//0503
/*
 * Original work Copyright (C) 2026 gwog :3 (SyST3MDeV/Undaunted)
 * Modified work Copyright (C) 2026 MysticFox / Pranav Karande (pranav158/Mystic-Paradox)
 *
 * Licensed under the GNU Affero General Public License v3.0.
 * You may obtain a copy of the License at the root of this repository.
 *
 * SPDX-License-Identifier: AGPL-3.0-only
 * Additional terms under AGPLv3 Section 7 apply. See ADDITIONAL_TERMS.md.
 */

#include <windows.h>
#include <shellapi.h>
#include <tlhelp32.h>
#include <psapi.h>   // [2026-10-10] GetProcessMemoryInfo -> K32GetProcessMemoryInfo in kernel32 (PSAPI_VERSION 2); no psapi.lib
#include <string>
#include <set>
#include <algorithm>
#include <cctype>
#include <cmath>
#include <cstdlib>   // atof — used by BleedoutDurationFallback()
#include <deque>
#include <unordered_map>
#include <unordered_set>
#include <vector>
#include <thread>
#include <iostream>
#include <ranges>

#include "framework.h"
#include "SDK.hpp"
#include "MinHook/MinHook.h"
#include "constants.h"
#include "Networking.h"
#include "RuntimeShared.h"
#include "P2PHooks.h"
#include "deployment_config.generated.h"
#include "BackendUrl.h"
#include "resource.h"

#include "SDK/GameplayAbilities_parameters.hpp"
#include "SDK/Archon_parameters.hpp"
#include "SDK/lantern_equipped_ab_parameters.hpp"
#include "SDK/base_gameobject_bp_parameters.hpp"

#include <cwchar>
#include <fstream>
#include <iomanip>
#include <intrin.h>
#include <malloc.h>
#include <mutex>
#include <sstream>

using namespace SDK;

// [1.14.7 2026-10-04] The watchdog's availability probe binds our own UDP port to test whether the hub is
// still listening. Networking.cpp pulls Winsock in through its own translation unit, so this one needs the
// import library explicitly.
#pragma comment(lib, "ws2_32.lib")

// [1.14.7 loader state dump] defined later in this file; used by the watchdog thread.
static void DumpLoadManagerEntries(const char* Tag);
// [2026-10-13 realms S1] defined with the URL redirect below; Init resolves the backend address, MainThread logs it.
static void MpResolveBackendAddress();
static void MpLogBackendAddress();
// [1.14.7 active hunt pass] defined later; used by the readiness predicate hook.
static void* g_archonGameInstanceForHuntPass = nullptr;
static void CallFindActiveHuntPassRow(const char* Why);

namespace Globals {
    enum class ServerAuthMode {
        GlobalGameserver,
        HuntCapability,
        Invalid
    };

    bool AmServer = false;
    uintptr_t BaseAddress = 0x0;
    bool Listening = false;
    bool DoListen = false;
    // [1.14.7 2026-10-03] Set when the map URL carries ?listen (MAP_URL_LISTEN.flag): the engine
    // builds the GameNetDriver during map load, so the runtime waits for UWorld::NetDriver
    // (UWorld+0x38) instead of creating one by hand - the manual path is what leaves the world
    // context invalid on 1.14.7.
    bool WaitingForEngineListener = false;
    const wchar_t* ServerAPIKey = nullptr;
    const wchar_t* MapPath = nullptr;
    const wchar_t* BehemothPath = nullptr;
    const wchar_t* MatchmakerHuntId = nullptr;
    const wchar_t* ExpectedPlayerString = nullptr;
    int Port = 0;
    const wchar_t* MyIpAndPort = nullptr;

    bool EnableLogging = true;
    // HuntCapability is the optional player-hosted mode (P2PHooks.h); only the module can select it.
    static ServerAuthMode AuthMode = ServerAuthMode::GlobalGameserver;

    // Boot-patch status recorded during InitServerHooks (where InitLog is a loader-lock no-op) and emitted
    // later from MainThread via MpLog so it is actually visible. (Named after the removed 1.12 Move10 patches;
    // today it carries the WARP force status.)
    static std::string Move10Status;

    static std::wstring ServerAPIKeyStorage;
    static std::wstring MapPathStorage;
    static std::wstring BehemothPathStorage;
    static std::wstring MatchmakerHuntIdStorage;
    static std::wstring ExpectedPlayerStringStorage;
    static std::wstring MyIpAndPortStorage;
}

// Loader-lock safe no-op: DllMain/Init must not do logging or file I/O.
static void InitLog(const std::string& Msg) {
    (void)Msg;
}

// [2026-10-09] Set by DllMain on DLL_PROCESS_DETACH, which the loader calls before this module's C runtime
// shuts down. From then on MpLog writes nothing and the exit/exception hooks only forward. Process exit
// runs RtlExitUserProcess -> NtTerminateProcess(NULL) -> DLL detach -> NtTerminateProcess(self); the last
// call went through NtTerminateProcessHook, whose MpLog opened a std::ofstream after the CRT had freed its
// stream table, and every client exit ended in 0xC0000005 (MSVCP140 +0x4c950 under /MD, this DLL's
// stream-slot search reading 0+0x18 under /MT).
static volatile LONG g_MpProcessDetaching = 0;
static bool MpProcessDetaching() {
    return InterlockedCompareExchange(&g_MpProcessDetaching, 0, 0) != 0;
}

// Log directory derived from the game .exe path so diagnostics also appear on the VPS
// (the previous hardcoded dev-box debug path only existed on one PC, so the DLL
// wrote NOTHING on the VPS). File-scope POD, filled once - no lazy constructor, so it is
// safe to touch under the loader lock (see the MpLogUrlObservation crash note below).
static char g_MpLogDir[MAX_PATH] = { 0 };
static volatile LONG g_MpLogDirReady = 0;
static const char* MpLogDir() {
    if (g_MpLogDirReady == 0) {
        char ExePath[MAX_PATH];
        DWORD n = GetModuleFileNameA(nullptr, ExePath, MAX_PATH);
        if (n > 0 && n < MAX_PATH) {
            int slash = -1;
            for (DWORD i = 0; i < n; ++i) { if (ExePath[i] == '\\' || ExePath[i] == '/') { slash = (int)i; } }
            if (slash >= 0) {
                for (int i = 0; i <= slash; ++i) { g_MpLogDir[i] = ExePath[i]; }
                g_MpLogDir[slash + 1] = '\0';
            }
        }
        InterlockedExchange(&g_MpLogDirReady, 1);
    }
    return g_MpLogDir;
}

// [A/B 2026-07-16] Generic exe-relative sentinel-flag check (same convention as
// MP_FORCE_WARP.flag): true iff <game-exe-dir>\<FileName> exists. Exe-relative so it works on
// the VPS.
// [2026-10-10 1.14.7 CPU] Cached per name for 4 s. It used to call GetModuleFileNameW, build a std::wstring and
// probe the file system on EVERY call, and about four call sites run every server frame (plus one per replicated
// actor added to the graph). Now:
//   * the exe directory is resolved once (MpResolveExeDirW, first thing in Init; never with a lock held) into POD
//     storage published through an interlocked ready state;
//   * each name's answer is kept in a fixed POD table (128 names x 64 chars) behind an SRWLOCK (constant-initialised,
//     loader-lock safe); the lock covers only the table scan, never GetModuleFileNameW or the file probe;
//   * a name is re-probed at most once every 4000 ms, so creating or deleting a live A/B flag (for example
//     DISABLE_PLAYER_ROLE_GLOBAL_ROUTE.flag) takes effect within 4 s, and both of that flag's read sites see the
//     same answer. A flag created and deleted again within 4 s may be missed. Call sites that keep the answer in a
//     static (read-once flags) still read once and keep it for the process lifetime;
//   * no heap and no CRT state, so it stays usable late in shutdown.
// A name of 64+ chars, a full table, or UNCACHED_FLAG_FILES.flag (probed directly, once) probes on every call, as
// before.
static wchar_t g_MpExeDirW[MAX_PATH] = { 0 };
static size_t g_MpExeDirLenW = 0;
static volatile LONG g_MpExeDirState = 0;   // 0 = not resolved, 1 = being published, 2 = ready

// Writes the exe path to Out and returns the length of its directory part (with the trailing separator); 0 on failure.
static size_t MpExeDirFromModuleW(wchar_t (&Out)[MAX_PATH]) {
    const DWORD n = GetModuleFileNameW(nullptr, Out, MAX_PATH);
    if (n == 0 || n >= MAX_PATH) return 0;
    size_t Len = 0;
    for (DWORD i = 0; i < n; ++i) { if (Out[i] == L'\\' || Out[i] == L'/') Len = static_cast<size_t>(i) + 1; }
    return Len;
}

static void MpResolveExeDirW() {
    if (InterlockedCompareExchange(&g_MpExeDirState, 0, 0) == 2) return;
    wchar_t Local[MAX_PATH];
    const size_t Len = MpExeDirFromModuleW(Local);
    if (Len == 0) return;   // stays unresolved: every probe looks the path up itself (the old behaviour)
    if (InterlockedCompareExchange(&g_MpExeDirState, 1, 0) != 0) return;   // another thread publishes the same path
    for (size_t i = 0; i < Len; ++i) g_MpExeDirW[i] = Local[i];
    g_MpExeDirW[Len] = L'\0';
    g_MpExeDirLenW = Len;
    InterlockedExchange(&g_MpExeDirState, 2);
}

static bool MpProbeExeRelativeFile(const wchar_t* Name, size_t NameLen) {
    wchar_t Path[MAX_PATH];
    size_t DirLen = 0;
    if (InterlockedCompareExchange(&g_MpExeDirState, 0, 0) == 2) {
        DirLen = g_MpExeDirLenW;
        for (size_t i = 0; i < DirLen; ++i) Path[i] = g_MpExeDirW[i];
    } else {
        DirLen = MpExeDirFromModuleW(Path);
    }
    if (DirLen == 0 || DirLen + NameLen + 1 > MAX_PATH) return false;
    for (size_t i = 0; i < NameLen; ++i) Path[DirLen + i] = Name[i];
    Path[DirLen + NameLen] = L'\0';
    return GetFileAttributesW(Path) != INVALID_FILE_ATTRIBUTES;
}

struct MpFlagCacheEntry { wchar_t Name[64]; size_t Len; bool Present; ULONGLONG CheckedMs; };
static MpFlagCacheEntry g_MpFlagCache[128] = {};
static int g_MpFlagCacheCount = 0;
static SRWLOCK g_MpFlagCacheLock = SRWLOCK_INIT;
static volatile LONG g_MpFlagCacheMode = -1;   // -1 = not decided, 1 = cached, 0 = UNCACHED_FLAG_FILES.flag
static constexpr ULONGLONG kMpFlagRecheckMs = 4000;

// Decided once: UNCACHED_FLAG_FILES.flag is probed directly (never cached) on the first call.
static LONG MpDecideFlagCacheMode() {
    const LONG Mode = InterlockedCompareExchange(&g_MpFlagCacheMode, 0, 0);
    if (Mode >= 0) return Mode;
    static const wchar_t kOff[] = L"UNCACHED_FLAG_FILES.flag";
    const LONG Decided = MpProbeExeRelativeFile(kOff, (sizeof(kOff) / sizeof(kOff[0])) - 1) ? 0 : 1;
    InterlockedCompareExchange(&g_MpFlagCacheMode, Decided, -1);
    return InterlockedCompareExchange(&g_MpFlagCacheMode, 0, 0);
}

bool MpExeRelativeFlagPresent(const wchar_t* FileName) {
    if (!FileName) { return false; }
    size_t Len = 0;
    while (FileName[Len] && Len < MAX_PATH) ++Len;
    MpResolveExeDirW();
    if (MpDecideFlagCacheMode() != 1 || Len >= 64) return MpProbeExeRelativeFile(FileName, Len);

    const ULONGLONG Now = GetTickCount64();
    int Slot = -1;
    AcquireSRWLockExclusive(&g_MpFlagCacheLock);
    for (int i = 0; i < g_MpFlagCacheCount; ++i) {
        const MpFlagCacheEntry& E = g_MpFlagCache[i];
        if (E.Len != Len) continue;
        size_t k = 0;
        while (k < Len && E.Name[k] == FileName[k]) ++k;
        if (k == Len) { Slot = i; break; }
    }
    if (Slot < 0 && g_MpFlagCacheCount < static_cast<int>(sizeof(g_MpFlagCache) / sizeof(g_MpFlagCache[0]))) {
        Slot = g_MpFlagCacheCount++;
        MpFlagCacheEntry& E = g_MpFlagCache[Slot];
        for (size_t k = 0; k < Len; ++k) E.Name[k] = FileName[k];
        E.Name[Len] = L'\0';
        E.Len = Len;
        E.Present = false;
        E.CheckedMs = 0;
    }
    if (Slot >= 0 && g_MpFlagCache[Slot].CheckedMs != 0 && Now - g_MpFlagCache[Slot].CheckedMs < kMpFlagRecheckMs) {
        const bool Present = g_MpFlagCache[Slot].Present;
        ReleaseSRWLockExclusive(&g_MpFlagCacheLock);
        return Present;
    }
    ReleaseSRWLockExclusive(&g_MpFlagCacheLock);

    const bool Present = MpProbeExeRelativeFile(FileName, Len);   // outside the lock
    if (Slot >= 0) {
        AcquireSRWLockExclusive(&g_MpFlagCacheLock);
        g_MpFlagCache[Slot].Present = Present;
        g_MpFlagCache[Slot].CheckedMs = Now ? Now : 1;
        ReleaseSRWLockExclusive(&g_MpFlagCacheLock);
    }
    return Present;
}

static const char* MpFlagCacheModeText() {
    const LONG Mode = InterlockedCompareExchange(&g_MpFlagCacheMode, 0, 0);
    return Mode == 1 ? "ON (each flag file re-checked at most every 4 s)"
        : Mode == 0 ? "OFF (UNCACHED_FLAG_FILES.flag: every check probes the file)"
                    : "not decided yet";
}

/*
 * [2026-07-19] VERBOSE_DIAG.flag — master switch for high-volume per-tick / startup tracing.
 *
 * WHY: production DLL logs were reaching 24-32 MB per hunt. That is not just disk — every line is a
 * formatted write from the game thread, and a blocked write is what deadlocked the server (see the
 * stdout-pipe stall in Progress/13_HUNT_SERVERS.md). Less log volume is less exposure to that class
 * of failure, and it makes the logs that remain actually readable.
 *
 * WHAT STAYS ON UNCONDITIONALLY (deliberately — these are rare, load-bearing, or diagnose the
 * intermittent bugs we cannot reproduce on demand):
 *   [Bleedout*]      bleedout domain — the permanent-downed bug is intermittent; no second chance
 *   [Watchdog/thread][HangSuspect][HangTrace]  hang + reap diagnosis (raw current PE pointers)
 *   [ExitTrace][ExceptionTrace]                crash forensics
 *   [Lifecycle:*][NetConnEdge][PossessionRPC]  low-volume, edge-triggered
 *                    ([2026-10-11] PRODUCTION_LOG_PROFILE.flag turns [Lifecycle:*] and [PossessionRPC] off on a
 *                    server, with the other per-event traces listed at MpProductionLogProfile; [NetConnEdge] stays)
 *   [HuntTableGap][BleedoutBUG][BleedoutStuck] one-shot problem markers
 *
 * WHAT THIS FLAG NOW GATES:
 *   [NetTickTrace]        per-tick net trace (budgeted, but still noise every launch)
 *   [GetGameDefaultMap]   fires on every map-name query
 *   recentPE name ring    copies every ProcessEvent name; enable only for targeted hang captures
 *
 * ALREADY GATED ELSEWHERE (unchanged, listed so nobody re-gates them):
 *   [RepFreq]                     REPGRAPH_DIAG.flag — the hook is only installed when set
 *   [GraphState] [ActorsNoConn]   REPGRAPH_DIAG.flag via RepGraphDiagNet() in Networking.cpp
 *   [SRA enter]/[SRA exit]        REPGRAPH_DIAG.flag
 * If a log is huge and full of [RepFreq]/[GraphState], REPGRAPH_DIAG.flag is present on the box —
 * remove it rather than editing code.
 */
bool DevelopmentRuntimeProfile() {
    static int Cached = -1;
    if (Cached >= 0) return Cached == 1;

    char Profile[32]{};
    const DWORD Length = GetEnvironmentVariableA(
        "MYSTICPARADOX_RUNTIME_PROFILE", Profile, static_cast<DWORD>(std::size(Profile)));
    Cached = (Length == 11 && strcmp(Profile, "development") == 0) ? 1 : 0;
    return Cached == 1;
}

static bool VerboseDiag() {
    static int Cached = -1;
    if (Cached < 0) {
        // A hand-created flag on an untrusted player machine is never sufficient. The launcher
        // must also inject the centrally authorized development runtime profile for this process.
        Cached = DevelopmentRuntimeProfile() && MpExeRelativeFlagPresent(L"VERBOSE_DIAG.flag") ? 1 : 0;
    }
    return Cached == 1;
}

/*
 * [2026-10-11 1.14.7 O3 PRODUCTION LOG PROFILE] PRODUCTION_LOG_PROFILE.flag (default OFF, read once, servers only)
 * silences the per-event diagnostic traces that a populated hub repeats for every player, join and RPC:
 *   [HuntPassState] [ArrivalTrigger] (server lines) [EconTrace] [PlayerRoleChannel] [PostLoginPE] [PossessionRPC]
 *   [Lifecycle:*] [EscalationFlow][Server] [SendPath] [FrankDroneDiag][Server] [PlayerRoleDirectChannel]
 *   [WeaponXP][ServerKill]/[ServerGrant]/[ServerPlayerGrant] [TempestPerfectDodge][Server] [GrantTrace]
 *   [CooldownTrace] [PAWN #] [TickDispatchInner] (periodic heartbeat)
 * Only log lines are skipped: every write, guard, retry and fix that sits next to them still runs. Clients ignore the
 * flag (it lives next to the shared game exe on a test box), so the client log stays complete.
 */
bool MpProductionLogProfile() {
    static volatile LONG s_mode = -1;   // -1 = not decided, 0 = off, 1 = on
    LONG Mode = s_mode;                 // plain aligned read once decided
    if (Mode < 0) {
        Mode = (Globals::AmServer && MpExeRelativeFlagPresent(L"PRODUCTION_LOG_PROFILE.flag")) ? 1 : 0;
        InterlockedExchange(&s_mode, Mode);
    }
    return Mode == 1;
}

/*
 * [1.12.0] Persistent, flushed diagnostic log from MainThread/hooks only.
 * One file per server port so concurrently-spawned gameservers don't clobber each other.
 * Writes next to the game .exe (see MpLogDir) so logs are visible on the VPS too.
 *
 * [2026-10-11 1.14.7 O3 log writer] Every line used to construct a std::ofstream: open, format, flush, close - a
 * CreateFile + WriteFile + CloseHandle round trip plus CRT stream setup per line, on whatever thread logged. That is
 * expensive on Windows and much worse under Wine (each open is a wineserver path walk). The file now stays open:
 * one handle with FILE_APPEND_DATA, shared read/write/delete (tail -f, Networking.cpp's writer and rotation keep
 * working), and one WriteFile per line straight into the OS cache - no CRT buffering, so a crash loses nothing that
 * MpLog returned from. Same text format. Kept rules: nothing after DLL_PROCESS_DETACH (g_MpProcessDetaching) and no
 * CRT stream object on this path. The handle follows Globals::Port (port 0 until Init parses it) and is reopened when
 * the file was deleted or renamed away (file id compared at most every 5 s). The lock is only TRIED: a thread that
 * cannot take it within a few ms (its owner killed by process exit, or a VEH line raised inside a write) writes its line
 * through a private open/append/close instead, so logging can never deadlock. MPLOG_OPEN_PER_LINE.flag (read once)
 * restores the old per-line std::ofstream path.
 */
static SRWLOCK g_MpLogLock = SRWLOCK_INIT;
static HANDLE g_MpLogHandle = INVALID_HANDLE_VALUE;   // guarded by g_MpLogLock
static int g_MpLogHandlePort = -1;
static ULONGLONG g_MpLogIdCheckMs = 0;
static volatile LONG g_MpLogMode = -1;   // -1 = not decided, 1 = one open handle, 0 = MPLOG_OPEN_PER_LINE.flag

static LONG MpLogMode() {
    LONG Mode = InterlockedCompareExchange(&g_MpLogMode, 0, 0);
    if (Mode < 0) {
        Mode = MpExeRelativeFlagPresent(L"MPLOG_OPEN_PER_LINE.flag") ? 0 : 1;
        InterlockedExchange(&g_MpLogMode, Mode);
    }
    return Mode;
}

static HANDLE MpLogOpenAppend(const char* Path) {
    return CreateFileA(Path, FILE_APPEND_DATA, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr,
        OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, nullptr);
}

static void MpLogWriteOnce(const char* Path, const char* Data, DWORD Len) {
    const HANDLE H = MpLogOpenAppend(Path);
    if (H == INVALID_HANDLE_VALUE) return;
    DWORD Written = 0;
    WriteFile(H, Data, Len, &Written, nullptr);
    CloseHandle(H);
}

// True while the open handle still names the file at Path: not deleted, same volume and file index.
static bool MpLogHandleStillCurrent(HANDLE H, const char* Path) {
    BY_HANDLE_FILE_INFORMATION Mine{};
    if (!GetFileInformationByHandle(H, &Mine) || Mine.nNumberOfLinks == 0) return false;
    const HANDLE P = CreateFileA(Path, FILE_READ_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
        nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
    if (P == INVALID_HANDLE_VALUE) return false;
    BY_HANDLE_FILE_INFORMATION Theirs{};
    const bool Ok = GetFileInformationByHandle(P, &Theirs) != FALSE;
    CloseHandle(P);
    return Ok && Theirs.dwVolumeSerialNumber == Mine.dwVolumeSerialNumber
        && Theirs.nFileIndexHigh == Mine.nFileIndexHigh && Theirs.nFileIndexLow == Mine.nFileIndexLow;
}

// One complete line (already terminated) into the per-port file. Port is the one Path was built for.
static void MpLogWriteLine(const char* Path, int Port, const char* Data, DWORD Len) {
    bool Locked = false;
    for (int Try = 0; Try < 52 && !Locked; ++Try) {
        Locked = TryAcquireSRWLockExclusive(&g_MpLogLock) != FALSE;
        if (Locked) break;
        if (Try < 32) YieldProcessor();
        else if (Try < 48) SwitchToThread();
        else Sleep(1);
    }
    if (!Locked) {
        MpLogWriteOnce(Path, Data, Len);
        return;
    }
    const ULONGLONG NowMs = GetTickCount64();
    if (g_MpLogHandle != INVALID_HANDLE_VALUE && g_MpLogHandlePort != Port) {
        CloseHandle(g_MpLogHandle);
        g_MpLogHandle = INVALID_HANDLE_VALUE;
    }
    if (g_MpLogHandle != INVALID_HANDLE_VALUE && NowMs - g_MpLogIdCheckMs >= 5000) {
        g_MpLogIdCheckMs = NowMs;
        if (!MpLogHandleStillCurrent(g_MpLogHandle, Path)) {
            CloseHandle(g_MpLogHandle);
            g_MpLogHandle = INVALID_HANDLE_VALUE;
        }
    }
    if (g_MpLogHandle == INVALID_HANDLE_VALUE) {
        g_MpLogHandle = MpLogOpenAppend(Path);
        g_MpLogHandlePort = Port;
        g_MpLogIdCheckMs = NowMs;
    }
    if (g_MpLogHandle != INVALID_HANDLE_VALUE) {
        DWORD Written = 0;
        if (!WriteFile(g_MpLogHandle, Data, Len, &Written, nullptr)) {
            CloseHandle(g_MpLogHandle);           // reopened by the next line
            g_MpLogHandle = INVALID_HANDLE_VALUE;
        }
    }
    ReleaseSRWLockExclusive(&g_MpLogLock);
}

// Prefix + body + "\n" in one buffer (stack for ordinary lines), then one write.
static void MpLogEmit(const char* Path, int Port, const char* Prefix, size_t PrefixLen, const std::string& Msg) {
    const size_t Total = PrefixLen + Msg.size() + 1;
    if (Total > 0x7FFFFFFFu) return;
    char Stack[2048];
    std::string Heap;
    char* Buf = Stack;
    if (Total > sizeof(Stack)) {
        Heap.resize(Total);
        Buf = &Heap[0];
    }
    if (PrefixLen) memcpy(Buf, Prefix, PrefixLen);
    if (!Msg.empty()) memcpy(Buf + PrefixLen, Msg.data(), Msg.size());
    Buf[Total - 1] = '\n';
    MpLogWriteLine(Path, Port, Buf, static_cast<DWORD>(Total));
}

void MpLog(const std::string& Msg) {
    if (MpProcessDetaching()) {
        return;
    }
    char Path[MAX_PATH];
    const int Port = Globals::Port;
    sprintf_s(Path, "%smysticparadox_dll_port%d.log", MpLogDir(), Port);

    if (MpLogMode() == 0) {
        // MPLOG_OPEN_PER_LINE.flag: the pre-11-Oct writer, unchanged.
        std::ofstream File(Path, std::ios::app);

        if (File.is_open()) {
            SYSTEMTIME Now{};
            GetLocalTime(&Now);
            File << "["
                 << std::setfill('0') << std::setw(2) << Now.wHour << ":"
                 << std::setfill('0') << std::setw(2) << Now.wMinute << ":"
                 << std::setfill('0') << std::setw(2) << Now.wSecond << "."
                 << std::setfill('0') << std::setw(3) << Now.wMilliseconds << "] "
                 << "pid=" << GetCurrentProcessId() << " "
                 << Msg << "\n";
            File.flush();
        }
        return;
    }

    SYSTEMTIME Now{};
    GetLocalTime(&Now);
    char Prefix[64];
    const int PrefixLen = sprintf_s(Prefix, "[%02d:%02d:%02d.%03d] pid=%lu ", static_cast<int>(Now.wHour),
        static_cast<int>(Now.wMinute), static_cast<int>(Now.wSecond), static_cast<int>(Now.wMilliseconds),
        static_cast<unsigned long>(GetCurrentProcessId()));
    MpLogEmit(Path, Port, Prefix, PrefixLen > 0 ? static_cast<size_t>(PrefixLen) : 0, Msg);
}

// [2026-10-11 1.14.7 O3] Networking.cpp's NetLog (no timestamp prefix, its own port argument) through the same writer.
// A line for another port than the open handle's is written with a private open so the shared handle never thrashes.
void MpLogRawPort(int Port, const std::string& Msg) {
    if (MpProcessDetaching()) return;
    char Path[MAX_PATH];
    sprintf_s(Path, "%smysticparadox_dll_port%d.log", MpLogDir(), Port);
    if (MpLogMode() == 0) {
        std::ofstream File(Path, std::ios::app);
        if (File.is_open()) {
            File << Msg << "\n";
            File.flush();
        }
        return;
    }
    if (Port != Globals::Port) {
        std::string Line = Msg;
        Line.push_back('\n');
        if (Line.size() <= 0x7FFFFFFFu) MpLogWriteOnce(Path, Line.data(), static_cast<DWORD>(Line.size()));
        return;
    }
    MpLogEmit(Path, Port, nullptr, 0, Msg);
}

bool MpReadEnvironment(const char* Name, std::string& Value, size_t Maximum) {
    Value.clear();
    char Buffer[512]{};
    const DWORD Length = GetEnvironmentVariableA(Name, Buffer, static_cast<DWORD>(sizeof(Buffer)));
    if (Length == 0 || Length >= sizeof(Buffer) || Length > Maximum) return false;
    Value.assign(Buffer, Length);
    return Value.find('\0') == std::string::npos && Value.find('\r') == std::string::npos &&
        Value.find('\n') == std::string::npos;
}

bool IsReadablePointer(const void* Ptr, size_t Size) {
    if (!Ptr || ((uintptr_t)Ptr & 0x7) != 0) {
        return false;
    }

    MEMORY_BASIC_INFORMATION Info{};
    if (!VirtualQuery(Ptr, &Info, sizeof(Info))) {
        return false;
    }

    if (Info.State != MEM_COMMIT || (Info.Protect & (PAGE_GUARD | PAGE_NOACCESS))) {
        return false;
    }

    uintptr_t Start = reinterpret_cast<uintptr_t>(Ptr);
    uintptr_t End = Start + Size;
    uintptr_t RegionEnd = reinterpret_cast<uintptr_t>(Info.BaseAddress) + Info.RegionSize;
    return End >= Start && End <= RegionEnd;
}

/*
 * [2026-10-11 1.14.7 O3 VirtualQuery] IsReadablePointer is a VirtualQuery system call (a wineserver round trip under
 * Wine), and the server's net path asked it about the same few pointers ~20 + 4N times per frame: the NetDriver and
 * every client connection, in SanitizeNetDriverClientConnections (three times a frame: the engine's TickDispatch hook
 * and before the manual dispatch and flush), the tick hook's two connection loops, the graph drive and the player-role
 * route checks. MpReadableThisFrame remembers a POSITIVE answer for one segment of the server game thread's frame and
 * answers repeats from a 256-slot table; a negative answer is never cached. The segment ("epoch") ends at the top of
 * GameEngineTickHook and on both sides of the native engine tick, which is where GC frees objects, so a remembered
 * answer never spans a GC. Other threads, and the client, always call IsReadablePointer. Only a few call sites (the
 * net driver / connection / graph checks listed above) use it; it is not a liveness test and was never meant to be
 * one. NO_FRAME_POINTER_CACHE.flag (read once) sends every call to IsReadablePointer.
 */
struct MpReadableCacheSlot { const void* Ptr; size_t Size; uint32_t Epoch; };
static MpReadableCacheSlot g_MpReadableCache[256] = {};
static uint32_t g_MpReadableEpoch = 1;
static DWORD g_MpReadableCacheThread = 0;   // the server game thread, set by GameEngineTickHook; 0 = cache unused
static int g_MpReadableCacheMode = -1;      // -1 = not decided, 1 = on, 0 = NO_FRAME_POINTER_CACHE.flag

// Game thread only.
static void MpReadableCacheNextEpoch() {
    if (++g_MpReadableEpoch == 0) {
        for (MpReadableCacheSlot& Slot : g_MpReadableCache) Slot.Epoch = 0;
        g_MpReadableEpoch = 1;
    }
}

static bool MpReadableThisFrame(const void* Ptr, size_t Size) {
    if (g_MpReadableCacheMode != 1 || g_MpReadableCacheThread == 0 || GetCurrentThreadId() != g_MpReadableCacheThread) {
        return IsReadablePointer(Ptr, Size);
    }
    if (!Ptr || (reinterpret_cast<uintptr_t>(Ptr) & 0x7) != 0) return false;
    const uintptr_t P = reinterpret_cast<uintptr_t>(Ptr);
    MpReadableCacheSlot& Slot = g_MpReadableCache[((P >> 3) ^ (P >> 12)) & 0xFF];
    if (Slot.Ptr == Ptr && Slot.Epoch == g_MpReadableEpoch && Slot.Size >= Size) return true;
    if (!IsReadablePointer(Ptr, Size)) return false;
    if (Slot.Ptr != Ptr || Slot.Epoch != g_MpReadableEpoch || Slot.Size < Size) {
        Slot.Ptr = Ptr;
        Slot.Size = Size;
        Slot.Epoch = g_MpReadableEpoch;
    }
    return true;
}

// [2026-07-24 ROOT-CAUSE FIX for the Ramsgate->Training "new player" crash] Robust UObject liveness
// check. IsReadablePointer above only proves memory is currently MAPPED - it cannot distinguish a live
// object from one whose memory was freed (and possibly reused) after a level travel, because UE recycles
// freed UObject memory, so a stale pointer stays "readable" while pointing at a dead/foreign object.
// Passing such a pointer to native game code (ApplyPlayerRole, the HUD lifecycle functions) faults deep
// inside the game - and catching that fault with SEH is NOT enough: the fault already happened partway
// through native game code, corrupting the game's own state mid-call, so the process still dies a moment
// later (proven by "vps logs copied/Training pawn issue/4": the SEH guard logged FAULTED...caught, then
// the log ends - the process died right after the catch).
//
// This instead confirms the pointer is still a currently-registered live object by looking it up in the
// engine's global object array (the same GUObjectArray the server block already walks every frame). Once
// a level travel destroys the old world's loadout/PC/HUD, that object is no longer any slot's .Object, so
// this returns false and the caller SKIPS the native call entirely - the fault never happens, so there is
// nothing to corrupt. This is PREVENTION; the SEH guards elsewhere remain only as a last-resort backstop.
// SEH-guarded (no std::string locals here, so __try is legal) against a transient array-read race; the
// array lives on the game thread and GC runs on the same thread, so no concurrent-mutation risk.
bool IsRegisteredLiveObject(const void* Ptr) {
    if (!Ptr) return false;
    __try {
        // O(1) liveness: every live UObject stores its own slot index (UObject::Index @ 0x0C) and
        // GObjects.GetByIndex is bounds-safe, so a live object round-trips: GetByIndex(obj->Index)==obj.
        // A destroyed object no longer owns that slot - after a level travel the slot is either nulled
        // or taken by a different object (different address), so the round-trip fails and we return
        // false, and the caller skips the native call. Reading Index from freed-but-recycled memory is
        // harmless under __try (it just yields a non-matching index -> false). This replaces the prior
        // full O(n) GObjects scan (~hundreds of thousands of entries) that ran on the game thread on
        // every call from the client-side pumps below.
        const int32_t Index = reinterpret_cast<const UObject*>(Ptr)->Index;
        return reinterpret_cast<const void*>(UObject::GObjects->GetByIndex(Index)) == Ptr;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;   // memory momentarily unreadable -> treat as not-live (caller safely skips)
    }
}

// A UObject can remain registered during the first stage of AActor destruction. That makes the
// GObjects round-trip above necessary but insufficient for replication/channel work: the object is
// still discoverable while native teardown has already invalidated fields used by SetChannelActor and
// ReplicateActor. Actor+0x5C bit 0x08 is the verified bActorIsBeingDestroyed flag in the 1.12 build
// (observed directly in RouteRemoveNetworkActorToNodes). UObject flags also reject BeginDestroyed and
// FinishDestroyed states as a second boundary. Never call native route/bootstrap APIs after this gate
// fails; purge the compatibility caches instead.
static bool IsActorSafeForReplicationLifecycle(const void* Ptr) {
    if (!Ptr || !IsReadablePointer(Ptr, 0x60) || !IsRegisteredLiveObject(Ptr)) return false;
    __try {
        constexpr uint32_t kRF_BeginDestroyed = 0x00008000u;
        constexpr uint32_t kRF_FinishDestroyed = 0x00010000u;
        const uint32_t ObjectFlags = *reinterpret_cast<const uint32_t*>(
            reinterpret_cast<uintptr_t>(Ptr) + 0x08);
        const uint8_t ActorFlags5C = *reinterpret_cast<const uint8_t*>(
            reinterpret_cast<uintptr_t>(Ptr) + 0x5C);
        return (ActorFlags5C & 0x08u) == 0
            && (ObjectFlags & (kRF_BeginDestroyed | kRF_FinishDestroyed)) == 0;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

static bool IsSanePointerArray(void* Data, int32_t Num, int32_t Max, int32_t Limit) {
    if (Num < 0 || Max < 0 || Num > Max || Num > Limit) {
        return false;
    }

    if (Num == 0) {
        return true;
    }

    return IsReadablePointer(Data, static_cast<size_t>(Num) * sizeof(void*));
}

// Narrow a wide string for logging (URLs/paths are ASCII, so a direct copy is fine).
static std::string MpNarrow(const std::wstring& W) {
    std::string Out;
    Out.reserve(W.size());
    for (wchar_t Ch : W) {
        Out.push_back(static_cast<char>(Ch));
    }
    return Out;
}

std::string MpPtr(const void* Ptr) {
    return Ptr ? std::to_string(reinterpret_cast<uintptr_t>(Ptr)) : "null";
}

static void MpReapExit(const char* Reason);   // defined with the empty-server watchdog below

// Game thread only.
// [2026-10-11 1.14.7 P2P host] Servers exit through MpReapExit. UKismetSystemLibrary::QuitGame (0x03EE3FD0) with no
// SpecificPlayer asks GetPlayerController(World, 0) (0x03E2F520) for a target and returns at once when there is none -
// always the case on a server with no client since the local player was removed (0.2.110/0.2.111) - and when it does
// find one (a remote player's controller) it runs the console command "quit" through that player, which at best
// reaches UE's exit teardown: the path that hangs 60 s and aborts on this build (see MpReapExit). So every player-host
// fence (P2PHooks::TickShutdown) ended in its 5 s TerminateProcess(0xE105) fallback. A server keeps nothing in process
// (persistence is in the Metagame), so it now ends the way the empty-server reap does: TerminateProcess(0). The client
// keeps QuitGame. SERVER_QUITGAME_EXIT.flag reverts servers to QuitGame (read once).
void MpQuitGame() {
    if (Globals::AmServer) {
        static const bool UseQuitGame = MpExeRelativeFlagPresent(L"SERVER_QUITGAME_EXIT.flag");
        if (!UseQuitGame) {
            MpLog("[ServerQuit] quit requested on a server; ending through the reap path (QuitGame does nothing "
                  "without a local PlayerController; SERVER_QUITGAME_EXIT.flag reverts)");
            MpReapExit("server quit (MpQuitGame)");
            return;
        }
        MpLog("[ServerQuit] SERVER_QUITGAME_EXIT.flag present: UKismetSystemLibrary::QuitGame (old path)");
    }
    UKismetSystemLibrary::QuitGame(UWorld::GetWorld(), nullptr, EQuitPreference::Quit, true);
}

static std::string MpHex(uintptr_t Value) {
    std::ostringstream Stream;
    Stream << "0x" << std::uppercase << std::hex << Value;
    return Stream.str();
}

// [2026-07-24 ACCESSORY-UNLOCK DIAG] Raw byte dump for a Parms buffer whose real struct layout
// (input args + ReturnValue offset) isn't known ahead of a live capture. Reads only through
// IsReadablePointer-guarded call sites, so this itself assumes the caller already checked readability.
static std::string DumpBytesHex(const void* Ptr, size_t Count) {
    std::ostringstream Stream;
    const uint8_t* Bytes = reinterpret_cast<const uint8_t*>(Ptr);
    Stream << std::uppercase << std::hex << std::setfill('0');
    for (size_t i = 0; i < Count; ++i) {
        if (i) Stream << ' ';
        Stream << std::setw(2) << static_cast<unsigned>(Bytes[i]);
    }
    return Stream.str();
}

static std::string MpBaseName(const char* Path) {
    if (!Path || !Path[0]) {
        return "(unknown)";
    }

    const char* Base = Path;
    for (const char* Cursor = Path; *Cursor; ++Cursor) {
        if (*Cursor == '\\' || *Cursor == '/') {
            Base = Cursor + 1;
        }
    }

    return std::string(Base);
}

static std::string MpAddress(const void* Ptr) {
    if (!Ptr) {
        return "null";
    }

    HMODULE Module = nullptr;
    if (GetModuleHandleExA(
        GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
        reinterpret_cast<LPCSTR>(Ptr),
        &Module)) {
        char ModulePath[MAX_PATH]{};
        GetModuleFileNameA(Module, ModulePath, MAX_PATH);
        uintptr_t Base = reinterpret_cast<uintptr_t>(Module);
        uintptr_t Address = reinterpret_cast<uintptr_t>(Ptr);
        return MpBaseName(ModulePath) + "+" + MpHex(Address - Base);
    }

    uintptr_t Base = Globals::BaseAddress ? Globals::BaseAddress : reinterpret_cast<uintptr_t>(GetModuleHandleA(nullptr));
    uintptr_t Address = reinterpret_cast<uintptr_t>(Ptr);
    if (Base && Address >= Base && Address < Base + 0x08000000) {
        return "Dauntless-Win64-Shipping.exe+" + MpHex(Address - Base);
    }

    return MpHex(Address);
}

static void MpLogStack(const std::string& Tag, uint32_t Code) {
    void* Frames[32]{};
    USHORT Count = CaptureStackBackTrace(1, static_cast<DWORD>(std::size(Frames)), Frames, nullptr);

    std::string Msg = "[ExitTrace] " + Tag + " code=" + std::to_string(Code) + " stack=";

    for (USHORT i = 0; i < Count; ++i) {
        if (i != 0) {
            Msg += " ";
        }

        Msg += MpAddress(Frames[i]);
    }

    MpLog(Msg);
}

using ExitProcessFn = void(WINAPI*)(UINT);
using RtlExitUserProcessFn = void(WINAPI*)(ULONG);
using TerminateProcessFn = BOOL(WINAPI*)(HANDLE, UINT);
using NtTerminateProcessFn = LONG(NTAPI*)(HANDLE, LONG);
using RaiseExceptionFn = void(WINAPI*)(DWORD, DWORD, DWORD, const ULONG_PTR*);
using CExitFn = void(__cdecl*)(int);
using AbortFn = void(__cdecl*)();

static ExitProcessFn OrigExitProcess = nullptr;
static RtlExitUserProcessFn OrigRtlExitUserProcess = nullptr;
static TerminateProcessFn OrigTerminateProcess = nullptr;
static NtTerminateProcessFn OrigNtTerminateProcess = nullptr;
static RaiseExceptionFn OrigRaiseException = nullptr;
static CExitFn OrigUcrtExit = nullptr;
static CExitFn OrigUcrtUnderscoreExit = nullptr;
static CExitFn OrigMsvcrtExit = nullptr;
static CExitFn OrigMsvcrtUnderscoreExit = nullptr;
static AbortFn OrigUcrtAbort = nullptr;
static AbortFn OrigMsvcrtAbort = nullptr;
static void* OrigUnhandledExceptionFilter = nullptr;
static PVOID VectoredExceptionHandle = nullptr;
static volatile LONG ExceptionTraceCount = 0;

// [DIAG 2026-07-09] Captured on first GameEngineTickHook entry so we can attribute
// exit/terminate callers by thread. Populated once via InterlockedCompareExchange so
// the very first tick wins even if the hook races (in practice UE4's game thread is
// serial, but the exchange is cheap insurance). Used only for diagnostic logging.
static volatile DWORD GameTickThreadId = 0;

// Resolve which loaded module (by base name) contains a given code address. Returns
// "?" if the address isn't in any mapped module. Used by the exit-hook diagnostics
// to identify whether TerminateProcess is being called from the game exe, libcef,
// our own DLL, or some other component.
static std::string MpModuleOfAddress(void* Addr) {
    if (!Addr) {
        return "null";
    }

    HMODULE Module = nullptr;
    if (!GetModuleHandleExW(
            GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
            reinterpret_cast<LPCWSTR>(Addr),
            &Module) || !Module) {
        return "?";
    }

    wchar_t PathW[MAX_PATH]{};
    DWORD PathLen = GetModuleFileNameW(Module, PathW, static_cast<DWORD>(std::size(PathW)));
    if (PathLen == 0) {
        return "?";
    }

    std::wstring Path(PathW, PathLen);
    size_t Slash = Path.find_last_of(L"\\/");
    std::wstring Base = (Slash == std::wstring::npos) ? Path : Path.substr(Slash + 1);
    return MpNarrow(Base);
}

// Compact diagnostic prefix logged on each exit-path hook. Captures which thread is
// terminating the process and which module holds the immediate caller — this is the
// smoking gun for "who initiated shutdown" (libcef IPC watchdog vs the game thread
// vs an unhandled AV in our own code).
static std::string MpExitDiag(void* ReturnAddress) {
    DWORD Tid = GetCurrentThreadId();
    DWORD GameTid = static_cast<DWORD>(InterlockedCompareExchange(
        reinterpret_cast<volatile LONG*>(&GameTickThreadId), 0, 0));

    std::string Msg = " tid=" + std::to_string(Tid);
    Msg += " gameTid=" + std::to_string(GameTid);
    Msg += " isGameThread=";
    Msg += (GameTid != 0 && Tid == GameTid) ? "1" : "0";
    Msg += " retAddr=" + MpAddress(ReturnAddress);
    Msg += " retModule=" + MpModuleOfAddress(ReturnAddress);

    return Msg;
}

void WINAPI ExitProcessHook(UINT ExitCode) {
    if (MpProcessDetaching()) {
        OrigExitProcess(ExitCode);
        return;
    }
    void* Caller = _ReturnAddress();
    MpLog("[ExitTrace] kernel32!ExitProcess entry code=" + std::to_string(ExitCode) + MpExitDiag(Caller));
    MpLogStack("kernel32!ExitProcess", ExitCode);
    OrigExitProcess(ExitCode);
}

void WINAPI RtlExitUserProcessHook(ULONG ExitCode) {
    if (MpProcessDetaching()) {
        OrigRtlExitUserProcess(ExitCode);
        return;
    }
    void* Caller = _ReturnAddress();
    MpLog("[ExitTrace] ntdll!RtlExitUserProcess entry code=" + std::to_string(ExitCode) + MpExitDiag(Caller));
    MpLogStack("ntdll!RtlExitUserProcess", ExitCode);
    OrigRtlExitUserProcess(ExitCode);
}

BOOL WINAPI TerminateProcessHook(HANDLE Process, UINT ExitCode) {
    if (MpProcessDetaching()) {
        return OrigTerminateProcess(Process, ExitCode);
    }
    void* Caller = _ReturnAddress();
    MpLog("[ExitTrace] kernelbase!TerminateProcess handle=" + MpPtr(Process)
        + " code=" + std::to_string(ExitCode)
        + MpExitDiag(Caller));
    MpLogStack("kernelbase!TerminateProcess", ExitCode);
    return OrigTerminateProcess(Process, ExitCode);
}

LONG NTAPI NtTerminateProcessHook(HANDLE Process, LONG ExitStatus) {
    if (MpProcessDetaching()) {
        return OrigNtTerminateProcess(Process, ExitStatus);
    }
    void* Caller = _ReturnAddress();
    MpLog("[ExitTrace] ntdll!NtTerminateProcess handle=" + MpPtr(Process)
        + " status=" + MpHex(static_cast<uint32_t>(ExitStatus))
        + MpExitDiag(Caller));
    MpLogStack("ntdll!NtTerminateProcess", static_cast<uint32_t>(ExitStatus));
    return OrigNtTerminateProcess(Process, ExitStatus);
}

static bool ShouldTraceExceptionCode(DWORD Code) {
    if (Code == DBG_PRINTEXCEPTION_C ||
        Code == DBG_PRINTEXCEPTION_WIDE_C ||
        Code == 0x406D1388 || // MSVC thread-name exception.
        Code == 0xE06D7363 || // MSVC C++ exception (CxxThrowException).
        Code == 0x40010005 ||
        Code == 0x40010006 ||
        Code == 0x40010007 ||
        Code == 0x40010008) {
        return false;
    }

    return true;
}

static void LogExceptionRecord(const char* Tag, const EXCEPTION_RECORD* Record, const CONTEXT* Context) {
    if (!ShouldTraceExceptionCode(Record ? Record->ExceptionCode : 0)) {
        return;
    }

    LONG Count = InterlockedIncrement(&ExceptionTraceCount);
    if (Count > 96) {
        return;
    }

    std::string Msg = "[ExceptionTrace] ";
    Msg += Tag;

    if (Record) {
        Msg += " code=" + MpHex(Record->ExceptionCode);
        Msg += " flags=" + MpHex(Record->ExceptionFlags);
        Msg += " address=" + MpAddress(Record->ExceptionAddress);

        uintptr_t Base = Globals::BaseAddress ? Globals::BaseAddress : reinterpret_cast<uintptr_t>(GetModuleHandleA(nullptr));
        uintptr_t ExceptionAddress = reinterpret_cast<uintptr_t>(Record->ExceptionAddress);
        if (Base && ExceptionAddress >= Base && ExceptionAddress < Base + 0x08000000) {
            Msg += " rva=+" + MpHex(ExceptionAddress - Base);
        }

        if (Record->NumberParameters > 0) {
            Msg += " params=";
            DWORD ParamCount = Record->NumberParameters;
            if (ParamCount > EXCEPTION_MAXIMUM_PARAMETERS) {
                ParamCount = EXCEPTION_MAXIMUM_PARAMETERS;
            }

            for (DWORD i = 0; i < ParamCount; ++i) {
                if (i != 0) {
                    Msg += ",";
                }
                Msg += MpHex(static_cast<uintptr_t>(Record->ExceptionInformation[i]));
            }
        }
    }

#if defined(_M_X64)
    if (Context) {
        Msg += " rip=" + MpAddress(reinterpret_cast<void*>(Context->Rip));
        Msg += " rsp=" + MpHex(static_cast<uintptr_t>(Context->Rsp));
        Msg += " regs{rax=" + MpHex(static_cast<uintptr_t>(Context->Rax))
            + " rcx=" + MpHex(static_cast<uintptr_t>(Context->Rcx))
            + " rdx=" + MpHex(static_cast<uintptr_t>(Context->Rdx))
            + " rbx=" + MpHex(static_cast<uintptr_t>(Context->Rbx))
            + " rsi=" + MpHex(static_cast<uintptr_t>(Context->Rsi))
            + " rdi=" + MpHex(static_cast<uintptr_t>(Context->Rdi))
            + " r8=" + MpHex(static_cast<uintptr_t>(Context->R8))
            + " r9=" + MpHex(static_cast<uintptr_t>(Context->R9)) + "}";
    }
#endif

    MpLog(Msg);
    MpLogStack(Tag, Record ? Record->ExceptionCode : 0);
}

void WINAPI RaiseExceptionHook(DWORD Code, DWORD Flags, DWORD ArgCount, const ULONG_PTR* Args) {
    if (MpProcessDetaching()) {
        OrigRaiseException(Code, Flags, ArgCount, Args);
        return;
    }
    EXCEPTION_RECORD Record{};
    Record.ExceptionCode = Code;
    Record.ExceptionFlags = Flags;
    Record.ExceptionAddress = _ReturnAddress();
    Record.NumberParameters = ArgCount > EXCEPTION_MAXIMUM_PARAMETERS ? EXCEPTION_MAXIMUM_PARAMETERS : ArgCount;

    if (Args && Record.NumberParameters > 0) {
        for (DWORD i = 0; i < Record.NumberParameters; ++i) {
            Record.ExceptionInformation[i] = Args[i];
        }
    }

    LogExceptionRecord("kernelbase!RaiseException", &Record, nullptr);
    OrigRaiseException(Code, Flags, ArgCount, Args);
}

static void MpLogTravelCrashState(CONTEXT* Context);   // [1.14.7 travel-crash probe] defined with the world census
static void MpReportZombieWorld(void* World, const char* Reason);   // [1.14.7 travel-crash probe] leftover-world holders
static void MpReleaseZombieKeepFlags(void* const* Worlds, int NumWorlds, const char* Reason);   // [1.14.7 travel-crash fix]
static bool MpZombieKeepFlagReleased(void* World);

LONG WINAPI VectoredExceptionTrace(EXCEPTION_POINTERS* ExceptionInfo) {
    if (MpProcessDetaching()) {
        return EXCEPTION_CONTINUE_SEARCH;
    }
    static thread_local bool InHandler = false;
    if (InHandler) {
        return EXCEPTION_CONTINUE_SEARCH;
    }

    InHandler = true;
    if (IsReadablePointer(ExceptionInfo, sizeof(EXCEPTION_POINTERS))) {
        EXCEPTION_RECORD* Record = ExceptionInfo->ExceptionRecord;
        CONTEXT* Context = ExceptionInfo->ContextRecord;
        if (IsReadablePointer(Record, sizeof(EXCEPTION_RECORD))) {
#if defined(_M_X64)
            // [1.14.7 2026-10-08] Was keyed on the 1.12 site 0x024AE5B0 (mid-function on 1.14.7, so the guard
            // never fired) and redirected Rdi to the 1.12 .rdata literal 0x04DF2E8C (inside .text on 1.14.7).
            // tools/rva-port-audit.py maps the site to 0x02660278 (bidirectionally verified; the same
            // `lea edi,[rax+rax]; add rdi,[r8+rcx*8+0x10]; movzx eax,word ptr [rdi]` sequence). The empty
            // name entry is now our own zeroed buffer, so no engine data address is needed.
            static const uint16_t s_EmptyNameEntry[16] = {};
            if (Context && IsReadablePointer(Context, sizeof(CONTEXT)) &&
                Record->ExceptionCode == EXCEPTION_ACCESS_VIOLATION &&
                Globals::BaseAddress &&
                Context->Rip == Globals::BaseAddress + 0x02660278) {
                MpLog("[ExceptionTrace] guarding invalid FName text read at +0x2660278 rdi="
                    + MpHex(static_cast<uintptr_t>(Context->Rdi))
                    + " access=" + (Record->NumberParameters > 1
                        ? MpHex(static_cast<uintptr_t>(Record->ExceptionInformation[1]))
                        : std::string("(unknown)")));

                Context->Rdi = reinterpret_cast<uintptr_t>(s_EmptyNameEntry); // header 0 = empty, non-wide name.
                InHandler = false;
                return EXCEPTION_CONTINUE_EXECUTION;
            }

            // [2026-10-10 1.14.7 travel-crash probe, observe-only] The hunt -> Ramsgate crash: UEngine::LoadMap reads
            // the new world's null PersistentLevel through GetOutermost (helper 0x0285E6F0). Neither the helper nor its
            // wrapper touches r12, which still holds LoadMap's FWorldContext, so the world it used is [r12+0x280].
            // Dump that world's state once; the exception then continues exactly as before.
            if (!Globals::AmServer && Context && IsReadablePointer(Context, sizeof(CONTEXT))
                && Record->ExceptionCode == EXCEPTION_ACCESS_VIOLATION && Globals::BaseAddress
                && Context->Rip == Globals::BaseAddress + 0x0285E6F0) {
                MpLogTravelCrashState(Context);
            }

            // [1.14.7 2026-10-08] The two spline-fault recoveries that sat here (+0x1091D5D evaluator AV and
            // the +0x3D47B31/+0x3D47B0E null-destination store) are removed. The "spline crash" was this
            // module calling the stale 1.12 CreateChannelByName RVA 0x03D47AC0, which lands mid-instruction in
            // FUN_143d47a90 (see Networking.cpp BootstrapActorChannel). The evaluator recovery also unwound
            // 8 bytes short (RSP += 0xB8 where the prologue needs 0xC0), which is what produced rip=0x16A.
#endif
            LogExceptionRecord("VEH", Record, IsReadablePointer(Context, sizeof(CONTEXT)) ? Context : nullptr);
        }
    }
    InHandler = false;

    return EXCEPTION_CONTINUE_SEARCH;
}

void __cdecl UcrtExitHook(int ExitCode) {
    if (MpProcessDetaching()) {
        OrigUcrtExit(ExitCode);
        return;
    }
    void* Caller = _ReturnAddress();
    MpLog("[ExitTrace] ucrtbase!exit entry code=" + std::to_string(ExitCode) + MpExitDiag(Caller));
    MpLogStack("ucrtbase!exit", static_cast<uint32_t>(ExitCode));
    OrigUcrtExit(ExitCode);
}

void __cdecl UcrtUnderscoreExitHook(int ExitCode) {
    if (MpProcessDetaching()) {
        OrigUcrtUnderscoreExit(ExitCode);
        return;
    }
    void* Caller = _ReturnAddress();
    MpLog("[ExitTrace] ucrtbase!_exit entry code=" + std::to_string(ExitCode) + MpExitDiag(Caller));
    MpLogStack("ucrtbase!_exit", static_cast<uint32_t>(ExitCode));
    OrigUcrtUnderscoreExit(ExitCode);
}

void __cdecl MsvcrtExitHook(int ExitCode) {
    if (MpProcessDetaching()) {
        OrigMsvcrtExit(ExitCode);
        return;
    }
    void* Caller = _ReturnAddress();
    MpLog("[ExitTrace] msvcrt!exit entry code=" + std::to_string(ExitCode) + MpExitDiag(Caller));
    MpLogStack("msvcrt!exit", static_cast<uint32_t>(ExitCode));
    OrigMsvcrtExit(ExitCode);
}

void __cdecl MsvcrtUnderscoreExitHook(int ExitCode) {
    if (MpProcessDetaching()) {
        OrigMsvcrtUnderscoreExit(ExitCode);
        return;
    }
    void* Caller = _ReturnAddress();
    MpLog("[ExitTrace] msvcrt!_exit entry code=" + std::to_string(ExitCode) + MpExitDiag(Caller));
    MpLogStack("msvcrt!_exit", static_cast<uint32_t>(ExitCode));
    OrigMsvcrtUnderscoreExit(ExitCode);
}

void __cdecl UcrtAbortHook() {
    if (MpProcessDetaching()) {
        OrigUcrtAbort();
        return;
    }
    void* Caller = _ReturnAddress();
    MpLog("[ExitTrace] ucrtbase!abort entry" + MpExitDiag(Caller));
    MpLogStack("ucrtbase!abort", 3);
    OrigUcrtAbort();
}

void __cdecl MsvcrtAbortHook() {
    if (MpProcessDetaching()) {
        OrigMsvcrtAbort();
        return;
    }
    void* Caller = _ReturnAddress();
    MpLog("[ExitTrace] msvcrt!abort entry" + MpExitDiag(Caller));
    MpLogStack("msvcrt!abort", 3);
    OrigMsvcrtAbort();
}

LONG WINAPI UEUnhandledExceptionFilterHook(EXCEPTION_POINTERS* ExceptionInfo) {
    if (MpProcessDetaching()) {
        return reinterpret_cast<LONG(WINAPI*)(EXCEPTION_POINTERS*)>(OrigUnhandledExceptionFilter)(ExceptionInfo);
    }
    std::string Msg = "[ExitTrace] UEUnhandledExceptionFilter";

    if (IsReadablePointer(ExceptionInfo, sizeof(EXCEPTION_POINTERS)) &&
        IsReadablePointer(ExceptionInfo->ExceptionRecord, sizeof(EXCEPTION_RECORD))) {
        EXCEPTION_RECORD* Record = ExceptionInfo->ExceptionRecord;
        Msg += " code=" + MpHex(Record->ExceptionCode);
        Msg += " flags=" + MpHex(Record->ExceptionFlags);
        Msg += " address=" + MpAddress(Record->ExceptionAddress);

        uintptr_t Base = Globals::BaseAddress ? Globals::BaseAddress : reinterpret_cast<uintptr_t>(GetModuleHandleA(nullptr));
        uintptr_t ExceptionAddress = reinterpret_cast<uintptr_t>(Record->ExceptionAddress);
        if (Base && ExceptionAddress >= Base && ExceptionAddress < Base + 0x08000000) {
            Msg += " rva=+" + MpHex(ExceptionAddress - Base);
        }
    }
    else {
        Msg += " exception_info_unreadable=" + MpPtr(ExceptionInfo);
    }

#if defined(_M_X64)
    if (IsReadablePointer(ExceptionInfo, sizeof(EXCEPTION_POINTERS)) &&
        IsReadablePointer(ExceptionInfo->ContextRecord, sizeof(CONTEXT))) {
        Msg += " rip=" + MpAddress(reinterpret_cast<void*>(ExceptionInfo->ContextRecord->Rip));
        Msg += " rsp=" + MpHex(static_cast<uintptr_t>(ExceptionInfo->ContextRecord->Rsp));
    }
#endif

    MpLog(Msg);
    MpLogStack("UEUnhandledExceptionFilter", 3);

    return reinterpret_cast<LONG(WINAPI*)(EXCEPTION_POINTERS*)>(OrigUnhandledExceptionFilter)(ExceptionInfo);
}

static void InstallApiHook(LPCWSTR Module, LPCSTR ProcName, LPVOID Detour, LPVOID* Original, const char* Tag) {
    LPVOID Target = nullptr;
    MH_STATUS CreateStatus = MH_CreateHookApiEx(Module, ProcName, Detour, Original, &Target);
    MH_STATUS EnableStatus = CreateStatus == MH_OK ? MH_EnableHook(Target) : CreateStatus;

    MpLog("[ExitTrace] hook " + std::string(Tag)
        + " create=" + MH_StatusToString(CreateStatus)
        + " enable=" + MH_StatusToString(EnableStatus)
        + " target=" + MpPtr(Target));
}

// ============================================================================
// [1.14.7 EOS Suppression] Force -DisableEOS on client so OnlineSubsystem falls back
// to MCP (routes/eos.ts) instead of attempting standalone EOS SDK auth which fails.
// ============================================================================
using GetCommandLineWFn = LPCWSTR(WINAPI*)();
using GetCommandLineAFn = LPCSTR(WINAPI*)();
static GetCommandLineWFn OrigGetCommandLineW = nullptr;
static GetCommandLineAFn OrigGetCommandLineA = nullptr;
static std::wstring g_ModifiedCmdLineW;
static std::string g_ModifiedCmdLineA;
static bool g_CmdLineWInited = false;
static bool g_CmdLineAInited = false;

// [1.14.7 EAC flags] Recorded booleans only - never the raw arguments (declared here because
// HookFCommandLineSet below is defined before the EAC block that logs them).
static bool g_engineCmdLineSawNoEAC = false;
static bool g_engineCmdLineSawDisableEOS = false;

static LPCWSTR WINAPI HookGetCommandLineW() {
    if (!g_CmdLineWInited) {
        LPCWSTR orig = OrigGetCommandLineW ? OrigGetCommandLineW() : GetCommandLineW();
        if (!orig) orig = L"";
        g_ModifiedCmdLineW = orig;
        if (g_ModifiedCmdLineW.find(L"-DisableEOS") == std::wstring::npos) {
            g_ModifiedCmdLineW += L" -DisableEOS";
            MpLog("[CommandLine] Appended -DisableEOS to GetCommandLineW");
        }
        // [1.14.7 EAC FIX] Same reasoning as FCommandLine::Set below: make sure the OS-visible line also
        // carries -NoEAC regardless of how the client was started.
        if (g_ModifiedCmdLineW.find(L"-NoEAC") == std::wstring::npos) {
            g_ModifiedCmdLineW += L" -NoEAC";
            MpLog("[CommandLine] Appended -NoEAC to GetCommandLineW");
        }
        g_CmdLineWInited = true;
    }
    return g_ModifiedCmdLineW.c_str();
}

static LPCSTR WINAPI HookGetCommandLineA() {
    if (!g_CmdLineAInited) {
        LPCSTR orig = OrigGetCommandLineA ? OrigGetCommandLineA() : GetCommandLineA();
        if (!orig) orig = "";
        g_ModifiedCmdLineA = orig;
        if (g_ModifiedCmdLineA.find("-DisableEOS") == std::string::npos) {
            g_ModifiedCmdLineA += " -DisableEOS";
            MpLog("[CommandLine] Appended -DisableEOS to GetCommandLineA");
        }
        if (g_ModifiedCmdLineA.find("-NoEAC") == std::string::npos) {
            g_ModifiedCmdLineA += " -NoEAC";
            MpLog("[CommandLine] Appended -NoEAC to GetCommandLineA");
        }
        g_CmdLineAInited = true;
    }
    return g_ModifiedCmdLineA.c_str();
}

// [1.14.7 EAC ROOT FIX 2026-10-04] StartupModule (RVA 0x01474ED0) decides whether to load EAC with:
//     uVar4 = FUN_1425e8f70();                 // FCommandLine::Get()  <- RVA 0x025E8F70
//     cVar3 = FUN_142634de0(uVar4, L"NoEAC");  // FParse::Param
//     if (cVar3 == '\0') { ...initialise EAC... }
// Measured on a real client run: os_NoEAC=1 but engine_FCommandLine_NoEAC=0 - the Launcher passes -NoEAC on
// the OS command line, while the engine's own FCommandLine does not carry it, so this check fails, EAC
// initialises, IGameClient creation fails (0x01477DD0) and HandleError (0x01476F20) reports it. Absorbing
// that dialog only hides the symptom (the client then sits at the login screen and never travels).
//
// This hooks FCommandLine::Get() itself - the exact function the check calls - and returns the engine's own
// string with -NoEAC appended when it is missing. The OS-line hooks above cannot help here: the engine builds
// its FCommandLine independently of GetCommandLineW/A.
using FCommandLineGetFn = const wchar_t*(*)(void);
static FCommandLineGetFn OrigFCommandLineGet = nullptr;
static std::wstring g_engineCmdLineServed;
static bool g_engineCmdLineLoggedOnce = false;

// [1.14.7 NULLRHI ROOT FIX 2026-10-04] The OS command line still carries the switches the deploy
// launcher requested even when the engine's own FCommandLine does not - the same gap already measured
// and documented for -NoEAC/-DisableEOS immediately below. Booleans only; no raw arguments are logged.
static bool MpOsCommandLineHas(const wchar_t* Param) {
    LPCWSTR Os = OrigGetCommandLineW ? OrigGetCommandLineW() : GetCommandLineW();
    return Os != nullptr && Param != nullptr && wcsstr(Os, Param) != nullptr;
}

/*
 * [2026-10-11 1.14.7 P2P host MULTIHOME] The engine chooses the address its net driver binds in
 * ISocketSubsystem::GetMultihomeAddress (0x032AE4B0, a vtable slot; GetLocalBindAddr 0x032AE2C0 calls it and falls
 * back to every interface when it answers false):
 *     FParse::Value(FCommandLine::Get(), L"MULTIHOME=", Home, 256)      // 0x02640610 / 0x025E8F70
 * read on every bind from the string HookFCommandLineGet serves. OS-only switches never reach that string (every hub
 * logs engineOriginalNullRHI=0 osNullRHI=1), so the -MULTIHOME=127.0.0.1 the launcher gives the player-hosted server
 * - to bind loopback only, reachable through the relay alone - was ignored and the host bound every interface,
 * bypassing relay admission. HookFCommandLineGet now carries it like -nullrhi: server role only, only when the OS line
 * has it and the served line has none, and only a strict IPv4 or IPv6 literal (an invalid value would make the
 * engine log "Invalid multihome IP address" and bind every interface anyway, so it is refused and logged instead).
 * DeployServer launches pass no MULTIHOME: dedicated hubs and hunts are unchanged.
 * The effective value (carried or the engine's own) is published once as POD for the watchdog thread's port probe
 * (MpOurUdpPortIsFree) and for the listen check in Networking::Listen (MpEngineCommandLineMultihome). No revert flag:
 * reverting would reopen the all-interfaces bind on the player host.
 */
static char g_MpEngineMultihomeA[64] = { 0 };          // effective MULTIHOME of the served engine line, "" = none
static volatile LONG g_MpEngineMultihomeState = 0;     // 0 = served line not built yet, 1 = published

// Strict dotted quad ("127.0.0.1"): four decimal parts 0..255, no sign, no empty part, no leading zero (octal-looking
// parts are read differently by different parsers), at most 3 digits each.
static bool MpParseIpv4Literal(const char* Text, uint32_t& OutHostOrder) {
    if (!Text) return false;
    uint32_t Result = 0;
    const char* P = Text;
    for (int Part = 0; Part < 4; ++Part) {
        if (Part > 0) { if (*P != '.') return false; ++P; }
        if (P[0] == '0' && P[1] >= '0' && P[1] <= '9') return false;
        int Digits = 0;
        uint32_t Value = 0;
        while (*P >= '0' && *P <= '9') {
            Value = Value * 10 + static_cast<uint32_t>(*P - '0');
            ++P;
            if (++Digits > 3) return false;
        }
        if (Digits == 0 || Value > 255) return false;
        Result = (Result << 8) | Value;
    }
    if (*P != '\0') return false;
    OutHostOrder = Result;
    return true;
}

// IPv4 dotted quad, or an IPv6 text form (hex digits, ':' and an optional embedded dotted quad; at least two ':').
static bool MpIsIpLiteralW(const std::wstring& Value) {
    if (Value.empty() || Value.size() > 45) return false;
    std::string Narrow;
    for (wchar_t C : Value) {
        if (C > 0x7F) return false;
        Narrow.push_back(static_cast<char>(C));
    }
    uint32_t Ignored = 0;
    if (MpParseIpv4Literal(Narrow.c_str(), Ignored)) return true;
    int Colons = 0;
    for (char C : Narrow) {
        if (C == ':') { ++Colons; continue; }
        if (!((C >= '0' && C <= '9') || (C >= 'a' && C <= 'f') || (C >= 'A' && C <= 'F') || C == '.')) return false;
    }
    return Colons >= 2;
}

// MULTIHOME value in an engine command line as FParse::Value (0x02640610) finds it: first case-insensitive match not
// preceded by a letter or digit and outside double quotes; the value runs to the next blank, comma, quote or ')'.
static std::wstring MpEngineLineMultihome(const wchar_t* Line) {
    if (!Line) return {};
    bool InQuotes = false;
    wchar_t Prev = 0;
    for (const wchar_t* P = Line; *P; ++P) {
        if (*P == L'"') { InQuotes = !InQuotes; Prev = *P; continue; }
        const bool PrevAlnum = (Prev >= L'0' && Prev <= L'9') || (Prev >= L'A' && Prev <= L'Z') || (Prev >= L'a' && Prev <= L'z');
        if (!InQuotes && !PrevAlnum && _wcsnicmp(P, L"MULTIHOME=", 10) == 0) {
            const wchar_t* V = P + 10;
            const wchar_t* E = V;
            while (*E && *E != L' ' && *E != L'\t' && *E != L',' && *E != L'"' && *E != L')') ++E;
            return std::wstring(V, E);
        }
        Prev = *P;
    }
    return {};
}

// MULTIHOME value on the OS command line: the first argument -MULTIHOME=<v> (case-insensitive), split the way the
// player-host module's launch check (CommandLineToArgvW) reads it. Found=false when there is none.
static std::wstring MpOsCommandLineMultihome(bool& Found) {
    Found = false;
    LPCWSTR Os = OrigGetCommandLineW ? OrigGetCommandLineW() : GetCommandLineW();
    if (!Os) return {};
    int NumArgs = 0;
    wchar_t** Args = CommandLineToArgvW(Os, &NumArgs);
    if (!Args) return {};
    std::wstring Value;
    for (int Index = 1; Index < NumArgs; ++Index) {
        if (Args[Index] && _wcsnicmp(Args[Index], L"-MULTIHOME=", 11) == 0) {
            Value = Args[Index] + 11;
            Found = true;
            break;
        }
    }
    LocalFree(Args);
    return Value;
}

// Effective MULTIHOME of the served engine line (wide copy of the published POD), empty when there is none or the
// line was never served. Used by Networking::Listen (declared there).
std::wstring MpEngineCommandLineMultihome() {
    if (InterlockedCompareExchange(&g_MpEngineMultihomeState, 0, 0) == 0) return {};
    std::wstring Out;
    for (const char* P = g_MpEngineMultihomeA; *P; ++P) Out.push_back(static_cast<wchar_t>(*P));
    return Out;
}

// Inside HookFCommandLineGet's one-time build: carry the OS -MULTIHOME= on server roles, then publish the effective value.
static void MpCarryMultihomeIntoEngineLine(std::wstring& Served) {
    std::wstring Effective = MpEngineLineMultihome(Served.c_str());
    if (Globals::AmServer) {
        bool OsFound = false;
        const std::wstring OsValue = MpOsCommandLineMultihome(OsFound);
        if (OsFound && Effective.empty()) {
            if (MpIsIpLiteralW(OsValue)) {
                Served += L" -MULTIHOME=" + OsValue;
                Effective = OsValue;
                MpLog("[CommandLine] MULTIHOME=" + MpNarrow(OsValue) + " carried from the OS command line into the engine "
                      "FCommandLine (server role; GetMultihomeAddress 0x032AE4B0 binds the net driver to it)");
            } else {
                MpLog("[CommandLine] MULTIHOME on the OS command line is not an IP literal (" + std::to_string(OsValue.size())
                    + " chars); NOT carried - the engine binds every interface (a player-hosted server then refuses to listen)");
            }
        } else if (OsFound && _wcsicmp(Effective.c_str(), OsValue.c_str()) != 0) {
            MpLog("[CommandLine] WARNING: the engine FCommandLine already has MULTIHOME=" + MpNarrow(Effective)
                + ", which differs from the OS command line's; the engine's value is kept");
        }
    }
    // Publish once. Only a validated literal fits the POD buffer; anything else is published as "" plus the
    // warning, which makes the port probe fall back and the player-host listen check refuse.
    if (!Effective.empty() && (!MpIsIpLiteralW(Effective) || Effective.size() >= sizeof(g_MpEngineMultihomeA))) {
        MpLog("[CommandLine] WARNING: the engine FCommandLine's MULTIHOME is not an IP literal (" + std::to_string(Effective.size())
            + " chars); the engine rejects it and binds every interface");
        Effective.clear();
    }
    size_t Length = 0;
    for (wchar_t C : Effective) g_MpEngineMultihomeA[Length++] = static_cast<char>(C);
    g_MpEngineMultihomeA[Length] = '\0';
    InterlockedExchange(&g_MpEngineMultihomeState, 1);
}

static const wchar_t* HookFCommandLineGet() {
    const wchar_t* Orig = OrigFCommandLineGet ? OrigFCommandLineGet() : nullptr;
    if (!Orig) return Orig;

    // Record what the ENGINE actually had (booleans only, no raw arguments) - this is the authoritative
    // "engine's effective FCommandLine" for the [EACFlags] line.
    if (wcsstr(Orig, L"-NoEAC") != nullptr) g_engineCmdLineSawNoEAC = true;
    if (wcsstr(Orig, L"-DisableEOS") != nullptr) g_engineCmdLineSawDisableEOS = true;
    const bool EngineOriginalNullRhi = wcsstr(Orig, L"-nullrhi") != nullptr;

    if (g_engineCmdLineServed.empty()) {
        g_engineCmdLineServed = Orig;
        if (g_engineCmdLineServed.find(L"-NoEAC") == std::wstring::npos) {
            g_engineCmdLineServed += L" -NoEAC";
            MpLog("[CommandLine] appended -NoEAC to the engine FCommandLine (FCommandLine::Get, RVA 0x025E8F70)");
        }
        if (g_engineCmdLineServed.find(L"-DisableEOS") == std::wstring::npos) {
            g_engineCmdLineServed += L" -DisableEOS";
            MpLog("[CommandLine] appended -DisableEOS to the engine FCommandLine (FCommandLine::Get)");
        }
        // [1.14.7 NULLRHI ROOT FIX 2026-10-04] The RHI selector reads
        //     FParse::Param(FCommandLine::Get(), L"nullrhi")        // RVA 0x02634DE0 / 0x025E8F70
        // and caches the result in the function-local static at RVA 0x06CD7878; a nonzero cache loads the
        // null driver instead of a D3D11 device (FUN_14349a760). The engine's own FCommandLine is built
        // independently of the OS command line, so a dedicated server launched with -nullrhi still cached
        // 0 and brought up a real hardware device - SW_HIDE hid the window but the GPU load remained
        // (measured on one controlled hub: 37-41% of the GPU 3D engine). Carry the requested switch into
        // the string this hook serves, so the engine's decision is the requested one. Server role only.
        if (Globals::AmServer && g_engineCmdLineServed.find(L"-nullrhi") == std::wstring::npos
            && MpOsCommandLineHas(L"-nullrhi")) {
            g_engineCmdLineServed += L" -nullrhi";
            MpLog("[CommandLine] appended -nullrhi to the engine FCommandLine (server role)");
        }
        // [2026-10-11 1.14.7 P2P host MULTIHOME] The bind address, the same gap (see MpCarryMultihomeIntoEngineLine).
        MpCarryMultihomeIntoEngineLine(g_engineCmdLineServed);
    }
    if (!g_engineCmdLineLoggedOnce) {
        g_engineCmdLineLoggedOnce = true;
        MpLog("[CommandLine] engine FCommandLine served with NoEAC="
            + std::to_string(g_engineCmdLineServed.find(L"-NoEAC") != std::wstring::npos ? 1 : 0)
            + " NullRHI=" + std::to_string(g_engineCmdLineServed.find(L"-nullrhi") != std::wstring::npos ? 1 : 0)
            + " engineOriginalNullRHI=" + std::to_string(EngineOriginalNullRhi ? 1 : 0)
            + " osNullRHI=" + std::to_string(MpOsCommandLineHas(L"-nullrhi") ? 1 : 0)
            + " Multihome=" + (g_MpEngineMultihomeA[0] ? std::string(g_MpEngineMultihomeA) : std::string("none")));
    }
    return g_engineCmdLineServed.c_str();
}

// ============================================================================
// [1.14.7 QOS HOST RESOLUTION FIX 2026-10-04]
//
// The client measures regions by pinging every regionUrl from /candidate/regions over PLAIN HTTP on port 80,
// expecting exactly <!DOCTYPE html><html><body>pong</body></html>
// (DauntlessEndpointDocumentation/Matchmaking/Candidate/GetRegions.md). The real service lists seven
// *.gce.latency-test.steelyard.ca hosts, which no longer resolve. Measured consequence in the client log:
//
//     LogSockets [Warning] GetAddressInfo failed to resolve host ... SE_HOST_NOT_FOUND [11001]   x4
//     LogQos     [Warning] Unable to set a good region!
//     LogQos     [Warning] Wanted to set NONE, failed to fall back to
//     LogQos     [Display] Current:                              <- EMPTY
//     LogQos     [Display]   Datacenter: euw11 9999ms (0.00%) Invalid   (and 6 more, all Invalid)
//
// so it travelled with no region at all. The Metagame now answers those pings on port 80; the names still
// have to resolve. Editing the machine's hosts file needs elevation, so resolve them here to loopback - the
// same in-process rewrite pattern already used for HTTP URLs. Both the wide and ANSI entry points are hooked
// because UE's socket subsystem reaches them through different paths.
// Signatures are declared with void* deliberately: the Winsock headers cannot be included here (winsock2.h
// must precede windows.h, which the project's other headers already pull in) and these hooks only forward
// the pointers untouched. WSAAPI is __stdcall; the return is INT (0 on success, 11001 = WSAHOST_NOT_FOUND).
using GetAddrInfoWFn = int (__stdcall*)(const wchar_t*, const wchar_t*, const void*, void**);
using GetAddrInfoAFn = int (__stdcall*)(const char*, const char*, const void*, void**);
static const int MP_WSAHOST_NOT_FOUND = 11001;
static GetAddrInfoWFn OrigGetAddrInfoW = nullptr;
static GetAddrInfoAFn OrigGetAddrInfoA = nullptr;

static bool MpIsQosLatencyTestHostW(PCWSTR NodeName) {
    if (!NodeName) return false;
    return std::wstring(NodeName).find(L"gce.latency-test.steelyard.ca") != std::wstring::npos;
}

static bool MpIsQosLatencyTestHostA(PCSTR NodeName) {
    if (!NodeName) return false;
    return std::string(NodeName).find("gce.latency-test.steelyard.ca") != std::string::npos;
}

static void MpLogQosResolveOnce() {
    static std::atomic<int> s_logged{ 0 };
    if (s_logged.fetch_add(1, std::memory_order_relaxed) < 3) {
        MpLog("[QoSFix] resolved a latency-test host to 127.0.0.1 (the Metagame answers pong on port 80)");
    }
}

static int __stdcall HookGetAddrInfoW(const wchar_t* NodeName, const wchar_t* ServiceName, const void* Hints, void** Result) {
    if (MpIsQosLatencyTestHostW(NodeName)) {
        MpLogQosResolveOnce();
        if (OrigGetAddrInfoW) return OrigGetAddrInfoW(L"127.0.0.1", ServiceName, Hints, Result);
    }
    return OrigGetAddrInfoW ? OrigGetAddrInfoW(NodeName, ServiceName, Hints, Result) : MP_WSAHOST_NOT_FOUND;
}

static int __stdcall HookGetAddrInfoA(const char* NodeName, const char* ServiceName, const void* Hints, void** Result) {
    if (MpIsQosLatencyTestHostA(NodeName)) {
        MpLogQosResolveOnce();
        if (OrigGetAddrInfoA) return OrigGetAddrInfoA("127.0.0.1", ServiceName, Hints, Result);
    }
    return OrigGetAddrInfoA ? OrigGetAddrInfoA(NodeName, ServiceName, Hints, Result) : MP_WSAHOST_NOT_FOUND;
}

static void InstallQosHostResolutionHook() {
    HMODULE Ws2 = GetModuleHandleW(L"ws2_32.dll");
    if (!Ws2) {
        MpLog("[QoSFix] ws2_32.dll not loaded; latency-test host hook skipped");
        return;
    }
    void* TargetW = reinterpret_cast<void*>(GetProcAddress(Ws2, "GetAddrInfoW"));
    if (TargetW) {
        MH_STATUS Create = MH_CreateHook(TargetW, HookGetAddrInfoW, reinterpret_cast<LPVOID*>(&OrigGetAddrInfoW));
        MH_STATUS Enable = Create == MH_OK ? MH_EnableHook(TargetW) : Create;
        MpLog(std::string("[QoSFix] GetAddrInfoW hook create=") + MH_StatusToString(Create)
            + " enable=" + MH_StatusToString(Enable));
    }
    void* TargetA = reinterpret_cast<void*>(GetProcAddress(Ws2, "getaddrinfo"));
    if (TargetA) {
        MH_STATUS Create = MH_CreateHook(TargetA, HookGetAddrInfoA, reinterpret_cast<LPVOID*>(&OrigGetAddrInfoA));
        MH_STATUS Enable = Create == MH_OK ? MH_EnableHook(TargetA) : Create;
        MpLog(std::string("[QoSFix] getaddrinfo hook create=") + MH_StatusToString(Create)
            + " enable=" + MH_StatusToString(Enable));
    }
}

// ============================================================================
// [1.14.7 SOCKET DIAGNOSTICS 2026-10-04]
//
// The travel times out after 20s with the hub continuously available, its UDP port bound on 0.0.0.0 and the
// client told 127.0.0.1:8790 (verified=1). Nothing appears in the hub's own net log, so the open question is
// whether the client's datagrams reach the hub's socket at all. These hooks answer it directly: the client's
// sendto destinations and the hub's recvfrom sources, both logged with the raw sockaddr bytes.
//
// Winsock types are deliberately avoided (winsock2.h cannot be included here - it must precede windows.h and
// the project's other headers already pull that in). AF_INET is 2, the port is big-endian at offset 2 and the
// address bytes follow at offset 4.
using MpSendToFn = int (__stdcall*)(uintptr_t, const char*, int, int, const void*, int);
using MpRecvFromFn = int (__stdcall*)(uintptr_t, char*, int, int, void*, int*);
static MpSendToFn OrigSendTo = nullptr;
static MpRecvFromFn OrigRecvFrom = nullptr;
static std::atomic<int> g_sockDiagLines{ 0 };

static void MpLogSockAddr(const char* Tag, const void* Sa, int SaLen, int Len) {
    if (!Sa || SaLen < 8) return;
    const unsigned char* p = reinterpret_cast<const unsigned char*>(Sa);
    const uint16_t Family = *reinterpret_cast<const uint16_t*>(p);
    if (Family != 2) return;                       // AF_INET only
    const uint16_t Port = static_cast<uint16_t>((p[2] << 8) | p[3]);
    if (g_sockDiagLines.fetch_add(1, std::memory_order_relaxed) >= 30) return;
    MpLog(std::string("[SocketDiag] ") + Tag + " " + std::to_string(p[4]) + "." + std::to_string(p[5]) + "."
        + std::to_string(p[6]) + "." + std::to_string(p[7]) + ":" + std::to_string(Port)
        + " len=" + std::to_string(Len) + " role=" + (Globals::AmServer ? "server" : "client"));
}

/*
 * [2026-10-11 1.14.7 O0 wire bytes] Bytes the server actually puts on the wire, per destination address, for the
 * once-a-minute [PerfNet] line (scaling one Ramsgate toward 30-40 players needs the per-connection budget). The
 * sendto hook below now always runs on servers (NO_PERF_DETAIL.flag turns the counting and the hook off) and only
 * counts: relaxed atomics into a fixed 64-slot table keyed by address:port, no allocation, no lock, no logging, no CRT.
 * The verbose per-packet lines stay opt-in (SOCKET_DIAG.flag). UE's IpNetDriver sends with ws2_32!sendto (SOCKET_DIAG
 * captured "sendto -> 127.0.0.1:8790"); WSASendTo is not hooked because nothing in the net driver uses it.
 * A slot whose peer sent nothing for a whole window is released by the reader, so a long-lived hub keeps room for new
 * joiners; a send racing that release can land in a released slot and is then reported as "unattributed". Once all 64
 * slots are busy, further peers count into "other".
 */
struct MpWireSlot {
    std::atomic<uint64_t> Key{ 0 };
    std::atomic<uint64_t> Bytes{ 0 };
    std::atomic<uint64_t> Packets{ 0 };
};
static MpWireSlot g_wireSlots[64];
static std::atomic<uint64_t> g_wireBytesTotal{ 0 };
static std::atomic<uint64_t> g_wirePacketsTotal{ 0 };
static std::atomic<uint64_t> g_wireBytesOther{ 0 };
static volatile LONG g_wireCountOn = 0;   // set once by InstallSocketDiagnostics (server, !NO_PERF_DETAIL.flag)

// Key from a sockaddr: tag(8) | IPv4 address(32) | port(16); IPv4-mapped IPv6 maps to the IPv4 key; other IPv6 uses a
// 40-bit FNV-1a of the address. 0 = not countable.
static uint64_t MpWireKeyFromSockAddr(const void* Sa, int SaLen) {
    if (!Sa || SaLen < 8) return 0;
    const unsigned char* p = reinterpret_cast<const unsigned char*>(Sa);
    const uint16_t Family = static_cast<uint16_t>(p[0] | (p[1] << 8));
    const uint64_t Port = static_cast<uint64_t>((p[2] << 8) | p[3]);
    if (Family == 2 && SaLen >= 8) {
        const uint64_t Addr = (static_cast<uint64_t>(p[4]) << 24) | (static_cast<uint64_t>(p[5]) << 16)
            | (static_cast<uint64_t>(p[6]) << 8) | static_cast<uint64_t>(p[7]);
        return (1ull << 56) | (Addr << 16) | Port;
    }
    if (Family == 23 && SaLen >= 24) {   // sockaddr_in6: family, port, flowinfo(4), address(16) at +8
        const unsigned char* A = p + 8;
        bool Mapped = A[10] == 0xFF && A[11] == 0xFF;
        for (int i = 0; i < 10 && Mapped; ++i) Mapped = A[i] == 0;
        if (Mapped) {
            const uint64_t Addr = (static_cast<uint64_t>(A[12]) << 24) | (static_cast<uint64_t>(A[13]) << 16)
                | (static_cast<uint64_t>(A[14]) << 8) | static_cast<uint64_t>(A[15]);
            return (1ull << 56) | (Addr << 16) | Port;
        }
        uint64_t H = 1469598103934665603ull;
        for (int i = 0; i < 16; ++i) { H ^= A[i]; H *= 1099511628211ull; }
        return (2ull << 56) | ((H & 0xFFFFFFFFFFull) << 16) | Port;
    }
    return (3ull << 56) | (static_cast<uint64_t>(Family) << 16);
}

static std::string MpWireKeyText(uint64_t Key) {
    const unsigned Tag = static_cast<unsigned>(Key >> 56);
    const unsigned Port = static_cast<unsigned>(Key & 0xFFFF);
    char Buf[64];
    if (Tag == 1) {
        const uint32_t A = static_cast<uint32_t>((Key >> 16) & 0xFFFFFFFFull);
        sprintf_s(Buf, "%u.%u.%u.%u:%u", (A >> 24) & 0xFF, (A >> 16) & 0xFF, (A >> 8) & 0xFF, A & 0xFF, Port);
    } else if (Tag == 2) {
        sprintf_s(Buf, "v6#%010llX:%u", static_cast<unsigned long long>((Key >> 16) & 0xFFFFFFFFFFull), Port);
    } else {
        sprintf_s(Buf, "family%u", static_cast<unsigned>((Key >> 16) & 0xFFFF));
    }
    return Buf;
}

static void MpWireCount(uint64_t Key, uint64_t Bytes) {
    g_wireBytesTotal.fetch_add(Bytes, std::memory_order_relaxed);
    g_wirePacketsTotal.fetch_add(1, std::memory_order_relaxed);
    if (Key == 0) {
        g_wireBytesOther.fetch_add(Bytes, std::memory_order_relaxed);
        return;
    }
    const unsigned Start = static_cast<unsigned>(((Key ^ (Key >> 23) ^ (Key >> 41)) * 0x9E3779B97F4A7C15ull) >> 58);
    for (unsigned n = 0; n < 64; ++n) {
        MpWireSlot& Slot = g_wireSlots[(Start + n) & 63];
        uint64_t K = Slot.Key.load(std::memory_order_relaxed);
        if (K == 0) {
            uint64_t Expected = 0;
            if (Slot.Key.compare_exchange_strong(Expected, Key, std::memory_order_relaxed)) K = Key;
            else K = Expected;
        }
        if (K == Key) {
            Slot.Bytes.fetch_add(Bytes, std::memory_order_relaxed);
            Slot.Packets.fetch_add(1, std::memory_order_relaxed);
            return;
        }
    }
    g_wireBytesOther.fetch_add(Bytes, std::memory_order_relaxed);
}

static int __stdcall HookSendTo(uintptr_t S, const char* Buf, int Len, int Flags, const void* To, int ToLen) {
    static const bool s_verbose = MpExeRelativeFlagPresent(L"SOCKET_DIAG.flag");   // [2026-10-11] read once
    if (s_verbose) MpLogSockAddr("sendto ->", To, ToLen, Len);
    const int R = OrigSendTo ? OrigSendTo(S, Buf, Len, Flags, To, ToLen) : -1;
    if (R > 0 && g_wireCountOn) MpWireCount(MpWireKeyFromSockAddr(To, ToLen), static_cast<uint64_t>(R));
    return R;
}

static int __stdcall HookRecvFrom(uintptr_t S, char* Buf, int Len, int Flags, void* From, int* FromLen) {
    const int R = OrigRecvFrom ? OrigRecvFrom(S, Buf, Len, Flags, From, FromLen) : -1;
    if (R > 0) MpLogSockAddr("recvfrom <-", From, FromLen ? *FromLen : 0, R);
    return R;
}

// The first receive hook covered only recvfrom. UE's net driver uses the OVERLAPPED receive path, so an
// arrival would be invisible to that hook - which would look exactly like "nothing arrived" when packets are
// actually being delivered. These cover WSARecvFrom (which reports the source address) and WSARecv.
using MpWSARecvFromFn = int (__stdcall*)(uintptr_t, void*, unsigned long, unsigned long*, unsigned long*, void*, int*, void*, void*);
using MpWSARecvFn = int (__stdcall*)(uintptr_t, void*, unsigned long, unsigned long*, unsigned long*, void*, void*);
static MpWSARecvFromFn OrigWSARecvFrom = nullptr;
static MpWSARecvFn OrigWSARecv = nullptr;
static std::atomic<int> g_wsarrivals{ 0 };

static int __stdcall HookWSARecvFrom(uintptr_t S, void* Buffers, unsigned long BufferCount,
    unsigned long* BytesRecvd, unsigned long* Flags, void* From, int* FromLen, void* Overlapped, void* Completion) {
    const int R = OrigWSARecvFrom
        ? OrigWSARecvFrom(S, Buffers, BufferCount, BytesRecvd, Flags, From, FromLen, Overlapped, Completion)
        : -1;
    // With an OVERLAPPED operation the result is pending (SOCKET_ERROR) and the count is filled in later, so
    // log the call itself as well - an arrival is then visible either way.
    if (R == 0 && BytesRecvd && *BytesRecvd > 0) {
        MpLogSockAddr("WSARecvFrom <-", From, FromLen ? *FromLen : 0, static_cast<int>(*BytesRecvd));
    }
    else if (Overlapped != nullptr) {
        if (g_wsarrivals.fetch_add(1, std::memory_order_relaxed) < 12) {
            MpLog(std::string("[SocketDiag] WSARecvFrom issued (overlapped, result pending) role=")
                + (Globals::AmServer ? "server" : "client"));
        }
    }
    return R;
}

static int __stdcall HookWSARecv(uintptr_t S, void* Buffers, unsigned long BufferCount,
    unsigned long* BytesRecvd, unsigned long* Flags, void* Overlapped, void* Completion) {
    const int R = OrigWSARecv
        ? OrigWSARecv(S, Buffers, BufferCount, BytesRecvd, Flags, Overlapped, Completion)
        : -1;
    if (R == 0 && BytesRecvd && *BytesRecvd > 0) {
        MpLog(std::string("[SocketDiag] WSARecv <- len=") + std::to_string(*BytesRecvd)
            + " role=" + (Globals::AmServer ? "server" : "client"));
    }
    return R;
}

static void InstallSocketDiagnostics() {
    // [1.14.7 2026-10-04] GATED OFF by default. These hooks log from inside the recvfrom/sendto path, i.e. on
    // the net tick's stack, and build std::strings through the CRT - whose frames are large (the fault below
    // is a CRT routine writing [rbp+0x3F0]). The measurements they were added for are complete (the client
    // sends 29-byte packets to 127.0.0.1:8790 and the hub receives them), and a diagnostic must not perturb
    // the path it measures. SOCKET_DIAG.flag beside the executable re-enables them.
    // [2026-10-11 1.14.7 O0] Exception: on servers the sendto hook is installed anyway, counting only (no logging, see
    // MpWireCount), for the [PerfNet] bytes-per-peer line. NO_PERF_DETAIL.flag leaves sendto unhooked again.
    const bool Verbose = MpExeRelativeFlagPresent(L"SOCKET_DIAG.flag");
    const bool CountWire = Globals::AmServer && !MpExeRelativeFlagPresent(L"NO_PERF_DETAIL.flag");
    if (!Verbose && !CountWire) {
        return;
    }
    HMODULE Ws2 = GetModuleHandleW(L"ws2_32.dll");
    if (!Ws2) {
        MpLog("[SocketDiag] ws2_32.dll not loaded; socket diagnostics skipped");
        return;
    }
    void* T1 = reinterpret_cast<void*>(GetProcAddress(Ws2, "sendto"));
    if (T1) {
        MH_STATUS C = MH_CreateHook(T1, HookSendTo, reinterpret_cast<LPVOID*>(&OrigSendTo));
        MH_STATUS E = C == MH_OK ? MH_EnableHook(T1) : C;
        if (CountWire && C == MH_OK && E == MH_OK) InterlockedExchange(&g_wireCountOn, 1);
        MpLog(std::string("[SocketDiag] sendto hook create=") + MH_StatusToString(C) + " enable=" + MH_StatusToString(E)
            + " counting=" + (g_wireCountOn ? "1 ([PerfNet] bytes per peer)" : "0")
            + " verbose=" + (Verbose ? "1 (SOCKET_DIAG.flag)" : "0"));
    }
    if (!Verbose) {
        return;   // counting only: the receive hooks stay opt-in
    }
    void* T2 = reinterpret_cast<void*>(GetProcAddress(Ws2, "recvfrom"));
    if (T2) {
        MH_STATUS C = MH_CreateHook(T2, HookRecvFrom, reinterpret_cast<LPVOID*>(&OrigRecvFrom));
        MH_STATUS E = C == MH_OK ? MH_EnableHook(T2) : C;
        MpLog(std::string("[SocketDiag] recvfrom hook create=") + MH_StatusToString(C) + " enable=" + MH_StatusToString(E));
    }
    void* T3 = reinterpret_cast<void*>(GetProcAddress(Ws2, "WSARecvFrom"));
    if (T3) {
        MH_STATUS C = MH_CreateHook(T3, HookWSARecvFrom, reinterpret_cast<LPVOID*>(&OrigWSARecvFrom));
        MH_STATUS E = C == MH_OK ? MH_EnableHook(T3) : C;
        MpLog(std::string("[SocketDiag] WSARecvFrom hook create=") + MH_StatusToString(C) + " enable=" + MH_StatusToString(E));
    }
    void* T4 = reinterpret_cast<void*>(GetProcAddress(Ws2, "WSARecv"));
    if (T4) {
        MH_STATUS C = MH_CreateHook(T4, HookWSARecv, reinterpret_cast<LPVOID*>(&OrigWSARecv));
        MH_STATUS E = C == MH_OK ? MH_EnableHook(T4) : C;
        MpLog(std::string("[SocketDiag] WSARecv hook create=") + MH_StatusToString(C) + " enable=" + MH_StatusToString(E));
    }
}

// ============================================================================
// [1.14.7 REMOVED 2026-10-04] The Ce8B6 guard hook was WRONG and has been deleted.
//
// I installed a detour at RVA 0x42CE8B6, having read those bytes from the live process and seen
// "sub rsp, 0x40 / mov rax, [rcx+0x10] / cmp qword ptr [rax+0x88], 0". But 0x42CE8B6 is NOT the function
// entry. The executable's unwind metadata puts the real start at RVA 0x42CE8B0:
//
//     0x42CE8B0  mov [rsp+0x18], rbx
//     0x42CE8B5  push rdi
//     0x42CE8B6  sub rsp, 0x40      <- the hook went HERE, after "push rdi" had already run
//
// A C++ detour expects the return address on top of the stack; here it finds the saved RDI. That single
// mistake produced BOTH symptoms I then misdiagnosed:
//   * wrong stack alignment -> the CRT's aligned "movdqa [rbp+0x3F0], xmm0" faults (0xC0000005), and
//   * wrong return address   -> execution jumps to a heap-looking address (the logged RIP was RDI, which I
//     wrongly read as evidence of a freed allocation).
// DbgHelp symbolization of the fault chain names it plainly: HookCe8B6 -> MpLog -> sprintf_s<260>.
//
// Lesson recorded: never install a detour from disassembled bytes alone. Confirm the function start from the
// unwind metadata (.pdata / RUNTIME_FUNCTION) or a symbol, not from the first plausible prologue bytes seen
// at an arbitrary offset.
//
// The guard is deleted rather than relocated: a replacement at this address needs verified function semantics
// and ABI first.

static void InstallEngineCommandLineHook() {
    MH_STATUS Create = MH_CreateHook((void*)(Globals::BaseAddress + 0x025E8F70),
        HookFCommandLineGet, reinterpret_cast<LPVOID*>(&OrigFCommandLineGet));
    MH_STATUS Enable = Create == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x025E8F70)) : Create;
    MpLog(std::string("[CommandLine] engine FCommandLine::Get hook (+0x025E8F70) create=")
        + MH_StatusToString(Create) + " enable=" + MH_StatusToString(Enable));
}

using FCommandLineSetFn = bool(*)(const wchar_t*);
static FCommandLineSetFn OrigFCommandLineSet = nullptr;

static bool HookFCommandLineSet(const wchar_t* CmdLine) {
    if (CmdLine) {
        std::wstring modified = CmdLine;
        bool changed = false;
        // [1.14.7 EAC flags] record what the ENGINE is actually given, as booleans only.
        if (wcsstr(CmdLine, L"-NoEAC") != nullptr) g_engineCmdLineSawNoEAC = true;
        if (wcsstr(CmdLine, L"-DisableEOS") != nullptr) g_engineCmdLineSawDisableEOS = true;
        if (wcsstr(CmdLine, L"-DisableEOS") == nullptr) {
            modified += L" -DisableEOS";
            changed = true;
        }
        // [1.14.7 EAC FIX 2026-10-04] The measured flag booleans from a real Launcher-equivalent client run:
        //   [EACFlags] os_NoEAC=1 engine_FCommandLine_NoEAC=0 os_DisableEOS=1 engine_FCommandLine_DisableEOS=0
        // The OS command line carries -NoEAC (the Launcher passes it) but the engine's own FCommandLine does
        // NOT, so StartupModule's NoEAC check (RVA 0x01474ED0) fails, EAC initialises, the IGameClient
        // creation fails (0x01477DD0) and HandleError (0x01476F20) reports it. Absorbing that dialog is not a
        // fix - the client then just sits at the login screen with "Online Play may not be available".
        // Adding the flag here is the root fix, exactly as -DisableEOS is already handled.
        if (wcsstr(CmdLine, L"-NoEAC") == nullptr) {
            modified += L" -NoEAC";
            changed = true;
        }
        if (changed) {
            MpLog("[CommandLine] Added -DisableEOS/-NoEAC to FCommandLine::Set (engine was missing them)");
            if (OrigFCommandLineSet) {
                return OrigFCommandLineSet(modified.c_str());
            }
            return true;
        }
    }
    if (OrigFCommandLineSet) {
        return OrigFCommandLineSet(CmdLine);
    }
    return true;
}

// [1.14.7 EOS/Login Hooks]
using IsEOSEnabledFn = char(*)();
static IsEOSEnabledFn OrigIsEOSEnabled = nullptr;

// [1.14.7 login fix 2026-10-03] Ghidra decompiles +0x01C30030 as
//   undefined1 FUN_141c30030(void) {
//       if (<TLS guard at +0x06D3417C>) {
//           c = FParse::Param(FCommandLine::Get(), L"DisableEOS");   // FUN_142634de0
//           DAT_146d34178 = (c == 0);                                // cached result
//       }
//       return DAT_146d34178;
//   }
// i.e. IsEOSEnabled() == !<command line contains -DisableEOS>, cached on first call.
// When it returns 1 the client authenticates through the EOS SDK, whose own HTTP stack
// bypasses FCurlHttpRequest::ProcessRequest -> the request goes to the real
// api.epicgames.dev instead of paradox.mysticfox.dev and fails with
// EOS_Auth_ExchangeCodeNotFound, so the login never reaches this backend.
// Forcing 0 selects MCP mode, where the same login is issued through UE's HTTP stack and
// IS rewritten to this backend (proven: the 0.1.87 build logs
// "[IsEOSEnabled] intercepted -> forcing 0 (MCP mode)" and completes
// POST /__origin/account-public-service-prod03.ol.epicgames.com/account/api/oauth/token).
// This is the private-server requirement, not a diagnostic suppression: no failure is hidden.
static char HookIsEOSEnabled() {
    static bool s_logged = false;
    if (!s_logged) {
        s_logged = true;
        MpLog("[IsEOSEnabled] intercepted -> forcing 0 (MCP mode)");
    }
    return 0;
}

static std::string SafeFTextToString(const void* TextPtr) {
    if (!TextPtr || !IsReadablePointer(TextPtr, 8)) return "<null>";
    void* TextData = *reinterpret_cast<void**>(const_cast<void*>(TextPtr));
    if (!TextData || !IsReadablePointer(TextData, 0x38)) return "<null-data>";
    wchar_t* Data = *reinterpret_cast<wchar_t**>(reinterpret_cast<uintptr_t>(TextData) + 0x28);
    int32_t Num = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(TextData) + 0x30);
    if (!Data || Num <= 0 || !IsReadablePointer(Data, 2)) return "<empty>";
    return MpNarrow(std::wstring(Data, Num > 512 ? 512 : Num));
}

using LoginOperationFailedFn = void(*)(void*, void*, void*, char);
static LoginOperationFailedFn OrigLoginOperationFailed = nullptr;

static void HookLoginOperationFailed(void* thisPtr, void* ErrorStringPtr, void* ErrorTextPtr, char bTrigger) {
    std::string className = "unknown";
    if (thisPtr && IsReadablePointer(thisPtr, 0x20)) {
        UObject* obj = reinterpret_cast<UObject*>(thisPtr);
        if (obj->Class && IsReadablePointer(obj->Class, 0x20)) {
            className = obj->Class->GetName();
        }
    }
    MpLog("[LoginOpFailed] class=" + className + " bTrigger=" + std::to_string((int)bTrigger)
        + " errorStringPresent=" + std::to_string(ErrorStringPtr != nullptr)
        + " errorTextPresent=" + std::to_string(ErrorTextPtr != nullptr));
    // Preserve the game's failure cleanup and delegate notifications. This hook is diagnostic only.
    if (OrigLoginOperationFailed) {
        OrigLoginOperationFailed(thisPtr, ErrorStringPtr, ErrorTextPtr, bTrigger);
    }
}

using LoginOperationSuccessFn = void(*)(void*);
static LoginOperationSuccessFn OrigLoginOperationSuccess = nullptr;

static void HookLoginOperationSuccess(void* thisPtr) {
    std::string className = "unknown";
    if (thisPtr && IsReadablePointer(thisPtr, 0x20)) {
        UObject* obj = reinterpret_cast<UObject*>(thisPtr);
        if (obj->Class && IsReadablePointer(obj->Class, 0x20)) {
            className = obj->Class->GetName();
        }
    }
    MpLog("[LoginOpSuccess] this=" + MpPtr(thisPtr) + " class=" + className + " -> login operation SUCCEEDED!");
    if (OrigLoginOperationSuccess) {
        OrigLoginOperationSuccess(thisPtr);
    }
}

using HasDisconnectErrorFn = void(*)(void*, void*, void*);
static HasDisconnectErrorFn OrigHasDisconnectError = nullptr;

static void HookHasDisconnectError(void* Context, void* Stack, void* Result) {
    if (OrigHasDisconnectError) {
        OrigHasDisconnectError(Context, Stack, Result);
    }
    if (Result) MpLog(std::string("[HasDisconnectError] observed result=")
        + ((*reinterpret_cast<uint8_t*>(Result) != 0) ? "true" : "false"));
}

using EnqueueDisconnectErrorFn = void(*)(void*, void*);
static EnqueueDisconnectErrorFn OrigEnqueueDisconnectError = nullptr;

// [1.14.7 2026-10-04] This hook used to log only errorTextPresent, which lost the reason and the caller and
// made the client's disconnect unactionable. It now reads the validated FText safely (SafeFTextToString
// already bounds the read), records a bounded REDACTED reason plus the caller RVA, and forwards the pointer
// unchanged - the original keeps ownership, nothing is copied or destroyed here.
static std::string RedactForLog(const std::string& Text, size_t MaxLen) {
    std::string Out;
    Out.reserve(Text.size() < MaxLen ? Text.size() : MaxLen);
    size_t Run = 0;
    for (size_t i = 0; i < Text.size() && Out.size() < MaxLen; ++i) {
        const unsigned char C = static_cast<unsigned char>(Text[i]);
        const bool Tokenish = (C >= '0' && C <= '9') || (C >= 'a' && C <= 'z') || (C >= 'A' && C <= 'Z') || C == '-' || C == '_';
        if (Tokenish) {
            ++Run;
            if (Run > 24) {              // long unbroken token-like run: mask it
                if (Out.size() < 12 || Out.compare(Out.size() - 12, 12, "<redacted>") != 0) Out += "<redacted>";
                while (i + 1 < Text.size() && Out.size() < MaxLen) {
                    const unsigned char N = static_cast<unsigned char>(Text[i + 1]);
                    const bool NextTokenish = (N >= '0' && N <= '9') || (N >= 'a' && N <= 'z') || (N >= 'A' && N <= 'Z') || N == '-' || N == '_';
                    if (!NextTokenish) break;
                    ++i;
                }
                Run = 0;
                continue;
            }
        } else {
            Run = 0;
        }
        Out += static_cast<char>(C);
    }
    if (Text.size() > Out.size()) Out += "...";
    return Out;
}

static void HookEnqueueDisconnectError(void* Context, void* ErrorTextPtr) {
    const std::string Reason = RedactForLog(SafeFTextToString(ErrorTextPtr), 160);
    void* Caller = _ReturnAddress();
    const uintptr_t CallerRva = (Globals::BaseAddress && reinterpret_cast<uintptr_t>(Caller) >= Globals::BaseAddress)
        ? reinterpret_cast<uintptr_t>(Caller) - Globals::BaseAddress
        : 0;
    MpLog(std::string("[EnqueueDisconnectError] reason='") + Reason + "' callerRva=+0x"
        + MpHex(CallerRva) + " this=" + MpPtr(Context)
        + " (forwarded unchanged; original keeps ownership)");
    if (OrigEnqueueDisconnectError) {
        OrigEnqueueDisconnectError(Context, ErrorTextPtr);
    }
}

using EasyAntiCheatHandleErrorFn = uint64_t(*)(void*, void*);
static EasyAntiCheatHandleErrorFn OrigEasyAntiCheatHandleError = nullptr;

// [1.14.7 2026-10-04] The previous version of this hook suppressed EVERY EAC error unconditionally.
// It is replaced by the scoped version defined with the EAC block further down, which absorbs only the
// expected private-client initialisation failure and forwards everything else to the original.
// The typedef and OrigEasyAntiCheatHandleError above are kept for that hook.

// ============================================================================
// [1.14.7 EAC DIAGNOSIS + SCOPED ERROR HANDLING 2026-10-04]
//
// Verified in the 1.14.7 binary:
//   StartupModule       0x01474ED0  checks NoEAC via FUN_142634de0(cmdline, L"NoEAC") and also has the path
//                                   "EnableEasyAntiCheatFeatures is false, EAC client will not load"
//   client creation     0x01477DD0  produces the IGameClient creation error
//   FEasyAntiCheatClient::HandleError 0x01476F20
//       undefined8 FUN_141476f20(this, FString* message)
//       - if a game callback is bound (this+8, vtable +0x30 != 0) it DISPATCHES there: vtable +0x48
//       - otherwise it falls back to the native dialog: "EasyAntiCheat Error: %s"
//       So the return is 64-bit (undefined8), and the caller reads AL. The old uint64_t declaration was
//       therefore correct; EAC suppression stopped because commit e320e022 REMOVED the hooks, not because of
//       the type. This restores it narrowly.
//
// Scope: only the expected private-client initialisation failure is absorbed. Every other EAC error is
// forwarded to the original unchanged, so ordinary error reporting and Central Guard checks still run.
static std::atomic<int> g_eacSuppressedCount{ 0 };
static std::atomic<int> g_eacForwardedCount{ 0 };

// The flag booleans are declared with the command-line hooks above; this records whether we logged them.
static bool g_eacFlagsLogged = false;

static std::wstring ReadFStringSafe(const void* StringPtr, size_t MaxChars) {
    if (!StringPtr || !IsReadablePointer(const_cast<void*>(StringPtr), 0x10)) return std::wstring();
    const wchar_t* Data = *reinterpret_cast<const wchar_t* const*>(StringPtr);
    const int32_t Num = *reinterpret_cast<const int32_t*>(reinterpret_cast<uintptr_t>(StringPtr) + 0x08);
    if (!Data || Num <= 0) return std::wstring();
    const size_t Count = static_cast<size_t>(Num) > MaxChars ? MaxChars : static_cast<size_t>(Num);
    if (!IsReadablePointer(const_cast<wchar_t*>(Data), Count * sizeof(wchar_t))) return std::wstring();
    return std::wstring(Data, Count > 0 ? Count - 1 : 0);
}

static uint64_t HookEasyAntiCheatHandleError(void* thisPtr, void* ErrorMessagePtr) {
    const std::wstring Message = ReadFStringSafe(ErrorMessagePtr, 512);

    // The expected private-client initialisation failure: the game could not create its IGameClient.
    // Nothing else is absorbed.
    const bool IsExpectedClientInitFailure =
        Message.find(L"IGameClient") != std::wstring::npos ||
        Message.find(L"Failed to create") != std::wstring::npos;

    if (IsExpectedClientInitFailure) {
        const int Seq = g_eacSuppressedCount.fetch_add(1, std::memory_order_relaxed);
        if (Seq < 4) {
            MpLog("[EACPopup] absorbed expected client-init failure (len=" + std::to_string(Message.size())
                + " chars, contains IGameClient=" + std::to_string(Message.find(L"IGameClient") != std::wstring::npos ? 1 : 0)
                + ") this=" + MpPtr(thisPtr));
        }
        return 1;   // AL=1: handled, no dialog
    }

    const int Seq = g_eacForwardedCount.fetch_add(1, std::memory_order_relaxed);
    if (Seq < 4) {
        MpLog("[EACPopup] forwarding a non-client-init EAC error to the original (len="
            + std::to_string(Message.size()) + " chars) this=" + MpPtr(thisPtr));
    }
    return OrigEasyAntiCheatHandleError
        ? OrigEasyAntiCheatHandleError(thisPtr, ErrorMessagePtr)
        : 0;
}

static void LogEacStartupFlags(const char* Where) {
    if (g_eacFlagsLogged) return;
    g_eacFlagsLogged = true;
    const wchar_t* OsCmd = GetCommandLineW();
    const std::wstring OsLine = OsCmd ? std::wstring(OsCmd) : std::wstring();
    const bool OsNoEAC = OsLine.find(L"-NoEAC") != std::wstring::npos;
    MpLog(std::string("[EACFlags] ") + Where
        + " os_NoEAC=" + std::to_string(OsNoEAC ? 1 : 0)
        + " engine_FCommandLine_NoEAC=" + std::to_string(g_engineCmdLineSawNoEAC ? 1 : 0)
        + " os_DisableEOS=" + std::to_string(OsLine.find(L"-DisableEOS") != std::wstring::npos ? 1 : 0)
        + " engine_FCommandLine_DisableEOS=" + std::to_string(g_engineCmdLineSawDisableEOS ? 1 : 0)
        + " (booleans only; no raw arguments recorded)");
}

using FMessageDialogOpenFn = int(*)(int, void*, void*);
static FMessageDialogOpenFn OrigFMessageDialogOpen = nullptr;

static int HookFMessageDialogOpen(int MsgType, void* MessageText, void* TitleText) {
    MpLog("[FMessageDialog] Open intercepted (MsgType=" + std::to_string(MsgType) + ") -> suppressed native OS message dialog");
    return (MsgType == 0) ? 5 : 1;
}

using ArchonEasyAntiCheatErrorProcFn = bool(*)(void*, void*);
static ArchonEasyAntiCheatErrorProcFn OrigArchonEasyAntiCheatErrorProc = nullptr;

static bool HookArchonEasyAntiCheatErrorProc(void* thisPtr, void* Message) {
    std::wstring msg = L"<null>";
    if (Message && IsReadablePointer(Message, 16)) {
        wchar_t* data = *reinterpret_cast<wchar_t**>(Message);
        int32_t num = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Message) + 8);
        if (data && num > 0 && IsReadablePointer(data, 2)) {
            msg = std::wstring(data, num > 256 ? 256 : num);
        }
    }
    MpLog("[EACPopup] HookArchonEasyAntiCheatErrorProc suppressed modal (Message='" + MpNarrow(msg) + "')");
    return false;
}

// Resolve a virtual through a LIVE instance's vtable and MinHook it.
// Immune to .text RVA drift; only the vtable INDEX must be correct.
static bool HookVirtual(void* instance, size_t index, void* detour, void** ppOrig, const char* tag) {
    if (!instance) return false;
    void** vtable = *reinterpret_cast<void***>(instance);
    void*  target = vtable[index];
    if (MH_CreateHook(target, detour, ppOrig) != MH_OK) return false;
    if (MH_EnableHook(target) != MH_OK) return false;
    if (Globals::EnableLogging)
        std::cout << "[vhook] " << tag << " idx=" << index << " -> +0x" << std::hex
                  << ((uintptr_t)target - Globals::BaseAddress) << std::dec << std::endl;
    return true;
}

// One-time runtime INDEX discovery. Log vtable[0..count) as module-relative RVAs,
// then identify each target (see "identifying" notes) and fill the IDX_ constants.
static void DumpVtable(void* instance, size_t count, const char* tag) {
    if (!instance) return;
    void** vt = *reinterpret_cast<void***>(instance);
    std::cout << "[vtable] " << tag << " @ +0x" << std::hex
              << ((uintptr_t)vt - Globals::BaseAddress) << std::dec << std::endl;
    for (size_t i = 0; i < count; ++i)
        std::cout << "  [" << i << "] +0x" << std::hex
                  << ((uintptr_t)vt[i] - Globals::BaseAddress) << std::dec << std::endl;
}

// 1.12.0 (UE 4.26.2). These are kept for optional diagnostics only. The critical
// virtuals below are hooked by runtime-confirmed concrete RVAs for this frozen build.
constexpr size_t IDX_UGAMEENGINE_TICK          = 0;
constexpr size_t IDX_INTERNAL_GET_NETMODE      = 0;
constexpr size_t IDX_UNETCONNECTION_ISNETREADY = 0;
constexpr size_t IDX_UNETDRIVER_ISLEVELINIT    = 0;
constexpr size_t IDX_AACTOR_GETFUNCTIONCALLSPACE = 69; // Confirmed from HOOK_TARGETS_1.12.0.md
constexpr size_t IDX_AGAMEMODEBASE_CHOOSEPLAYERSTART = 207; // Confirmed from HOOK_TARGETS_1.12.0.md

__declspec(dllexport) const char* DummyLinkFunc() {
    return "mrow :3";
}

// Shared with tools/CatalogExporter/StoreRuntimeExporter.cpp. The runtime project compiles that same
// read-only source so an opted-in client capture does not depend on manually injecting a second DLL.
extern int RunStoreRuntimeExportWhenReady(DWORD timeoutMs);

static DWORD WINAPI RewardCacheCaptureThread(LPVOID) {
    MpLog("[RewardCacheCapture] waiting up to 15 minutes for the season_store view model");
    const int result = RunStoreRuntimeExportWhenReady(15u * 60u * 1000u);
    MpLog("[RewardCacheCapture] worker finished result=" + std::to_string(result));
    return 0;
}

void MainThread() {
    InitLog("[MainThread] Entry");

    // Build log string piece by piece to isolate crash point
    std::string logMsg = "\n=== ParadoxRuntime session start ===\n[MainThread] started. AmServer=";
    logMsg += (Globals::AmServer ? "1" : "0");
    InitLog("[MainThread] Built AmServer part");

    logMsg += " port=";
    logMsg += std::to_string(Globals::Port);
    InitLog("[MainThread] Built port part");

    logMsg += " map=";
    if (Globals::MapPath) {
        logMsg += MpNarrow(std::wstring(Globals::MapPath));
    } else {
        logMsg += "(null)";
    }
    logMsg += " base=";
    logMsg += MpHex(Globals::BaseAddress);
    // Never persist the process command line. Client launches contain the one-time
    // exchange code plus account/display identifiers, while server launches contain
    // the deploy key and hunt routing details. None of those values are needed in
    // the session banner.
    InitLog("[MainThread] Built map part, calling MpLog...");

    MpLog(logMsg);
    MpLog(std::string("[FlagCache] flag-file cache ") + MpFlagCacheModeText());
    MpLogBackendAddress();   // [2026-10-13 realms S1] source=env|built-in, resolved in Init
    InitLog("[MainThread] MpLog returned, entering UWorld wait loop");

    if (Globals::AmServer && Globals::AuthMode == Globals::ServerAuthMode::Invalid) {
        MpLog("[ServerAuth] unknown MYSTICPARADOX_AUTH_MODE; terminating before listen");
        TerminateProcess(GetCurrentProcess(), 0xE102);
        return;
    }

    // The optional player-hosted mode starts its own workers before listen (P2PHooks.h).
    if (Globals::AmServer && Globals::AuthMode == Globals::ServerAuthMode::HuntCapability
        && !P2PHooks::StartServer()) {
        return;
    }

    // Opt-in Reward Cache contract capture. This runs only in the normal client role and only when
    // REWARD_CACHE_CAPTURE.flag exists next to Dauntless-Win64-Shipping.exe. The worker waits for the
    // exact live season_store view model before writing, so launching with the flag cannot overwrite
    // the previous capture with empty startup output. Dedicated servers never create this thread.
    if (!Globals::AmServer && MpExeRelativeFlagPresent(L"REWARD_CACHE_CAPTURE.flag")) {
        HANDLE captureThread = CreateThread(nullptr, 0, RewardCacheCaptureThread, nullptr, 0, nullptr);
        if (captureThread) {
            CloseHandle(captureThread);
            MpLog("[RewardCacheCapture] worker started (REWARD_CACHE_CAPTURE.flag present)");
        }
        else {
            MpLog("[RewardCacheCapture] CreateThread failed error=" + std::to_string(GetLastError()));
        }
    }

    // Emit boot-patch status here (InitServerHooks recorded it under loader lock where InitLog is a no-op).
    if (Globals::AmServer && !Globals::Move10Status.empty()) {
        MpLog(std::string("[BootPatch] status:") + Globals::Move10Status);
    }

    int waitCount = 0;
    while (true) {
        InitLog(std::string("[MainThread] Loop iteration ") + std::to_string(waitCount) + ", calling UWorld::GetWorld()...");
        UWorld* world = UWorld::GetWorld();
        UWorld* directGWorld = nullptr;
        if (Globals::BaseAddress) {
            directGWorld = *reinterpret_cast<UWorld**>(Globals::BaseAddress + 0x06FC7F58);
        }
        if (Globals::AmServer) {
            MpLog("[MainThread] wait=" + std::to_string(waitCount)
                + " SDKWorld=" + MpPtr(world)
                + " DirectGWorld=" + MpPtr(directGWorld));
        }
        InitLog(std::string("[MainThread] UWorld::GetWorld() returned: ") + (world ? "non-null" : "null"));
        if (world || directGWorld) break;

        if (Globals::AmServer) {
            InitLog("[MainThread] About to Sleep(1000)...");
            Sleep(1000);
            InitLog("[MainThread] Sleep complete, incrementing waitCount");
            waitCount++;
            InitLog(std::string("[MainThread] waitCount now: ") + std::to_string(waitCount));
            if (waitCount >= 30) {
                InitLog("[MainThread] Waited 30s for UWorld, giving up");
                break;
            }
        }
        else {
            Sleep(1);
        }
    }
    InitLog("[MainThread] Exited UWorld wait loop");

    if (Globals::AmServer) {
        MpLog("[MainThread] UWorld is live; requesting listen immediately");
        Globals::DoListen = true;
        return;
    }

    Sleep(3 * 1000);

    UEngine* Engine = UEngine::GetEngine();

    UInputSettings::GetDefaultObj()->ConsoleKeys[0].KeyName = UKismetStringLibrary::Conv_StringToName(L"F2");

    UObject* NewObject = UGameplayStatics::SpawnObject(Engine->ConsoleClass, Engine->GameViewport);

    Engine->GameViewport->ViewportConsole = static_cast<UConsole*>(NewObject);

    if (Globals::EnableLogging)
        std::cout << "Spawned UConsole!" << std::endl;
}

// [1.12.0] Engine allocator bridge.
// The modern Dumper-7 SDK's FString has NO allocating operator=: FString(const wchar_t*) only
// ALIASES the pointer (Data = const_cast<wchar_t*>(Str)) and TArray::operator= is a defaulted
// shallow copy. So `*Ret = someStdWString.c_str()` left the engine's map FString pointing at a
// std::wstring buffer that is freed (CRT) when the local goes out of scope. When the engine then
// grew/append'd that URL it called FMemory::Realloc on the dangling, non-engine pointer and
// FMallocBinned2 aborted with "Attempt to realloc an unrecognized block ... canary == 0x0 != 0xe3"
// (Fatal), so the dedicated server exited during boot -- upstream of Networking::Listen.
// (The 1.4.4 build worked because its older SDK wired FString allocation to the engine via
//  UC::FMemory::Init; the modern SDK has no such namespace, so we bridge to the engine allocator
//  manually here.)
//
// We call FMemory::Realloc, the free-function wrapper (Ghidra FUN_1423bb590, RVA 0x023BB590):
//     void* FMemory::Realloc(void* Original, size_t Count, uint32 Alignment)
// It lazily initializes GMalloc and dispatches through GMalloc's vtable (Realloc == vtable+0x20),
// so it is correct even though GMalloc is a PROXY/wrapper rather than a raw FMallocBinned2.
// (Calling FMallocBinned2::Realloc 0x003930D0 directly with GMalloc as `this` crashed with
//  EXCEPTION_ACCESS_VIOLATION writing 0x2b, proving GMalloc's dynamic type is not FMallocBinned2.)
// Verified in Ghidra: FMemory::Malloc=GMalloc->vt[+0x10] (FUN_1423b8de0), FMemory::Realloc=vt[+0x20]
// (FUN_1423bb590), FMemory::Free=vt[+0x30] (FUN_1423aaed0); GMalloc=DAT_146b532d0 (RVA 0x06B532D0).
// FMemory::Realloc(nullptr, size, 0) degrades to a plain malloc, so a null Data is safe.
static void* EngineRealloc(void* Ptr, size_t NewSize) {
    InitLog(std::string("[EngineRealloc] Entry: Ptr=") + (Ptr ? "0x" + std::to_string((uintptr_t)Ptr) : "NULL") + " NewSize=" + std::to_string(NewSize));

    uintptr_t Base = Globals::BaseAddress ? Globals::BaseAddress : reinterpret_cast<uintptr_t>(GetModuleHandleA(nullptr));
    using ReallocFn = void* (*)(void*, size_t, uint32_t);
    void* Result = reinterpret_cast<ReallocFn>(Base + 0x02564AB0)(Ptr, NewSize, 0);
    InitLog(std::string("[EngineRealloc] FMemory::Realloc returned: ") + (Result ? "0x" + std::to_string((uintptr_t)Result) : "NULL"));

    return Result;
}

// [2026-07-16] Late-join lifecycle snapshot (read-only, no behaviour change). Walks GObjects for
// the live AArchonGameMode + AArchonGameState and logs match/session/capacity state so we can see
// exactly how it differs at each connection edge (P1 join / P2 join / P1 leave) and pinpoint the
// native event that only enables P2 after P1 leaves. Offsets from SDK: GameMode GameSession +0x278,
// MatchState +0x2C0, NumSpectators +0x2CC, NumPlayers +0x2D0, NumTravellingPlayers +0x2DC,
// ExpectedPlayerCount +0x498, MaxPlayers +0x49C; GameState MatchState +0x270; GameSession MaxPlayers +0x224.
//
// [2026-10-11 1.14.7 O2 join/leave hitch] The walk below visited GUObjectArray (~208k objects on Ramsgate, an IsA per
// object) at EVERY connection-count change, match-state change and PostLogin-named ProcessEvent - several walks per
// join or leave, the 277 ms frames seen on joins. The two objects now come from the world itself:
// GWorld->AuthorityGameMode (+0x118) and GWorld->GameState (+0x120), the same reads the ExpectedPlayerCount sync and
// the AFK timeout already use (Offsets::GWorld 0x06FC7F58), each checked as a live non-CDO object of the Archon class.
// The walk's "first instance found" could even be a leftover from an earlier world; the world's pointers are the live
// ones. Same line format. LEGACY_LIFECYCLE_WALK.flag (read once) restores the walks here, in the match-state tracker,
// the progression-config resume and the arrival-trigger probe.
static bool MpLegacyLifecycleWalk() {
    static int s_mode = -1;
    if (s_mode < 0) {
        s_mode = MpExeRelativeFlagPresent(L"LEGACY_LIFECYCLE_WALK.flag") ? 1 : 0;
        MpLog(std::string("[Lifecycle] GameMode/GameState lookup = ")
            + (s_mode ? "full GObjects walk (LEGACY_LIFECYCLE_WALK.flag present)"
                      : "world pointers GWorld+0x118 / +0x120 (default)"));
    }
    return s_mode == 1;
}

// Live non-CDO object of Cls, or nullptr. Game thread.
static SDK::UObject* MpLiveObjectOfClass(SDK::UObject* Obj, SDK::UClass* Cls) {
    if (!Obj || !Cls || !IsRegisteredLiveObject(Obj) || Obj->IsDefaultObject() || !Obj->Class
        || !IsRegisteredLiveObject(Obj->Class) || !Obj->IsA(Cls)) {
        return nullptr;
    }
    return Obj;
}

// The world's AArchonGameMode (+0x118) and AArchonGameState (+0x120); either may come back null. Game thread.
static void MpWorldGameModeAndState(SDK::UObject*& OutGameMode, SDK::UObject*& OutGameState) {
    OutGameMode = nullptr;
    OutGameState = nullptr;
    SDK::UWorld* World = SDK::UWorld::GetWorld();
    if (!World || !IsReadablePointer(World, 0x128)) return;
    const uintptr_t W = reinterpret_cast<uintptr_t>(World);
    OutGameMode = MpLiveObjectOfClass(*reinterpret_cast<SDK::UObject**>(W + 0x118), SDK::AArchonGameMode::StaticClass());
    OutGameState = MpLiveObjectOfClass(*reinterpret_cast<SDK::UObject**>(W + 0x120), SDK::AArchonGameState::StaticClass());
}

static void LogArchonLifecycle(const char* Tag) {
    if (!SDK::UObject::GObjects) { return; }
    SDK::UObject* GmObj = nullptr;
    SDK::UObject* GsObj = nullptr;
    if (!MpLegacyLifecycleWalk()) {
        MpWorldGameModeAndState(GmObj, GsObj);
    } else {
        const int Count = SDK::UObject::GObjects->Num();
        for (int i = 0; i < Count; i++) {
            SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
            if (!Obj || Obj->IsDefaultObject()) { continue; }
            if (!GmObj && Obj->IsA(SDK::AArchonGameMode::StaticClass())) { GmObj = Obj; }
            else if (!GsObj && Obj->IsA(SDK::AArchonGameState::StaticClass())) { GsObj = Obj; }
            if (GmObj && GsObj) { break; }
        }
    }

    std::string Msg = std::string("[Lifecycle:") + Tag + "]";

    if (GmObj && IsReadablePointer(GmObj, 0x4A0)) {
        uintptr_t Gm = reinterpret_cast<uintptr_t>(GmObj);
        std::string MatchState = "?";
        if (IsReadablePointer(reinterpret_cast<void*>(Gm + 0x02C0), 8)) {
            MatchState = reinterpret_cast<SDK::FName*>(Gm + 0x02C0)->ToString();
        }
        void* GameSession = *reinterpret_cast<void**>(Gm + 0x0278);
        int32_t GsMax = -1;
        if (IsReadablePointer(GameSession, 0x228)) {
            GsMax = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(GameSession) + 0x0224);
        }
        Msg += " GM=" + MpPtr(GmObj) + " class=" + GmObj->Class->GetName()
            + " match=" + MatchState
            + " NumPlayers=" + std::to_string(*reinterpret_cast<int32_t*>(Gm + 0x02D0))
            + " NumSpectators=" + std::to_string(*reinterpret_cast<int32_t*>(Gm + 0x02CC))
            + " NumTravelling=" + std::to_string(*reinterpret_cast<int32_t*>(Gm + 0x02DC))
            + " ExpectedPlayerCount=" + std::to_string(*reinterpret_cast<int32_t*>(Gm + 0x0498))
            + " MaxPlayers=" + std::to_string(*reinterpret_cast<int32_t*>(Gm + 0x049C))
            + " GameSession=" + MpPtr(GameSession) + " GS.MaxPlayers=" + std::to_string(GsMax);
    } else {
        Msg += " GM=null";
    }

    if (GsObj && IsReadablePointer(GsObj, 0x278)) {
        uintptr_t Gs = reinterpret_cast<uintptr_t>(GsObj);
        std::string GsMatch = "?";
        if (IsReadablePointer(reinterpret_cast<void*>(Gs + 0x0270), 8)) {
            GsMatch = reinterpret_cast<SDK::FName*>(Gs + 0x0270)->ToString();
        }
        Msg += " | GState=" + MpPtr(GsObj) + " match=" + GsMatch;
    } else {
        Msg += " | GState=null";
    }

    MpLog(Msg);
}

// [2026-07-17 empty-server watchdog robustness] Authoritative "is this instance empty?" using
// AGameMode::NumPlayers (+0x2D0) and NumTravellingPlayers (+0x2DC) instead of scanning UNetConnections.
// The connection scan's HasConnection stays stuck TRUE when a player's connection lingers/zombies after
// they travel out, so the 50s empty-exit never fired and empty hunts leaked RAM (reported). NumPlayers is
// decremented on Logout; NumTravellingPlayers keeps a server whose players are still LOADING IN (big maps)
// from being counted as empty. Cached + throttled so we never walk GObjects every tick.
//   Returns: 1 = empty (no players, none incoming), 0 = occupied/incoming, -1 = GameMode not found yet.
static SDK::UObject* g_CachedGameMode = nullptr;
static uint64_t g_LastGameModeSearchMs = 0;
// [2026-07-18 crash fix] Published by the GAME THREAD only (from GameModeEmptyState, called in the tick).
// The background empty-watchdog thread must NEVER walk GObjects or call IsA/GetName itself — doing that
// off the game thread races the engine spawning/destroying actors and crashed with an access violation
// inside the game's AppendString/IsA (all-Dauntless callstack, reading 0x248). The AArchonGameMode object
// persists for the whole process, so once published its pointer stays valid and NumPlayers/NumTravelling
// are safe plain int reads from any thread.
static std::atomic<void*> g_wdGameModePtr{ nullptr };
// [1.14.7 2026-10-10] Set when this server booted without the phantom local player (every server role since 0.2.110;
// false only if the byte guard in InitServerHooks failed); the first login then starts the match (MpStartMatchWithoutPhantom).
static std::atomic<bool> g_NoLocalPlayerApplied{ false };
static std::atomic<uint64_t> g_MpLastPostLoginMs{ 0 };   // [2026-10-10 arrival-trigger probe] last server K2_PostLogin
// [2026-10-10 GrantTrace] The reflected (Blueprint/UFunction) call chain on this thread, written by the server
// ProcessEventHook's depth guard and read by the inventory-transaction hook to name the Blueprint behind a grant.
static thread_local SDK::UFunction* g_MpPeChain[64] = {};
static thread_local int g_MpPeChainDepth = 0;

// [1.14.7 WATCHDOG HEALTH FIX 2026-10-04] The watchdog thread used to dereference g_wdGameModePtr to read the
// player counts. That pointer is only refreshed while the game thread keeps calling GameModeEmptyState(), so
// after a map change (the Training AFK LeavingMap) it can outlive the GameMode and the thread then read
// garbage - observed as "numPlayers=344066816", an impossible count that cannot establish world health and
// that the reap decision was being made from. The counts are now read on the GAME thread and published as
// plain values, with a timestamp, so the watchdog does no UObject dereference at all (which is what its own
// comment always intended). A stale or implausible sample is treated as UNKNOWN and never reaps.
// [1.14.7 AVAILABILITY TEST 2026-10-04] The definitive "am I still serving?" check: try to bind our own UDP
// port. While the hub holds it the bind fails; after the AFK idle-out the socket is gone and the bind
// succeeds. Measured on the Training hub: at t+150s the match state was LeavingMap and UDP 8789 was unbound,
// yet the published counts stayed fresh (countsUsable=1, numPlayers=1) because the GameMode survives the map
// exit - so a counts-based trigger never fires. The port is the honest signal.
// [2026-10-11 1.14.7 P2P host] Probe the address the server is actually bound to. Windows lets a wildcard bind
// (0.0.0.0:port) succeed while another socket holds a specific address on the same port (127.0.0.1:port) unless that
// socket used SO_EXCLUSIVEADDRUSE, so once the player host binds loopback only (MULTIHOME, see
// MpCarryMultihomeIntoEngineLine) an INADDR_ANY probe would report the port free while the host is serving, and the
// 45 s rule in the watchdog thread would reap it about 45 s after its first GameMode sample. The engine binds the MULTIHOME address when its command line has one, else
// every interface: the probe now binds the same address (a same-address bind fails while the server holds it, the
// measured hub behaviour). This keeps the alive-but-unavailable exit for the host and for any server given a
// MULTIHOME, which skipping the check for the player host would have lost. An address this IPv4 probe cannot
// express (IPv6) means "cannot test": never act.
static bool MpOurUdpPortIsFree() {
    const int Port = static_cast<int>(Globals::Port);
    if (Port <= 0 || Port > 65535) return false;      // unknown port: never act
    uint32_t BindHostOrder = INADDR_ANY;
    if (InterlockedCompareExchange(&g_MpEngineMultihomeState, 0, 0) != 0 && g_MpEngineMultihomeA[0] != '\0'
        && !MpParseIpv4Literal(g_MpEngineMultihomeA, BindHostOrder)) {
        static std::atomic<bool> s_loggedUntestable{ false };
        if (!s_loggedUntestable.exchange(true, std::memory_order_relaxed)) {
            MpLog(std::string("[Watchdog/thread] port probe: MULTIHOME=") + g_MpEngineMultihomeA
                + " is not IPv4; the port-free check is off for this server (never acts)");
        }
        return false;
    }
    SOCKET Probe = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
    if (Probe == INVALID_SOCKET) return false;        // cannot test: never act
    sockaddr_in Addr{};
    Addr.sin_family = AF_INET;
    Addr.sin_port = htons(static_cast<u_short>(Port));
    Addr.sin_addr.s_addr = htonl(BindHostOrder);
    const bool Bound = (bind(Probe, reinterpret_cast<sockaddr*>(&Addr), sizeof(Addr)) == 0);
    closesocket(Probe);
    return Bound;
}

static std::atomic<bool>      g_wdEverHadCounts{ false };   // has this hub ever been in a map?
static std::atomic<int32_t>   g_wdNumPlayers{ -1 };
static std::atomic<int32_t>   g_wdNumTravelling{ -1 };
static std::atomic<uint64_t>  g_wdCountsStampMs{ 0 };
static constexpr int32_t MP_WD_MAX_PLAUSIBLE_PLAYERS = 64;
static constexpr uint64_t MP_WD_COUNTS_MAX_AGE_MS = 10000;
static std::atomic<int>   g_wdIsHub{ -1 };   // -1 unknown, 0 disposable (reapable), 1 persistent hub

/*
 * [1.14.7 EMPTY-HUNT FIX 2026-10-09] Remote client connections, published by the game thread from
 * NetDriver->ClientConnections.Num (the [NetConnEdge] count).
 *
 * Until runtime 0.2.110 a 1.14.7 server owned one local (phantom) player (38_ §12), so GameMode NumPlayers never dropped
 * below 1 and an emptied hunt never looked empty: every hunt stayed alive and the third one filled
 * DeployServer's cap ("Hunt server capacity reached (3/3)", 38_ §18.4). Measured on three hunts on 9 Oct:
 * [NetConnEdge] connCount 1 -> 0 when the player left, with NumPlayers=1 before and after. The connection
 * count is therefore the emptiness signal; NumPlayers is still logged.
 */
static std::atomic<int32_t>   g_wdConnCount{ -1 };
static std::atomic<uint64_t>  g_wdConnStampMs{ 0 };
static std::atomic<bool>      g_wdHadRemoteClient{ false };   // a client has connected at least once
// [2026-10-15 0.2.139] 50 -> 60 s (owner's call: every hunt is player-hosted now; the backend drains it meanwhile).
static constexpr float MP_WD_EMPTY_REAP_SEC = 60.0f;           // after the last client left
static constexpr float MP_WD_NEVER_JOINED_REAP_SEC = 300.0f;   // spawned, but nobody ever arrived

/*
 * [2026-07-18 STALE-TICK REAP] Game-thread tick heartbeat.
 *
 * THE DEADLOCK THIS BREAKS (observed on port 8787, pid 6920, BPGM_ArchonEscalation_C):
 *   22:02:08  [NetConnEdge] connCount 2 -> 1        <- second player leaves
 *             ...no 1 -> 0 edge is EVER logged...
 *   22:12:42  last [SRA enter] ClientConns=1        <- engine tick winds down, one connection still open
 *   22:41:26  [Watchdog/thread] numPlayers=1 empty=0 emptySec=0
 * The instance sat occupied-by-a-ghost for 39+ minutes and kept holding a concurrent-server slot until
 * DeployServer refused new hunts.
 *
 * Why the existing emptiness test cannot catch it: a player who travels back to Ramsgate without a clean
 * close leaves a stale UNetConnection. UE reaps stale connections from UNetDriver::TickDispatch — but the
 * tick is exactly what stops once players are gone. So the connection is never timed out, GameMode::Logout
 * never fires, NumPlayers stays 1, and the watchdog's `empty` is never true. The cleanup depends on the
 * very tick whose absence is the problem.
 *
 * The fix: publish a heartbeat from the game thread. A hunt with real players in it always ticks, so a
 * disposable instance whose tick has been silent for minutes is finished by definition — reap it
 * regardless of what NumPlayers claims. This is a plain timestamp store (no GObjects/FName work), so it
 * is safe on the game thread and a plain read on the watchdog thread.
 */
static std::atomic<uint64_t> g_wdLastTickMs{ 0 };
// Set once the instance has actually ticked with a player present. Prevents reaping a freshly spawned
// server that has not reached its first tick yet (its heartbeat would look "stale" from birth).
static std::atomic<bool> g_wdSawPlayer{ false };
// Game thread id, published from the game thread. Needed to capture WHERE it is stuck (see below).
static std::atomic<uint32_t> g_wdGameThreadId{ 0 };

// [2026-10-10 1.14.7 RAM] Last GetTickCount64() at which the game thread saw at least one remote client connection
// (stored every frame while ClientConnections.Num > 0). The hub working-set trim uses it so a client that connects and
// leaves between two 2 s watchdog polls still breaks the idle window and re-arms the trim.
static std::atomic<uint64_t> g_wdLastRemoteConnMs{ 0 };

// [2026-10-10 1.14.7 Perf] Frame counters for the once-a-minute [Perf] line. Written by the game thread at the top of
// GameEngineTickHook (servers only) with relaxed atomics; drained with exchange(0) by the watchdog thread. Reset on the
// game thread at listen (StartEmptyWatchdogThread), so boot and map-load frames never reach the first window.
// Read-only timing: nothing here changes the frame or net tick cadence.
static std::atomic<uint64_t> g_perfFrames{ 0 };          // frame intervals measured (entry to entry)
static std::atomic<uint64_t> g_perfFrameTicksSum{ 0 };   // QPC ticks summed over those intervals
static std::atomic<uint64_t> g_perfFrameTicksMax{ 0 };
static std::atomic<uint64_t> g_perfHitches{ 0 };         // intervals > 100 ms
static std::atomic<uint64_t> g_perfEngineCalls{ 0 };     // OrigGameEngineTick calls timed
static std::atomic<uint64_t> g_perfEngineTicksSum{ 0 };  // QPC ticks inside OrigGameEngineTick
static std::atomic<int64_t>  g_perfLastFrameQpc{ 0 };    // 0 = start a new interval on the next frame
static std::atomic<int64_t>  g_perfQpcFreq{ 0 };

/*
 * [2026-10-11 1.14.7 O0 measurement] The [Perf] timer covers only OrigGameEngineTick, but the replication-graph drive
 * and the manual TickDispatch/TickFlush run after it, outside the timer, and an idle hub burns ~1.5 logical CPUs that
 * the 0.5-1 ms engine tick does not explain. [PerfDetail] (same 60 s cadence, servers only) adds avg/max per call for
 * the engine tick, graph drive, manual dispatch and manual flush; ReplicateActor calls and replicated bits per frame
 * (and per connection); replication-graph sizes; [PerfThreads] the top threads by CPU with their start module+RVA;
 * [PerfNet] wire bytes per peer (MpWireCount). Everything is counters and QPC reads on the game thread, read and
 * logged by the watchdog thread; nothing changes a tick, rate or replication setting. NO_PERF_DETAIL.flag (read once)
 * turns all of it off, including the sendto hook.
 */
struct MpPerfPhase {
    std::atomic<uint64_t> Calls{ 0 };
    std::atomic<uint64_t> Sum{ 0 };
    std::atomic<uint64_t> Max{ 0 };
};
static MpPerfPhase g_perfPhaseEngine;     // OrigGameEngineTick (same calls as the [Perf] engine counters, plus max)
static MpPerfPhase g_perfPhaseGraph;      // MpDriveReplicationGraph
static MpPerfPhase g_perfPhaseDispatch;   // SafeManualTickDispatch
static MpPerfPhase g_perfPhaseFlush;      // SafeManualTickFlush
static std::atomic<uint64_t> g_perfRepActorCalls{ 0 };   // ReplicateActorFreqHook entries
static std::atomic<uint64_t> g_perfRepActorBits{ 0 };    // sum of the native ReplicateActor return (bits written)
// Replication-graph sizes, sampled by the game thread every 2 s (MpPerfSampleGraphCounts); -1 = not read.
static std::atomic<int32_t> g_perfGraphConns{ -1 };
static std::atomic<int32_t> g_perfGraphGlobalActors{ -1 };
static std::atomic<int32_t> g_perfGraphActorInfoSum{ -1 };
static std::atomic<int32_t> g_perfGraphActorInfoMax{ -1 };
static std::atomic<int32_t> g_perfClientConns{ -1 };
static std::atomic<int32_t> g_perfOpenChannelsSum{ -1 };
static std::atomic<int32_t> g_perfOpenChannelsMax{ -1 };
static std::atomic<uint64_t> g_perfGraphSampleMs{ 0 };
// Replicated bits per connection (UActorChannel+0x28), game thread writes, watchdog drains. The reader asks for a reset
// after each window; the game thread then clears the keys, so the table holds the connections of one window.
struct MpRepBitsSlot {
    std::atomic<void*> Conn{ nullptr };
    std::atomic<uint64_t> Bits{ 0 };
    std::atomic<uint64_t> Calls{ 0 };
};
static MpRepBitsSlot g_repBitsSlots[64];
static std::atomic<uint64_t> g_repBitsOverflow{ 0 };
static std::atomic<bool> g_repBitsResetRequested{ false };
static void* g_repBitsLastConn = nullptr;   // game thread only
static int g_repBitsLastSlot = -1;

static bool MpPerfDetailEnabled() {
    static volatile LONG s_mode = -1;   // -1 = not decided, 1 = on, 0 = off (client or NO_PERF_DETAIL.flag)
    LONG Mode = s_mode;                 // plain aligned read: this runs for every replicated channel
    if (Mode < 0) {
        Mode = (Globals::AmServer && !MpExeRelativeFlagPresent(L"NO_PERF_DETAIL.flag")) ? 1 : 0;
        InterlockedExchange(&s_mode, Mode);
    }
    return Mode == 1;
}

static void MpPerfPhaseAdd(MpPerfPhase& Phase, int64_t T0, int64_t T1) {
    if (T1 <= T0) return;
    const uint64_t D = static_cast<uint64_t>(T1 - T0);
    Phase.Calls.fetch_add(1, std::memory_order_relaxed);
    Phase.Sum.fetch_add(D, std::memory_order_relaxed);
    uint64_t Max = Phase.Max.load(std::memory_order_relaxed);
    while (D > Max && !Phase.Max.compare_exchange_weak(Max, D, std::memory_order_relaxed)) {}
}

static int64_t MpQpcNow() {
    LARGE_INTEGER T{};
    QueryPerformanceCounter(&T);
    return T.QuadPart;
}

// Game thread (ReplicateActorFreqHook). Bits = the native ReplicateActor return; Conn = the channel's connection.
static void MpRepBitsAdd(void* Conn, int64_t Bits) {
    if (g_repBitsResetRequested.load(std::memory_order_relaxed)) {
        for (MpRepBitsSlot& S : g_repBitsSlots) {
            S.Conn.store(nullptr, std::memory_order_relaxed);
            S.Bits.store(0, std::memory_order_relaxed);
            S.Calls.store(0, std::memory_order_relaxed);
        }
        g_repBitsLastConn = nullptr;
        g_repBitsLastSlot = -1;
        g_repBitsResetRequested.store(false, std::memory_order_relaxed);
    }
    const uint64_t Add = Bits > 0 ? static_cast<uint64_t>(Bits) : 0;
    int Slot = -1;
    if (Conn && Conn == g_repBitsLastConn && g_repBitsLastSlot >= 0) {
        Slot = g_repBitsLastSlot;
    } else if (Conn) {
        int Free = -1;
        for (int i = 0; i < 64; ++i) {
            void* K = g_repBitsSlots[i].Conn.load(std::memory_order_relaxed);
            if (K == Conn) { Slot = i; break; }
            if (!K && Free < 0) Free = i;
        }
        if (Slot < 0 && Free >= 0) {
            g_repBitsSlots[Free].Conn.store(Conn, std::memory_order_relaxed);
            Slot = Free;
        }
        g_repBitsLastConn = Slot >= 0 ? Conn : nullptr;
        g_repBitsLastSlot = Slot;
    }
    if (Slot < 0) {
        g_repBitsOverflow.fetch_add(Add, std::memory_order_relaxed);
        return;
    }
    g_repBitsSlots[Slot].Bits.fetch_add(Add, std::memory_order_relaxed);
    g_repBitsSlots[Slot].Calls.fetch_add(1, std::memory_order_relaxed);
}

static void MpPerfFrameSample(int64_t NowQpc) {
    int64_t Freq = g_perfQpcFreq.load(std::memory_order_relaxed);
    if (Freq == 0) {
        LARGE_INTEGER F{};
        QueryPerformanceFrequency(&F);
        Freq = F.QuadPart;
        g_perfQpcFreq.store(Freq, std::memory_order_relaxed);
    }
    const int64_t Last = g_perfLastFrameQpc.exchange(NowQpc, std::memory_order_relaxed);
    if (Last <= 0 || NowQpc <= Last) return;
    const uint64_t D = static_cast<uint64_t>(NowQpc - Last);
    g_perfFrames.fetch_add(1, std::memory_order_relaxed);
    g_perfFrameTicksSum.fetch_add(D, std::memory_order_relaxed);
    uint64_t Max = g_perfFrameTicksMax.load(std::memory_order_relaxed);
    while (D > Max && !g_perfFrameTicksMax.compare_exchange_weak(Max, D, std::memory_order_relaxed)) {}
    if (Freq > 0 && D * 10 > static_cast<uint64_t>(Freq)) g_perfHitches.fetch_add(1, std::memory_order_relaxed);
}

static void MpPerfResetCounters() {
    g_perfFrames.store(0, std::memory_order_relaxed);
    g_perfFrameTicksSum.store(0, std::memory_order_relaxed);
    g_perfFrameTicksMax.store(0, std::memory_order_relaxed);
    g_perfHitches.store(0, std::memory_order_relaxed);
    g_perfEngineCalls.store(0, std::memory_order_relaxed);
    g_perfEngineTicksSum.store(0, std::memory_order_relaxed);
    g_perfLastFrameQpc.store(0, std::memory_order_relaxed);
    // [2026-10-11 1.14.7 O0] [PerfDetail] counters start at listen too.
    for (MpPerfPhase* P : { &g_perfPhaseEngine, &g_perfPhaseGraph, &g_perfPhaseDispatch, &g_perfPhaseFlush }) {
        P->Calls.store(0, std::memory_order_relaxed);
        P->Sum.store(0, std::memory_order_relaxed);
        P->Max.store(0, std::memory_order_relaxed);
    }
    g_perfRepActorCalls.store(0, std::memory_order_relaxed);
    g_perfRepActorBits.store(0, std::memory_order_relaxed);
    g_repBitsResetRequested.store(true, std::memory_order_relaxed);
}

// [2026-07-19 HANG DIAG] Breadcrumb ring of the last UFunction names the GAME THREAD dispatched through
// ProcessEvent. Written on the game thread (ProcessEventHook already has the cached full name of every call, so
// we just strncpy that into a fixed slot — NO extra name resolution, NO heap). The watchdog thread reads
// these fixed char buffers when a hang is detected, so it never has to resolve an FName off-thread (which
// previously crashed). When the game thread freezes inside a UFunction, ring[pos-1] IS that function.
static constexpr int  kPeRing = 32;
static char           g_gtPeNameRing[kPeRing][160] = {};
static std::atomic<uint32_t> g_gtPeRingPos{ 0 };
// Innermost currently-dispatching UFunction*/object pointers (raw, for Ghidra) — plain diagnostic stores.
static std::atomic<void*>    g_gtPeCurFunc{ nullptr };
static std::atomic<void*>    g_gtPeCurObj{ nullptr };

/*
 * [2026-07-18] Capture the game thread's instruction pointer while it is hung.
 *
 * WHY: the observed failure is a HANG, not a crash — replication runs healthily at 60Hz and then stops
 * dead mid-hunt with no exception, no exit, and no UE log line (port 8788, pid 7332: last [SRA] and
 * [RepFreq] at 22:39:57, then only watchdog output). The process stays alive, so the client just times
 * out and gets bounced to login. Nothing in any existing log says where it stopped.
 *
 * MpLogStack cannot answer this: CaptureStackBackTrace walks the CALLING thread, and the caller here is
 * the watchdog thread, which is fine. We need the frozen thread's RIP, which requires suspending it and
 * reading its context.
 *
 * The logged address is module-relative (via MpAddress), so it can be pasted straight into Ghidra to
 * identify the blocking call. That converts "the server hangs sometimes" into a specific function.
 *
 * Safety: the context is captured and the thread resumed IMMEDIATELY, before any logging — logging while
 * holding a suspended thread risks deadlock if that thread owns the log's lock. Only ever called from
 * the stale-tick path, i.e. when the instance is already condemned.
 */
/*
 * [2026-07-18] Reap by TerminateProcess, NOT exit().
 *
 * WHY: exit() runs UE's static destructors and atexit handlers, and that teardown is broken on this
 * build. Measured across four reaps in one evening:
 *     pid 6640: reap 21:07:31.720 -> ucrtbase!abort 21:08:32.076   = 60.4s
 *     pid 7004: reap 21:58:59.964 -> ucrtbase!abort 22:00:00.094   = 60.1s
 * Exactly 60 seconds each — a shutdown timeout giving up and calling abort(), which the DeployServer
 * then reports as `exited code=3221226505` (0xC0000409). That alarming code is NOT a gameplay crash;
 * it is our own clean reap dying badly.
 *
 * It gets worse: during that teardown an access violation fires, and UE's unhandled-exception filter
 * (FUN_1424a7da0) crashes *itself* trying to report it —
 *     1424a7dda  CALL 0x1423ab2f0        ; Meyers-singleton getter
 *     1424a7ddf  MOV  RCX,RAX
 *     1424a7de2  MOV  RDX,qword ptr [RAX] ; <-- RAX == 0, reads [0x0]
 *     1424a7de5  CALL qword ptr [RDX+0x10]
 * The getter caches its instance and registers an atexit destructor; once that destructor has run, the
 * magic-static guard is already set, so the getter returns the destroyed (null) pointer instead of
 * re-creating it. Classic static-destruction-order bug — and it means UE can never write a crash report
 * during shutdown, which is exactly why "the logs don't say it crashed".
 *
 * A disposable hunt server has nothing to flush: all persistence lives in the metagame/Mongo, not in
 * process. So skip the whole broken path — terminate immediately. This frees the port and the
 * concurrency slot ~60s sooner and stops manufacturing scary exit codes.
 *
 * NOTE: this does not FIX UE's teardown or its self-crashing handler; it avoids them. A real crash
 * during gameplay still routes through the same broken filter, so crash reports remain unreliable —
 * our own VEH/ExitTrace logging is the source of truth there.
 */
static void MpReapExit(const char* Reason) {
    MpLog(std::string("[Watchdog/thread] ") + Reason
        + " -> TerminateProcess(0) (skipping UE static teardown; see MpReapExit comment)");
    // Give the log a moment to flush before the process vanishes.
    Sleep(50);
    TerminateProcess(GetCurrentProcess(), 0);
    // Unreachable in practice; retained so the function cannot fall through if Terminate is hooked.
    exit(0);
}

// Object-free stack scan: read the suspended thread's stack upward from RSP and collect values that point
// back into our module's code range (candidate return addresses = a poor-man's call stack). No unwinding
// objects here so it stays SEH-safe; IsReadablePointer guards every read. Kept only as a fallback for the
// accurate RtlVirtualUnwind chain below.
static int ScanStackReturns(uint64_t rsp, uint64_t codeLo, uint64_t codeHi, uint64_t* out, int maxOut) {
    int n = 0;
    for (uint64_t p = rsp; p < rsp + 0x1400 && n < maxOut; p += 8) {
        if (!IsReadablePointer(reinterpret_cast<void*>(p), 8)) break;
        uint64_t v = *reinterpret_cast<uint64_t*>(p);
        if (v >= codeLo && v < codeHi) out[n++] = v;
    }
    return n;
}

// [2026-07-19] ACCURATE x64 stack unwind of a (hung) thread using its captured CONTEXT + the loaded .pdata
// (RtlLookupFunctionEntry / RtlVirtualUnwind — both in ntdll, no DbgHelp dependency). Because the game
// thread is parked in an OS wait, its stack is stable, so unwinding a COPY of the context after resuming is
// safe. This replaces the heuristic retchain with the true caller chain — resolve each frame in Ghidra.
static void MpLogRealStack(CONTEXT ctx) {   // by value: RtlVirtualUnwind mutates it
    for (int i = 0; i < 30 && ctx.Rip; ++i) {
        MpLog("[HangTrace]   frame[" + std::to_string(i) + "] " + MpAddress(reinterpret_cast<void*>(ctx.Rip)));
        DWORD64 imgBase = 0;
        PRUNTIME_FUNCTION rf = RtlLookupFunctionEntry(ctx.Rip, &imgBase, nullptr);
        if (rf) {
            PVOID handlerData = nullptr; DWORD64 establisher = 0;
            RtlVirtualUnwind(UNW_FLAG_NHANDLER, imgBase, ctx.Rip, rf, &ctx, &handlerData, &establisher, nullptr);
        } else {
            // Leaf function (no unwind info): return address sits at [RSP].
            if (!IsReadablePointer(reinterpret_cast<void*>(ctx.Rsp), 8)) break;
            ctx.Rip = *reinterpret_cast<DWORD64*>(ctx.Rsp);
            ctx.Rsp += 8;
        }
    }
}

// [2026-07-19] Snapshot the RIP of EVERY thread in this process. In a lock deadlock the game thread's own
// RIP only says "waiting" — the culprit is whichever OTHER thread holds the lock. This names the
// counterparty (resolve its RIP in Ghidra). Each thread is suspended only momentarily.
static void MpLogAllThreadRips(uint32_t gameTid) {
    HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
    if (snap == INVALID_HANDLE_VALUE) { MpLog("[HangTrace] thread snapshot failed"); return; }
    THREADENTRY32 te{}; te.dwSize = sizeof(te);
    const DWORD myPid = GetCurrentProcessId();
    const DWORD selfTid = GetCurrentThreadId();
    int logged = 0;
    if (Thread32First(snap, &te)) {
        do {
            if (te.th32OwnerProcessID != myPid || te.th32ThreadID == selfTid) continue;
            HANDLE th = OpenThread(THREAD_GET_CONTEXT | THREAD_SUSPEND_RESUME | THREAD_QUERY_INFORMATION, FALSE, te.th32ThreadID);
            if (!th) continue;
            CONTEXT c{}; c.ContextFlags = CONTEXT_CONTROL;
            uint64_t rip = 0;
            if (SuspendThread(th) != (DWORD)-1) { if (GetThreadContext(th, &c)) rip = c.Rip; ResumeThread(th); }
            CloseHandle(th);
            if (rip) {
                MpLog("[HangTrace] thread tid=" + std::to_string(te.th32ThreadID)
                    + (te.th32ThreadID == gameTid ? " (GAME)" : "")
                    + " RIP=" + MpAddress(reinterpret_cast<void*>(rip)));
                ++logged;
            }
        } while (Thread32Next(snap, &te) && logged < 96);
    }
    CloseHandle(snap);
    MpLog("[HangTrace] all-thread snapshot: " + std::to_string(logged) + " threads sampled");
}

static void MpLogHungGameThread() {
    uint32_t Tid = g_wdGameThreadId.load(std::memory_order_relaxed);
    if (Tid == 0) { MpLog("[HangTrace] game thread id unknown; cannot sample"); return; }

    HANDLE Th = OpenThread(THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION | THREAD_SUSPEND_RESUME, FALSE, Tid);
    if (!Th) { MpLog("[HangTrace] OpenThread failed for tid=" + std::to_string(Tid)); return; }

    // Sample the RIP 3x over ~0.5s: identical RIP => truly blocked (deadlock/wait); moving RIP => spinning
    // in a loop. Keep the FULL context of the first sample for an accurate unwind.
    uint64_t rip[3] = { 0,0,0 };
    uint64_t rsp0 = 0;
    uint64_t retChain[12] = {};
    int      retN = 0;
    CONTEXT  fullCtx0{};
    bool     haveCtx0 = false;
    // [1.14.7 2026-10-08] The hard-coded 1.12 bound 0x04E00000 cut off the top of the 1.14.7 .text (ends
    // 0x04F850AF); read the section from the PE header instead.
    uint64_t codeLo = Globals::BaseAddress + 0x1000;
    uint64_t codeHi = Globals::BaseAddress + 0x05000000;
    if (Globals::BaseAddress) {
        const auto* Dos = reinterpret_cast<const IMAGE_DOS_HEADER*>(Globals::BaseAddress);
        const auto* Nt = reinterpret_cast<const IMAGE_NT_HEADERS*>(Globals::BaseAddress + Dos->e_lfanew);
        const auto* Sec = IMAGE_FIRST_SECTION(Nt);
        for (int i = 0; i < Nt->FileHeader.NumberOfSections; ++i) {
            if (std::memcmp(Sec[i].Name, ".text", 5) == 0) {
                codeLo = Globals::BaseAddress + Sec[i].VirtualAddress;
                codeHi = codeLo + Sec[i].Misc.VirtualSize;
                break;
            }
        }
    }

    for (int s = 0; s < 3; ++s) {
        CONTEXT Ctx{};
        Ctx.ContextFlags = CONTEXT_FULL;
        if (SuspendThread(Th) != (DWORD)-1) {
            if (GetThreadContext(Th, &Ctx)) {
                rip[s] = Ctx.Rip;
                if (s == 0) {
                    rsp0 = Ctx.Rsp;
                    fullCtx0 = Ctx; haveCtx0 = true;
                    retN = ScanStackReturns(Ctx.Rsp, codeLo, codeHi, retChain, 12);
                }
            }
            ResumeThread(Th);   // always resume before we log / sleep
        }
        if (s < 2) Sleep(250);
    }
    CloseHandle(Th);

    if (rip[0] == 0) { MpLog("[HangTrace] GetThreadContext failed for tid=" + std::to_string(Tid)); return; }

    bool moving = (rip[0] != rip[1]) || (rip[1] != rip[2]);
    MpLog("[HangTrace] game thread tid=" + std::to_string(Tid)
        + (moving ? " SPINNING (RIP moves - loop)" : " BLOCKED (RIP fixed - wait/deadlock)")
        + " RIP=" + MpAddress(reinterpret_cast<void*>(rip[0]))
        + " / " + MpAddress(reinterpret_cast<void*>(rip[1]))
        + " / " + MpAddress(reinterpret_cast<void*>(rip[2]))
        + " RSP=" + MpAddress(reinterpret_cast<void*>(rsp0)));

    // ACCURATE call chain via .pdata unwind (primary).
    if (haveCtx0) { MpLog("[HangTrace] REAL unwind (game thread):"); MpLogRealStack(fullCtx0); }

    // Heuristic scan (fallback / cross-check).
    std::string chain;
    for (int i = 0; i < retN; ++i) { chain += (i ? " <- " : "") + MpAddress(reinterpret_cast<void*>(retChain[i])); }
    MpLog("[HangTrace] heuristic retchain(" + std::to_string(retN) + "): " + (chain.empty() ? "(none in module)" : chain));

    // What UFunction was the game thread dispatching? Pointers for Ghidra + the last names it ran.
    MpLog("[HangTrace] curFunc=" + MpPtr(g_gtPeCurFunc.load(std::memory_order_relaxed))
        + " curObj=" + MpPtr(g_gtPeCurObj.load(std::memory_order_relaxed)));
    uint32_t pos = g_gtPeRingPos.load(std::memory_order_relaxed);
    for (int i = 1; i <= 10; ++i) {
        uint32_t idx = (pos - static_cast<uint32_t>(i)) % kPeRing;
        // Fixed char buffer copied on the game thread — safe to read here without FName resolution.
        char buf[160]; memcpy(buf, g_gtPeNameRing[idx], sizeof(buf)); buf[sizeof(buf) - 1] = '\0';
        if (buf[0]) MpLog("[HangTrace]   recentPE[-" + std::to_string(i) + "] = " + std::string(buf));
    }

    // Who holds the lock? Snapshot every other thread's RIP — the counterparty is the real bug.
    MpLogAllThreadRips(Tid);
}
/*
 * [2026-07-19 PERMANENT-BLEEDOUT / "INVINCIBILITY" FIX]
 *
 * SYMPTOM: a downed player sits at 0 health forever — takes no further damage, never dies, can still
 * attack. Reported as "I became invincible". Random only in the sense that you must actually go down
 * to hit it; once you do, it is deterministic.
 *
 * SERVER LOG (34 occurrences across both players in one 30-minute session):
 *     Script Msg: BP_PlayerCharacter_C_...  BleedOutElasped
 *     SetTimer passed a negative or zero time. The associated timer may fail to be created!
 * plus 8x  UReviveInteractionAbility::CanUserStartInteraction: UArchonInteractionUserComponent is
 * nullptr  — so being revived out of it is broken too. Both exits from bleedout are dead ends.
 *
 * GHIDRA — UArchonBleedoutComponent::TryStartBleedout (FUN_141bb08f0) ends with:
 *     lVar4 = *(longlong *)(lVar4 + 0x118);                       // island GameMode
 *     if (lVar4 == 0) -> "Can't enter bleedout in non-island game modes."
 *     *(undefined4 *)(param_1 + 0xb4) = *(undefined4 *)(lVar4 + 0x540);
 *     //  UArchonBleedoutComponent::CurrentBleedoutDuration (+0xB4)
 *     //      <- AArchonGameMode_Island::BleedoutDuration (+0x540)
 * The Blueprint then feeds CurrentBleedoutDuration to SetTimer. Duration 0 => timer never created
 * => bleedout never elapses => permanently downed.
 *
 * BleedoutDuration is an Edit/BlueprintVisible designer value on the GameMode. It is arriving as 0 on
 * our BPGM_ArchonExploration_C, so we supply a sane floor. This is a RUNTIME PATCH, not a root fix —
 * the real question (why the Blueprint CDO default is not applied) is unresolved, and the original
 * value is logged so we can see whether it is 0 or garbage.
 *
 * SAFETY: BleedoutDuration exists on AArchonGameMode_Island. Ramsgate (BPGM_City_C) is NOT an island
 * mode, and +0x540 there is an unrelated field — so this is hard-gated on IsA(AArchonGameMode_Island)
 * and must never be relaxed to the AArchonGameMode base. Game thread only (IsA/GObjects work).
 */
static float BleedoutDurationFallback() {
    // Override with MYSTICPARADOX_BLEEDOUT_SECONDS if the default proves wrong in play.
    static float Cached = -1.0f;
    if (Cached < 0.0f) {
        Cached = 30.0f;
        char Buf[32]{};
        if (GetEnvironmentVariableA("MYSTICPARADOX_BLEEDOUT_SECONDS", Buf, sizeof(Buf)) > 0) {
            float Parsed = static_cast<float>(atof(Buf));
            if (Parsed > 0.0f && Parsed < 600.0f) Cached = Parsed;
        }
    }
    return Cached;
}

static void EnsureBleedoutDuration(SDK::UObject* GameMode) {
    static bool s_done = false;
    if (s_done || !GameMode) return;
    if (!IsReadablePointer(GameMode, 0x548)) return;

    // Hard gate: only the island GameMode has BleedoutDuration at +0x540.
    if (!GameMode->IsA(SDK::AArchonGameMode_Island::StaticClass())) { s_done = true; return; }

    float* Duration = reinterpret_cast<float*>(reinterpret_cast<uintptr_t>(GameMode) + 0x540);
    const float Original = *Duration;

    if (Original > 0.0f) {
        MpLog("[Bleedout] GameMode BleedoutDuration=" + std::to_string(Original)
            + "s (valid; no patch needed)");
        s_done = true;
        return;
    }

    *Duration = BleedoutDurationFallback();
    MpLog("[Bleedout] GameMode BleedoutDuration was " + std::to_string(Original)
        + " (<=0) — SetTimer would fail and the player would be stuck downed forever. Patched to "
        + std::to_string(*Duration) + "s.");
    s_done = true;
}

/*
 * ---------------------------------------------------------------------------------------------
 * BLEEDOUT DOMAIN DIAGNOSTICS — ALWAYS ON, NOT FLAG-GATED.
 *
 * WHY ALWAYS ON: the permanent-downed bug ("invincible at 0 HP, still able to attack") does not
 * reproduce on demand. The BleedoutDuration patch above may or may not have cured it, and a stuck
 * bleedout *replacement* effect produces a visually identical symptom via a completely different code
 * path. If either recurs we get exactly one chance to see it, so the evidence has to already be in the
 * log — there is no flag to have remembered to set.
 *
 * COST: a handful of UFunction-name comparisons on already-hooked ProcessEvent calls, and a few plain
 * field reads. Bleedout events fire a few times per player per hunt, so the volume is negligible.
 * Deliberately NOT capped by a global "log first N" counter like the other diagnostics — a cap is
 * exactly how you miss the one occurrence that mattered. It is instead deduped per state-change.
 *
 * Field offsets verified against SDK/Archon_classes.hpp (UArchonBleedoutComponent):
 *   +0x0B0  EArchonBleedoutState CurrentBleedoutState   (0 = None, 1 = Bleedout)
 *   +0x0B1  EArchonBleedoutState PreviousBleedoutState
 *   +0x0B4  float                CurrentBleedoutDuration   <- 0 here is THE bug
 *   +0x130  bool                 bIsInFinishingHit
 *   +0x148  TArray               ReplacementEffects  (data ptr; Num at +0x150)
 *   +0x160  FActiveGameplayEffectHandle NoHealthGameplayEffectHandle
 *   +0x170  bool                 bIsReadyForBleedoutEvents
 * ---------------------------------------------------------------------------------------------
 */
static std::string BleedoutSnapshot(void* Comp) {
    if (!Comp || !IsReadablePointer(Comp, 0x178)) return "comp=unreadable";
    const uintptr_t C = reinterpret_cast<uintptr_t>(Comp);

    const uint8_t  State     = *reinterpret_cast<uint8_t*>(C + 0x0B0);
    const uint8_t  PrevState = *reinterpret_cast<uint8_t*>(C + 0x0B1);
    const float    Duration  = *reinterpret_cast<float*>(C + 0x0B4);
    const uint8_t  Finishing = *reinterpret_cast<uint8_t*>(C + 0x130);
    const int32_t  RepNum    = *reinterpret_cast<int32_t*>(C + 0x150);
    const int32_t  NoHealth  = *reinterpret_cast<int32_t*>(C + 0x160);
    const uint8_t  Ready     = *reinterpret_cast<uint8_t*>(C + 0x170);

    return "comp=" + MpPtr(Comp)
        + " state=" + std::to_string(State) + (State == 1 ? "(Bleedout)" : "(None)")
        + " prev=" + std::to_string(PrevState)
        + " duration=" + std::to_string(Duration) + (Duration <= 0.0f ? "  <== ZERO/NEG: SetTimer WILL FAIL" : "")
        + " replacementEffects=" + std::to_string(RepNum) + (RepNum > 0 ? "  <== REPLACEMENT PATH" : "")
        + " finishingHit=" + std::to_string(Finishing)
        + " noHealthEffectHandle=" + std::to_string(NoHealth)
        + " readyForEvents=" + std::to_string(Ready);
}

// Tracks components currently in bleedout so a never-resolving one can be reported. Small fixed array:
// this is per-player, and a hunt caps at a handful. No allocation, no locking — game thread only.
struct BleedoutWatchEntry {
    void*    Comp;
    uint64_t EnteredMs;
    float    DurationAtEntry;
    bool     Warned;
};
// [2026-10-11 1.14.7 O1] 8 -> 64 slots: a 30-40 player hub can have more than eight players downed at once (the old
// size was "a hunt caps at a handful"). Overwriting the oldest now logs once.
static BleedoutWatchEntry g_BleedWatch[64]{};

static void BleedoutWatchEnter(void* Comp, float Duration) {
    uint64_t Now = GetTickCount64();
    for (auto& E : g_BleedWatch) if (E.Comp == Comp) { E.EnteredMs = Now; E.DurationAtEntry = Duration; E.Warned = false; return; }
    for (auto& E : g_BleedWatch) if (E.Comp == nullptr) { E = { Comp, Now, Duration, false }; return; }
    // All slots busy: overwrite the oldest rather than silently dropping the new one.
    BleedoutWatchEntry* Oldest = &g_BleedWatch[0];
    for (auto& E : g_BleedWatch) if (E.EnteredMs < Oldest->EnteredMs) Oldest = &E;
    static bool s_fullLogged = false;
    if (!s_fullLogged) {
        s_fullLogged = true;
        MpLog("[BleedoutWatch] TABLE_FULL (" + std::to_string(std::size(g_BleedWatch))
            + " players in bleedout at once); overwriting the oldest entry (logged once)");
    }
    *Oldest = { Comp, Now, Duration, false };
}

static void BleedoutWatchExit(void* Comp) {
    for (auto& E : g_BleedWatch) if (E.Comp == Comp) { E = {}; return; }
}

// Called once per tick from GameModeEmptyState. Reports a bleedout that has outlived any plausible
// window — the signature of the stuck/half-downed state, whichever path caused it.
static void BleedoutWatchTick() {
    const uint64_t Now = GetTickCount64();

    for (auto& E : g_BleedWatch) {
        if (E.Comp == nullptr || E.Warned) continue;

        const uint64_t HeldMs = Now - E.EnteredMs;
        // Generous: longer than any legitimate bleedout window, so a normal downed player never trips it.
        if (HeldMs < 120000) continue;

        if (!IsReadablePointer(E.Comp, 0x178)) { E = {}; continue; }
        if (*reinterpret_cast<uint8_t*>(reinterpret_cast<uintptr_t>(E.Comp) + 0x0B0) != 1) { E = {}; continue; }

        MpLog("[BleedoutStuck] STILL in bleedout after " + std::to_string(HeldMs / 1000)
            + "s (durationAtEntry=" + std::to_string(E.DurationAtEntry)
            + ") — player is likely stuck downed/invincible. " + BleedoutSnapshot(E.Comp));
        E.Warned = true;
    }
}

/*
 * Called from the ProcessEvent hook for every bleedout-domain UFunction. `Obj` is the component for
 * component functions; for others it is whatever owned the call, and the snapshot simply reports
 * unreadable — still useful, because the sequence of function names is itself the evidence.
 */
static void BleedoutNoteEvent(const std::string& FunctionName, void* Obj) {
    // ProcessEvent is extremely hot during map load. Reject almost every call with at most three
    // searches before walking the complete diagnostic-name list below. Every tracked name contains
    // one of these tokens, so this preserves the rare bleedout evidence without doing 17 searches
    // for every unrelated Blueprint event.
    if (FunctionName.find("Bleedout") == std::string::npos
        && FunctionName.find("FinishingHit") == std::string::npos
        && FunctionName.find("NoHealth") == std::string::npos) {
        return;
    }

    // Only the bleedout-domain functions; every other matching token returns immediately.
    static const char* kNames[] = {
        "ServerTryStartBleedout", "TryStartBleedout", "AuthSetBleedoutState",
        "AuthOnBleedoutReplaced", "OnRep_CurrentBleedoutState",
        "ReceiveOnEnteredBleedoutState", "ReceiveOnExitedBleedoutState",
        "BroadcastPlayerStartedBleedoutDelegate", "ApplyNoHealthGameplayEffectToSelf",
        "DoFinishingHit", "FailsafeDoFinishingHit", "ClientEndFinishingHit",
        "RegisterBleedoutReplacementEffect", "UnregisterBleedoutReplacementEffect",
        "CanReplaceBleedout", "ReplaceBleedout", "OnPlayerEnterBleedout"
    };

    const char* Hit = nullptr;
    for (const char* N : kNames) {
        if (FunctionName.find(N) != std::string::npos) { Hit = N; break; }
    }
    if (!Hit) return;

    /*
     * Only read component offsets when the object IS the bleedout component. Several of the names
     * above (CanReplaceBleedout / ReplaceBleedout) are invoked on the *replacement effect* object,
     * and blindly reading +0xB0..+0x170 there would log plausible-looking garbage — the worst
     * possible outcome for a diagnostic whose only job is to be trusted after a rare event.
     * We are on the game thread inside ProcessEvent, so IsA is safe here.
     */
    const bool IsComponent = Obj != nullptr
        && reinterpret_cast<UObject*>(Obj)->IsA(SDK::UArchonBleedoutComponent::StaticClass());

    const std::string Snap = IsComponent
        ? BleedoutSnapshot(Obj)
        : ("obj=" + MpPtr(Obj) + " (not the bleedout component — fields not read)");
    MpLog(std::string("[Bleedout] ") + Hit + " | " + Snap);

    // Maintain the stuck-watch off the authoritative state field.
    if (IsComponent && IsReadablePointer(Obj, 0x178)) {
        const uintptr_t C = reinterpret_cast<uintptr_t>(Obj);
        const uint8_t State = *reinterpret_cast<uint8_t*>(C + 0x0B0);
        const float Duration = *reinterpret_cast<float*>(C + 0x0B4);

        if (State == 1) BleedoutWatchEnter(Obj, Duration);
        else            BleedoutWatchExit(Obj);

        // Loudest possible marker for the exact known failure, at the moment it happens.
        if (State == 1 && Duration <= 0.0f) {
            MpLog("[BleedoutBUG] entered bleedout with duration=" + std::to_string(Duration)
                + " — BleedOutElasped SetTimer will fail and the player will be stuck downed. " + Snap);
        }
    }
}

// [1.14.7 AFK EXEMPTION 2026-10-04] The managed hubs are listen servers whose only participant is the
// synthetic local controller. Nothing generates input for it, so the game's own AFK timer eventually fires:
//
//     LogOnline   [Warning] Player Returned to Main Menu Reason: AFK
//     ArchonLog   [Warning] Disconnect Error Message: You have been away from the keyboard for too long...
//     LogGameMode [Display] Match State Changed from InProgress to LeavingMap
//     LogNet      [Error]   LoadMap: failed to Listen(/Game/Maps/ramsgate/ramsgate_01_persistent?closed?MaxPlayers=4)
//
// The hub then holds no UDP socket while the process stays alive, so a client already in matchmaking is
// handed an address nothing is listening on and times out after 20s. Measured: the client named
// "RemoteAddr: 127.0.0.1:8790" at 12:54:04 while the replacement hub only reported
// "Networking::Listen returned OK" at 12:54:21 - 17 seconds too late.
//
// The SDK exposes AArchonPlayerController::bNoAFK at +0xC2C (SDK/Archon_classes.hpp:1097) and the shipped
// AFK routine at RVA 0x01CB8E50 gates on it:
//     if (timeoutExceeded && !controller->bNoAFK) { ...AFK message and return to menu... }
// so setting the field exempts a controller without adding a native detour.
//
// Identification is strict, per the audit: SERVER ROLE + the CURRENT world + a ULocalPlayer
// (APlayerController::Player at +0x298, Engine_classes.hpp). Remote players have Player == nullptr, but a
// null network connection alone is NOT accepted as proof. Real players are never touched.
// [2026-10-10 1.14.7 AFK] Verified mechanism (static, 1.14.7 exe): the AFK check 0x01CB8E50 runs only for a LOCAL
// player controller (AController+0x294 bit 1, then vtable +0x6D8), i.e. on a client for its own controller. It
// kicks when 0 < T < PC+0xC28 (idle seconds) && !PC+0xC2C (bNoAFK), with T = GS+0x410 ? GS+0x3FC : GS+0x3F8
// (AArchonGameState::AFKTimeoutFriendly / AFKTimeout). Both GS floats replicate COND_InitialOnly
// (GetLifetimeReplicatedProps 0x01901D60); InitGameState 0x019086E0 copies GM+0x468/+0x46C into them once.
// Native constructor values: 600/600 (base), 180/600 (0x01A95040, Island by layout); live Ramsgate 600 s (two
// client AFK kicks ~600 s after input). bNoAFK is not replicated, so setting it on a remote player's server-side
// controller never had any effect. Since 0.2.111 no server role has a local controller, so the per-controller
// exemption below is a fallback only (MpApplyAfkTimeout writes the replicated GS values instead). The port-free
// watchdog stays as recovery for the phantom-failure case.
// [1.14.7 ACCEPTANCE AID 2026-10-04] The 1.14.7 login screen waits behind PressStartScreen_bps_C, whose own
// log says "UI Screen does not have a valid default focusable widget" - and it ignores synthetic input
// entirely (verified: neither keybd_event nor SendInput with a centre-window click dismisses it). A scripted
// repro therefore cannot get past it, even though everything behind it is fixed and verified.
//
// This invokes the very function a click would: ULoginScreen_bps_C::OnPressToStartDismissed
// (LoginScreen_bps_classes.hpp:287). The client's own log shows that call leading straight into the rest of
// the login chain (PrepareForLoginProxy -> OnSuccess_5A94... -> ...), so it is equivalent to the click and
// changes nothing else. Flag gated (AUTO_PRESS_START.flag beside the executable) so ordinary play, where a
// human clicks, is completely unaffected.
// [1.14.7 ACCEPTANCE AID 2026-10-04] Same idea as the press-to-start: the main menu's Play -> Ramsgate is a
// single game function, AArchonPlayerController::StartFastTravelToCity() (SDK/Archon_classes.hpp:1226, in the
// same class that owns bNoAFK), so a scripted repro can reach Ramsgate without a human choosing it in the UI.
// The main menu is recognisable from its own OnPlayScreenPollTimer event, which fires once a second; a few
// polls are allowed first so the menu is settled before travelling.
//
// Flag gated by the same AUTO_PRESS_START.flag and client-only, so ordinary play is unaffected.
static void AutoTravelToCityFromEvent(SDK::UObject* Object, const std::string& FunctionName) {
    if (Globals::AmServer) return;                              // client only
    if (!MpExeRelativeFlagPresent(L"AUTO_PRESS_START.flag")) return;
    if (FunctionName.find("OnPlayScreenPollTimer") == std::string::npos) return;

    static int s_pollsSeen = 0;
    static bool s_invoked = false;
    if (s_invoked) return;
    if (++s_pollsSeen < 4) return;                              // let the menu settle

    if (!SDK::UObject::GObjects) return;

    // The first attempt used AArchonPlayerController::StartFastTravelToCity, which cannot work here: the
    // diagnostics proved there is NO AArchonPlayerController at all on the login screen / main menu
    // ("no local AArchonPlayerController yet (controllers=0 local=0)"). The travel is issued by the party
    // client instead: AArchonPartyClient::StartTravelToCity(bool bLeaveWithParty)
    // (SDK/Archon_classes.hpp:24321, class at 24244 - an AInfo actor, so it exists while the menu is up).
    int PartyClientsSeen = 0;
    for (int i = 0; i < SDK::UObject::GObjects->Num(); i++) {
        SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
        if (!Obj || Obj->IsDefaultObject()) continue;
        if (!Obj->IsA(SDK::AArchonPartyClient::StaticClass())) continue;
        ++PartyClientsSeen;

        SDK::AArchonPartyClient* Party = static_cast<SDK::AArchonPartyClient*>(Obj);
        if (!IsReadablePointer(Party, 0x700)) continue;

        SDK::UFunction* Fn = Party->Class
            ? Party->Class->GetFunction("ArchonPartyClient", "StartTravelToCity")
            : nullptr;
        if (!Fn) {
            MpLog("[AutoTravel] StartTravelToCity not found on " + std::string(Party->Class ? Party->Class->GetName() : "null")
                + "; partyClients=" + std::to_string(PartyClientsSeen) + "; leaving travel to the UI");
            s_invoked = true;
            return;
        }

        // StartTravelToCity(bool bLeaveWithParty) - solo, so leave the party behind.
        struct TravelParams { bool bLeaveWithParty; } Params{ false };
        Party->ProcessEvent(Fn, &Params);
        s_invoked = true;
        MpLog("[AutoTravel] invoked AArchonPartyClient::StartTravelToCity(false) after "
            + std::to_string(s_pollsSeen) + " main-menu polls; party=" + MpPtr(Party) + " fn=" + MpPtr(Fn));
        return;
    }

    if (s_pollsSeen % 10 == 0) {
        MpLog("[AutoTravel] no AArchonPartyClient yet (partyClients=" + std::to_string(PartyClientsSeen)
            + ") at poll " + std::to_string(s_pollsSeen));
    }
}

// [1.14.7 ACCEPTANCE AID 2026-10-05] Scripted-repro counterpart of the operator pressing the login
// screen's Play button. Measured: after the press-to-start helper above runs, the client sits on the
// Play screen and its own OnPlayScreenPollTimer fires once a second forever; the transition to
// Ramsgate is raised by the Blueprint button event
//   LoginScreen_bps_C.BndEvt__w_loginbutton_K2Node_ComponentBoundEvent_4_Button Clicked__DelegateSignature
// which a scripted run cannot produce (same reason OnPressToStartDismissed needed its helper). In the
// previous recorded run that exact event is what led straight into TryTransitionToState ->
// StartMatchmakingIntoCity, and without it no AArchonPartyClient is ever created, so
// AutoTravelToCityFromEvent below can never fire either.
//
// The event name carries a Blueprint-graph index (the "_4_"), so it is found by walking the login
// screen class's UField children (UStruct::Children @ +0x48, UField::Next @ +0x28) and matching the
// widget's own name instead of hardcoding the index. Nothing else is touched: the found UFunction is
// dispatched on the login screen object exactly as the button click would.
//
// Same AUTO_PRESS_START.flag gate and client-only, so ordinary play is unaffected.
static void AutoPlayFromEvent(SDK::UObject* Object, const std::string& FunctionName) {
    if (Globals::AmServer) return;                              // client only
    if (!MpExeRelativeFlagPresent(L"AUTO_PRESS_START.flag")) return;
    if (FunctionName.find("OnPlayScreenPollTimer") == std::string::npos) return;

    static int s_polls = 0;
    static bool s_invoked = false;
    if (s_invoked) return;
    if (++s_polls < 4) return;                                  // let the menu settle
    if (!Object || !Object->Class) return;
    if (!IsReadablePointer(Object->Class, 0x50)) return;

    SDK::UField* Child = *reinterpret_cast<SDK::UField**>(
        reinterpret_cast<uintptr_t>(Object->Class) + 0x48);
    int Guard = 0;
    while (Child && Guard++ < 8192) {
        if (!IsReadablePointer(Child, 0x30)) break;
        const std::string ChildName = Child->GetName();
        if (ChildName.find("w_loginbutton") != std::string::npos
            && ChildName.find("Clicked") != std::string::npos) {
            uint8_t Params[256] = {};                           // the event takes no parameters
            Object->ProcessEvent(reinterpret_cast<SDK::UFunction*>(Child), Params);
            s_invoked = true;
            MpLog("[AutoPlay] invoked " + ChildName + " on " + FunctionName
                + " (the same event the Play button click raises); screen=" + MpPtr(Object)
                + " fn=" + MpPtr(Child));
            return;
        }
        Child = Child->Next;
    }
    if (s_polls % 10 == 0) {
        MpLog("[AutoPlay] no Play-button click event found on "
            + std::string(Object->Class->GetName()) + " at poll " + std::to_string(s_polls)
            + "; leaving the screen alone");
    }
}

// Driven by the ProcessEvent hook rather than a tick. The first attempt lived behind the GameMode lookup,
// which does not run on the login screen, so it never fired (measured: autoPress=0 for two minutes). The
// LoginScreen's own OnStartupMovieFinished event is the moment the screen becomes interactive and it is
// delivered on the client, so that is the trigger.
static void AutoPressStartFromEvent(SDK::UObject* Object, const std::string& FunctionName) {
    if (Globals::AmServer) return;                              // client only
    if (!MpExeRelativeFlagPresent(L"AUTO_PRESS_START.flag")) return;
    if (FunctionName.find("OnStartupMovieFinished") == std::string::npos) return;

    static bool s_invoked = false;
    if (s_invoked) return;
    if (!Object || !Object->Class) return;

    SDK::UFunction* Fn = Object->Class->GetFunction("LoginScreen_bps_C", "OnPressToStartDismissed");
    if (!Fn) {
        MpLog("[AutoPressStart] OnPressToStartDismissed not found on " + FunctionName + "; leaving the screen alone");
        s_invoked = true;                                       // do not spam every event
        return;
    }

    // OnPressToStartDismissed(int32 UserIndex) takes a single int32, so a local buffer is enough and the SDK
    // parameters header does not have to be included here.
    struct PressStartParams { int32_t UserIndex; } Params{ 0 };
    Object->ProcessEvent(Fn, &Params);

    s_invoked = true;
    MpLog("[AutoPressStart] invoked OnPressToStartDismissed after " + FunctionName
        + " (the same function a click calls); screen=" + MpPtr(Object) + " fn=" + MpPtr(Fn));
}

// [CLIENT BRANDING 2026-10-08] Mystic Paradox login screen. Client only and RVA-free: every call is a reflected
// UFunction reached through ProcessEvent, every field comes from the 1.14.7 SDK dump.
//   - Background. LoginScreen_bps_C.SetSplashImage reads the served hunt-pass season's
//     HuntPassScreenDetails.LoginTexture and puts it on SplashImage with SetBrushFromSoftTexture (read from the
//     cooked asset's imports), which is why the art followed the season. The PNG embedded by MysticParadox.rc
//     is decoded by KismetRenderingLibrary.ImportBufferAsTexture2D and set with Image.SetBrushFromTexture, which
//     also cancels the season texture's pending async load. Applied from Construct onward.
//   - The DAUNTLESS logo (ArchonLogoMat, /Game/UI/Textures/Logo/ArchonLogo_Mat) is collapsed; the background
//     carries the Mystic Paradox logo.
//   - The patch-notes "Update <release_version>" line (preview and popup) is collapsed; the Metagame serves the
//     title and text (routes/system.ts /patchnotes).
// Re-asserted after every LoginScreen event because the screen's own animations and native refreshes may
// restore them; once applied each check is a pointer or byte compare. If decoding fails the season art stays.
// DISABLE_LOGIN_BRANDING.flag beside the executable reverts to the stock screen.
namespace LoginBranding {

static SDK::UTexture2D* s_Background = nullptr;
static int32_t s_BackgroundIndex = -1;
static bool s_ImportFailed = false;

static bool EmbeddedBackground(const uint8_t*& Data, uint32_t& Size) {
    static const uint8_t* s_Data = nullptr;
    static uint32_t s_Size = 0;
    static bool s_Looked = false;
    if (!s_Looked) {
        s_Looked = true;
        HMODULE Self = nullptr;
        if (GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
                reinterpret_cast<LPCWSTR>(&EmbeddedBackground), &Self) && Self) {
            if (HRSRC Res = FindResourceW(Self, MAKEINTRESOURCEW(IDR_MP_LOGIN_BACKGROUND), MAKEINTRESOURCEW(10) /*RT_RCDATA*/)) {
                HGLOBAL Loaded = LoadResource(Self, Res);
                s_Data = Loaded ? static_cast<const uint8_t*>(LockResource(Loaded)) : nullptr;
                s_Size = s_Data ? SizeofResource(Self, Res) : 0;
            }
        }
    }
    Data = s_Data;
    Size = s_Size;
    return Data && Size > 0;
}

// The texture is referenced only by SplashImage's brush, so it is collected with the screen; a later screen
// re-imports. GObjects identity (index + pointer + class) tells whether the cached pointer is still that texture.
static bool BackgroundAlive() {
    return s_Background && s_BackgroundIndex >= 0
        && SDK::UObject::GObjects->GetByIndex(s_BackgroundIndex) == static_cast<SDK::UObject*>(s_Background)
        && s_Background->IsA(SDK::UTexture2D::StaticClass());
}

static SDK::UTexture2D* ImportBackground(SDK::UObject* WorldContext) {
    const uint8_t* Data = nullptr;
    uint32_t Size = 0;
    if (!EmbeddedBackground(Data, Size)) {
        MpLog("[LoginBranding] embedded background resource not found - keeping the season image");
        return nullptr;
    }
    SDK::UFunction* Fn = SDK::UKismetRenderingLibrary::StaticClass()->GetFunction("KismetRenderingLibrary", "ImportBufferAsTexture2D");
    SDK::UObject* Library = SDK::UKismetRenderingLibrary::GetDefaultObj();
    if (!Fn || !Library) {
        MpLog("[LoginBranding] KismetRenderingLibrary.ImportBufferAsTexture2D not found - keeping the season image");
        return nullptr;
    }
    // Params::KismetRenderingLibrary_ImportBufferAsTexture2D with the TArray<uint8> spelled out so it can point at
    // the read-only resource bytes: the native thunk only reads a const TArray<uint8>&, and ProcessEvent never frees
    // caller-owned parameters.
    struct {
        SDK::UObject* WorldContextObject;
        const uint8_t* BufferData;
        int32_t BufferNum;
        int32_t BufferMax;
        SDK::UTexture2D* ReturnValue;
    } Parms{ WorldContext, Data, static_cast<int32_t>(Size), static_cast<int32_t>(Size), nullptr };
    static_assert(sizeof(Parms) == 0x20, "KismetRenderingLibrary_ImportBufferAsTexture2D is 0x20 bytes");
    const uint64_t StartMs = GetTickCount64();
    Library->ProcessEvent(Fn, &Parms);
    MpLog("[LoginBranding] decoded embedded background (" + std::to_string(Size) + " bytes) in "
        + std::to_string(GetTickCount64() - StartMs) + "ms -> texture=" + MpPtr(Parms.ReturnValue));
    return Parms.ReturnValue;
}

static void ApplyBackground(SDK::ULoginScreen_bps_C* Screen, const std::string& FunctionName) {
    SDK::UImage* Splash = Screen->SplashImage;
    if (s_ImportFailed || !Splash || !IsReadablePointer(Splash, sizeof(SDK::UImage))) return;

    const bool Alive = BackgroundAlive();
    if (Alive && Splash->Brush.ResourceObject == static_cast<SDK::UObject*>(s_Background)) return;   // already ours
    if (!Alive) {
        s_Background = ImportBackground(Screen);
        s_BackgroundIndex = s_Background ? s_Background->Index : -1;
        if (!s_Background) {
            s_ImportFailed = true;                                   // do not retry on every event
            return;
        }
    }

    static SDK::UFunction* s_SetBrushFromTexture = nullptr;
    if (!s_SetBrushFromTexture) s_SetBrushFromTexture = Splash->Class->GetFunction("Image", "SetBrushFromTexture");
    if (!s_SetBrushFromTexture) {
        MpLog("[LoginBranding] Image.SetBrushFromTexture not found - keeping the season image");
        s_ImportFailed = true;
        return;
    }
    // bMatchSize=false keeps the brush size the screen already laid out (the season art is the same 16:9 shape).
    struct { SDK::UTexture2D* Texture; bool bMatchSize; uint8_t Pad[7]; } Parms{ s_Background, false, {} };
    Splash->ProcessEvent(s_SetBrushFromTexture, &Parms);

    static int s_Logged = 0;
    if (s_Logged++ < 16) {
        MpLog("[LoginBranding] background set after " + FunctionName + " screen=" + MpPtr(Screen)
            + " applied=" + std::to_string(Splash->Brush.ResourceObject == static_cast<SDK::UObject*>(s_Background)));
    }
}

static void Collapse(SDK::UWidget* Widget, const char* What) {
    if (!Widget || !IsReadablePointer(Widget, sizeof(SDK::UWidget))) return;
    if (Widget->Visibility == SDK::ESlateVisibility::Collapsed) return;

    static SDK::UFunction* s_SetVisibility = nullptr;
    if (!s_SetVisibility) s_SetVisibility = Widget->Class->GetFunction("Widget", "SetVisibility");
    if (!s_SetVisibility) return;
    SDK::ESlateVisibility Parms = SDK::ESlateVisibility::Collapsed;
    Widget->ProcessEvent(s_SetVisibility, &Parms);

    static int s_Logged = 0;
    if (s_Logged++ < 16) {
        std::string Parent = "?";
        SDK::UPanelSlot* Slot = Widget->Slot;
        if (Slot && IsReadablePointer(Slot, sizeof(SDK::UPanelSlot)) && Slot->Parent
            && IsReadablePointer(Slot->Parent, sizeof(SDK::UObject))) {
            Parent = Slot->Parent->GetName();
        }
        MpLog(std::string("[LoginBranding] collapsed ") + What + " widget=" + MpPtr(Widget) + " parent=" + Parent);
    }
}

static void OnLoginScreenEvent(SDK::UObject* Object, const std::string& FunctionName) {
    if (Globals::AmServer) return;                                   // client only
    static const bool s_Disabled = MpExeRelativeFlagPresent(L"DISABLE_LOGIN_BRANDING.flag");
    if (s_Disabled) return;
    if (!Object || !IsReadablePointer(Object, sizeof(SDK::ULoginScreen_bps_C))) return;
    if (!Object->IsA(SDK::ULoginScreen_bps_C::StaticClass())) return;
    auto* Screen = static_cast<SDK::ULoginScreen_bps_C*>(Object);

    ApplyBackground(Screen, FunctionName);
    Collapse(Screen->ArchonLogoMat, "DAUNTLESS logo (ArchonLogoMat)");

    SDK::UPatchNotesPreviewWidget* Preview = Screen->PatchNotesPreviewWidget;
    if (Preview && IsReadablePointer(Preview, sizeof(SDK::UPatchNotesPreviewWidget))) {
        Collapse(Preview->PatchNotesVersionTextBlock, "patch-notes preview version line");
    }
    SDK::UPatchNotesPopupWidget* Popup = Screen->PatchNotesPopupWidget;
    if (Popup && IsReadablePointer(Popup, sizeof(SDK::UPatchNotesPopupWidget))) {
        Collapse(Popup->PatchVersion, "patch-notes popup version line");
    }
}

}  // namespace LoginBranding

static FProperty* FindPropertyByNameInChain(UStruct* Struct, const char* TargetName);   // defined below

// [CLIENT BRANDING 2026-10-09] Credits: a "Mystic Paradox" block above Phoenix Labs. Client only and RVA-free.
// bpw_Credits_C stacks its studio sections in one ScrollBox; each credits_section_name_title_bpw_C is a title
// TextBlock (SectionTextBlock) over a ColumnsBox whose first two TextBlocks receive every name and every title as
// one multi-line string, filled by UArchonCreditsSection::NativeConstruct from SectionTable (FCreditsNameTitle
// rows). NativeConstruct returns before touching any text when SectionTable is null (it only logs "No
// SectionTable specified"), so a section created without a table keeps the text set here.
// The block is: title (Phoenix's gold section-title style), subheading and disclaimer (the titles-column style),
// then a table-less section of the same class as Phoenix showing only the names | titles columns (its own title
// collapsed). The extra lines sit in the ScrollBox itself: the section's inner layout is not a VerticalBox, so
// lines cannot go inside it (0.2.91-0.2.93 logged subheading=0 for that reason).
// UPanelWidget has no reflected InsertChildAt, so everything is added while the credits widget is initialised
// (UserWidget.OnInitialized, before Slate exists): AddChild, copy Phoenix's slot layout, then move the new slot in
// front of Phoenix in the ScrollBox's Slots array - Slate later builds the children in that order.
// DISABLE_CREDITS_BRANDING.flag beside the executable reverts to the stock credits.
namespace CreditsBranding {

// Layout: title, subheading, empty line, disclaimer, empty line, names | titles, two empty lines, Phoenix Labs.
// The empty lines are trailing newlines; both columns end with the same two so their rows stay aligned.
static const wchar_t* const kTitle = L"Mystic Paradox";
static const wchar_t* const kSubheading = L"Private Server Development\n";
static const wchar_t* const kDisclaimer =
    L"Mystic Paradox is a community preservation server\nand is not affiliated with Phoenix Labs.\n";
static const wchar_t* const kNames = L"Mystic / Pranav Karande\nHarmonicRain\ngwog / SyST3MDeV\n\n";
static const wchar_t* const kRoles = L"Mystic Paradox\nUndaunted Fork\nUndaunted 1.4.4\n\n";

static SDK::UObject* s_Section = nullptr;            // last injected section, for the PreConstruct re-check
static int32_t s_SectionIndex = -1;

static bool CallUFunction(SDK::UObject* Object, const char* ClassName, const char* FunctionName, void* Parms) {
    if (!Object || !Object->Class) return false;
    SDK::UFunction* Fn = Object->Class->GetFunction(ClassName, FunctionName);
    if (!Fn) {
        MpLog(std::string("[CreditsBranding] ") + ClassName + "." + FunctionName + " not found");
        return false;
    }
    Object->ProcessEvent(Fn, Parms);
    return true;
}

// Each FText is created once and never destroyed, so the reference it holds keeps the copies handed to SetText
// valid for the session (a few hundred bytes in total).
static const uint8_t* TextFor(const wchar_t* Value) {
    static std::unordered_map<const wchar_t*, const uint8_t*> s_Texts;
    if (auto It = s_Texts.find(Value); It != s_Texts.end()) return It->second;
    // Params::KismetTextLibrary_Conv_StringToText: FString InString (Data, Num, Max) + FText ReturnValue.
    struct { const wchar_t* Data; int32_t Num; int32_t Max; uint8_t ReturnValue[0x18]; } Parms{};
    static_assert(sizeof(Parms) == 0x28, "KismetTextLibrary_Conv_StringToText is 0x28 bytes");
    Parms.Data = Value;
    Parms.Num = Parms.Max = static_cast<int32_t>(wcslen(Value)) + 1;
    if (!CallUFunction(SDK::UKismetTextLibrary::GetDefaultObj(), "KismetTextLibrary", "Conv_StringToText", &Parms)) {
        return nullptr;
    }
    auto* Text = new uint8_t[0x18];
    memcpy(Text, Parms.ReturnValue, 0x18);
    s_Texts.emplace(Value, Text);
    return Text;
}

static void SetText(SDK::UWidget* TextBlock, const wchar_t* Value) {
    const uint8_t* Text = TextFor(Value);
    if (!TextBlock || !Text) return;
    struct { uint8_t InText[0x18]; } Parms;
    memcpy(Parms.InText, Text, 0x18);
    CallUFunction(TextBlock, "TextBlock", "SetText", &Parms);
}

static SDK::UWidget* ChildAt(SDK::UPanelWidget* Panel, int32_t Index) {
    if (!Panel || !Panel->Slots.IsValidIndex(Index)) return nullptr;
    SDK::UPanelSlot* Slot = Panel->Slots[Index];
    return Slot ? Slot->Content : nullptr;
}

static int32_t SlotIndexOf(SDK::UPanelWidget* Panel, SDK::UWidget* Child) {
    for (int32_t i = 0; Panel && i < Panel->Slots.Num(); ++i) {
        if (Panel->Slots[i] && Panel->Slots[i]->Content == Child) return i;
    }
    return -1;
}

// AddChild, give the new slot Reference's alignment (and padding if asked), then move it to Index. Only valid
// before Slate is built.
static bool AddChildAt(SDK::UPanelWidget* Panel, SDK::UWidget* Child, int32_t Index, SDK::UPanelSlot* Reference,
                       bool CopyPadding) {
    struct { SDK::UWidget* Content; SDK::UPanelSlot* ReturnValue; } Parms{ Child, nullptr };
    if (!Child || !CallUFunction(Panel, "PanelWidget", "AddChild", &Parms) || !Parms.ReturnValue) return false;
    SDK::UPanelSlot* NewSlot = Parms.ReturnValue;
    if (Reference && Reference->Class == NewSlot->Class) {
        for (const char* Name : { "Padding", "Size", "HorizontalAlignment", "VerticalAlignment" }) {
            if (!CopyPadding && strcmp(Name, "Padding") == 0) continue;
            FProperty* Prop = FindPropertyByNameInChain(reinterpret_cast<UStruct*>(NewSlot->Class), Name);
            if (!Prop || Prop->ElementSize <= 0 || Prop->ElementSize > 0x20) continue;   // POD layout fields only
            memcpy(reinterpret_cast<uint8_t*>(NewSlot) + Prop->Offset,
                reinterpret_cast<uint8_t*>(Reference) + Prop->Offset, Prop->ElementSize);
        }
    }
    auto& Slots = Panel->Slots;
    const int32_t Last = Slots.Num() - 1;
    if (Index < 0 || Index > Last || Slots[Last] != NewSlot) return false;
    for (int32_t i = Last; i > Index; --i) Slots[i] = Slots[i - 1];
    Slots[Index] = NewSlot;
    return true;
}

// A centred TextBlock owned by Outer, styled like Style.
static SDK::UTextBlock* MakeStyledText(SDK::UObject* Outer, SDK::UTextBlock* Style, const wchar_t* Value) {
    struct { SDK::UClass* ObjectClass; SDK::UObject* Outer; SDK::UObject* ReturnValue; } Spawn{ Style->Class, Outer, nullptr };
    CallUFunction(SDK::UGameplayStatics::GetDefaultObj(), "GameplayStatics", "SpawnObject", &Spawn);
    auto* Line = static_cast<SDK::UTextBlock*>(Spawn.ReturnValue);
    if (!Line) return nullptr;
    // Field by field: FSlateFontInfo+0x30 and FSlateColor+0x18 are TSharedPtrs (CompositeFont,
    // LinkedSpecifiedColor) that a byte copy would leave unreferenced.
    Line->Font.FontObject = Style->Font.FontObject;
    Line->Font.FontMaterial = Style->Font.FontMaterial;
    Line->Font.OutlineSettings = Style->Font.OutlineSettings;
    Line->Font.TypefaceFontName = Style->Font.TypefaceFontName;
    Line->Font.Size = Style->Font.Size;
    Line->Font.LetterSpacing = Style->Font.LetterSpacing;
    const uint8_t* Linked = reinterpret_cast<const uint8_t*>(&Style->ColorAndOpacity) + 0x18;   // TSharedPtr
    if (std::all_of(Linked, Linked + 0x10, [](uint8_t B) { return B == 0; })) Line->ColorAndOpacity = Style->ColorAndOpacity;
    Line->ShadowOffset = Style->ShadowOffset;
    Line->ShadowColorAndOpacity = Style->ShadowColorAndOpacity;
    Line->Justification = SDK::ETextJustify::Center;
    SetText(Line, Value);
    return Line;
}

static void ApplyTexts(SDK::UArchonCreditsSection* Section) {
    SetText(ChildAt(reinterpret_cast<SDK::UPanelWidget*>(Section->ColumnsBox), 0), kNames);
    SetText(ChildAt(reinterpret_cast<SDK::UPanelWidget*>(Section->ColumnsBox), 1), kRoles);
}

static void Inject(SDK::Ubpw_Credits_C* Credits) {
    SDK::UArchonCreditsSection* Phoenix = Credits->credits_section_phoenix;
    if (!Phoenix || !IsReadablePointer(Phoenix, sizeof(SDK::UArchonCreditsSection)) || !Phoenix->Slot) {
        MpLog("[CreditsBranding] credits_section_phoenix missing - credits left unchanged");
        return;
    }
    SDK::UPanelWidget* Parent = Phoenix->Slot->Parent;
    const int32_t PhoenixIndex = SlotIndexOf(Parent, Phoenix);
    auto* TitleStyle = static_cast<SDK::UTextBlock*>(Phoenix->SectionTextBlock);
    auto* RolesStyle = static_cast<SDK::UTextBlock*>(ChildAt(reinterpret_cast<SDK::UPanelWidget*>(Phoenix->ColumnsBox), 1));
    if (!RolesStyle) {
        MpLog("[CreditsBranding] Phoenix titles column not found - subheading and disclaimer use the title style");
        RolesStyle = TitleStyle;
    }
    if (PhoenixIndex < 0 || !TitleStyle || !Credits->WidgetTree) {
        MpLog("[CreditsBranding] Phoenix Labs layout not as expected (index " + std::to_string(PhoenixIndex)
            + ") - credits left unchanged");
        return;
    }

    // Same class as the Phoenix section, so the same fonts, colours and column layout; no SectionTable.
    struct { SDK::UObject* WorldContextObject; SDK::UClass* WidgetType; SDK::UObject* OwningPlayer; SDK::UObject* ReturnValue; }
        Create{ Credits, Phoenix->Class, nullptr, nullptr };
    CallUFunction(SDK::UWidgetBlueprintLibrary::GetDefaultObj(), "WidgetBlueprintLibrary", "Create", &Create);
    auto* Section = static_cast<SDK::UArchonCreditsSection*>(Create.ReturnValue);
    if (!Section || !Section->SectionTextBlock || !Section->ColumnsBox) {
        MpLog("[CreditsBranding] could not create the Mystic Paradox section - credits left unchanged");
        return;
    }
    Section->bShowContributerTitle = Phoenix->bShowContributerTitle;
    Section->SectionTextBlock->Visibility = SDK::ESlateVisibility::Collapsed;   // the title is its own line above
    ApplyTexts(Section);

    // Only the first line takes Phoenix's padding (the gap between studios); the rest stack tight.
    SDK::UWidget* Lines[] = {
        MakeStyledText(Credits->WidgetTree, TitleStyle, kTitle),
        MakeStyledText(Credits->WidgetTree, RolesStyle, kSubheading),
        MakeStyledText(Credits->WidgetTree, RolesStyle, kDisclaimer),
        Section,
    };
    int32_t Placed = 0;
    for (SDK::UWidget* Line : Lines) {
        if (!AddChildAt(Parent, Line, PhoenixIndex + Placed, Phoenix->Slot, Placed == 0)) break;
        ++Placed;
    }
    if (Placed == 4) {
        s_Section = Section;
        s_SectionIndex = Section->Index;
    }
    MpLog("[CreditsBranding] Mystic Paradox block above Phoenix Labs: placed " + std::to_string(Placed)
        + "/4 (title, subheading, disclaimer, names) at index " + std::to_string(PhoenixIndex) + " of "
        + Parent->Class->GetName() + " section=" + MpPtr(Section));
}

static void OnCreditsEvent(SDK::UObject* Object, const std::string& FunctionName) {
    if (Globals::AmServer) return;                                   // client only
    static const bool s_Disabled = MpExeRelativeFlagPresent(L"DISABLE_CREDITS_BRANDING.flag");
    if (s_Disabled || !Object || !Object->Class) return;

    // OnInitialized fires for every widget the game creates: match the class by FName index once it is known.
    static int32_t s_CreditsNameIdx = 0;
    const int32_t NameIdx = Object->Class->Name.ComparisonIndex;
    if (s_CreditsNameIdx == 0) {
        if (Object->Class->GetName() != "bpw_Credits_C") return;
        s_CreditsNameIdx = NameIdx;
    } else if (NameIdx != s_CreditsNameIdx) {
        return;
    }

    if (FunctionName.find("OnInitialized") != std::string::npos) {
        Inject(static_cast<SDK::Ubpw_Credits_C*>(Object));
    } else if (FunctionName.find("PreConstruct") != std::string::npos) {
        // Built by now: re-assert the texts in case anything rewrote them, and say so once.
        const bool Alive = s_Section && s_SectionIndex >= 0
            && SDK::UObject::GObjects->GetByIndex(s_SectionIndex) == s_Section;
        if (Alive) ApplyTexts(static_cast<SDK::UArchonCreditsSection*>(s_Section));
        static int s_Logged = 0;
        if (s_Logged++ < 4) MpLog(std::string("[CreditsBranding] credits constructed; Mystic Paradox section ") + (Alive ? "present" : "MISSING"));
    }
}

}  // namespace CreditsBranding

// [CLIENT BRANDING 2026-10-09] Press-start popup text. PressStartScreen_bps_C (the popup before the login screen)
// shows "Dauntless is made with feedback from Slayers like you. Join the community on Discord, Reddit, or
// Twitter!" (Game.locres) in its PressStartPanel's WelcomeText TextBlock. The same panel class also backs the
// login screen's queue and "cannot play online" dialogs, so only a panel whose owner (Outer -> WidgetTree ->
// Outer) is a PressStartScreen_bps_C is changed. Re-applied after each event of that screen or panel, because
// the panel's own text refresh may rewrite the TextBlock. Client only and RVA-free.
// DISABLE_PRESS_START_BRANDING.flag beside the executable reverts.
namespace PressStartBranding {

// The empty line sets the credit apart (the TextBlock has one style for all lines).
static const wchar_t* const kWelcome =
    L"Welcome back to the Shattered Isles, Slayer.\n"
    L"Mystic Paradox keeps the hunt going, together.\n"
    L"\n"
    L"Credits: Mystic  •  github.com/pranav158/Mystic-Paradox";

static bool IsPressStartScreen(SDK::UObject* Object) {
    return Object && IsReadablePointer(Object, sizeof(SDK::UPressStartScreen_bps_C))
        && Object->IsA(SDK::UPressStartScreen_bps_C::StaticClass());
}

static void OnPressStartEvent(SDK::UObject* Object, const std::string& FunctionName) {
    if (Globals::AmServer) return;                                   // client only
    static const bool s_Disabled = MpExeRelativeFlagPresent(L"DISABLE_PRESS_START_BRANDING.flag");
    if (s_Disabled || !Object || !Object->Class) return;

    SDK::UPressStartPanel_bpw_C* Panel = nullptr;
    if (FunctionName.find("PressStartScreen_bps_C.") != std::string::npos) {
        if (!IsPressStartScreen(Object)) return;
        Panel = static_cast<SDK::UPressStartScreen_bps_C*>(Object)->PressStartPanel;
    } else if (FunctionName.find("PressStartPanel_bpw_C.") != std::string::npos) {
        SDK::UObject* Tree = Object->Outer;
        if (!Tree || !IsReadablePointer(Tree, sizeof(SDK::UObject)) || !IsPressStartScreen(Tree->Outer)) return;
        Panel = static_cast<SDK::UPressStartPanel_bpw_C*>(Object);
    }
    if (!Panel || !IsReadablePointer(Panel, sizeof(SDK::UPressStartPanel_bpw_C)) || !Panel->WelcomeText) return;

    CreditsBranding::SetText(Panel->WelcomeText, kWelcome);
    static int s_Logged = 0;
    if (s_Logged++ < 6) MpLog("[PressStartBranding] welcome text set after " + FunctionName);
}

}  // namespace PressStartBranding

// The SDK has no GetWorld() on AArchonPlayerController, so the owning world is found by walking Outer
// (Actor -> Level -> World). Used only on the game thread.
static SDK::UWorld* MpOwningWorld(SDK::UObject* Obj) {
    SDK::UObject* Cur = Obj;
    for (int Depth = 0; Cur != nullptr && Depth < 8; ++Depth) {
        if (!IsReadablePointer(Cur, 0x30)) return nullptr;
        if (Cur->IsA(SDK::UWorld::StaticClass())) return static_cast<SDK::UWorld*>(Cur);
        Cur = Cur->Outer;
    }
    return nullptr;
}

static void AfkExemptionTick() {
    if (!Globals::AmServer) return;                        // server role only
    // [2026-10-10 1.14.7 AFK] No local controller exists on any server role whose 0x03E07353 patch applied, and
    // the AFK check (0x01CB8E50) runs only for local controllers, so this 5 s GObjects walk had no effect there.
    // It still runs (unchanged) where the patch did not apply and a phantom local controller exists.
    if (g_NoLocalPlayerApplied.load(std::memory_order_relaxed)) return;
    if (!SDK::UObject::GObjects) return;

    static uint64_t s_lastMs = 0;
    const uint64_t NowMs = GetTickCount64();
    if (s_lastMs != 0 && NowMs - s_lastMs < 5000) return;   // throttle the GObjects walk
    s_lastMs = NowMs;

    SDK::UWorld* CurrentWorld = SDK::UWorld::GetWorld();
    if (!CurrentWorld) return;

    const int Count = SDK::UObject::GObjects->Num();
    int Considered = 0;
    int Changed = 0;
    for (int i = 0; i < Count; i++) {
        SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
        if (!Obj || Obj->IsDefaultObject()) continue;
        if (!Obj->IsA(SDK::AArchonPlayerController::StaticClass())) continue;
        SDK::AArchonPlayerController* PC = static_cast<SDK::AArchonPlayerController*>(Obj);
        if (!IsReadablePointer(PC, 0xC30)) continue;        // covers bNoAFK at +0xC2C
        if (PC->Player == nullptr) continue;                // unattached controller
        // [1.14.7 FIX 2026-10-05] Cover REMOTE players as well, not just the hub's own.
        // [2026-10-10 correction] The remote-player part of this never worked: bNoAFK is not replicated and a
        // remote player's AFK check runs on that player's own client (0x01CB8E50, local controllers only), where
        // it only disconnects that client. Only the hub's own local controller could make the hub leave its map.
        // The note below is kept as history.
        //
        // The previous version required a verified ULocalPlayer here, which silently excluded every remote
        // player's controller - a remote player's APlayerController::Player is a UNetConnection, not a
        // ULocalPlayer. Measured consequence, and it is the repeat cycle the operator is seeing:
        //   - the hub's phantom WAS exempt (bNoAFK set on it);
        //   - the remote player was NOT, so their AFK idle-out fired ~2 minutes into the session;
        //   - the hub left the map, its UDP listener went away, the client's connection died
        //     ("Host closed the connection" -> the error-exit popup);
        //   - the DLL watchdog then reaped the hub:
        //       [Watchdog/thread] our UDP port 8790 has been free for >45s after this hub had served -
        //                         the AFK idle-out left it alive but unavailable
        //       [Watchdog/thread] persistent hub unavailable (port free) -> TerminateProcess(0)
        //   - the DeployServer respawned it, and the whole thing repeated.
        // bNoAFK is a per-controller flag, and an exemption whose purpose is "the hub can no longer idle out"
        // has to cover every controller in the world. The world and liveness checks below still apply.
        if (MpOwningWorld(PC) != CurrentWorld) continue;    // must belong to the CURRENT world
        ++Considered;
        if (!PC->bNoAFK) {
            PC->bNoAFK = true;
            ++Changed;
        }
    }
    if (Changed > 0) {
        MpLog("[AfkExemption] set bNoAFK on " + std::to_string(Changed) + " local controller(s) in the "
            "current world (considered=" + std::to_string(Considered) + ") - the hub can no longer idle out");
    }
}

/*
 * [2026-10-10 1.14.7 AFK] Server-side AFK timeout, written into the replicated AArchonGameState values.
 *
 * The client kicks itself (0x01CB8E50, local controllers only) when its idle time exceeds
 * GS AFKTimeout (+0x3F8) / AFKTimeoutFriendly (+0x3FC); 0 or less never kicks. Both replicate COND_InitialOnly
 * (GetLifetimeReplicatedProps 0x01901D60), so the value must be in place BEFORE a client's GameState channel opens:
 *   - GameModeEmptyState writes it once a second (first call immediate). That runs only where EnableWatchdog is on:
 *     every launch with the full DeployServer-style argument list (hubs, dedicated hunts and the P2P player host, on
 *     any port; only the manual-test launch turns it off - see Init);
 *   - the K2_PostLogin branch of the server ProcessEvent hook writes it for every login, before that connection's
 *     first replication pass. (An older note here said this was the player host's only write path; it never was.)
 * The GameMode copy (+0x468/+0x46C, read once by InitGameState 0x019086E0) is written too, so the two stay
 * consistent. Both objects are taken from the world itself (GWorld->AuthorityGameMode +0x118, GameState +0x120),
 * never from a cached pointer that may have outlived a map change. Same writes as the engine's own cheat
 * UArchonCheatManager::AFKTimeout (0x018BE5C0). No hook, no byte patch.
 *
 * Values (read once, at listen, on the game thread; a change needs a restart and reaches clients that join after it):
 *   HUB_AFK_TIMEOUT_SECONDS.txt   Ramsgate/Training (GameMode class name contains City / TrainingGrounds, the
 *                                 g_wdIsHub rule, MpHubRoleFromGameModeClass). Default 1200 s (native Ramsgate is 600 s).
 *   HUNT_AFK_TIMEOUT_SECONDS.txt  every other server instance, and every player-hosted server - a Training hosted on a
 *                                 player's PC included (11 Oct). Default: native (no write).
 *   Integer N: negative = native; 0 = never kick (warned: idle players then hold hub slots indefinitely);
 *   1..59 -> 60; above 604800 -> 604800; an unreadable value keeps the default.
 *   DISABLE_AFK_TIMEOUT_OVERRIDE.flag turns every write off (pure native).
 */
struct MpAfkSetting { int Seconds; const char* Source; };   // Seconds < 0 = native (no override)

static MpAfkSetting MpAfkSecondsFromFile(const wchar_t* Name, int Default) {
    MpAfkSetting R{ Default, "default" };
    wchar_t Path[MAX_PATH];
    size_t DirLen = 0;
    if (InterlockedCompareExchange(&g_MpExeDirState, 0, 0) == 2) {
        DirLen = g_MpExeDirLenW;
        for (size_t i = 0; i < DirLen; ++i) Path[i] = g_MpExeDirW[i];
    } else {
        DirLen = MpExeDirFromModuleW(Path);
    }
    size_t NameLen = 0;
    while (Name[NameLen]) ++NameLen;
    if (DirLen == 0 || DirLen + NameLen + 1 > MAX_PATH) return R;
    for (size_t i = 0; i < NameLen; ++i) Path[DirLen + i] = Name[i];
    Path[DirLen + NameLen] = L'\0';
    std::ifstream File(Path);
    if (!File.is_open()) return R;
    long long Value = 0;
    if (!(File >> Value)) { R.Source = "file unreadable -> default"; return R; }
    if (Value < 0)        { R.Seconds = -1; R.Source = "file (negative = native)"; return R; }
    if (Value == 0)       { R.Seconds = 0; R.Source = "file (0 = never kick)"; return R; }
    if (Value < 60)       { R.Seconds = 60; R.Source = "file (clamped to 60)"; return R; }
    if (Value > 604800)   { R.Seconds = 604800; R.Source = "file (clamped to 604800)"; return R; }
    R.Seconds = static_cast<int>(Value);
    R.Source = "file";
    return R;
}

// Game thread only (filled at listen from StartEmptyWatchdogThread, or by the first MpApplyAfkTimeout call).
static bool g_MpAfkPrimed = false;
static bool g_MpAfkDisabled = false;
static MpAfkSetting g_MpAfkHub{ 1200, "default" };
static MpAfkSetting g_MpAfkHunt{ -1, "default" };

static std::string MpAfkSecondsText(const MpAfkSetting& S) {
    return (S.Seconds < 0 ? std::string("native") : std::to_string(S.Seconds) + " s") + " (" + S.Source + ")";
}

static void MpAfkPrimeConfig() {
    if (!Globals::AmServer || g_MpAfkPrimed) return;
    g_MpAfkPrimed = true;
    g_MpAfkDisabled = MpExeRelativeFlagPresent(L"DISABLE_AFK_TIMEOUT_OVERRIDE.flag");
    g_MpAfkHub = MpAfkSecondsFromFile(L"HUB_AFK_TIMEOUT_SECONDS.txt", 1200);
    g_MpAfkHunt = MpAfkSecondsFromFile(L"HUNT_AFK_TIMEOUT_SECONDS.txt", -1);
    // [2026-10-13 realms hub] A hub the launcher started (MYSTICPARADOX_HOSTED_ROLE=HUB) takes its idle-kick timeout
    // from MYSTICPARADOX_HUB_AFK_SECONDS when the launcher set it (the hook is -1 otherwise, always -1 on a dedicated
    // server and in the build without the p2p module): no per-install text file in the host's game folder. The same
    // floor as the file applies, so a value of 1..59 becomes 60; 0 = never kick. HUNT_AFK_TIMEOUT_SECONDS.txt is
    // unchanged and DISABLE_AFK_TIMEOUT_OVERRIDE.flag still turns every write off.
    bool HubFromLauncher = false;
    if (Globals::AuthMode == Globals::ServerAuthMode::HuntCapability) {
        const int LauncherAfk = P2PHooks::HubAfkSecondsOverride();
        if (LauncherAfk >= 0) {
            HubFromLauncher = true;
            g_MpAfkHub = (LauncherAfk == 0) ? MpAfkSetting{ 0, "launcher role (0 = never kick)" }
                : (LauncherAfk < 60)        ? MpAfkSetting{ 60, "launcher role (clamped to 60)" }
                                            : MpAfkSetting{ LauncherAfk, "launcher role" };
        }
    }
    if (g_MpAfkDisabled) {
        MpLog("[AfkTimeout] override DISABLED by DISABLE_AFK_TIMEOUT_OVERRIDE.flag; every role keeps the native timeout");
        return;
    }
    MpLog("[AfkTimeout] config hub=" + MpAfkSecondsText(g_MpAfkHub) + " hunt=" + MpAfkSecondsText(g_MpAfkHunt));
    if (g_MpAfkHub.Seconds == 0) {
        MpLog(HubFromLauncher
            ? "[AfkTimeout] WARNING: MYSTICPARADOX_HUB_AFK_SECONDS = 0 -> hub players are never idle-kicked; idle "
              "players can hold every hub slot indefinitely"
            : "[AfkTimeout] WARNING: HUB_AFK_TIMEOUT_SECONDS.txt = 0 -> hub players are never idle-kicked; idle "
              "players can hold every hub slot indefinitely");
    }
    if (g_MpAfkHunt.Seconds == 0) {
        MpLog("[AfkTimeout] WARNING: HUNT_AFK_TIMEOUT_SECONDS.txt = 0 -> hunt players are never idle-kicked");
    }
}

static bool MpAfkLiveObjectOf(SDK::UObject* Obj, SDK::UClass* Cls) {
    return Obj && Cls && IsRegisteredLiveObject(Obj) && !Obj->IsDefaultObject() && Obj->Class
        && IsRegisteredLiveObject(Obj->Class) && Obj->IsA(Cls);
}

static std::string MpAfkFloatText(float V) {
    char Buf[32];
    sprintf_s(Buf, "%.0f", static_cast<double>(V));
    return Buf;
}

/*
 * [2026-10-11 1.14.7 P2P host] Hub role from the GameMode class name (the g_wdIsHub rule): 1 = persistent hub
 * (Ramsgate BPGM_City_C, Training BPGM_ArchonTrainingGrounds_C), 0 = disposable. A persistent hub is never reaped and
 * gets the hub AFK timeout, because the DeployServer owns its lifecycle. A player-hosted (HuntCapability) server has
 * no such owner: the launcher starts it for one session, so a Training hosted on a player's PC classified as a hub
 * was never reaped when empty (both reap paths require hub == 0) and kept idle players for 1200 s. Under HuntCapability
 * every class is disposable (0): empty-reap and hunt AFK rules. Dedicated Ramsgate/Training are unchanged.
 * KEEP_HOSTED_HUB_ROLE.flag reverts (read once). Game thread only (both callers are).
 *
 * [2026-10-13 realms hub] The one exception is a launcher-declared hub: the launcher that runs a realm's Ramsgate or
 * Training on the host's PC starts it with MYSTICPARADOX_HOSTED_ROLE=HUB, and P2PHooks::HostedRoleIsHub() then makes
 * the named hub class persistent (role 1: never reaped, hub AFK rule - the launcher's supervisor owns its lifecycle,
 * as the DeployServer does for a dedicated hub). A launcher role HUNT (also the default when the variable is absent)
 * keeps today's behaviour for every class. The flag stays a manual override that wins over a HUNT role. A HUB role
 * on a class that is not a named hub changes nothing (it is a hunt server by its map), and says so once.
 */
static int MpHubRoleFromGameModeClass(const std::string& ClassName) {
    const bool NamedHub = ClassName.find("City") != std::string::npos
        || ClassName.find("TrainingGrounds") != std::string::npos;
    if (Globals::AuthMode == Globals::ServerAuthMode::HuntCapability && !NamedHub && P2PHooks::HostedRoleIsHub()) {
        static bool s_loggedUnnamed = false;
        if (!s_loggedUnnamed) {
            s_loggedUnnamed = true;
            MpLog("[HubRole] WARNING: " + ClassName + " -> disposable although the launcher role is HUB: the GameMode "
                  "class is not a named hub class (City / TrainingGrounds), so empty-reap and hunt AFK rules apply");
        }
    }
    if (!NamedHub || Globals::AuthMode != Globals::ServerAuthMode::HuntCapability) return NamedHub ? 1 : 0;
    static const bool KeepHubRole = MpExeRelativeFlagPresent(L"KEEP_HOSTED_HUB_ROLE.flag");
    static const bool LauncherHub = P2PHooks::HostedRoleIsHub();
    static bool s_logged = false;
    if (!s_logged) {
        s_logged = true;
        MpLog("[HubRole] " + ClassName + " -> " + (LauncherHub
            ? std::string("persistent hub (launcher role): never reaped, hub AFK rule")
            : KeepHubRole
            ? std::string("persistent hub (KEEP_HOSTED_HUB_ROLE.flag, launcher role HUNT): never reaped, hub AFK rule")
            : std::string("disposable (launcher role HUNT): reaped when empty, hunt AFK rules; "
                          "KEEP_HOSTED_HUB_ROLE.flag reverts")));
    }
    return (LauncherHub || KeepHubRole) ? 1 : 0;
}

// Game thread only. HintGameMode is used only to classify the role while the world has no GameMode yet; it is never
// a write target. Cheap: pointer checks, two IsA, no GObjects walk, no exceptions.
static void MpApplyAfkTimeout(SDK::UObject* HintGameMode, const char* Why) {
    if (!Globals::AmServer || !SDK::UObject::GObjects) return;
    MpAfkPrimeConfig();
    if (g_MpAfkDisabled) return;
    SDK::UWorld* World = SDK::UWorld::GetWorld();
    if (!World || !IsReadablePointer(World, 0x128)) return;
    const uintptr_t W = reinterpret_cast<uintptr_t>(World);
    SDK::UObject* GM = *reinterpret_cast<SDK::UObject**>(W + 0x118);   // UWorld::AuthorityGameMode
    SDK::UObject* GS = *reinterpret_cast<SDK::UObject**>(W + 0x120);   // UWorld::GameState
    if (!MpAfkLiveObjectOf(GS, SDK::AArchonGameState::StaticClass()) || !IsReadablePointer(GS, 0x400)) return;
    const bool GmOk = MpAfkLiveObjectOf(GM, SDK::AArchonGameMode::StaticClass()) && IsReadablePointer(GM, 0x470);

    static void* s_loggedGs = nullptr;   // one line per GameState instance
    const bool LogThis = GS != s_loggedGs;
    int Hub = g_wdIsHub.load(std::memory_order_relaxed);
    std::string ClassName;
    if (Hub < 0 || LogThis) {
        SDK::UObject* ClassSource = GmOk ? GM
            : (MpAfkLiveObjectOf(HintGameMode, SDK::AArchonGameMode::StaticClass()) ? HintGameMode : nullptr);
        if (ClassSource) ClassName = ClassSource->Class->GetName();
        if (Hub < 0 && !ClassName.empty()) {
            Hub = MpHubRoleFromGameModeClass(ClassName);   // [2026-10-11] HuntCapability -> 0 (see there)
        }
    }
    if (Hub < 0) return;   // role unknown: write nothing yet

    const MpAfkSetting& S = Hub ? g_MpAfkHub : g_MpAfkHunt;
    auto* AGS = static_cast<SDK::AArchonGameState*>(GS);
    auto* AGM = GmOk ? static_cast<SDK::AArchonGameMode*>(GM) : nullptr;
    const float GsA = AGS->AFKTimeout, GsB = AGS->AFKTimeoutFriendly;
    const float GmA = AGM ? AGM->AFKTimeout : -1.0f, GmB = AGM ? AGM->AFKTimeoutFriendly : -1.0f;
    std::string Applied;
    if (S.Seconds < 0) {
        Applied = "no override (native)";
    } else {
        const float V = static_cast<float>(S.Seconds);
        if (GsA != V || GsB != V) { AGS->AFKTimeout = V; AGS->AFKTimeoutFriendly = V; }
        if (AGM && (GmA != V || GmB != V)) { AGM->AFKTimeout = V; AGM->AFKTimeoutFriendly = V; }
        Applied = "applied " + std::to_string(S.Seconds) + " s" + (S.Seconds == 0 ? " (never kick)" : "");
    }
    if (LogThis) {
        s_loggedGs = GS;
        MpLog(std::string("[AfkTimeout] role=") + (Hub ? "hub" : "hunt")
            + " class=" + (ClassName.empty() ? std::string("?") : ClassName)
            + " before GM=" + (AGM ? MpAfkFloatText(GmA) + "/" + MpAfkFloatText(GmB) : std::string("?"))
            + " GS=" + MpAfkFloatText(GsA) + "/" + MpAfkFloatText(GsB)
            + " -> " + Applied + " (why=" + Why + ") GS=" + MpPtr(GS));
    }
}

// GAME-THREAD ONLY (walks GObjects / reads FName). Returns: 1 empty, 0 occupied, -1 unknown.
static int GameModeEmptyState() {
    if (!SDK::UObject::GObjects) return -1;
    if (!g_CachedGameMode || !IsReadablePointer(g_CachedGameMode, 0x2E0)) {
        uint64_t Now = GetTickCount64();
        if (Now - g_LastGameModeSearchMs < 3000) return -1; // throttle the GObjects walk
        g_LastGameModeSearchMs = Now;
        g_CachedGameMode = nullptr;
        const int Count = SDK::UObject::GObjects->Num();
        for (int i = 0; i < Count; i++) {
            SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
            if (!Obj || Obj->IsDefaultObject()) continue;
            if (Obj->IsA(SDK::AArchonGameMode::StaticClass())) { g_CachedGameMode = Obj; break; }
        }
    }
    if (!g_CachedGameMode || !IsReadablePointer(g_CachedGameMode, 0x2E0)) return -1;
    // Publish for the background watchdog thread (which does NO GObjects/name work of its own).
    g_wdGameModePtr.store(g_CachedGameMode, std::memory_order_relaxed);
    if (g_wdIsHub.load(std::memory_order_relaxed) < 0) {
        SDK::UObject* Cls = *reinterpret_cast<SDK::UObject**>(reinterpret_cast<uintptr_t>(g_CachedGameMode) + 0x10);
        if (Cls && IsReadablePointer(Cls, 0x20)) {
            std::string Name = Cls->GetName();   // safe: game thread
            // [2026-10-11] HuntCapability -> 0 (see MpHubRoleFromGameModeClass).
            g_wdIsHub.store(MpHubRoleFromGameModeClass(Name), std::memory_order_relaxed);
        }
    }
    uintptr_t Gm = reinterpret_cast<uintptr_t>(g_CachedGameMode);
    int32_t NumPlayers    = *reinterpret_cast<int32_t*>(Gm + 0x02D0);
    int32_t NumTravelling = *reinterpret_cast<int32_t*>(Gm + 0x02DC);

    // [1.14.7 WATCHDOG HEALTH FIX] Publish the counts (and their timestamp) for the watchdog thread so it
    // never has to dereference a cached GameMode pointer that may have outlived the map.
    g_wdNumPlayers.store(NumPlayers, std::memory_order_relaxed);
    g_wdNumTravelling.store(NumTravelling, std::memory_order_relaxed);
    g_wdCountsStampMs.store(GetTickCount64(), std::memory_order_relaxed);
    g_wdEverHadCounts.store(true, std::memory_order_relaxed);

    // Heartbeat: we are on the game thread and it is alive right now. Plain stores only.
    g_wdLastTickMs.store(GetTickCount64(), std::memory_order_relaxed);
    g_wdGameThreadId.store(GetCurrentThreadId(), std::memory_order_relaxed);

    EnsureBleedoutDuration(g_CachedGameMode);
    BleedoutWatchTick();
    AfkExemptionTick();   // returns at once unless a phantom local controller exists (no-local-player patch failed)
    {
        // [2026-10-10 1.14.7 AFK] Once a second, first call immediate; see MpApplyAfkTimeout.
        static uint64_t s_afkMs = 0;
        const uint64_t AfkNow = GetTickCount64();
        if (s_afkMs == 0 || AfkNow - s_afkMs >= 1000) {
            s_afkMs = AfkNow;
            MpApplyAfkTimeout(g_CachedGameMode, "tick");
        }
    }
    if (NumPlayers > 0) g_wdSawPlayer.store(true, std::memory_order_relaxed);

    return (NumPlayers <= 0 && NumTravelling <= 0) ? 1 : 0;
}

/*
 * [2026-10-10 1.14.7 RAM] Server memory: backup OOM pool release, hub idle working-set trim, [Perf]/[Memory] lines.
 * All three run on the empty-watchdog thread (never the game thread) and change no frame, tick or replication setting.
 *
 * Backup OOM pool (static proof, 1.14.7 exe): FGenericPlatformMemory::SetupMemoryPools (0x02525890, called from
 * FWindowsPlatformMemory::Init 0x0266ACD0) does VirtualAlloc(NULL, 0x2000000, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE)
 * through the thunk 0x02661D90 and stores the block in the global 0x06DACBD0. Its only reader is
 * FGenericPlatformMemory::OnOutOfMemory (0x02529C00), which skips a null pool (test rcx,rcx; je at 0x02529C6B) and
 * otherwise frees it with VirtualFree(p, 0, MEM_RELEASE) before its fatal log. The pages are never touched, so the
 * saving is 32 MB of commit charge (pagefile budget) per server, not resident RAM. Trade-off: on a real out-of-memory
 * death the engine's (and our crash logging's) last 32 MB of headroom is gone. KEEP_OOM_POOL.flag keeps the pool.
 */
static const char* MpVerifyBackupOomPoolSites();   // defined after CwVerifySite (.pdata entry + bytes)

static bool MpProcessMemory(PROCESS_MEMORY_COUNTERS_EX& Out) {
    Out = {};
    Out.cb = sizeof(Out);
    return GetProcessMemoryInfo(GetCurrentProcess(), reinterpret_cast<PROCESS_MEMORY_COUNTERS*>(&Out), sizeof(Out)) != FALSE;
}

static std::string MpMiBText(SIZE_T Bytes) {
    char Buf[32];
    sprintf_s(Buf, "%.1f", static_cast<double>(Bytes) / (1024.0 * 1024.0));
    return Buf;
}

static void MpReleaseBackupOomPool() {
    if (const char* Why = MpVerifyBackupOomPoolSites()) {
        MpLog(std::string("[Memory] backup OOM pool left alone: ") + Why + " (SetupMemoryPools +0x2525890 / "
              "OnOutOfMemory +0x2529C00 not as verified on 1.14.7)");
        return;
    }
    void* volatile* Slot = reinterpret_cast<void* volatile*>(Globals::BaseAddress + 0x06DACBD0);
    if (!IsReadablePointer(const_cast<void**>(Slot), sizeof(void*))) {
        MpLog("[Memory] backup OOM pool left alone: global +0x6DACBD0 unreadable");
        return;
    }
    void* Block = *Slot;
    MEMORY_BASIC_INFORMATION Mi{};
    if (!Block || !VirtualQuery(Block, &Mi, sizeof(Mi)) || Mi.BaseAddress != Block || Mi.AllocationBase != Block
        || Mi.RegionSize != 0x2000000 || Mi.State != MEM_COMMIT || Mi.Type != MEM_PRIVATE || Mi.Protect != PAGE_READWRITE) {
        MpLog("[Memory] backup OOM pool left alone: block=" + MpPtr(Block) + " is not the expected 32 MB private "
              "read-write allocation (region=" + std::to_string(static_cast<unsigned long long>(Mi.RegionSize)) + ")");
        return;
    }
    PROCESS_MEMORY_COUNTERS_EX Before{}, After{};
    const bool HaveBefore = MpProcessMemory(Before);
    if (InterlockedCompareExchangePointer(reinterpret_cast<PVOID volatile*>(Slot), nullptr, Block) != Block) {
        MpLog("[Memory] backup OOM pool left alone: the global changed while releasing it");
        return;
    }
    if (!VirtualFree(Block, 0, MEM_RELEASE)) {
        const DWORD Err = GetLastError();
        InterlockedCompareExchangePointer(reinterpret_cast<PVOID volatile*>(Slot), Block, nullptr);   // still valid: put back
        MpLog("[Memory] backup OOM pool kept: VirtualFree failed err=" + std::to_string(Err));
        return;
    }
    const bool HaveAfter = MpProcessMemory(After);
    MpLog("[Memory] released the engine's 32 MB backup out-of-memory pool block=" + MpPtr(Block)
        + " (33554432 bytes of commit; OnOutOfMemory skips a null pool): private commit "
        + (HaveBefore ? MpMiBText(Before.PrivateUsage) : std::string("?")) + " -> "
        + (HaveAfter ? MpMiBText(After.PrivateUsage) : std::string("?")) + " MiB, working set "
        + (HaveBefore ? MpMiBText(Before.WorkingSetSize) : std::string("?")) + " -> "
        + (HaveAfter ? MpMiBText(After.WorkingSetSize) : std::string("?")) + " MiB");
}

// Hub idle working-set trim. Called only from the watchdog thread, so trims never overlap. SetProcessWorkingSetSizeEx
// takes the process working-set lock, so the game thread can wait on it (page faults, VirtualQuery) for the trim's
// duration; that is accepted only because no remote client has been connected for 60 s. A client whose handshake starts
// inside that window gets a short pre-login hitch on its loading screen, and the next arrival soft-faults pages back in.
static void MpTrimWorkingSet(uint64_t IdleMs) {
    PROCESS_MEMORY_COUNTERS_EX Before{}, After{};
    const bool HaveBefore = MpProcessMemory(Before);
    LARGE_INTEGER T0{}, T1{}, F{};
    QueryPerformanceFrequency(&F);
    QueryPerformanceCounter(&T0);
    const BOOL Ok = SetProcessWorkingSetSizeEx(GetCurrentProcess(), static_cast<SIZE_T>(-1), static_cast<SIZE_T>(-1), 0);
    const DWORD Err = Ok ? 0 : GetLastError();
    QueryPerformanceCounter(&T1);
    const bool HaveAfter = MpProcessMemory(After);
    char Ms[32];
    sprintf_s(Ms, "%.1f", F.QuadPart > 0 ? static_cast<double>(T1.QuadPart - T0.QuadPart) * 1000.0 / static_cast<double>(F.QuadPart) : -1.0);
    MpLog("[WorkingSet] trimmed (hub idle: 0 remote connections for " + std::to_string(IdleMs / 1000) + " s): working set "
        + (HaveBefore ? MpMiBText(Before.WorkingSetSize) : std::string("?")) + " -> "
        + (HaveAfter ? MpMiBText(After.WorkingSetSize) : std::string("?")) + " MiB, private commit "
        + (HaveAfter ? MpMiBText(After.PrivateUsage) : std::string("?")) + " MiB, " + Ms + " ms"
        + (Ok ? std::string() : " (SetProcessWorkingSetSizeEx failed err=" + std::to_string(Err) + ")"));
}

// [2026-10-11 1.14.7 O0] avg/max of one phase in ms ("-" when it never ran in the window); drains the counters.
static std::string MpPerfPhaseText(MpPerfPhase& Phase, int64_t Freq) {
    const uint64_t Calls = Phase.Calls.exchange(0, std::memory_order_relaxed);
    const uint64_t Sum = Phase.Sum.exchange(0, std::memory_order_relaxed);
    const uint64_t Max = Phase.Max.exchange(0, std::memory_order_relaxed);
    if (Freq <= 0 || Calls == 0) return "-";
    char Buf[64];
    const double MaxMs = static_cast<double>(Max) * 1000.0 / static_cast<double>(Freq);
    const double AvgMs = static_cast<double>(Sum) * 1000.0 / static_cast<double>(Freq) / static_cast<double>(Calls);
    sprintf_s(Buf, "%.3f/%.2f", AvgMs, MaxMs);
    return Buf;
}

// [2026-10-11 1.14.7 O0] [PerfThreads]: CPU per thread since the previous call (watchdog thread only). Each thread's
// start address comes from NtQueryInformationThread(ThreadQuerySetWin32StartAddress = 9) once per thread id and is
// printed as module+RVA. Every handle is closed; nothing here touches game objects. Prime = take the baseline only.
static void MpLogThreadCpu(bool Prime) {
    using NtQueryInformationThreadFn = LONG(NTAPI*)(HANDLE, ULONG, PVOID, ULONG, PULONG);
    using GetThreadDescriptionFn = HRESULT(WINAPI*)(HANDLE, PWSTR*);
    static NtQueryInformationThreadFn s_ntQit = reinterpret_cast<NtQueryInformationThreadFn>(
        GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtQueryInformationThread"));
    static GetThreadDescriptionFn s_getDesc = reinterpret_cast<GetThreadDescriptionFn>(
        GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetThreadDescription"));
    struct Prev { uint64_t Cpu100ns; uintptr_t Start; std::string Name; uint64_t SeenIter; };
    static std::unordered_map<DWORD, Prev> s_prev;   // watchdog thread only
    static uint64_t s_iter = 0;
    static uint64_t s_lastMs = 0;
    ++s_iter;
    const uint64_t NowMs = GetTickCount64();
    const uint64_t WindowMs = s_lastMs ? NowMs - s_lastMs : 0;
    s_lastMs = NowMs;

    HANDLE Snap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
    if (Snap == INVALID_HANDLE_VALUE) {
        if (!Prime) MpLog("[PerfThreads] thread snapshot failed err=" + std::to_string(GetLastError()));
        return;
    }
    struct Row { DWORD Tid; uint64_t Delta; uintptr_t Start; const std::string* Name; bool New; };
    std::vector<Row> Rows;
    uint64_t Total = 0;
    int Threads = 0;
    THREADENTRY32 Te{};
    Te.dwSize = sizeof(Te);
    const DWORD MyPid = GetCurrentProcessId();
    if (Thread32First(Snap, &Te)) {
        do {
            if (Te.th32OwnerProcessID != MyPid) continue;
            ++Threads;
            HANDLE Th = OpenThread(THREAD_QUERY_INFORMATION, FALSE, Te.th32ThreadID);
            if (!Th) Th = OpenThread(THREAD_QUERY_LIMITED_INFORMATION, FALSE, Te.th32ThreadID);
            if (!Th) continue;
            FILETIME C{}, E{}, K{}, U{};
            const bool HaveTimes = GetThreadTimes(Th, &C, &E, &K, &U) != FALSE;
            auto It = s_prev.find(Te.th32ThreadID);
            const bool New = It == s_prev.end();
            if (New) {
                Prev P{ 0, 0, std::string(), 0 };
                if (s_ntQit) {
                    PVOID StartAddr = nullptr;
                    if (s_ntQit(Th, 9, &StartAddr, sizeof(StartAddr), nullptr) >= 0) P.Start = reinterpret_cast<uintptr_t>(StartAddr);
                }
                if (s_getDesc) {
                    PWSTR Desc = nullptr;
                    if (SUCCEEDED(s_getDesc(Th, &Desc)) && Desc) {
                        for (const wchar_t* c = Desc; *c && P.Name.size() < 40; ++c) P.Name.push_back(*c < 0x80 ? static_cast<char>(*c) : '?');
                        LocalFree(Desc);
                    }
                }
                It = s_prev.emplace(Te.th32ThreadID, P).first;
            }
            CloseHandle(Th);
            if (!HaveTimes) continue;
            const uint64_t Cpu = ((static_cast<uint64_t>(K.dwHighDateTime) << 32) | K.dwLowDateTime)
                + ((static_cast<uint64_t>(U.dwHighDateTime) << 32) | U.dwLowDateTime);
            const uint64_t Delta = (!New && Cpu >= It->second.Cpu100ns) ? Cpu - It->second.Cpu100ns : (New ? Cpu : 0);
            It->second.Cpu100ns = Cpu;
            It->second.SeenIter = s_iter;
            Total += Delta;
            Rows.push_back({ Te.th32ThreadID, Delta, It->second.Start, &It->second.Name, New });
        } while (Thread32Next(Snap, &Te));
    }
    CloseHandle(Snap);
    for (auto It = s_prev.begin(); It != s_prev.end();) {   // forget exited threads
        if (It->second.SeenIter != s_iter) It = s_prev.erase(It);
        else ++It;
    }
    if (Prime || WindowMs == 0) return;

    const double Denom = static_cast<double>(WindowMs) * 10000.0;   // 100 ns units in the window
    std::sort(Rows.begin(), Rows.end(), [](const Row& A, const Row& B) { return A.Delta > B.Delta; });
    const DWORD GameTid = g_wdGameThreadId.load(std::memory_order_relaxed);
    auto RowText = [&](const Row& R) {
        char Pct[32];
        sprintf_s(Pct, "%.1f%%", static_cast<double>(R.Delta) * 100.0 / Denom);
        return std::string(" tid=") + std::to_string(R.Tid) + (R.Tid == GameTid ? "(GAME)" : "") + " " + Pct
            + " start=" + MpAddress(reinterpret_cast<void*>(R.Start))
            + (R.Name && !R.Name->empty() ? " \"" + *R.Name + "\"" : std::string())
            + (R.New ? " (new: since thread start)" : "");
    };
    char Head[160];
    sprintf_s(Head, "[PerfThreads] %.1fs: process %.1f%% of one CPU over %d threads; top:",
        static_cast<double>(WindowMs) / 1000.0, static_cast<double>(Total) * 100.0 / Denom, Threads);
    std::string Line = Head;
    bool GameShown = false;
    for (size_t i = 0; i < Rows.size() && i < 6; ++i) {
        Line += (i ? ";" : "") + RowText(Rows[i]);
        if (Rows[i].Tid == GameTid) GameShown = true;
    }
    if (!GameShown && GameTid) {
        for (const Row& R : Rows) {
            if (R.Tid == GameTid) { Line += " | game:" + RowText(R); break; }
        }
    }
    MpLog(Line);
}

// [2026-10-11 1.14.7 O0] [PerfDetail] and [PerfNet] (watchdog thread). Frames = the window's frame count.
static void MpLogPerfDetail(uint64_t Frames, double WindowSec, int64_t Freq) {
    const std::string Engine = MpPerfPhaseText(g_perfPhaseEngine, Freq);
    const std::string Graph = MpPerfPhaseText(g_perfPhaseGraph, Freq);
    const std::string Dispatch = MpPerfPhaseText(g_perfPhaseDispatch, Freq);
    const std::string Flush = MpPerfPhaseText(g_perfPhaseFlush, Freq);
    const uint64_t RepCalls = g_perfRepActorCalls.exchange(0, std::memory_order_relaxed);
    const uint64_t RepBits = g_perfRepActorBits.exchange(0, std::memory_order_relaxed);
    const double PerFrame = Frames ? 1.0 / static_cast<double>(Frames) : 0.0;

    // Replicated bits per connection: drain, then ask the game thread to clear the keys for the next window.
    struct ConnBits { void* Conn; uint64_t Bits; uint64_t Calls; };
    std::vector<ConnBits> Conns;
    for (MpRepBitsSlot& S : g_repBitsSlots) {
        void* C = S.Conn.load(std::memory_order_relaxed);
        const uint64_t B = S.Bits.exchange(0, std::memory_order_relaxed);
        const uint64_t N = S.Calls.exchange(0, std::memory_order_relaxed);
        if (C && (B || N)) Conns.push_back({ C, B, N });
    }
    const uint64_t BitsOverflow = g_repBitsOverflow.exchange(0, std::memory_order_relaxed);
    g_repBitsResetRequested.store(true, std::memory_order_relaxed);
    std::sort(Conns.begin(), Conns.end(), [](const ConnBits& A, const ConnBits& B) { return A.Bits > B.Bits; });

    const uint64_t GraphStamp = g_perfGraphSampleMs.load(std::memory_order_relaxed);
    const uint64_t NowMs = GetTickCount64();
    const bool GraphFresh = GraphStamp != 0 && NowMs >= GraphStamp && NowMs - GraphStamp <= 10000;

    char Buf[512];
    sprintf_s(Buf, "[PerfDetail] %.1fs avg/max ms per call: engine tick %s, graph drive %s, manual dispatch %s, "
        "manual flush %s; ReplicateActor %.1f calls/frame, %.0f kbit/s replicated (%.0f bits/frame)",
        WindowSec, Engine.c_str(), Graph.c_str(), Dispatch.c_str(), Flush.c_str(),
        static_cast<double>(RepCalls) * PerFrame,
        WindowSec > 0 ? static_cast<double>(RepBits) / WindowSec / 1000.0 : 0.0,
        static_cast<double>(RepBits) * PerFrame);
    std::string Line = Buf;
    if (GraphFresh) {
        sprintf_s(Buf, "; graph: connections %d, global actors %d, actor-info per connection sum %d max %d; "
            "client connections %d, open channels sum %d max %d",
            g_perfGraphConns.load(std::memory_order_relaxed), g_perfGraphGlobalActors.load(std::memory_order_relaxed),
            g_perfGraphActorInfoSum.load(std::memory_order_relaxed), g_perfGraphActorInfoMax.load(std::memory_order_relaxed),
            g_perfClientConns.load(std::memory_order_relaxed), g_perfOpenChannelsSum.load(std::memory_order_relaxed),
            g_perfOpenChannelsMax.load(std::memory_order_relaxed));
        Line += Buf;
    } else {
        Line += "; graph: not sampled (no replication graph)";
    }
    if (!Conns.empty()) {
        Line += "; top connections by replicated kbit/s:";
        for (size_t i = 0; i < Conns.size() && i < 4; ++i) {
            sprintf_s(Buf, " %s=%.1f(%llu calls)", MpPtr(Conns[i].Conn).c_str(),
                WindowSec > 0 ? static_cast<double>(Conns[i].Bits) / WindowSec / 1000.0 : 0.0,
                static_cast<unsigned long long>(Conns[i].Calls));
            Line += Buf;
        }
        if (Conns.size() > 4) Line += " +" + std::to_string(Conns.size() - 4) + " more";
    }
    if (BitsOverflow) Line += "; untracked connections " + std::to_string(BitsOverflow) + " bits";
    MpLog(Line);

    if (!g_wireCountOn) return;
    struct Peer { uint64_t Key; uint64_t Bytes; uint64_t Packets; };
    std::vector<Peer> Peers;
    uint64_t Unattributed = 0;
    for (MpWireSlot& S : g_wireSlots) {
        const uint64_t K = S.Key.load(std::memory_order_relaxed);
        const uint64_t B = S.Bytes.exchange(0, std::memory_order_relaxed);
        const uint64_t P = S.Packets.exchange(0, std::memory_order_relaxed);
        if (K == 0) { Unattributed += B; continue; }
        if (B == 0 && P == 0) {
            uint64_t Expected = K;
            S.Key.compare_exchange_strong(Expected, 0, std::memory_order_relaxed);   // idle for a window: release
            continue;
        }
        bool Merged = false;   // a released slot can leave one peer in two slots for a window
        for (Peer& Existing : Peers) {
            if (Existing.Key == K) { Existing.Bytes += B; Existing.Packets += P; Merged = true; break; }
        }
        if (!Merged) Peers.push_back({ K, B, P });
    }
    const uint64_t TotalBytes = g_wireBytesTotal.exchange(0, std::memory_order_relaxed);
    const uint64_t TotalPackets = g_wirePacketsTotal.exchange(0, std::memory_order_relaxed);
    const uint64_t OtherBytes = g_wireBytesOther.exchange(0, std::memory_order_relaxed);
    std::sort(Peers.begin(), Peers.end(), [](const Peer& A, const Peer& B) { return A.Bytes > B.Bytes; });
    const double Sec = WindowSec > 0 ? WindowSec : 60.0;
    sprintf_s(Buf, "[PerfNet] %.1fs: sent %.1f kB/s in %.0f packets/s to %zu peers",
        Sec, static_cast<double>(TotalBytes) / Sec / 1000.0, static_cast<double>(TotalPackets) / Sec, Peers.size());
    Line = Buf;
    if (!Peers.empty()) {
        Line += "; top:";
        for (size_t i = 0; i < Peers.size() && i < 8; ++i) {
            sprintf_s(Buf, " %s=%.2f kB/s (%.0f pkt/s)", MpWireKeyText(Peers[i].Key).c_str(),
                static_cast<double>(Peers[i].Bytes) / Sec / 1000.0, static_cast<double>(Peers[i].Packets) / Sec);
            Line += Buf;
        }
    }
    if (OtherBytes) Line += "; other " + std::to_string(OtherBytes) + " bytes";
    if (Unattributed) Line += "; unattributed " + std::to_string(Unattributed) + " bytes";
    MpLog(Line);
}

// Once a minute from the watchdog thread. Reads only atomics the game thread published and this process's counters.
static void MpLogPerfAndMemory(bool FirstWindow) {
    if (MpProcessDetaching()) return;
    const int64_t Freq = g_perfQpcFreq.load(std::memory_order_relaxed);
    const uint64_t Frames = g_perfFrames.exchange(0, std::memory_order_relaxed);
    const uint64_t Sum = g_perfFrameTicksSum.exchange(0, std::memory_order_relaxed);
    const uint64_t Max = g_perfFrameTicksMax.exchange(0, std::memory_order_relaxed);
    const uint64_t Hitches = g_perfHitches.exchange(0, std::memory_order_relaxed);
    const uint64_t EngCalls = g_perfEngineCalls.exchange(0, std::memory_order_relaxed);
    const uint64_t EngSum = g_perfEngineTicksSum.exchange(0, std::memory_order_relaxed);

    const uint64_t NowMs = GetTickCount64();
    const uint64_t ConnStamp = g_wdConnStampMs.load(std::memory_order_relaxed);
    const int32_t Conn = g_wdConnCount.load(std::memory_order_relaxed);
    const bool ConnFresh = ConnStamp != 0 && NowMs >= ConnStamp && NowMs - ConnStamp <= MP_WD_COUNTS_MAX_AGE_MS;
    const std::string ConnText = std::to_string(Conn) + (ConnFresh ? "" : " (stale)");
    const char* Mark = FirstWindow ? " (first window since listen)" : "";

    char Line[320];
    double WindowSec = 0.0;   // [2026-10-11 1.14.7 O0] for [PerfDetail]/[PerfNet] rates
    if (Freq > 0 && Frames > 0 && Sum > 0) {
        const double SumSec = static_cast<double>(Sum) / static_cast<double>(Freq);
        WindowSec = SumSec;
        const double AvgMs = SumSec * 1000.0 / static_cast<double>(Frames);
        const double MaxMs = static_cast<double>(Max) * 1000.0 / static_cast<double>(Freq);
        const double EngMs = EngCalls ? static_cast<double>(EngSum) * 1000.0 / static_cast<double>(Freq) / static_cast<double>(EngCalls) : 0.0;
        sprintf_s(Line, "[Perf] %.1fs: %llu frames (%.1f/s), frame avg %.2f ms / max %.1f ms, hitches>100ms %llu, "
            "engine tick %.2f ms/frame", SumSec, static_cast<unsigned long long>(Frames),
            static_cast<double>(Frames) / SumSec, AvgMs, MaxMs, static_cast<unsigned long long>(Hitches), EngMs);
    } else {
        sprintf_s(Line, "[Perf] no frames measured in this window (game thread not ticking?)");
    }
    MpLog(std::string(Line) + ", connections " + ConnText + ", hub " + std::to_string(g_wdIsHub.load(std::memory_order_relaxed)) + Mark);

    PROCESS_MEMORY_COUNTERS_EX Pm{};
    if (MpProcessMemory(Pm)) {
        static DWORD s_lastFaults = 0;   // watchdog thread only
        const std::string Faults = s_lastFaults ? "+" + std::to_string(Pm.PageFaultCount - s_lastFaults) + " since last line"
                                                : std::to_string(Pm.PageFaultCount) + " total";
        s_lastFaults = Pm.PageFaultCount ? Pm.PageFaultCount : 1;
        MpLog("[Memory] connections " + ConnText + ", working set " + MpMiBText(Pm.WorkingSetSize) + " MiB (peak "
            + MpMiBText(Pm.PeakWorkingSetSize) + "), private commit " + MpMiBText(Pm.PrivateUsage) + " MiB, page faults "
            + Faults + Mark);
    }

    // [2026-10-11 1.14.7 O0] Same cadence: phase timings, replication/graph sizes, wire bytes, threads.
    if (MpPerfDetailEnabled()) {
        static uint64_t s_lastDetailMs = 0;   // watchdog thread only; fallback window when no frames were measured
        const uint64_t DetailNow = GetTickCount64();
        if (WindowSec <= 0.0 && s_lastDetailMs) WindowSec = static_cast<double>(DetailNow - s_lastDetailMs) / 1000.0;
        s_lastDetailMs = DetailNow;
        MpLogPerfDetail(Frames, WindowSec, Freq);
        MpLogThreadCpu(false);
    }
}

// [2026-07-18] Background empty-server watchdog thread.
// The tick-based empty-exit (in the GameEngineTick hook below) rides the game/net tick — but that tick
// STOPS firing once the last player disconnects from a hunt. Observed in the logs: an empty
// BPGM_ArchonExploration_C hunt logged its final "[Lifecycle:ConnEdge 1->0 NumPlayers=0]" and then went
// totally silent for 30-90 min, never hitting the 50s exit, so the finished hunt kept holding a
// concurrent-server slot until the DeployServer cap refused new hunts (reported: "max capacity reached").
// This dedicated thread polls the AUTHORITATIVE GameMode player count on its own timer, independent of
// the engine loop, so an empty instance always self-terminates and the DeployServer reclaims its port +
// RAM. Safety (never kill an active/loading hunt): only CONTINUOUS emptiness counts — no remote client
// connection && NumTravelling==0 for 50s straight after the last client left (5 min if none ever arrived);
// any occupied OR unknown (-1, GameMode or NetDriver not resolved yet, stale sample) reading resets the
// timer. NumPlayers was unusable while the phantom local player kept it at 1 (removed in 0.2.110); the remote
// connection count stays the signal (see g_wdConnCount).
//
// SCOPE: only DISPOSABLE instances self-terminate. The two persistent hubs the DeployServer keeps alive
// — ramsgate (BPGM_City_C) and the training grounds (BPGM_ArchonTrainingGrounds_C) — are EXEMPT, so they
// stay up continuously (no churn, and no risk of the hub vanishing while a player is traveling back to
// it). Everything else (hunts/exploration, escalation, trials, etc.) is reapable when empty.
static std::atomic<bool> g_emptyWatchdogStarted{ false };
extern bool EnableWatchdog;   // defined later (global watchdog master switch, default true)
static void StartEmptyWatchdogThread() {
    bool expected = false;
    if (!g_emptyWatchdogStarted.compare_exchange_strong(expected, true)) return;   // start once
    // [2026-10-10 1.14.7] Called on the GAME thread at listen (both listen paths in GameEngineTickHook): reset the
    // [Perf] counters so the first window starts here, and read the AFK value files before any client can log in.
    MpPerfResetCounters();
    MpAfkPrimeConfig();
    std::thread([] {
        float emptySec = 0.0f;
        const float POLL_SEC = 2.0f;
        uint64_t iter = 0;
        bool hangSampled = false;   // one-shot [HangSuspect] capture per freeze episode (reset when ticks resume)
        MpLog("[Watchdog/thread] started (poll 2s; reaps a disposable instance with no client connection for "
              + std::to_string(static_cast<int>(MP_WD_EMPTY_REAP_SEC)) + "s after its last client left, or 5 min if none ever arrived)");
        // [2026-10-10 1.14.7 RAM] Read once at thread start (= listen). See the RAM block above StartEmptyWatchdogThread.
        const uint64_t wdStartMs = GetTickCount64();
        const bool keepOomPool = MpExeRelativeFlagPresent(L"KEEP_OOM_POOL.flag");
        const bool perfLog = !MpExeRelativeFlagPresent(L"DISABLE_PERF_LOG.flag");
        // Working-set trim: DeployServer instances only (never the P2P player host), and below only confirmed hubs.
        const bool trimAllowed = Globals::AuthMode == Globals::ServerAuthMode::GlobalGameserver
            && !MpExeRelativeFlagPresent(L"KEEP_WORKING_SET.flag");
        bool oomPoolDone = false;
        bool perfFirstWindow = true;
        uint64_t idleSinceMs = 0;     // start of the current zero-connection period (0 = not idle)
        bool idleTrimmed = false;     // one trim per idle period; re-armed once a client connects
        uint64_t trimmedAtMs = 0;
        MpLog(std::string("[Memory] backup OOM pool: ") + (keepOomPool ? "KEPT (KEEP_OOM_POOL.flag)" : "release at listen+30 s")
            + "; hub idle working-set trim: "
            + (trimAllowed ? "ON (confirmed hubs only, after 60 s with 0 remote connections, once per idle period)"
                : (Globals::AuthMode == Globals::ServerAuthMode::GlobalGameserver ? "OFF (KEEP_WORKING_SET.flag)"
                                                                                   : "OFF (not a DeployServer instance)"))
            + "; [Perf]/[Memory] lines: " + (perfLog ? "every 60 s" : "OFF (DISABLE_PERF_LOG.flag)")
            + "; [PerfDetail]/[PerfNet]/[PerfThreads]: "
            + (perfLog && MpPerfDetailEnabled() ? "every 60 s" : (perfLog ? "OFF (NO_PERF_DETAIL.flag)" : "OFF")));
        // [2026-10-11 1.14.7 O0] Baseline for the first [PerfThreads] window (CPU since listen, not since process start).
        if (perfLog && MpPerfDetailEnabled()) MpLogThreadCpu(true);
        for (;;) {
            Sleep(static_cast<DWORD>(POLL_SEC * 1000.0f));
            ++iter;
            if (MpProcessDetaching()) continue;   // never touch the CRT or log after DLL_PROCESS_DETACH
            // [2026-10-10 1.14.7 RAM] Every server role (before the EnableWatchdog gate on purpose): the pool release
            // once, 30 s after listen (its pages are untouched, so the connection state does not matter), and the
            // [Perf]/[Memory] lines every 30 polls (~60 s; the rate is computed from measured frame time).
            if (!oomPoolDone && GetTickCount64() - wdStartMs >= 30000) {
                oomPoolDone = true;
                if (!keepOomPool) MpReleaseBackupOomPool();
            }
            if (perfLog && (iter % 30) == 0) {
                MpLogPerfAndMemory(perfFirstWindow);
                perfFirstWindow = false;
            }
            if (!EnableWatchdog) { emptySec = 0.0f; continue; }
            // CRASH-SAFE: this thread does NO GObjects walk and NO IsA/GetName calls (doing that off the
            // game thread raced actor spawn/destroy and faulted inside the game). It only reads values the
            // GAME THREAD published (gamemode ptr + hub flag) plus plain int fields on that stable ptr.
            void* gm  = g_wdGameModePtr.load(std::memory_order_relaxed);
            int   hub = g_wdIsHub.load(std::memory_order_relaxed);
            bool empty = false;
            int32_t numPlayers = -1, numTravelling = -1, connCount = -1;
            bool countsUsable = false;
            {
                // [1.14.7 WATCHDOG HEALTH FIX] Values published by the game thread only - this thread never
                // dereferences the GameMode pointer. A sample must be FRESH and PLAUSIBLE to count as health;
                // anything else is treated as unknown and can never trigger a reap.
                const uint64_t Stamp = g_wdCountsStampMs.load(std::memory_order_relaxed);
                const uint64_t NowMs = GetTickCount64();
                const bool Fresh = Stamp != 0 && NowMs >= Stamp && (NowMs - Stamp) <= MP_WD_COUNTS_MAX_AGE_MS;
                const int32_t P = g_wdNumPlayers.load(std::memory_order_relaxed);
                const int32_t T = g_wdNumTravelling.load(std::memory_order_relaxed);
                const bool Plausible = P >= 0 && P <= MP_WD_MAX_PLAUSIBLE_PLAYERS
                    && T >= 0 && T <= MP_WD_MAX_PLAUSIBLE_PLAYERS;
                // [1.14.7 EMPTY-HUNT FIX] Emptiness is "no remote client connection and nobody travelling
                // in", not NumPlayers (the phantom keeps that at 1). The connection count follows the same
                // fresh-and-plausible rule; without it the instance is never considered empty.
                const uint64_t ConnStamp = g_wdConnStampMs.load(std::memory_order_relaxed);
                const int32_t C = g_wdConnCount.load(std::memory_order_relaxed);
                const bool ConnUsable = ConnStamp != 0 && NowMs >= ConnStamp
                    && (NowMs - ConnStamp) <= MP_WD_COUNTS_MAX_AGE_MS
                    && C >= 0 && C <= MP_WD_MAX_PLAUSIBLE_PLAYERS;
                if (Fresh && Plausible) {
                    numPlayers = P;
                    numTravelling = T;
                    countsUsable = true;
                    if (ConnUsable) {
                        connCount = C;
                        empty = (connCount <= 0 && numTravelling <= 0);
                    }
                }
                else if (!Plausible && Stamp != 0) {
                    static std::atomic<int> s_implausibleLogged{ 0 };
                    if (s_implausibleLogged.fetch_add(1, std::memory_order_relaxed) < 4) {
                        MpLog("[Watchdog/thread] ignoring implausible player counts (players=" + std::to_string(P)
                            + " travelling=" + std::to_string(T) + " max_plausible="
                            + std::to_string(MP_WD_MAX_PLAUSIBLE_PLAYERS)
                            + ") - treated as unknown, no reap");
                    }
                }
            }
            // [1.14.7 loader state dump trigger 2026-10-03] This loop runs every ~2s for the life of the
            // process, so it is a reliable clock. The readiness hook only runs during the load window (its
            // 25s check never got a chance), and the server-tick placement never fired either - hence the
            // dump is triggered here, once, 25s after this thread starts.
            {
                static std::atomic<int> s_loaderDumpState{ 0 };
                static ULONGLONG s_watchdogStart = 0;
                if (s_loaderDumpState.load() == 0) {
                    s_watchdogStart = GetTickCount64();
                    s_loaderDumpState.store(1);
                } else if (s_loaderDumpState.load() == 1 && GetTickCount64() - s_watchdogStart > 25000) {
                    s_loaderDumpState.store(2);
                    DumpLoadManagerEntries("t+25s (watchdog)");
                }
            }

            // Heartbeat ~every 30s, and on every poll while counting down to a reap, so the log proves the
            // thread is live and shows EXACTLY why it does/doesn't reap (gm published? hub class? counts?).
            const bool hadRemoteClient = g_wdHadRemoteClient.load(std::memory_order_relaxed);
            const float emptyLimitSec = hadRemoteClient ? MP_WD_EMPTY_REAP_SEC : MP_WD_NEVER_JOINED_REAP_SEC;
            // While counting down, log every 10 s instead of every poll (the never-joined window is 5 min).
            if ((iter % 15) == 0 || (empty && hub == 0 && (iter % 5) == 0)) {
                MpLog("[Watchdog/thread] gm=" + MpPtr(gm) + " hub=" + std::to_string(hub)
                    + " numPlayers=" + std::to_string(numPlayers) + " numTravelling=" + std::to_string(numTravelling)
                    + " connCount=" + std::to_string(connCount) + " hadClient=" + std::to_string(hadRemoteClient ? 1 : 0)
                    + " countsUsable=" + std::to_string(countsUsable ? 1 : 0)
                    + " empty=" + std::to_string(empty ? 1 : 0) + " emptySec=" + std::to_string(emptySec)
                    + "/" + std::to_string(static_cast<int>(emptyLimitSec)));
            }
            // [2026-10-10 1.14.7 RAM] Hub idle working-set trim. Only a CONFIRMED hub (hub == 1; never -1/unknown, never a
            // hunt, never the P2P host), only after ZERO remote connections continuously for 60 s (usable counts, a
            // connection sample at most 1 s old, nobody seamless-travelling; any connection seen by the game thread
            // restarts the period), at most once per idle period (re-armed when a client connects). Runs here, on the
            // watchdog thread. The server cannot see a hard-travel client before its handshake creates the connection,
            // so an arrival can still coincide with a trim: performance only (see MpTrimWorkingSet).
            {
                const uint64_t NowMs = GetTickCount64();
                const uint64_t LastConnMs = g_wdLastRemoteConnMs.load(std::memory_order_relaxed);
                if (idleTrimmed && LastConnMs > trimmedAtMs) idleTrimmed = false;   // a client connected since: re-arm
                const uint64_t ConnStamp = g_wdConnStampMs.load(std::memory_order_relaxed);
                const bool ConnFresh = ConnStamp != 0 && NowMs >= ConnStamp && NowMs - ConnStamp <= 1000;
                const bool IdleNow = hub == 1 && countsUsable && ConnFresh && connCount == 0 && numTravelling == 0
                    && g_wdConnCount.load(std::memory_order_relaxed) == 0;
                if (!IdleNow) {
                    idleSinceMs = 0;
                } else {
                    if (idleSinceMs == 0 || LastConnMs >= idleSinceMs) idleSinceMs = NowMs;   // continuous zero only
                    if (trimAllowed && !idleTrimmed && NowMs - idleSinceMs >= 60000) {
                        idleTrimmed = true;
                        trimmedAtMs = NowMs;
                        MpTrimWorkingSet(NowMs - idleSinceMs);
                    }
                }
            }
            // [1.14.7 AVAILABILITY FIX 2026-10-04] A persistent hub that leaves its map becomes ALIVE BUT
            // UNAVAILABLE: the game's own AFK timeout kicks the phantom player, the match state goes to
            // LeavingMap and the re-listen fails ("LoadMap: failed to Listen"), so UDP 8789/8790 stops being
            // bound while the process keeps running. The DeployServer watchdog only checks process existence
            // (kill(pid, 0)), so nothing ever restarts it. Report that state by exiting: the existing
            // CleanupServer + restart path then brings the hub back, which is what makes it available again.
            // Guarded so a hub that is still loading (never yet had counts) is never touched.
            {
                static ULONGLONG s_portFreeSince = 0;
                // Only a hub that has actually served is considered (never one still loading), and the port
                // must stay free for a full 45 s so a transient re-listen is not mistaken for an idle-out.
                if (!g_wdEverHadCounts.load(std::memory_order_relaxed)) {
                    s_portFreeSince = 0;
                } else if (MpOurUdpPortIsFree()) {
                    const ULONGLONG NowMs = GetTickCount64();
                    if (s_portFreeSince == 0) s_portFreeSince = NowMs;
                    if (NowMs - s_portFreeSince > 45000) {
                        MpLog("[Watchdog/thread] our UDP port " + std::to_string(Globals::Port)
                            + " has been free for >45s after this hub had served - the AFK idle-out left it "
                              "alive but unavailable; exiting so the DeployServer restarts it");
                        MpReapExit("persistent hub unavailable (port free)");
                    }
                } else {
                    s_portFreeSince = 0;
                }
            }

            // Reap only a CONFIRMED disposable instance (hub==0) empty 50s continuous after its last client
            // left, or 5 min if no client ever arrived (so a slow first load is never cut short). hub==1
            // (persistent ramsgate/training) or hub==-1 (not yet classified by the game thread) is never
            // reaped here.
            if (empty && hub == 0) {
                emptySec += POLL_SEC;
                if (emptySec >= emptyLimitSec) {
                    const std::string reapReason = hadRemoteClient
                        ? "disposable instance empty " + std::to_string(static_cast<int>(MP_WD_EMPTY_REAP_SEC))
                            + "s continuous after its last client left"
                        : std::string("disposable instance never joined by a client within 5 min");
                    MpReapExit(reapReason.c_str());
                }
            } else {
                emptySec = 0.0f;
            }

            // [2026-07-18 STALE-TICK REAP] Fallback for the ghost-connection deadlock described at
            // g_wdLastTickMs. Independent of NumPlayers on purpose: that counter is exactly what gets
            // stuck. A disposable instance that has stopped ticking for STALE_TICK_MS is finished —
            // nothing is replicating to anyone, so no live hunt can be harmed by reaping it.
            // Guards: disposable only (hub==0), and only after the instance actually hosted a player,
            // so a server that has not reached its first tick is never mistaken for a dead one.
            if (hub == 0 && g_wdSawPlayer.load(std::memory_order_relaxed)) {
                const uint64_t STALE_TICK_MS = 180000;   // 3 min; > any legitimate hitch or load spike
                uint64_t lastTick = g_wdLastTickMs.load(std::memory_order_relaxed);
                if (lastTick != 0) {
                    uint64_t sinceTick = GetTickCount64() - lastTick;
                    // EARLY DIAGNOSTIC (no reap): the game thread hasn't ticked for ~20s while a hunt is
                    // live. Almost certainly the freeze the player sees. Sample it NOW (once) so we capture
                    // the blocking location even if the operator kills the box before the 180s reap.
                    if (sinceTick >= 20000 && !hangSampled) {
                        hangSampled = true;
                        MpLog("[HangSuspect] game thread not ticked for " + std::to_string(sinceTick / 1000)
                            + "s while numPlayers=" + std::to_string(numPlayers)
                            + " — sampling (NOT reaping yet; reap at " + std::to_string(180) + "s)");
                        MpLogHungGameThread();
                    }
                    if (sinceTick < 10000) hangSampled = false;   // ticks resumed -> re-arm for next episode
                    if (sinceTick >= STALE_TICK_MS) {
                        MpLog("[Watchdog/thread] disposable instance tick STALE for "
                            + std::to_string(sinceTick / 1000) + "s (numPlayers=" + std::to_string(numPlayers)
                            + " — hung game thread or ghost connection) -> reap");
                        // Sample WHERE it is hung once more before killing it (fresh chain), then reap.
                        MpLogHungGameThread();
                        MpReapExit("tick stale");
                    }
                    // Surface the countdown once it is clearly abnormal, so the log shows this path arming.
                    if (sinceTick >= 60000 && (iter % 15) == 0) {
                        MpLog("[Watchdog/thread] tick stale " + std::to_string(sinceTick / 1000)
                            + "s (numPlayers=" + std::to_string(numPlayers) + "); reaping at "
                            + std::to_string(STALE_TICK_MS / 1000) + "s");
                    }
                }
            }
        }
    }).detach();
}

void* OrigGetDefaultMap = nullptr;
void* OrigNetModeHook = nullptr;
void* OrigInternalNetModeHook = nullptr;
void* OrigWorldNetModeHook = nullptr;
void* OrigIsLevelInitForActor = nullptr;
void* OrigIsNetReady = nullptr;

bool IsNetReadyHook();
// [1.14.7 FIX 2026-10-05] MUST be int, not char. Returning char compiles to `mov al, 1; ret`, and the
// native caller reads all of EAX - the upper bits survive from whatever held the NetDriver pointer, so the
// live value was measured as 0xEE47C001 instead of 1. Unreal then classifies the server incorrectly when it
// routes ServerDraftBounty, which can send that RPC remotely or absorb it instead of executing locally -
// the automatic-draft stall (iteration 1, initialization flags set, FinishSetup never reached).
int InternalNetModeHook(void* a1);
int WorldNetModeHook(void* a1);
bool IsLevelInitForActorHook(void* a1, char a2);

// [2026-07-16] Instance player cap (HUB_MAX_PLAYERS setting). AArchonGameMode::InitGame
// defaults "max player count" to 1 when the map URL carries no ?MaxPlayers option, which
// strands a 2nd player at the loading screen until a slot frees (verified in the repro:
// port8790 InitGame "max player count is 1"; the 2nd player only activates after the 1st
// leaves). We inject ?MaxPlayers into the map URL (see GetGameDefaultMap) so InitGame sets up
// all related session/game-mode state for N players at once. This is the CAP only;
// ExpectedPlayerCount is synchronized separately from the concrete launch roster below.
// Default 4 (Dauntless party size). Override WITHOUT a rebuild by writing an integer into
// <game-exe-dir>\HUB_MAX_PLAYERS.txt. Read once.
// [2026-10-13 realms hub] A hub the launcher started (MYSTICPARADOX_HOSTED_ROLE=HUB) sets its cap with
// MYSTICPARADOX_MAX_PLAYERS (1..64, validated by the p2p module): P2PHooks::MaxPlayersOverride() is consulted first
// and then HUB_MAX_PLAYERS.txt is not read at all (no per-install text file in the host's game folder). The hook is 0
// ("none") on a dedicated server, for a HUNT role and in the build without the p2p module, so those read the file as
// before. A player-hosted server logs the source once.
static int HubMaxPlayers() {
    static int Cached = -1;
    if (Cached < 0) {
        const int LauncherMax = P2PHooks::MaxPlayersOverride();
        if (LauncherMax >= 1 && LauncherMax <= 64) {
            Cached = LauncherMax;
            MpLog("[HubRole] max players " + std::to_string(Cached) + " (launcher MYSTICPARADOX_MAX_PLAYERS)");
            return Cached;
        }
        Cached = 4; // default party size
        const char* MaxPlayersSource = "default";
        wchar_t ExePath[MAX_PATH];
        DWORD n = GetModuleFileNameW(nullptr, ExePath, MAX_PATH);
        if (n > 0 && n < MAX_PATH) {
            for (int i = (int)n - 1; i >= 0; --i) {
                if (ExePath[i] == L'\\' || ExePath[i] == L'/') { ExePath[i + 1] = L'\0'; break; }
            }
            std::wstring Path = std::wstring(ExePath) + L"HUB_MAX_PLAYERS.txt";
            std::ifstream File(Path);
            if (File.is_open()) {
                int Value = 0;
                if ((File >> Value) && Value >= 1 && Value <= 64) { Cached = Value; MaxPlayersSource = "HUB_MAX_PLAYERS.txt"; }
            }
        }
        if (Globals::AuthMode == Globals::ServerAuthMode::HuntCapability) {
            MpLog("[HubRole] max players " + std::to_string(Cached) + " (" + MaxPlayersSource + ")");
        }
    }
    return Cached;
}

/*
 * [2026-10-11 1.14.7 P2P host] MAP_URL_LISTEN.flag (the engine-listener A/B path) is refused on a player-hosted
 * (HuntCapability) server. That path lets the engine create the GameNetDriver during map load and then only waits for
 * UWorld::NetDriver, so it skips the player-host checks the manual Networking::Listen makes: PrepareListen (loopback
 * bind address, and the engine MULTIHOME check) and the readiness report whose failure fences the host
 * (P2PHooks::OnListenFailed). Both readers - GetGameDefaultMap (?listen) and GameEngineTickHook (wait for the engine
 * listener) - ask here, so the host's map URL never carries ?listen and the host always listens manually. DeployServer
 * instances keep the flag's behaviour. No revert flag (the refused path has no player-host safety).
 */
static bool MpMapUrlListenEnabled() {
    if (!MpExeRelativeFlagPresent(L"MAP_URL_LISTEN.flag")) return false;
    if (Globals::AuthMode != Globals::ServerAuthMode::HuntCapability) return true;
    static volatile LONG s_logged = 0;
    if (InterlockedCompareExchange(&s_logged, 1, 0) == 0) {
        MpLog("[EngineListen] MAP_URL_LISTEN.flag REFUSED on this player-hosted server: the engine-listener path skips "
              "PrepareListen and the readiness fence; listening through Networking::Listen instead");
    }
    return false;
}

// Count the concrete `playerUid:playerHuntId` entries supplied by DeployServer/PlayerHost in
// Globals::ExpectedPlayerString. Persistent hubs use NO_EXPECTED_PLAYERS and intentionally return
// zero. A malformed launch roster also returns zero rather than making the load manager wait for a
// player that can never satisfy the entry. The runtime cap remains authoritative.
static int LaunchExpectedPlayerCount() {
    if (!Globals::ExpectedPlayerString) return 0;

    const std::wstring Roster(Globals::ExpectedPlayerString);
    if (Roster.empty() || Roster.find(L"NO_EXPECTED_PLAYERS") != std::wstring::npos) return 0;

    int Count = 0;
    size_t Start = 0;
    while (Start < Roster.size()) {
        const size_t End = Roster.find(L',', Start);
        const size_t Length = (End == std::wstring::npos ? Roster.size() : End) - Start;
        const std::wstring Entry = Roster.substr(Start, Length);
        const size_t Colon = Entry.find(L':');
        if (Colon == std::wstring::npos || Colon == 0 || Colon + 1 >= Entry.size()) return 0;
        ++Count;
        if (End == std::wstring::npos) break;
        Start = End + 1;
    }

    return std::clamp(Count, 0, HubMaxPlayers());
}

FString* GetGameDefaultMap(FString* a1) {
    // [2026-07-19] Per-call entry/return traces are VERBOSE_DIAG-only; this hook fires constantly.
    if (VerboseDiag()) MpLog("[GetGameDefaultMap] entry out=" + MpPtr(a1));
    FString* Ret = reinterpret_cast<FString*(*)(FString*)>(OrigGetDefaultMap)(a1);
    if (VerboseDiag()) MpLog("[GetGameDefaultMap] original returned " + MpPtr(Ret));

    std::wstring FinalURL(Globals::MapPath);

    std::wstring BehemothPath(Globals::BehemothPath);

    if (!BehemothPath.contains(L"NO_BEHEMOTH")) {
        FinalURL += std::wstring(L"?MonsterClass=");
        FinalURL += std::wstring(BehemothPath);
    }

    std::wstring MatchmakerHuntId(Globals::MatchmakerHuntId);

    if (!MatchmakerHuntId.contains(L"NO_MM_HUNTID")) {
        FinalURL += std::wstring(L"?HuntId=");
        FinalURL += std::wstring(MatchmakerHuntId);
    }

    std::wstring ExpectedPlayers(Globals::ExpectedPlayerString);

    if (!ExpectedPlayers.contains(L"NO_EXPECTED_PLAYERS")) {
        FinalURL += std::wstring(L"?PlayerHuntIds=");
        FinalURL += std::wstring(ExpectedPlayers);
    }

    // [2026-07-16] Always advertise the instance player cap. Without ?MaxPlayers the native
    // AArchonGameMode::InitGame defaults "max player count" to 1 and gates every 2nd joiner at
    // loading until a slot frees. Supplying the URL option lets InitGame initialize session/
    // game-mode state for N players consistently. ExpectedPlayerCount is synchronized from the
    // concrete launch roster in the server tick.
    FinalURL += std::wstring(L"?MaxPlayers=");
    FinalURL += std::to_wstring(HubMaxPlayers());

    // [1.14.7 2026-10-03] With MAP_URL_LISTEN.flag present, advertise the map as a LISTEN server so the
    // ENGINE builds the GameNetDriver during map load (the standard UE dedicated-server path,
    // UWorld::Listen) instead of this runtime creating one by hand. The manual path is what leaves the
    // world context invalid on 1.14.7: "WorldContext requested with invalid context object" appears 28
    // times per run with it and 0 times without it.
    // [2026-10-11] Never on a player-hosted server (MpMapUrlListenEnabled).
    if (MpMapUrlListenEnabled()) {
        FinalURL += std::wstring(L"?listen");
    }

    // [1.12.0] Write the URL into the engine-OWNED FString buffer instead of aliasing FinalURL's
    // std::wstring storage (see EngineRealloc note above). Ret->Data was MOVED out of the engine's
    // config map string by the original GetGameDefaultMap, so it is a genuine FMallocBinned2 block
    // we can grow; the engine can then realloc/free it safely. realloc(nullptr) degrades to malloc.
    {
        struct RawFString { wchar_t* Data; int Num; int Max; };
        RawFString* Raw = reinterpret_cast<RawFString*>(Ret);
        const int Count = static_cast<int>(FinalURL.size()) + 1; // include null terminator
        // [1.14.7 2026-10-03 LOG-FLOOD FIX] This hook fires on EVERY map-name query, and the original
        // rebuilds the engine config string each time, so our rewrite always needs a fresh buffer. The
        // per-call traces below therefore fired hundreds of times per second and grew the runtime log to
        // 735 MB in one session - the flood the user sees as "infinite logging", and needless I/O on the
        // hot path of a server that restarts. They are now verbose-only, exactly like the entry/return
        // traces above; the behaviour is unchanged.
        if (VerboseDiag()) {
            MpLog("[GetGameDefaultMap] setting map URL (" + std::to_string(FinalURL.size()) + " chars): " + MpNarrow(FinalURL));
            MpLog("[GetGameDefaultMap] before write Ret=" + MpPtr(Ret)
                + " Data=" + MpPtr(Raw->Data)
                + " Num=" + std::to_string(Raw->Num)
                + " Max=" + std::to_string(Raw->Max)
                + " Count=" + std::to_string(Count));
        }

        if (Raw->Max < Count || Raw->Data == nullptr) {
            if (VerboseDiag()) MpLog("[GetGameDefaultMap] realloc needed");
            Raw->Data = static_cast<wchar_t*>(EngineRealloc(Raw->Data, static_cast<size_t>(Count) * sizeof(wchar_t)));
            if (VerboseDiag()) MpLog("[GetGameDefaultMap] realloc returned Data=" + MpPtr(Raw->Data));
        }
        else if (VerboseDiag()) {
            MpLog("[GetGameDefaultMap] reusing existing buffer");
        }

        if (!Raw->Data) {
            MpLog("[GetGameDefaultMap] null Data after allocation; returning original result");
            return Ret;
        }

        wmemcpy(Raw->Data, FinalURL.c_str(), static_cast<size_t>(Count));
        Raw->Num = Count;
        if (Raw->Max < Count) {
            Raw->Max = Count;
        }
        if (VerboseDiag()) {
            MpLog("[GetGameDefaultMap] written OK Data=" + MpPtr(Raw->Data)
                + " Num=" + std::to_string(Raw->Num)
                + " Max=" + std::to_string(Raw->Max));
        }
    }

    //*Ret = L"/Game/Maps/islands/1705/dia_moss_triforce?MonsterClass=/Game/Monsters/mcrollin/mcbeaver_tutorial_bp.mcbeaver_tutorial_bp_C";
    //*Ret = L"/Game/Maps/ramsgate/ramsgate_01_persistent";
    //*Ret = L"/Game/Maps/islands/dojo/training_dojo_persistent";
    //*Ret = L"/Game/Maps/islands/1705/dia_moss_triforce?MonsterClass=/Game/Monsters/mcrollin/mcbeaver_tutorial_bp.mcbeaver_tutorial_bp_C";

    return Ret;
}

void* OrigGetCommandLine = nullptr;

const wchar_t* GetCommandLineHook() {
    // [Phase 0L 2026-07-12] Added LogNetPackageMap Verbose to capture FNetGUIDCache::SupportsObject /
    // guid assignment/export for the interaction-invisibility root-cause (why the client can't resolve
    // ClientInteractionCompleted's object-ref target for non-replicated NPCs like npc_bosun).
    // The dedicated process has no official EAC launcher/session.  Keep the
    // engine's own opt-out on the overridden command line so the EAC module
    // does not repeatedly try to create an IGameClient on every game server.
    // -warp: force the WARP software D3D11 device so this client-as-server binary boots on a
    // GPU-less VPS. -nullrhi alone does NOT suppress D3D11 device creation on the Shipping client
    // build, so without a GPU the engine still hits "A D3D11-compatible GPU is required". WARP
    // presents an FL11.0 device in software; the headless server renders nothing, so overhead is
    // negligible. Server-only: this hook is installed in InitServerHooks, so clients are unaffected.
    return L"Dauntless-Win64-Shipping.exe -server -unattended -nullrhi -warp -nosound -EpicPortal -NoEAC -RepDriverDisable -LogCmds=\"LogNet VeryVerbose, LogNetPackageMap Verbose\"";
}

// ============================================================================
// [WARP force 2026-07-15] Boot the client-as-server binary on a GPU-less VPS.
// The engine RHI selector (FUN_1432d9ca0) calls the D3D11RHI module IsSupported();
// with no Feature-Level-11 GPU it returns false and hard-exits with the popup
// "A D3D11-compatible GPU (Feature Level 11.0, Shader Model 5.0) is required to run
// the engine". -nullrhi/-warp do NOT bypass this on the Shipping client build.
// ONLY when the sentinel MP_FORCE_WARP.flag exists next to the game .exe (exe-relative
// so it works on the VPS, unlike the hardcoded debug path) do we:
//   1) byte-patch the IsSupported() failure branch (JNZ 0x75 -> JMP 0xEB at
//      RVA 0x0032DAA1B) so RHI selection always accepts D3D11, and
//   2) force every D3D11CreateDevice[AndSwapChain] to the WARP software adapter
//      (DriverType = D3D_DRIVER_TYPE_WARP(5), pAdapter = NULL) so the real device is
//      created in software with zero GPUs.
// Reversible + default-OFF: absent flag = stock behaviour (inert). Delete the flag
// (or restore the previous DLL, SHA 4FEA5FA6) to revert without a rebuild.
// ============================================================================
static bool MpForceWarpEnabled() {
    static int Cached = -1;
    if (Cached < 0) {
        Cached = 0;
        wchar_t ExePath[MAX_PATH];
        DWORD n = GetModuleFileNameW(nullptr, ExePath, MAX_PATH);
        if (n > 0 && n < MAX_PATH) {
            for (int i = (int)n - 1; i >= 0; --i) {
                if (ExePath[i] == L'\\' || ExePath[i] == L'/') { ExePath[i + 1] = L'\0'; break; }
            }
            std::wstring FlagPath = std::wstring(ExePath) + L"MP_FORCE_WARP.flag";
            if (GetFileAttributesW(FlagPath.c_str()) != INVALID_FILE_ATTRIBUTES) { Cached = 1; }
        }
    }
    return Cached == 1;
}

// Case-insensitive "d3d11" substring test (avoids <cwctype>).
static bool MpPathHasD3D11(const wchar_t* Path) {
    if (!Path) { return false; }
    const wchar_t* Needle = L"d3d11";
    for (const wchar_t* P = Path; *P; ++P) {
        int i = 0;
        for (; Needle[i] && P[i]; ++i) {
            wchar_t a = P[i];
            if (a >= L'A' && a <= L'Z') { a = (wchar_t)(a + 32); }
            if (a != Needle[i]) { break; }
        }
        if (!Needle[i]) { return true; }
    }
    return false;
}

// Opaque signatures (avoid pulling in d3d11.h). D3D_DRIVER_TYPE_WARP = 5.
using PFN_D3D11CreateDevice = long (WINAPI*)(void*, unsigned int, HMODULE, unsigned int,
    const void*, unsigned int, unsigned int, void**, void*, void**);
using PFN_D3D11CreateDeviceAndSwapChain = long (WINAPI*)(void*, unsigned int, HMODULE, unsigned int,
    const void*, unsigned int, unsigned int, const void*, void**, void**, void*, void**);
static PFN_D3D11CreateDevice OrigD3D11CreateDevice = nullptr;
static PFN_D3D11CreateDeviceAndSwapChain OrigD3D11CreateDeviceAndSwapChain = nullptr;
static volatile LONG g_D3D11Hooked = 0;

static long WINAPI D3D11CreateDeviceHook(void* pAdapter, unsigned int DriverType, HMODULE Software,
    unsigned int Flags, const void* pFeatureLevels, unsigned int FeatureLevels, unsigned int SDKVersion,
    void** ppDevice, void* pFeatureLevel, void** ppImmediateContext) {
    (void)pAdapter; (void)DriverType;
    // WARP is always present in d3d11.dll and needs no DXGI hardware enumeration, so this
    // succeeds with zero GPUs. Null adapter is REQUIRED with D3D_DRIVER_TYPE_WARP.
    return OrigD3D11CreateDevice(nullptr, 5, Software, Flags, pFeatureLevels, FeatureLevels,
        SDKVersion, ppDevice, pFeatureLevel, ppImmediateContext);
}
static long WINAPI D3D11CreateDeviceAndSwapChainHook(void* pAdapter, unsigned int DriverType, HMODULE Software,
    unsigned int Flags, const void* pFeatureLevels, unsigned int FeatureLevels, unsigned int SDKVersion,
    const void* pSwapChainDesc, void** ppSwapChain, void** ppDevice, void* pFeatureLevel, void** ppImmediateContext) {
    (void)pAdapter; (void)DriverType;
    return OrigD3D11CreateDeviceAndSwapChain(nullptr, 5, Software, Flags, pFeatureLevels, FeatureLevels,
        SDKVersion, pSwapChainDesc, ppSwapChain, ppDevice, pFeatureLevel, ppImmediateContext);
}

// Install the D3D11CreateDevice[AndSwapChain] -> WARP hooks once, given a loaded d3d11.dll.
// No MpLog here: this can run under the loader lock while d3d11.dll is loading.
static void MpTryHookD3D11(HMODULE Mod) {
    if (!Mod) { return; }
    if (InterlockedCompareExchange(&g_D3D11Hooked, 1, 0) != 0) { return; }
    void* pCreate = reinterpret_cast<void*>(GetProcAddress(Mod, "D3D11CreateDevice"));
    void* pCreateSC = reinterpret_cast<void*>(GetProcAddress(Mod, "D3D11CreateDeviceAndSwapChain"));
    if (pCreate) {
        MH_CreateHook(pCreate, reinterpret_cast<void*>(D3D11CreateDeviceHook),
            reinterpret_cast<void**>(&OrigD3D11CreateDevice));
        MH_EnableHook(pCreate);
    }
    if (pCreateSC) {
        MH_CreateHook(pCreateSC, reinterpret_cast<void*>(D3D11CreateDeviceAndSwapChainHook),
            reinterpret_cast<void**>(&OrigD3D11CreateDeviceAndSwapChain));
        MH_EnableHook(pCreateSC);
    }
}

// Catch d3d11.dll being loaded (UE4 loads it dynamically during RHI init), then hook it.
using PFN_LoadLibraryExW = HMODULE (WINAPI*)(const wchar_t*, HANDLE, DWORD);
static PFN_LoadLibraryExW OrigLoadLibraryExW = nullptr;
static HMODULE WINAPI LoadLibraryExWHook(const wchar_t* lpLibFileName, HANDLE hFile, DWORD dwFlags) {
    HMODULE Result = OrigLoadLibraryExW(lpLibFileName, hFile, dwFlags);
    if (Result && !g_D3D11Hooked && MpPathHasD3D11(lpLibFileName)) {
        MpTryHookD3D11(Result);
    }
    return Result;
}

static bool MpPatchBytesVerified(uintptr_t Rva, const uint8_t* Expected, const uint8_t* Replacement,
                                 size_t Length, const char* Tag);

// Called from InitServerHooks only when MP_FORCE_WARP.flag is present (see header comment).
static void InstallWarpForceHooks() {
    MpLog("[WARP] installing (MP_FORCE_WARP.flag present)");
    // 1) Bypass the IsSupported() failure branch: JNZ (0x75) -> JMP (0xEB).
    // [1.14.7 2026-10-08] The site was the 1.12 RVA 0x032DAA1B, guarded only by "byte == 0x75" - on 1.14.7
    // that could have flipped an unrelated jne. tools/rva-port-audit.py maps it to 0x034AB73F (verified; the
    // same `call [rdx+0x40]; test al,al; jne` sequence). The patch now checks `test al,al; jne` and fails closed.
    {
        static const uint8_t Expected[3] = { 0x84, 0xC0, 0x75 };
        static const uint8_t Replacement[3] = { 0x84, 0xC0, 0xEB };
        const bool Ok = MpPatchBytesVerified(0x034AB73D, Expected, Replacement, 3, "WARP IsSupported gate");
        MpLog(std::string("[WARP] gate patch @+0x34AB73F ") + (Ok ? "(OK)"
            : "(NOT applied: bytes differ - DLL likely loaded AFTER engine PreInit, or a different exe)"));
    }
    // 2) Force WARP for the real device creation: hook LoadLibraryExW to catch d3d11.dll,
    //    and hook it directly if it is already resident (static import).
    HMODULE Kernel = GetModuleHandleW(L"kernel32.dll");
    void* pLLEW = Kernel ? reinterpret_cast<void*>(GetProcAddress(Kernel, "LoadLibraryExW")) : nullptr;
    if (pLLEW) {
        MH_CreateHook(pLLEW, reinterpret_cast<void*>(LoadLibraryExWHook),
            reinterpret_cast<void**>(&OrigLoadLibraryExW));
        MH_EnableHook(pLLEW);
    }
    HMODULE Existing = GetModuleHandleW(L"d3d11.dll");
    MpLog(std::string("[WARP] LoadLibraryExW hook=") + (pLLEW ? "on" : "FAIL")
        + " d3d11Resident=" + (Existing ? "yes(hook now)" : "no(hook on load)"));
    if (Existing) { MpTryHookD3D11(Existing); }
}

void* OrigServerBootCrash = nullptr;

// Dauntless 1.14.7 / CL 647472: ServerBootCrash is the UE4 HandleError/error-history writer
// at RVA 0x02659A20. Ghidra confirms the fatal text is passed as a UTF-16 buffer at RVA
// 0x06E14AD0 (FUN_142659a20 passes &DAT_146e14ad0 to FUN_1425f0c70 as ushort*). This is a
// character buffer, not a pointer slot. Read it directly and with a strict bound because this
// hook runs on an error path and must not introduce a second fault while reporting the first.
void ServerBootCrash(void* param_1) {
    const wchar_t* ErrorHist = reinterpret_cast<const wchar_t*>(Globals::BaseAddress + 0x06E14AD0);

    std::string Category = "ServerBootCrash";
    std::wstring SafeErrorHist;
    SafeErrorHist.reserve(256);
    if (!ErrorHist) {
        SafeErrorHist = L"(null error history buffer)";
    } else {
        for (size_t i = 0; i < 1023; ++i) {
            wchar_t Ch = L'\0';
            SIZE_T BytesRead = 0;
            if (!ReadProcessMemory(GetCurrentProcess(), ErrorHist + i, &Ch, sizeof(Ch), &BytesRead)
                || BytesRead != sizeof(Ch)) {
                SafeErrorHist += L" <unreadable/truncated>";
                break;
            }
            if (Ch == L'\0') break;
            SafeErrorHist.push_back(Ch);
        }
    }
    std::string MsgNarrow = MpNarrow(SafeErrorHist);

    MpLog("[ServerBootCrash] FATAL (native handler preserved) - category=" + Category + " msg=" + MsgNarrow);

    // [1.14.7 root-cause fix 2026-10-03] Do NOT swallow the engine's fatal path.
    // Ghidra (1.14.7 program, CL 647472) decompiles +0x02659A20 as
    //   void FUN_142659a20(longlong *param_1)   -- one pointer argument, void return
    // It is FWindowsErrorOutputDevice::HandleError: it sets GIsCriticalError, emits
    // "=== Critical error: ===" into the error history buffer at +0x06E14AD0, flushes the
    // error device and lets UE request exit. The previous implementation logged and
    // returned WITHOUT calling it, so the engine kept running after a fatal error and then
    // corrupted unrelated state (NetDriver cleanup arrays; particle module hashes) before
    // dying later with an unrelated message -- which is why the true first failure was
    // never attributable. Preserve native handling: log first, then delegate.
    if (OrigServerBootCrash != nullptr) {
        reinterpret_cast<void(*)(void*)>(OrigServerBootCrash)(param_1);
    }
    return;
}

// [move2.md 2026-07-10] Forward decls for helpers used in the LoadFailed diagnostic
// hook below. Full definitions live near line 2605 (SafeReadPtr) and 90
// (IsReadablePointer). We also declare two new size-specific readers.
static uintptr_t SafeReadPtr(uintptr_t base, uintptr_t offset);
static int SafeReadU8At(uintptr_t base, uintptr_t offset);
// [1.14.7 identity diagnostic] defined near the byte-patch helper; declared here because the
// client hook-install block appears earlier in this translation unit than the definition.
static void InstallLoadMgrBeginHook(const char* Role);
// [1.14.7 progression diagnostics] same reason: defined later, installed from InitServerHooks.
static void InstallProgressionDiagnostics();
// [1.14.7 headless audio] same reason: defined later, installed from InitServerHooks.
static void InstallHeadlessAudioHook();
// [1.14.7 progression cache probe] same reason: defined later, installed from InitServerHooks.
static void InstallProgressionCacheProbe();
// [1.14.7 progression readiness probe] same reason: defined later, installed from InitServerHooks.
static void InstallProgressionReadinessProbe();
// [1.14.7 active hunt pass] same reason: defined later, installed from InitServerHooks.
static void InstallActiveHuntPassDriver();
// [1.14.7 load complete probe] same reason: defined later, installed from InitServerHooks.
static void InstallLoadCompleteProbe();
// [1.14.7 FindRow probe] same reason: defined later, installed from InitServerHooks.
static void InstallFindRowProbe();
// [1.14.7 config callback probe] same reason: defined later, installed from InitServerHooks.
static void InstallConfigCompleteProbe();
// [1.14.7 interface query call] defined later; used from the progression cache probe.
static void CallInterfaceQuerySlot(void* Interface, uintptr_t SlotOffset);
// [1.14.7 caller scan] defined later; installed from InitServerHooks.
static void InstallGameInstanceQueryHook();
// [1.14.7 feature flag dump] defined later; used from the readiness hook.
static void DumpFeatureFlags(const char* Tag);
// [1.14.7 hunt pass query call] defined later; used from the readiness hook.
static void CallHuntPassSeasonQuery();
// [1.14.7 mastery array probe] same reason: defined later, installed from InitServerHooks.
static void InstallMasteryProbe();
// [1.14.7 InteractionCalloutWidget::OnSetDisabled guard] same reason: defined later.
static void InstallInteractionCalloutSetDisabledGuard();
// [1.14.7 loader state dump] same reason: defined later, used from the server tick.
static void DumpLoadManagerEntries(const char* Tag);
// [Group C cleanup 2026-07-13] ForceNetUpdateEnabled fwd-decl removed (Phase-0e experiment deleted).
static int32_t SafeReadI32At(uintptr_t base, uintptr_t offset);
static void* ResolveWeakObj(int32_t objectIndex, int32_t serialNumber);
std::string SafeObjectNameForDiagnostic(void* Object);

// One automatic retry is enough to repair the observed hunt -> Ramsgate failure without turning a
// genuinely broken endpoint into an infinite request loop. The state is keyed by both manager and
// owning PlayerController so a recycled UObject allocation starts with a fresh budget.
struct PlayerDataLoadRecoverySlot {
    uintptr_t LoadManager;
    uintptr_t PlayerController;
    uint64_t LastFailureMs;
    uint32_t RetryCount;
};

static constexpr uint32_t kPlayerDataLoadMaxRetries = 1;
static constexpr size_t kPlayerDataLoadRecoverySlotCount = 32;
static constexpr uint64_t kPlayerDataLoadRecoveryStaleMs = 5ull * 60ull * 1000ull;
static SRWLOCK g_PlayerDataLoadRecoveryLock = SRWLOCK_INIT;
static PlayerDataLoadRecoverySlot
    g_PlayerDataLoadRecoverySlots[kPlayerDataLoadRecoverySlotCount] = {};

static bool ClaimPlayerDataLoadRetry(
    uintptr_t LoadManager,
    uintptr_t PlayerController,
    uint32_t* OutRetryNumber)
{
    if (!LoadManager || !PlayerController || !OutRetryNumber) return false;

    const uint64_t NowMs = GetTickCount64();
    AcquireSRWLockExclusive(&g_PlayerDataLoadRecoveryLock);

    PlayerDataLoadRecoverySlot* Match = nullptr;
    PlayerDataLoadRecoverySlot* Replacement = nullptr;
    uint64_t OldestFailureMs = UINT64_MAX;

    for (PlayerDataLoadRecoverySlot& Slot : g_PlayerDataLoadRecoverySlots) {
        if (Slot.LoadManager == LoadManager && Slot.PlayerController == PlayerController) {
            Match = &Slot;
            break;
        }

        const bool Empty = Slot.LoadManager == 0;
        const bool Stale = Slot.LastFailureMs != 0
            && NowMs - Slot.LastFailureMs >= kPlayerDataLoadRecoveryStaleMs;
        if (Empty || Stale) {
            Replacement = &Slot;
            if (Empty) break;
        }
        else if (!Replacement && Slot.LastFailureMs < OldestFailureMs) {
            Replacement = &Slot;
            OldestFailureMs = Slot.LastFailureMs;
        }
    }

    if (!Match) {
        Match = Replacement;
        if (Match) {
            *Match = {};
            Match->LoadManager = LoadManager;
            Match->PlayerController = PlayerController;
        }
    }

    bool Claimed = false;
    if (Match) {
        Match->LastFailureMs = NowMs;
        if (Match->RetryCount < kPlayerDataLoadMaxRetries) {
            ++Match->RetryCount;
            *OutRetryNumber = Match->RetryCount;
            Claimed = true;
        }
    }

    ReleaseSRWLockExclusive(&g_PlayerDataLoadRecoveryLock);
    return Claimed;
}

static bool ClearPlayerDataLoadRecovery(uintptr_t LoadManager, uintptr_t PlayerController) {
    bool Cleared = false;
    AcquireSRWLockExclusive(&g_PlayerDataLoadRecoveryLock);
    for (PlayerDataLoadRecoverySlot& Slot : g_PlayerDataLoadRecoverySlots) {
        if ((LoadManager && Slot.LoadManager == LoadManager)
            || (PlayerController && Slot.PlayerController == PlayerController)) {
            Slot = {};
            Cleared = true;
        }
    }
    ReleaseSRWLockExclusive(&g_PlayerDataLoadRecoveryLock);
    return Cleared;
}

// Reset only the native IArchonPlayerDataLoader::bLoading byte (+0x11) for loaders that are still
// bLoaded=false (+0x10), then re-enter UArchonLoadManager::Begin. Begin schedules a new bounded
// LoadFailed timer and calls the loader's real Load implementation. A late callback from the first
// request remains safe because IArchonPlayerDataLoader::Done is idempotent once bLoaded becomes true.
// Kept POD-only so SEH can contain any stale pointer/native-call fault.
static bool RearmIncompletePlayerDataLoaders(
    uintptr_t LoadManager,
    uintptr_t ArrayBase,
    int32_t ArrayCount,
    int ExpectedIncomplete,
    int* OutRearmed)
{
    if (OutRearmed) *OutRearmed = 0;
    __try {
        int Rearmed = 0;
        for (int32_t i = 0; i < ArrayCount; ++i) {
            const uintptr_t Entry = ArrayBase + static_cast<uintptr_t>(i) * 0x10;
            const uintptr_t Loader = *reinterpret_cast<uintptr_t*>(Entry + 0x08);
            if (!Loader) return false;
            if (*reinterpret_cast<uint8_t*>(Loader + 0x10) == 0) {
                *reinterpret_cast<uint8_t*>(Loader + 0x11) = 0;
                ++Rearmed;
            }
        }

        if (Rearmed <= 0 || Rearmed != ExpectedIncomplete) return false;

        // UArchonLoadManager::Begin guards timer creation with bBegun @ +0x58. The previous
        // one-shot timer is the callback currently executing, so clearing this byte lets Begin
        // replace/re-arm the same native timer handle at +0x60 and refresh StartTime at +0x68.
        *reinterpret_cast<uint8_t*>(LoadManager + 0x58) = 0;
        using BeginFn = void(*)(void*);
        // [1.14.7 REMAP 2026-10-03] Begin was hardcoded at the 1.12 RVA 0x01B50080, which is a
        // different function in this binary - calling it faulted at +0x1B50087 (0xC0000005) the
        // moment the retry ran. The 1.14.7 function is resolved by the same string-anchor method:
        // "UArchonLoadManager::Begin" (0x1454BFF10) has exactly one xref, inside FUN_141c997a0.
        // (Complete is FUN_141c9dc70 if it is ever needed.)
        reinterpret_cast<BeginFn>(Globals::BaseAddress + 0x01C997A0)(
            reinterpret_cast<void*>(LoadManager));

        if (OutRearmed) *OutRearmed = Rearmed;
        return true;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

// [1.12.0] UArchonLoadManager::LoadFailed - CONFIRMED RVA 0x01B65EB0
// Found via string-anchor on the ASCII function-name literal "UArchonLoadManager::LoadFailed"
// at .rdata file offset 0x51D7688 -> RVA 0x51D8888 -> VA 0x1451D8888; 3 xrefs, all inside
// FUN_141b65eb0 (Ghidra).
//
// Recovery contract verified from the 1.12.0 native functions:
//   Begin                  @ RVA 0x01B50080 (1.12) -> 0x01C997A0 (1.14.7, string-anchor verified)
//   Complete               @ RVA 0x01B547D0 (1.12) -> 0x01C9DC70 (1.14.7, string-anchor verified)
//   LoadFailed             @ RVA 0x01B65EB0
//   IPlayerDataLoader::Load @ RVA 0x01BA25E0
//   IPlayerDataLoader::Done @ RVA 0x01B92600
//
// Each manager entry is {FWeakObjectPtr owner, IArchonPlayerDataLoader* loader}; it is NOT an
// FName. The previous diagnostic decoded the weak index/serial as an FName and produced mojibake.
// On the observed failed return, one loader remains bLoaded=0/bLoading=1. Complete() calls Begin()
// again, but Load() refuses to run while bLoading is still true, leaving the manager deadlocked
// until this timeout.
//
// Default behavior now performs one native retry of only the incomplete loader(s). If the retry
// also reaches LoadFailed, the original game handler runs and reports/disconnects normally rather
// than leaving the player on an endless loading screen. DISABLE_PLAYERDATA_LOAD_RETRY.flag bypasses
// the retry and immediately uses the original handler.
void* OrigArchonLoadManagerLoadFailed = nullptr;
void ArchonLoadManagerLoadFailedHook(void* This) {
    static std::atomic<int> s_hitCount{0};
    int hit = s_hitCount.fetch_add(1, std::memory_order_relaxed);

    uintptr_t self = reinterpret_cast<uintptr_t>(This);
    uintptr_t playerController = 0;
    MpLog(std::string("[LoadFailedDiag] fire #") + std::to_string(hit)
        + " LoadManager=" + MpPtr(This));

    auto CallOriginal = [&]() {
        if (OrigArchonLoadManagerLoadFailed) {
            reinterpret_cast<void(*)(void*)>(OrigArchonLoadManagerLoadFailed)(This);
        }
        else {
            MpLog("[PlayerDataRecovery] original LoadFailed trampoline missing; cannot report terminal failure");
        }
    };

    if (!IsReadablePointer(This, 0x70)) {
        MpLog("[LoadFailedDiag]   LoadManager pointer not readable; using original terminal handler");
        CallOriginal();
        return;
    }

    playerController = SafeReadPtr(self, 0x20);
    uintptr_t arrayBase = SafeReadPtr(self, 0x48);
    int32_t   arrayCount = SafeReadI32At(self, 0x50);

    MpLog(std::string("[LoadFailedDiag]   ArrayBase=") + MpPtr((void*)arrayBase)
        + " Count=" + std::to_string(arrayCount)
        + " PlayerController=" + MpPtr((void*)playerController));

    if (!arrayBase || arrayCount <= 0 || arrayCount > 128) {
        MpLog("[LoadFailedDiag]   Array empty/invalid; using original terminal handler");
        CallOriginal();
        return;
    }

    if (!IsReadablePointer(reinterpret_cast<void*>(arrayBase),
                           static_cast<size_t>(arrayCount) * 0x10)) {
        MpLog("[LoadFailedDiag]   Array unreadable; using original terminal handler");
        CallOriginal();
        return;
    }

    int incompleteCount = 0;
    // [1.14.7 FIX 2026-10-05] Loaders this handler completed BY ITSELF (see the daily-bounty block below).
    // The re-arm path requires Rearmed != 0, so completing a loader here used to leave nothing to re-arm,
    // RearmIncompletePlayerDataLoaders returned false, and the recovery fell through to the original terminal
    // handler anyway - which is why the client still showed the error-exit popup every ~60s.
    int CompletedByUs = 0;
    bool snapshotRecoverable = playerController != 0
        && IsReadablePointer(reinterpret_cast<void*>(playerController), 0xA78)
        && IsRegisteredLiveObject(reinterpret_cast<void*>(playerController));

    for (int i = 0; i < arrayCount; ++i) {
        uintptr_t entryAddr = arrayBase + static_cast<uintptr_t>(i) * 0x10;
        const int32_t weakIndex = SafeReadI32At(entryAddr, 0x00);
        const int32_t weakSerial = SafeReadI32At(entryAddr, 0x04);
        const uintptr_t loaderPtr = SafeReadPtr(entryAddr, 0x08);
        void* owner = ResolveWeakObj(weakIndex, weakSerial);

        int loadedFlag = -1;
        int loadingFlag = -1;
        if (loaderPtr && IsReadablePointer(reinterpret_cast<void*>(loaderPtr), 0x28)) {
            loadedFlag = SafeReadU8At(loaderPtr, 0x10);
            loadingFlag = SafeReadU8At(loaderPtr, 0x11);
        }

        if (loadedFlag == 0) ++incompleteCount;
        if (!owner || !loaderPtr || (loadedFlag != 0 && loadedFlag != 1)
            || (loadingFlag != 0 && loadingFlag != 1)) {
            snapshotRecoverable = false;
        }

        uintptr_t ownerClass = owner
            ? SafeReadPtr(reinterpret_cast<uintptr_t>(owner), 0x10)
            : 0;

        // [1.14.7 FLAG PROBE 2026-10-04] The daily bounty component logs
        //   UBountyComponent_Daily::ServerInitializeBounties() - bServerInitializedBounties is true so bailing.
        // and its loader is the only one stuck (bLoaded=0/bLoading=1). Our re-arm clears bLoading and re-enters
        // Begin(), but the re-run bails on that guard, so the offset must be MEASURED rather than assumed.
        // Dump the component's flag region (a bool the component sets) so the offset can be identified and then
        // TESTED by clearing it - not guessed. Bounded to the bounty components.
        {
            const std::string OwnerName = SafeObjectNameForDiagnostic(owner);
            // [1.14.7 FIX 2026-10-04] Clear the daily bounty component's init guard so the re-arm below can
            // actually complete it.
            //
            // MEASURED (dump of all three bounty components at LoadFailed time):
            //   bounty_bpc        +0x3F0: 01..   +0x3F8: 01..     loader loaded=1
            //   bounty_weekly_bpc +0x3F0: 01..   +0x3F8: 01..     loader loaded=1
            //   bounty_daily_bpc  +0x3F0: 01..   +0x3F8: 00..     loader loaded=0 loading=1
            // +0x3F0 is 1 on all three - each component has run ServerInitializeBounties, which is exactly why
            // the daily logs "bServerInitializedBounties is true so bailing". +0x3F8 is 1 only on the two that
            // COMPLETED. So the daily's first init set the guard but never finished, and every retry bails on
            // that guard - our re-arm clears bLoading and re-enters Begin(), but the re-run bails again.
            //
            // Clearing the guard for the daily component lets its re-run do the work and complete the loader.
            // Bounded to that one component by name, and only when its loader is genuinely incomplete.
            // [1.14.7 REMOVED 2026-10-05] The forced-completion patch that lived here is DELETED. The audit
            // corrected its premises, all of which were wrong:
            //   +0x3F0 means CONFIGURATION RECEIVED, not the initialization guard;
            //   the guard is +0x414, and +0x3F8 records FINISHED SETUP;
            //   and writing loaded=1 into the loader never executes native FinishSetup -> Done, so it only
            //   made the manager's count look satisfied while the component stayed stalled.
            // The real defect is elsewhere: ReadFromBackend's WAIT branch binds a dynamic delegate named
            // CompleteLoadInternal to this component, but the class hierarchy has no reflected UFunction with
            // that name, so Unreal's function cache returns null and the dispatcher skips it - the component is
            // stranded even though configuration and season selection finish. See the progression resume below.
            const bool IsDailyBounty = false;   // forced completion disabled
            if (IsDailyBounty && loadedFlag == 0 && loaderPtr) {
                // MEASURED, and this corrects an earlier wrong fix: clearing the component's +0x3F0 init guard
                // does make ServerInitializeBounties run again (the guard comes back as 1 on the next fire),
                // but the loader STILL ends at loaded=0 loading=1 and the manager times out a second time.
                // So the guard was not the blocker - the loader's own Load() runs and never completes, while
                // the component demonstrably finishes its work (it re-sets the guard). What is left is the
                // manager's bookkeeping: Complete() counts loaders whose bLoaded (+0x10) is set, and this one
                // never is. Mark it loaded so the manager can finish, and clear bLoading (+0x11) to keep the
                // "Load refuses while bLoading" deadlock documented above from re-arming.
                uint8_t* LoadedByte = reinterpret_cast<uint8_t*>(loaderPtr + 0x10);
                uint8_t* LoadingByte = reinterpret_cast<uint8_t*>(loaderPtr + 0x11);
                if (IsReadablePointer(LoadedByte, 2)) {
                    MpLog(std::string("[DailyBountyGuard] completing stuck loader: loaded ")
                        + std::to_string(static_cast<int>(*LoadedByte)) + "->1, loading "
                        + std::to_string(static_cast<int>(*LoadingByte)) + "->0 owner=" + MpPtr(owner)
                        + " loader=" + MpPtr(reinterpret_cast<void*>(loaderPtr)));
                    *LoadedByte = 1;
                    *LoadingByte = 0;
                    ++CompletedByUs;
                }
            }
            if (OwnerName.find("bounty") != std::string::npos) {
                std::string Dump = "[BountyFlagDump] " + OwnerName + " +0x3E0..+0x420:";
                const uintptr_t Base = reinterpret_cast<uintptr_t>(owner);
                for (uintptr_t Off = 0x3E0; Off < 0x420; Off += 0x10) {
                    if (!IsReadablePointer(reinterpret_cast<void*>(Base + Off), 0x10)) break;
                    Dump += " ";
                    for (uintptr_t B = 0; B < 0x10; ++B) {
                        char Buf[4];
                        snprintf(Buf, sizeof(Buf), "%02X",
                            *reinterpret_cast<const uint8_t*>(Base + Off + B));
                        Dump += Buf;
                    }
                }
                MpLog(Dump);
            }
        }

        MpLog(std::string("[LoadFailedDiag]   [") + std::to_string(i) + "] "
            + "owner=" + MpPtr(owner) + "/" + SafeObjectNameForDiagnostic(owner)
            + " class=" + MpPtr((void*)ownerClass) + "/"
            + SafeObjectNameForDiagnostic(reinterpret_cast<void*>(ownerClass))
            + " loader=" + MpPtr((void*)loaderPtr)
            + " loaded=" + std::to_string(loadedFlag)
            + " loading=" + std::to_string(loadingFlag)
            + " weak=(" + std::to_string(weakIndex) + "," + std::to_string(weakSerial) + ")");
    }

    if (MpExeRelativeFlagPresent(L"DISABLE_PLAYERDATA_LOAD_RETRY.flag")) {
        MpLog("[PlayerDataRecovery] disabled by flag; using original terminal handler");
        CallOriginal();
        return;
    }

    if (!snapshotRecoverable || incompleteCount <= 0) {
        MpLog("[PlayerDataRecovery] snapshot is not safely recoverable incomplete="
            + std::to_string(incompleteCount) + "; using original terminal handler");
        CallOriginal();
        return;
    }

    uint32_t retryNumber = 0;
    if (!ClaimPlayerDataLoadRetry(self, playerController, &retryNumber)) {
        MpLog("[PlayerDataRecovery] retry budget exhausted; using original terminal handler");
        CallOriginal();
        return;
    }

    // [1.14.7 FIX 2026-10-05] If this handler already completed the stuck loader(s), the manager's Complete()
    // can fire on its own - so do NOT try to re-arm (there is nothing left to re-arm, and
    // RearmIncompletePlayerDataLoaders would return false purely because Rearmed == 0) and do NOT report a
    // terminal failure. That veto was the reason the recovery never actually succeeded:
    //   [DailyBountyGuard] completing stuck loader: loaded 0->1, loading 0->0
    //   [PlayerDataRecovery] native re-arm failed; using original terminal handler
    // [1.14.7 REMOVED 2026-10-05] The CompletedByUs early return is DELETED: it suppressed the terminal
    // failure while OTHER loaders could still be unfinished, so it hid real failures rather than fixing one.
    // With the forced loader bytes gone, CompletedByUs is always 0 and the normal re-arm path applies.
    if (false && CompletedByUs > 0) {
        return;
    }

    int rearmedCount = 0;
    if (!RearmIncompletePlayerDataLoaders(
            self, arrayBase, arrayCount, incompleteCount, &rearmedCount)) {
        ClearPlayerDataLoadRecovery(self, playerController);
        MpLog("[PlayerDataRecovery] native re-arm failed; using original terminal handler");
        CallOriginal();
        return;
    }

    MpLog("[PlayerDataRecovery] native retry=" + std::to_string(retryNumber)
        + "/" + std::to_string(kPlayerDataLoadMaxRetries)
        + " rearmed=" + std::to_string(rearmedCount)
        + " manager=" + MpPtr(This)
        + " playerController=" + MpPtr((void*)playerController));
}

// ============================================================================
// [LoadMgrDump 2026-07-11] Deterministic UArchonLoadManager loader enumeration.
// Backend player-data is now valid (WP_EB_BEGINNER etc. all resolve; no catalog/loadout rejection,
// no "Loading can't continue!"), yet OnPlayerDataLoadComplete never fires and the client drops at
// ~36s - BEFORE UArchonLoadManager::LoadFailed's ~60s timeout - so [LoadFailedDiag] never fires to
// name the stuck loader. This reuses the LoadFailed enumeration but (a) finds the LoadManager via
// GObjects (no hook arg) and (b) is triggered on a timer inside the connected window (see
// GameEngineTickHook). Any loader whose loaded byte (loaderobj+0x10) stays 0 is the exact gate.
// ============================================================================
static std::atomic<uint64_t> g_postLoginTimeMs{ 0 };   // GetTickCount64() at first K2_PostLogin (0 = not yet)
// [2026-07-18] Per-login budget for the [PAWN #] ClientRestart/relevancy trace. Reset to 0 at each
// K2_PostLogin so EVERY login (including travel-back returns) gets a fresh capture window — the old
// process-global budget was exhausted by the first two logins, blinding us to whether ClientRestart
// even fires on the intermittent stuck-in-Ramsgate returns.
static std::atomic<int> g_pawnDiagCount{ 0 };
// [Group B cleanup 2026-07-13] g_loadMgrDumpCount / g_clientLifecycleDumpCount removed with their dump blocks.

// SEH-guarded call to the game's FWeakObjectPtr resolver (bounds-checks ObjectIndex against GUObjectArray,
// validates the serial, returns the live UObject* or 0 if stale). Takes {ObjectIndex, ObjectSerialNumber}.
// POD-only inside __try. [2026-10-08] The comment used to name 0x026C2C10 (the 1.12 RVA) while the call used
// 0x0287AA20 (audit R10). 0x0287AA20 is the 1.14.7 resolver: a leaf after int3 padding (`mov r8d,[rcx+4];
// test r8d,r8d ...`), the same function UInteractionCalloutWidget's key refresh calls at 0x1E3EBC6.
static void* ResolveWeakObj(int32_t objectIndex, int32_t serialNumber) {
    __try {
        int32_t weak[2] = { objectIndex, serialNumber };
        using ResolveFn = void* (*)(int32_t*);
        auto fn = reinterpret_cast<ResolveFn>(Globals::BaseAddress + 0x0287AA20);
        return fn(weak);
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return nullptr;
    }
}

// Enumerate one UArchonLoadManager's registered player-data loaders.
// CORRECTED LAYOUT (2026-07-11, verified via Ghidra Complete@0x1B547D0 + resolver@0x026C2C10):
//   loader array base @ self+0x48, int32 count @ self+0x50, stride 0x10.
//   Each 16-byte entry: entry+0x00 = FWeakObjectPtr {int32 ObjectIndex, int32 ObjectSerialNumber}
//   (NOT an FName - the old hook misread this and produced the bogus "MovieScene*" mojibake that
//   seeded the false cinematic theory); entry+0x08 = IArchonPlayerDataLoader* interface pointer.
//   loaded @ iface+0x10, started @ iface+0x11, dependency count @ iface+0x20.
//   Complete() loops back to Begin and never fires while ANY loader's loaded byte is 0.
// [Group B cleanup 2026-07-13] EnumerateLoadManagerLoaders + DumpLoadManagerViaGObjects removed
// (uncalled UArchonLoadManager loader-array dump; obsolete Phase-0 readiness diagnostic).

// [Phase 0 diagnostic 2026-07-11] Read-only snapshot of the natural player-init state (server side).
// [1.14.7 SDK CORRECTION 2026-10-05] Fields: Character.PlayerRole @char+0x738; APawn.PlayerState
// @char+0x240; AArchonPlayerState.bIsActiveGameplay @PS+0x6B0 (SDK line 26170 - the +0x690 this comment
// used to name is stale and lands in Pad_658); controller readiness bOnlineDataReady @PC+0xC69 (the
// +0xC59 named here was stale as well; the code already uses the correct +0xC69).
// [Phase 0Q 2026-07-12] Cached readiness tracer. Finds PC/Char/LoadingDispatch ONCE (lazy), caches the
// pointers, then reads the readiness leaves with NO GObjects re-scan on subsequent calls. Logs each leaf
// (+0x98..+0x9E), the first false one, bIsActiveGameplay (PS+0x690), bOnlineDataReady (PC+0xC59). Server
// and client both drive it. READ-ONLY. This is the natural-readiness first-false-leaf finder.
// [readiness tracer removed 2026-07-13 — Pass 1 Step 1] g_rdPC/g_rdChar/g_rdDisp/g_rdInv +
// ReadyPtrIsClass/EnsureReadinessPtrs/LogReadinessCached deleted (obsolete Phase-0 diagnostic; crash source).
// [Group D2 cleanup 2026-07-13] g_ixnWrapperTag removed (interaction-probe correlation tag).







// [Group B cleanup 2026-07-13] DumpLifecycleState removed (obsolete Phase-0 readiness/loadout GObjects
// dump; also contained the [Phase 0e] ForceNetUpdate experiment — ForceNetUpdateEnabled cleaned in Group C).

void* OrigEncounterableSetup = nullptr;

void EncounterableSetupHook() {
    return;
}

float TotalNoPlayersTime = 0.0f;

bool EnableWatchdog = true;

void* OrigGameEngineTick = nullptr;
void* OrigInteractionCalloutHideHoldText = nullptr;
void* OrigArchonLoadingScreenFadeIn = nullptr;

static bool SanitizeNetDriverClientConnections(void* NetDriver, const char* Tag);

// [CollectionFix] The GameNetDriver is registered into the world's gameplay FLevelCollections (the engine's source of truth that
// UWorld::SetActiveLevelCollection copies into UWorld->NetDriver). Unconditional — no flag, no legacy poke.

// Per-tick idempotent registration guard (validation build; production repair moves this to the driver/world
// init point once proven stable). Registers Networking::NetDriver into the gameplay FLevelCollections
// (type 0 DynSource + type 2 Static; never demo/replay). Self-protecting: RESOLVES BY NAME FIRST and only writes
// the collection fields if the WorldContext resolver returns our driver (so SetActiveLevelCollection's re-resolve
// cannot re-null it). Never pokes World->NetDriver. Logs deferred/rejected states once per world for visibility.
static void* g_regWorld = nullptr;
static void* g_deferredWorld = nullptr;
static void* g_rejectedWorld = nullptr;
static bool RegisterNetDriverInLevelCollections() {
    if (!Globals::Listening || !Networking::NetDriver || !IsReadablePointer(Networking::NetDriver, 0x198)) return false;
    UWorld* w = UWorld::GetWorld();
    if (!w || !IsReadablePointer(w, 0x160)) return false;
    if (g_regWorld == reinterpret_cast<void*>(w)) return true;   // already registered for this world (fast path)

    void* drvWorld = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x140);  // UNetDriver::World
    uintptr_t arr = *reinterpret_cast<uintptr_t*>(reinterpret_cast<uintptr_t>(w) + 0x148);
    int32_t count = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(w) + 0x150);
    bool collectionsOk = (arr && count > 0 && count <= 8 && IsReadablePointer(reinterpret_cast<void*>(arr), static_cast<size_t>(count) * 0x78));
    // Deferred: driver not yet bound to this world, or collections not ready (e.g. mid-travel). Do NOT poke World->NetDriver.
    if (drvWorld != reinterpret_cast<void*>(w) || !collectionsOk) {
        if (g_deferredWorld != reinterpret_cast<void*>(w)) {
            g_deferredWorld = reinterpret_cast<void*>(w);
            MpLog("[CollectionFix] registration deferred: world=" + MpPtr(w) + " driverWorld=" + MpPtr(drvWorld)
                + " collections=" + (collectionsOk ? ("n=" + std::to_string(count)) : std::string("unavailable")));
        }
        return false;
    }
    // RESOLVE FIRST (self-protect): the WorldContext by-name resolver must return our driver before touching any field.
    void* gengine = IsReadablePointer(reinterpret_cast<void*>(Globals::BaseAddress + 0x06FC3CE8), 8)
        ? *reinterpret_cast<void**>(Globals::BaseAddress + 0x06FC3CE8) : nullptr;
    uint64_t nm = *reinterpret_cast<uint64_t*>(reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x190);  // NetDriverName
    // [1.14.7 ROOT-CAUSE FIX 2026-10-04] This called the WRONG overload: RVA 0x04266770 is the
    // PendingNetGame lookup (it compares the context field at +0x1A0, which the SDK documents as
    // PendingNetGame), while the argument here is a UWorld. The UWorld overload is RVA 0x042667F0 - it
    // compares context+0x280, the same FWorldContext::World offset ResolveWorldContextFromWorld uses in
    // reverse. Because the wrong overload never matched, the lookup returned null, registration was refused
    // ("registration REJECTED (driver not in WorldContext; would re-null) ... byNameResolve=null"), the level
    // collections were never populated, and UWorld::SetActiveLevelCollection (RVA 0x042D9740) then copied a
    // null driver into World->NetDriver - overwriting the one-time assignment Networking::Listen makes.
    //
    // That null is the dispatch fault: the native caller loads the world's network-notify interface from
    // NetDriver+0x208, and that interface lives at UWorld+0x28, so its +0x10 field IS UWorld::NetDriver
    // (UWorld+0x38). Measured: rcx=0x23437DF19F8 and rcx-0x28=0x23437DF19D0, which is exactly the world
    // address the runtime had logged. So the fault was never a destroyed UObject - it was a null world driver.
    void* reResolve = (gengine && IsReadablePointer(gengine, 0xC48))
        ? reinterpret_cast<void* (*)(void*, void*, uint64_t)>(Globals::BaseAddress + 0x042667F0)(gengine, w, nm) : nullptr;
    if (reResolve != reinterpret_cast<void*>(Networking::NetDriver)) {
        if (g_rejectedWorld != reinterpret_cast<void*>(w)) {
            g_rejectedWorld = reinterpret_cast<void*>(w);
            MpLog("[CollectionFix] registration REJECTED (driver not in WorldContext; would re-null): world=" + MpPtr(w)
                + " byNameResolve=" + MpPtr(reResolve) + " driver=" + MpPtr(Networking::NetDriver) + " — NOT writing collections");
        }
        return false;   // retry next tick; if this persists, context registration is required before the collection write
    }
    // Verified -> safe to write the collection source-of-truth.
    int populated = 0;
    for (int i = 0; i < count; ++i) {
        uintptr_t c = arr + static_cast<uintptr_t>(i) * 0x78;
        uint8_t type = *reinterpret_cast<uint8_t*>(c + 0x00);
        if (type == 0 || type == 2) {   // DynSource + Static gameplay collections only
            *reinterpret_cast<void**>(c + 0x10) = reinterpret_cast<void*>(Networking::NetDriver);  // FLevelCollection::NetDriver
            ++populated;
        }
    }
    g_regWorld = reinterpret_cast<void*>(w);
    MpLog("[CollectionFix] set driver on " + std::to_string(populated) + " gameplay collection(s) world=" + MpPtr(w)
        + " driver=" + MpPtr(Networking::NetDriver) + " byNameResolve=" + MpPtr(reResolve) + " resolveMatches=Y");
    return true;
}

static void SanitizeNetDriverBeforeEngineTick() {
    if (!Globals::Listening || !Networking::NetDriver || !IsReadablePointer(Networking::NetDriver, 0x2B0)) {
        return;
    }

    UWorld* World = UWorld::GetWorld();
    if (!World || !IsReadablePointer(World, 0x40)) {
        return;
    }

    static FName GameNetDriverName = FName();
    static bool GameNetDriverNameInit = false;

    if (!GameNetDriverNameInit) {
        GameNetDriverName = UKismetStringLibrary::Conv_StringToName(L"GameNetDriver");
        GameNetDriverNameInit = true;
    }

    // Register the GameNetDriver into the gameplay FLevelCollections (the source UWorld::SetActiveLevelCollection
    // copies into UWorld->NetDriver); the engine then propagates it. Idempotent per world; we never poke
    // World->NetDriver directly. This is the ONLY supported path (no COLLECTION_FIX flag, no legacy fallback).
    RegisterNetDriverInLevelCollections();
    Networking::NetDriver->World = World;
    Networking::NetDriver->NetDriverName = GameNetDriverName;
    Networking::NetDriver->ServerConnection = nullptr;
}

// [Group D cleanup 2026-07-13] SnapWorldDriver ([WorldDriverTransition] stage monitor) removed —
// read-only diagnostic that localized the driver-null transition; root fixed by the collection registration (item 2).

static bool NativeNetTick();  // [fwd] NATIVE_NET_TICK.flag A/B — defined below; gates the manual dispatch/flush

// A native net-tick exception can become persistent once a connection enters a bad teardown state.
// Logging it every engine frame creates megabytes of I/O and can itself stall the game thread. Preserve
// the first failure, emit one aggregate every 30 seconds, and report recovery once. The SEH filters still
// retain the bounded exception record/stack evidence used for root-cause analysis.
struct ManualNetTickFailureState {
    bool Active = false;
    uint64_t LastReportMs = 0;
    uint64_t FailuresSinceReport = 0;
};

static ManualNetTickFailureState g_TickDispatchFailureState;
static ManualNetTickFailureState g_TickFlushFailureState;

static void ReportManualNetTickFailure(bool IsFlush, uint64_t Tick) {
    ManualNetTickFailureState& State = IsFlush ? g_TickFlushFailureState : g_TickDispatchFailureState;
    const char* Phase = IsFlush ? "TickFlush" : "TickDispatch";
    const uint64_t NowMs = GetTickCount64();
    ++State.FailuresSinceReport;

    if (!State.Active) {
        State.Active = true;
        State.LastReportMs = NowMs;
        MpLog("[NetTickFault] " + std::string(Phase) + " first exception at tick=" + std::to_string(Tick)
            + "; repeated failures will be summarized every 30s");
        State.FailuresSinceReport = 0;
        return;
    }

    if (NowMs - State.LastReportMs >= 30000) {
        MpLog("[NetTickFault] " + std::string(Phase) + " still failing at tick=" + std::to_string(Tick)
            + " failuresSinceLast=" + std::to_string(State.FailuresSinceReport));
        State.LastReportMs = NowMs;
        State.FailuresSinceReport = 0;
    }
}

static void ReportManualNetTickRecovery(bool IsFlush, uint64_t Tick) {
    ManualNetTickFailureState& State = IsFlush ? g_TickFlushFailureState : g_TickDispatchFailureState;
    if (!State.Active) return;

    const char* Phase = IsFlush ? "TickFlush" : "TickDispatch";
    MpLog("[NetTickFault] " + std::string(Phase) + " recovered at tick=" + std::to_string(Tick)
        + " unreportedFailures=" + std::to_string(State.FailuresSinceReport));
    State = {};
}

static int TickDispatchExceptionFilter(unsigned int Code, EXCEPTION_POINTERS* ExceptionInfo) {
    if (ExceptionInfo && IsReadablePointer(ExceptionInfo, sizeof(EXCEPTION_POINTERS)) &&
        IsReadablePointer(ExceptionInfo->ExceptionRecord, sizeof(EXCEPTION_RECORD))) {
        LogExceptionRecord(
            "ManualTickDispatchSEH",
            ExceptionInfo->ExceptionRecord,
            IsReadablePointer(ExceptionInfo->ContextRecord, sizeof(CONTEXT)) ? ExceptionInfo->ContextRecord : nullptr);
    }
    else {
        EXCEPTION_RECORD Record{};
        Record.ExceptionCode = Code;
        Record.ExceptionAddress = _ReturnAddress();
        LogExceptionRecord("ManualTickDispatchSEH", &Record, nullptr);
    }

    return EXCEPTION_EXECUTE_HANDLER;
}

// [1.14.7 FIX] The UGameEngine captured by GameEngineTickHook; the manual tick needs it as its first
// argument (see the note at the hook definition). Declared here because this function is defined earlier.
static void* g_GameEnginePtr = nullptr;

// [1.14.7 FIX 2026-10-04] Reentrancy guard. The manual dispatch drives the world/net path, which can route
// back into this same function (the engine tick path re-enters the net tick). Without a guard that recursion
// is unbounded, and the observed failure is exactly a stack-exhaustion signature rather than a bad pointer:
//   ManualTickDispatchSEH code=0xC0000005 address=ucrtbase.dll+0xD8AE params=0x0,0xFFFFFFFFFFFFFFFF
// and the bytes at that address are
//   66 0F 7F 85 F0 03 00 00   movdqa [rbp+0x3F0], xmm0
// i.e. a CRT routine writing a large stack frame and faulting on the frame itself. (The earlier [0+0x88]
// fault at 0x42CE8B6 is gone - the multi-world UWorld::NetDriver poke fixed it, guardSkips stayed 0.)
// Re-entering is never useful here, so the nested call simply returns.
static thread_local int s_manualTickDepth = 0;

// Set while the manual dispatch is running, so a re-entrant tick cannot recurse (see the call site in
// GameEngineTickHook). The guard lives there because this function uses __try, which forbids objects
// requiring unwinding.
static thread_local bool s_inManualTick = false;

static bool SafeManualTickDispatch(UNetDriver* NetDriver, float DeltaTime) {
    // [NATIVE_NET_TICK A/B] skip the manual (double) drive — native engine tick owns TickDispatch.
    // (No logging here: this function uses __try, which forbids objects requiring unwinding. The
    //  one-time mode banner is emitted from NativeNetTick()'s cache init instead.)
    if (NativeNetTick()) return true;
    using TickDispatchFn = void(*)(UNetDriver*, float);

    // [1.14.7 2026-10-04] REVERTED: passing the UGameEngine as the first argument is WRONG. Measured with
    // the engine pointer captured from GameEngineTickHook and used here:
    //   ManualTickDispatchSEH code=0xC0000005 address=exe+0x39F9A70 params=0x0,0x500000015
    //   [NetTickFault] TickDispatch first exception at tick=2
    //   recvfrom: 0  sendto: 0  fatal=1   (the hub crash-looped, one restart per minute)
    // i.e. it faults immediately and does not even read the socket, whereas passing the NetDriver reads it
    // (recvfrom <- 127.0.0.1:52155 len=29) before faulting at [0+0x88]. So NetDriver IS the correct first
    // argument and the [0+0x88] fault is a separate, still-open defect. No logging here - this function uses
    // __try, which forbids objects requiring unwinding (see the note above).
    void* TickTarget = reinterpret_cast<void*>(NetDriver);

    __try {
        // [1.14.7 2026-10-04] I changed this to 0x03FAE420 (FUN_143fae420, the address hooked as
        // NetDriverTickDispatchInner) on the theory that 0x00A82CF0 was a stale 1.12 RVA. That was WRONG and
        // the measurements say so:
        //   with 0x00A82CF0 : hub reads  -> "recvfrom <- 127.0.0.1:52155 len=29"  (then faults, see below)
        //   with 0x03FAE420 : hub reads  -> nothing at all (recvfrom: 0, SEH faults: 0)
        // So 0x00A82CF0 IS the working dispatch entry and it is restored here. The real defect is that the
        // dispatch then faults at exe+0x42CE8C1 with 0xC0000005, which the SEH filter absorbs
        // ("[ManualTickDispatchSEH] code=0xC0000005", "[NetTickFault] TickDispatch recovered at tick=N").
        // That fault - not the address - is what the earlier double-drive A/B recorded as "NetDriver
        // corruption", and it is the remaining blocker for the travel handshake.
        reinterpret_cast<void(*)(void*, float)>(Globals::BaseAddress + 0x00A82CF0)(TickTarget, DeltaTime);
        return true;
    }
    __except (TickDispatchExceptionFilter(GetExceptionCode(), GetExceptionInformation())) {
        return false;
    }
}

// [1.12.0] UNetDriver::TickFlush at RVA 0x03D91DC0. Send-side counterpart to TickDispatch.
// Confirmed via Ghidra decompile of FUN_143d91dc0 (vtable slot right after TickDispatch and
// PostTickDispatch on UIpNetDriver's vtable at 0x144E0AF98):
//   - Same signature as TickDispatch: void __fastcall(UNetDriver* this, float DeltaSeconds)
//   - Walks ClientConnections at this[0x12] (Num at [0x13])
//   - Calls UNetConnection::Tick(DeltaSeconds) on each (vtable slot +0x2C8)
//   - Invokes ServerReplicateActors via this[0x21] (World) and driver vtable +0x2A8
//   - Manipulates per-connection bytes-sent stats at conn+0x4C4..+0x4D0 (only meaningful
//     on the send path). This is the flush that emits queued replication + ACKs.
//
// Why we call it here: our custom net-tick path in GameEngineTickHook calls TickDispatch
// (receive) but nothing was calling TickFlush (send). That's why the server sees InSeq
// climbing but NextOutGoingSeq frozen; NMT_Welcome, pawn replication, and the "clear the
// loading screen" chain sit queued and never leave the box.
static int TickFlushExceptionFilter(unsigned int Code, EXCEPTION_POINTERS* ExceptionInfo) {
    if (ExceptionInfo && IsReadablePointer(ExceptionInfo, sizeof(EXCEPTION_POINTERS)) &&
        IsReadablePointer(ExceptionInfo->ExceptionRecord, sizeof(EXCEPTION_RECORD))) {
        LogExceptionRecord(
            "ManualTickFlushSEH",
            ExceptionInfo->ExceptionRecord,
            IsReadablePointer(ExceptionInfo->ContextRecord, sizeof(CONTEXT)) ? ExceptionInfo->ContextRecord : nullptr);
    }
    else {
        EXCEPTION_RECORD Record{};
        Record.ExceptionCode = Code;
        Record.ExceptionAddress = _ReturnAddress();
        LogExceptionRecord("ManualTickFlushSEH", &Record, nullptr);
    }
    return EXCEPTION_EXECUTE_HANDLER;
}

static bool SafeManualTickFlush(UNetDriver* NetDriver, float DeltaTime) {
    // [NATIVE_NET_TICK A/B] skip the manual (double) drive — native engine tick owns TickFlush -> ServerReplicateActors.
    if (NativeNetTick()) return true;
    using TickFlushFn = void(*)(UNetDriver*, float);

    __try {
        reinterpret_cast<TickFlushFn>(Globals::BaseAddress + 0x03FAE700)(NetDriver, DeltaTime);
        return true;
    }
    __except (TickFlushExceptionFilter(GetExceptionCode(), GetExceptionInformation())) {
        return false;
    }
}

// [2026-07-18 double-drive A/B] NATIVE_NET_TICK.flag — the network path is currently driven TWICE per
// frame: the native UGameEngine::Tick (OrigGameEngineTick) drives UWorld::Tick -> UNetDriver::TickDispatch/
// TickFlush now that the NetDriver is registered in the world/level collections, AND the DLL calls
// SafeManualTickDispatch + SafeManualTickFlush again immediately afterward. Both funnel through the hooked
// vtable slot +0x2A8 (ServerReplicateActorsHook, ArchonDirect), so ServerReplicateActors runs ~2x per frame
// -> the [SRA enter] log shows ~60Hz while NetServerMaxTickRate=30. Double-driving the graph during rapidly
// changing actor state (travel / possession / disconnect) is the strongest remaining desync/lifecycle
// suspect (ServerMove TimeStamp expired, stretched proxies, higher churn-failure probability).
//
// When this flag is present next to the game .exe, the manual TickDispatch + TickFlush are SKIPPED, leaving
// the native engine tick as the SOLE driver -> the graph is invoked ONCE per network frame (expected
// [SRA enter] ~30Hz). CONFIRMATION SIGNAL: enable REPGRAPH_DIAG.flag too and watch [SRA enter] SRA=..Hz:
//   ~30Hz  => native tick drives the net driver; manual calls were redundant (KEEP this on, promote later).
//   ~0Hz / no [SRA enter] => native tick does NOT drive TickFlush here; manual calls were load-bearing
//                            -> remove the flag (replication is broken in this mode).
// Default OFF (absent flag = current double-drive behaviour). Opt-in + reversible: deploying the DLL alone
// changes nothing until the flag is dropped and the server restarted. Read once (cached) — set before launch.
/*
 * [2026-07-19] MANUAL_TICK_ZERO_DT.flag — *** BROKEN. DO NOT ENABLE. ***
 *
 * TESTED AND FAILED: with this flag the server becomes unjoinable. Verified A/B on port 8790:
 *     WITH    (22:58, pid 1308): connCount -2 -> 0 at startup, then NOTHING. No client ever connects.
 *     WITHOUT (23:02, pid 4284): connCount 0 -> 1 @ 23:03:10, PostLoginPE#0 @ 23:03:12. Joins fine.
 *
 * WHY: UNetDriver::TickDispatch(DeltaSeconds) does not merely accumulate a clock — it drives
 * UNetConnection::Tick(DeltaSeconds), which runs the connection handshake state machine and its
 * timers. DeltaTime=0 freezes those timers, so the handshake never completes. The parameter is
 * load-bearing for connection progression, not just timekeeping.
 *
 * The surgical replacement (NOT yet implemented) is to let TickDispatch run with the REAL DeltaTime
 * and instead save/restore UNetDriver::Time (+0x210) around the manual call, removing only the double
 * clock advance. DO NOT build that until the underlying assumption is confirmed in Ghidra: that this
 * build's TickDispatch actually accumulates Time from DeltaSeconds. Two flags have now been shipped on
 * unverified assumptions (NATIVE_NET_TICK, this one) and both broke joining.
 *
 * Original rationale retained below for context.
 *
 * [2026-07-19] MANUAL_TICK_ZERO_DT.flag — beam/orbit visual desync A/B.
 *
 * BACKGROUND: NATIVE_NET_TICK.flag was the intended A/B for the double-drive, but it was tried and the
 * server became unjoinable — i.e. the documented "~0Hz / no [SRA enter] => manual calls were load-bearing"
 * branch. The native engine tick does NOT drive TickFlush on this setup, so the manual calls cannot simply
 * be removed. That flag is therefore a dead end for this investigation and must NOT be promoted.
 *
 * SYMPTOM THIS TARGETS: some behemoth abilities render wrong — Valomyr's orbiting orbs fire beams that
 * start from displaced positions, clip into terrain, or draw only partially. Gameplay/damage is correct.
 * Critically it is SELECTIVE: only some abilities on some behemoths. A globally corrupted replication
 * path would degrade everything equally, so a global explanation does not fit.
 *
 * MECHANISM: the affected visuals are the ones derived from ELAPSED TIME rather than from a replicated
 * transform:
 *     UOrbitingProjectileComponent : float SpawnTime, float NormalizedElapsedTime
 *                                    GetNormalizedTimeElapsed(), UpdateParticlePosition_Native(...)
 *     UProjectileBehavior_BeamBase : FVector StartPos / OwnerPos / CurrentEndPoint  (computed locally)
 * The orb's orbit phase comes from elapsed time; the beam's origin is inherited from the orb. Montage
 * melee, simple projectiles and AoEs do not integrate elapsed time client-side — and those look fine.
 *
 * UNetDriver::TickDispatch(DeltaSeconds) advances the driver's ElapsedTime (the network clock used for
 * client/server time sync). The manual call passes the SAME DeltaTime the native tick already consumed:
 *     SafeManualTickDispatch(NetDriver, DeltaTime);   // second time, same value
 * so that clock plausibly runs at ~2x real time, and anything phase-derived resolves to the wrong point.
 *
 * WHAT THIS FLAG DOES: passes 0.0f as DeltaTime to the MANUAL TickDispatch only. The call still happens,
 * so replication keeps running and the server stays joinable — unlike NATIVE_NET_TICK.flag. Only the
 * double clock advance is removed. TickFlush keeps its real DeltaTime because it drives bandwidth/
 * throttling, not the clock.
 *
 * *** UNVERIFIED ASSUMPTION: that this build's TickDispatch accumulates ElapsedTime from DeltaSeconds.
 * That is standard UE behaviour and matches the symptom, but it has NOT been confirmed in Ghidra for this
 * binary. If this flag changes nothing, verify that before pursuing the time-base theory further. ***
 *
 * Default OFF. Read once, cached — set before launch.
 */
static bool ManualTickZeroDeltaTime() {
    static int c = -1;
    if (c < 0) {
        c = MpExeRelativeFlagPresent(L"MANUAL_TICK_ZERO_DT.flag") ? 1 : 0;
        MpLog(std::string("[ManualTickDT] MANUAL_TICK_ZERO_DT.flag ")
            + (c ? "PRESENT -> *** BROKEN: server will be UNJOINABLE (handshake timers frozen). REMOVE THIS FLAG. *** "
                   "Replication still runs; server stays joinable. Watch whether orbit/beam visuals correct "
                   "themselves while everything else is unchanged."
                 : "absent -> manual TickDispatch gets the real DeltaTime (default; clock may double-advance)."));
    }
    return c == 1;
}

/*
 * [2026-07-19] MANUAL_TICK_HALF_RATE.flag — rate-parity A/B (alternative to the clock fix above).
 *
 * Runs the manual TickDispatch/TickFlush pair on every OTHER engine frame, so ServerReplicateActors is
 * invoked about once per network frame (~30Hz, matching NetServerMaxTickRate) instead of ~60Hz.
 *
 * This is a DIFFERENT hypothesis from MANUAL_TICK_ZERO_DT: it assumes the problem is replication
 * FREQUENCY rather than the clock. Note the cost — halving the manual drive also halves the effective
 * player-pawn replication rate, which works against the deliberate PlayerRepBoost smoothness fix. Prefer
 * the zero-DT flag first; use this only to test the frequency theory.
 *
 * Do NOT enable both at once — you would not know which one moved the needle.
 * Default OFF.
 */
static bool ManualTickHalfRate() {
    static int c = -1;
    if (c < 0) {
        c = MpExeRelativeFlagPresent(L"MANUAL_TICK_HALF_RATE.flag") ? 1 : 0;
        MpLog(std::string("[ManualTickRate] MANUAL_TICK_HALF_RATE.flag ")
            + (c ? "PRESENT -> manual TickDispatch/TickFlush run every OTHER frame (~30Hz SRA, matches "
                   "NetServerMaxTickRate). NOTE: also halves player-pawn replication rate."
                 : "absent -> manual drive runs every frame (default)."));
    }
    return c == 1;
}

static bool NativeNetTick() {
    static int c = -1;
    if (c < 0) {
        // [1.14.7 ROOT FIX 2026-10-03] Default is now NATIVE-ONLY (manual drive skipped).
        //
        // Ghidra: FUN_143fae420 is UNetDriver::TickDispatch (its own "Very long time between
        // ticks" string) and FUN_143fae700 is UNetDriver::TickFlush (it dispatches vtable
        // +0x2A8, ServerReplicateActors). GameEngineTickHook still calls the engine tick
        // (OrigGameEngineTick), which already drives UWorld::Tick -> TickDispatch/TickFlush,
        // so the manual path in this file drove the network path TWICE per frame.
        //
        // Controlled A/B on this machine (same build, same maps, only this flag differed):
        //   double drive ENABLED : both hubs logged "resetting invalid ClientConnections" and
        //                          "resetting invalid cleanup array" ~60-90s in, then died
        //                          (Ramsgate exit 3 after "Fatal error ... RemoveFromHash
        //                          NumRemoved = 0"; Training exit 0xC0000005).
        //   double drive DISABLED: both hubs stayed alive past 3 minutes with zero corruption
        //                          events and no fatal.
        // UNetDriver is byte-identical between the 1.12.0 and 1.14.7 SDK dumps and this
        // corruption never appears in the archived 1.12-era logs, so this is a 1.14.7-specific
        // regression caused by driving the net path twice.
        //
        // NATIVE_NET_TICK.flag (legacy) and MANUAL_NET_TICK.flag (new) are both honoured:
        // native-only is the default; MANUAL_NET_TICK.flag re-enables the legacy double drive
        // for A/B only and logs loudly.
        const bool LegacyNativeFlag = MpExeRelativeFlagPresent(L"NATIVE_NET_TICK.flag");
        const bool ManualOverride = MpExeRelativeFlagPresent(L"MANUAL_NET_TICK.flag");
        // [1.14.7 FIX 2026-10-04] Default flipped back to the MANUAL drive. The native-only default rested on
        // "the NetDriver is registered in the world/level collections, so the engine tick drives it", but this
        // build proves otherwise:
        //   [CollectionFix] registration REJECTED (driver not in WorldContext; would re-null)
        // so the engine never dispatches our named driver. With the manual path skipped NOTHING ticked it and
        // its socket was never read - measured with the socket diagnostics:
        //   client: sendto -> 127.0.0.1:8790 len=29   (once a second for the whole 20s window)
        //   hub:    zero recvfrom / WSARecvFrom / WSARecv calls
        // Enabling the manual drive made the hub read immediately: recvfrom <- 127.0.0.1:52155 len=29.
        // The crashes the earlier A/B blamed on double-driving were the stale TickDispatch RVA (0x00A82CF0),
        // now corrected to the verified 0x03FAE420 - not the double drive itself.
        // NATIVE_NET_TICK.flag still forces the old native-only behaviour for A/B.
        c = (LegacyNativeFlag || ManualOverride) ? 1 : 0;

        // [1.14.7 ROLE GATE 2026-10-04] The manual drive is for the MANAGED HUBS ONLY.
        //
        // Why it is needed there: the hub's named driver is not in the world context
        // ("[CollectionFix] registration REJECTED (driver not in WorldContext; would re-null)"), so the engine
        // never dispatches it and its socket is never read - measured: the client sent
        // "sendto -> 127.0.0.1:8790 len=29" once a second for 20s while the hub made zero receive calls.
        //
        // Why the CLIENT must not have it: a game client's driver IS engine-registered and IS ticked by the
        // engine, so driving it again would double-tick it. When the manual drive was enabled for both roles,
        // the client stopped reaching matchmaking entirely - it parked on the main menu with
        // OnPlayScreenPollTimer repeating and the backend saw no /candidate/join at all, where before it
        // travelled a few seconds after press-to-start.
        //
        // So: server role -> manual drive (unless NATIVE_NET_TICK.flag); client role -> always native.
        if (!Globals::AmServer) {
            c = 1;
        }

        // [1.14.7 FIX 2026-10-04] Native-only for the SERVER too, now that Networking::Listen points
        // UWorld::NetDriver (+0x38) at our named driver. The engine tick therefore dispatches OUR driver
        // exactly once, so the manual drive is no longer needed - and removing it also removes the null+0x88
        // fault it caused (a second engine tick per frame running in a state the first one never created:
        // "[ManualTickDispatchSEH] code=0xC0000005 ... params=0x0,0x88 regs{rax=0x0}").
        // NATIVE_NET_TICK.flag / MANUAL_NET_TICK.flag still override either way for A/B.
        // [1.14.7 2026-10-04] Round-20 forced native here on the theory that pointing UWorld::NetDriver at
        // our driver would make the engine tick dispatch it. Measured since: the engine NEVER calls
        // TickDispatch on it (instrumented counter: "TickDispatchInner call lines: 0"), so the server needs
        // the manual drive after all - now with the real UGameEngine as its first argument instead of the
        // net driver, which is what removes the [0+0x88] fault.
        // [2026-10-08] The message now reports the real reason. The old DISABLED text claimed
        // "MANUAL_NET_TICK.flag present ... expect NetDriver corruption" on every hub boot, although the
        // manual hub drive is the intended server default and no flag was installed.
        std::string Reason;
        if (!Globals::AmServer) {
            Reason = "ACTIVE: client role, the engine ticks its own registered driver.";
        } else if (c) {
            Reason = std::string("ACTIVE (A/B override: ")
                + (LegacyNativeFlag ? "NATIVE_NET_TICK.flag" : "MANUAL_NET_TICK.flag")
                + " present): manual TickDispatch/TickFlush SKIPPED on the server.";
        } else {
            Reason = "OFF (server default): the hub's named driver is not engine-registered, so the module "
                     "drives TickDispatch/TickFlush manually.";
        }
        MpLog("[NativeNetTick] native-only net tick " + Reason);
    }
    return c == 1;
}

// [Group D cleanup 2026-07-13] DriverWriteWatch cluster removed (g_dww*, DriverWriteVEH, DriverWriteArmThread,
// MaybeArmDriverWriteWatch) — flag-gated (DRIVER_WRITE_WATCH.flag) hardware-watchpoint diagnostic; root fixed by item 2.

// [Group E2 cleanup 2026-07-13] DumpLevelCollectionsOnce removed — read-only [LevelCollections] dump used
// to confirm the collection.NetDriver==null root; superseded by the collection-registration fix (item 2).

static bool PlayerRepBoost();  // [fwd] defined with the replication helpers below; used in GameEngineTickHook
static void MpReportReplicationMembership();  // [fwd] 1.14.7 client-replication membership probe
static void MpRouteBaseActorsToConnections(); // [fwd] 1.14.7 client PlayerState/GameState route fix
static void MpDriveReplicationGraph(float DeltaTime);  // [fwd] 1.14.7 replication-graph drive
static void DropStalePlayerControllerChannelQuarantine();  // [fwd] stale PC channel quarantine entries

// [2026-07-20] FORCE_SERVER_MESH_POSE.flag — dedicated-server skeletal pose/socket fix.
// See Progress/02_NETWORK_REPLICATION.md. HYPOTHESIS: on the -nullrhi dedicated server, skeletal meshes
// whose VisibilityBasedAnimTickOption (+0x5FC) is OnlyTickPoseWhenRendered(3) / OnlyTickMontagesWhenNot
// Rendered(2) never refresh bone/socket world transforms (the server never renders), so socket-anchored
// VFX/projectile origins (Valomyr's orbiting orbs + their beams, etc.) collapse to the reference pose
// (~actor origin, ground level) and that wrong transform replicates to clients -> flat, ground-hugging
// beams. Forcing AlwaysTickPoseAndRefreshBones(0) makes bone transforms valid server-side.
//
// [2026-07-21 correctness fix] Two bugs found during a Rezakiri/Valomyr log review (verified before
// fixing, not assumed):
//   1. Only handled enum values 2/3. AlwaysTickPose(1) still gates BONE/SOCKET refresh behind rendering
//      per the SDK's own enum comment ("Always Tick Pose" only guarantees the pose graph runs, not that
//      bones are refreshed when unrendered) - a behemoth mesh sitting at 1 was silently left untouched
//      and never logged, i.e. exactly the failure mode this function exists to rule out.
//   2. Logging was conditional on the value CHANGING, capped at 60 lines total across every scanned
//      mesh. A mesh already at 0 (or, per bug 1, sitting at 1) produced NO log line at all - so an
//      absent [ForceServerMeshPose] line for a given behemoth proved nothing: skipped-by-the-value-1-gap,
//      already-fine, or simply crowded out of the 60-line cap by unrelated meshes (player characters,
//      weapons, props) all look identical from the outside: silence. Now every qualifying mesh's CURRENT
//      value is logged on every pass, unconditionally, whether or not it needed changing, so a specific
//      behemoth's mesh can be grepped for by name and its state is never ambiguous.
//
// STILL NOT DONE (do not guess this blind): scoping to only the active behemoth's mesh instead of every
// USkeletalMeshComponent in GObjects. That needs a verified UActorComponent "Owner"/Outer field offset
// or a native GetOwner() call site from Ghidra - this SDK dump does not expose Owner as a named field
// (private, non-reflected), and guessing a raw pointer offset in a live server patch is how you crash
// the process reading garbage memory. Left as a follow-up requiring that offset first.
//
// SELF-VERIFYING: logs every mesh's value and full name on every pass, so even if this is NOT the
// cause we learn the actual server-side setting. GAME-THREAD ONLY (GObjects walk + IsA/GetName are safe
// here, like GameModeEmptyState); throttled; server-only (client meshes render and should keep their
// render-gated option for perf). Default OFF; opt-in + reversible.
static void ForceServerMeshPose() {
    if (!MpExeRelativeFlagPresent(L"FORCE_SERVER_MESH_POSE.flag")) return;

    // [2026-07-26 REPRO CLEANUP] The VPS still had this old diagnostic flag enabled during
    // "texture issue can walk". Every four seconds it walked up to 138,948 UObjects and flushed
    // ~21 log lines, but changed exactly zero meshes. The reason is deterministic:
    // IsReadablePointer requires an 8-byte-aligned address while VisibilityBasedAnimTickOption is
    // at Obj+0x5FC (4-byte misaligned), so the old gate rejects every valid field before the write.
    //
    // Do not silently turn the write on now: forcing AlwaysTickPoseAndRefreshBones for every server
    // mesh is a separate high-CPU experiment and is not a justified fix for a client-side remote
    // pawn/PlayerRole lifetime bug. Existing FORCE_SERVER_MESH_POSE.flag deployments therefore
    // become inert. Requiring a second deliberately named flag preserves the old experiment for
    // a controlled future test without letting a forgotten flag contaminate normal server timing.
    if (!MpExeRelativeFlagPresent(L"FORCE_SERVER_MESH_POSE_UNSAFE.flag")) {
        static bool s_loggedRetired = false;
        if (!s_loggedRetired) {
            s_loggedRetired = true;
            MpLog("[ForceServerMeshPose] retired nonfunctional diagnostic; "
                "remove FORCE_SERVER_MESH_POSE.flag (unsafe experiment now also requires "
                "FORCE_SERVER_MESH_POSE_UNSAFE.flag)");
        }
        return;
    }
    if (!SDK::UObject::GObjects) return;

    static uint64_t s_lastMs = 0;
    uint64_t now = GetTickCount64();
    if (s_lastMs != 0 && now - s_lastMs < 4000) return;   // throttle the full GObjects walk
    s_lastMs = now;

    SDK::UClass* MeshClass = SDK::USkeletalMeshComponent::StaticClass();
    if (!MeshClass) {
        MpLog("[ForceServerMeshPose] pass: USkeletalMeshComponent::StaticClass() returned null - class lookup failed");
        return;
    }

    const int Count = SDK::UObject::GObjects->Num();
    // [2026-07-21 diagnostic split] A live VPS repro (Ramsgate AND a hunt, 1h43m, hundreds of passes)
    // reported "scanned 0" every single time, including in Ramsgate where player character meshes are
    // always present - so the zero cannot be "no meshes existed this pass", something upstream of the
    // old single `scanned` counter is failing silently. Split into distinct stages so the NEXT capture
    // proves exactly where: does IsA(MeshClass) ever match anything at all (matched), and of those, does
    // the +0x5FC read fail (unreadable)? Previously `scanned` only incremented AFTER the pointer-read
    // check passed, so "scanned 0" was ambiguous between "IsA never matched" and "IsA matched but the
    // offset read always failed" - exactly the same class of silent-failure bug already fixed once for
    // the value-change logging, now applied to the scan itself.
    int walked = 0, matched = 0, unreadable = 0, changed = 0, logged = 0;
    const int LogCap = 500;   // generous - this is an opt-in diagnostic pass, not a hot path
    const int NameSampleCap = 20;   // sample of matched objects' names even when unreadable, to confirm identity
    int nameSampled = 0;
    for (int i = 0; i < Count; i++) {
        SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
        if (!Obj || Obj->IsDefaultObject()) continue;
        ++walked;
        if (!Obj->IsA(MeshClass)) continue;
        ++matched;

        uint8_t* opt = reinterpret_cast<uint8_t*>(reinterpret_cast<uintptr_t>(Obj) + 0x5FC);
        // IsReadablePointer intentionally requires its starting pointer to be 8-byte aligned.
        // Validate from the aligned UObject base through the field instead of passing Obj+0x5FC.
        if (!IsReadablePointer(Obj, 0x5FD)) {
            ++unreadable;
            if (nameSampled < NameSampleCap) {
                ++nameSampled;
                MpLog("[ForceServerMeshPose] MATCHED-BUT-UNREADABLE " + Obj->GetFullName() + " ptr=" + MpPtr(opt));
            }
            continue;
        }

        uint8_t oldVal = *opt;
        bool willChange = (oldVal == 1 || oldVal == 2 || oldVal == 3);   // any render-gated variant
        if (willChange) {
            *opt = 0;                                       // AlwaysTickPoseAndRefreshBones
            ++changed;
        }
        if (logged < LogCap) {
            ++logged;
            MpLog("[ForceServerMeshPose] " + Obj->GetFullName()
                + " VisibilityBasedAnimTickOption " + std::to_string(oldVal)
                + (willChange ? " -> 0 (forced)" : " (already 0, no change)"));
        }
    }
    MpLog("[ForceServerMeshPose] pass walked " + std::to_string(walked) + " object(s), IsA-matched "
        + std::to_string(matched) + ", unreadable " + std::to_string(unreadable) + ", changed "
        + std::to_string(changed) + ", logged " + std::to_string(logged));
}

// [2026-07-20 TRIALS GRACE DIAG] Confirm the downed self-revive window in Trials. Gated by
// TRIALS_GRACE_DIAG.flag. Reads AArchonPlayerState.BleedoutState(+0x3AC) / BleedoutTimerLength(+0x3B0) /
// BleedoutTimeRemaining(+0x3B4) from GameState.PlayerArray, so we can see the grace length the game assigns
// (timerLen) and watch it count down (timeRemaining) versus when the match ends. This distinguishes:
//   (a) short self-revive window  -> timerLen itself is ~3-4s
//   (b) solo wipe ends match early -> timerLen is ~normal (~30s) but the match ends with lots remaining
// UWorld.GameState @ +0x120; AGameStateBase.PlayerArray data @ +0x238, Num @ +0x240. Read-only, no behavior
// change. Server-only, throttled by the caller.
static void SampleBleedoutGrace() {
    UWorld* w = *reinterpret_cast<UWorld**>(Globals::BaseAddress + 0x06FC7F58);
    if (!w || !IsReadablePointer(w, 0x128)) return;
    void* gs = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(w) + 0x120);
    if (!gs || !IsReadablePointer(gs, 0x248)) return;
    void** psData = *reinterpret_cast<void***>(reinterpret_cast<uintptr_t>(gs) + 0x238);
    int psNum = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(gs) + 0x240);
    if (!psData || psNum <= 0 || psNum > 64 || !IsReadablePointer(psData, 8)) return;
    for (int i = 0; i < psNum; ++i) {
        void* ps = psData[i];
        if (!ps || !IsReadablePointer(ps, 0x3B8)) continue;
        int32_t state = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(ps) + 0x3AC);
        if (state == 0) continue;   // only sample while a player is downed / bleeding out
        float len = *reinterpret_cast<float*>(reinterpret_cast<uintptr_t>(ps) + 0x3B0);
        float rem = *reinterpret_cast<float*>(reinterpret_cast<uintptr_t>(ps) + 0x3B4);
        MpLog("[GraceDiag] ps=" + reinterpret_cast<UObject*>(ps)->GetName()
            + " BleedoutState=" + std::to_string(state)
            + " timerLen=" + std::to_string(len)
            + " timeRemaining=" + std::to_string(rem));
    }
}

// Object-free wrapper so the __try lives outside GameEngineTickHook (which requires object unwinding -> C2712).
static void SampleBleedoutGraceGuarded() {
    __try { SampleBleedoutGrace(); } __except (EXCEPTION_EXECUTE_HANDLER) {}
}

// [2026-07-20 TRIALS GRACE DIAG v2] The tick sampler above reads AArchonPlayerState.BleedoutState (+0x3AC),
// which is BlueprintVisible but NOT Net -> it can stay 0 on the dedicated server (bleedout is tracked on the
// per-character UArchonBleedoutComponent). So also hook the knockout routine (FUN_141b8acd0 @ RVA 0x01B8ACD0),
// which the arena logs prove fires server-side on every down ("Tried to knock out %s ..."). Logging every
// knockout with MpLog's timestamp + the actor lets us measure the real grace = last-knockout -> WaitingPostMatch
// (game log), and count downs per player. Gated by TRIALS_GRACE_DIAG.flag.
void* OrigKnockout = nullptr;
static void LogKnockout(void* self) {
    std::string nm = (self && IsReadablePointer(self, 0x40)) ? reinterpret_cast<UObject*>(self)->GetName() : std::string("?");
    MpLog("[GraceDiag] KNOCKOUT actor=" + nm);
}
void KnockoutHook(void* self) {
    reinterpret_cast<void(*)(void*)>(OrigKnockout)(self);
    if (MpExeRelativeFlagPresent(L"TRIALS_GRACE_DIAG.flag")) {
        __try { LogKnockout(self); } __except (EXCEPTION_EXECUTE_HANDLER) {}
    }
}

// Forward decls: real definitions live later in the file (with ProcessEventClientHook, which is
// their primary caller), but GameEngineTickHook's timeout fallback below (2026-07-21) needs them
// too, and GameEngineTickHook is defined earlier in this translation unit.
static bool DiagNaturalMode();
void TriggerArchonInputActivation(UObject* PC, const char* TriggerLabel, bool AllowCinematicClear);
std::string CoreCapFString(void* fstr);   // defined later in this file; ProcessEventClientHook's
                                                  // 2026-07-24 accessory-unlock diag needs it earlier.

// [2026-07-21/22] Forward decls for the ApplyPlayerRole timeout-retry (defined near
// ApplyPlayerRoleHook, further down the file). Both server AND owning client need this lifecycle:
// the server having a valid PR_TEMPEST inventory reference does not populate the client's local
// pawn/HUD, because AArchonCharacter.PlayerRole is not a replicated SDK property.
extern void* OrigApplyPlayerRole;
void ApplyPlayerRoleHook(void* a1);
static void TickPlayerRoleRetries();
static void TickPlayerRolePostActivationRefresh();
static void TickTempestModifierEnsure();
static void TickEscalationBuffChoiceSpawn();
static void NoteEscalationStateChangeForBuffChoices(UObject* ModeComponent, void* Parms);
static void TickTempestChargeDiag();
static void TickProgressionHudRefresh();
static void ResetClientPlayerRoleRetryStateForTravel();
static bool ValidateClientPossessionChain(UObject* PC, UObject* ExpectedPawn, UObject** OutPawn);
static void MpTraceClientPlayerStateGap(UObject* PC);   // [1.14.7 client player-state probe]
static void MpSendPathDiag();                          // [1.14.7 hub send-path probe]
static void MpProgressionWaitPoll();                   // [1.14.7 parked progression components, 2026-10-10]
static void MpArrivalTriggerServerProbe();             // [1.14.7 Training arrival-trigger diagnostic, 2026-10-10]
static void MpHuntPassServerStateTick();               // [1.14.7 2026-10-10] read-only [HuntPassState], server
static void MpHuntPassClientProbe(UObject* PC);        // [1.14.7 2026-10-10] read-only [HuntPassProbe], client arrival
static void MpCoinTossClientProbe(UObject* PC);        // [1.14.7 2026-10-10] read-only [CoinTossProbe], client arrival
static void MpStartMatchWithoutPhantom(void* GameMode);  // [1.14.7 phantom removal: match start at the first login]
static bool IsClientRolePumpPossessionStable(UObject* PC, UObject** OutPawn);
static void TickFrankDroneClientDiag(void* Pawn, const char* Trigger);
static std::string FrankDroneGateSummary(void* PlayerRole);
static void TraceArtificerDroneEvent(
    const char* Side, const char* Phase, UObject* Object,
    const std::string& FunctionName, void* Parms);
extern void* OrigFrankCanActivateAbilityBP;
bool __fastcall FrankCanActivateAbilityBPHook(void* PlayerRole);

// [1.12 archon-input-activation state — 2026-07-10, relocated to file scope 2026-07-21]
// Was function-local to ProcessEventClientHook; promoted to file scope (and moved up here, ahead
// of both its readers) so GameEngineTickHook's timeout fallback can see it too. Captures the
// client-side AArchonPlayerController at ClientRestart so the input-activation cascade
// (TriggerArchonInputActivation) can run against it, either from the first OnInputModeChanged
// callback (normal path, in ProcessEventClientHook) or a bounded timeout below if that callback
// never fires. See Progress/ 2026-07-21 entry for why: the native loading-screen-close decision
// that would fire OnInputModeChanged can itself stall, leaving the player stuck on the loading
// screen with input never enabled — confirmed by comparing a stuck client's log against a working
// one: [ArchonInputActivate] never appeared at all in the stuck one.
static UObject* s_LastPossessedPC = nullptr;
static UObject* s_LastRestartPawn = nullptr;
static void* s_LastPossessedWorld = nullptr;   // GWorld when s_LastPossessedPC was captured
static uint64_t s_LastPossessedAtMs = 0;
static bool s_ArchonInputActivated = false;

// [2026-10-10 1.14.7] s_LastPossessedPC / s_LastRestartPawn belong to the world they were captured in, and nothing
// cleared them. After a travel, or a disconnect back to the login screen, every probe kept validating the freed
// controller: IsRegisteredLiveObject reads UObject::Index (+0x0C) from decommitted memory, its SEH caught each fault
// and the VEH logged them (192 in 5 s on 10 Oct 19:41, after a rejected party join left the client on the login
// screen). Forget the pair once GWorld (0x06FC7F58) is no longer the capture world; the next ClientRestart in the new
// world is then a new possession, as before, and every reader already treats a null controller as "not yet".
static void MpForgetPossessionIfWorldChanged() {
    if (!s_LastPossessedPC && !s_LastRestartPawn) return;
    void* World = *reinterpret_cast<void**>(Globals::BaseAddress + 0x06FC7F58);
    if (World == s_LastPossessedWorld) return;
    MpLog("[PossessionChain] world changed (captured=" + MpPtr(s_LastPossessedWorld) + " now=" + MpPtr(World)
        + "): forgetting the tracked controller " + MpPtr(s_LastPossessedPC) + " and pawn " + MpPtr(s_LastRestartPawn));
    s_LastPossessedPC = nullptr;
    s_LastRestartPawn = nullptr;
}

// [2026-10-10 1.14.7 travel-crash probe, read-only, client only] The hunt -> Ramsgate crash (38_ §18.3, 22.4) is
// UEngine::LoadMap (0x04271370) at 0x04272D28: `World()->PersistentLevel->GetOutermost()` with PersistentLevel null -
// the shipping build drops the check() before LoadPackagesFully. It is the NEW world, and it faults 0.2 s after the
// connect, far too soon for a disk load of Ramsgate (~4 s): LoadMap's FindPackage found the map already in memory.
// Hypothesis: the previous Ramsgate UWorld survives the trip (something still references it); GC destroyed its level
// and nulled PersistentLevel; on return LoadMap reuses that world. This census lists every UWorld at each world change
// and 10 s / 60 s later: package, PersistentLevel, object flags, the GUObjectArray item flags (RootSet 0x40000000,
// PendingKill 0x20000000, Unreachable 0x10000000) and how many objects still sit inside it. NO_WORLD_CENSUS.flag off.
struct MpWorldCensusEntry {
    void* World;
    void* Outer;
    void* Level;
    uint32_t ObjectFlags;
    int32_t ItemFlags;
    int32_t Inside;
};

static int MpWorldCensusScan(MpWorldCensusEntry* Out, int Max, int* OutObjects) {
    int Found = 0;
    *OutObjects = 0;
    __try {
        SDK::TUObjectArray* Arr = SDK::UObject::GObjects.operator->();
        const int Count = Arr ? Arr->NumElements : 0;
        *OutObjects = Count;
        SDK::UClass* WorldClass = SDK::UWorld::StaticClass();
        for (int i = 0; i < Count && Found < Max; ++i) {
            SDK::FUObjectItem* Chunk = Arr->Objects[i / SDK::TUObjectArray::ElementsPerChunk];
            if (!Chunk) continue;
            SDK::FUObjectItem* Item = &Chunk[i % SDK::TUObjectArray::ElementsPerChunk];
            UObject* Obj = Item->Object;
            if (!Obj || !Obj->Class) continue;
            const uint32_t Flags = *reinterpret_cast<uint32_t*>(reinterpret_cast<uintptr_t>(Obj) + 0x08);
            if (Flags & 0x10) continue;                       // RF_ClassDefaultObject
            if (!Obj->IsA(WorldClass)) continue;
            MpWorldCensusEntry& E = Out[Found++];
            E.World = Obj;
            E.Outer = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Obj) + 0x20);
            E.Level = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Obj) + 0x30);   // UWorld::PersistentLevel
            E.ObjectFlags = Flags;
            E.ItemFlags = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Item) + 0x08);
            E.Inside = 0;
        }
        // Second pass: objects whose Outer chain reaches each world (what the world still holds in memory).
        for (int i = 0; i < Count && Found > 0; ++i) {
            SDK::FUObjectItem* Chunk = Arr->Objects[i / SDK::TUObjectArray::ElementsPerChunk];
            if (!Chunk) continue;
            UObject* Obj = Chunk[i % SDK::TUObjectArray::ElementsPerChunk].Object;
            if (!Obj) continue;
            void* O = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Obj) + 0x20);
            for (int Depth = 0; O && Depth < 16; ++Depth) {
                for (int w = 0; w < Found; ++w) {
                    if (Out[w].World == O) { ++Out[w].Inside; O = nullptr; break; }
                }
                if (O) O = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(O) + 0x20);
            }
        }
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return -Found - 1;
    }
    return Found;
}

// Load/destroy state of a UObject from its ObjectFlags and its GUObjectArray item flags (UE 4.26 values).
static std::string MpObjectStateFlags(uint32_t ObjectFlags, int32_t ItemFlags) {
    std::string State;
    const struct { uint32_t Bit; const char* Name; } kItem[] = {
        { 0x40000000, "rootset" }, { 0x20000000, "pendingkill" }, { 0x10000000, "unreachable" },
        { 0x08000000, "asyncloading" }, { 0x04000000, "async" } };
    const struct { uint32_t Bit; const char* Name; } kObj[] = {
        { 0x400, "needload" }, { 0x1000, "needpostload" }, { 0x8000, "begindestroyed" }, { 0x10000, "finishdestroyed" },
        { 0x80000, "wasloaded" }, { 0x200000, "loadcompleted" } };
    for (const auto& F : kItem) if (static_cast<uint32_t>(ItemFlags) & F.Bit) { State += F.Name; State += ','; }
    for (const auto& F : kObj) if (ObjectFlags & F.Bit) { State += F.Name; State += ','; }
    if (!State.empty()) State.pop_back();
    return State;
}

static void MpWorldCensus(const char* Reason) {
    MpWorldCensusEntry Entries[64]{};
    int Objects = 0;
    int Found = MpWorldCensusScan(Entries, 64, &Objects);
    const bool Faulted = Found < 0;
    if (Faulted) Found = -Found - 1;
    void* Current = *reinterpret_cast<void**>(Globals::BaseAddress + 0x06FC7F58);
    std::string Line = std::string("[WorldCensus] reason=") + Reason + " gworld=" + MpPtr(Current)
        + " objects=" + std::to_string(Objects) + " worlds=" + std::to_string(Found) + (Faulted ? " (scan faulted)" : "");
    for (int i = 0; i < Found; ++i) {
        const MpWorldCensusEntry& E = Entries[i];
        std::string Name = SafeObjectNameForDiagnostic(E.World);
        std::string Pkg = E.Outer ? SafeObjectNameForDiagnostic(E.Outer) : std::string("none");
        const std::string State = MpObjectStateFlags(E.ObjectFlags, E.ItemFlags);
        // Compact: the package is only shown when it is not the world's own name.
        Line += " | " + MpPtr(E.World) + " " + Name + (Pkg != Name ? " pkg=" + Pkg : std::string())
            + (E.World == Current ? " CURRENT" : "")
            + " level=" + (E.Level ? MpPtr(E.Level) : std::string("NULL"))
            + (State.empty() ? "" : " [" + State + "]") + " inside=" + std::to_string(E.Inside);
    }
    MpLog(Line);
    // A pending-kill world that is not the current one has outlived its map: name what keeps it (once per world), then
    // release its stuck keep flags so the next GC (LoadMap's full purge at the latest) frees it.
    void* Zombies[64];
    int NumZombies = 0;
    for (int i = 0; i < Found; ++i) {
        if (Entries[i].World != Current && (Entries[i].ItemFlags & 0x20000000)) {
            MpReportZombieWorld(Entries[i].World, Reason);
            Zombies[NumZombies++] = Entries[i].World;
        }
    }
    if (NumZombies > 0 && strcmp(Reason, "travel-crash") != 0) MpReleaseZombieKeepFlags(Zombies, NumZombies, Reason);
}

static bool MpReadWorldStateSafe(void* Obj, uint32_t* ObjFlags, int32_t* ItemFlags, void** Outer, void** Level) {
    *ObjFlags = 0; *ItemFlags = 0; *Outer = nullptr; *Level = nullptr;
    __try {
        *ObjFlags = *reinterpret_cast<uint32_t*>(reinterpret_cast<uintptr_t>(Obj) + 0x08);
        const int32_t Index = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Obj) + 0x0C);
        *Outer = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Obj) + 0x20);
        *Level = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Obj) + 0x30);
        SDK::TUObjectArray* Arr = SDK::UObject::GObjects.operator->();
        if (Arr && Index >= 0 && Index < Arr->NumElements) {
            SDK::FUObjectItem* Chunk = Arr->Objects[Index / SDK::TUObjectArray::ElementsPerChunk];
            if (Chunk) {
                *ItemFlags = *reinterpret_cast<int32_t*>(
                    reinterpret_cast<uintptr_t>(&Chunk[Index % SDK::TUObjectArray::ElementsPerChunk]) + 0x08);
            }
        }
        return true;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

static void MpLogTravelCrashState(CONTEXT* Context) {
    static std::atomic<int> s_dumps{ 0 };
    if (s_dumps.fetch_add(1) != 0) return;
    void* WorldContext = reinterpret_cast<void*>(Context->R12);
    void* World = nullptr;
    if (WorldContext && IsReadablePointer(WorldContext, 0x288)) {
        World = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(WorldContext) + 0x280);
    }
    void* GWorldNow = *reinterpret_cast<void**>(Globals::BaseAddress + 0x06FC7F58);
    std::string Line = "[TravelCrash] LoadMap null PersistentLevel: context(r12)=" + MpPtr(WorldContext)
        + " world=" + MpPtr(World) + " gworld=" + MpPtr(GWorldNow);
    uint32_t ObjFlags = 0; int32_t ItemFlags = 0; void* Outer = nullptr; void* Level = nullptr;
    if (World && MpReadWorldStateSafe(World, &ObjFlags, &ItemFlags, &Outer, &Level)) {
        Line += " name=" + SafeObjectNameForDiagnostic(World) + " pkg=" + (Outer ? SafeObjectNameForDiagnostic(Outer) : std::string("none"))
            + " level=" + (Level ? MpPtr(Level) : std::string("NULL")) + " objFlags=" + MpHex(ObjFlags)
            + " item=" + MpHex(static_cast<uint32_t>(ItemFlags)) + " [" + MpObjectStateFlags(ObjFlags, ItemFlags) + "]";
        uint32_t PkgFlags = 0; int32_t PkgItem = 0; void* PkgOuter = nullptr; void* Unused = nullptr;
        if (Outer && MpReadWorldStateSafe(Outer, &PkgFlags, &PkgItem, &PkgOuter, &Unused)) {
            Line += " pkgFlags=" + MpHex(PkgFlags) + " pkgItem=" + MpHex(static_cast<uint32_t>(PkgItem))
                + " [" + MpObjectStateFlags(PkgFlags, PkgItem) + "]";
        }
    } else {
        Line += " (world unreadable)";
    }
    MpLog(Line);
    MpWorldCensus("travel-crash");
}

// [2026-10-10 1.14.7 travel-crash probe, read-only] 0.2.123 caught the crash (21:14:50): LoadMap reused the PREVIOUS
// Ramsgate UWorld. On the way out (Ramsgate -> Training) LoadMap unrooted it and GC destroyed its level, yet the world
// survived as pendingkill with 3 objects still inside; a reachable inner object keeps its Outer (the world) alive, since
// GC never eliminates outer references. On return FindPackage found the leftover and LoadMap reused it. This names what
// is left inside a pending-kill world and every live object that points at it (direct fields, plus one level of TArray
// contents), once per such world. A holder found nowhere is a native FGCObject reference.
struct MpRefHit {
    void* Referencer;
    void* Target;
    uint32_t Offset;
    int32_t ArrayIndex;   // -1 = the field itself, else an element of the TArray at Offset
};

static bool MpPtrSetHas(void* const* Set, uintptr_t P) {
    if (!P) return false;
    for (int Probe = 0, Slot = static_cast<int>((P >> 4) & 255); Probe < 256; ++Probe, Slot = (Slot + 1) & 255) {
        if (!Set[Slot]) return false;
        if (reinterpret_cast<uintptr_t>(Set[Slot]) == P) return true;
    }
    return false;
}

static void MpPtrSetAdd(void** Set, void* P) {
    for (int Probe = 0, Slot = static_cast<int>((reinterpret_cast<uintptr_t>(P) >> 4) & 255); Probe < 256; ++Probe, Slot = (Slot + 1) & 255) {
        if (!Set[Slot] || Set[Slot] == P) { Set[Slot] = P; return; }
    }
}

static bool MpOuterChainReaches(void* Obj, void* World) {
    void* O = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Obj) + 0x20);
    for (int Depth = 0; O && Depth < 16; ++Depth) {
        if (O == World) return true;
        O = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(O) + 0x20);
    }
    return false;
}

// One level of TArray<UObject*>-shaped memory; its own SEH frame so a false-positive header only skips itself.
static int MpScanPtrArraySafe(uintptr_t Data, int32_t Num, void* const* Set, void* Referencer, uint32_t Offset,
                              MpRefHit* Hits, int Found, int MaxHits) {
    __try {
        const uintptr_t* Elems = reinterpret_cast<const uintptr_t*>(Data);
        for (int32_t i = 0; i < Num && Found < MaxHits; ++i) {
            if (MpPtrSetHas(Set, Elems[i])) Hits[Found++] = { Referencer, reinterpret_cast<void*>(Elems[i]), Offset, i };
        }
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {}
    return Found;
}

static int MpZombieInnerScan(void* World, void** OutInner, int MaxInner) {
    int Found = 0;
    __try {
        SDK::TUObjectArray* Arr = SDK::UObject::GObjects.operator->();
        const int Count = Arr ? Arr->NumElements : 0;
        for (int i = 0; i < Count && Found < MaxInner; ++i) {
            SDK::FUObjectItem* Chunk = Arr->Objects[i / SDK::TUObjectArray::ElementsPerChunk];
            if (!Chunk) continue;
            void* Obj = Chunk[i % SDK::TUObjectArray::ElementsPerChunk].Object;
            if (Obj && Obj != World && MpOuterChainReaches(Obj, World)) OutInner[Found++] = Obj;
        }
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {}
    return Found;
}

static int MpZombieRefScan(void* const* Set, void* World, MpRefHit* Hits, int MaxHits, int* OutScanned) {
    int Found = 0;
    *OutScanned = 0;
    __try {
        SDK::TUObjectArray* Arr = SDK::UObject::GObjects.operator->();
        const int Count = Arr ? Arr->NumElements : 0;
        for (int i = 0; i < Count && Found < MaxHits; ++i) {
            SDK::FUObjectItem* Chunk = Arr->Objects[i / SDK::TUObjectArray::ElementsPerChunk];
            if (!Chunk) continue;
            void* Obj = Chunk[i % SDK::TUObjectArray::ElementsPerChunk].Object;
            if (!Obj || MpPtrSetHas(Set, reinterpret_cast<uintptr_t>(Obj)) || MpOuterChainReaches(Obj, World)) continue;
            void* Cls = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Obj) + 0x10);
            if (!Cls) continue;
            int32_t Size = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Cls) + 0x58);   // UStruct::Size
            if (Size < 0x30) continue;
            if (Size > 0x4000) Size = 0x4000;
            ++*OutScanned;
            for (uint32_t Off = 0x28; Off + 8 <= static_cast<uint32_t>(Size) && Found < MaxHits; Off += 8) {
                const uintptr_t Q = *reinterpret_cast<uintptr_t*>(reinterpret_cast<uintptr_t>(Obj) + Off);
                if (MpPtrSetHas(Set, Q)) { Hits[Found++] = { Obj, reinterpret_cast<void*>(Q), Off, -1 }; continue; }
                if (Q > 0x10000 && (Q & 7) == 0 && Off + 16 <= static_cast<uint32_t>(Size)) {
                    const int32_t Num = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Obj) + Off + 8);
                    const int32_t Max = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Obj) + Off + 12);
                    if (Num > 0 && Num <= Max && Max <= 4096) Found = MpScanPtrArraySafe(Q, Num, Set, Obj, Off, Hits, Found, MaxHits);
                }
            }
        }
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {}
    return Found;
}

static std::string MpObjectAndClassName(void* Obj) {
    if (!Obj) return "null";
    void* Cls = IsRegisteredLiveObject(Obj) ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Obj) + 0x10) : nullptr;
    return SafeObjectNameForDiagnostic(Obj) + "(" + (Cls ? SafeObjectNameForDiagnostic(Cls) : std::string("?")) + ")";
}

static void MpReportZombieWorld(void* World, const char* Reason) {
    static void* s_reported[16] = {};
    for (void* P : s_reported) if (P == World) return;
    for (void*& P : s_reported) if (!P) { P = World; break; }

    void* Inner[48] = {};
    const int NumInner = MpZombieInnerScan(World, Inner, 48);
    void* Set[256] = {};
    MpPtrSetAdd(Set, World);
    void* Package = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(World) + 0x20);
    if (Package) MpPtrSetAdd(Set, Package);
    std::string InnerList;
    for (int i = 0; i < NumInner; ++i) {
        MpPtrSetAdd(Set, Inner[i]);
        uint32_t Of = 0; int32_t It = 0; void* Ou = nullptr; void* Lv = nullptr;
        MpReadWorldStateSafe(Inner[i], &Of, &It, &Ou, &Lv);
        InnerList += " | " + MpPtr(Inner[i]) + " " + MpObjectAndClassName(Inner[i]) + " outer=" + MpObjectAndClassName(Ou)
            + " [" + MpObjectStateFlags(Of, It) + "]";
    }
    MpLog(std::string("[ZombieWorld] reason=") + Reason + " world=" + MpPtr(World) + " " + MpObjectAndClassName(World)
        + " pkg=" + MpObjectAndClassName(Package) + " inside=" + std::to_string(NumInner) + InnerList);

    // The reference sweep is opt-in since 0.2.125: its one-level TArray reads treat byte arrays (UFunction::Script at
    // +0x60) as pointer arrays, so it reported stale heap words as holders and raised ~190 first-chance faults per
    // world (MpScanPtrArraySafe, 21:26:34), all logged by the VEH. The holder it was looking for is a keep flag, which
    // the inner list above already shows.
    static int s_refScan = -1;
    if (s_refScan < 0) s_refScan = MpExeRelativeFlagPresent(L"ZOMBIE_REF_SCAN.flag") ? 1 : 0;
    if (!s_refScan) return;
    MpRefHit Hits[32] = {};
    int Scanned = 0;
    const uint64_t T0 = GetTickCount64();
    const int NumHits = MpZombieRefScan(Set, World, Hits, 32, &Scanned);
    std::string HitList;
    for (int i = 0; i < NumHits; ++i) {
        HitList += " | " + MpObjectAndClassName(Hits[i].Referencer) + " +" + MpHex(Hits[i].Offset)
            + (Hits[i].ArrayIndex >= 0 ? "[" + std::to_string(Hits[i].ArrayIndex) + "]" : std::string())
            + " -> " + MpObjectAndClassName(Hits[i].Target);
    }
    MpLog("[ZombieWorld] holders of " + MpPtr(World) + ": " + std::to_string(NumHits) + " reference(s) from "
        + std::to_string(Scanned) + " objects scanned in " + std::to_string(GetTickCount64() - T0) + " ms"
        + (NumHits == 0 ? " (none in UObject memory: a native FGCObject holds it)" : "") + HitList);
}

// [2026-10-10 1.14.7 travel-crash FIX] Root cause, proven on 0.2.124 (leftovers at 21:26:34 and 21:26:48, crash on the
// second one at 21:27:14): every leftover world held exactly one chain, `default_input_bpc_C [pendingkill,async]` ->
// its PlayerController -> PersistentLevel -> UWorld -> package. GUObjectArray item flag 0x04000000 is
// EInternalObjectFlags::Async, one of GarbageCollectionKeepFlags: the 1.14.7 mark phase (0x027D9580 and its three
// siblings pass FastKeepFlags = 0x0E000000) keeps such an object even when it is PendingKill, and GC never eliminates
// Outer references, so one input component whose Async flag was never cleared keeps its whole world alive. LoadMap
// runs a full-purge CollectGarbage (0x027DFE10, called at 0x042721A6 with KeepFlags 0, after the old world is detached
// and before FindPackage), so clearing that stale bit lets the purge free the leftover and LoadMap loads the map fresh
// instead of reusing a world whose PersistentLevel is gone (0x04272D28).
// Touched: only objects that are PendingKill, not RootSet, carry Async without AsyncLoading, and whose Outer chain
// reaches a pending-kill UWorld that is not GWorld; only the Async bit is cleared. AsyncLoading/RootSet holders are
// counted, never changed. KEEP_STUCK_ASYNC_FLAGS.flag reverts (report only).
static void* s_ZombieKeepReleased[16] = {};
static int s_ZombieKeepReleasedNext = 0;

static bool MpZombieKeepFlagReleased(void* World) {
    for (void* P : s_ZombieKeepReleased) if (P && P == World) return true;
    return false;
}

static int MpWorldIndexInOuterChain(void* Obj, void* const* Worlds, int NumWorlds) {
    void* O = Obj;
    for (int Depth = 0; O && Depth < 17; ++Depth) {
        for (int w = 0; w < NumWorlds; ++w) if (Worlds[w] == O) return w;
        O = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(O) + 0x20);
    }
    return -1;
}

// Objects inside the given worlds that carry a GC keep flag. Release = clear Async on the eligible ones (game thread).
static int MpStuckAsyncScan(void* const* Worlds, int NumWorlds, bool Release, void** OutObj, int* OutWorld, int Max,
                            int* OutLeftAlone) {
    int Found = 0;
    *OutLeftAlone = 0;
    __try {
        SDK::TUObjectArray* Arr = SDK::UObject::GObjects.operator->();
        const int Count = Arr ? Arr->NumElements : 0;
        for (int i = 0; i < Count; ++i) {
            SDK::FUObjectItem* Chunk = Arr->Objects[i / SDK::TUObjectArray::ElementsPerChunk];
            if (!Chunk) continue;
            SDK::FUObjectItem* Item = &Chunk[i % SDK::TUObjectArray::ElementsPerChunk];
            void* Obj = Item->Object;
            if (!Obj) continue;
            volatile LONG* Flags = reinterpret_cast<volatile LONG*>(reinterpret_cast<uintptr_t>(Item) + 0x08);
            const LONG F = *Flags;
            if (!(F & 0x4C000000)) continue;                  // no RootSet / AsyncLoading / Async
            const int W = MpWorldIndexInOuterChain(Obj, Worlds, NumWorlds);
            if (W < 0) continue;
            const bool Eligible = (F & 0x20000000) && !(F & 0x40000000) && (F & 0x04000000) && !(F & 0x08000000);
            if (!Eligible) { ++*OutLeftAlone; continue; }
            if (Release) InterlockedAnd(Flags, ~static_cast<LONG>(0x04000000));
            if (Found < Max) { OutObj[Found] = Obj; OutWorld[Found] = W; }
            ++Found;
        }
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {}
    return Found;
}

static void MpReleaseZombieKeepFlags(void* const* Worlds, int NumWorlds, const char* Reason) {
    static int s_reportOnly = -1;
    if (s_reportOnly < 0) {
        s_reportOnly = MpExeRelativeFlagPresent(L"KEEP_STUCK_ASYNC_FLAGS.flag") ? 1 : 0;
        MpLog(std::string("[ZombieWorld] stuck Async keep-flag release ") + (s_reportOnly
            ? "OFF (KEEP_STUCK_ASYNC_FLAGS.flag; report only)"
            : "ON: leftover worlds are freed by the next GC instead of being reused by LoadMap"));
    }
    // A world released before this LoadMap that is still here after it survived the full purge: another holder.
    static void* s_survivorWarned[16] = {};
    if (strcmp(Reason, "world-change") == 0) {
        for (int w = 0; w < NumWorlds; ++w) {
            if (!MpZombieKeepFlagReleased(Worlds[w])) continue;
            bool Warned = false;
            for (void* P : s_survivorWarned) if (P == Worlds[w]) Warned = true;
            if (Warned) continue;
            for (void*& P : s_survivorWarned) if (!P) { P = Worlds[w]; break; }
            MpLog("[ZombieWorld] " + MpPtr(Worlds[w]) + " " + SafeObjectNameForDiagnostic(Worlds[w])
                + " survived LoadMap's full purge after its keep flag was released: something else holds it"
                  " (ZOMBIE_REF_SCAN.flag lists candidates)");
        }
    }
    void* Obj[16] = {};
    int WorldOf[16] = {};
    int LeftAlone = 0;
    const int N = MpStuckAsyncScan(Worlds, NumWorlds, !s_reportOnly, Obj, WorldOf, 16, &LeftAlone);
    static int s_lastLeftAlone = -1;
    if (N == 0 && (LeftAlone == 0 || LeftAlone == s_lastLeftAlone)) return;
    s_lastLeftAlone = LeftAlone;
    std::string List;
    for (int i = 0; i < N && i < 16; ++i) {
        List += " | " + MpObjectAndClassName(Obj[i]) + " in " + SafeObjectNameForDiagnostic(Worlds[WorldOf[i]]);
        if (!s_reportOnly && !MpZombieKeepFlagReleased(Worlds[WorldOf[i]])) {
            s_ZombieKeepReleased[s_ZombieKeepReleasedNext] = Worlds[WorldOf[i]];
            s_ZombieKeepReleasedNext = (s_ZombieKeepReleasedNext + 1) % 16;
        }
    }
    MpLog(std::string("[ZombieWorld] reason=") + Reason + (s_reportOnly ? " FOUND (not released)" : " RELEASED")
        + " stuck Async keep flag on " + std::to_string(N) + " pending-kill object(s) in " + std::to_string(NumWorlds)
        + " leftover world(s); keep-flag holders left alone (AsyncLoading/RootSet/live): " + std::to_string(LeftAlone)
        + List);
}

// Live objects of the current world that carry Async/AsyncLoading at +10 s / +60 s: shows whether the input component
// is born with the stale flag (who sets it) and predicts which world would have leaked.
static int MpLiveAsyncScan(void* World, void** OutObj, int Max, int* OutAsyncLoading) {
    int Found = 0;
    *OutAsyncLoading = 0;
    __try {
        SDK::TUObjectArray* Arr = SDK::UObject::GObjects.operator->();
        const int Count = Arr ? Arr->NumElements : 0;
        for (int i = 0; i < Count; ++i) {
            SDK::FUObjectItem* Chunk = Arr->Objects[i / SDK::TUObjectArray::ElementsPerChunk];
            if (!Chunk) continue;
            SDK::FUObjectItem* Item = &Chunk[i % SDK::TUObjectArray::ElementsPerChunk];
            void* Obj = Item->Object;
            if (!Obj) continue;
            const int32_t F = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Item) + 0x08);
            if (!(F & 0x0C000000)) continue;
            if (MpWorldIndexInOuterChain(Obj, &World, 1) < 0) continue;
            if (F & 0x08000000) ++*OutAsyncLoading;
            if (F & 0x04000000) { if (Found < Max) OutObj[Found] = Obj; ++Found; }
        }
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {}
    return Found;
}

static void MpAsyncFlagCensus(const char* Reason) {
    void* World = *reinterpret_cast<void**>(Globals::BaseAddress + 0x06FC7F58);
    if (!World) return;
    void* Obj[8] = {};
    int AsyncLoading = 0;
    const int N = MpLiveAsyncScan(World, Obj, 8, &AsyncLoading);
    std::string List;
    for (int i = 0; i < N && i < 8; ++i) {
        uint32_t Of = 0; int32_t It = 0; void* Ou = nullptr; void* Lv = nullptr;
        MpReadWorldStateSafe(Obj[i], &Of, &It, &Ou, &Lv);
        List += " | " + MpObjectAndClassName(Obj[i]) + " outer=" + MpObjectAndClassName(Ou) + " [" + MpObjectStateFlags(Of, It) + "]";
    }
    MpLog(std::string("[AsyncFlagCensus] reason=") + Reason + " world=" + SafeObjectNameForDiagnostic(World)
        + " async=" + std::to_string(N) + " asyncloading=" + std::to_string(AsyncLoading) + List);
}

// Client (from ProcessEventClientHook, every 250 ms): a census on every GWorld change and 10 s / 60 s after it.
static void MpWorldCensusTick() {
    static int s_disabled = -1;
    if (s_disabled < 0) {
        s_disabled = MpExeRelativeFlagPresent(L"NO_WORLD_CENSUS.flag") ? 1 : 0;
        MpLog(std::string("[WorldCensus] ") + (s_disabled ? "OFF (NO_WORLD_CENSUS.flag)" : "ON: every UWorld at each world change, +10 s and +60 s (client)"));
    }
    if (s_disabled) return;
    static void* s_world = nullptr;
    static uint64_t s_changedAtMs = 0;
    static int s_stage = 0;   // 0 = idle, 1 = +10 s pending, 2 = +60 s pending
    void* World = *reinterpret_cast<void**>(Globals::BaseAddress + 0x06FC7F58);
    const uint64_t Now = GetTickCount64();
    if (World != s_world) {
        s_world = World;
        s_changedAtMs = Now;
        s_stage = 1;
        MpWorldCensus("world-change");
        return;
    }
    if (s_stage == 1 && Now - s_changedAtMs >= 10000) { s_stage = 2; MpWorldCensus("arrival+10s"); MpAsyncFlagCensus("arrival+10s"); }
    else if (s_stage == 2 && Now - s_changedAtMs >= 60000) { s_stage = 0; MpWorldCensus("arrival+60s"); MpAsyncFlagCensus("arrival+60s"); }
}
// A natural OnInputModeChanged can arrive before the new map's LocalPlayer/PC/Pawn chain has
// remained stable long enough for compatibility calls. Remember that edge and replay the input
// activation only after the existing travel-settle gate passes; never advance the cinematic from
// the timeout-only path.
static bool s_ArchonInputActivationPending = false;
static bool s_NaturalInputModeChangedObserved = false;
// [1.14.7 FIX 2026-10-10, 38_ §21] The game's own latest OnInputModeChanged value for the current
// possession (-1 none yet, 0 input taken away, 1 control handed to the player) and when it arrived.
// Events raised from inside TriggerArchonInputActivation (EnableCharacterInput fires the same event)
// are ours and are not recorded. On a hunt the first natural edge is false - the arrival cinematic
// taking input - and true only arrives when the cinematic ends; the airship screen does the same.
static int s_LastNaturalGameInput = -1;
static uint64_t s_LastNaturalGameInputMs = 0;
static int s_ArchonInputActivationDepth = 0;
static bool s_ProgressionHudRefreshPending = false;
static uint32_t s_ProgressionHudRefreshAttempts = 0;
static uint64_t s_ProgressionHudRefreshNotBeforeMs = 0;

// [2026-07-27 CLIENT TRAVEL STABILITY] The ProcessEvent client pump must not chase a freshly
// replaced controller/pawn merely because both addresses are readable. During Ramsgate -> hunt the
// old controller is detached, UObject slots are recycled, and the new Player/Controller/Pawn chain
// converges over several frames. Require both an exact live ownership chain and a bounded settle
// interval before invoking any compatibility lifecycle callback.
static UObject* s_ClientRolePumpStablePC = nullptr;
static UObject* s_ClientRolePumpStablePawn = nullptr;
static uint64_t s_ClientRolePumpStableSinceMs = 0;
static constexpr uint64_t kClientRolePumpTravelSettleMs = 3000;
static constexpr uint64_t kClientRolePumpStableChainMs = 750;

// [2026-10-10 1.14.7 CPU] ExpectedPlayerCount roster sync for ONE object (the world's GameMode or GameState).
// Same checks, compare-then-write and one-time log text as the GObjects walk it replaces (see the roster block in
// GameEngineTickHook); a null, unregistered, CDO or wrong-class pointer writes nothing.
static void MpSyncExpectedPlayerField(SDK::UObject* Obj, SDK::UClass* Cls, uintptr_t Offset, const char* Tag,
    const char* OffsetText, bool& Logged, int32_t Value) {
    if (!Obj || !Cls || !IsRegisteredLiveObject(Obj) || Obj->IsDefaultObject()
        || !Obj->Class || !IsRegisteredLiveObject(Obj->Class) || !Obj->IsA(Cls)) {
        return;
    }
    int32_t* Field = reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Obj) + Offset);
    if (!IsReadablePointer(Field, sizeof(int32_t))) return;
    const int32_t Before = *Field;
    if (Before == Value) return;
    *Field = Value;
    if (!Logged) {
        Logged = true;
        MpLog(std::string("[ExpectedPlayerCount@") + Tag + "] synchronized  instance=" + MpPtr(Obj)
            + " class=" + Obj->Class->GetName()
            + " before=" + std::to_string(Before)
            + " after=" + std::to_string(Value)
            + " offset=" + OffsetText);
    }
}

// [2026-10-10 1.14.7 CPU] Read-only, one-shot cross-check for the world-pointer roster sync: walks GObjects ONCE and
// logs how many non-CDO AArchonGameMode / AArchonGameState instances exist and whether each is the world's
// AuthorityGameMode (+0x118) / GameState (+0x120). The fast path is accepted only once hub, Training and hunt logs
// show gameModes=1 gameStates=1 with match=1 each. Called from the game thread (the tick hook) only.
static void MpExpectedPlayerWorldCensus(const char* When) {
    if (!SDK::UObject::GObjects) return;
    SDK::UWorld* World = SDK::UWorld::GetWorld();
    void* WorldGM = nullptr;
    void* WorldGS = nullptr;
    if (World && IsReadablePointer(World, 0x128)) {
        WorldGM = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(World) + 0x118);
        WorldGS = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(World) + 0x120);
    }
    int GameModes = 0, GameStates = 0, GameModeMatch = 0, GameStateMatch = 0;
    std::string Detail;
    const int Count = SDK::UObject::GObjects->Num();
    for (int i = 0; i < Count; i++) {
        SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
        if (!Obj || Obj->IsDefaultObject()) continue;
        const bool IsGM = Obj->IsA(SDK::AArchonGameMode::StaticClass());
        const bool IsGS = !IsGM && Obj->IsA(SDK::AArchonGameState::StaticClass());
        if (!IsGM && !IsGS) continue;
        const bool Match = IsGM ? (Obj == WorldGM) : (Obj == WorldGS);
        if (IsGM) { ++GameModes; if (Match) ++GameModeMatch; }
        else { ++GameStates; if (Match) ++GameStateMatch; }
        if (GameModes + GameStates <= 8) {
            Detail += std::string(" ") + (IsGM ? "GM" : "GS") + "=" + MpPtr(Obj) + "/"
                + (Obj->Class ? Obj->Class->GetName() : std::string("?")) + (Match ? "(world)" : "(NOT world)");
        }
    }
    MpLog(std::string("[ExpectedPlayerCount] census ") + When
        + " world=" + MpPtr(World) + " worldGM=" + MpPtr(WorldGM) + " worldGS=" + MpPtr(WorldGS)
        + " gameModes=" + std::to_string(GameModes) + " match=" + std::to_string(GameModeMatch)
        + " gameStates=" + std::to_string(GameStates) + " match=" + std::to_string(GameStateMatch)
        + " objects=" + std::to_string(Count) + Detail);
}

// [2026-10-10 1.14.7] Blueprint TickFilterHelper answered as a dedicated server - OPT-IN, default OFF.
// UArchonGameplayStatics::TickFilterHelper (native 0x019480B0, .pdata entry, 208 bytes; its only caller is the exec thunk
// 0x0229DB70, so only the Blueprint VM reaches it) decides whether a Blueprint "tick" branch runs: rcx=Actor, dl=Where
// (ECityExecFilter: IslandOnly 0, CityOnly 1, Both 2), r8b=Whom (ERemoteExecFilter: LocalOnly 0, RemoteOnly 1,
// LocalOrRemote 2, ServerOnly 3, LocalOrServer 4, All 5); al = result. Decoded on the 1.14.7 exe (same logic as 1.12
// 0x01823000): WherePasses = Where==Both || ((Where==CityOnly) == world-is-city); Whom 0 and 4 pass only for an
// AutonomousProxy (Role +0xF0 == 2), 1 only for a non-autonomous actor (Authority included), 2 and 5 always, and 3
// (ServerOnly) NEVER - the client build has no NetMode branch. Every pawn on our servers is ROLE_Authority, so ServerOnly
// and LocalOrServer branches never run there and RemoteOnly/LocalOrRemote branches always do.
// What is proven: the native logic above. What is NOT proven: which Blueprint sites (TickStamina, TickBleedout, the
// 0.5 s UpdateLastValidPlayerTransform edge-recovery timer, ...) sit behind which filter on 1.14.7 - the bytecode is
// Oodle-compressed in the pak - and the "dedicated-server answer" table below is a semantic reading of the enum names
// (an official UE_SERVER native cannot be checked in this binary). The census shows where the answers differ, not which
// one is right.
// Two independent opt-in modes; the hook is installed ONLY when one of the flags is present at InitServerHooks, and
// only on DeployServer instances (AuthMode GlobalGameserver) with the no-local-player patch applied. The P2P host
// (HuntCapability) is excluded. With neither flag: no hook, no behaviour change, the manual TickStamina stays.
//   TICK_FILTER_CENSUS.flag  - diagnostic only. The game's answer is returned unchanged. Calls are counted per Blueprint
//                              call site (exec-thunk hook: FFrame.Node = calling script function, script offset of the
//                              first parameter) with the game answer next to the dedicated-server answer, logged once a
//                              minute as [TickFilterCensus]; each calling function's Script bytes are dumped once for an
//                              offline Kismet review; [EdgeRecoveryProbe] reads the edge-recovery fields every 10 s.
//   SERVER_TICK_FILTER.flag  - fix. Only for ROLE_Authority actors that IsA BP_PlayerCharacter_C (the combat anim BP passes
//                              the pawn as Actor too): ServerOnly / LocalOrServer / All -> WherePasses, LocalOnly /
//                              RemoteOnly / LocalOrRemote -> false. Every other actor (behemoths, pets, NPCs, any
//                              Blueprint the partial SDK dump does not show) gets the game's answer. While it is active
//                              the manual per-connection TickStamina is skipped (the character's own tick runs it; both
//                              would evaluate stamina twice per frame). SUBTRACTIVE TOO: RemoteOnly/LocalOrRemote branches
//                              that run on our servers today stop - review the census "stop" rows before enabling.
// Both flags together: fix answers plus the census. The hook takes no lock, writes no log and allocates nothing outside
// census mode; it forwards to the game once DLL detach has begun. All FFrame/UFunction reads are SEH-guarded in
// MpTickFilterReadFrame.
using TickFilterHelperFn = bool(__fastcall*)(void* Actor, uint8_t Where, uint8_t Whom);
using TickFilterExecFn = void(__fastcall*)(void* Context, void* Stack, void* Result);
static TickFilterHelperFn OrigTickFilterHelper = nullptr;
static TickFilterExecFn OrigTickFilterExec = nullptr;
static std::atomic<bool> g_ServerTickFilterActive{ false };   // SERVER_TICK_FILTER.flag and the filter hook enabled
static std::atomic<bool> g_TickFilterCensus{ false };         // TICK_FILTER_CENSUS.flag and the filter hook enabled
static std::atomic<UClass*> g_TickFilterPlayerClass{ nullptr };   // BP_PlayerCharacter_C, cached on the game thread

// Per-thread call-site context, set by the exec-thunk hook (census only) for the duration of one native call.
thread_local void* t_TfSiteNode = nullptr;
thread_local int32_t t_TfSiteOffset = -1;
thread_local bool t_TfSiteValid = false;
thread_local int32_t t_TfSiteNodeIndex = -1;   // the Node's GUObjectArray slot (UObject::Index @ 0x0C) at capture time

// SEH-guarded FFrame read: Node +0x10 (calling UFunction), Code +0x20; UStruct::Script data +0x60 / count +0x68 (CANDIDATE
// offsets, UE4.26 layout; the thunk itself uses +0x18/+0x20/+0x80). Offset = Code - Script.Data when Code lies inside the
// script, else -1 (which also exposes a wrong Script offset in the census). OutIndex = the Node's UObject::Index (+0x0C),
// recorded so the once-a-minute log can tell a still-live function from a freed or reused address. No C++ objects here (__try).
__declspec(noinline) static bool MpTickFilterReadFrame(const void* Frame, void** OutNode, int32_t* OutOffset, int32_t* OutIndex) {
    __try {
        const uint8_t* F = static_cast<const uint8_t*>(Frame);
        void* Node = *reinterpret_cast<void* const*>(F + 0x10);
        const uint8_t* Code = *reinterpret_cast<const uint8_t* const*>(F + 0x20);
        int32_t Offset = -1;
        int32_t Index = -1;
        if (Node) Index = *reinterpret_cast<const int32_t*>(static_cast<const uint8_t*>(Node) + 0x0C);
        if (Node && Code) {
            const uint8_t* N = static_cast<const uint8_t*>(Node);
            const uint8_t* Script = *reinterpret_cast<const uint8_t* const*>(N + 0x60);
            const int32_t Num = *reinterpret_cast<const int32_t*>(N + 0x68);
            if (Script && Num > 0 && Code >= Script && Code <= Script + Num) Offset = static_cast<int32_t>(Code - Script);
        }
        *OutNode = Node;
        *OutOffset = Offset;
        *OutIndex = Index;
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

// SEH-guarded read of a UFunction's Script array (+0x60 data, +0x68 count). Copies at most Cap bytes into Out.
__declspec(noinline) static int32_t MpTickFilterReadScript(const void* Node, uint8_t* Out, int32_t Cap, const void** OutData) {
    __try {
        const uint8_t* N = static_cast<const uint8_t*>(Node);
        const uint8_t* Script = *reinterpret_cast<const uint8_t* const*>(N + 0x60);
        const int32_t Num = *reinterpret_cast<const int32_t*>(N + 0x68);
        *OutData = Script;
        if (!Script || Num <= 0) return 0;
        if (!Out) return Num;
        const int32_t Copy = Num < Cap ? Num : Cap;
        memcpy(Out, Script, static_cast<size_t>(Copy));
        return Copy;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return -1;
    }
}

struct MpTickFilterSiteRow {
    void* Node; int32_t NodeIndex; int32_t Offset; uint8_t Where; uint8_t Whom;
    uint64_t Calls, GamePass, ServerPass, Stop, Start, NoServerAnswer, OffThread, Total;
};
static MpTickFilterSiteRow g_TfSites[64] = {};
static int g_TfSiteCount = 0;
static uint64_t g_TfOverflow = 0;
static volatile LONG64 g_TfFrameFaults = 0;
static SRWLOCK g_TfLock = SRWLOCK_INIT;

// The dedicated-server answer, or -1 when the hook gives the game's answer (not an authority player character, Whom out
// of range, or the player class not cached yet). Reads only +0xF0 (the byte the native reads) and the object's class chain.
static int MpTickFilterServerAnswer(void* Actor, uint8_t Where, uint8_t Whom) {
    if (!Actor || Whom > 5) return -1;
    if (reinterpret_cast<const uint8_t*>(Actor)[0xF0] != 3 /*ROLE_Authority*/) return -1;
    UClass* PlayerClass = g_TickFilterPlayerClass.load(std::memory_order_acquire);
    if (!PlayerClass || !reinterpret_cast<UObject*>(Actor)->IsA(PlayerClass)) return -1;
    const bool WherePasses = OrigTickFilterHelper(Actor, Where, 5 /*All: Whom always passes, so this is the Where test*/);
    switch (Whom) {
    case 3: case 4: case 5: return WherePasses ? 1 : 0;   // ServerOnly, LocalOrServer, All
    default: return 0;                                     // LocalOnly, RemoteOnly, LocalOrRemote: no local player here
    }
}

static void MpTickFilterCount(uint8_t Where, uint8_t Whom, bool Game, int Server) {
    void* Node = t_TfSiteValid ? t_TfSiteNode : nullptr;
    const int32_t NodeIndex = t_TfSiteValid ? t_TfSiteNodeIndex : -1;
    const int32_t Offset = t_TfSiteValid ? t_TfSiteOffset : -1;
    const bool OffThread = GetCurrentThreadId() != GameTickThreadId;
    const bool Effective = Server >= 0 ? Server == 1 : Game;   // what SERVER_TICK_FILTER.flag would answer
    AcquireSRWLockExclusive(&g_TfLock);
    MpTickFilterSiteRow* Row = nullptr;
    for (int i = 0; i < g_TfSiteCount; ++i) {
        MpTickFilterSiteRow& R = g_TfSites[i];
        if (R.Node == Node && R.NodeIndex == NodeIndex && R.Offset == Offset && R.Where == Where && R.Whom == Whom) { Row = &R; break; }
    }
    if (!Row && g_TfSiteCount < static_cast<int>(sizeof(g_TfSites) / sizeof(g_TfSites[0]))) {
        Row = &g_TfSites[g_TfSiteCount++];
        *Row = MpTickFilterSiteRow{};
        Row->Node = Node; Row->NodeIndex = NodeIndex; Row->Offset = Offset; Row->Where = Where; Row->Whom = Whom;
    }
    if (Row) {
        ++Row->Calls; ++Row->Total;
        if (Game) ++Row->GamePass;
        if (Effective) ++Row->ServerPass;
        if (Game && !Effective) ++Row->Stop;
        if (!Game && Effective) ++Row->Start;
        if (Server < 0) ++Row->NoServerAnswer;
        if (OffThread) ++Row->OffThread;
    } else {
        ++g_TfOverflow;
    }
    ReleaseSRWLockExclusive(&g_TfLock);
}

static bool __fastcall TickFilterHelperDetour(void* Actor, uint8_t Where, uint8_t Whom) {
    if (MpProcessDetaching()) return OrigTickFilterHelper(Actor, Where, Whom);
    const bool Fix = g_ServerTickFilterActive.load(std::memory_order_relaxed);
    if (!g_TickFilterCensus.load(std::memory_order_relaxed)) {
        if (!Fix) return OrigTickFilterHelper(Actor, Where, Whom);
        const int Server = MpTickFilterServerAnswer(Actor, Where, Whom);
        return Server >= 0 ? Server == 1 : OrigTickFilterHelper(Actor, Where, Whom);
    }
    const bool Game = OrigTickFilterHelper(Actor, Where, Whom);
    const int Server = MpTickFilterServerAnswer(Actor, Where, Whom);
    MpTickFilterCount(Where, Whom, Game, Server);
    return (Fix && Server >= 0) ? Server == 1 : Game;
}

// Census only: records the calling script function and offset for the filter call made inside this thunk.
static void __fastcall TickFilterExecDetour(void* Context, void* Stack, void* Result) {
    void* PrevNode = t_TfSiteNode;
    const int32_t PrevOffset = t_TfSiteOffset;
    const bool PrevValid = t_TfSiteValid;
    const int32_t PrevIndex = t_TfSiteNodeIndex;
    void* Node = nullptr;
    int32_t Offset = -1;
    int32_t Index = -1;
    if (!MpProcessDetaching() && Stack && MpTickFilterReadFrame(Stack, &Node, &Offset, &Index)) {
        t_TfSiteNode = Node; t_TfSiteOffset = Offset; t_TfSiteNodeIndex = Index; t_TfSiteValid = true;
    } else {
        t_TfSiteNode = nullptr; t_TfSiteOffset = -1; t_TfSiteNodeIndex = -1; t_TfSiteValid = false;
        if (Stack && !MpProcessDetaching()) InterlockedIncrement64(&g_TfFrameFaults);
    }
    OrigTickFilterExec(Context, Stack, Result);
    t_TfSiteNode = PrevNode; t_TfSiteOffset = PrevOffset; t_TfSiteNodeIndex = PrevIndex; t_TfSiteValid = PrevValid;
}

static bool MpTickFilterHookActive() {
    return g_ServerTickFilterActive.load(std::memory_order_relaxed) || g_TickFilterCensus.load(std::memory_order_relaxed);
}

// Game thread: the BP class only exists once the map has loaded, so it is cached from the first connection pawn that the
// existing per-connection loop has already matched with IsA(ABP_PlayerCharacter_C::StaticClass()). Until then the fix
// answers like the game and the manual TickStamina keeps running.
static void MpTickFilterCachePlayerClass(UClass* PlayerClass) {
    if (!PlayerClass || !MpTickFilterHookActive() || g_TickFilterPlayerClass.load(std::memory_order_relaxed)) return;
    g_TickFilterPlayerClass.store(PlayerClass, std::memory_order_release);
    MpLog("[TickFilter] BP_PlayerCharacter_C class cached=" + MpPtr(PlayerClass)
        + (g_ServerTickFilterActive.load(std::memory_order_relaxed)
            ? std::string("; dedicated-server answers now active for player characters")
            : std::string("; census now reports the dedicated-server answer for player characters")));
}

static const char* MpTickFilterWhomName(uint8_t Whom) {
    static const char* const Names[6] = { "LocalOnly", "RemoteOnly", "LocalOrRemote", "ServerOnly", "LocalOrServer", "All" };
    return Whom < 6 ? Names[Whom] : "?";
}
static const char* MpTickFilterWhereName(uint8_t Where) {
    static const char* const Names[3] = { "IslandOnly", "CityOnly", "Both" };
    return Where < 3 ? Names[Where] : "?";
}

// Census only, game thread: dumps a calling function's Script bytes once to <exe dir>\tickfilter_script_port<N>_<k>.bin.
// In-memory Kismet holds raw object pointers where the pak has import indices; the logged base and name let an offline
// reader relate them.
// Keyed by the function's full name, not its address: a freed function's address can be reused by another one.
// The caller has already checked that Node is still the live UFunction it recorded (MpTickFilterNodeStillLive).
static void MpTickFilterDumpScriptOnce(void* Node, const std::string& Name) {
    static std::string s_dumped[32];
    static int s_count = 0;
    for (int i = 0; i < s_count; ++i) if (s_dumped[i] == Name) return;
    if (s_count >= 32) return;
    s_dumped[s_count++] = Name;
    const void* Data = nullptr;
    const int32_t Num = MpTickFilterReadScript(Node, nullptr, 0, &Data);
    if (Num <= 0 || Num > (8 << 20)) {
        MpLog("[TickFilterCensus] script dump skipped fn=" + Name + " num=" + std::to_string(Num) + " (unreadable/empty/too big)");
        return;
    }
    std::vector<uint8_t> Bytes(static_cast<size_t>(Num));
    const int32_t Got = MpTickFilterReadScript(Node, Bytes.data(), Num, &Data);
    if (Got != Num) {
        MpLog("[TickFilterCensus] script dump failed fn=" + Name + " got=" + std::to_string(Got) + " of " + std::to_string(Num));
        return;
    }
    char Path[MAX_PATH];
    sprintf_s(Path, "%stickfilter_script_port%d_%d.bin", MpLogDir(), Globals::Port, s_count);
    std::ofstream File(Path, std::ios::binary | std::ios::trunc);
    if (File.is_open()) File.write(reinterpret_cast<const char*>(Bytes.data()), Num);
    MpLog("[TickFilterCensus] script dump fn=" + Name + " node=" + MpPtr(Node) + " script=" + MpPtr(const_cast<void*>(Data))
        + " bytes=" + std::to_string(Num) + " file=" + Path + (File.good() ? "" : " (WRITE FAILED)"));
}

// [2026-10-10 1.14.7] Census only, game thread (GC runs on this thread, so the answer holds until the caller returns): is
// the Node recorded up to 60 s ago still the same live UFunction? It may have been garbage-collected since (a streamed
// sublevel or an unloaded Blueprint class) and its memory reused, and GetFullName walks Class/Outer/FName unguarded.
// Requires the GObjects round trip, the same slot index as at capture, and a live class that IsA UFunction.
static bool MpTickFilterNodeStillLive(void* Node, int32_t NodeIndex) {
    if (!Node || NodeIndex < 0 || !IsReadablePointer(Node, 0x70) || !IsRegisteredLiveObject(Node)) return false;
    UObject* Obj = reinterpret_cast<UObject*>(Node);
    if (Obj->Index != NodeIndex || !Obj->Class || !IsRegisteredLiveObject(Obj->Class)) return false;
    return Obj->IsA(UFunction::StaticClass());
}

// Census only, game thread, once a minute: one line per call site with calls in the window, then the window resets.
// "stop" = the game passes, the dedicated-server answer would not (branches that run on our servers today and would stop
// under SERVER_TICK_FILTER.flag); "start" = the reverse (branches that never run today).
static void MpTickFilterCensusTick() {
    if (!g_TickFilterCensus.load(std::memory_order_relaxed)) return;
    static ULONGLONG s_windowStart = 0;
    const ULONGLONG Now = GetTickCount64();
    if (s_windowStart == 0) { s_windowStart = Now; return; }
    if (Now - s_windowStart < 60000) return;
    const double Seconds = static_cast<double>(Now - s_windowStart) / 1000.0;
    s_windowStart = Now;

    MpTickFilterSiteRow Rows[64];
    int Count = 0;
    uint64_t Overflow = 0;
    AcquireSRWLockExclusive(&g_TfLock);
    Count = g_TfSiteCount;
    for (int i = 0; i < Count; ++i) {
        Rows[i] = g_TfSites[i];
        MpTickFilterSiteRow& R = g_TfSites[i];
        R.Calls = R.GamePass = R.ServerPass = R.Stop = R.Start = R.NoServerAnswer = R.OffThread = 0;
    }
    Overflow = g_TfOverflow;
    ReleaseSRWLockExclusive(&g_TfLock);
    const uint64_t FrameFaults = static_cast<uint64_t>(InterlockedCompareExchange64(
        reinterpret_cast<volatile LONG64*>(&g_TfFrameFaults), 0, 0));

    uint64_t Calls = 0, Stop = 0, Start = 0;
    int Active = 0;
    for (int i = 0; i < Count; ++i) {
        const MpTickFilterSiteRow& R = Rows[i];
        if (R.Calls == 0) continue;
        ++Active; Calls += R.Calls; Stop += R.Stop; Start += R.Start;
        std::string Fn = "(no frame)";
        bool Live = false;
        if (R.Node) {
            Live = MpTickFilterNodeStillLive(R.Node, R.NodeIndex);
            Fn = Live ? reinterpret_cast<UObject*>(R.Node)->GetFullName() : std::string("(stale)");
        }
        char Line[256];
        sprintf_s(Line, " off=%d where=%s whom=%s calls=%llu game=%llu server=%llu stop=%llu start=%llu noServerAnswer=%llu offThread=%llu total=%llu",
            R.Offset, MpTickFilterWhereName(R.Where), MpTickFilterWhomName(R.Whom),
            static_cast<unsigned long long>(R.Calls), static_cast<unsigned long long>(R.GamePass),
            static_cast<unsigned long long>(R.ServerPass), static_cast<unsigned long long>(R.Stop),
            static_cast<unsigned long long>(R.Start), static_cast<unsigned long long>(R.NoServerAnswer),
            static_cast<unsigned long long>(R.OffThread), static_cast<unsigned long long>(R.Total));
        MpLog("[TickFilterCensus] site fn=" + Fn + Line);
        if (Live) MpTickFilterDumpScriptOnce(R.Node, Fn);
    }
    char Summary[256];
    sprintf_s(Summary, "[TickFilterCensus] %.1fs: sites=%d (known %d) calls=%llu stop=%llu start=%llu overflow=%llu frameFaults=%llu playerClass=%s mode=%s",
        Seconds, Active, Count, static_cast<unsigned long long>(Calls), static_cast<unsigned long long>(Stop),
        static_cast<unsigned long long>(Start), static_cast<unsigned long long>(Overflow),
        static_cast<unsigned long long>(FrameFaults),
        g_TickFilterPlayerClass.load(std::memory_order_relaxed) ? "cached" : "not-yet",
        g_ServerTickFilterActive.load(std::memory_order_relaxed) ? "server-answers" : "game-answers");
    MpLog(Summary);
}

// Read-only, either tick-filter flag, game thread, every 10 s per connected player pawn: does the server ever run the edge
// recovery recorder? EdgeRecoveryTransformTimer (+0x1910, FTimerHandle, 0 = never set), LastValidPlayerTransform translation
// (+0x1880 + 0x10), BleedOutTImer (+0xE68) - BP_PlayerCharacter_C offsets, identical in the 1.12 and 1.14.7 SDKs.
// Expected with the game's answers: edgeTimer=0 and a stale lastValid. Unreadable fields are logged as such, not skipped.
static void MpEdgeRecoveryProbe(AActor* Pawn, int32_t ConnIndex) {
    const uintptr_t P = reinterpret_cast<uintptr_t>(Pawn);
    std::string Line = "[EdgeRecoveryProbe] conn=" + std::to_string(ConnIndex) + " pawn=" + MpPtr(Pawn);
    char Buf[160];
    if (IsReadablePointer(reinterpret_cast<void*>(P + 0x1910), 8)) {
        sprintf_s(Buf, " edgeTimer=0x%llX", static_cast<unsigned long long>(*reinterpret_cast<uint64_t*>(P + 0x1910)));
        Line += Buf;
    } else Line += " edgeTimer=unreadable";
    bool HaveLast = false;
    float Last[3] = {};
    if (IsReadablePointer(reinterpret_cast<void*>(P + 0x1890), 16)) {
        memcpy(Last, reinterpret_cast<const void*>(P + 0x1890), sizeof(Last));
        HaveLast = true;
        sprintf_s(Buf, " lastValid=(%.0f,%.0f,%.0f)", Last[0], Last[1], Last[2]);
        Line += Buf;
    } else Line += " lastValid=unreadable";
    const FVector Loc = Pawn->K2_GetActorLocation();
    sprintf_s(Buf, " pawnLoc=(%.0f,%.0f,%.0f)", Loc.X, Loc.Y, Loc.Z);
    Line += Buf;
    if (HaveLast) {
        const float dx = Loc.X - Last[0], dy = Loc.Y - Last[1], dz = Loc.Z - Last[2];
        sprintf_s(Buf, " dist=%.0f", std::sqrt(dx * dx + dy * dy + dz * dz));
        Line += Buf;
    }
    if (IsReadablePointer(reinterpret_cast<void*>(P + 0xE68), 8)) {
        sprintf_s(Buf, " bleedTimer=0x%llX", static_cast<unsigned long long>(*reinterpret_cast<uint64_t*>(P + 0xE68)));
        Line += Buf;
    } else Line += " bleedTimer=unreadable";
    MpLog(Line);
}

// [1.14.7 FIX 2026-10-04] The engine pointer, captured from the tick hook itself.
//
// The manual net tick has always called 0x00A82CF0 with Networking::NetDriver as the first argument:
//     reinterpret_cast<TickDispatchFn>(BaseAddress + 0x00A82CF0)(NetDriver, DeltaTime);
// but that function is NOT a net-driver dispatch - it is a ~4.6 KB engine/world tick whose first argument
// is a UGameEngine* (the same shape this hook receives). Passing the driver produced the measured
// behaviour: it read the socket (recvfrom <- 127.0.0.1:52155 len=29, because the bogus base happened to
// yield a usable world) and then faulted at [0+0x88]:
//     ManualTickDispatchSEH code=0xC0000005 params=0x0,0x88 regs{rax=0x0 ...}
// 0x88 is UNetDriver::ServerConnection, which Networking::Listen deliberately nulls - i.e. the code was
// following a client-style path off a garbage base. Calling it with the real engine is the correct fix.
// [2026-10-11 1.14.7 O0] Replication-graph sizes for [PerfDetail], every 2 s, game thread, read-only. Offsets verified on
// 1.14.7 (see MpDriveReplicationGraph and the relevance-settings layout block): NetDriver+0x6E8 graph (its +0x30 must
// be the driver), graph Connections {Data +0x38, Num +0x40}, GlobalActorReplicationInfoMap Num +0xC0+0x08, each
// connection manager's actor-info map Num +0x30+0x08, NetDriver ClientConnections {Data +0x90, Num +0x98} and each
// UNetConnection's OpenChannels.Num +0x78. Every read goes through the SEH helpers; nothing is written.
static void MpPerfSampleGraphCounts() {
    if (!Globals::AmServer || !Networking::NetDriver || !MpPerfDetailEnabled()) return;
    static uint64_t s_lastMs = 0;
    const uint64_t Now = GetTickCount64();
    if (s_lastMs != 0 && Now - s_lastMs < 2000) return;
    s_lastMs = Now;
    const uintptr_t Driver = reinterpret_cast<uintptr_t>(Networking::NetDriver);
    const uintptr_t Graph = SafeReadPtr(Driver, 0x6E8);
    if (!Graph || SafeReadPtr(Graph, 0x30) != Driver) return;
    const int32_t Conns = SafeReadI32At(Graph, 0x40);
    const uintptr_t ConnData = SafeReadPtr(Graph, 0x38);
    int32_t InfoSum = 0, InfoMax = 0;
    for (int32_t i = 0; ConnData && i < Conns && i < 1024; ++i) {
        const uintptr_t Mgr = SafeReadPtr(ConnData, static_cast<uintptr_t>(i) * sizeof(void*));
        if (!Mgr) continue;
        const int32_t N = SafeReadI32At(Mgr, 0x38);
        if (N < 0 || N > 1000000) continue;
        InfoSum += N;
        if (N > InfoMax) InfoMax = N;
    }
    const int32_t Clients = SafeReadI32At(Driver, 0x98);
    const uintptr_t ClientData = SafeReadPtr(Driver, 0x90);
    int32_t ChSum = 0, ChMax = 0;
    for (int32_t i = 0; ClientData && i < Clients && i < 1024; ++i) {
        const uintptr_t Conn = SafeReadPtr(ClientData, static_cast<uintptr_t>(i) * sizeof(void*));
        if (!Conn) continue;
        const int32_t N = SafeReadI32At(Conn, 0x78);
        if (N < 0 || N > 1000000) continue;
        ChSum += N;
        if (N > ChMax) ChMax = N;
    }
    g_perfGraphConns.store(Conns, std::memory_order_relaxed);
    g_perfGraphGlobalActors.store(SafeReadI32At(Graph, 0xC8), std::memory_order_relaxed);
    g_perfGraphActorInfoSum.store(InfoSum, std::memory_order_relaxed);
    g_perfGraphActorInfoMax.store(InfoMax, std::memory_order_relaxed);
    g_perfClientConns.store(Clients, std::memory_order_relaxed);
    g_perfOpenChannelsSum.store(ChSum, std::memory_order_relaxed);
    g_perfOpenChannelsMax.store(ChMax, std::memory_order_relaxed);
    g_perfGraphSampleMs.store(Now, std::memory_order_relaxed);
}

void GameEngineTickHook(UGameEngine* GameEngine, float DeltaTime, char CanRender) {
    // [2026-10-10 1.14.7 Perf] Frame interval for the [Perf] line (entry to entry, so it includes the engine's own frame
    // wait). One QPC read and a few relaxed atomics; no logging, allocation or lock on the game thread.
    if (Globals::AmServer) {
        LARGE_INTEGER PerfEntry{};
        QueryPerformanceCounter(&PerfEntry);
        MpPerfFrameSample(PerfEntry.QuadPart);
        // [2026-10-11 1.14.7 O3] New pointer-check epoch for this frame (see MpReadableThisFrame).
        if (g_MpReadableCacheMode < 0) {
            g_MpReadableCacheMode = MpExeRelativeFlagPresent(L"NO_FRAME_POINTER_CACHE.flag") ? 0 : 1;
            MpLog(std::string("[FramePointerCache] ")
                + (g_MpReadableCacheMode ? "ON: repeated net-driver/connection/graph pointer checks answered once per "
                                           "frame segment (NO_FRAME_POINTER_CACHE.flag reverts)"
                                         : "OFF (NO_FRAME_POINTER_CACHE.flag): every check calls VirtualQuery"));
        }
        g_MpReadableCacheThread = GetCurrentThreadId();
        MpReadableCacheNextEpoch();
    }
    if (GameEngine != nullptr && g_GameEnginePtr == nullptr) {
        g_GameEnginePtr = GameEngine;
    }
    static uint64_t tickCounter = 0;    ++tickCounter;

    // [DIAG 2026-07-09] Record the game-tick thread once so the exit-path hooks can
    // report whether TerminateProcess/ExitProcess is being called from the tick thread
    // (normal shutdown) or a background thread (libcef watchdog, etc.).
    DWORD CurTid = GetCurrentThreadId();
    InterlockedCompareExchange(
        reinterpret_cast<volatile LONG*>(&GameTickThreadId),
        static_cast<LONG>(CurTid),
        0);

    static bool tickHookLogged = false;
    if (!tickHookLogged) {
        tickHookLogged = true;
        MpLog("[GameEngineTick] first entry GameEngine=" + MpPtr(GameEngine)
            + " DeltaTime=" + std::to_string(DeltaTime)
            + " CanRender=" + std::to_string(static_cast<int>(CanRender))
            + " DoListen=" + std::to_string(Globals::DoListen ? 1 : 0)
            + " Listening=" + std::to_string(Globals::Listening ? 1 : 0)
            + " tid=" + std::to_string(CurTid));
    }

    // [1.14.7 client replication membership 2026-10-05] Bounded, read-only server probe: does the
    // replication graph's per-connection actor-info map ever hold the GameState and the PlayerState?
    // [2026-10-05] GATED OFF BY DEFAULT. Both of these walk the whole GObjects array (with several IsA
    // calls per object) every couple of seconds on the hub. Measured the same day: hubs started from the
    // builds that had them always-on began dying with the game-side access violation
    // `Dauntless-Win64-Shipping.exe+0x1091D5D` about two minutes in, while the earlier builds (which had
    // only the cheap pointer-read probes) did not. The faulting RIP is in the game binary, so this is a
    // load/timing trigger rather than a fault in these functions, but a diagnostic must not destabilise
    // the hub it is measuring. ENABLE_HUB_REP_DIAGNOSTICS.flag turns them back on for a dedicated run.
    // Split gating: the route function is cheap while no client is connected (it bails before it touches
    // GObjects) and it carries the only fix lever this session produced, so it may run for either flag.
    // The membership report is the heavy one (a full GObjects walk plus an IsA pass per object, several
    // times a minute) and only ever runs for the diagnostics flag.
    const bool HubRepDiag = Globals::AmServer && MpExeRelativeFlagPresent(L"ENABLE_HUB_REP_DIAGNOSTICS.flag");
    if (Globals::AmServer
        && (HubRepDiag || MpExeRelativeFlagPresent(L"ENABLE_BASE_ACTOR_BOOTSTRAP.flag"))) {
        MpRouteBaseActorsToConnections();
    }
    if (HubRepDiag) {
        MpReportReplicationMembership();
    }

    // The optional player-hosted mode may be ending the process (P2PHooks.h): skip the tick.
    if (Globals::AuthMode == Globals::ServerAuthMode::HuntCapability && P2PHooks::TickShutdown()) {
        return;
    }

    // [1.12.0] Force dedicated-server mode BEFORE the engine ticks. The client build's boot code
    // resets GIsServer/GIsClient back to client flags after Init() sets them once, so the net
    // driver was rejecting incoming connections (join -> "Failure received"). Re-assert every
    // frame here as the per-frame replacement for the disabled in-code patches (see InitServerHooks
    // #if 0 block above) so networking always ticks with server flags set.
    if (Globals::AmServer) {
        *(uint8_t*)(Globals::BaseAddress + 0x06E1EADA) = 0x1; // GIsServer
        *(uint8_t*)(Globals::BaseAddress + 0x06E1EAD9) = 0x0; // GIsClient
    }

    SanitizeNetDriverBeforeEngineTick();

    // [2026-10-10 1.14.7 Perf] Time the native engine tick for the [Perf] line; the call itself is unchanged.
    LARGE_INTEGER PerfEngine0{};
    if (Globals::AmServer) {
        MpReadableCacheNextEpoch();   // [2026-10-11 O3] the engine tick (and its GC) is its own pointer-check epoch
        QueryPerformanceCounter(&PerfEngine0);
    }
    reinterpret_cast<void(*)(UGameEngine*, float, char)>(OrigGameEngineTick)(GameEngine, DeltaTime, CanRender);
    if (Globals::AmServer) {
        LARGE_INTEGER PerfEngine1{};
        QueryPerformanceCounter(&PerfEngine1);
        if (PerfEngine1.QuadPart > PerfEngine0.QuadPart) {
            g_perfEngineCalls.fetch_add(1, std::memory_order_relaxed);
            g_perfEngineTicksSum.fetch_add(static_cast<uint64_t>(PerfEngine1.QuadPart - PerfEngine0.QuadPart), std::memory_order_relaxed);
            if (MpPerfDetailEnabled()) MpPerfPhaseAdd(g_perfPhaseEngine, PerfEngine0.QuadPart, PerfEngine1.QuadPart);
        }
        MpReadableCacheNextEpoch();   // [2026-10-11 O3] nothing remembered from inside the engine tick survives it
    }

    // [1.14.7 REPLICATION-GRAPH DRIVE] The engine's own TickFlush never dispatches to
    // UNetDriver::ReplicationDriver on this build, so drive the Archon graph here, once per frame,
    // immediately after the engine tick has finished its own net pass. See MpDriveReplicationGraph.
    if (Globals::AmServer) {
        DropStalePlayerControllerChannelQuarantine();
    }
    // [2026-10-11 1.14.7 O0] Timed for [PerfDetail]; the call itself is unchanged.
    const bool PerfDetail = Globals::AmServer && MpPerfDetailEnabled();
    const int64_t PerfGraph0 = PerfDetail ? MpQpcNow() : 0;
    MpDriveReplicationGraph(DeltaTime);
    if (PerfDetail) {
        MpPerfPhaseAdd(g_perfPhaseGraph, PerfGraph0, MpQpcNow());
        MpPerfSampleGraphCounts();
    }

    // [1.14.7 FIX 2026-10-10] Resume progression components parked before the configuration loaded.
    MpProgressionWaitPoll();
    MpArrivalTriggerServerProbe();   // read-only diagnostic, 40 s after each login
    MpHuntPassServerStateTick();     // read-only diagnostic, every 10 s, logs changes only

    // [2026-07-20] Server-side skeletal pose/socket fix (FORCE_SERVER_MESH_POSE.flag). Server-only; the
    // helper self-throttles + no-ops unless the flag is present. See its definition above.
    if (Globals::AmServer) {
        ForceServerMeshPose();
    }

    // [2026-07-20 TRIALS GRACE DIAG] Throttled bleedout sampler (SampleBleedoutGrace). Flag re-checked every
    // 256 ticks (incl. tick 1); sampled every 8 ticks while enabled. Server-only, read-only, __try-guarded.
    if (Globals::AmServer) {
        static uint32_t s_graceTick = 0;
        static bool s_graceOn = false;
        ++s_graceTick;
        if ((s_graceTick & 0xFF) == 1) s_graceOn = MpExeRelativeFlagPresent(L"TRIALS_GRACE_DIAG.flag");
        if (s_graceOn && (s_graceTick & 7) == 0) {
            SampleBleedoutGraceGuarded();
        }
    }

    // [2026-07-21] Server-side timeout-retry for ApplyPlayerRole (Omnicell/PlayerRole HUD gap).
    // See ApplyPlayerRoleHook + TickPlayerRoleRetries below for the full writeup. Throttled the
    // same way as the grace sampler above; the retry itself is further throttled per-entry inside
    // TickPlayerRoleRetries (kPlayerRoleRetryIntervalMs), so this outer check just avoids walking
    // the (usually empty) pending table every single tick.
    if (Globals::AmServer) {
        static uint32_t s_roleRetryTick = 0;
        if ((++s_roleRetryTick & 0x3F) == 0) {   // ~once/sec at 60fps
            TickPlayerRoleRetries();
            TickPlayerRolePostActivationRefresh();
            TickTempestModifierEnsure();
            TickEscalationBuffChoiceSpawn();
        }
    }

    // [2026-07-24 TEMPEST CHARGE/STACK DIAG] Sampled on a finer cadence than the ~1/sec block above:
    // a tap-V activation drops the charge for a single frame then it passively refills, so a 1/sec
    // sample would routinely miss the drop. Sample ~8x/sec; the function itself edge-triggers logging
    // (activation / CanActivate flip / 5s heartbeat) so the log stays sparse. No-ops unless
    // TEMPEST_CHARGE_DIAG.flag is present next to the exe.
    if (Globals::AmServer) {
        static uint32_t s_tempestDiagTick = 0;
        if ((++s_tempestDiagTick & 0x7) == 0) {
            TickTempestChargeDiag();
        }
    }

    // [2026-07-24] The ArchonInputActivate timeout fallback and the weapon-XP HUD refresh retry
    // that used to be gated on "!Globals::AmServer" right here NEVER RAN, on any process: this
    // hook's own MH_CreateHook is only called from InitServerHooks (see Init() near the bottom of
    // this file), so a real client process never installs this hook at all and the branch was dead
    // code — proven by a live capture showing zero [WeaponXP][HudInit] lines, not even the
    // unconditional heartbeat added specifically to prove the function was being reached. Both are
    // now driven from ProcessEventClientHook's existing client-local retry pump instead, which
    // already correctly works around this exact fact (see its 2026-07-22 OMNICELL comment).

    // [1.12.0] The pre-tick write above gets wiped out somewhere inside OrigGameEngineTick itself
    // (confirmed via [NetDiag]: it still read GIsServer=0/GIsClient=1 AFTER the original tick
    // returned, even though we forced 1/0 right before calling it). Re-force here too, immediately
    // before TickNetworking/TickDispatch actually process the connection, so the net driver sees
    // server flags at the moment it matters.
    if (Globals::AmServer) {
        *(uint8_t*)(Globals::BaseAddress + 0x06E1EADA) = 0x1; // GIsServer
        *(uint8_t*)(Globals::BaseAddress + 0x06E1EAD9) = 0x0; // GIsClient
    }

    // [Group B cleanup 2026-07-13] Timed server LoadManager/lifecycle GObjects-dump block removed
    // (DumpLifecycleState + DumpLoadManagerViaGObjects — obsolete Phase-0 readiness scanners, gated off).

    // [2026-10-10 1.14.7 CPU] F7 GObjects dump: client-only. GetAsyncKeyState reads the shared desktop key state, so
    // F7 pressed in ANY window made every local hub/hunt walk all ~208k objects and then busy-wait on its game thread
    // until the key was released (no tick, no net, no graph drive). This hook is installed only by InitServerHooks,
    // so on today's builds the handler never runs at all.
    if (!Globals::AmServer && GetAsyncKeyState(VK_F7)) {
        for (int i = 0; i < SDK::UObject::GObjects->Num(); i++)
        {
            SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);

            if (!Obj)
                continue;

            if (Obj->IsA(SDK::AActor::StaticClass()))
            {
                AActor* Quest = (AActor*)Obj;

                if (Quest->Role != ENetRole::ROLE_Authority) {
                    std::cout << (int)(uint8_t)Quest->Role << std::endl;

                    std::cout << Quest->GetFullName() << std::endl;
                }
            }
        }

        while (GetAsyncKeyState(VK_F7)) {

        }
    }

    if (Globals::Listening) {
        // [1.12.0 player-host roster gate] Keep ExpectedPlayerCount synchronized with the
        // concrete launch roster. The previous blanket zero forced a two-player hunt to enter
        // InProgress as soon as P1 arrived; an SDR joiner arriving a few seconds later then hit
        // the fragile late-join PlayerController-channel path and closed control channel 0.
        // A launch string with two `uid:huntId` entries must therefore remain at 2 until both
        // initial party members arrive. Persistent hubs carry NO_EXPECTED_PLAYERS and remain 0.
        //
        // Verified per SDK/Archon_classes.hpp (static_asserted in Assertions.inl):
        //   AArchonGameMode::ExpectedPlayerCount   at +0x0498  (Archon_classes.hpp:16653)
        //   AArchonGameState::ExpectedPlayerCount  at +0x02E8  (Archon_classes.hpp:18683, Net-replicated)
        // Ramsgate/Dojo use AArchonGameMode_City and AArchonGameMode_Island, both of which
        // inherit from AArchonGameMode, so IsA(AArchonGameMode::StaticClass()) covers them.
        //
        // Rewritten every frame as belt-and-braces against InitGame or replication restoring the native
        // default of 1. We keep the existing UArchonLoadManager::LoadFailed compatibility hook unchanged.
        // [2026-10-10 1.14.7 CPU] The objects now come from the world itself: GWorld->AuthorityGameMode (+0x118)
        // and GWorld->GameState (+0x120), the only GameMode the engine consults and the only GameState it
        // replicates. The previous lookup walked every GObjects entry (~208k on Ramsgate) with two IsA calls each
        // on EVERY frame (the old comment called that "cheap, ~one-time"; it was neither). Same values, same
        // fields, same compare-then-write, same one-time log text. A frame with no readable world writes nothing
        // and the next frame writes. MpExpectedPlayerWorldCensus logs a one-shot cross-check (10 s after listen
        // and at the first K2_PostLogin). LEGACY_EXPECTED_PLAYER_WALK.flag (read once) restores the full walk.
        // [A/B 2026-07-16] DISABLE_EXPECTED_PLAYER_ZERO.flag — when present next to the game .exe,
        // skip synchronization so the native session/load-manager state is left intact for an
        // A/B. Cached once (this runs every tick). Default OFF (absent flag = roster sync).
        static int s_disableExpectedZero = -1;
        static int s_launchExpectedPlayers = -1;
        if (s_disableExpectedZero < 0) {
            s_disableExpectedZero = MpExeRelativeFlagPresent(L"DISABLE_EXPECTED_PLAYER_ZERO.flag") ? 1 : 0;
            s_launchExpectedPlayers = LaunchExpectedPlayerCount();
            MpLog(std::string("[ExpectedPlayerCount] DISABLE_EXPECTED_PLAYER_ZERO.flag ")
                + (s_disableExpectedZero ? "PRESENT -> roster sync DISABLED (native session state preserved)"
                                         : "absent -> roster sync ENABLED (default)")
                + " launchRosterCount=" + std::to_string(s_launchExpectedPlayers));
        }
        static int s_legacyExpectedWalk = -1;
        if (s_legacyExpectedWalk < 0) {
            s_legacyExpectedWalk = MpExeRelativeFlagPresent(L"LEGACY_EXPECTED_PLAYER_WALK.flag") ? 1 : 0;
            MpLog(std::string("[ExpectedPlayerCount] lookup = ")
                + (s_legacyExpectedWalk ? "full GObjects walk every frame (LEGACY_EXPECTED_PLAYER_WALK.flag present)"
                                        : "world pointers GWorld+0x118 / +0x120 (default)"));
        }

        static bool s_loggedGameMode  = false;
        static bool s_loggedGameState = false;
        if (s_disableExpectedZero == 0 && s_legacyExpectedWalk == 0) {
            SDK::UWorld* World = SDK::UWorld::GetWorld();   // Offsets::GWorld 0x06FC7F58
            if (World && IsReadablePointer(World, 0x128)) {
                const uintptr_t W = reinterpret_cast<uintptr_t>(World);
                MpSyncExpectedPlayerField(*reinterpret_cast<SDK::UObject**>(W + 0x118), SDK::AArchonGameMode::StaticClass(),
                    0x0498, "GameMode", "+0x0498", s_loggedGameMode, s_launchExpectedPlayers);
                MpSyncExpectedPlayerField(*reinterpret_cast<SDK::UObject**>(W + 0x120), SDK::AArchonGameState::StaticClass(),
                    0x02E8, "GameState", "+0x02E8", s_loggedGameState, s_launchExpectedPlayers);
            }
        }
        // One-shot read-only census (both lookups): 10 s after the first listening frame, and once after the
        // first K2_PostLogin (g_postLoginTimeMs is set by the server ProcessEvent hook).
        {
            static uint64_t s_censusListenMs = 0;
            static bool s_censusListenDone = false;
            static bool s_censusLoginDone = false;
            const uint64_t NowMs = GetTickCount64();
            if (s_censusListenMs == 0) s_censusListenMs = NowMs;
            if (!s_censusListenDone && NowMs - s_censusListenMs >= 10000) {
                s_censusListenDone = true;
                MpExpectedPlayerWorldCensus("listen+10s");
            }
            if (!s_censusLoginDone && g_postLoginTimeMs.load(std::memory_order_relaxed) != 0) {
                s_censusLoginDone = true;
                MpExpectedPlayerWorldCensus("first-postlogin");
            }
        }

        if (s_disableExpectedZero == 0 && s_legacyExpectedWalk == 1 && SDK::UObject::GObjects) {
            const int Count = SDK::UObject::GObjects->Num();
            for (int i = 0; i < Count; i++) {
                SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
                if (!Obj) continue;
                if (Obj->IsDefaultObject()) continue;

                if (Obj->IsA(SDK::AArchonGameMode::StaticClass())) {
                    int32_t* Field = reinterpret_cast<int32_t*>(
                        reinterpret_cast<uintptr_t>(Obj) + 0x0498);
                    if (IsReadablePointer(Field, sizeof(int32_t))) {
                        int32_t Before = *Field;
                        if (Before != s_launchExpectedPlayers) {
                            *Field = s_launchExpectedPlayers;
                            if (!s_loggedGameMode) {
                                s_loggedGameMode = true;
                                MpLog("[ExpectedPlayerCount@GameMode] synchronized  instance=" + MpPtr(Obj)
                                    + " class=" + Obj->Class->GetName()
                                    + " before=" + std::to_string(Before)
                                    + " after=" + std::to_string(s_launchExpectedPlayers)
                                    + " offset=+0x0498");
                            }
                        }
                    }
                }

                if (Obj->IsA(SDK::AArchonGameState::StaticClass())) {
                    int32_t* Field = reinterpret_cast<int32_t*>(
                        reinterpret_cast<uintptr_t>(Obj) + 0x02E8);
                    if (IsReadablePointer(Field, sizeof(int32_t))) {
                        int32_t Before = *Field;
                        if (Before != s_launchExpectedPlayers) {
                            *Field = s_launchExpectedPlayers;
                            if (!s_loggedGameState) {
                                s_loggedGameState = true;
                                MpLog("[ExpectedPlayerCount@GameState] synchronized  instance=" + MpPtr(Obj)
                                    + " class=" + Obj->Class->GetName()
                                    + " before=" + std::to_string(Before)
                                    + " after=" + std::to_string(s_launchExpectedPlayers)
                                    + " offset=+0x02E8");
                            }
                        }
                    }
                }
            }
        }

        static int netTickTraceBudget = 180;
        int32_t preConnectionCount = -1;
        int32_t preConnectionMax = -1;

        if (Networking::NetDriver &&
            MpReadableThisFrame(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x98), sizeof(int32_t) * 2)) {
            preConnectionCount = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x98);
            preConnectionMax = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x9C);
        }

        // [A/B 2026-07-16] Edge-triggered connection-count trace. The budget trace below only
        // covers the first 180 boot ticks (all connCount=0), so it never captured the 2-player
        // join. Log ONLY when the client-connection count changes, so every join/leave is visible
        // for the whole session without the per-tick spam removed in Phase 0k. This is the
        // primary evidence for the A/B: does connCount actually reach 2, and when?
        // Publish the remote connection count for the empty-instance watchdog (see g_wdConnCount).
        if (preConnectionCount >= 0) {
            g_wdConnCount.store(preConnectionCount, std::memory_order_relaxed);
            const uint64_t ConnNowMs = GetTickCount64();
            g_wdConnStampMs.store(ConnNowMs, std::memory_order_relaxed);
            if (preConnectionCount > 0) {
                g_wdHadRemoteClient.store(true, std::memory_order_relaxed);
                g_wdLastRemoteConnMs.store(ConnNowMs, std::memory_order_relaxed);   // [2026-10-10 RAM] trim re-arm
            }
        }
        {
            static int32_t s_lastConnCount = -2;   // -2 = uninitialized (distinct from -1 = unreadable)
            if (preConnectionCount != s_lastConnCount) {
                MpLog("[NetConnEdge] tick=" + std::to_string(tickCounter)
                    + " connCount " + std::to_string(s_lastConnCount)
                    + " -> " + std::to_string(preConnectionCount)
                    + " connMax=" + std::to_string(preConnectionMax)
                    + " NetDriver=" + MpPtr(Networking::NetDriver));
                // [2026-07-16] Snapshot game-mode/session/state at every join/leave edge so the
                // P1-leave -> P2-enable transition (and how the one-expected-player init gates P2)
                // is visible in the log.
                // [2026-10-11 O2] World-pointer lookup now (LogArchonLifecycle); off with PRODUCTION_LOG_PROFILE.flag.
                if (!MpProductionLogProfile()) {
                    LogArchonLifecycle(("ConnEdge " + std::to_string(s_lastConnCount) + "->" + std::to_string(preConnectionCount)).c_str());
                }
                s_lastConnCount = preConnectionCount;
            }
        }

        // [1.14.7 2026-10-05] Self-throttled to one line per 2s and only while a client connection
        // exists; runs on both hub ports but logs nothing until someone joins.
        MpSendPathDiag();

        // [2026-07-16] MatchState-change trace: catch GameMode MatchState transitions between
        // connection edges (e.g. WaitingToStart -> InProgress, and whatever flips at P1-leave to
        // enable P2). Cheap: once the GameMode is cached, each tick compares one int (the FName
        // ComparisonIndex at +0x2C0); only on a change do we ToString + snapshot. The GObjects walk
        // to (re)find the GameMode is throttled to ~1/sec and only runs while it is missing/stale.
        {
            static AArchonGameMode* s_gm = nullptr;
            static uint64_t s_lastFindMs = 0;
            static int32_t s_lastMatchIdx = -0x7fffffff;
            uint64_t nowMs = static_cast<uint64_t>(GetTickCount64());

            // Readability alone does not establish UObject liveness: after a world transition,
            // a stale GameMode pointer can still reference mapped memory while its Class field
            // has already been invalidated. Validate both UObject slots before IsA dereferences
            // the class/superclass chain; a stale cache then falls through to the GObjects lookup.
            bool gmOk = s_gm && IsRegisteredLiveObject(s_gm) && IsReadablePointer(s_gm, 0x4A0)
                && IsRegisteredLiveObject(s_gm->Class) && s_gm->IsA(AArchonGameMode::StaticClass());
            if (!gmOk && (nowMs - s_lastFindMs) > 1000) {
                s_lastFindMs = nowMs;
                s_gm = nullptr;
                // [2026-10-11 1.14.7 O2] The world's AuthorityGameMode (+0x118) instead of a ~208k-object walk once a
                // second while it is missing (boot, map change). LEGACY_LIFECYCLE_WALK.flag keeps the walk.
                if (!MpLegacyLifecycleWalk()) {
                    SDK::UObject* WorldGm = nullptr;
                    SDK::UObject* WorldGs = nullptr;
                    MpWorldGameModeAndState(WorldGm, WorldGs);
                    s_gm = reinterpret_cast<AArchonGameMode*>(WorldGm);
                } else if (SDK::UObject::GObjects) {
                    const int n = SDK::UObject::GObjects->Num();
                    for (int i = 0; i < n; i++) {
                        SDK::UObject* o = SDK::UObject::GObjects->GetByIndex(i);
                        if (!o || o->IsDefaultObject()) { continue; }
                        if (o->IsA(AArchonGameMode::StaticClass())) { s_gm = reinterpret_cast<AArchonGameMode*>(o); break; }
                    }
                }
                gmOk = s_gm && IsReadablePointer(s_gm, 0x4A0);
            }

            if (gmOk) {
                int32_t idx = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(s_gm) + 0x02C0);
                if (idx != s_lastMatchIdx) {
                    std::string ms = reinterpret_cast<SDK::FName*>(reinterpret_cast<uintptr_t>(s_gm) + 0x02C0)->ToString();
                    MpLog("[MatchStateChange] tick=" + std::to_string(tickCounter) + " -> " + ms
                        + " (idx " + std::to_string(s_lastMatchIdx) + "->" + std::to_string(idx) + ")");
                    if (!MpProductionLogProfile()) LogArchonLifecycle(("MatchState=" + ms).c_str());   // [2026-10-11 O2/O3]
                    s_lastMatchIdx = idx;
                }
            }
        }

        // [2026-07-19] VERBOSE_DIAG-gated: budget alone still emitted a burst every launch.
        bool traceNetTick = VerboseDiag() && netTickTraceBudget > 0;   // [Phase 0k] budget-only; removed "|| preConnectionCount>0" which kept it on every tick forever (21k lines/min, contaminated lag)
        if (traceNetTick && netTickTraceBudget > 0) {
            --netTickTraceBudget;
        }

        if (traceNetTick) {
            MpLog("[NetTickTrace] tick=" + std::to_string(tickCounter)
                + " before TickNetworking NetDriver=" + MpPtr(Networking::NetDriver)
                + " connCount=" + std::to_string(preConnectionCount)
                + " connMax=" + std::to_string(preConnectionMax)
                + " GIsServer=" + std::to_string(*(uint8_t*)(Globals::BaseAddress + 0x06E1EADA))
                + " GIsClient=" + std::to_string(*(uint8_t*)(Globals::BaseAddress + 0x06E1EAD9)));
        }

        Networking::TickNetworking();

        if (traceNetTick) {
            MpLog("[NetTickTrace] tick=" + std::to_string(tickCounter) + " after TickNetworking");
        }

        if (traceNetTick) {
            MpLog("[NetTickTrace] tick=" + std::to_string(tickCounter)
                + " before TickDispatch fn=" + MpAddress(reinterpret_cast<void*>(Globals::BaseAddress + 0x00A82CF0)));
        }

        // [2026-07-19] MANUAL_TICK_HALF_RATE: skip the manual drive on odd frames so the graph is
        // invoked ~once per network frame. Counter is per-process and only advances here.
        static uint64_t s_manualTickFrame = 0;
        const bool SkipManualDriveThisFrame = ManualTickHalfRate() && ((++s_manualTickFrame & 1ull) != 0ull);

        bool tickDispatchOk = true;
        if (SkipManualDriveThisFrame) {
            tickDispatchOk = false;   // nothing dispatched this frame by us; native tick still ran
        }
        else if (!SanitizeNetDriverClientConnections(Networking::NetDriver, "GameEngineTickBeforeTickDispatch")) {
            MpLog("[NetTickTrace] tick=" + std::to_string(tickCounter)
                + " skipped TickDispatch after sanitizing unsafe NetDriver state");
            tickDispatchOk = false;
        }
        // [2026-07-19] MANUAL_TICK_ZERO_DT: pass 0 so the manual call does not advance the
        // NetDriver's ElapsedTime a second time this frame. See ManualTickZeroDeltaTime().
        else if (s_inManualTick) {
            // [1.14.7 FIX 2026-10-04] Re-entrant tick. The manual drive routes through the world/net path,
            // which can come back here. Without this the recursion is unbounded and the failure is stack
            // exhaustion rather than a bad pointer: "[ManualTickDispatchSEH] code=0xC0000005
            // address=ucrtbase.dll+0xD8AE params=0x0,0xFFFFFFFFFFFFFFFF", whose bytes are
            // "66 0F 7F 85 F0 03 00 00  movdqa [rbp+0x3F0], xmm0" - a CRT routine writing a large stack frame
            // and faulting on the frame itself. Re-entering is never useful, so do nothing this tick.
        }
        else {
            // [1.14.7 CORRECTION 2026-10-04] s_inManualTick is now actually SET. It was declared and tested
            // but never assigned, so the guard above was inert - a correction from the audit, and the reason
            // "reentrancy guard added" had no observable effect. It is cleared on every path, so the call is
            // wrapped in an explicit block rather than folded into the condition.
            s_inManualTick = true;
            const int64_t PerfDispatch0 = PerfDetail ? MpQpcNow() : 0;   // [2026-10-11 O0] timed for [PerfDetail]
            const bool TickOk = SafeManualTickDispatch(Networking::NetDriver,
                ManualTickZeroDeltaTime() ? 0.0f : DeltaTime);
            if (PerfDetail) MpPerfPhaseAdd(g_perfPhaseDispatch, PerfDispatch0, MpQpcNow());
            MpReadableCacheNextEpoch();   // [2026-10-11 O3] the dispatch ran game code: fresh pointer checks after it
            s_inManualTick = false;
            if (!TickOk) {
                ReportManualNetTickFailure(false, tickCounter);
                tickDispatchOk = false;
            }
            else {
                ReportManualNetTickRecovery(false, tickCounter);
            }
        }

        if (traceNetTick) {
            int32_t postConnectionCount = -1;
            if (Networking::NetDriver &&
                IsReadablePointer(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x98), sizeof(int32_t))) {
                postConnectionCount = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x98);
            }

            MpLog("[NetTickTrace] tick=" + std::to_string(tickCounter)
                + " after TickDispatch ok=" + std::to_string(tickDispatchOk ? 1 : 0)
                + " connCount=" + std::to_string(postConnectionCount));
        }

        // [1.12.0] Send-side pair for TickDispatch. Original UGameEngine::Tick path drives
        // TickFlush via UWorld::Tick -> UNetDriver::TickFlush, but our custom net-tick path
        // was only calling TickDispatch. Without this, ServerReplicateActors never runs and
        // per-connection outgoing queues never flush -- the client sees the loading screen
        // freeze because NMT_Welcome / pawn replication / "loading done" packets sit queued
        // on the server forever (observed as InSeq climbing while NextOutGoingSeq is frozen).
        if (traceNetTick) {
            MpLog("[NetTickTrace] tick=" + std::to_string(tickCounter)
                + " before TickFlush fn=" + MpAddress(reinterpret_cast<void*>(Globals::BaseAddress + 0x03FAE700)));
        }

        bool tickFlushOk = true;
        if (SkipManualDriveThisFrame) {
            tickFlushOk = false;
        }
        else if (!SanitizeNetDriverClientConnections(Networking::NetDriver, "GameEngineTickBeforeTickFlush")) {
            MpLog("[NetTickTrace] tick=" + std::to_string(tickCounter)
                + " skipped TickFlush after sanitizing unsafe NetDriver state");
            tickFlushOk = false;
        }
        else {
            // [2026-10-11 1.14.7 O0] Timed for [PerfDetail]; same call, same failure/recovery reporting.
            const int64_t PerfFlush0 = PerfDetail ? MpQpcNow() : 0;
            const bool FlushOk = SafeManualTickFlush(Networking::NetDriver, DeltaTime);
            if (PerfDetail) MpPerfPhaseAdd(g_perfPhaseFlush, PerfFlush0, MpQpcNow());
            MpReadableCacheNextEpoch();   // [2026-10-11 O3]
            if (!FlushOk) {
                ReportManualNetTickFailure(true, tickCounter);
                tickFlushOk = false;
            }
            else {
                ReportManualNetTickRecovery(true, tickCounter);
            }
        }

        if (traceNetTick) {
            MpLog("[NetTickTrace] tick=" + std::to_string(tickCounter)
                + " after TickFlush ok=" + std::to_string(tickFlushOk ? 1 : 0));
        }

        static bool netDiagLogged = false;
        if (!netDiagLogged) {
            netDiagLogged = true;
            MpLog(std::string("[NetDiag] GIsServer=") + std::to_string(*(uint8_t*)(Globals::BaseAddress + 0x06E1EADA))
                + " GIsClient=" + std::to_string(*(uint8_t*)(Globals::BaseAddress + 0x06E1EAD9)));
        }
    }

    // [1.14.7 A/B 2026-10-03] The hub logs "WorldContext requested with invalid context object" from
    // tick 1 onwards, immediately after this manual Listen, and that message does not exist in any
    // archived 1.12 hub log. Everything downstream (player-data loaders never completing, the map
    // reload failing, the port closing) is consistent with an invalid world context, so this flag
    // isolates whether OUR listen is what invalidates it: with the flag present the manual Listen is
    // skipped entirely and the boot can be compared. Diagnostic only.
    if (Globals::DoListen && MpExeRelativeFlagPresent(L"DISABLE_MANUAL_LISTEN.flag")) {
        Globals::DoListen = false;
        MpLog("[GameEngineTick] manual Networking::Listen SKIPPED (DISABLE_MANUAL_LISTEN.flag) - A/B");
    }

    // [1.14.7 2026-10-03] Engine-listener path: the map URL carries ?listen (GetGameDefaultMap), so
    // the engine creates the GameNetDriver during map load. Skip the manual path and announce READY
    // only once UWorld::NetDriver (UWorld+0x38) actually exists; the harness independently confirms
    // the port is bound, so this never announces a listener that is not there.
    // [2026-10-11] Never on a player-hosted server (MpMapUrlListenEnabled): it listens manually below.
    if (Globals::DoListen && MpMapUrlListenEnabled()) {
        Globals::DoListen = false;
        Globals::WaitingForEngineListener = true;
        MpLog("[GameEngineTick] manual Listen skipped; waiting for the ENGINE listener (?listen map URL)");
    }

    if (Globals::WaitingForEngineListener) {
        void* ListenWorld = UWorld::GetWorld();
        void* EngineNetDriver = ListenWorld
            ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(ListenWorld) + 0x38)   // UWorld::NetDriver
            : nullptr;
        if (EngineNetDriver != nullptr) {
            Globals::WaitingForEngineListener = false;
            Globals::Listening = true;
            MpLog("[GameEngineTick] engine NetDriver present at " + MpPtr(EngineNetDriver)
                + " (UWorld+0x38); announcing READY");
            Networking::AnnounceEngineReady(static_cast<int>(Globals::Port));
            StartEmptyWatchdogThread();
            return;
        }
    }

    if (Globals::DoListen) {
        Globals::DoListen = false;

        MpLog("[GameEngineTick] calling Networking::Listen(port=" + std::to_string(Globals::Port) + ")");
        const bool ListenReady = Networking::Listen(UEngine::GetEngine(), Globals::Port);
        MpLog(std::string("[GameEngineTick] Networking::Listen returned ") + (ListenReady ? "OK" : "FAIL"));

        if (!ListenReady) {
            if (Globals::AuthMode == Globals::ServerAuthMode::HuntCapability) {
                P2PHooks::OnListenFailed();
            }
            return;
        }

        Globals::Listening = true;
        MpLog("[GameEngineTick] Listening armed; skipping post-listen watchdog this tick");
        // [2026-07-18] Kick off the tick-independent empty-server watchdog now that this instance is a
        // live listen server. Runs once; self-terminates the process after 50s continuous emptiness even
        // if the game/net tick stalls when the last player leaves (the failure that leaked hunt slots).
        StartEmptyWatchdogThread();
        return;
    }

    if (Globals::Listening && Networking::NetDriver) {
        bool HasConnection = false;

        auto ClientConnectionData = *reinterpret_cast<UNetConnection***>((uintptr_t)Networking::NetDriver + 0x90);
        int32_t ClientConnectionCount = *reinterpret_cast<int32_t*>((uintptr_t)Networking::NetDriver + 0x98);
        int32_t ClientConnectionMax = *reinterpret_cast<int32_t*>((uintptr_t)Networking::NetDriver + 0x9C);

        if (!IsSanePointerArray(ClientConnectionData, ClientConnectionCount, ClientConnectionMax, 1024)) {
            MpLog("[GameEngineTick] Invalid ClientConnections array; skipping watchdog/stamina");
        }
        else {
            for (int32_t Index = 0; Index < ClientConnectionCount; ++Index) {
                UNetConnection* Connection = ClientConnectionData[Index];
                if (!MpReadableThisFrame(Connection, 0x140)) {   // [2026-10-11 O3] once per frame segment
                    continue;
                }

                if (!Connection->OwningActor || *(uint32_t*)((uintptr_t)Connection + 0x134) != 3)
                    continue;

                HasConnection = true;
            }

            if (EnableWatchdog) {
                // Empty detection: trust the authoritative GameMode player count when we have it (fixes
                // the zombie-connection case where HasConnection stayed stuck TRUE after players traveled
                // out, so the server never self-terminated). Only fall back to the connection scan while
                // the GameMode isn't found yet (-1). Counting travelling players keeps a still-loading
                // instance from being reaped.
                int EmptyState = GameModeEmptyState();               // 1 empty, 0 occupied, -1 unknown
                bool IsEmpty = (EmptyState == 1) || (EmptyState == -1 && !HasConnection);

                if (IsEmpty) {
                    TotalNoPlayersTime += DeltaTime;

                    // Reap only CONFIRMED disposable instances (g_wdIsHub==0). Persistent hubs (ramsgate
                    // BPGM_City_C / training BPGM_ArchonTrainingGrounds_C => hub==1) and not-yet-classified
                    // (hub==-1) are NEVER self-terminated here — the DeployServer owns the hub lifecycle,
                    // and reaping a hub mid-travel would vanish it under a returning player. (The background
                    // thread applies the same hub==0 gate and is the reliable reaper once the tick stops.)
                    // [2026-10-16] The same limit as the background thread (MP_WD_EMPTY_REAP_SEC): 0.2.139 changed only the
                    // thread, so this path still reaped at 50 s (verification hunt 15 Oct 18:35:39 UTC).
                    if (TotalNoPlayersTime >= MP_WD_EMPTY_REAP_SEC && g_wdIsHub.load(std::memory_order_relaxed) == 0) {
                        // Empty for 50s CONTINUOUS -> self-terminate so the DeployServer reclaims the
                        // port + ~1GB of RAM. Fires ONLY when no one is connected/incoming, so an active
                        // hunt never triggers it no matter how long or how big the map.
                        // Same teardown reasoning as the background thread's reap — see MpReapExit.
                        MpReapExit(("tick-path: disposable instance empty " + std::to_string(static_cast<int>(MP_WD_EMPTY_REAP_SEC))
                            + "s continuous (gmState="
                            + std::to_string(EmptyState) + ")").c_str());
                    }
                }
                else {
                    // Reset on ANY occupancy signal so the 50s window measures CONTINUOUS emptiness, not
                    // cumulative. Without this, brief empty moments summed across a long hunt could reach
                    // 50s and kill an ACTIVE hunt mid-fight (big maps / long hunts) - the failure to avoid.
                    TotalNoPlayersTime = 0.0f;
                }
            }

            // [2026-10-10 1.14.7] Tick-filter opt-in modes (TICK_FILTER_CENSUS.flag / SERVER_TICK_FILTER.flag): one
            // [EdgeRecoveryProbe] round every 10 s. Nothing here runs when neither flag installed the hook.
            bool EdgeProbeRound = false;
            if (MpTickFilterHookActive()) {
                static ULONGLONG s_edgeProbeLast = 0;
                const ULONGLONG NowMs = GetTickCount64();
                if (NowMs - s_edgeProbeLast >= 10000) { s_edgeProbeLast = NowMs; EdgeProbeRound = true; }
            }
            for (int32_t Index = 0; Index < ClientConnectionCount; ++Index) {
                UNetConnection* Conn = ClientConnectionData[Index];
                if (!MpReadableThisFrame(Conn, 0x140)) {   // [2026-10-11 O3] once per frame segment
                    continue;
                }

                if (Conn->PlayerController && Conn->PlayerController->Pawn && Conn->PlayerController->Pawn->IsA(ABP_PlayerCharacter_C::StaticClass())) {
                    // [2026-10-10 1.14.7] With SERVER_TICK_FILTER.flag the character's own tick runs TickStamina once per
                    // actor tick (its ServerOnly/LocalOrServer branch now passes); calling it here as well would evaluate
                    // stamina twice per frame. The manual call stays until the player class is cached (the fix answers
                    // like the game before that), and always without the flag.
                    MpTickFilterCachePlayerClass(ABP_PlayerCharacter_C::StaticClass());
                    if (!(g_ServerTickFilterActive.load(std::memory_order_relaxed)
                          && g_TickFilterPlayerClass.load(std::memory_order_relaxed))) {
                        ((ABP_PlayerCharacter_C*)Conn->PlayerController->Pawn)->TickStamina(ECityExecFilter::Both, ERemoteExecFilter::All);
                    } else {
                        static bool s_staminaSkipLogged = false;
                        if (!s_staminaSkipLogged) {
                            s_staminaSkipLogged = true;
                            MpLog("[TickFilter] manual TickStamina skipped (SERVER_TICK_FILTER.flag): the character's own tick runs it");
                        }
                    }
                    if (EdgeProbeRound) MpEdgeRecoveryProbe(Conn->PlayerController->Pawn, Index);
                    // [2026-07-17 co-op smoothness] Measured: player pawns replicate ~10Hz (period 3) vs the
                    // behemoth ~30Hz. Raise the pawn's NetUpdateFrequency (+0x108) / MinNetUpdateFrequency
                    // (+0x10C) so the graph gives it period 1 (~30Hz, capped by NetServerMaxTickRate). Every
                    // player pawn is boosted (loop covers all connections). Flag-gated A/B.
                    if (PlayerRepBoost()) {
                        AActor* pawn = Conn->PlayerController->Pawn;
                        if (IsReadablePointer(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(pawn) + 0x110), 4)) {
                            *reinterpret_cast<float*>(reinterpret_cast<uintptr_t>(pawn) + 0x108) = 60.0f; // NetUpdateFrequency
                            *reinterpret_cast<float*>(reinterpret_cast<uintptr_t>(pawn) + 0x10C) = 30.0f; // MinNetUpdateFrequency
                        }
                    }
                }
            }
        }
        MpTickFilterCensusTick();   // TICK_FILTER_CENSUS.flag only; once a minute
    }
}

void InteractionCalloutHideHoldTextHook(void* Widget) {
    if (!IsReadablePointer(Widget, 0x3C8)) {
        MpLog("[InteractionCalloutHideHoldText] skipping unreadable widget=" + MpPtr(Widget));
        return;
    }

    void* HoldTextController = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Widget) + 0x3C0);
    if (!IsReadablePointer(HoldTextController, sizeof(void*))) {
        MpLog("[InteractionCalloutHideHoldText] skipping null/unreadable widget+0x3C0 widget="
            + MpPtr(Widget)
            + " member=" + MpPtr(HoldTextController));
        return;
    }

    reinterpret_cast<void(*)(void*)>(OrigInteractionCalloutHideHoldText)(Widget);
}

// UArchonLoadingScreen::ScreenFadeIn at RVA 0x01CADE20.
//
// On DEDICATED SERVER (-nullrhi Ramsgate/Dojo): fade-widget slots at LoadingScreen+0x3E0
// and +0x3E8 are null (no viewport, no UI) and the original function crashes at
// RVA 0x01CADEA6 trying to deref +0x3E8. We suppress in that case.
//
// On CLIENT: both widget pointers ARE valid. Suppressing here blocks the loading-screen
// state machine from advancing (screen never finishes fading -> subsequent
// "loaded, hide screen" transitions never fire -> client stuck on loading art forever).
// So on client we must call through to the original.
//
// Decision: gate purely on widget validity - if the widget the original will deref is
// non-null and readable, call the original; otherwise suppress. This works correctly
// whether AmServer is 0 or 1 and doesn't rely on that global being set yet at first call.
void ArchonLoadingScreenFadeInHook(void* LoadingScreen, uint8_t FadeMode) {
    void* PrimaryFadeWidget = nullptr;
    void* SecondaryFadeWidget = nullptr;

    if (IsReadablePointer(LoadingScreen, 0x3F0)) {
        PrimaryFadeWidget = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(LoadingScreen) + 0x3E8);
        SecondaryFadeWidget = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(LoadingScreen) + 0x3E0);
    }

    // Server-null-crash guard: if either widget slot is null, the original will crash
    // when it derefs LoadingScreen+0x3E8. Suppress in that case only.
    const bool WidgetsValid =
        LoadingScreen != nullptr &&
        PrimaryFadeWidget != nullptr &&
        SecondaryFadeWidget != nullptr &&
        IsReadablePointer(PrimaryFadeWidget, sizeof(void*)) &&
        IsReadablePointer(SecondaryFadeWidget, sizeof(void*));

    if (!WidgetsValid) {
        MpLog("[ArchonLoadingScreenFadeIn] suppressed (null-widget guard) loadingScreen="
            + MpPtr(LoadingScreen)
            + " primary(+0x3E8)=" + MpPtr(PrimaryFadeWidget)
            + " secondary(+0x3E0)=" + MpPtr(SecondaryFadeWidget)
            + " mode=" + std::to_string(FadeMode));
        return;
    }

    // Log first pass-through per mode so we can see fade-in/out transitions on client.
    static bool s_loggedMode[256] = {};
    if (!s_loggedMode[FadeMode]) {
        s_loggedMode[FadeMode] = true;
        MpLog("[ArchonLoadingScreenFadeIn] pass-through (widgets valid) loadingScreen="
            + MpPtr(LoadingScreen)
            + " primary(+0x3E8)=" + MpPtr(PrimaryFadeWidget)
            + " secondary(+0x3E0)=" + MpPtr(SecondaryFadeWidget)
            + " mode=" + std::to_string(FadeMode)
            + " -> calling original");
    }

    reinterpret_cast<void(*)(void*, uint8_t)>(OrigArchonLoadingScreenFadeIn)(LoadingScreen, FadeMode);
}

struct RawPointerArray { void** Data; int32_t Num; int32_t Max; };

// [2026-10-11 1.14.7 O3] Runs three times a frame on a server (the engine's TickDispatch hook, before the manual dispatch
// and before the manual flush); the NetDriver and per-connection pointer checks now go through MpReadableThisFrame, so
// each pointer costs one VirtualQuery per frame segment instead of one per call. Same checks, same repairs.
static bool SanitizeNetDriverClientConnections(void* NetDriver, const char* Tag) {
    if (!NetDriver || !MpReadableThisFrame(NetDriver, 0xA0)) {
        MpLog(std::string("[") + Tag + "] invalid NetDriver=" + MpPtr(NetDriver));
        return false;
    }

    RawPointerArray* ClientConnections = reinterpret_cast<RawPointerArray*>(
        reinterpret_cast<uintptr_t>(NetDriver) + 0x90);

    if (!MpReadableThisFrame(ClientConnections, sizeof(RawPointerArray))) {
        MpLog(std::string("[") + Tag + "] unreadable ClientConnections metadata NetDriver=" + MpPtr(NetDriver));
        return false;
    }

    if (!IsSanePointerArray(ClientConnections->Data, ClientConnections->Num, ClientConnections->Max, 1024)) {
        MpLog(std::string("[") + Tag + "] resetting invalid ClientConnections"
            + " data=" + MpPtr(ClientConnections->Data)
            + " num=" + std::to_string(ClientConnections->Num)
            + " max=" + std::to_string(ClientConnections->Max));
        ClientConnections->Data = nullptr;
        ClientConnections->Num = 0;
        ClientConnections->Max = 0;
        return false;
    }

    int32_t WriteIndex = 0;
    for (int32_t ReadIndex = 0; ReadIndex < ClientConnections->Num; ++ReadIndex) {
        void* Connection = ClientConnections->Data[ReadIndex];
        if (!MpReadableThisFrame(Connection, 0x138)) {
            MpLog(std::string("[") + Tag + "] dropping invalid connection"
                + " index=" + std::to_string(ReadIndex)
                + " ptr=" + MpPtr(Connection));
            continue;
        }

        ClientConnections->Data[WriteIndex++] = Connection;
    }

    for (int32_t Index = WriteIndex; Index < ClientConnections->Num; ++Index) {
        ClientConnections->Data[Index] = nullptr;
    }

    if (WriteIndex != ClientConnections->Num) {
        MpLog(std::string("[") + Tag + "] compacted ClientConnections"
            + " oldNum=" + std::to_string(ClientConnections->Num)
            + " newNum=" + std::to_string(WriteIndex));
        ClientConnections->Num = WriteIndex;
        return false;
    }

    RawPointerArray* PendingCleanup = reinterpret_cast<RawPointerArray*>(
        reinterpret_cast<uintptr_t>(NetDriver) + 0xF0);

    if (!MpReadableThisFrame(PendingCleanup, sizeof(RawPointerArray))) {
        MpLog(std::string("[") + Tag + "] unreadable NetDriver+0xF0 cleanup metadata NetDriver=" + MpPtr(NetDriver));
        return false;
    }

    if (PendingCleanup->Num < 0 || PendingCleanup->Max < 0 ||
        PendingCleanup->Num > PendingCleanup->Max || PendingCleanup->Num > 1024 ||
        (PendingCleanup->Num > 0 && !IsReadablePointer(PendingCleanup->Data, static_cast<size_t>(PendingCleanup->Num) * 0x18))) {
        MpLog(std::string("[") + Tag + "] resetting invalid cleanup array"
            + " data=" + MpPtr(PendingCleanup->Data)
            + " num=" + std::to_string(PendingCleanup->Num)
            + " max=" + std::to_string(PendingCleanup->Max));
        PendingCleanup->Data = nullptr;
        PendingCleanup->Num = 0;
        PendingCleanup->Max = 0;
        return false;
    }

    return true;
}

void* OrigNetDriverTickDispatchInner = nullptr;

void NetDriverTickDispatchInnerHook(void* NetDriver, float DeltaTime) {
    // [1.14.7 DIAG 2026-10-04] Is the ENGINE actually calling UNetDriver::TickDispatch at all?
    // The hub's socket is never read with the native tick, and UWorld::NetDriver (verified +0x38,
    // Engine_classes.hpp:7414) is now set to our named driver, so either the engine never calls this or the
    // socket read lives in the UIpNetDriver override rather than here. A counter answers it.
    {
        static std::atomic<int> s_calls{ 0 };
        const int n = s_calls.fetch_add(1, std::memory_order_relaxed);
        // [2026-10-11 O3] The periodic heartbeat (every 600th call) is off with PRODUCTION_LOG_PROFILE.flag.
        if (n < 3 || ((n % 600) == 0 && !MpProductionLogProfile())) {
            MpLog("[TickDispatchInner] call #" + std::to_string(n + 1) + " role="
                + (Globals::AmServer ? "server" : "client") + " driver=" + MpPtr(NetDriver));
        }
    }
    if (!SanitizeNetDriverClientConnections(NetDriver, "NetDriverTickDispatchInner")) {
        MpLog("[NetDriverTickDispatchInner] skipped original after sanitizing unsafe connection state");
        return;
    }

    reinterpret_cast<void(*)(void*, float)>(OrigNetDriverTickDispatchInner)(NetDriver, DeltaTime);
}

void* OrigFixupNetworkNotify = nullptr;

void* FixupNetworkNotifyHook(void* a1) {
    if(UWorld::GetWorld())
        *(void**)((uintptr_t)a1 + 0x208) = (void*)((uintptr_t)UWorld::GetWorld() + 0x28); // UWorld::NetworkNotify: unnamed in 1.12.0 SDK; slot @ +0x28 (before PersistentLevel@0x30, stable 1.4.4->1.12.0)

    return reinterpret_cast<void* (*)(void*)>(OrigFixupNetworkNotify)(a1);
}

void* OrigNotifyClientDisconnected = nullptr;

void NotifyClientDisconnectedHook(void* NetDriver, void* Connection) {
    MpLog("[NotifyClientDisconnected] hook entry");

    if (!NetDriver || !IsReadablePointer(NetDriver, 0x240)) {
        MpLog("[NotifyClientDisconnected] invalid NetDriver pointer");
        return;
    }

    if (Connection && !IsReadablePointer(Connection, 0x140)) {
        MpLog("[NotifyClientDisconnected] skipping invalid connection pointer");
        return;
    }

    // [1.12.0] The original starts with VeryVerbose name formatting and then calls
    // RemoveSingleSwap on a UIpNetDriver-private TArray at +0x238. In our forced
    // server path that array can be half-torn during disconnect, producing crashes
    // in FName->FString (logging) or in the remove helper's `cmp [rax], rdx`.
    //
    // Replace only the fragile bookkeeping: validate the raw array before reading,
    // remove by swap-with-last if possible, and skip shrink/callback side effects.
    RawPointerArray* DisconnectedClients = reinterpret_cast<RawPointerArray*>(
        reinterpret_cast<uintptr_t>(NetDriver) + 0x238);

    if (!IsSanePointerArray(DisconnectedClients->Data, DisconnectedClients->Num, DisconnectedClients->Max, 1024)) {
        MpLog("[NotifyClientDisconnected] invalid NetDriver+0x238 array; skipping original");
        return;
    }

    for (int32_t Index = 0; Index < DisconnectedClients->Num; ++Index) {
        if (DisconnectedClients->Data[Index] != Connection) {
            continue;
        }

        const int32_t LastIndex = DisconnectedClients->Num - 1;
        if (Index != LastIndex) {
            DisconnectedClients->Data[Index] = DisconnectedClients->Data[LastIndex];
        }
        DisconnectedClients->Data[LastIndex] = nullptr;
        DisconnectedClients->Num = LastIndex;
        MpLog("[NotifyClientDisconnected] removed connection from NetDriver+0x238");
        return;
    }

    MpLog("[NotifyClientDisconnected] connection not present in NetDriver+0x238");
}

// [2026-07-21 DISCONNECT-CLEANUP DIAG] Read-only observation hook on the REAL native disconnect
// entry point, UNetConnection::Close (RVA 0x03D477C0 - located via its own log string
// "UNetConnection::Close: %s, Channels: %i, Time: %s"). This is NOT NotifyClientDisconnectedHook
// above: a full log scan across a real quit-and-rejoin-while-server-stays-up repro showed
// NotifyClientDisconnectedHook's own "hook entry" line NEVER fires for a normal client quit -
// only its install confirmation appears. So whatever the game does on disconnect happens through
// THIS function instead, and it has zero DLL visibility today.
//
// Close() makes two virtual calls we don't yet know the identity of:
//   plVar1 = *(Connection + 0x1318); if (plVar1) (*plVar1->vtable[0x288])(plVar1, 0);
//   (conditionally) (*Connection->vtable[0x2c0])(Connection, 0);
// Connection+0x1318 is deliberately NOT interpreted here: an earlier version assumed it was a
// UObject and crashed during name resolution.  We only observe verified scalar fields and the
// native caller stack.  That makes this safe to use on the short P2P post-login disconnect.
void* OrigNetConnectionClose = nullptr;
void NetConnectionCloseHook(void* Connection) {
    if (!Connection || !IsReadablePointer(Connection, 0x1D8)) {
        MpLog("[NetConnectionClose] invalid connection=" + MpPtr(Connection));
        reinterpret_cast<void(*)(void*)>(OrigNetConnectionClose)(Connection);
        return;
    }

    // Keep this diagnostic useful during a failed join without allowing ordinary
    // connection churn to grow the session log without bound.
    static std::atomic<int> s_ncCloseSeq{ 0 };
    const int Seq = s_ncCloseSeq.fetch_add(1, std::memory_order_relaxed);
    if (Seq >= 16) {
        reinterpret_cast<void(*)(void*)>(OrigNetConnectionClose)(Connection);
        return;
    }
    const uintptr_t Base = reinterpret_cast<uintptr_t>(Connection);
    const uint8_t State = *reinterpret_cast<const uint8_t*>(Base + 0x134);
    const double LastReceiveTime = *reinterpret_cast<const double*>(Base + 0x1D0);
    void* Frames[12]{};
    const USHORT FrameCount = CaptureStackBackTrace(1, static_cast<DWORD>(std::size(Frames)), Frames, nullptr);
    std::string Stack;
    for (USHORT Index = 0; Index < FrameCount; ++Index) {
        if (Index != 0) Stack += " ";
        Stack += MpAddress(Frames[Index]);
    }

    MpLog(std::string(Globals::AmServer ? "[NetConnectionClose server #" : "[NetConnectionClose client #") + std::to_string(Seq) + "] ENTER conn=" + MpPtr(Connection)
        + " state=" + std::to_string(State)
        + " lastReceive=" + std::to_string(LastReceiveTime)
        + " stack=" + Stack);

    reinterpret_cast<void(*)(void*)>(OrigNetConnectionClose)(Connection);

    MpLog(std::string(Globals::AmServer ? "[NetConnectionClose server #" : "[NetConnectionClose client #") + std::to_string(Seq) + "] EXIT conn=" + MpPtr(Connection));
}

void* OrigProcessRequest = nullptr;

static bool MpRewriteRequestUrl(void* Request);
static void MpProbeCharacterRequestAssociation(void* Request);
static bool MpSplitUrl(const std::wstring& Url, std::wstring& OutHost, std::wstring& OutTail);
static std::string MpGrantTraceCallChain();   // [GrantTrace]: native call chain with .pdata function starts

// [1.14.7 2026-10-10] RtlGenRandom (advapi32!SystemFunction036) is the CSPRNG behind the grant id below. advapi32 is in
// this project's default link set (the vcxproj adds no AdditionalDependencies and bcrypt.lib is not linked), and the
// declaration is spelled out here instead of pulling <ntsecapi.h> (LSA types) in next to the UE SDK.
extern "C" BOOLEAN NTAPI SystemFunction036(PVOID RandomBuffer, ULONG RandomBufferLength);

// [1.14.7 2026-10-10] FMemory::Free for engine buffers handed back to this DLL (the FString GetHeader copies out).
// GMalloc is DAT_146e1eb58 (RVA 0x06E1EB58): FMemory::Realloc (0x02564AB0, see EngineRealloc) dispatches its vtable
// +0x20, and every inlined FString destructor in 1.14.7 frees through +0x30 on the same object (FUN_142564b60:
// "if (!GMalloc) init; GMalloc->vt[0x30](GMalloc, Data)"). A buffer we received was allocated through that GMalloc,
// so a null GMalloc means there is nothing of ours to free.
static void MpEngineFree(void* Ptr) {
    if (!Ptr || !Globals::BaseAddress) return;
    void* Malloc = *reinterpret_cast<void**>(Globals::BaseAddress + 0x06E1EB58);
    if (!Malloc || !IsReadablePointer(Malloc, sizeof(void*))) return;
    void** Vtable = *reinterpret_cast<void***>(Malloc);
    if (!Vtable || !IsReadablePointer(Vtable, 7 * sizeof(void*))) return;
    reinterpret_cast<void(*)(void*, void*)>(Vtable[6])(Malloc, Ptr);
}

// [1.14.7 2026-10-10] The path of a dedicated-server XP grant, "/progression/<account>/<track>/<amount>", or empty for
// any other URL. Scheme, host and query are ignored. MpRewriteRequestUrl has already run, so an allowlisted host now
// reads "/__origin/<original-host>/progression/..."; the backend strips that prefix before routing (app.ts), and so
// does this. Exactly three non-empty segments, the last all digits - anything else gets no grant id, which the backend
// answers with 400 (fail-closed).
// Plain arrays, no function-local std::wstring statics: their lazy construction faulted once on a curl worker thread
// (see the g_UrlObs* note below), and this runs on whatever thread issues the request.
static std::wstring MpProgressionGrantPath(const std::wstring& Url) {
    std::wstring Host;
    std::wstring Tail;
    if (!MpSplitUrl(Url, Host, Tail)) return L"";
    std::wstring Path = Tail.substr(0, Tail.find_first_of(L"?#"));
    constexpr wchar_t kOrigin[] = L"/__origin/";
    constexpr size_t kOriginLen = (sizeof(kOrigin) / sizeof(wchar_t)) - 1;
    if (Path.compare(0, kOriginLen, kOrigin) == 0) {
        const size_t HostEnd = Path.find(L'/', kOriginLen);
        if (HostEnd == std::wstring::npos || HostEnd == kOriginLen) return L"";
        Path = Path.substr(HostEnd);
    }
    constexpr wchar_t kPrefix[] = L"/progression/";
    constexpr size_t kPrefixLen = (sizeof(kPrefix) / sizeof(wchar_t)) - 1;
    if (Path.compare(0, kPrefixLen, kPrefix) != 0) return L"";
    const size_t First = kPrefixLen;
    const size_t Slash1 = Path.find(L'/', First);
    if (Slash1 == std::wstring::npos || Slash1 == First) return L"";
    const size_t Slash2 = Path.find(L'/', Slash1 + 1);
    if (Slash2 == std::wstring::npos || Slash2 == Slash1 + 1) return L"";
    const std::wstring Amount = Path.substr(Slash2 + 1);
    if (Amount.empty() || Amount.size() > 9) return L"";
    for (wchar_t C : Amount) {
        if (C < L'0' || C > L'9') return L"";
    }
    return Path;
}

// [1.14.7 2026-10-10] Idempotent grant id on dedicated-server XP grants. The backend accepts
// POST /progression/{account}/{track}/{amount} only with x-mysticparadox-grant-id (^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$)
// and applies each id once; the game sends none (no grant/idempotency string in the exe). UE's HTTP retry re-issues
// ProcessRequest on the SAME FCurlHttpRequest, so the header is read back first: a retry keeps the id it was given on
// the first attempt and the backend replays instead of applying the XP twice. New ids are "gs-" + 128 random bits.
// FCurlHttpRequest vtable (1.14.7, 0x145B62FE0): [2] GetHeader 0x1432BC040 = FString* (this, FString* Out /*hidden
// return*/, const FString* Name) - zeroes Out, looks Name up in the header map at this+0xC8 and copies the value;
// [16] SetHeader 0x1432C59E0, ignored while the request is in flight (+0xC4 == 1).
// The URL is read in place at this+0x70 (the FString ProcessRequest itself consumes, same guards as
// MpRewriteRequestUrl) rather than through GetURL [0], which would hand back one more engine copy to free.
// Logs one [ProgressionGrantReq] line per grant request (process budget 2000). Never logs the API key or other headers.
static void MpEnsureProgressionGrantId(void* Request) {
    if (!Request || !IsReadablePointer(Request, 0xD0)) return;
    struct RawFString { wchar_t* Data; int32_t Num; int32_t Max; };
    const auto* Url = reinterpret_cast<const RawFString*>(reinterpret_cast<uintptr_t>(Request) + 0x70);
    if (!Url->Data || Url->Num < 2 || Url->Max < Url->Num || Url->Num > 32768
        || !IsReadablePointer(Url->Data, static_cast<size_t>(Url->Num) * sizeof(wchar_t))) {
        return;
    }
    const std::wstring Path = MpProgressionGrantPath(std::wstring(Url->Data, static_cast<size_t>(Url->Num - 1)));
    if (Path.empty()) return;

    static std::atomic<int> s_logBudget{ 0 };
    const bool LogIt = s_logBudget.fetch_add(1, std::memory_order_relaxed) < 2000;
    if (*reinterpret_cast<const int32_t*>(reinterpret_cast<uintptr_t>(Request) + 0xC4) == 1) {
        if (LogIt) MpLog("[ProgressionGrantReq] path=" + MpNarrow(Path) + " in flight: header untouched (the native call fails it)");
        return;
    }
    void** Vtable = *reinterpret_cast<void***>(Request);
    if (!Vtable || !IsReadablePointer(Vtable, 17 * sizeof(void*))) return;

    FString HeaderName(L"x-mysticparadox-grant-id");
    RawFString Existing{};
    using GetHeaderFn = void*(*)(void*, void*, const void*);
    reinterpret_cast<GetHeaderFn>(Vtable[2])(Request, &Existing, &HeaderName);
    // Any non-empty value already on the request is kept, even one this code cannot read back: replacing it on a retry
    // would turn one grant into two ids.
    const bool Reused = Existing.Data != nullptr && Existing.Num > 1;
    std::wstring GrantId;
    if (Reused) {
        if (Existing.Num <= 256
            && IsReadablePointer(Existing.Data, static_cast<size_t>(Existing.Num) * sizeof(wchar_t))) {
            GrantId.assign(Existing.Data, static_cast<size_t>(Existing.Num - 1));
        } else {
            GrantId = L"<unreadable>";
        }
    }
    MpEngineFree(Existing.Data);   // GetHeader's copy was allocated with FMemory (FUN_1409fb5f0 -> 0x02564AB0)

    if (!Reused) {
        unsigned char Bytes[16] = {};
        if (!SystemFunction036(Bytes, static_cast<ULONG>(sizeof(Bytes)))) {
            // Fail-closed: without an id the backend refuses the grant (400) rather than risk applying it twice.
            if (LogIt) MpLog("[ProgressionGrantReq] path=" + MpNarrow(Path) + " RtlGenRandom FAILED err="
                + std::to_string(GetLastError()) + ": no grant id set, the backend will refuse this grant");
            return;
        }
        static const wchar_t kHexDigits[] = L"0123456789abcdef";
        GrantId = L"gs-";
        for (unsigned char B : Bytes) {
            GrantId += kHexDigits[B >> 4];
            GrantId += kHexDigits[B & 0x0F];
        }
        FString GrantValue(GrantId.c_str());
        using SetHeaderFn = void(*)(void*, FString*, FString*);
        reinterpret_cast<SetHeaderFn>(Vtable[16])(Request, &HeaderName, &GrantValue);
    }
    if (LogIt) {
        MpLog("[ProgressionGrantReq] path=" + MpNarrow(Path) + " grant=" + MpNarrow(GrantId.substr(0, 128))
            + " reused=" + (Reused ? "1" : "0") + " tid=" + std::to_string(GetCurrentThreadId())
            + " chain=" + MpGrantTraceCallChain());
    }
}

char ProcessRequest(void* Request) {
    // 1.14.7 Ghidra confirms ProcessRequest reads FCurlHttpRequest's FString URL
    // at this+0x70 before it configures the native request. Rewrite at this
    // pre-dispatch boundary; +0x032C5B40 is only the one-argument in-flight
    // SetURL diagnostic and cannot accept a replacement FString.
    MpRewriteRequestUrl(Request);

    // [1.14.7 2026-10-10] Dedicated-server XP grants carry an idempotent grant id (see MpEnsureProgressionGrantId).
    // Globals::AuthMode defaults to GlobalGameserver in every process (only Init() on a server changes it), so the
    // server role is checked as well.
    // [2026-10-14 realms] A player host (HuntCapability: realm hubs and hunts) needs the same id: the backend refuses
    // every XP grant without one, so a realm member's kill XP was never saved (VPS, 14 Oct 11:29).
    if (Globals::AmServer && (Globals::AuthMode == Globals::ServerAuthMode::GlobalGameserver
            || Globals::AuthMode == Globals::ServerAuthMode::HuntCapability)) {
        MpEnsureProgressionGrantId(Request);
    }

    // Only a DeployServer gameserver carries the global gameserver credential. The optional
    // player-hosted mode never receives it and supplies its own scoped header (P2PHooks.h).
    if (Globals::AuthMode == Globals::ServerAuthMode::GlobalGameserver && Globals::ServerAPIKey) {
        FString APIHeader(L"x-mysticparadox-gameserver-apikey");
        FString APIKey(Globals::ServerAPIKey);

        // SetHeader is virtual: vtable BYTE offset 0x80 == INDEX 16 (0x80/8). NOT index 0x80.
        using SetHeaderFn = void(*)(void*, FString*, FString*);
        void* setHeader = (*reinterpret_cast<void***>(Request))[16];
        reinterpret_cast<SetHeaderFn>(setHeader)(Request, &APIHeader, &APIKey);
    }
    else if (Globals::AuthMode == Globals::ServerAuthMode::HuntCapability) {
        std::wstring HeaderName;
        std::wstring HeaderValue;
        P2PHooks::RequestHeader(HeaderName, HeaderValue);
        if (!HeaderName.empty()) {
            FString ModuleHeader(HeaderName.c_str());
            FString ModuleValue(HeaderValue.c_str());
            using SetHeaderFn = void(*)(void*, FString*, FString*);
            void* setHeader = (*reinterpret_cast<void***>(Request))[16];
            reinterpret_cast<SetHeaderFn>(setHeader)(Request, &ModuleHeader, &ModuleValue);
        }
    }

    return reinterpret_cast<char(*)(void*)>(OrigProcessRequest)(Request);
}

// ============================================================================
// [1.12.0] In-process HTTPS redirect — FCurlHttpRequest::SetURL (RVA 0x03102740).
//
// Replaces the external WinDivert interceptor for core backend HTTP(S) traffic.
// SetURL receives the complete URL (RCX=this, RDX=FString* url) before the
// request becomes in-flight and assigns it into the request at this+0x70. We
// rewrite allowlisted official hostnames to the owned domain here, encoding the
// original host in the path so the backend can route WITHOUT nginx and without
// depending on the outgoing Host header:
//
//   https://auth-prod.steelyard.ca/tags?x=1
//     -> https://paradox.mysticfox.dev/__origin/auth-prod.steelyard.ca/tags?x=1
//
// Because the URL itself now names paradox.mysticfox.dev, TLS SNI + cert
// validation use that hostname — no hosts file, root cert, portproxy, WinDivert
// or machine-wide proxy. Only the injected process is affected.
//
// Two independent sentinels, both default OFF and cached on first read:
//   debug\URL_REWRITE.flag  -> rewrite allowlisted URLs to paradox.mysticfox.dev
//   debug\URL_LOG.flag      -> emit sanitized, deduplicated, budget-capped observations
// Default (no flags) = passthrough with zero logging/overhead. Logging is gated
// SEPARATELY from rewrite so it never runs in production (earlier diagnostic
// logging caused frame lag) and so it can be disabled after rewrite is enabled.
// Installed in BOTH client and dedicated-server init (both make backend calls).
// ============================================================================
//
// [2026-10-13 realms S1] The backend address is no longer only compiled in. The launcher can hand the game process the
// backend to use (a community realm, a self-hosted hub) in MYSTICPARADOX_BACKEND_URL = scheme://host[:port]: http or
// https, a DNS name, IPv4 or [IPv6] host, no path, query, fragment or user information (BackendUrl.h has the exact
// grammar). A valid value replaces the built-in https://MP_PUBLIC_HOST as the API base used by MpBuildRedirectUrl and
// as the chat WebSocket address further down (ws/wss matching http/https, same host; the port goes to the XMPP
// ServerPort key, because the client appends ":" + ServerPort to ServerAddr). Absent, empty or invalid means the
// built-in https/wss address exactly as before; an invalid value is logged - reason and length only, it may have
// carried credentials - and ignored. A DeployServer sets no such variable, so its servers keep the built-in address.
// Resolved once: from Init (before any hook reading it exists) and otherwise on first use, behind an Interlocked state
// word. The results sit in file-scope POD buffers (no lazy constructors, see the g_UrlObs* note below) so any thread
// can read them once the state is 2. The log line is written by MainThread because Init runs under the loader lock.
static const wchar_t* const kMpBuiltInApiBase = L"https://" MP_PUBLIC_HOST;
static const wchar_t* const kMpBuiltInXmppWsUrl = L"wss://" MP_PUBLIC_HOST;
static constexpr uint16_t kMpBuiltInXmppPort = 443;
static constexpr size_t kMpBackendAddressChars = 320;   // "https://" + 253-char host + ":65535" + NUL, with room to spare

static wchar_t g_MpApiBase[kMpBackendAddressChars];
static wchar_t g_MpXmppWsUrl[kMpBackendAddressChars];
static uint16_t g_MpXmppPort = kMpBuiltInXmppPort;
static bool g_MpBackendFromEnv = false;
static char g_MpBackendEnvIgnored[96];                  // why MYSTICPARADOX_BACKEND_URL was ignored; empty if used or absent
static DWORD g_MpBackendEnvLength = 0;
static volatile LONG g_MpBackendState = 0;              // 0 = unresolved, 1 = being resolved, 2 = ready

static void MpResolveBackendAddress() {
    if (InterlockedCompareExchange(&g_MpBackendState, 1, 0) != 0) {
        // Resolved, or being resolved by another thread: wait for the result (a few microseconds at most).
        while (InterlockedCompareExchange(&g_MpBackendState, 2, 2) != 2) { YieldProcessor(); }
        return;
    }

    bool FromEnv = false;
    const char* Ignored = "";
    DWORD EnvLength = 0;
    std::wstring EnvApi;
    std::wstring EnvWs;
    uint16_t EnvPort = kMpBuiltInXmppPort;
    try {
        char Raw[512] = {};
        const DWORD Length = GetEnvironmentVariableA("MYSTICPARADOX_BACKEND_URL", Raw, static_cast<DWORD>(sizeof(Raw)));
        if (Length >= sizeof(Raw)) {
            EnvLength = Length;                         // buffer too small: Length is the size it would need
            Ignored = "value too long";
        }
        else if (Length != 0) {                         // 0 = not set (or set empty): the built-in address
            EnvLength = Length;
            MpBackendUrl Url;
            const char* Why = "";
            if (MpParseBackendUrl(std::string(Raw, Length), Url, Why)) {
                EnvApi = MpBackendApiBase(Url);
                EnvWs = MpBackendXmppAddress(Url);
                EnvPort = Url.Port;
                if (EnvApi.size() < kMpBackendAddressChars && EnvWs.size() < kMpBackendAddressChars) {
                    FromEnv = true;
                }
                else {
                    Ignored = "value too long";         // unreachable under the parser's 300-character cap
                }
            }
            else {
                Ignored = Why;
            }
        }
    }
    catch (...) {
        FromEnv = false;
        Ignored = "internal error while reading the value";
    }

    if (FromEnv) {
        wmemcpy(g_MpApiBase, EnvApi.c_str(), EnvApi.size() + 1);
        wmemcpy(g_MpXmppWsUrl, EnvWs.c_str(), EnvWs.size() + 1);
        g_MpXmppPort = EnvPort;
    }
    else {
        wcscpy_s(g_MpApiBase, kMpBackendAddressChars, kMpBuiltInApiBase);
        wcscpy_s(g_MpXmppWsUrl, kMpBackendAddressChars, kMpBuiltInXmppWsUrl);
        g_MpXmppPort = kMpBuiltInXmppPort;
        strcpy_s(g_MpBackendEnvIgnored, sizeof(g_MpBackendEnvIgnored), Ignored);
        g_MpBackendEnvLength = Ignored[0] ? EnvLength : 0;
    }
    g_MpBackendFromEnv = FromEnv;
    InterlockedExchange(&g_MpBackendState, 2);          // full barrier: the buffers above are visible to readers of 2
}

static const wchar_t* MpApiBase() {
    MpResolveBackendAddress();
    return g_MpApiBase;
}

// The XMPP ServerAddr value: "wss://host" or "ws://host", no port and no path (the NOTE above the XMPP redirect below).
static const wchar_t* MpXmppWsUrl() {
    MpResolveBackendAddress();
    return g_MpXmppWsUrl;
}

// The port the chat WebSocket connects to; written to XMPP ServerPort only when the address came from the environment.
static uint16_t MpXmppServerPort() {
    MpResolveBackendAddress();
    return g_MpXmppPort;
}

static bool MpBackendFromEnvironment() {
    MpResolveBackendAddress();
    return g_MpBackendFromEnv;
}

// One line at startup: where the address came from and what the client will use. "ws" is the address as the client
// assembles it (ServerAddr + ":" + ServerPort); the built-in one is wss://MP_PUBLIC_HOST:443 as before.
static void MpLogBackendAddress() {
    MpResolveBackendAddress();
    std::string Line = std::string("[BackendAddress] source=") + (g_MpBackendFromEnv ? "env" : "built-in")
        + " api=" + MpNarrow(g_MpApiBase) + " ws=" + MpNarrow(g_MpXmppWsUrl) + ":" + std::to_string(g_MpXmppPort);
    if (g_MpBackendEnvIgnored[0]) {
        Line += std::string(" (MYSTICPARADOX_BACKEND_URL ignored: ") + g_MpBackendEnvIgnored
            + ", length=" + std::to_string(g_MpBackendEnvLength) + ")";
    }
    MpLog(Line);
}

// Case-insensitive parsed-host match against the redirect allowlist: exact apex
// or a dot-delimited subdomain of one. Never a blind substring match.
static bool MpIsRedirectHost(const std::wstring& Host) {
    static const wchar_t* kApexHosts[] = {
        L"steelyard.ca",        // *.steelyard.ca  + apex   (Phoenix / Steelyard backend)
        L"steelyard.online",    // *.steelyard.online + apex
        L"ol.epicgames.com",    // *.ol.epicgames.com (Epic account / friends / presence / OSS)
        L"api.epicgames.dev",   // EOS SDK (kept for observation; confirm it reaches this hook)
    };
    for (const wchar_t* Apex : kApexHosts) {
        const size_t Alen = wcslen(Apex);
        if (Host.size() < Alen) continue;
        if (Host.size() == Alen) {
            if (_wcsicmp(Host.c_str(), Apex) == 0) return true;
            continue;
        }
        // suffix match with a dot boundary: "<label>.<apex>"
        if (Host[Host.size() - Alen - 1] != L'.') continue;
        if (_wcsicmp(Host.c_str() + (Host.size() - Alen), Apex) == 0) return true;
    }
    return false;
}

// Split "scheme://[user@]host[:port]/path?query#frag" into host and the
// verbatim path+query+fragment tail (leading '/'). http/https only.
static bool MpSplitUrl(const std::wstring& Url, std::wstring& OutHost, std::wstring& OutTail) {
    const size_t SchemeEnd = Url.find(L"://");
    if (SchemeEnd == std::wstring::npos) return false;
    const std::wstring Scheme = Url.substr(0, SchemeEnd);
    if (_wcsicmp(Scheme.c_str(), L"http") != 0 && _wcsicmp(Scheme.c_str(), L"https") != 0) return false;

    const size_t AuthStart = SchemeEnd + 3;
    // Authority ends at the first '/', '?' or '#' (a URL may carry a query or
    // fragment with no path, e.g. https://host.example?x=1).
    const size_t AuthEnd = Url.find_first_of(L"/?#", AuthStart);
    std::wstring Authority = (AuthEnd == std::wstring::npos)
        ? Url.substr(AuthStart) : Url.substr(AuthStart, AuthEnd - AuthStart);
    // Keep path+query+fragment verbatim. If the tail starts with '?' or '#'
    // (no path), prepend '/' so the rewritten URL still has a valid path.
    if (AuthEnd == std::wstring::npos)  OutTail = L"/";
    else if (Url[AuthEnd] == L'/')      OutTail = Url.substr(AuthEnd);
    else                                OutTail = L"/" + Url.substr(AuthEnd);

    const size_t At = Authority.find(L'@');
    if (At != std::wstring::npos) Authority = Authority.substr(At + 1);
    const size_t Colon = Authority.find(L':');
    if (Colon != std::wstring::npos) Authority = Authority.substr(0, Colon);

    OutHost = Authority;
    return !OutHost.empty();
}

static std::wstring MpBuildRedirectUrl(const std::wstring& Host, const std::wstring& Tail) {
    // https://paradox.mysticfox.dev/__origin/<original-host><tail>  (Tail begins with '/')
    // [2026-10-13 realms S1] The base is the built-in address unless MYSTICPARADOX_BACKEND_URL named another (above).
    std::wstring Out = MpApiBase();
    Out += L"/__origin/";
    Out += Host;
    Out += Tail;
    return Out;
}

// The 1.14.7 ProcessRequest body reads the request URL from FCurlHttpRequest+0x70
// (Ghidra: request+0x70 is passed to its "URL='%s'" diagnostic before curl setup).
// Replace the owned FString contents with the verified engine allocator so its later
// destructor/realloc remains compatible with GMalloc. Do not log URL paths or queries.
// ============================================================================
// [1.14.7 2026-10-04] Resolve a code address to its TRUE function entry from the image's unwind metadata
// (.pdata / RUNTIME_FUNCTION) - the same mechanism the OS uses to unwind. This is authoritative where
// Ghidra's function boundaries are not: for the frames below Ghidra answered "No function found" for several
// addresses while also claiming one range that two functions occupy. Reading a prologue backwards is NOT
// acceptable - that mistake installed a detour mid-function at 0x42CE8B6 earlier in this work.
// [1.14.7 CORRECTION 2026-10-04] The first version of this returned Entry->BeginAddress directly, and that
// was WRONG in a way that crashed the hub twice: RtlLookupFunctionEntry can return a CHAINED RUNTIME_FUNCTION
// (UNW_FLAG_CHAININFO). A chained entry is a CONTINUATION FRAGMENT of a function, not a callable entry point,
// so hooking its BeginAddress corrupts the stack - measured as
//   EXCEPTION_ACCESS_VIOLATION reading 0xffffffffffffffff
//   -> ucrtbase!sprintf_s<260> -> MpLog -> MpProbeLoaderArgs -> MpLoaderFrame6Hook
// i.e. exactly the same signature as the earlier 0x42CE8B6 mid-function detour. The chain must be followed to
// the PRIMARY entry. Same lesson, second time: a reported "function start" is not a detour target until the
// unwind chain says it is a real entry.
static uintptr_t MpFunctionStartForAddress(uintptr_t Address) {
    DWORD64 ImageBase = 0;
    PRUNTIME_FUNCTION Entry = RtlLookupFunctionEntry(
        static_cast<DWORD64>(Address), &ImageBase, nullptr);
    if (!Entry) return 0;

    // Walk UNW_FLAG_CHAININFO to the primary entry.
    //
    // Layout (Windows x64): UNWIND_INFO is 4 bytes {VersionAndFlags, SizeOfProlog, CountOfCodes,
    // FrameRegisterAndOffset}, then CountOfCodes UNWIND_CODE entries of TWO bytes each (padded to an even
    // count), then - when Flags has UNW_FLAG_CHAININFO - a RUNTIME_FUNCTION describing the next fragment.
    // The SDK headers in this build do not expose UNWIND_INFO, so it is declared here.
    struct MpUnwindInfo {
        uint8_t VersionAndFlags;        // Version:3 | Flags:5
        uint8_t SizeOfProlog;
        uint8_t CountOfCodes;
        uint8_t FrameRegisterAndOffset; // FrameRegister:4 | FrameOffset:4
    };
    constexpr uint8_t kUnwFlagChainInfo = 0x4;

    for (int Guard = 0; Guard < 32; ++Guard) {
        const auto* Info = reinterpret_cast<const MpUnwindInfo*>(
            static_cast<uintptr_t>(ImageBase) + Entry->UnwindData);
        if (!IsReadablePointer(Info, sizeof(MpUnwindInfo))) break;
        if ((Info->VersionAndFlags & kUnwFlagChainInfo) == 0) break;
        const size_t CodesBytes = static_cast<size_t>((Info->CountOfCodes + 1) & ~1u) * 2u;
        const ULONG_PTR ChainAddress = reinterpret_cast<ULONG_PTR>(Info) + 4u + CodesBytes;
        if (!IsReadablePointer(reinterpret_cast<const void*>(ChainAddress), sizeof(RUNTIME_FUNCTION))) break;
        Entry = reinterpret_cast<PRUNTIME_FUNCTION>(ChainAddress);
    }
    return static_cast<uintptr_t>(ImageBase) + Entry->BeginAddress;
}

// [1.14.7 REMOVED 2026-10-05] The association probe that lived here (MpProbeCharacterRequestAssociation and
// its dispatch-stack capture) is DELETED. It answered its question - an FCurlHttpRequest carries no reachable
// link to its issuer - and then began crashing the process:
//   EXCEPTION_ACCESS_VIOLATION reading address 0x0000023f48460000
//     MysticParadox.dll!MpProbeCharacterRequestAssociation() [dllmain.cpp:5287]
//     MysticParadox.dll!ProcessRequest() [dllmain.cpp:5082]
// A diagnostic must not be able to kill the thing it measures. The findings it produced are recorded in
// Progress/34_DAUNTLESS_1_14_7_UPGRADE_AUDIT.md.
#if 0
// [1.14.7 ASSOCIATION PROBE 2026-10-04] Prove - or disprove - that an FCurlHttpRequest carries a link back
// to the object that issued it.
//
// Why this exists: the marker design depends on identifying the PHANTOM's character read at the request
// level. The ProcessRequest hook (RVA 0x032C5FE0) receives only the request - no controller context - so the
// association must be read OFF the request itself. The audit states this association is NOT yet verified, and
// Ghidra's xref queries for the completion callback (0x140dee610) return nothing, so this measures it
// directly instead of assuming a delegate offset.
//
// It assumes nothing: it walks the request object and reports every 8-byte value that is a REGISTERED LIVE
// UObject (GUObjectArray round-trip), with its offset and name. Runs for /character requests only, at most 6
// times, and only while CHARACTER_ASSOC_PROBE.flag sits beside the executable.
static void MpProbeCharacterRequestAssociation(void* Request) {
    if (!MpExeRelativeFlagPresent(L"CHARACTER_ASSOC_PROBE.flag")) return;
    if (!Request || !IsReadablePointer(Request, 0x200)) return;

    struct RawFString { wchar_t* Data; int32_t Num; int32_t Max; };
    auto* Url = reinterpret_cast<RawFString*>(reinterpret_cast<uintptr_t>(Request) + 0x70);
    if (!IsReadablePointer(Url, sizeof(*Url)) || !Url->Data || Url->Num < 2 ||
        Url->Max < Url->Num || Url->Num > 32768 ||
        !IsReadablePointer(Url->Data, static_cast<size_t>(Url->Num) * sizeof(wchar_t))) {
        return;
    }
    const std::wstring Incoming(Url->Data, static_cast<size_t>(Url->Num - 1));
    if (Incoming.find(L"/character") == std::wstring::npos) return;

    static std::atomic<int> s_probes{ 0 };
    if (s_probes.fetch_add(1, std::memory_order_relaxed) >= 3) return;

    const uintptr_t ImageLo = Globals::BaseAddress;
    const uintptr_t ImageHi = ImageLo + 0x10000000u;

    std::string Line = "[CharAssocProbe2] request=" + MpPtr(Request) + " url=" + MpNarrow(Incoming);

    // Pass 1: live UObjects referenced directly by the request. MEASURED over 0x0-0x200 first: zero.
    // Widened to 0x800 here in case the completion delegate sits past the fields the DLL already knows
    // (URL at +0x70, in-flight flag at +0xC4).
    int Direct = 0;
    for (uintptr_t Off = 0; Off + 8 <= 0x800; Off += 8) {
        void* V = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Request) + Off);
        if (!V || !IsReadablePointer(V, 0x28)) continue;
        if (!IsRegisteredLiveObject(V)) continue;
        Line += " U+" + MpHex(Off) + "=" + SafeObjectNameForDiagnostic(V);
        if (++Direct >= 6) break;
    }
    Line += " directUObjects=" + std::to_string(Direct);

    // Pass 2: the delegate instance is NOT a UObject - it is a plain C++ object, so pass 1 cannot see it.
    // Identify C++ objects by their vtable pointing into the executable image, then look INSIDE each for the
    // UObject it binds. This is how the request -> requester link would be reachable without assuming an
    // offset for it.
    int CppObjects = 0;
    for (uintptr_t Off = 0; Off + 8 <= 0x800 && CppObjects < 6; Off += 8) {
        void* V = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Request) + Off);
        if (!V || !IsReadablePointer(V, 0x10)) continue;
        void* Vtable = *reinterpret_cast<void**>(V);
        const uintptr_t Vt = reinterpret_cast<uintptr_t>(Vtable);
        if (Vt < ImageLo || Vt >= ImageHi) continue;
        ++CppObjects;
        Line += " C+" + MpHex(Off) + "=" + MpPtr(V) + "{";
        int Inner = 0;
        for (uintptr_t I = 0; I + 8 <= 0x80 && Inner < 3; I += 8) {
            void* W = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(V) + I);
            if (!W || !IsReadablePointer(W, 0x28)) continue;
            if (!IsRegisteredLiveObject(W)) continue;
            Line += "u" + MpHex(I) + "=" + SafeObjectNameForDiagnostic(W) + ";";
            ++Inner;
        }
        Line += "}";
    }
    Line += " cppObjects=" + std::to_string(CppObjects);
    MpLog(Line);

    // [1.14.7 2026-10-04] Also capture the call stack. SetURL (RVA 0x03102740) is NOT a hookable function
    // entry - MinHook returned MH_ERROR_UNSUPPORTED_FUNCTION for it, so the runtime's comment naming that RVA
    // as FCurlHttpRequest::SetURL is wrong. ProcessRequest IS hookable and receives the request, so its
    // caller chain is the available evidence for where this request was dispatched from.
    void* Frames[20]{};
    const USHORT FrameCount = CaptureStackBackTrace(1, static_cast<DWORD>(std::size(Frames)), Frames, nullptr);
    std::string Stack;
    for (USHORT Index = 0; Index < FrameCount; ++Index) {
        if (Index) Stack += " ";
        Stack += MpAddress(Frames[Index]);
        // Name the enclosing function from unwind metadata, so each frame is attributable without Ghidra.
        const uintptr_t Start = MpFunctionStartForAddress(reinterpret_cast<uintptr_t>(Frames[Index]));
        if (Start) {
            Stack += "(fn+" + MpHex(Start - Globals::BaseAddress) + ")";
        }
    }
    MpLog("[CharDispatchProbe] request=" + MpPtr(Request) + " stack=" + Stack);
}
#endif   // [1.14.7 REMOVED] end of the disabled association probe (it crashed the process)

// ============================================================================
// [1.14.7 CREATION-SITE PROBE 2026-10-04] Name the function that ISSUES an HTTP request.
//
// The request -> issuer association is NOT readable from the request itself. Measured two ways on live
// /character requests: zero live UObjects anywhere in 0x0-0x800 (GUObjectArray round-trip), and the only
// vtable-bearing C++ objects the request references are its own vtable (+0x0), a self-pointer (+0x8) and
// unrelated quest/UI widgets. So the marker must be attached where the request is CREATED, not read off it.
//
// SetURL (RVA 0x03102740, RCX=request, RDX=FString* url) runs at exactly that boundary, so the CALLER's
// return address names the issuing function - evidence rather than a guessed offset. Logs the stack only
// (never the URL body), for /character requests only, at most 6 times, and only while
// CHARACTER_ASSOC_PROBE.flag sits beside the executable.
// ============================================================================
// [1.14.7 LOADER-BOUNDARY PROBE 2026-10-04] Find the requester at the loader frame.
//
// The dispatch chain for /character (captured with unwind metadata, which is authoritative where Ghidra's
// boundaries are not) runs:
//   ProcessRequest <- fn+0x32C1F10 <- fn+0xDC3363 <- fn+0xE0E760 (queue drain) <- fn+0xDCF7CD
//     <- fn+0x1BAF7F0 <- fn+0x1CB3C37 <- fn+0x190F32A <- fn+0x1ABBB10 <- ... tick
// fn+0x1CB3C37 sits in the ArchonLoadManager region (LoadFailed is 0x1CB0010, OnPlayerDataLoadComplete is
// 0x1CB33B0), so the object that OWNS this load is live in that frame's arguments. Both entries are the
// BeginAddress values the image's own unwind metadata reports - not prologues read backwards.
//
// Logs argument identity only (no URLs, no bodies), bounded, and only while CHARACTER_ASSOC_PROBE.flag is
// present beside the executable.
using MpFourArgFn = void(__fastcall*)(void*, void*, void*, void*);
static MpFourArgFn MpOrigLoaderFrame5 = nullptr;
static MpFourArgFn MpOrigLoaderFrame6 = nullptr;

static void MpProbeLoaderArgs(const char* Tag, void* A1, void* A2, void* A3, void* A4) {
    if (!MpExeRelativeFlagPresent(L"CHARACTER_ASSOC_PROBE.flag")) return;
    static std::atomic<int> s_seq{ 0 };
    if (s_seq.fetch_add(1, std::memory_order_relaxed) >= 40) return;
    std::string Line = std::string("[CharLoaderProbe] ") + Tag;
    void* Args[4] = { A1, A2, A3, A4 };
    for (int Index = 0; Index < 4; ++Index) {
        Line += " a" + std::to_string(Index) + "=" + MpPtr(Args[Index]);
        if (Args[Index] && IsReadablePointer(Args[Index], 0x28) && IsRegisteredLiveObject(Args[Index])) {
            Line += "/" + SafeObjectNameForDiagnostic(Args[Index]);
        }
    }
    MpLog(Line);
}

static void __fastcall MpLoaderFrame5Hook(void* A1, void* A2, void* A3, void* A4) {
    MpProbeLoaderArgs("f5(+1BAF7F0)", A1, A2, A3, A4);
    if (MpOrigLoaderFrame5) MpOrigLoaderFrame5(A1, A2, A3, A4);
}

static void __fastcall MpLoaderFrame6Hook(void* A1, void* A2, void* A3, void* A4) {
    MpProbeLoaderArgs("f6(+1CB3C37)", A1, A2, A3, A4);
    if (MpOrigLoaderFrame6) MpOrigLoaderFrame6(A1, A2, A3, A4);
}

// ============================================================================
// [1.14.7 PARSE PROBE 2026-10-04] Read the exact numbers the character parser compares.
//
// ABI VERIFIED before hooking (the lesson from 0x42CE8B6 and the loader frames): the Ghidra decompile gives
//   void FUN_140dee610(longlong *param_1, longlong *param_2, longlong *param_3, char param_4, int param_5)
// - five arguments, so a five-argument __fastcall passthrough is correct and the stack argument is preserved.
//
// param_1 is the object whose FString at +0x28 (Data) / +0x30 (Num) is logged as "%s" in the function's own
// "OnGetHttpRequestComplete Completed, Attempt #: %d" message - i.e. the id the requester already holds.
// The decoded acceptance rule is:
//   returned.Num == held.Num && returned.Num > 1 -> string compare must match
//   otherwise                                    -> accept iff (returned.Num + held.Num) == 1
// so a requester holding an EMPTY id only accepts a returned id of Num 1. This logs both numbers.
using MpParseFn = void(__fastcall*)(void*, void*, void*, char, int);
static MpParseFn MpOrigParse = nullptr;

static void __fastcall MpParseHook(void* P1, void* P2, void* P3, char P4, int P5) {
    if (MpExeRelativeFlagPresent(L"CHARACTER_ASSOC_PROBE.flag") && P1) {
        static std::atomic<int> s_seq{ 0 };
        if (s_seq.fetch_add(1, std::memory_order_relaxed) < 12) {
            // No __try here: this function holds std::string, which needs unwinding, and the compiler rejects
            // the combination (C2712). Every read is guarded by IsReadablePointer instead, the same discipline
            // the rest of this file uses.
            const int64_t HeldNum = *reinterpret_cast<int64_t*>(
                reinterpret_cast<uintptr_t>(P1) + 0x30);
            const void* HeldData = *reinterpret_cast<void**>(
                reinterpret_cast<uintptr_t>(P1) + 0x28);
            std::string Held;
            if (HeldNum > 0 && HeldNum <= 64 && HeldData &&
                IsReadablePointer(HeldData, static_cast<size_t>(HeldNum) * sizeof(wchar_t))) {
                Held = MpNarrow(std::wstring(reinterpret_cast<const wchar_t*>(HeldData),
                    static_cast<size_t>(HeldNum - 1)));
            }
            MpLog("[CharParseProbe] this=" + MpPtr(P1) + " heldNum=" + std::to_string(HeldNum)
                + " heldId='" + Held + "' ok=" + std::to_string(static_cast<int>(P4))
                + " a5=" + std::to_string(P5));
        }
    }
    if (MpOrigParse) {
        MpOrigParse(P1, P2, P3, P4, P5);
    }
}

using MpSetUrlFn = void(*)(void*, void*);
static MpSetUrlFn MpOrigSetUrl = nullptr;

static void MpSetUrlHook(void* Request, void* UrlRaw) {
    if (MpExeRelativeFlagPresent(L"CHARACTER_ASSOC_PROBE.flag") && Request && UrlRaw) {
        struct RawFString { wchar_t* Data; int32_t Num; int32_t Max; };
        auto* Url = reinterpret_cast<RawFString*>(UrlRaw);
        if (IsReadablePointer(Url, sizeof(*Url)) && Url->Data && Url->Num >= 2 &&
            Url->Max >= Url->Num && Url->Num <= 32768 &&
            IsReadablePointer(Url->Data, static_cast<size_t>(Url->Num) * sizeof(wchar_t))) {
            const std::wstring Incoming(Url->Data, static_cast<size_t>(Url->Num - 1));
            if (Incoming.find(L"/character") != std::wstring::npos) {
                static std::atomic<int> s_seq{ 0 };
                if (s_seq.fetch_add(1, std::memory_order_relaxed) < 6) {
                    void* Frames[16]{};
                    const USHORT Count = CaptureStackBackTrace(
                        1, static_cast<DWORD>(std::size(Frames)), Frames, nullptr);
                    std::string Stack;
                    for (USHORT Index = 0; Index < Count; ++Index) {
                        if (Index) Stack += " ";
                        Stack += MpAddress(Frames[Index]);
                    }
                    MpLog("[CharCreateProbe] request=" + MpPtr(Request) + " stack=" + Stack);
                }
            }
        }
    }
    if (MpOrigSetUrl) {
        MpOrigSetUrl(Request, UrlRaw);
    }
}

static bool MpRewriteRequestUrl(void* Request) {
    if (!Request || !IsReadablePointer(Request, 0xD0)) return false;

    struct RawFString { wchar_t* Data; int32_t Num; int32_t Max; };
    auto* Url = reinterpret_cast<RawFString*>(reinterpret_cast<uintptr_t>(Request) + 0x70);
    if (!IsReadablePointer(Url, sizeof(*Url)) || !Url->Data || Url->Num < 2 ||
        Url->Max < Url->Num || Url->Num > 32768 ||
        !IsReadablePointer(Url->Data, static_cast<size_t>(Url->Num) * sizeof(wchar_t))) {
        return false;
    }

    // ProcessRequest uses +0xC4 == 1 for an already in-flight request. Let the
    // native failure behavior run without mutating that request's URL.
    if (*reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Request) + 0xC4) == 1) return false;

    const std::wstring Incoming(Url->Data, static_cast<size_t>(Url->Num - 1));
    std::wstring Host;
    std::wstring Tail;
    const bool SplitOk = MpSplitUrl(Incoming, Host, Tail);

    // [1.14.7 diagnostic 2026-10-03] URL_PATH_DIAG.flag: log the HOST and PATH of every request the
    // client attempts through this rewrite hook, INCLUDING hosts this runtime does not rewrite.
    // The first version of this log sat after the allowlist check below, which hid exactly the case
    // that matters now: the progression configuration query never reaches the backend, so it may be
    // going to a host outside the allowlist (and therefore never rewritten, never seen). Logged
    // before the check, with a marker for whether the host is rewritten. Backend API paths only - no
    // bodies, no queries, no tokens - and only while the flag is present next to the game executable.
    if (SplitOk && MpExeRelativeFlagPresent(L"URL_PATH_DIAG.flag")) {
        MpLog("[UrlPathDiag] " + MpNarrow(Host) + MpNarrow(Tail)
            + (MpIsRedirectHost(Host) ? " [rewritten]" : " [NOT rewritten]"));
    }

    if (!SplitOk || !MpIsRedirectHost(Host)) return false;

    const std::wstring Replacement = MpBuildRedirectUrl(Host, Tail);
    if (Replacement.size() >= 32767) return false;
    const int32_t NewCount = static_cast<int32_t>(Replacement.size() + 1);
    wchar_t* NewData = Url->Data;
    if (Url->Max < NewCount) {
        NewData = static_cast<wchar_t*>(EngineRealloc(
            Url->Data, static_cast<size_t>(NewCount) * sizeof(wchar_t)));
        if (!NewData) return false;
    }

    wmemcpy(NewData, Replacement.c_str(), static_cast<size_t>(NewCount));
    Url->Data = NewData;
    Url->Num = NewCount;
    if (Url->Max < NewCount) Url->Max = NewCount;

    static volatile LONG LoggedRewrite = 0;
    if (InterlockedCompareExchange(&LoggedRewrite, 1, 0) == 0) {
        MpLog(std::string("[UrlRedirect] ProcessRequest active host=") + MpNarrow(Host));
    }
    return true;
}

// Rewrite is PERMANENTLY ON for every client (dev and distributed players alike): all
// allowlisted backend traffic is redirected to paradox.mysticfox.dev. There is no
// sentinel/flag gate — players never have a dev flag file, and no stray file should ever
// be able to disable the redirect and break everyone's connection. Logged once.
// Observation logging is OFF by default and gated by its OWN sentinel, independent
// of rewrite, so it never runs in production and can be turned off once rewrite is on.
static bool MpUrlLogEnabled() {
    static int Cached = -1;
    if (Cached < 0) {
        Cached = DevelopmentRuntimeProfile()
            && MpExeRelativeFlagPresent(L"URL_LOG.flag") ? 1 : 0;
    }
    return Cached == 1;
}

// UrlRedirect observation dedup + budget state. Deliberately POD + Interlocked, NOT
// std::mutex/std::set: a non-trivial function-local static (std::set) faulted on its
// lazy first-use construction the first time MpLogUrlObservation was reached from a curl
// HTTP worker thread (crash: MpLogUrlObservation -> msvcp140, read 0x0). File-scope POD is
// zero-initialized at load and has no lazy constructor, so it cannot fault that way.
static constexpr int kUrlObsMax = 512;
static volatile LONG g_UrlObsSpin = 0;      // 0=free, 1=held (zero-init, no constructor)
static uint64_t g_UrlObsSeen[kUrlObsMax];   // FNV-1a hashes of host+path already logged (zero-init)
static int g_UrlObsCount = 0;               // distinct entries logged so far (budget)

static uint64_t MpUrlKeyHash(const std::wstring& Host, const std::wstring& Path) {
    uint64_t H = 1469598103934665603ULL; // FNV-1a offset basis
    auto Mix = [&H](const std::wstring& S) {
        for (wchar_t C : S) { H ^= static_cast<uint16_t>(C); H *= 1099511628211ULL; }
        H ^= static_cast<uint8_t>('|'); H *= 1099511628211ULL;
    };
    Mix(Host); Mix(Path);
    return H;
}

// Sanitized observation log: host + path only (query redacted — it may carry tokens or
// exchange codes; never log secrets, headers or bodies). Deduplicated on host+path and
// hard-capped so a chatty client cannot reintroduce log-driven frame lag. Thread-safe via
// an Interlocked spinlock guarding only the POD bookkeeping; file I/O happens outside it.
static void MpLogUrlObservation(const std::wstring& Host, const std::wstring& Tail, bool WillRewrite) {
    auto Narrow = [](const std::wstring& W) {
        std::string S; S.reserve(W.size());
        for (wchar_t C : W) S += (C >= 0x20 && C < 0x7f) ? static_cast<char>(C) : '?';
        return S;
    };
    std::wstring Path = Tail;
    const size_t Q = Path.find(L'?');
    const bool HadQuery = (Q != std::wstring::npos);
    if (HadQuery) Path.resize(Q);

    const uint64_t Key = MpUrlKeyHash(Host, Path);
    bool LogLine = false;
    bool LogBudgetNotice = false;

    while (InterlockedCompareExchange(&g_UrlObsSpin, 1, 0) != 0) { YieldProcessor(); }
    if (g_UrlObsCount < kUrlObsMax) {
        bool Seen = false;
        for (int i = 0; i < g_UrlObsCount; ++i) { if (g_UrlObsSeen[i] == Key) { Seen = true; break; } }
        if (!Seen) {
            g_UrlObsSeen[g_UrlObsCount++] = Key;
            LogLine = true;
            if (g_UrlObsCount == kUrlObsMax) LogBudgetNotice = true;
        }
    }
    InterlockedExchange(&g_UrlObsSpin, 0);

    if (LogLine) {
        MpLog(std::string("[UrlRedirect] host=") + Narrow(Host) + " path=" + Narrow(Path)
            + (HadQuery ? " ?<redacted>" : "") + (WillRewrite ? "  => REWRITE" : "  (observe)"));
    }
    if (LogBudgetNotice) {
        MpLog("[UrlRedirect] observation budget reached (512 distinct host+path); further observations suppressed");
    }
}

// ============================================================================
// [1.12.0 XMPP] FConfigCacheIni::GetString redirect (CLIENT ONLY) — WP1 of
// Plans/XMPP_PRESENCE_CHAT_IMPLEMENTATION_PLAN.md.
//
// Verified in Ghidra: RVA 0x0243CAD0 = FConfigCacheIni::GetString(
//   this, const TCHAR* Section, const TCHAR* Key, FString& Value, const FString& Filename) -> bool.
// GetInt (0x0243B600) and GetBool (0x0243A900) call this internally, so overriding the
// string here also covers XMPP ServerPort/bUseSSL/bEnableWebsockets if ever needed (not
// overridden in the first build — plan §7.2).
//
// Observation-first: we ALWAYS call the original, then optionally (a) trace-log a sanitized
// view of the read and (b) override ONLY the XMPP ServerAddr so the client opens its realtime
// WebSocket at our owned endpoint instead of Epic. Two independent sentinels, default OFF,
// cached on first read — players never have these files, so this is inert for everyone until
// capture is explicitly enabled on a dev box. Removing XMPP_REDIRECT.flag reverts to Epic
// WITHOUT touching HTTP rewriting (plan §7.4, §21).
//   debug\XMPP_TRACE.flag    -> sanitized observation of config string reads
//   debug\XMPP_REDIRECT.flag -> override XMPP ServerAddr -> wss://paradox.mysticfox.dev/__ws/xmpp
// ============================================================================
// NOTE: capture proved the 1.12 client builds its XMPP WS URL as ServerAddr + ":" + ServerPort
// (naive concat). So ServerAddr MUST be host-only (no path) — a path gets ":443" appended AFTER
// it (observed reject: GET /__ws/xmpp:443). With a bare host the client connects to
// wss://paradox.mysticfox.dev:443 and requests the root path, which the gateway accepts.
// [2026-10-13 realms S1] The ServerAddr written here is MpXmppWsUrl() - still wss://MP_PUBLIC_HOST (host only, no path)
// by default, ws:// or wss:// plus the host of MYSTICPARADOX_BACKEND_URL when the launcher set it (backend-address
// block above). Because of the concatenation the port cannot ride in that string: when the address came from the
// environment the hook also answers XMPP ServerPort with MpXmppServerPort() (scheme default 80 / 443 or the explicit
// port); with the built-in address ServerPort is left to the game's own config (443), as before.

static bool MpXmppTraceEnabled() {
    static int Cached = -1;
    if (Cached < 0) {
        Cached = DevelopmentRuntimeProfile()
            && MpExeRelativeFlagPresent(L"XMPP_TRACE.flag") ? 1 : 0;
    }
    return Cached == 1;
}

// [PROD] XMPP config redirect is permanent in the private-server build: the client's
// OnlineSubsystemMcp.XMPP ServerAddr must point at our gateway (wss://paradox.mysticfox.dev)
// or presence/chat can never reach us. Validated end-to-end (auth+bind+presence+Party MUC).
// Previously gated behind XMPP_REDIRECT.flag; now unconditionally enabled (no flag required).
static bool MpXmppRedirectEnabled() {
    return true;
}

// Case-insensitive substring test via a _wcsnicmp sliding window (avoids <cwctype>/towlower).
static bool MpWContainsCI(const std::wstring& Haystack, const wchar_t* Needle) {
    const size_t NLen = wcslen(Needle);
    if (NLen == 0) return true;
    if (Haystack.size() < NLen) return false;
    for (size_t i = 0; i + NLen <= Haystack.size(); ++i) {
        if (_wcsnicmp(Haystack.c_str() + i, Needle, NLen) == 0) return true;
    }
    return false;
}

// True when (Section or Key) names the XMPP transport AND Key selects the physical server
// address — the ONE value we redirect (plan §7.1 allowlist). Robust to both
// "[OnlineSubsystemMcp.XMPP] ServerAddr" and "Messaging.XMPP.ServerAddr" style naming.
static bool MpIsXmppServerAddr(const std::wstring& Section, const std::wstring& Key) {
    const bool KeyIsServerAddr =
        (_wcsicmp(Key.c_str(), L"ServerAddr") == 0) || MpWContainsCI(Key, L"serveraddr");
    if (!KeyIsServerAddr) return false;
    return MpWContainsCI(Section, L"xmpp") || MpWContainsCI(Key, L"xmpp");
}

// Trace filter: only OBSERVE reads relevant to the social/realtime transport, so the engine's
// thousands of unrelated config reads (physics, audio, rendering, GC...) never flood the log or
// exhaust the dedup budget before the (late, login-time) XMPP ServerAddr read occurs.
static bool MpIsXmppInterestingConfig(const std::wstring& Section, const std::wstring& Key) {
    static const wchar_t* kNeedles[] = {
        L"xmpp", L"messaging", L"serveraddr", L"onlinesubsystem", L"mcp",
        L"presence", L"jabber", L"notification", L"stomp", L"epicgames", L"steelyard",
    };
    for (const wchar_t* N : kNeedles) {
        if (MpWContainsCI(Section, N) || MpWContainsCI(Key, N)) return true;
    }
    return false;
}

// Sanitized + deduped + budgeted observation of config reads. Only section/key/result and a
// coarse rewrite flag are logged — NEVER a credential or full config value.
static constexpr int kXmppObsMax = 512;
static volatile LONG g_XmppObsSpin = 0;      // 0=free, 1=held (zero-init, no constructor)
static uint64_t g_XmppObsSeen[kXmppObsMax];  // FNV-1a of section|key already logged (zero-init)
static int g_XmppObsCount = 0;

static void MpLogXmppConfigObservation(const std::wstring& Section, const std::wstring& Key, bool Found, bool WillRewrite) {
    uint64_t H = 1469598103934665603ULL; // FNV-1a offset basis
    auto AsciiFold = [](wchar_t c) -> uint16_t { return (c >= L'A' && c <= L'Z') ? static_cast<uint16_t>(c + 32) : static_cast<uint16_t>(c); };
    auto Mix = [&H, &AsciiFold](const std::wstring& S) {
        for (wchar_t C : S) { H ^= AsciiFold(C); H *= 1099511628211ULL; }
        H ^= static_cast<uint8_t>('|'); H *= 1099511628211ULL;
    };
    Mix(Section); Mix(Key);

    bool LogLine = false;
    while (InterlockedCompareExchange(&g_XmppObsSpin, 1, 0) != 0) { YieldProcessor(); }
    if (g_XmppObsCount < kXmppObsMax) {
        bool Seen = false;
        for (int i = 0; i < g_XmppObsCount; ++i) { if (g_XmppObsSeen[i] == H) { Seen = true; break; } }
        if (!Seen) { g_XmppObsSeen[g_XmppObsCount++] = H; LogLine = true; }
    }
    InterlockedExchange(&g_XmppObsSpin, 0);

    if (LogLine) {
        MpLog(std::string("[XmppConfig] section=") + MpNarrow(Section) + " key=" + MpNarrow(Key)
            + " found=" + (Found ? "1" : "0") + (WillRewrite ? "  => REWRITE ServerAddr" : ""));
    }
}

// [2026-10-13 realms S1] True when (Section or Key) names the XMPP transport AND Key is exactly ServerPort - the port the
// client appends to ServerAddr (only overridden when the backend address came from the environment).
static bool MpIsXmppServerPort(const std::wstring& Section, const std::wstring& Key) {
    return _wcsicmp(Key.c_str(), L"ServerPort") == 0
        && (MpWContainsCI(Section, L"xmpp") || MpWContainsCI(Key, L"xmpp"));
}

// Overwrites the OUTPUT FString (Value), which the client reads AFTER the hook returns, using the proven
// engine-allocating pattern (see EngineRealloc / GetGameDefaultMap). A shallow FString(wchar_t*) would alias freed CRT
// storage and dangle here. False (Value untouched) when the engine allocation fails.
static bool MpWriteEngineFString(void* Value, const std::wstring& New) {
    struct RawFString { wchar_t* Data; int Num; int Max; };
    RawFString* Raw = reinterpret_cast<RawFString*>(Value);
    const int Count = static_cast<int>(New.size()) + 1; // include null terminator

    if (Raw->Max < Count || Raw->Data == nullptr) {
        Raw->Data = static_cast<wchar_t*>(EngineRealloc(Raw->Data, static_cast<size_t>(Count) * sizeof(wchar_t)));
    }
    if (Raw->Data == nullptr) return false;
    wmemcpy(Raw->Data, New.c_str(), static_cast<size_t>(Count));
    Raw->Num = Count;
    if (Raw->Max < Count) Raw->Max = Count;
    return true;
}

void* OrigGetConfigString = nullptr;

// bool FConfigCacheIni::GetString(this, const TCHAR* Section, const TCHAR* Key, FString& Value, const FString& Filename)
bool GetConfigStringHook(void* This, const wchar_t* Section, const wchar_t* Key, void* Value, const void* Filename) {
    using GetStringFn = bool(*)(void*, const wchar_t*, const wchar_t*, void*, const void*);
    const bool Found = reinterpret_cast<GetStringFn>(OrigGetConfigString)(This, Section, Key, Value, Filename);

    // Zero-work passthrough unless a sentinel is present (the normal player path).
    const bool Trace = MpXmppTraceEnabled();
    const bool Redirect = MpXmppRedirectEnabled();
    if (!Trace && !Redirect) return Found;

    // Section/Key are engine-owned, null-terminated wide strings; guard against a null/garbage ptr.
    std::wstring Sec = (Section && IsReadablePointer((void*)Section, sizeof(wchar_t))) ? std::wstring(Section) : std::wstring();
    std::wstring K   = (Key && IsReadablePointer((void*)Key, sizeof(wchar_t))) ? std::wstring(Key) : std::wstring();

    const bool IsServerAddr = MpIsXmppServerAddr(Sec, K);

    if (Trace && (IsServerAddr || MpIsXmppInterestingConfig(Sec, K))) {
        MpLogXmppConfigObservation(Sec, K, Found, Redirect && IsServerAddr);
    }

    if (Redirect && IsServerAddr && Value != nullptr) {
        const std::wstring New = MpXmppWsUrl();
        if (MpWriteEngineFString(Value, New)) {
            static int LoggedOnce = 0;
            if (!LoggedOnce) { LoggedOnce = 1; MpLog(std::string("[XmppConfig] ServerAddr -> ") + MpNarrow(New)); }
            return true; // Value now holds our owned endpoint
        }
        // Allocation failed — fall through and leave the original result untouched.
    }

    // [2026-10-13 realms S1] An address from MYSTICPARADOX_BACKEND_URL also fixes the port (the client appends
    // ":" + ServerPort to ServerAddr). Never reached with the built-in address: ServerPort stays the game's own.
    if (Redirect && Value != nullptr && MpBackendFromEnvironment() && MpIsXmppServerPort(Sec, K)) {
        const std::wstring Port = std::to_wstring(static_cast<unsigned>(MpXmppServerPort()));
        if (MpWriteEngineFString(Value, Port)) {
            static int LoggedPortOnce = 0;
            if (!LoggedPortOnce) { LoggedPortOnce = 1; MpLog(std::string("[XmppConfig] ServerPort -> ") + MpNarrow(Port)); }
            return true;
        }
    }

    return Found;
}

// Installs the XMPP config-redirect hook. Client only (dedicated servers don't need social XMPP).
static void InstallXmppConfigRedirectHook(const char* Mode) {
    MH_STATUS Create = MH_CreateHook((void*)(Globals::BaseAddress + 0x025E6890), GetConfigStringHook, &OrigGetConfigString);
    MH_STATUS Enable = (Create == MH_OK) ? MH_EnableHook((void*)(Globals::BaseAddress + 0x025E6890)) : Create;
    MpLog(std::string("[XmppConfig] (") + Mode + ") GetString hook create=" + MH_StatusToString(Create)
        + " enable=" + MH_StatusToString(Enable) + " target=+" + MpHex(0x025E6890)
        + " trace=" + (MpXmppTraceEnabled() ? "on" : "off") + " redirect=" + (MpXmppRedirectEnabled() ? "on" : "off"));
}

enum EFunctionCallspace : uint32_t
{
    /** This function call should be absorbed (ie client side with no authority) */
    Absorbed = 0x0,
    /** This function call should be called remotely via its net driver */
    Remote = 0x1,
    /** This function call should be called locally */
    Local = 0x2
};

// [Group D cleanup 2026-07-13] GetActorCallspace + OrigGetActorCallspace removed (dead diagnostic —
// never installed via MinHook/HookVirtual; logged "Ammo" functions during early bring-up). EFunctionCallspace enum kept.

void* OrigPostLogin = nullptr;

// NOTE: intentionally NOT installed - AGameMode::PostLogin's 1.12.0 native RVA is not resolved,
// so it cannot be registered via MinHook yet. Per-controller post-login is traced reliably in
// ProcessEventHook ([PostLoginPE]) instead, because K2_PostLogin / ClientOnPostLogin route through
// the already-installed ProcessEvent hook on the server. Kept as a passthrough stub so the
// signature is ready if the native RVA is found later.
void PostLoginHook(void* a1, AArchonPlayerController* a2) {
    reinterpret_cast<void(*)(void*, void*)>(OrigPostLogin)(a1, a2);
}

void* OrigHasFinishedLoading = nullptr;

// [Phase 0 diagnostic 2026-07-11] Natural-mode toggle. If the sentinel file exists, DISABLE the
// gameplay readiness bypasses so we can observe the NATURAL init lifecycle (the forces contaminate it).
// Read-only tracing stays on regardless. Flip by creating/deleting the file - no rebuild needed.
// Sentinel: <game-exe-dir>\DIAG_NATURAL.flag
static bool DiagNaturalMode() {
    static int cached = -1;
    if (cached < 0) {
        cached = MpExeRelativeFlagPresent(L"DIAG_NATURAL.flag") ? 1 : 0;
        MpLog(std::string("[Diag] natural-mode ") + (cached ? "ON (gameplay bypasses DISABLED)" : "off (bypasses active)"));
    }
    return cached == 1;
}

// [Group C cleanup 2026-07-13] ForceNetUpdateEnabled + FORCE_NETUPDATE.flag experiment removed
// (its only caller was the deleted DumpLifecycleState).

// Sentinel: <game-exe-dir>\USE_ARCHON_REPGRAPH.flag (historical; see below)
// [Phase 0f] Replication-graph selection. The current production path prefers the game's own
// UArchonReplicationGraph over stock UBasicReplicationGraph. The selected class's runtime flags and
// successful construction still require 1.14.7 repro validation.
static bool UseArchonRepGraph() {
    // [PROD] Preserve the validated known-good config (USE_ARCHON_REPGRAPH.flag was present in
    // debug\): use the game's own UArchonReplicationGraph. Previously flag-gated; now permanent.
    static bool s_loggedRepGraph = false;
    if (!s_loggedRepGraph) {
        s_loggedRepGraph = true;
        MpLog("[Phase0f] ReplicationGraph = ArchonReplicationGraph (game's own) [permanent]");
    }
    return true;
}

// FUN_141A60BC0 is the generic IArchonLoadingInterface dispatcher, not a controller-specific
// readiness getter. Ghidra verifies that it calls the interface vtable (+0x20) and reflected
// HasFinishedLoading implementation for every participating object. The SDK contains world/visual
// participants (escalation GameState, arrival cinematic trigger, armour, weapons and lanterns), so
// changing every false result to true can release the loading screen while streamed materials and
// sublevels are still initializing. On clients, allow the compatibility override only for the exact
// local AArchonPlayerController whose missing backend callback blocks player start.
static bool IsLocalArchonControllerReadinessObject(UObject* Object) {
    if (Globals::AmServer || !Object) return false;
    __try {
        if (!IsReadablePointer(Object, 0x2A0)
            || !IsRegisteredLiveObject(Object)
            || !Object->IsA(SDK::AArchonPlayerController::StaticClass())) {
            return false;
        }

        // SDK 1.12: APlayerController::Player @ +0x298; UPlayer::PlayerController @ +0x30.
        void* Player = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Object) + 0x298);
        if (!Player || !IsReadablePointer(Player, 0x38)
            || !IsRegisteredLiveObject(Player)
            || !reinterpret_cast<UObject*>(Player)->IsA(SDK::ULocalPlayer::StaticClass())) {
            return false;
        }

        void* PlayerController = *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(Player) + 0x30);
        if (PlayerController != Object || Object != s_LastPossessedPC) {
            return false;
        }

        // The controller override itself must obey the same travel-settle and stable-chain proof as
        // input/cinematic repair. Otherwise the hook could still close the loading screen before the
        // new map's possession graph has converged, even though non-controller blockers are natural.
        UObject* StablePawn = nullptr;
        return IsClientRolePumpPossessionStable(Object, &StablePawn);
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

// [1.14.7 DIAG 2026-10-10] Training's arrival-cinematic trigger. On every Training arrival the client's
// CheckForPlayerStartEvent (+0x1C9BEB8) gets HasFinishedLoading=false from island_arrival_cinematic_trigger_bp
// for ~17 s after the player already has control (9 Oct 23:57:42-58:00 with the phantom, 10 Oct 09:21:30-47
// without it), then gameplay starts anyway - a timeout, not a load. These read-only lines record the
// trigger's state on both sides so the missing input (replicated slayers / intro animations / atmosphere, or
// its own async load) can be identified. Field offsets are the 1.14.7 SDK's (classes.hpp).
static std::string MpArrivalTriggerState(UObject* Object) {
    if (!Object || !IsReadablePointer(Object, 0x4C0)) return "unreadable";
    auto* T = reinterpret_cast<SDK::Aisland_arrival_cinematic_trigger_bp_C*>(Object);
    return "role=" + std::to_string(static_cast<int>(T->Role))
        + " remoteRole=" + std::to_string(static_cast<int>(T->RemoteRole))
        + " bReplicates=" + std::to_string(static_cast<int>(T->bReplicates))
        + " bClientStarted=" + std::to_string(static_cast<int>(T->bClientStarted))
        + " loadingState=" + std::to_string(static_cast<int>(T->LoadingState))
        + " loadStart=" + std::to_string(T->LLoadStartTime)
        + " slayers=" + std::to_string(T->SlayerActors.Num())
        + " introRefs=" + std::to_string(T->IntroAnimSequenceRefs.Num())
        + " localIntroRefs=" + std::to_string(T->LIntroAnimSequenceRefs.Num())
        + " defaultIntroAnims=" + std::to_string(T->DefaultIntroAnimations.Num())
        + " introAnims=" + std::to_string(T->IntroAnimSequences.Num())
        + " replacements=" + std::to_string(T->ReplacementActors.Num())
        + " supportActors=" + std::to_string(T->SupportCineActors.Num())
        + " primaryCine=" + MpPtr(T->PrimaryCineActor)
        + " approachSeqActor=" + MpPtr(T->IslandApproachLevelSequenceActor)
        + " atmosphere=" + MpPtr(T->IslandAtmosphereSpawner)
        + " cineComponent=" + MpPtr(T->dynamic_cinematic_component_bp);
}

static void* g_MpArrivalTrigger = nullptr;   // last trigger instance seen by the readiness hook

static bool MpIsAGuarded(UObject* Object, UClass* Class) {
    __try {
        return Object->IsA(Class);
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

static void MpProbeArrivalTrigger(UObject* Object, bool Ret, uintptr_t CallerRva) {
    if (!Object) return;
    // The class exists only once Training is loaded; until then a by-name lookup walks every object, so it is
    // retried at most every 2 s (this hook runs for every loading participant). The SDK caches a found class.
    static UClass* s_triggerClass = nullptr;
    static uint64_t s_lastClassLookupMs = 0;
    if (s_triggerClass && !IsRegisteredLiveObject(s_triggerClass)) s_triggerClass = nullptr;   // unloaded on travel
    if (!s_triggerClass) {
        const uint64_t NowLookup = GetTickCount64();
        if (NowLookup - s_lastClassLookupMs < 2000) return;
        s_lastClassLookupMs = NowLookup;
        s_triggerClass = SDK::UObject::FindClassFast("island_arrival_cinematic_trigger_bp_C");
        if (!s_triggerClass) return;
    }
    if (!MpIsAGuarded(Object, s_triggerClass)) return;
    g_MpArrivalTrigger = Object;
    static void* s_lastObject = nullptr;
    static uint64_t s_firstFalseMs = 0;
    static bool s_loggedTrue = false;
    static std::atomic<int> s_budget{ 0 };
    if (Object != s_lastObject) {   // a new map's trigger: start a fresh measurement
        s_lastObject = Object;
        s_firstFalseMs = 0;
        s_loggedTrue = false;
    }
    const uint64_t Now = GetTickCount64();
    if (MpProductionLogProfile()) return;   // [2026-10-11 O3] server lines off (g_MpArrivalTrigger is already recorded)
    if (!Ret) {
        if (s_firstFalseMs == 0) s_firstFalseMs = Now;
        if (s_budget.fetch_add(1, std::memory_order_relaxed) < 60) {
            MpLog(std::string("[ArrivalTrigger] ") + (Globals::AmServer ? "server" : "client")
                + " NOT_FINISHED waitedMs=" + std::to_string(Now - s_firstFalseMs)
                + " sinceClientRestartMs=" + std::to_string(s_LastPossessedAtMs ? Now - s_LastPossessedAtMs : 0)
                + " caller=+" + MpHex(CallerRva) + " " + MpArrivalTriggerState(Object));
        }
    } else if (!s_loggedTrue) {
        s_loggedTrue = true;
        MpLog(std::string("[ArrivalTrigger] ") + (Globals::AmServer ? "server" : "client")
            + " FINISHED after waitedMs=" + std::to_string(s_firstFalseMs ? Now - s_firstFalseMs : 0)
            + " caller=+" + MpHex(CallerRva) + " " + MpArrivalTriggerState(Object));
    }
}

// [1.14.7 FIX 2026-10-10] Release an idle Training arrival trigger early (client).
// The 10 Oct 09:35 probe settled it: the server's trigger loads its assets 1 s after boot (loadingState=2) but
// never gets the arriving player in SlayerActors (0 for 40 s), so the arrival cinematic never starts; the
// client's trigger sits at slayers=0 / introRefs=0 / bClientStarted=0 / loadingState=0 and its readiness turns
// TRUE after its own 18 s timeout with nothing changed. Returning TRUE as soon as the local possession chain
// is stable (the same proof the controller override uses) gives the identical end state 15 s sooner. Any sign
// of a real cinematic (a slayer, intro refs, a started client, a load, a cinematic actor) keeps the native
// answer. KEEP_ARRIVAL_TRIGGER_WAIT.flag reverts.
static bool MpArrivalTriggerIdleReady(UObject* Object) {
    static int s_disabled = -1;
    if (s_disabled < 0) {
        s_disabled = MpExeRelativeFlagPresent(L"KEEP_ARRIVAL_TRIGGER_WAIT.flag") ? 1 : 0;
        MpLog(std::string("[ArrivalTrigger] idle-trigger release ")
            + (s_disabled ? "OFF (KEEP_ARRIVAL_TRIGGER_WAIT.flag present)" : "ON (default)"));
    }
    if (s_disabled == 1 || Globals::AmServer || !Object || !IsReadablePointer(Object, 0x4C0)) return false;
    auto* T = reinterpret_cast<SDK::Aisland_arrival_cinematic_trigger_bp_C*>(Object);
    if (T->SlayerActors.Num() != 0 || T->IntroAnimSequenceRefs.Num() != 0 || T->bClientStarted
        || static_cast<int>(T->LoadingState) != 0 || T->PrimaryCineActor || T->IslandApproachLevelSequenceActor) {
        return false;
    }
    MpForgetPossessionIfWorldChanged();
    UObject* PC = s_LastPossessedPC;
    if (!PC || !IsRegisteredLiveObject(PC)) return false;
    UObject* StablePawn = nullptr;
    return IsClientRolePumpPossessionStable(PC, &StablePawn);
}

// Server half of the probe above: the trigger's replicated inputs as the server holds them, every 2 s for 40 s
// after each login (the server's own readiness checks are forced TRUE and may never ask the trigger).
// [2026-10-11 1.14.7 O2] When the trigger was not cached, every 2 s sample for 40 s after EACH login did a by-name class
// lookup (FindClassFast walks the object array) and then a full GObjects walk with an IsA per object - on Ramsgate,
// which has no arrival trigger, that is ~20 full walks per joining player for nothing. Now the class lookup and the walk
// run at most once per world (GWorld pointer); a trigger the readiness hook sees later is still picked up through
// g_MpArrivalTrigger. Read-only diagnostic: it releases nothing (the client's release is MpArrivalTriggerIdleReady).
// LEGACY_LIFECYCLE_WALK.flag restores the per-sample lookup; PRODUCTION_LOG_PROFILE.flag turns the probe off.
static void MpArrivalTriggerServerProbe() {
    if (!Globals::AmServer) return;
    const uint64_t PostLoginMs = g_MpLastPostLoginMs.load(std::memory_order_relaxed);
    if (PostLoginMs == 0) return;
    const uint64_t Now = GetTickCount64();
    if (Now - PostLoginMs > 40000) return;
    static uint64_t s_last = 0;
    if (Now - s_last < 2000) return;
    s_last = Now;
    static int s_budget = 0;
    if (s_budget >= 60) return;
    if (MpProductionLogProfile()) return;

    void* Trigger = g_MpArrivalTrigger;
    if (!Trigger || !IsRegisteredLiveObject(Trigger)) {
        Trigger = nullptr;
        static void* s_searchedWorld = nullptr;   // world whose search already came back empty
        void* World = SDK::UWorld::GetWorld();
        if (!MpLegacyLifecycleWalk()) {
            if (World && World == s_searchedWorld) return;
            s_searchedWorld = World;
        }
        UClass* Cls = SDK::UObject::FindClassFast("island_arrival_cinematic_trigger_bp_C");
        if (!Cls || !UObject::GObjects) return;   // not a map with an arrival cinematic
        const int Count = UObject::GObjects->Num();
        for (int i = 0; i < Count; ++i) {
            UObject* Obj = UObject::GObjects->GetByIndex(i);
            if (!Obj || Obj->IsDefaultObject() || !MpIsAGuarded(Obj, Cls)) continue;
            Trigger = Obj;
            break;
        }
        if (!Trigger) return;
        g_MpArrivalTrigger = Trigger;
    }
    ++s_budget;
    MpLog("[ArrivalTrigger] server state sincePostLoginMs=" + std::to_string(Now - PostLoginMs)
        + " obj=" + MpPtr(Trigger) + " " + MpArrivalTriggerState(reinterpret_cast<UObject*>(Trigger)));
}

bool HasFinishedLoadingHook(UObject* a1) {
    const bool Ret = reinterpret_cast<bool(*)(UObject*)>(OrigHasFinishedLoading)(a1);
    MpProbeArrivalTrigger(a1, Ret, reinterpret_cast<uintptr_t>(_ReturnAddress()) >= Globals::BaseAddress
        ? reinterpret_cast<uintptr_t>(_ReturnAddress()) - Globals::BaseAddress : 0);
    if (Ret) return true;

    const uintptr_t ReturnAddress = reinterpret_cast<uintptr_t>(_ReturnAddress());
    const uintptr_t CallerRva = ReturnAddress >= Globals::BaseAddress
        ? ReturnAddress - Globals::BaseAddress : 0;

    if (DiagNaturalMode()) {
        static std::atomic<int> s_hflNatural{ 0 };
        if (s_hflNatural.fetch_add(1, std::memory_order_relaxed) < 20) {
            MpLog(std::string("[ReadinessCompat] PRESERVE_FALSE mode=natural obj=")
                + (a1 ? a1->GetFullName() : "(null)")
                + " caller=+" + MpHex(CallerRva));
        }
        return false;
    }

    if (Globals::AmServer) {
        // Preserve the established dedicated-server compatibility behavior. The visual-loading race
        // is client-only; narrowing server readiness in the same build would mix two independent
        // changes and risk reintroducing player-start timeouts on headless instances.
        static std::atomic<int> s_hflServer{ 0 };
        if (s_hflServer.fetch_add(1, std::memory_order_relaxed) < 20) {
            MpLog(std::string("[ReadinessCompat] FORCE_TRUE scope=server-legacy obj=")
                + (a1 ? a1->GetFullName() : "(null)")
                + " caller=+" + MpHex(CallerRva));
        }
        return true;
    }

    if (a1 && a1 == g_MpArrivalTrigger && MpArrivalTriggerIdleReady(a1)) {
        static void* s_releasedTrigger = nullptr;
        if (s_releasedTrigger != a1) {
            s_releasedTrigger = a1;
            MpLog("[ArrivalTrigger] client RELEASED idle trigger (no slayers replicated, possession stable) sinceClientRestartMs="
                + std::to_string(s_LastPossessedAtMs ? GetTickCount64() - s_LastPossessedAtMs : 0)
                + " - its own timeout is 18 s; " + MpArrivalTriggerState(a1));
        }
        return true;
    }

    if (IsLocalArchonControllerReadinessObject(a1)) {
        static std::atomic<int> s_hflController{ 0 };
        if (s_hflController.fetch_add(1, std::memory_order_relaxed) < 20) {
            const uint64_t Elapsed = s_LastPossessedAtMs != 0
                ? GetTickCount64() - s_LastPossessedAtMs : 0;
            MpLog(std::string("[ReadinessCompat] FORCE_TRUE scope=local-controller obj=")
                + a1->GetFullName()
                + " sinceClientRestartMs=" + std::to_string(Elapsed)
                + " caller=+" + MpHex(CallerRva));
        }
        return true;
    }

    // [1.14.7 DIAG 2026-10-08] Separate budgets: inventory item-id lookups (caller +0x1BFDF81,
    // FItemInstanceIdRepl::ResolveItemInstanceId) used up all 40 lines within 9 ms on the 8 Oct hunt
    // join, which would hide any later player-start blocker (caller +0x1C9BEB8, CheckForPlayerStartEvent).
    static std::atomic<int> s_hflPreserved{ 0 };
    static std::atomic<int> s_hflPreservedInventory{ 0 };
    std::atomic<int>& PreserveBudget = (CallerRva == 0x1BFDF81) ? s_hflPreservedInventory : s_hflPreserved;
    if (PreserveBudget.fetch_add(1, std::memory_order_relaxed) < 40) {
        MpLog(std::string("[ReadinessCompat] PRESERVE_FALSE scope=client-not-allowlisted obj=")
            + (a1 ? a1->GetFullName() : "(null)")
            + " caller=+" + MpHex(CallerRva));
    }
    return false;
}

bool IsNetReadyHook() {
    return true;
}

int InternalNetModeHook(void* a1) {
    return 1;   // full EAX - see the declaration comment
}

int WorldNetModeHook(void* a1) {
    return 1;
}

bool IsLevelInitForActorHook(void* a1, char a2) {
    bool real = reinterpret_cast<bool (*)(void*, char)>(OrigIsLevelInitForActor)(a1, a2);

    // [Phase 0P 2026-07-12] The force-true bypass makes the manual loop ship streamed-sublevel actors
    // BEFORE the client acks those levels visible -> client SerializeNewActor failures (Actor: None) +
    // lost streamed-level interaction completions + PendingReplication/120s timeout. Verified: our own
    // code forces this, and the client acks show sublevels going through the visibility handshake.
    // Gate: with debug\NO_LEVELINIT_FORCE.flag present, return the REAL value so replication respects
    // level-visibility (persistent-level pawn/loadout still init-true; streamed actors wait for the ack).
    // Default (flag absent) = legacy force-true, so this is opt-in + fully reversible.
    // [PROD] Preserve the validated known-good config (NO_LEVELINIT_FORCE.flag was present in
    // debug\): respect real level-visibility permanently. The legacy force-true path caused client
    // SerializeNewActor failures + PendingReplication/120s timeouts, so it stays disabled (no flag).
    // Persistent-level pawn/loadout still init-true naturally; streamed actors wait for the client ack.
    static bool s_loggedLevelInit = false;
    if (!s_loggedLevelInit) {
        s_loggedLevelInit = true;
        MpLog("[Phase0P] IsLevelInitForActor force DISABLED (respect real visibility) [permanent]");
    }
    return real;
}

void* OrigSetReplicationDriver = nullptr;

// [ServerReplicateActors probe 2026-07-17] Read-only hook on UNetDriver::ServerReplicateActors
// (the UNetDriver vtable +0x2A8 target, RVA 0x03D75EF0) that our manual TickFlush invokes. Logs entry/exit
// with the installed ReplicationDriver (+0x6E8), its ActorsWithoutNetConnection count (graph+0x4C0) BEFORE
// and AFTER the native call, ConnMgrs (+0x40) and ClientConns (+0x98). Splits the failure:
//   * hook never enters                          -> manual TickFlush isn't reaching native ServerReplicateActors
//   * enters, ActorsNoConn drops                 -> graph ran + migrated (would work)
//   * enters, ActorsNoConn stuck at 5            -> Archon's migration override missing/bypassed (reroute needed)
// Throttled ~1/sec. Pure read + passthrough (no behavior change).
void* OrigServerReplicateActors = nullptr;

// [DRIVE_ARCHON_GRAPH 2026-07-17] The native UNetDriver::ServerReplicateActors (0x03D75EF0) does NOT dispatch
// to the installed graph (proven: ret=0, ActorsNoConn stuck). This flag makes the SRA hook call the Archon
// graph's OWN ServerReplicateActors (FUN_141ab43d0 @ RVA 0x01AB43D0) INSTEAD of the native SRA — it migrates
// ActorsWithoutNetConnection + per-connection gather/replicate. Default OFF. Pair with NATIVE_GRAPH_ONLY
// (custom loop off) so only one path replicates per tick.
// [2026-07-17 PRODUCTION] The native ArchonReplicationGraph is the production replication layer, ON by
// default with NO flag files required. EMERGENCY_LEGACY_REPLICATION.flag reverts to the legacy hand-written
// actor loop (emergency fallback only). REPGRAPH_DIAG.flag re-enables the per-tick diagnostic logging
// ([SRA]/[GraphState]); off in production.
static bool UseNativeGraph() {
    static int c = -1;
    if (c < 0) c = MpExeRelativeFlagPresent(L"EMERGENCY_LEGACY_REPLICATION.flag") ? 0 : 1;
    return c == 1;
}
static bool RepGraphDiag() {
    static int c = -1;
    if (c < 0) c = MpExeRelativeFlagPresent(L"REPGRAPH_DIAG.flag") ? 1 : 0;
    return c == 1;
}
static bool DriveArchonGraph() {
    return UseNativeGraph();
}
// [2026-07-17 co-op smoothness] Raises player-character NetUpdateFrequency so the graph replicates player
// pawns every frame (~30Hz) like the behemoth, instead of the measured ~10Hz (period 3) that causes remote-
// player jitter. Measured + verified via [RepFreq] BP_PlayerCharacter (10 -> ~30) in a 2P hunt.
//
// [2026-07-17 PROMOTED TO PRODUCTION DEFAULT] Was gated behind PLAYER_REP_BOOST.flag for A/B; now ON by
// default so every tester gets the fix without needing a flag file. Reversible A/B: create
// DISABLE_PLAYER_REP_BOOST.flag next to the game .exe to revert to the native ~10Hz behavior. The actual
// write lives in BoostPlayerCharCDONetFreq() (CDO NetUpdateFrequency +0x108 -> 60, MinNetUpdateFrequency
// +0x10C -> 30) applied in SetReplicationDriverHook before native graph init; effective rate is capped by
// NetServerMaxTickRate (30) => period 1.
static bool PlayerRepBoost() {
    static int c = -1;
    if (c < 0) c = MpExeRelativeFlagPresent(L"DISABLE_PLAYER_REP_BOOST.flag") ? 0 : 1;
    return c == 1;
}

// [2026-07-18 travel-visibility A/B] Force player pawns ALWAYS-RELEVANT via the BP_PlayerCharacter CDO
// (AActor::bAlwaysRelevant, +0x58 bit3) BEFORE graph init, so they route through the graph's always-
// relevant node instead of the spatial grid. This targets the reported "travel back to Ramsgate ->
// invisible" bug: on the persistent hub, a player rejoining after travel is not consistently re-added
// to the grid node relevant to existing connections (log: repeated "Attempted to remove
// BP_PlayerCharacter ... from ReplicationGraphNode_ActorList ... not found"), so players stop seeing
// each other. Always-relevant makes hub visibility independent of that grid/travel churn. For <=4
// co-op players the extra bandwidth is negligible (and hunts benefit too). A/B, DEFAULT OFF: create
// PLAYER_ALWAYS_RELEVANT.flag next to the game exe (server-side) to enable; promote to default if it
// resolves the invisibility on a travel round-trip.
static bool PlayerAlwaysRelevant() {
    static int c = -1;
    if (c < 0) c = MpExeRelativeFlagPresent(L"PLAYER_ALWAYS_RELEVANT.flag") ? 1 : 0;
    return c == 1;
}
// [2026-07-18 owner-pawn relevancy] Make the OWNER's own pawn reliably relevant to its OWN connection —
// per-connection only, NOT global always-relevant, so it does NOT reintroduce the armor-hide regression
// that global PLAYER_ALWAYS_RELEVANT caused. Root cause of the intermittent "stuck loading into Ramsgate"
// (confirmed via per-login capture 2026-07-18): ClientRestart fires and the pawn is possessed server-side,
// but the client never resolves the pawn NetGUID (ServerCheckClientPossessionReliable pawnParam=null loops
// forever, ServerAcknowledgePossession never arrives). The rep graph's per-connection
// AlwaysRelevant_ForConnection gather makes the connection's ViewTarget relevant, but the DLL's connect-time
// FORCE-VIEWTARGET leaves the connection ViewTarget = the PlayerController (a pre-pawn bootstrap), so the
// pawn lives only in the spatial GRID. During load the owner's grid cell isn't resolved yet → the pawn is
// never gathered → its channel never opens on the owner → loading hangs. Fix: at ClientRestart (pawn exists
// + possessed) point the owning UNetConnection's ViewTarget at the PAWN so the per-connection gather
// includes it, bypassing the flaky grid — for the owning connection only. Default ON; create
// DISABLE_OWNER_PAWN_RELEVANCY.flag next to the game exe to revert. Verify via the per-login capture:
// success = ServerAcknowledgePossession now appears for the previously-stuck login.
static bool OwnerPawnRelevancyFix() {
    static int c = -1;
    if (c < 0) c = MpExeRelativeFlagPresent(L"DISABLE_OWNER_PAWN_RELEVANCY.flag") ? 0 : 1;
    return c == 1;
}
// [1.14.7 HUB CRASH GUARD 2026-10-05] Direction evaluation on a component's spline curve.
//
// MEASURED (module VEH, control run with every added flag absent):
//   hub, ~90 s after a client joined ramsgate_01_persistent:
//   [ExceptionTrace] VEH code=0xC0000005 address=Dauntless-Win64-Shipping.exe+0x1091D5D
//   stack: ... 0x1091D5D  0x3D47AD0
// The two frames are exact:
//   * 0x1091D50 = FUN_141091d50, the FInterpCurveVector evaluator: it bisects Points (stride 0xB floats,
//     i.e. FInterpCurvePoint<FVector>) and interpolates a 3-vector.
//   * 0x3D47AD0 is the return address of the call at 0x3D47ACB inside FUN_143d47a90, which passes
//     `param_1 + 0x448` as the curve, normalises the result, and can rotate it by the component's
//     quaternion at +0x1C0 and scale at +0x1E0.
// At the fault the evaluator's curve Data pointer was 0xDFD633F8 and the faulting read was at
// 0xDFD63400: a user-space-shaped but unmapped address, i.e. the curve struct held a stale pointer. The
// evaluator is the victim; the component it was handed is unusable.
//
// So this guards that one entry point: if the curve at `This + 0x448` cannot be validated, write a zero
// direction and return, instead of calling into an evaluator that will fault. That converts a fatal hub
// access violation into one frame of "no direction", which is the same trade the module already makes at
// InteractionCalloutWidget::OnSetDisabled (crash site 0x1E5414E).
//
// Cost control: the validation runs a VirtualQuery, so the last accepted (This, Data, Num) triple is
// cached and a repeat of it skips the query entirely. Splines are static in the steady state, so this is
// one query per distinct curve, not one per frame.
// DISABLE_SPLINE_GUARD.flag reverts it.
static void* OrigSplineDirection = nullptr;
static constexpr uintptr_t kSplineCurveOffset = 0x448;

static void* SplineDirectionGuard(void* This, float* OutVec, float InVal, int ApplyRotation) {
    typedef void* (*Fn)(void*, float*, float, int);
    Fn Orig = reinterpret_cast<Fn>(OrigSplineDirection);

    // [1.14.7 2026-10-08] The NULL-destination / wild-curve crashes never came through this detour: they
    // were this module jumping to 0x03D47AC0 (mid-instruction in this function) as a stale 1.12
    // CreateChannelByName RVA. Genuine engine calls pass a real destination; leave them untouched.
    if (!OutVec) return Orig(This, OutVec, InVal, ApplyRotation);

    static void* s_goodThis = nullptr;
    static uintptr_t s_goodData = 0;
    static int32_t s_goodNum = 0;

    bool Usable = false;
    if (This && IsReadablePointer(This, kSplineCurveOffset + 0x18)) {
        const uintptr_t Curve = reinterpret_cast<uintptr_t>(This) + kSplineCurveOffset;
        const uintptr_t Data = SafeReadPtr(Curve, 0x00);
        const int32_t Num = SafeReadI32At(Curve, 0x08);
        if (This == s_goodThis && Data == s_goodData && Num == s_goodNum && Data != 0) {
            Usable = true;                                  // unchanged since the last accepted check
        } else if (Data != 0 && Num > 0 && Num <= 10000
                   && IsReadablePointer(reinterpret_cast<void*>(Data),
                                        static_cast<size_t>(Num) * 0x2C)) {
            Usable = true;
            s_goodThis = This; s_goodData = Data; s_goodNum = Num;
        }
    }

    if (Usable) return Orig(This, OutVec, InVal, ApplyRotation);

    OutVec[0] = 0.0f;
    OutVec[1] = 0.0f;
    OutVec[2] = 0.0f;
    static std::atomic<int> s_logs{ 0 };
    if (s_logs.fetch_add(1, std::memory_order_relaxed) < 8) {
        MpLog("[SplineGuard] component spline curve is unusable; returned a zero direction instead of "
            "faulting (this is the +0x1091D5D hub crash path)");
    }
    return OutVec;
}

static bool SplineGuardEnabled() {
    static int c = -1;
    if (c < 0) {
        c = MpExeRelativeFlagPresent(L"DISABLE_SPLINE_GUARD.flag") ? 0 : 1;
        MpLog(std::string("[SplineGuard] DISABLE_SPLINE_GUARD.flag ")
            + (c ? "absent -> the +0x1091D5D spline crash path is guarded (default)"
                 : "PRESENT -> guard disabled"));
    }
    return c == 1;
}

// [1.14.7 HUB CRASH GUARD #2 2026-10-05] The entry detour above is necessary but NOT sufficient.
//
// MEASURED recurrence (hub pid 13328, 23:03:40, after the first guard reported create=MH_OK enable=MH_OK):
// identical frames - rip +0x1091D5D with the return address +0x3D47AD0 inside the hooked FUN_143d47a90 -
// and the entry guard's unusable-curve logger never fired once. Registers: rcx=0x498733F8 (the curve),
// rdx=0x7CDEB1A4C8 (the out vector, on the stack); the faulting read was 0x49873400, i.e.
// MOVSXD R8, dword ptr [RCX+0x8] reading TArray::Num.
//
// So FUN_143d47a90 hands the evaluator more than one curve: the entry check validated the component's own
// curve at +0x448 (readable, therefore accepted) while the call that faulted was given a different, wild
// curve. Guarding the EVALUATOR covers every caller and every call site inside them. FUN_141091d50 takes
// (curve, out FVector, value, param4) per its decompilation, so the curve is RCX and the output RDX.
// Only genuinely unusable curves are intercepted: an empty curve (Num == 0) is passed through because the
// evaluator handles that case explicitly, while a negative/garbage Num or an unreadable Points array gets a
// zero vector instead of an access violation - the same trade the entry guard makes.
// DISABLE_SPLINE_GUARD.flag disables this together with the entry guard.
static void* OrigSplineCurveEval = nullptr;

static void* SplineCurveEvalGuard(void* Curve, float* OutVec, float InVal, void* Param4) {
    typedef void* (*Fn)(void*, float*, float, void*);
    Fn Orig = reinterpret_cast<Fn>(OrigSplineCurveEval);
    if (!OutVec) return Curve ? Orig(Curve, OutVec, InVal, Param4) : nullptr;

    bool Usable;
    uintptr_t Data = 0;
    int32_t Num = -1;
    if (!IsReadablePointer(Curve, 0x10)) {
        Usable = false;                                   // the curve struct itself is wild
    } else {
        Data = SafeReadPtr(reinterpret_cast<uintptr_t>(Curve), 0x00);
        Num = SafeReadI32At(reinterpret_cast<uintptr_t>(Curve), 0x08);
        if (Num == 0) {
            Usable = true;                                // empty curve: the evaluator handles this
        } else {
            Usable = Num > 0 && Num <= 10000 && Data != 0
                && IsReadablePointer(reinterpret_cast<void*>(Data), static_cast<size_t>(Num) * 0x2C)
                && IsReadablePointer(OutVec, sizeof(float) * 3);
        }
    }

    if (Usable) return Orig(Curve, OutVec, InVal, Param4);

    OutVec[0] = 0.0f;
    OutVec[1] = 0.0f;
    OutVec[2] = 0.0f;
    static std::atomic<int> s_logs{ 0 };
    if (s_logs.fetch_add(1, std::memory_order_relaxed) < 8) {
        MpLog("[SplineGuard2] curve evaluator was handed an unusable curve curve=" + MpPtr(Curve)
            + " data=0x" + MpHex(Data) + " num=" + std::to_string(Num)
            + " - returned a zero vector instead of faulting (the +0x1091D5D path)");
    }
    return OutVec;
}

// SEH-isolated (no C++ objects here) call to the graph's ServerReplicateActors. Returns -999 on fault so a
// bad state/signature is caught + logged instead of killing the server.
static int SafeCallGraphServerReplicate(void* graph, float dt) {
    __try {
        return reinterpret_cast<int(__fastcall*)(void*, float)>(Globals::BaseAddress + 0x01C034C0)(graph, dt);
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return -999;
    }
}

// [1.14.7 REPLICATION-GRAPH DRIVE 2026-10-05]
//
// THE ROOT CAUSE OF THE MISSING CLIENT PLAYER STATE.
//
// Measured, static and runtime:
//   * UNetDriver::TickFlush (RVA 0x03FAE700 - the module's own SafeManualTickFlush calls it, and its
//     decompilation iterates ClientConnections calling UNetConnection::Tick) contains NO reference to
//     UNetDriver::ReplicationDriver. That field IS at +0x6E8 (SDK Engine_classes.hpp, UNetDriver) and
//     IS populated with the game's ArchonReplicationGraph, but nothing in TickFlush ever calls it.
//   * The 1.12 module compensated for exactly this with DRIVE_ARCHON_GRAPH: ServerReplicateActorsHook
//     called the graph's own ServerReplicateActors. On 1.14.7 that hook is NOT installed
//     ("[InitServerHooks] ServerReplicateActors probe skipped (1.14.7 target unresolved)"), so the port
//     lost the drive, and the RVA the dead path would have used (0x01AB43D0) is a generic helper.
//   * Slot 89 (+0x2C8) was WRONG. The driver's vtable ends at .rdata 0x5F324F0 with a pointer to RVA
//     0x3FAC7F0, and the string "UReplicationDriver::ServerReplicateActors" sits at 0x145F32A30, so
//     that last driver slot is ServerReplicateActors. The driver slot at -0x18 (RVA 0xF22900) is the
//     same function the graph vtable holds at +0x2E0, which fixes the alignment: graph slot = driver
//     slot + 0x2F8. UArchonReplicationGraph's override is therefore at +0x2F8 = RVA 0x01C034C0, and
//     its decompiled body proves it: it walks the deferred bOnlyRelevantToOwner list at graph+0x4B8
//     (Num +0x4C0), resolves each actor through GetAlwaysRelevantNodeForConnection, then tail-calls
//     UReplicationGraph::ServerReplicateActors (RVA 0xF2EB60).
//   * Consequence of never driving it: the graph still classifies actors into its nodes (so membership
//     reads succeed) and the connection's connect-time actors still arrive, but the connection's
//     actor-info map is never filled by a gather, so ActorInfoNum stays 0-3 and every actor that only
//     an always-relevant route would deliver - AGameStateBase and APlayerState - never reaches the
//     client. That is the measured state: those actors are perfect (bReplicates=1, Role=Authority,
//     RemoteRole=SimulatedProxy, NetDormancy=Awake, bAlwaysRelevant=1, globalMember=1) and the client
//     reports playerStates=0 gameStates=0.
//
// The call goes through the vtable slot rather than a hardcoded RVA so it survives another build.
// DISABLE_GRAPH_DRIVE.flag reverts it.
static int MpCallGraphSraRaw(void* Graph, void* Fn, float DeltaTime) {
    __try {
        return reinterpret_cast<int(__fastcall*)(void*, float)>(Fn)(Graph, DeltaTime);
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return -999;
    }
}

// [1.14.7 2026-10-05] Does the ENGINE ever drive the Archon graph? This pass-through counter answers it
// in one run: the graph's ServerReplicateActors entry (RVA 0x01C034C0, vtable slot +0x2F8) is hooked and
// the first calls are logged with the caller RVA. If it never fires while a client is connected, the
// graph really is undriven - owner-only actors keep sitting in the pending list at graph+0x4B8 and never
// get an actor channel - and this module has to drive it (the 1.12 port did exactly that with its
// DRIVE_ARCHON_GRAPH / ServerReplicateActorsHook pair, which the 1.14.7 port lost).
static void* OrigArchonGraphSra = nullptr;
static int __fastcall ArchonGraphSraHook(void* Graph, float DeltaSeconds) {
    static std::atomic<int> s_calls{ 0 };
    const int n = s_calls.fetch_add(1, std::memory_order_relaxed);
    if (n < 8) {
        MpLog("[GraphSRA] call #" + std::to_string(n) + " graph=" + MpPtr(Graph)
            + " dt=" + std::to_string(DeltaSeconds)
            + " callerRva=+" + MpHex(
                reinterpret_cast<uintptr_t>(_ReturnAddress()) - Globals::BaseAddress));
    }
    return reinterpret_cast<int(__fastcall*)(void*, float)>(OrigArchonGraphSra)(Graph, DeltaSeconds);
}

// The slot is no longer guessed and no longer discovered by trial: +0x2F8 is derived from the driver
// vtable, matched against the graph vtable through a shared slot, and confirmed by decompiling the
// target (see above). The trial machinery below is kept only as a fallback and is never entered,
// because s_sraSlot is pre-set. ENABLE_GRAPH_DRIVE.flag turns the drive on while it is being verified;
// the flag becomes the opt-out once a run proves the client receives its PlayerState.
// DEFAULT ON. This is the fix for the missing PlayerState, not an experiment: measured on 2026-10-05,
// the hub's connection goes from openCh=2-5 with no channel for the GameState or the client's
// APlayerState to openCh=89-100 with channels for both, and the client goes from a 120s "Loading
// timeout while joining the server" to a playable Ramsgate with bGameInputEnabled=true.
// DISABLE_GRAPH_DRIVE.flag returns to the original undriven behaviour.
static bool GraphDriveEnabled() {
    static int c = -1;
    if (c < 0) {
        c = MpExeRelativeFlagPresent(L"DISABLE_GRAPH_DRIVE.flag") ? 0 : 1;
        MpLog(std::string("[GraphDrive] DISABLE_GRAPH_DRIVE.flag ")
            + (c ? "absent -> driving UArchonReplicationGraph::ServerReplicateActors (vtable +0x2F8, "
                   "RVA 0x01C034C0) once per frame; this is what delivers the client's AGameStateBase "
                   "and APlayerState"
                 : "PRESENT -> graph left undriven (the 1.14.7 port's original behaviour, client never "
                   "receives its player state)"));
    }
    return c == 1;
}

static void MpDriveReplicationGraph(float DeltaTime) {
    if (!GraphDriveEnabled() || !Globals::AmServer || !Networking::NetDriver) return;
    // [2026-10-11 1.14.7 O3] The three pointer checks go through MpReadableThisFrame (same checks, one VirtualQuery
    // per frame segment); the call and its slot are unchanged.
    if (!MpReadableThisFrame(Networking::NetDriver, 0x6F0)) return;

    void* Graph = reinterpret_cast<void*>(
        SafeReadPtr(reinterpret_cast<uintptr_t>(Networking::NetDriver), 0x6E8));
    if (!Graph || !MpReadableThisFrame(Graph, 0x4C8)) return;
    if (reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(Graph), 0x30))
        != reinterpret_cast<void*>(Networking::NetDriver)) return;

    const uintptr_t Vt = SafeReadPtr(reinterpret_cast<uintptr_t>(Graph), 0x00);
    if (!Vt || !MpReadableThisFrame(reinterpret_cast<void*>(Vt + 0x2F0), 8)) return;

    static thread_local bool s_inDrive = false;
    if (s_inDrive) return;

    // The slot is identified once, by trial, because two independent attempts to derive it statically
    // disagreed: UReplicationDriver declares ServerReplicateActors first and RouteAddNetworkActorToNodes
    // ninth, which puts it at +0x2C8 given RouteAdd is at +0x308 - but the function at that slot is an
    // Actor-keyed Connections walk (FlushNetDormancy-shaped) and faults when called with a float ABI.
    // Candidates are the graph's own virtuals adjacent to the ones this module already calls; a wrong
    // one lands on a slot that reads RDX as a pointer and faults, which the SEH wrapper catches, so the
    // probe is self-limiting. The winner is logged once and then reused for every frame.
    // RouteAddNetworkActorToNodes is measured at +0x308 (slot 97), and UObject::ProcessEvent is at slot
    // 68 (+0x220), so the whole driver/graph virtual block is slots 69..96 (+0x228..+0x300). The earlier
    // range stopped at +0x290 and found nothing, so probe the entire block. A candidate is only adopted
    // when it functionally gathers actors; the log also records the graph's node/connection counts
    // before and after each call so a destructive virtual (Reset/TearDown-shaped) is obvious.
    // MEASURED: +0x278 (RVA 0xF1E4B0) is graph-mutating - calling it grew GlobalGraphNodes 2->4 and
    // PrepareReplicationNodes 1->2, i.e. it is Reset/Initialize-shaped. The previous ascending probe hit
    // it and then evaluated every later slot against a graph it had already doubled, so those results
    // are void. This list starts ABOVE it, ascending, so the block is only ever entered with an intact
    // graph. Probing also stops immediately if any candidate changes the graph's node or connection
    // counts, which protects the rest of the run.
    static const uintptr_t kCandidateSlots[] = { 0x2F8 };
    static uintptr_t s_sraSlot = 0x2F8;   // UArchonReplicationGraph::ServerReplicateActors (0x01C034C0)
    static std::atomic<int> s_logs{ 0 };

    auto TrySlot = [&](uintptr_t Slot) -> int {
        void* Fn = reinterpret_cast<void*>(SafeReadPtr(Vt, Slot));
        if (!Fn) return -999;
        s_inDrive = true;
        const int R = MpCallGraphSraRaw(Graph, Fn, DeltaTime);
        s_inDrive = false;
        return R;
    };

    if (s_sraSlot != 0) {
        const int Result = TrySlot(s_sraSlot);
        if (Result == -999) {
            static std::atomic<int> s_faults{ 0 };
            if (s_faults.fetch_add(1, std::memory_order_relaxed) < 6) {
                MpLog("[GraphDrive] slot+" + MpHex(s_sraSlot) + " FAULTED (SEH) graph=" + MpPtr(Graph));
            }
            return;
        }
        if (Result != -999) {
            if (s_logs.fetch_add(1, std::memory_order_relaxed) < 6) {
                MpLog("[GraphDrive] slot+" + MpHex(s_sraSlot) + " graph=" + MpPtr(Graph)
                    + " -> " + std::to_string(Result)
                    + " connections=" + std::to_string(SafeReadI32At(reinterpret_cast<uintptr_t>(Graph), 0x40))
                    + " actorsNoConn=" + std::to_string(SafeReadI32At(reinterpret_cast<uintptr_t>(Graph), 0x4C0)));
            }
        }
        return;
    }

    // A candidate is only adopted when it has a FUNCTIONAL effect: after the call, the first
    // connection's actor-info map must hold at least one more actor than before. "Did it fault" is not
    // a valid test - a build that used it adopted +0x2B8 (RVA 0xF18A10), a global-actor-map lookup that
    // harmlessly returns -1 for a garbage key. Probing only happens while a client connection exists,
    // so nothing is called on a bare hub.
    const uintptr_t ConnData = SafeReadPtr(reinterpret_cast<uintptr_t>(Graph), 0x38);
    const int32_t ConnNum = SafeReadI32At(reinterpret_cast<uintptr_t>(Graph), 0x40);
    const int32_t ConnMax = SafeReadI32At(reinterpret_cast<uintptr_t>(Graph), 0x44);
    if (ConnNum <= 0 || !IsSanePointerArray(reinterpret_cast<void*>(ConnData), ConnNum, ConnMax, 64)) {
        return;
    }
    void* ConnMgr = reinterpret_cast<void**>(ConnData)[0];
    if (!ConnMgr || !IsReadablePointer(ConnMgr, 0x40)) return;

    for (uintptr_t Slot : kCandidateSlots) {
        const int32_t InfoBefore = SafeReadI32At(reinterpret_cast<uintptr_t>(ConnMgr) + 0x30, 0x08);
        const int32_t ConnBefore = SafeReadI32At(reinterpret_cast<uintptr_t>(Graph), 0x40);
        const int32_t GlobalNodesBefore = SafeReadI32At(reinterpret_cast<uintptr_t>(Graph), 0xA0);
        const int32_t PrepNodesBefore = SafeReadI32At(reinterpret_cast<uintptr_t>(Graph), 0xB0);
        const int Result = TrySlot(Slot);
        const int32_t InfoAfter = SafeReadI32At(reinterpret_cast<uintptr_t>(ConnMgr) + 0x30, 0x08);
        const int32_t ConnAfter = SafeReadI32At(reinterpret_cast<uintptr_t>(Graph), 0x40);
        const int32_t GlobalNodesAfter = SafeReadI32At(reinterpret_cast<uintptr_t>(Graph), 0xA0);
        const int32_t PrepNodesAfter = SafeReadI32At(reinterpret_cast<uintptr_t>(Graph), 0xB0);
        MpLog("[GraphDriveProbe] slot+" + MpHex(Slot) + " fn="
            + MpAddress(reinterpret_cast<void*>(SafeReadPtr(Vt, Slot)))
            + " -> " + std::to_string(Result)
            + " actorInfo " + std::to_string(InfoBefore) + "->" + std::to_string(InfoAfter)
            + " conns " + std::to_string(ConnBefore) + "->" + std::to_string(ConnAfter)
            + " globalNodes " + std::to_string(GlobalNodesBefore) + "->" + std::to_string(GlobalNodesAfter)
            + " prepNodes " + std::to_string(PrepNodesBefore) + "->" + std::to_string(PrepNodesAfter));
        if (InfoAfter > InfoBefore) {
            s_sraSlot = Slot;
            MpLog("[GraphDrive] ADOPTED slot+" + MpHex(Slot) + " graph=" + MpPtr(Graph)
                + " connections=" + std::to_string(ConnNum)
                + " actorInfo " + std::to_string(InfoBefore) + "->" + std::to_string(InfoAfter));
            return;
        }
        if (ConnAfter != ConnBefore || GlobalNodesAfter != GlobalNodesBefore
            || PrepNodesAfter != PrepNodesBefore) {
            s_sraSlot = ~static_cast<uintptr_t>(0);
            MpLog("[GraphDrive] ABORTED probing: slot+" + MpHex(Slot)
                + " mutated the graph (conns " + std::to_string(ConnBefore) + "->" + std::to_string(ConnAfter)
                + " globalNodes " + std::to_string(GlobalNodesBefore) + "->" + std::to_string(GlobalNodesAfter)
                + " prepNodes " + std::to_string(PrepNodesBefore) + "->" + std::to_string(PrepNodesAfter)
                + ")");
            return;
        }
    }
    s_sraSlot = ~static_cast<uintptr_t>(0);   // no candidate gathered anything; stop probing
}

// UE 4.26 FNewReplicatedActorInfo, verified from UArchonReplicationGraph::RouteAddNetworkActorToNodes
// (RVA 0x01AAF620): { Actor@0, StreamingLevelName@8, Class@0x10 }.
struct RepGraphActorInfo112 {
    void* Actor;
    SDK::FName StreamingLevelName;
    void* Class;
};
static_assert(sizeof(RepGraphActorInfo112) == 0x18,
    "1.12 FNewReplicatedActorInfo layout drift");

// UReplicationGraphNode_ActorList::NotifyAddNetworkActor
// (FUN_140EC4BC0, vtable +0x270) proves that the persistent-level actor list is
// {Data@Node+0x58, Num@+0x60, Max@+0x64}. Keep this helper read-only: it lets the
// route/channel diagnostics distinguish "the actor left the global node" from
// "the actor is still globally gathered but its channel closed anyway."
static int RepGraphPersistentActorListContains(void* Node, void* Actor) {
    if (!Node || !Actor || !IsReadablePointer(Node, 0x68)) return -2;
    const RawPointerArray* Actors = reinterpret_cast<const RawPointerArray*>(
        reinterpret_cast<uintptr_t>(Node) + 0x58);
    if (!IsSanePointerArray(Actors->Data, Actors->Num, Actors->Max, 65536)) return -2;
    for (int32_t i = 0; i < Actors->Num; ++i) {
        if (Actors->Data[i] == Actor) return 1;
    }
    return 0;
}

// ---------------------------------------------------------------------------------------------
// [2026-07-26 REP-GRAPH RELEVANCE SETTINGS — OMNICELL LIFETIME + REMOTE REFERENCE-POSE ROOT FIX]
// ---------------------------------------------------------------------------------------------
//
// Both remaining symptoms are the SAME engine mechanism, verified in Ghidra and in the 2026-07-26
// VPS capture. Routing an actor into a node only decides whether it is GATHERED; it does not decide
// whether the gathered actor is then culled per connection.
//
// UReplicationGraph::ReplicateActorListsForConnections_Default (FUN_140ecdb30) is the only place a
// gathered actor becomes replication work for a connection. Per actor it:
//   1. FindOrAdd's the per-connection FConnectionReplicationActorInfo. A NEW one is built as a
//      SNAPSHOT of the actor's FGlobalActorReplicationInfo: ReplicationPeriodFrame (Global+0x2C),
//      FastPath_ReplicationPeriodFrame (Global+0x2E) and CullDistanceSquared (Global+0x8C ->
//      ConnInfo+0x0C, with its sqrt into ConnInfo+0x08).
//   2. When Settings.DistancePriorityScale (Global+0x20) > 0, measures the actor against every
//      viewer and, if ConnInfo.CullDistanceSquared > 0 and EVERY viewer is beyond it, skips the
//      actor entirely.
//   3. Only for a non-skipped actor refreshes
//      ConnInfo.ActorChannelCloseFrameNum (+0x24) = Max(current,
//          FrameNum + Settings.ActorChannelFrameTimeout (Global+0x30)
//                   + ConnInfo.ReplicationPeriodFrame (+0x20)
//                   + Graph.GlobalActorChannelFrameNumTimeout (Graph+0x70)).
// UReplicationGraph::ServerReplicateActors (FUN_140ed15a0) then walks the connection's channel map
// (ConnMgr+0x80) and calls Channel->Close(EChannelCloseReason::Relevancy == 3) for every entry whose
// ActorChannelCloseFrameNum is non-zero and <= FrameNum. A client that receives a NON-dormancy
// channel close DESTROYS the actor.
//
// Symptom 1 - the Omnicell coming and going.
// 0.1.47 correctly made AArchonPlayerRole globally relevant, but that only changed the node. The
// class-derived spatial CullDistanceSquared is still snapshotted into every connection's actor info,
// and AArchonCharacter::CreatePlayerRoleFromClass (FUN_1417a3d20) spawns the role and immediately
// places it at the IDENTITY transform - the world origin. So as soon as a player is further than the
// class cull distance from the origin, EVERY role goes non-relevant for that ONE connection, its
// close frame stops being refreshed, and the role channels close together. That is exactly what the
// 2026-07-26 normal-hunt server log shows: PR_FRANK and PR_ICEBORNE both CLOSED at 14:49:23.673/.675
// for connection 1573005310192 only, with globalPersistentMember=1 and netDormancy=1 (DORM_Awake) -
// still globally routed, still awake, culled purely on distance - both reopening together at
// 14:50:46. The client destroys its role replica, AArchonCharacter::PlayerRole goes null and the HUD
// unbinds.
//
// Symptom 2 - the remote reference ("T") pose in Escalation.
// The same close path applies to other players' pawns, which are ordinary spatial actors, and their
// default grace is tiny: ActorChannelFrameTimeout 4 + period + the graph's global timeout is about
// 7 replication frames (~230 ms at 30 Hz). An Escalation ready transition moves both players ~10^6
// units in the same instant (server log: both player starts chosen at 14:37:34.158 and .161), so for
// a handful of frames a remote pawn is beyond the viewer's cull distance, the channel times out, and
// the client destroys and rebuilds that pawn. AArchonCharacter::PlayerRole (+0x738) is NOT a
// replicated property and AArchonCharacter::SetPlayerRole (FUN_1417bc8e0) early-outs unless
// Role == ROLE_Authority, so the replacement client pawn never regains its role and the role-driven
// mesh/anim setup never runs. Mystic's Escalation client log is exactly that shape: Bobo
// pawn=2815817970128 playerRole=2816730937152 at 14:37:16.495 -> playerRole=NULL at 14:37:34.447 ->
// pawn=2815817962848 playerRole=NULL at 14:37:34.547, and NULL for the remaining eight minutes.
// Normal hunts do not reproduce it because their spawns are manual and staggered, so two viewers
// never diverge by a map-width inside one relevancy grace.
//
// The fix edits replication SETTINGS, not routing:
//   * AArchonPlayerRole -> CullDistance/CullDistanceSquared = 0, so the global route it already has
//     actually keeps its channels alive instead of being distance-culled at the world origin.
//   * AArchonCharacter  -> ActorChannelFrameTimeout raised to a bounded grace, so a sub-second
//     relevancy gap can no longer destroy and rebuild a remote pawn.
// Neither change adds a pawn to a global node or alters what is gathered, so the PLAYER_ALWAYS_RELEVANT
// armour-hide regression cannot return. Revert both with DISABLE_REPGRAPH_RELEVANCE_FIX.flag.
//
// Layout, all read straight out of the decompiled allocation/consumption sites:
//   FGlobalActorReplicationInfo (0x110 bytes, built in FUN_140ebddf0):
//     +0x00 LastPreReplicationFrame, +0x04 ForceNetUpdateFrame, +0x08 WorldLocation,
//     +0x14 bWantsToBeDormant, +0x20 Settings (FClassReplicationInfo, 0x70, copied from the class
//     map at Graph+0x110). FClassReplicationInfo (SDK ReplicationGraph_structs.hpp) puts
//     ActorChannelFrameTimeout at +0x10 and CullDistance/CullDistanceSquared at +0x68/+0x6C, giving
//     Global +0x30 / +0x88 / +0x8C.
//   FConnectionReplicationActorInfo (0x30 bytes): Channel +0x00, CullDistance +0x08,
//     CullDistanceSquared +0x0C, NextReplicationFrameNum +0x10, LastRepFrameNum +0x14,
//     ReplicationPeriodFrame +0x20, ActorChannelCloseFrameNum +0x24.
//   UReplicationGraph: NetDriver +0x30, Connections TArray +0x38, GlobalActorReplicationInfoMap
//     +0xC0 (ActorMap, element stride 0x18), AlwaysRelevantNode +0x4A0.
//   UNetReplicationGraphConnection: NetConnection +0x28, ActorInfoMap.ActorMap +0x30 (stride 0x20).
static constexpr uintptr_t kRepGraphGlobalChannelTimeout = 0x30;   // uint16
static constexpr uintptr_t kRepGraphGlobalCullDistance = 0x88;     // float
static constexpr uintptr_t kRepGraphGlobalCullDistanceSq = 0x8C;   // float
static constexpr uintptr_t kRepGraphConnCullDistance = 0x08;       // float
static constexpr uintptr_t kRepGraphConnCullDistanceSq = 0x0C;     // float
static constexpr uintptr_t kRepGraphConnectionsData = 0x38;
static constexpr uintptr_t kRepGraphConnectionsNum = 0x40;
static constexpr uintptr_t kRepGraphConnectionsMax = 0x44;
static constexpr uintptr_t kRepGraphGlobalActorMap = 0xC0;
static constexpr uintptr_t kRepGraphConnActorInfoMap = 0x30;

// Long enough to bridge a synchronized island/ready transition, short enough that a player who is
// genuinely gone still releases the channel: 300 replication frames is 10 s at 30 Hz, 5 s at 60 Hz.
static constexpr uint16_t kRepGraphPlayerChannelGraceFrames = 300;

static bool RepGraphRelevanceFixEnabled() {
    static int c = -1;
    if (c < 0) c = MpExeRelativeFlagPresent(L"DISABLE_REPGRAPH_RELEVANCE_FIX.flag") ? 0 : 1;
    return c == 1;
}

// Generic UE4 TMap probe. The layout is proven by the ChannelMap walk inside
// UReplicationGraph::ServerReplicateActors: Data ptr +0x00, Num +0x08, Max +0x0C, allocation
// bit-array inline words +0x10 (4 words), secondary word pointer +0x20, NumBits +0x28. Elements are
// {Key, ValuePtr, hash} at the caller-supplied stride. Holes are skipped via the allocation bits and
// nothing except the caller's own key value is ever dereferenced, so a malformed map yields nullptr
// rather than a fault.
static void* RepGraphMapFindValue(uintptr_t MapBase, const void* Key, size_t Stride) {
    if (!MapBase || !Key) return nullptr;
    if (!IsReadablePointer(reinterpret_cast<void*>(MapBase), 0x30)) return nullptr;
    const uintptr_t Data = *reinterpret_cast<uintptr_t*>(MapBase + 0x00);
    const int32_t Num = *reinterpret_cast<int32_t*>(MapBase + 0x08);
    const int32_t Max = *reinterpret_cast<int32_t*>(MapBase + 0x0C);
    const uint32_t* Secondary = *reinterpret_cast<uint32_t**>(MapBase + 0x20);
    const int32_t NumBits = *reinterpret_cast<int32_t*>(MapBase + 0x28);
    if (!Data || Num <= 0 || Num > 65536 || Max < Num) return nullptr;
    if (!IsReadablePointer(reinterpret_cast<void*>(Data),
                           static_cast<size_t>(Num) * Stride)) return nullptr;
    int32_t Count = (NumBits > 0 && NumBits < Num) ? NumBits : Num;
    const uint32_t* Words = Secondary;
    if (Words) {
        if (!IsReadablePointer(Words, (static_cast<size_t>(Count) + 31) / 32 * 4)) return nullptr;
    } else {
        // TInlineAllocator<4>: without a secondary allocation only 128 bits exist inline.
        if (Count > 128) Count = 128;
        Words = reinterpret_cast<const uint32_t*>(MapBase + 0x10);
    }
    for (int32_t i = 0; i < Count; ++i) {
        if (((Words[i >> 5] >> (i & 31)) & 1u) == 0) continue;
        const uintptr_t Element = Data + static_cast<size_t>(i) * Stride;
        if (*reinterpret_cast<void**>(Element) != Key) continue;
        return *reinterpret_cast<void**>(Element + 8);
    }
    return nullptr;
}

static void* RepGraphFindGlobalActorInfo(void* Graph, void* Actor) {
    if (!Graph || !Actor || !IsReadablePointer(Graph, 0x118)) return nullptr;
    return RepGraphMapFindValue(
        reinterpret_cast<uintptr_t>(Graph) + kRepGraphGlobalActorMap, Actor, 0x18);
}

// Returns 1 when something was changed, 0 when the settings were already correct, -1 when the
// pointer was unusable. OutDetail always reports the before/after values so a live capture proves
// the offsets (a spatialized class reads a real NetCullDistanceSquared here, e.g. 225000000).
// [2026-10-11 1.14.7 O3] DetailOnlyIfChanged: build OutDetail (six std::to_string calls) only when something changed - the
// once-a-second re-assert pass logs only then. Default false keeps every registration log line as it was.
static int RepGraphApplyGlobalSettings(void* GlobalInfo, bool ZeroCullDistance,
                                       uint16_t MinChannelFrameTimeout, std::string* OutDetail,
                                       bool DetailOnlyIfChanged = false) {
    if (!GlobalInfo || !IsReadablePointer(GlobalInfo, 0x110)) return -1;
    const uintptr_t G = reinterpret_cast<uintptr_t>(GlobalInfo);
    float* Cull = reinterpret_cast<float*>(G + kRepGraphGlobalCullDistance);
    float* CullSq = reinterpret_cast<float*>(G + kRepGraphGlobalCullDistanceSq);
    uint16_t* Timeout = reinterpret_cast<uint16_t*>(G + kRepGraphGlobalChannelTimeout);
    const float CullBefore = *Cull;
    const float CullSqBefore = *CullSq;
    const uint16_t TimeoutBefore = *Timeout;
    if (ZeroCullDistance) {
        *Cull = 0.0f;
        *CullSq = 0.0f;
    }
    // Only ever raise the grace: a class that already asks for a longer one keeps it, and a class
    // that opted out entirely with 0 (never time the channel out) is left opted out.
    if (MinChannelFrameTimeout != 0 && TimeoutBefore != 0 && TimeoutBefore < MinChannelFrameTimeout) {
        *Timeout = MinChannelFrameTimeout;
    }
    const int Result = (*Cull != CullBefore || *CullSq != CullSqBefore || *Timeout != TimeoutBefore) ? 1 : 0;
    if (OutDetail && (!DetailOnlyIfChanged || Result == 1)) {
        *OutDetail = " cullDistance=" + std::to_string(CullBefore) + "->" + std::to_string(*Cull)
            + " cullDistanceSq=" + std::to_string(CullSqBefore) + "->" + std::to_string(*CullSq)
            + " actorChannelFrameTimeout=" + std::to_string(TimeoutBefore)
            + "->" + std::to_string(*Timeout);
    }
    return Result;
}

// A FConnectionReplicationActorInfo is a snapshot taken the first time a connection gathers the
// actor, so clearing the global cull distance afterwards is not enough on its own. In the fixed path
// the global settings are written inside RouteAddNetworkActorToNodes, before any connection can have
// gathered the actor, so this normally finds nothing - it exists for an actor that was registered
// before the hook (or re-registered by a graph rebuild). Returns how many snapshots were repaired.
static int RepGraphClearConnectionCullDistance(void* Graph, void* Actor) {
    if (!Graph || !Actor || !IsReadablePointer(Graph, 0x4C8)) return 0;
    const uintptr_t G = reinterpret_cast<uintptr_t>(Graph);
    void** ConnData = *reinterpret_cast<void***>(G + kRepGraphConnectionsData);
    const int32_t ConnNum = *reinterpret_cast<int32_t*>(G + kRepGraphConnectionsNum);
    const int32_t ConnMax = *reinterpret_cast<int32_t*>(G + kRepGraphConnectionsMax);
    if (!IsSanePointerArray(ConnData, ConnNum, ConnMax, 1024)) return 0;
    int Cleared = 0;
    for (int32_t i = 0; i < ConnNum; ++i) {
        void* ConnMgr = ConnData[i];
        if (!ConnMgr || !IsReadablePointer(ConnMgr, 0xE0)) continue;
        void* Info = RepGraphMapFindValue(
            reinterpret_cast<uintptr_t>(ConnMgr) + kRepGraphConnActorInfoMap, Actor, 0x20);
        if (!Info || !IsReadablePointer(Info, 0x30)) continue;
        const uintptr_t I = reinterpret_cast<uintptr_t>(Info);
        float* Cull = reinterpret_cast<float*>(I + kRepGraphConnCullDistance);
        float* CullSq = reinterpret_cast<float*>(I + kRepGraphConnCullDistanceSq);
        if (*Cull == 0.0f && *CullSq == 0.0f) continue;
        *Cull = 0.0f;
        *CullSq = 0.0f;
        ++Cleared;
    }
    return Cleared;
}

// [2026-07-26 AMP FREEZE ROOT FIX]
//
// Repro 14 (with ESCALATION_NO_RELIC_FANOUT.flag) proved that a successful amp selection on Bobo's
// PlayerEscalationComponent is followed 110 ms later by Mystic's stock
// APlayerController::OnActorChannelOpen -> HandleClientPlayer -> SetPlayer path adopting another
// PlayerController. Mystic never opened the relic UI in that run. The client is therefore doing the
// correct thing with an invalid actor channel sent by the server.
//
// Ghidra gives the exact Archon graph classification:
//   RouteAddNetworkActorToNodes  RVA 0x01AAF620
//     AActor+0x58 bit 3 (0x08) -> global AlwaysRelevantNode
//     AActor+0x58 bit 2 (0x04) -> ActorsWithoutNetConnection, then the owning connection's node
//     neither bit              -> spatial GridNode
// A PlayerController is legal only in the second route. Enforce that invariant at the graph's route
// boundary, before it chooses a node. This is early enough to repair the route itself; merely changing
// the bit later would leave the actor cached in the old node.
void* OrigArchonRouteAddNetworkActor = nullptr;

void __fastcall ArchonRouteAddNetworkActorHook(
    void* Graph, RepGraphActorInfo112* Info, void* GlobalInfo) {
    void* Actor = (Info && IsReadablePointer(Info, sizeof(*Info))) ? Info->Actor : nullptr;
    bool IsPlayerRole = false;
    bool IsPlayerState = false;   // [1.14.7 client player-state fix] see the branch below
    int32_t StreamingNameIndex = 0;
    uint32_t StreamingNameNumber = 0;
    if (IsActorSafeForReplicationLifecycle(Actor)) {
        UObject* ActorObject = reinterpret_cast<UObject*>(Actor);
        if (ActorObject->IsA(SDK::APlayerController::StaticClass())) {
            uint8_t* Flags = reinterpret_cast<uint8_t*>(
                reinterpret_cast<uintptr_t>(Actor) + 0x58);
            const uint8_t Before = *Flags;
            // bOnlyRelevantToOwner=1 and bAlwaysRelevant=0. RouteAdd checks always-relevant first,
            // so leaving both bits set would still put the controller in the global node.
            *Flags = static_cast<uint8_t>((Before | 0x04u) & ~0x08u);
            void* NetConnection = IsReadablePointer(Actor, 0x420)
                ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Actor) + 0x418)
                : nullptr;
            MpLog("[PlayerControllerRouteGuard] actor=" + MpPtr(Actor)
                + " graph=" + MpPtr(Graph)
                + " netConnection=" + MpPtr(NetConnection)
                + " globalInfo=" + MpPtr(GlobalInfo)
                + " flagsBefore=" + MpHex(Before)
                + " flagsAfter=" + MpHex(*Flags)
                + " route=owning-connection");
        } else if (ActorObject->IsA(SDK::APlayerState::StaticClass())) {
            // [1.14.7 CLIENT PLAYER-STATE ROOT CAUSE 2026-10-05]
            //
            // MEASURED (client probe [ClientPSGap] / [PSGapCensus]): a joined client has NO APlayerState
            // object at all - ctrlPlayerState(+0x228)=null, pawnPlayerState(+0x240)=null, and a GObjects
            // census inside Ramsgate reports playerStates=0 archonPlayerStates=0 while
            // archonControllers=1 archonCharacters=1. The pawn itself arrived correctly
            // (role=2 AutonomousProxy, remoteRole=3 Authority, owner=the controller, replicates=1), so
            // this is neither a stale offset nor a property-specific gap: the whole PlayerState actor
            // never reaches the client.
            //
            // Why it blocks arrival: everything the client builds about its own player hangs off the
            // replicated PlayerState. The client-side character construction path is
            // AArchonPlayerState::PlayerRoleId (Net/RepNotify) -> OnRep_PlayerRoleId ->
            // AArchonCharacter::SetPlayerRole (dllmain.cpp:15621); UArchonLoadManager reads
            // manager+0x20 -> controller+0x228 for the identity/netId gate; and the
            // IArchonLoadingInterface participants that give the readiness poll something to wait on are
            // the PlayerState and the equipment it owns. With no PlayerState the client's poll lists only
            // the bare controller, so the native HasFinishedLoading can never become true - exactly the
            // observed [ReadinessCompat] PRESERVE_FALSE scope=client-not-allowlisted
            // obj=player_controller_city_bp_C loop.
            //
            // The mechanism: UArchonReplicationGraph classifies every actor at this boundary
            // (Ghidra-verified, RVA 0x01AAF620): +0x58 bit3 (bAlwaysRelevant) -> the graph's global
            // AlwaysRelevantNode, bit2 (bOnlyRelevantToOwner) -> the owning connection's node, neither ->
            // the spatial GridNode. APlayerState has no meaningful spatial presence for the GridNode to
            // gather, so it must be routed globally. This is the same correction, at the same boundary,
            // that AArchonPlayerRole already applies two branches below.
            uint8_t* PsFlags58 = reinterpret_cast<uint8_t*>(reinterpret_cast<uintptr_t>(Actor) + 0x58);
            uint8_t* PsFlags59 = reinterpret_cast<uint8_t*>(reinterpret_cast<uintptr_t>(Actor) + 0x59);
            const uint8_t PsBefore58 = *PsFlags58;
            const uint8_t PsBefore59 = *PsFlags59;
            // [2026-10-05 EXPERIMENT, opt-in] The global route (bit3) is measured NOT to deliver on this
            // build: membership in the global AlwaysRelevantNode is not enough. The owning-connection
            // route (bit2) is the one the PlayerController demonstrably uses to reach the client, and
            // APlayerState::GetNetConnection resolves through its Owner (the PlayerController whose
            // +0x298 Player is the IpConnection), so it should resolve too. ENABLE_PLAYERSTATE_OWNER_ROUTE.flag
            // switches the PlayerState onto that route. Note this is owner-only, so a remote player's
            // PlayerState would no longer be sent to third parties - correct for the single-client
            // acceptance, and something to revisit for multiplayer.
            if (MpExeRelativeFlagPresent(L"ENABLE_PLAYERSTATE_OWNER_ROUTE.flag")) {
                *PsFlags58 = static_cast<uint8_t>((*PsFlags58 | 0x04u) & ~0x08u);
            } else {
                *PsFlags58 = static_cast<uint8_t>((*PsFlags58 | 0x08u) & ~0x04u);
            }
            *PsFlags59 = static_cast<uint8_t>(*PsFlags59 & ~0x02u);
            std::string PsSettings;
            const int PsSettingsResult = RepGraphRelevanceFixEnabled()
                ? RepGraphApplyGlobalSettings(GlobalInfo, true, kRepGraphPlayerChannelGraceFrames,
                    &PsSettings)
                : -2;
            IsPlayerState = true;
            static std::atomic<int> s_psRouteLogged{ 0 };
            if (s_psRouteLogged.fetch_add(1, std::memory_order_relaxed) < 12) {
                MpLog("[PlayerStateRouteGuard] actor=" + MpPtr(Actor)
                    + " class=" + std::string(ActorObject->Class ? ActorObject->Class->GetName() : "?")
                    + " graph=" + MpPtr(Graph)
                    + " globalInfo=" + MpPtr(GlobalInfo)
                    + " flags58Before=" + MpHex(PsBefore58)
                    + " bAlwaysRelevantBefore=" + std::to_string((PsBefore58 & 0x08u) != 0 ? 1 : 0)
                    + " bOnlyRelevantToOwnerBefore=" + std::to_string((PsBefore58 & 0x04u) != 0 ? 1 : 0)
                    + " flags58After=" + MpHex(*PsFlags58)
                    + " flags59Before=" + MpHex(PsBefore59)
                    + " flags59After=" + MpHex(*PsFlags59)
                    + " cullFix=" + std::to_string(PsSettingsResult) + PsSettings
                    + " route=global-always-relevant");
            }
        } else if (!MpExeRelativeFlagPresent(L"DISABLE_PLAYER_ROLE_GLOBAL_ROUTE.flag")
            && ActorObject->IsA(SDK::AArchonPlayerRole::StaticClass())) {
            IsPlayerRole = true;
            StreamingNameIndex = Info->StreamingLevelName.ComparisonIndex;
            StreamingNameNumber = Info->StreamingLevelName.Number;
            // [2026-07-26 OMNICELL ROLE-STABILITY ROOT FIX]
            //
            // Repro 15 proves the server role actors stay stable while every client repeatedly
            // destroys and recreates both replicas. Each destruction lines up exactly with the
            // corresponding server actor channels closing. The former fix inserted the role into
            // per-connection always-relevant ActorLists but deliberately left the actor flags
            // unchanged (bNetUseOwnerRelevancy=1, bAlwaysRelevant=0). That list membership is not
            // enough: the later per-actor relevancy pass can still time the channel out whenever
            // the transient owner/pawn route changes. Normal spatial relevance then reopens it,
            // producing a new client UObject and the visible Omnicell coming/going loop.
            //
            // A role is tiny party equipment state and every client that can draw its owning pawn
            // needs it. Put it through Archon's native global AlwaysRelevantNode at initial graph
            // registration, before any route is cached. This creates exactly one authoritative
            // route instead of spatial + manually duplicated per-connection routes.
            uint8_t* Flags58 = reinterpret_cast<uint8_t*>(
                reinterpret_cast<uintptr_t>(Actor) + 0x58);
            uint8_t* Flags59 = reinterpret_cast<uint8_t*>(
                reinterpret_cast<uintptr_t>(Actor) + 0x59);
            const uint8_t Before58 = *Flags58;
            const uint8_t Before59 = *Flags59;
            *Flags58 = static_cast<uint8_t>((*Flags58 | 0x08u) & ~0x04u);
            // Repro "texture issue can walk" proved 0.1.46 still churned the role channels even
            // after the native graph selected AlwaysRelevantNode. Its route log also proved the
            // omission: bNetUseOwnerRelevancy remained 1. A truly global role must not be
            // re-evaluated through its transient owning pawn, so clear that independent actor bit.
            // This changes relevancy only; Actor.Owner remains intact for gameplay/RPC ownership.
            *Flags59 = static_cast<uint8_t>(*Flags59 & ~0x02u);
            // [2026-07-26 OMNICELL CULL-DISTANCE ROOT FIX] The flags above only pick the node. The
            // 0.1.47 capture proved a role can be globally routed (persistentMember=1) and awake
            // (netDormancy=1) and STILL have both of its channels closed for one connection, because
            // the class-derived spatial cull distance is snapshotted per connection and the role
            // itself sits at the world origin. Clear it at registration, before any connection can
            // take that snapshot. See the layout writeup above RepGraphMapFindValue.
            std::string SettingsDetail;
            const int SettingsResult = RepGraphRelevanceFixEnabled()
                ? RepGraphApplyGlobalSettings(GlobalInfo, true,
                    kRepGraphPlayerChannelGraceFrames, &SettingsDetail)
                : -2;
            MpLog("[PlayerRoleRouteGuard] actor=" + MpPtr(Actor)
                + " graph=" + MpPtr(Graph)
                + " globalInfo=" + MpPtr(GlobalInfo)
                + " flags58Before=" + MpHex(Before58)
                + " flags58After=" + MpHex(*Flags58)
                + " flags59Before=" + MpHex(Before59)
                + " flags59After=" + MpHex(*Flags59)
                + " bNetUseOwnerRelevancyBefore="
                + std::to_string((Before59 & 0x02u) != 0 ? 1 : 0)
                + " bNetUseOwnerRelevancyAfter="
                + std::to_string((*Flags59 & 0x02u) != 0 ? 1 : 0)
                + " cullFix=" + std::to_string(SettingsResult) + SettingsDetail
                + " route=global-always-relevant");
        } else if (RepGraphRelevanceFixEnabled()
            && ActorObject->IsA(SDK::AArchonCharacter::StaticClass())) {
            // [2026-07-26 REMOTE REFERENCE-POSE ROOT FIX] Player characters stay on their ordinary
            // spatial route - nothing here makes them globally relevant, so the old
            // PLAYER_ALWAYS_RELEVANT armour-hide regression cannot return. All that changes is how
            // long a channel survives a relevancy gap. The stock grace is ActorChannelFrameTimeout 4
            // plus the period plus the graph's global timeout, about 7 replication frames, which the
            // simultaneous Escalation island teleport exceeds; the client then destroys the remote
            // pawn, and because AArchonCharacter::PlayerRole (+0x738) is not replicated and
            // SetPlayerRole is authority-only, the rebuilt pawn never gets its role back and stays in
            // the reference pose. AArchonBehemoth derives from AArchonCreatureBase, a sibling of
            // AArchonCharacter, so behemoths are not affected by this branch.
            std::string SettingsDetail;
            const int SettingsResult = RepGraphApplyGlobalSettings(
                GlobalInfo, false, kRepGraphPlayerChannelGraceFrames, &SettingsDetail);
            if (SettingsResult != 0) {
                MpLog("[PawnChannelGrace] source=route actor=" + MpPtr(Actor)
                    + " class=" + (ActorObject->Class ? ActorObject->Class->GetName() : std::string("?"))
                    + " graph=" + MpPtr(Graph)
                    + " globalInfo=" + MpPtr(GlobalInfo)
                    + " result=" + std::to_string(SettingsResult) + SettingsDetail);
            }
        }
    }
    reinterpret_cast<void(__fastcall*)(void*, RepGraphActorInfo112*, void*)>(
        OrigArchonRouteAddNetworkActor)(Graph, Info, GlobalInfo);

    if (IsPlayerRole && Graph && IsReadablePointer(Graph, 0x4A8)) {
        void* GlobalNode = *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(Graph) + 0x4A0);
        MpLog("[PlayerRoleGlobalMembership] event=ADD actor=" + MpPtr(Actor)
            + " graph=" + MpPtr(Graph)
            + " node=" + MpPtr(GlobalNode)
            + " persistentMember="
            + std::to_string(RepGraphPersistentActorListContains(GlobalNode, Actor))
            + " streamingNameIndex=" + std::to_string(StreamingNameIndex)
            + " streamingNameNumber=" + std::to_string(StreamingNameNumber));
    }

    if (IsPlayerState && Graph && IsReadablePointer(Graph, 0x4A8)) {
        void* GlobalNode = *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(Graph) + 0x4A0);
        MpLog("[PlayerStateGlobalMembership] event=ADD actor=" + MpPtr(Actor)
            + " graph=" + MpPtr(Graph)
            + " node=" + MpPtr(GlobalNode)
            + " persistentMember="
            + std::to_string(RepGraphPersistentActorListContains(GlobalNode, Actor)));
    }
}

// RouteRemoveNetworkActorToNodes is a verified two-argument function at RVA 0x01AAF6B0.
// PlayerRole removals are also a hard lifetime boundary for our compatibility caches: the UObject
// can still be registered while Actor+0x5C already says destroying, so retaining it until the next
// generic liveness sweep is unsafe. The implementation is defined below after all cache tables.
static void PurgePlayerRoleLifetimeCaches(void* PlayerRole, const char* Reason);
void* OrigArchonRouteRemoveNetworkActor = nullptr;
void __fastcall ArchonRouteRemoveNetworkActorHook(
    void* Graph, RepGraphActorInfo112* Info) {
    void* Actor = (Info && IsReadablePointer(Info, sizeof(*Info))) ? Info->Actor : nullptr;
    bool IsPlayerRole = Actor && IsReadablePointer(Actor, 0x60)
        && IsRegisteredLiveObject(Actor)
        && reinterpret_cast<UObject*>(Actor)->IsA(SDK::AArchonPlayerRole::StaticClass());
    uint8_t Flags58 = IsPlayerRole ? SafeReadU8At(reinterpret_cast<uintptr_t>(Actor), 0x58) : 0;
    uint8_t Flags59 = IsPlayerRole ? SafeReadU8At(reinterpret_cast<uintptr_t>(Actor), 0x59) : 0;
    uint8_t Flags5C = IsPlayerRole ? SafeReadU8At(reinterpret_cast<uintptr_t>(Actor), 0x5C) : 0;
    void* GlobalNode = (IsPlayerRole && Graph && IsReadablePointer(Graph, 0x4A8))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Graph) + 0x4A0)
        : nullptr;
    const int MemberBefore = IsPlayerRole
        ? RepGraphPersistentActorListContains(GlobalNode, Actor) : -2;

    if (IsPlayerRole) {
        PurgePlayerRoleLifetimeCaches(Actor, "route-remove");
    }

    reinterpret_cast<void(__fastcall*)(void*, RepGraphActorInfo112*)>(
        OrigArchonRouteRemoveNetworkActor)(Graph, Info);

    if (IsPlayerRole) {
        MpLog("[PlayerRoleGlobalMembership] event=REMOVE actor=" + MpPtr(Actor)
            + " graph=" + MpPtr(Graph)
            + " node=" + MpPtr(GlobalNode)
            + " persistentMemberBefore=" + std::to_string(MemberBefore)
            + " persistentMemberAfter="
            + std::to_string(RepGraphPersistentActorListContains(GlobalNode, Actor))
            + " flags58=" + MpHex(Flags58)
            + " flags59=" + MpHex(Flags59)
            + " destroying=" + std::to_string((Flags5C & 0x08u) != 0 ? 1 : 0));
    }
}

// [2026-07-28 ESCALATION PLAYERCONTROLLER CHANNEL QUARANTINE]
//
// A PlayerController channel is connection-private. The 2026-07-28 two-player capture proved that
// an already-cached FConnectionReplicationActorInfo could reference an actor channel owned by the
// other player's UNetConnection. Amp selection merely dirtied controller-owned state and exercised
// that bad channel; the receiving client lost its LocalPlayer->PlayerController->Pawn chain and the
// server removed the connection roughly 100 ms later. Keep the hot-path guards non-destructive and
// defer channel Close() until ServerReplicateActors has returned.
struct PlayerControllerChannelQuarantineEntry {
    void* Channel = nullptr;
    void* Actor = nullptr;
    void* WrongConnection = nullptr;
    void* CorrectConnection = nullptr;
    uintptr_t CallerRva = 0;
    uint64_t QueuedAtMs = 0;
    const char* Source = nullptr;
};

static PlayerControllerChannelQuarantineEntry s_pcChannelQuarantine[64]{};
static thread_local bool s_processingPcChannelQuarantine = false;
// [2026-10-11 1.14.7 O3] Entries in use, recounted after every change to the table (changes are rare: a BLOCK or a
// cleanup). ReplicateActorFreqHook asks IsPlayerControllerChannelQuarantined for every replicated channel, and the
// per-frame stale sweep walks the table; with nothing quarantined (the normal state) both now cost one compare.
static int s_pcChannelQuarantineInUse = 0;

static void RecountPlayerControllerChannelQuarantine() {
    int InUse = 0;
    for (const auto& Entry : s_pcChannelQuarantine) {
        if (Entry.Channel) ++InUse;
    }
    s_pcChannelQuarantineInUse = InUse;
}

static bool IsLiveNetConnection112(void* Ptr) {
    return Ptr
        && IsReadablePointer(Ptr, 0xA0)
        && IsRegisteredLiveObject(Ptr)
        && reinterpret_cast<UObject*>(Ptr)->IsA(SDK::UNetConnection::StaticClass());
}

static bool IsLiveActorChannel112(void* Ptr) {
    return Ptr
        && IsReadablePointer(Ptr, 0x78)
        && IsRegisteredLiveObject(Ptr)
        && reinterpret_cast<UObject*>(Ptr)->IsA(SDK::UActorChannel::StaticClass());
}

static bool IsLivePlayerController112(void* Ptr) {
    return Ptr
        && IsReadablePointer(Ptr, 0x420)
        && IsRegisteredLiveObject(Ptr)
        && reinterpret_cast<UObject*>(Ptr)->IsA(SDK::APlayerController::StaticClass());
}

static void* PlayerControllerChannelConnection(void* Channel) {
    return IsLiveActorChannel112(Channel)
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Channel) + 0x28)
        : nullptr;
}

static void* PlayerControllerChannelActor(void* Channel) {
    return IsLiveActorChannel112(Channel)
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Channel) + 0x70)
        : nullptr;
}

static int ClearConnActorInfoChannelIfMatches(void* ConnActorInfo, void* Channel) {
    if (!ConnActorInfo || !Channel || !IsReadablePointer(ConnActorInfo, sizeof(void*))) return 0;
    __try {
        void** Slot = reinterpret_cast<void**>(ConnActorInfo);
        if (*Slot != Channel) return 0;
        *Slot = nullptr;
        return 1;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return -1;
    }
}

static bool IsPlayerControllerChannelQuarantined(void* Channel) {
    if (!Channel || s_pcChannelQuarantineInUse == 0) return false;   // [2026-10-11 O3] empty table: nothing to scan
    for (const auto& Entry : s_pcChannelQuarantine) {
        if (Entry.Channel == Channel) return true;
    }
    return false;
}

static bool QueuePlayerControllerChannelQuarantine(
    void* Channel, void* Actor, void* WrongConnection, void* CorrectConnection,
    const char* Source, uintptr_t CallerRva) {
    if (!Channel) return false;

    int Free = -1;
    for (int i = 0; i < static_cast<int>(std::size(s_pcChannelQuarantine)); ++i) {
        PlayerControllerChannelQuarantineEntry& Entry = s_pcChannelQuarantine[i];
        if (Entry.Channel == Channel) {
            if (!Entry.Actor) Entry.Actor = Actor;
            if (!Entry.WrongConnection) Entry.WrongConnection = WrongConnection;
            if (!Entry.CorrectConnection) Entry.CorrectConnection = CorrectConnection;
            if (!Entry.CallerRva) Entry.CallerRva = CallerRva;
            if (!Entry.Source) Entry.Source = Source;
            return true;
        }
        if (!Entry.Channel && Free < 0) Free = i;
    }

    if (Free < 0) {
        static uint64_t s_lastFullLogMs = 0;
        const uint64_t Now = static_cast<uint64_t>(GetTickCount64());
        if (s_lastFullLogMs == 0 || Now - s_lastFullLogMs >= 1000) {
            s_lastFullLogMs = Now;
            MpLog("[PCChannelQuarantine] TABLE_FULL channel=" + MpPtr(Channel)
                + " actor=" + MpPtr(Actor)
                + " wrongConnection=" + MpPtr(WrongConnection)
                + " correctConnection=" + MpPtr(CorrectConnection));
        }
        return false;
    }

    PlayerControllerChannelQuarantineEntry& Entry = s_pcChannelQuarantine[Free];
    Entry.Channel = Channel;
    Entry.Actor = Actor;
    Entry.WrongConnection = WrongConnection;
    Entry.CorrectConnection = CorrectConnection;
    Entry.CallerRva = CallerRva;
    Entry.QueuedAtMs = static_cast<uint64_t>(GetTickCount64());
    Entry.Source = Source;
    RecountPlayerControllerChannelQuarantine();   // [2026-10-11 O3]
    MpLog("[PCChannelQuarantine] QUEUED channel=" + MpPtr(Channel)
        + " actor=" + MpPtr(Actor)
        + " wrongConnection=" + MpPtr(WrongConnection)
        + " correctConnection=" + MpPtr(CorrectConnection)
        + " source=" + (Source ? std::string(Source) : std::string("?"))
        + " callerRva=" + MpHex(CallerRva));
    return true;
}

static void* FindRepGraphConnectionManager(void* Graph, void* Connection) {
    if (!Graph || !Connection || !IsReadablePointer(Graph, 0x48)) return nullptr;
    void** Data = *reinterpret_cast<void***>(
        reinterpret_cast<uintptr_t>(Graph) + kRepGraphConnectionsData);
    const int32_t Num = *reinterpret_cast<int32_t*>(
        reinterpret_cast<uintptr_t>(Graph) + kRepGraphConnectionsNum);
    const int32_t Max = *reinterpret_cast<int32_t*>(
        reinterpret_cast<uintptr_t>(Graph) + kRepGraphConnectionsMax);
    if (!IsSanePointerArray(Data, Num, Max, 1024)) return nullptr;
    for (int32_t i = 0; i < Num; ++i) {
        void* Manager = Data[i];
        if (!Manager || !IsReadablePointer(Manager, 0x30)) continue;
        void* Candidate = *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(Manager) + 0x28);
        if (Candidate == Connection) return Manager;
    }
    return nullptr;
}

static int ClearRepGraphConnActorInfoChannel(
    void* Graph, void* Connection, void* Actor, void* Channel) {
    void* Manager = FindRepGraphConnectionManager(Graph, Connection);
    if (!Manager) return 0;
    void* ConnActorInfo = RepGraphMapFindValue(
        reinterpret_cast<uintptr_t>(Manager) + kRepGraphConnActorInfoMap,
        Actor, 0x20);
    return ClearConnActorInfoChannelIfMatches(ConnActorInfo, Channel);
}

// Verified from UReplicationGraph::ServerReplicateActors: UChannel::Close is vtable +0x288 and
// receives EChannelCloseReason::Relevancy (3). Keep this raw helper free of C++ unwind objects so
// the native call can be SEH-isolated.
static int SafeCloseQuarantinedActorChannel(void* Channel) {
    if (!Channel || !IsReadablePointer(Channel, 0x38)) return 0;
    __try {
        void** VTable = *reinterpret_cast<void***>(Channel);
        if (!VTable || !IsReadablePointer(VTable + (0x288 / 8), sizeof(void*))) return 0;
        void* CloseFn = VTable[0x288 / 8];
        if (!CloseFn) return 0;
        reinterpret_cast<void(__fastcall*)(void*, uint32_t)>(CloseFn)(Channel, 3u);
        return 1;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return -1;
    }
}

// Drops an entry whose channel is no longer the binding that was quarantined: the channel object is
// gone, or a live channel now carries a different actor or connection. Uses only SDK class checks and
// the channel's +0x28 / +0x70 fields, no native graph layout. Returns true when the entry was dropped.
static bool DropStalePlayerControllerChannelQuarantineEntry(PlayerControllerChannelQuarantineEntry& Entry) {
    void* Channel = Entry.Channel;
    void* CurrentConnection = PlayerControllerChannelConnection(Channel);
    void* CurrentActor = PlayerControllerChannelActor(Channel);
    const bool ChannelLive = IsLiveActorChannel112(Channel);
    const bool Reused = ChannelLive
        && ((Entry.WrongConnection && CurrentConnection != Entry.WrongConnection)
            || (CurrentActor && Entry.Actor && CurrentActor != Entry.Actor));
    if (ChannelLive && !Reused) return false;

    MpLog("[PCChannelQuarantine] DROP_STALE channel=" + MpPtr(Channel)
        + " expectedActor=" + MpPtr(Entry.Actor)
        + " currentActor=" + MpPtr(CurrentActor)
        + " expectedConnection=" + MpPtr(Entry.WrongConnection)
        + " currentConnection=" + MpPtr(CurrentConnection));
    Entry = PlayerControllerChannelQuarantineEntry{};
    RecountPlayerControllerChannelQuarantine();   // [2026-10-11 O3]
    return true;
}

static void ProcessPlayerControllerChannelQuarantine(void* NetDriver) {
    if (s_processingPcChannelQuarantine) return;
    s_processingPcChannelQuarantine = true;

    void* Graph = (NetDriver && IsReadablePointer(NetDriver, 0x6F0))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(NetDriver) + 0x6E8)
        : nullptr;

    for (auto& Entry : s_pcChannelQuarantine) {
        if (!Entry.Channel) continue;
        if (DropStalePlayerControllerChannelQuarantineEntry(Entry)) continue;

        void* Channel = Entry.Channel;
        const uint8_t ChannelFlags30 = *reinterpret_cast<uint8_t*>(
            reinterpret_cast<uintptr_t>(Channel) + 0x30);
        const int CloseResult = (ChannelFlags30 & 0x02u) != 0
            ? 2
            : SafeCloseQuarantinedActorChannel(Channel);
        const int ActorInfoCleared = ClearRepGraphConnActorInfoChannel(
            Graph, Entry.WrongConnection, Entry.Actor, Channel);

        MpLog("[PCChannelQuarantine] CLEANUP channel=" + MpPtr(Channel)
            + " actor=" + MpPtr(Entry.Actor)
            + " wrongConnection=" + MpPtr(Entry.WrongConnection)
            + " correctConnection=" + MpPtr(Entry.CorrectConnection)
            + " source=" + (Entry.Source ? std::string(Entry.Source) : std::string("?"))
            + " callerRva=" + MpHex(Entry.CallerRva)
            + " queuedForMs=" + std::to_string(
                static_cast<uint64_t>(GetTickCount64()) - Entry.QueuedAtMs)
            + " closeResult=" + std::to_string(CloseResult)
            + " actorInfoCleared=" + std::to_string(ActorInfoCleared));
        Entry = PlayerControllerChannelQuarantineEntry{};
    }
    RecountPlayerControllerChannelQuarantine();   // [2026-10-11 O3]

    s_processingPcChannelQuarantine = false;
}

// [2026-10-10 1.14.7] Nothing calls ProcessPlayerControllerChannelQuarantine on this build: it ran from
// ServerReplicateActorsHook, which is not installed (MpDriveReplicationGraph drives the graph). An entry
// therefore stayed forever, and a channel object later allocated at the same address would be skipped by
// ReplicateActorFreqHook or refused by the SetChannelActor guard for an unrelated actor. Called once per
// server frame before the graph drive, this drops only such stale entries; an entry still bound to the
// wrong connection stays blocked. Closing the channel and clearing the graph's cached actor info (the
// rest of the cleanup) depend on native layouts not yet verified on 1.14.7, so they stay out.
static void DropStalePlayerControllerChannelQuarantine() {
    if (s_processingPcChannelQuarantine || s_pcChannelQuarantineInUse == 0) return;   // [2026-10-11 O3]
    for (auto& Entry : s_pcChannelQuarantine) {
        if (Entry.Channel) DropStalePlayerControllerChannelQuarantineEntry(Entry);
    }
}

// [2026-07-26 ESCALATION CONTROLLER-ADOPTION ROOT FIX]
//
// Repro 16 proved that the ReplicateActor boundary below is not early enough: it logged BLOCK for
// Bobo's controller on Mystic's connection, yet 97 ms later Mystic still entered stock
// APlayerController::OnActorChannelOpen -> HandleClientPlayer("setplayer") and temporarily adopted
// Bobo's controller. The resulting ULocalPlayer.PlayerController split made the relic screen's
// GetOwningPlayer return null, so clicks were visible but could never send ServerSelectRelicOption.
//
// Ghidra/disassembly verifies FUN_140ECEC50 (RVA 0x00ECEC50) is the replication-graph's per-actor,
// per-connection helper. Its argument order is:
//   (Graph, Actor, ConnActorInfo, GlobalInfo, ActorInfoMap, ConnManager, Frame)
// The decompiler labels it void, but its native caller immediately consumes RAX and adds it to the
// replication total, so the hook must preserve a 64-bit replication-count return. Native code reads
// ConnManager+0x28 as UNetConnection, reuses ConnActorInfo->Channel when present, otherwise creates
// an actor channel, calls SetChannelActor, then ReplicateActor. The cached channel therefore needs
// the same connection invariant as a newly created channel.
//
// [2026-10-10 1.14.7] The target is FUN_140F2C230 (RVA 0x00F2C230), a .pdata entry reached from the
// graph drive: Archon ServerReplicateActors 0x01C034C0 -> base 0x00F2EB60 -> 0x00F2AFF0 -> here. Its
// decompile has the same argument order and uses: param 2 +0x5C destroy bit, *param 3 = channel (and
// channel +0x70 == actor), param 6 +0x28 handed to CreateChannelByName 0x03F62E90, param 7 frame. It
// returns the bit total (`mov rax, rsi` at 0x00F2C6C9). This hook runs for every actor on every
// connection, so a PlayerController is identified with the SEH-guarded O(1) liveness check and IsA
// before any VirtualQuery-backed validation (Harmonicrain/Undaunted measured per-actor
// IsReadablePointer at ~19% of a two-player 1.12 game thread).
void* OrigRepGraphReplicateSingleActor = nullptr;
uint64_t __fastcall RepGraphReplicateSingleActorGuardHook(
    void* Graph, void* Actor, void* ConnActorInfo, void* GlobalInfo,
    void* ActorInfoMap, void* ConnManager, uint32_t Frame) {
    if (Actor && IsRegisteredLiveObject(Actor)
        && reinterpret_cast<UObject*>(Actor)->IsA(SDK::APlayerController::StaticClass())
        && IsLivePlayerController112(Actor)) {
        const bool ConnManagerValid = ConnManager
            && IsReadablePointer(ConnManager, 0x30)
            && IsRegisteredLiveObject(ConnManager);
        void* Connection = ConnManagerValid
            ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(ConnManager) + 0x28)
            : nullptr;
        const bool ConnectionValid = IsLiveNetConnection112(Connection);

        void* ActorConnection = *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(Actor) + 0x418);
        const bool ActorConnectionValid = IsLiveNetConnection112(ActorConnection);

        void* CachedChannel =
            (ConnActorInfo && IsReadablePointer(ConnActorInfo, sizeof(void*)))
            ? *reinterpret_cast<void**>(ConnActorInfo) : nullptr;
        const bool CachedChannelValid = IsLiveActorChannel112(CachedChannel);
        void* CachedConnection = CachedChannelValid
            ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(CachedChannel) + 0x28)
            : nullptr;
        void* CachedActor = CachedChannelValid
            ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(CachedChannel) + 0x70)
            : nullptr;
        const bool CachedConnectionValid = IsLiveNetConnection112(CachedConnection);
        const bool CachedConnectionMismatch = CachedChannelValid && ConnectionValid
            && CachedConnectionValid && CachedConnection != Connection;
        const bool CachedActorMismatch = CachedChannelValid && CachedActor && CachedActor != Actor;
        const bool CachedUnusable = CachedChannel
            && (!CachedChannelValid || !CachedConnectionValid);

        if (CachedConnectionMismatch || CachedActorMismatch || CachedUnusable) {
            const bool OwnsCachedBinding = CachedChannelValid
                && (!CachedActor || CachedActor == Actor)
                && CachedConnectionValid;
            if (OwnsCachedBinding && CachedConnectionMismatch) {
                QueuePlayerControllerChannelQuarantine(
                    CachedChannel, Actor, CachedConnection,
                    ActorConnectionValid ? ActorConnection : Connection,
                    "conn-actor-info-mismatch", 0);
            }
            const int Cleared = ClearConnActorInfoChannelIfMatches(
                ConnActorInfo, CachedChannel);
            MpLog("[PCConnActorInfoInvariant] RESET actor=" + MpPtr(Actor)
                + " actorConnection=" + MpPtr(ActorConnection)
                + " targetConnection=" + MpPtr(Connection)
                + " cachedChannel=" + MpPtr(CachedChannel)
                + " cachedChannelConnection=" + MpPtr(CachedConnection)
                + " cachedChannelActor=" + MpPtr(CachedActor)
                + " connActorInfo=" + MpPtr(ConnActorInfo)
                + " cleared=" + std::to_string(Cleared)
                + " reason=" + (CachedConnectionMismatch
                    ? "cached-channel-connection-mismatch"
                    : (CachedActorMismatch
                        ? "cached-channel-actor-mismatch"
                        : "cached-channel-unusable")));
            CachedChannel = nullptr;
            CachedConnection = nullptr;
            CachedActor = nullptr;
        }

        if (!ConnectionValid) {
            // Fail open when the target connection cannot be proven. Blocking here would suppress the
            // owning PlayerController's initial channel and strand all controller-owned client state.
            static uint64_t s_lastInvalidConnectionLogMs = 0;
            const uint64_t Now = static_cast<uint64_t>(GetTickCount64());
            if (s_lastInvalidConnectionLogMs == 0
                || Now - s_lastInvalidConnectionLogMs >= 1000) {
                s_lastInvalidConnectionLogMs = Now;
                MpLog("[PlayerControllerPreChannelGuard] FAIL_OPEN actor=" + MpPtr(Actor)
                    + " actorInfoMap=" + MpPtr(ActorInfoMap)
                    + " connManager=" + MpPtr(ConnManager)
                    + " targetConnection=" + MpPtr(Connection)
                    + " frame=" + std::to_string(Frame)
                    + " reason=unvalidated-target-connection");
            }
        }
        else {
            void* ConnectionPC = *reinterpret_cast<void**>(
                reinterpret_cast<uintptr_t>(Connection) + 0x30);
            void* OwningActor = *reinterpret_cast<void**>(
                reinterpret_cast<uintptr_t>(Connection) + 0x98);
            if (!IsRegisteredLiveObject(ConnectionPC)) ConnectionPC = nullptr;
            if (!IsRegisteredLiveObject(OwningActor)) OwningActor = nullptr;

            const bool ConnectionHasIdentity = ConnectionPC || OwningActor;
            const bool IsRemoteByConnection =
                ActorConnectionValid && ActorConnection != Connection;
            const bool IsRemoteByIdentity =
                !ActorConnectionValid && ConnectionHasIdentity
                && Actor != ConnectionPC && Actor != OwningActor;
            if (IsRemoteByConnection || IsRemoteByIdentity) {
                void* ChannelBefore =
                    (ConnActorInfo && IsReadablePointer(ConnActorInfo, sizeof(void*)))
                    ? *reinterpret_cast<void**>(ConnActorInfo) : nullptr;
                if (IsLiveActorChannel112(ChannelBefore)) {
                    void* ChannelConnection = PlayerControllerChannelConnection(ChannelBefore);
                    void* ChannelActor = PlayerControllerChannelActor(ChannelBefore);
                    if (ChannelConnection == Connection
                        && (!ChannelActor || ChannelActor == Actor)) {
                        QueuePlayerControllerChannelQuarantine(
                            ChannelBefore, Actor, Connection,
                            ActorConnectionValid ? ActorConnection : nullptr,
                            "remote-controller-pre-channel", 0);
                    }
                    ClearConnActorInfoChannelIfMatches(ConnActorInfo, ChannelBefore);
                }

                struct BlockedPair {
                    void* Actor = nullptr;
                    void* Connection = nullptr;
                };
                static BlockedPair s_loggedPairs[64]{};
                bool Seen = false;
                int Free = -1;
                for (int i = 0; i < static_cast<int>(std::size(s_loggedPairs)); ++i) {
                    if (s_loggedPairs[i].Actor == Actor
                        && s_loggedPairs[i].Connection == Connection) {
                        Seen = true;
                        break;
                    }
                    if (!s_loggedPairs[i].Actor && Free < 0) Free = i;
                }
                if (!Seen) {
                    if (Free >= 0) s_loggedPairs[Free] = { Actor, Connection };
                    MpLog("[PlayerControllerPreChannelGuard] BLOCK actor=" + MpPtr(Actor)
                        + " actorNetConnection=" + MpPtr(ActorConnection)
                        + " targetConnection=" + MpPtr(Connection)
                        + " targetPC=" + MpPtr(ConnectionPC)
                        + " targetOwningActor=" + MpPtr(OwningActor)
                        + " actorInfoMap=" + MpPtr(ActorInfoMap)
                        + " connManager=" + MpPtr(ConnManager)
                        + " connActorInfo=" + MpPtr(ConnActorInfo)
                        + " channelBefore=" + MpPtr(ChannelBefore)
                        + " globalInfo=" + MpPtr(GlobalInfo)
                        + " frame=" + std::to_string(Frame)
                        + " reason=" + (IsRemoteByConnection
                            ? "actor-netconnection-mismatch"
                            : "target-identity-mismatch")
                        + " result=SKIP_BEFORE_CREATE_CHANNEL");
                }
                return 0;
            }
        }
    }

    return reinterpret_cast<uint64_t(__fastcall*)(
        void*, void*, void*, void*, void*, void*, uint32_t)>(
            OrigRepGraphReplicateSingleActor)(
                Graph, Actor, ConnActorInfo, GlobalInfo,
                ActorInfoMap, ConnManager, Frame);
}

// Universal binding boundary. This catches SetChannelActor callers outside FUN_140ECEC50. A
// conclusive PlayerController/UNetConnection mismatch is quarantined before the original can emit
// reliable initial-channel state. The caller may still invoke ReplicateActor afterward, so the final
// hook below rejects every quarantined channel until deferred cleanup closes it.
void* OrigPlayerControllerSetChannelActor = nullptr;
void __fastcall PlayerControllerSetChannelActorGuardHook(
    UActorChannel* Channel, AActor* Actor, uint64_t Flags) {
    const uintptr_t Caller = reinterpret_cast<uintptr_t>(_ReturnAddress());
    const uintptr_t CallerRva = Caller >= Globals::BaseAddress
        ? Caller - Globals::BaseAddress : 0;

    if (Channel && IsPlayerControllerChannelQuarantined(Channel)) {
        MpLog("[PCChannelBind] BLOCK_QUARANTINED channel=" + MpPtr(Channel)
            + " actor=" + MpPtr(Actor)
            + " callerRva=" + MpHex(CallerRva));
        return;
    }

    if (IsLiveActorChannel112(Channel) && IsLivePlayerController112(Actor)) {
        void* ChannelConnection = *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(Channel) + 0x28);
        void* ActorConnection = *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(Actor) + 0x418);
        void* PreviousActor = *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(Channel) + 0x70);
        const bool ChannelConnectionValid = IsLiveNetConnection112(ChannelConnection);
        const bool ActorConnectionValid = IsLiveNetConnection112(ActorConnection);
        void* ChannelConnectionPC = ChannelConnectionValid
            ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(ChannelConnection) + 0x30)
            : nullptr;
        void* ChannelOwningActor = ChannelConnectionValid
            ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(ChannelConnection) + 0x98)
            : nullptr;
        if (!IsRegisteredLiveObject(ChannelConnectionPC)) ChannelConnectionPC = nullptr;
        if (!IsRegisteredLiveObject(ChannelOwningActor)) ChannelOwningActor = nullptr;
        const bool ChannelHasIdentity = ChannelConnectionPC || ChannelOwningActor;
        const bool WrongByConnection = ChannelConnectionValid && ActorConnectionValid
            && ChannelConnection != ActorConnection;
        const bool WrongByIdentity = ChannelConnectionValid && !ActorConnectionValid
            && ChannelHasIdentity
            && Actor != ChannelConnectionPC && Actor != ChannelOwningActor;

        if (WrongByConnection || WrongByIdentity) {
            const bool Queued = QueuePlayerControllerChannelQuarantine(
                Channel, Actor, ChannelConnection,
                ActorConnectionValid ? ActorConnection : nullptr,
                "set-channel-actor", CallerRva);
            const int EmergencyClose = Queued ? 0 : SafeCloseQuarantinedActorChannel(Channel);
            MpLog("[PCChannelBind] BLOCK actor=" + MpPtr(Actor)
                + " actorConnection=" + MpPtr(ActorConnection)
                + " channel=" + MpPtr(Channel)
                + " channelConnection=" + MpPtr(ChannelConnection)
                + " channelPC=" + MpPtr(ChannelConnectionPC)
                + " channelOwningActor=" + MpPtr(ChannelOwningActor)
                + " previousActor=" + MpPtr(PreviousActor)
                + " flags=" + MpHex(static_cast<uintptr_t>(Flags))
                + " callerRva=" + MpHex(CallerRva)
                + " reason=" + (WrongByConnection
                    ? "actor-netconnection-mismatch"
                    : "target-identity-mismatch")
                + " queued=" + std::to_string(Queued ? 1 : 0)
                + " emergencyClose=" + std::to_string(EmergencyClose)
                + " decision=SKIP_BIND");
            return;
        }
    }

    reinterpret_cast<void(__fastcall*)(UActorChannel*, AActor*, uint64_t)>(
        OrigPlayerControllerSetChannelActor)(Channel, Actor, Flags);
}

// Production invariant at the final server send boundary. Even if a future graph change regresses
// routing, a PlayerController is never serialized onto a different NetConnection. This boundary is
// intentionally non-mutating: changing graph lists while ServerReplicateActors is iterating them
// caused the 2026-07-27 Escalation disconnects. Returning early intentionally skips serialization for
// a quarantined controller channel. REPGRAPH_DIAG.flag still enables the older per-class frequency
// tally below.
//
// [2026-10-10] The target returns int64 bits written, not void: its epilogue is `mov rax, rdi` at
// 0x03D8BDAB, and the graph's ReplicateSingleActor (0x00F2C230) adds RAX into the connection's
// bandwidth counters (+0x198 / +0x1F8 at 0x00F2C68E / 0x00F2C699) and its own return value. The hook
// was declared bool (July) and then void, so every blocked path handed the graph whatever RAX held.
// It now forwards the original's value and returns 0 ("nothing written") when it blocks. Harmonicrain/
// Undaunted fixed the same ABI in their 1.12 copy. The channel and actor are no longer checked with
// VirtualQuery on every call: the native function dereferences both unconditionally, and
// IsRegisteredLiveObject is an SEH-guarded O(1) round trip.
void* OrigReplicateActorFreq = nullptr;
// [2026-10-11 1.14.7 O0] Counts every call and sums the native return (bits written) per connection for [PerfDetail].
// Game thread; relaxed atomics; the channel's connection (+0x28) is read like the actor (+0x70) already is.
static int64_t MpReplicateActorCounted(UActorChannel* Channel) {
    const int64_t Bits = reinterpret_cast<int64_t(__fastcall*)(UActorChannel*)>(OrigReplicateActorFreq)(Channel);
    if (MpPerfDetailEnabled()) {
        if (Bits > 0) g_perfRepActorBits.fetch_add(static_cast<uint64_t>(Bits), std::memory_order_relaxed);
        MpRepBitsAdd(Channel ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Channel) + 0x28) : nullptr, Bits);
    }
    return Bits;
}

int64_t __fastcall ReplicateActorFreqHook(UActorChannel* channel) {
    if (MpPerfDetailEnabled()) g_perfRepActorCalls.fetch_add(1, std::memory_order_relaxed);   // [2026-10-11 O0]
    if (channel && IsPlayerControllerChannelQuarantined(channel)) {
        return 0;
    }
    if (channel) {
        void* actor = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(channel) + 0x70);
        if (actor && IsRegisteredLiveObject(actor)) {
            if (reinterpret_cast<UObject*>(actor)->IsA(
                    SDK::APlayerController::StaticClass())) {
                void* connection = *reinterpret_cast<void**>(
                    reinterpret_cast<uintptr_t>(channel) + 0x28);
                const bool ConnectionValid = IsLiveNetConnection112(connection);
                void* connectionPC = ConnectionValid
                    ? *reinterpret_cast<void**>(
                        reinterpret_cast<uintptr_t>(connection) + 0x30)
                    : nullptr;
                void* owningActor = ConnectionValid
                    ? *reinterpret_cast<void**>(
                        reinterpret_cast<uintptr_t>(connection) + 0x98)
                    : nullptr;
                if (!IsRegisteredLiveObject(connectionPC)) connectionPC = nullptr;
                if (!IsRegisteredLiveObject(owningActor)) owningActor = nullptr;
                void* ActorConnection = IsReadablePointer(actor, 0x420)
                    ? *reinterpret_cast<void**>(
                        reinterpret_cast<uintptr_t>(actor) + 0x418)
                    : nullptr;
                const bool ConnectionHasIdentity = connectionPC || owningActor;
                const bool ActorConnectionKnown = IsLiveNetConnection112(ActorConnection);
                const bool IsRemoteByConnection =
                    ActorConnectionKnown && ConnectionValid && ActorConnection != connection;
                const bool IsRemoteByIdentity =
                    !ActorConnectionKnown && ConnectionHasIdentity
                    && actor != connectionPC && actor != owningActor;
                if (IsRemoteByConnection || IsRemoteByIdentity) {
                    QueuePlayerControllerChannelQuarantine(
                        channel, actor, connection,
                        ActorConnectionKnown ? ActorConnection : nullptr,
                        "replicate-actor-final", 0);
                    struct BlockedPair {
                        void* Actor = nullptr;
                        void* Connection = nullptr;
                    };
                    static BlockedPair s_loggedPairs[64]{};
                    bool Seen = false;
                    int Free = -1;
                    for (int i = 0; i < static_cast<int>(std::size(s_loggedPairs)); ++i) {
                        if (s_loggedPairs[i].Actor == actor
                            && s_loggedPairs[i].Connection == connection) {
                            Seen = true;
                            break;
                        }
                        if (!s_loggedPairs[i].Actor && Free < 0) Free = i;
                    }
                    if (!Seen) {
                        if (Free >= 0) s_loggedPairs[Free] = { actor, connection };
                        const uint8_t Flags = IsReadablePointer(actor, 0x60)
                            ? *reinterpret_cast<uint8_t*>(
                                reinterpret_cast<uintptr_t>(actor) + 0x58)
                            : 0;
                        MpLog("[PlayerControllerChannelGuard] BLOCK actor=" + MpPtr(actor)
                            + " actorNetConnection=" + MpPtr(ActorConnection)
                            + " targetConnection=" + MpPtr(connection)
                            + " targetPC=" + MpPtr(connectionPC)
                            + " targetOwningActor=" + MpPtr(owningActor)
                            + " flags=" + MpHex(Flags)
                            + " reason=" + (IsRemoteByConnection
                                ? "actor-netconnection-mismatch"
                                : "target-identity-mismatch"));
                    }
                    return 0;
                }
            }

            if (!RepGraphDiag()) {
                return MpReplicateActorCounted(channel);
            }
            void* cls = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(actor) + 0x10);
            if (cls && IsReadablePointer(cls, 0x20)) {
                static std::vector<std::pair<std::string, int>> s_counts;
                static uint64_t s_ms = 0;
                std::string cn = reinterpret_cast<UObject*>(cls)->GetName();
                bool found = false;
                for (auto& kv : s_counts) { if (kv.first == cn) { kv.second++; found = true; break; } }
                if (!found && s_counts.size() < 64) s_counts.push_back(std::make_pair(cn, 1));
                uint64_t now = static_cast<uint64_t>(GetTickCount64());
                if (s_ms == 0) s_ms = now;
                if (now - s_ms > 1000) {
                    std::string line;
                    for (auto& kv : s_counts) { line += " " + kv.first + "=" + std::to_string(kv.second); }
                    MpLog("[RepFreq] window=" + std::to_string(now - s_ms) + "ms reps/class:" + line);
                    s_counts.clear();
                    s_ms = now;
                }
            }
        }
    }
    return MpReplicateActorCounted(channel);
}

// [2026-07-19 SRA_RATE_CAP.flag] Bring the ~60Hz SRA into sync with NetServerMaxTickRate (30). VERIFIED in
// Ghidra: the game's TickFlush (0x03D91DC0) calls the SRA vtable slot +0x2A8 (this hook) UNCONDITIONALLY
// every invocation — there is NO internal MaxTickRate gate, so SRA runs at the engine frame rate regardless
// of the configured net rate. This flag coalesces SRA to NetServerMaxTickRate by skipping passes that
// arrive too soon (returning 0 = "replicated 0 actors", exactly how stock UE throttles when frame rate
// exceeds net rate). CRUCIAL DIFFERENCE from NATIVE_NET_TICK / MANUAL_TICK_ZERO_DT (both broke joining): it
// NEVER touches TickDispatch, so connection handshakes/timers keep running at full frame rate and the
// server stays joinable. Default OFF; opt-in + reversible.
// [2026-10-11 1.14.7] DEAD ON THIS BUILD: SRA_RATE_CAP.flag has no effect. Its only reader is ServerReplicateActorsHook,
// which InitServerHooks never installs on 1.14.7 ("ServerReplicateActors probe skipped (1.14.7 target unresolved)"); the
// Archon graph is driven by MpDriveReplicationGraph once per frame, and nothing there reads this flag. Kept only for
// the 1.12 hook body below. Rate changes belong to O4 (39_ section 13.3), one flag at a time, with players.
static bool SraRateCap() {
    static int c = -1;
    if (c < 0) {
        c = MpExeRelativeFlagPresent(L"SRA_RATE_CAP.flag") ? 1 : 0;
        MpLog(std::string("[SraRateCap] SRA_RATE_CAP.flag ")
            + (c ? "PRESENT -> ServerReplicateActors coalesced to NetServerMaxTickRate (SRA ~= configured "
                   "net rate). TickDispatch/handshakes untouched -> server stays joinable. Watch [SRA enter]."
                 : "absent -> SRA runs every TickFlush (default; ~engine frame rate)."));
    }
    return c == 1;
}

int __fastcall ServerReplicateActorsHook(void* NetDriver, float DeltaSeconds) {
    static uint64_t s_lastMs = 0;
    uint64_t now = static_cast<uint64_t>(GetTickCount64());
    bool doLog = RepGraphDiag() && (now - s_lastMs) > 1000;

    void* graph = (NetDriver && IsReadablePointer(reinterpret_cast<void*>((uintptr_t)NetDriver + 0x6F0), 8))
                  ? *reinterpret_cast<void**>((uintptr_t)NetDriver + 0x6E8) : nullptr;
    auto readIntAt = [](void* base, uintptr_t off) -> int {
        return (base && IsReadablePointer(reinterpret_cast<void*>((uintptr_t)base + off), 4))
               ? *reinterpret_cast<int*>((uintptr_t)base + off) : -1;
    };
    int ancBefore   = readIntAt(graph, 0x4C0);
    int connMgrs    = readIntAt(graph, 0x40);
    int clientConns = readIntAt(NetDriver, 0x98);

    // [SRA_RATE_CAP] Coalesce SRA to NetServerMaxTickRate. Skips replication passes that arrive sooner than
    // 1/rate since the last dispatch (0.9 slack so a ~60Hz frame lands ~30Hz, not ~20). Returns 0 without
    // calling the graph SRA — TickFlush's connection flush already ran, so this only defers new-actor
    // consideration to the next dispatched pass. TickDispatch/handshakes are on a different path and are
    // untouched, so this cannot make the server unjoinable (the failure mode of the two earlier flags).
    if (SraRateCap()) {
        static uint64_t s_lastSraDispatchMs = 0;
        int maxRate = readIntAt(NetDriver, 0x58);   // NetServerMaxTickRate
        if (maxRate > 0) {
            double minIntervalMs = (1000.0 / static_cast<double>(maxRate)) * 0.9;
            if (s_lastSraDispatchMs != 0 && static_cast<double>(now - s_lastSraDispatchMs) < minIntervalMs) {
                ProcessPlayerControllerChannelQuarantine(NetDriver);
                return 0;   // throttled this pass
            }
            s_lastSraDispatchMs = now;
        }
    }

    // [net-rate diag] measured SRA (replication) rate + the driver's configured net tick-rate caps, to
    // diagnose the co-op movement jitter (players are seen via the graph's spatial node, which updates less
    // often than the always-relevant behemoth). NetServerMaxTickRate @ +0x58, MaxNetTickRate @ +0x5C.
    static int s_sraCalls = 0;
    s_sraCalls++;
    if (doLog) {
        uint64_t elapsed = now - s_lastMs;
        float sraHz = (elapsed > 0) ? (s_sraCalls * 1000.0f / static_cast<float>(elapsed)) : 0.0f;
        int nstr = readIntAt(NetDriver, 0x58);
        int mntr = readIntAt(NetDriver, 0x5C);
        s_lastMs = now;
        s_sraCalls = 0;
        MpLog("[SRA enter] NetDriver=" + MpPtr(NetDriver) + " RepDriver=" + MpPtr(graph)
            + " ActorsNoConn_before=" + std::to_string(ancBefore)
            + " ConnMgrs=" + std::to_string(connMgrs) + " ClientConns=" + std::to_string(clientConns)
            + " | SRA=" + std::to_string(sraHz) + "Hz NetServerMaxTickRate=" + std::to_string(nstr)
            + " MaxNetTickRate=" + std::to_string(mntr));
    }

    // [DRIVE_ARCHON_GRAPH] When set + the graph is valid + graph.NetDriver matches this NetDriver, call the
    // Archon graph's own ServerReplicateActors (FUN_141ab43d0) INSTEAD of the native SRA (which doesn't
    // dispatch to the graph). Otherwise run the original. SEH + re-entrancy guarded.
    void* graphNetDriver = (graph && IsReadablePointer(graph, 0x38)) ? *reinterpret_cast<void**>((uintptr_t)graph + 0x30) : nullptr;
    static thread_local bool s_inGraphSRA = false;
    int ret;
    const char* mode;
    if (DriveArchonGraph() && graph && !s_inGraphSRA && graphNetDriver == NetDriver && IsReadablePointer(graph, 0x4C8)) {
        s_inGraphSRA = true;
        ret = SafeCallGraphServerReplicate(graph, DeltaSeconds);
        s_inGraphSRA = false;
        mode = "ArchonDirect";
    } else {
        ret = reinterpret_cast<int(__fastcall*)(void*, float)>(OrigServerReplicateActors)(NetDriver, DeltaSeconds);
        mode = DriveArchonGraph() ? "Original(guard-failed)" : "Original";
    }

    // SetChannelActor/ReplicateActor can only queue while the graph is iterating. Close and detach
    // contaminated channels after the native replication pass has completely unwound.
    ProcessPlayerControllerChannelQuarantine(NetDriver);

    if (doLog) {
        int ancAfter = readIntAt(graph, 0x4C0);
        MpLog(std::string("[SRA exit ] mode=") + mode + " ret=" + std::to_string(ret)
            + " ActorsNoConn " + std::to_string(ancBefore) + " -> " + std::to_string(ancAfter)
            + " graph.NetDriver=" + MpPtr(graphNetDriver));
    }
    return ret;
}


// [1.12.0 FIX 2026-07-10] The game's "create replication driver" helper
// (FUN_143d72a80, RVA 0x03D72A80) has two gates:
//   1) global byte at RVA 0x06729DA8 (DAT_146729da8) — master enable flag,
//      normally set by cmdline "-RepDriverEnable". Default appears to be 0.
//   2) NetDriver+0x178 (UNetDriver::ReplicationDriverClass) must be non-null.
// On dedicated server, neither is populated by default → helper prints
// "ReplicationDriverClass is null! Not using ReplicationDriver." and returns 0
// → SetReplicationDriver(driver, null) → no ArchonReplicationGraph → no
// actor channels → pawn never replicates → client stuck at loading.
//
// FIX: hook FUN_143d72a80. Force the enable flag to 1. If class field null,
// resolve UArchonReplicationGraph UClass from GObjects and write it.
static uint32_t* g_RepDriverEnableFlag = nullptr;         // Runtime addr for RVA 0x06729DA8. Reads/writes are dword-sized per Ghidra disasm.
static void*    g_ArchonRepGraphClass = nullptr;         // Cached UClass* for UArchonReplicationGraph
static bool     g_ArchonRepGraphSearched = false;

static void* FindArchonReplicationGraphClass() {
    if (g_ArchonRepGraphSearched) return g_ArchonRepGraphClass;
    g_ArchonRepGraphSearched = true;
    if (!SDK::UObject::GObjects) return nullptr;
    const int Count = SDK::UObject::GObjects->Num();

    // Search known graph classes. The generated runtime object flags and successful construction path
    // must be observed before treating either candidate as a valid 1.14.7 P2P replication graph.
    void* archonClass = nullptr;
    void* basicClass = nullptr;
    void* concreteArchonSubclass = nullptr;
    for (int i = 0; i < Count; i++) {
        SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
        if (!Obj) continue;
        const std::string nm = Obj->GetName();
        if (nm == "ArchonReplicationGraph")           archonClass = Obj;
        else if (nm == "BasicReplicationGraph")       basicClass = Obj;
        // Concrete subclasses would derive from ArchonReplicationGraph; check via SuperStruct at +0x40
    }

    // Log which candidates we found
    std::string report;
    report += "archonClass=" + MpPtr(archonClass);
    report += " basicClass=" + MpPtr(basicClass);
    report += " concreteArchonSubclass=" + MpPtr(concreteArchonSubclass);
    MpLog("[FindArchonRepGraph] candidates: " + report);

    // Prefer the game's own graph. CreateRepDriverHook handles the verified Abstract flag temporarily
    // during construction and restores it synchronously; runtime behavior still needs repro validation.
    void* chosen;
    if (UseArchonRepGraph() && archonClass) {
        chosen = archonClass;
    } else {
        chosen = concreteArchonSubclass ? concreteArchonSubclass
               : (basicClass ? basicClass
                              : archonClass);
    }
    if (chosen) {
        uintptr_t base = reinterpret_cast<uintptr_t>(chosen);
        // Wide class-flags scan across UStruct/UClass fields to locate where CLASS_Native
        // actually lives on this build. Sweep 0xA0..0x120 in 4-byte steps.
        std::string wideProbe;
        for (uintptr_t off = 0xA0; off <= 0x120; off += 4) {
            if (IsReadablePointer(reinterpret_cast<void*>(base + off), 4)) {
                uint32_t v = *reinterpret_cast<uint32_t*>(base + off);
                if (v != 0) {   // only print non-zero to reduce noise
                    char b[32]; _snprintf_s(b, _TRUNCATE, "+0x%02llX=0x%08X", (long long)off, v);
                    if (!wideProbe.empty()) wideProbe += " ";
                    wideProbe += b;
                }
            }
        }
        SDK::UObject* co = reinterpret_cast<SDK::UObject*>(chosen);
        MpLog(std::string("[FindArchonRepGraph] chose ") + co->GetName()
            + " ptr=" + MpPtr(chosen)
            + " metaclass=" + (co->Class ? co->Class->GetName() : "(null)")
            + " nonzero-dwords: " + wideProbe);

        // Also probe transient package (DAT_146e57480 in Ghidra = RVA 0x06E57480).
        // FUN_142810780 returns this, used as Outer for NewObject. If null, construction fails.
        void* transientPkg = nullptr;
        uintptr_t transAddr = Globals::BaseAddress + 0x06E57480;
        if (IsReadablePointer(reinterpret_cast<void*>(transAddr), 8)) {
            transientPkg = *reinterpret_cast<void**>(transAddr);
        }
        std::string pkgName = "(null-package)";
        if (transientPkg && IsReadablePointer(transientPkg, 0x20)) {
            SDK::UObject* pkg = reinterpret_cast<SDK::UObject*>(transientPkg);
            pkgName = pkg->GetName();
        }
        MpLog(std::string("[FindArchonRepGraph] TransientPackage @ RVA_0x06E57480 = ")
            + MpPtr(transientPkg) + " (" + pkgName + ")");

        // Additionally: check ClassDefaultObject at +0x118 (per SDK layout).
        void* cdoPtr = nullptr;
        if (IsReadablePointer(reinterpret_cast<void*>(base + 0x118), 8)) {
            cdoPtr = *reinterpret_cast<void**>(base + 0x118);
        }
        std::string cdoName = "(null)";
        if (cdoPtr && IsReadablePointer(cdoPtr, 0x20)) {
            cdoName = reinterpret_cast<SDK::UObject*>(cdoPtr)->GetName();
        }
        MpLog(std::string("[FindArchonRepGraph] ClassDefaultObject(+0x118)=") + MpPtr(cdoPtr) + " (" + cdoName + ")");
    } else {
        MpLog("[FindArchonRepGraph] NOTHING found in GObjects (Count=" + std::to_string(Count) + ")");
    }
    g_ArchonRepGraphClass = chosen;
    return g_ArchonRepGraphClass;
}

// Find the CDO of UArchonReplicationGraph. The CDO is a normal UObject named
// "Default__ArchonReplicationGraph" that lives in the /Script/Archon package.
// If we can substitute the CDO into SetReplicationDriver when the game passes null,
// the netdriver may accept it and drive actor channels.
static void*  g_ArchonRepGraphCDO = nullptr;
static bool   g_ArchonRepGraphCDOSearched = false;
static void* FindArchonReplicationGraphCDO() {
    if (g_ArchonRepGraphCDOSearched) return g_ArchonRepGraphCDO;
    g_ArchonRepGraphCDOSearched = true;
    if (!SDK::UObject::GObjects) return nullptr;
    const int Count = SDK::UObject::GObjects->Num();
    for (int i = 0; i < Count; i++) {
        SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
        if (!Obj) continue;
        if (Obj->GetName() == "Default__ArchonReplicationGraph") {
            g_ArchonRepGraphCDO = Obj;
            MpLog("[FindArchonRepGraphCDO] found at " + MpPtr(Obj)
                + "  class=" + (Obj->Class ? Obj->Class->GetName() : "(null)"));
            return g_ArchonRepGraphCDO;
        }
    }
    MpLog("[FindArchonRepGraphCDO] NOT FOUND in GObjects (Count=" + std::to_string(Count) + ")");
    return nullptr;
}

void* OrigCreateRepDriver = nullptr;
// Address of the ReplicationGraphFeature helper TArray {data, count}.
// From decompile: FUN_143d72cd0() returns &DAT_146ce9588. TArray in UE is 16 bytes:
// [0..7]=data pointer, [8..11]=count, [12..15]=max. At RVA 0x06CE9588.
static void** g_RepGraphFeatureArrayData = nullptr;   // pointer to (data ptr slot)
static int*   g_RepGraphFeatureArrayNum  = nullptr;   // pointer to count slot

// [RepGraph self-construct probe/fix 2026-07-16] When REPGRAPH_SELF_CONSTRUCT.flag is present, drive the
// class-path construction ourselves instead of calling the game's CreateReplicationDriver: resolve
// GetTransientPackage (FUN_142659120 @ RVA 0x02659120) as Outer, then StaticConstructObject_Internal
// (FUN_1426cec20 @ RVA 0x026CEC20) on a zeroed FStaticConstructObjectParameters {Class, Outer, ...}.
// This decomposes the native construction path using the selected class and transient package. If it
// yields a non-null instance, installs it so SetReplicationDriver receives a real driver. A verified
// Abstract flag is temporarily cleared by CreateRepDriverHook and restored before this returns.
static bool RepGraphSelfConstruct() {
    return UseNativeGraph();   // PRODUCTION: install the graph unless EMERGENCY_LEGACY_REPLICATION.flag
}

void* __fastcall CreateRepDriverHook(void* NetDriver, void* p2, void* p3) {
    static std::atomic<int> s_crdCount{0};
    int n = s_crdCount.fetch_add(1, std::memory_order_relaxed);

    // Force master enable flag to 1 before the check. Ghidra disasm shows dword access
    // (`CMP dword ptr [addr], 0` / `MOV dword ptr [addr], 1`), so read/write as uint32_t.
    if (g_RepDriverEnableFlag && IsReadablePointer(g_RepDriverEnableFlag, 4)) {
        uint32_t before = *g_RepDriverEnableFlag;
        *g_RepDriverEnableFlag = 1u;
        if (n < 3) MpLog("[CreateRepDriverHook #" + std::to_string(n) + "] "
            "forced RepDriverEnable flag: before=" + std::to_string(before)
            + " after=1  addr=" + MpPtr(g_RepDriverEnableFlag));
    }

    // Log ReplicationGraphFeature array state (this is the first early-exit gate)
    if (n < 3 && g_RepGraphFeatureArrayNum && IsReadablePointer(g_RepGraphFeatureArrayNum, 4)) {
        int num = *g_RepGraphFeatureArrayNum;
        void* data0 = (g_RepGraphFeatureArrayData && IsReadablePointer(g_RepGraphFeatureArrayData, 8))
                       ? *g_RepGraphFeatureArrayData : nullptr;
        std::string helperClass = "(null)";
        void* firstHelper = nullptr;
        if (data0 && num > 0 && IsReadablePointer(data0, 8)) {
            firstHelper = *reinterpret_cast<void**>(data0);
            if (firstHelper && IsReadablePointer(firstHelper, 0x20)) {
                UObject* cls = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(firstHelper) + 0x10);
                if (cls && IsReadablePointer(cls, 0x20)) helperClass = cls->GetName();
            }
        }
        MpLog("[CreateRepDriverHook #" + std::to_string(n) + "] "
            "RepGraphFeature array: count=" + std::to_string(num)
            + " data[0]=" + MpPtr(firstHelper) + " (" + helperClass + ")");
    }

    void*  beforeCls = nullptr;
    void*  afterCls  = nullptr;
    if (NetDriver && IsReadablePointer(NetDriver, 0x200)) {
        void** classField = reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(NetDriver) + 0x178);
        beforeCls = *classField;
        if (!beforeCls) {
            void* cls = FindArchonReplicationGraphClass();
            if (cls) {
                *classField = cls;
                afterCls = cls;
            }
        } else {
            afterCls = beforeCls;
        }
    }

    if (n < 6) {
        std::string clsName = "(null)";
        if (afterCls && IsReadablePointer(afterCls, 0x20)) {
            clsName = reinterpret_cast<UObject*>(afterCls)->GetName();
        }
        MpLog("[CreateRepDriverHook #" + std::to_string(n) + "] NetDriver=" + MpPtr(NetDriver)
            + " NetDriver+0x178 before=" + MpPtr(beforeCls) + " after=" + MpPtr(afterCls)
            + " (" + clsName + ")");
    }

    // Optionally force helper-array count to 0 while original runs, so it takes the
    // legacy path that consumes NetDriver+0x178 via NewObject. Restore after.
    int savedCount = 0;
    bool didSuppress = false;
    if (g_RepGraphFeatureArrayNum && IsReadablePointer(g_RepGraphFeatureArrayNum, 4)) {
        savedCount = *g_RepGraphFeatureArrayNum;
        if (savedCount > 0) {
            *g_RepGraphFeatureArrayNum = 0;
            didSuppress = true;
        }
    }

    // Ghidra's 1.14.7 StaticConstructObject path tests class flags at UClass+0xCC; the matching
    // generated SDK defines EClassFlags::Abstract as bit 0. Clear only that bit, only when present,
    // and restore it after synchronous construction. No other class flag is changed.
    if (n < 3 && afterCls && IsReadablePointer(afterCls, 0x130)) {
        std::stringstream ss;
        for (uintptr_t off = 0x40; off <= 0x120; off += 4) {
            uint32_t v = *reinterpret_cast<uint32_t*>(reinterpret_cast<uintptr_t>(afterCls) + off);
            ss << "+0x" << std::hex << off << "=0x" << v << " ";
        }
        // Explicitly decode the CDO (+0x118). If null, the Archon class isn't fully initialized at
        // NetDriver-init time -> NewObject fails -> that's why the create-helper returns null.
        void* cdo = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(afterCls) + 0x118);
        std::string cdoName = "(null)";
        if (cdo && IsReadablePointer(cdo, 0x20)) cdoName = reinterpret_cast<UObject*>(cdo)->GetName();
        MpLog("[CreateRepDriverHook #" + std::to_string(n) + "] classConstructScan afterCls=" + MpPtr(afterCls)
            + " CDO(+0x118)=" + MpPtr(cdo) + " (" + cdoName + ")  " + ss.str());
    }

    uint32_t savedClassFlags = 0;
    bool didClearAbstract = false;
    if (afterCls && IsReadablePointer(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(afterCls) + 0xCC), 4)) {
        uint32_t* flagsPtr = reinterpret_cast<uint32_t*>(reinterpret_cast<uintptr_t>(afterCls) + 0xCC);
        savedClassFlags = *flagsPtr;
        if (savedClassFlags & static_cast<uint32_t>(SDK::EClassFlags::Abstract)) {
            *flagsPtr = savedClassFlags & ~static_cast<uint32_t>(SDK::EClassFlags::Abstract);
            didClearAbstract = true;
        }
    }

    if (RepGraphSelfConstruct() && NetDriver && afterCls) {
        // Replicate the native class-path: Outer = GetTransientPackage (FUN_142659120 @ RVA 0x02659120),
        // then StaticConstructObject_Internal (FUN_1426cec20 @ RVA 0x026CEC20) on a zeroed
        // FStaticConstructObjectParameters {Class, Outer, Name=None, flags=0, Template=0, ...}.
        int fcount = (g_RepGraphFeatureArrayNum && IsReadablePointer(g_RepGraphFeatureArrayNum, 4))
                     ? *g_RepGraphFeatureArrayNum : -1;
        void* pkg = reinterpret_cast<void*(__fastcall*)()>(Globals::BaseAddress + 0x02810780)();
        void* params[10] = {};          // 80 bytes, zeroed (native reads up to +0x38)
        params[0] = afterCls;           // Class
        params[1] = pkg;                // Outer (transient package)
        void* obj = reinterpret_cast<void*(__fastcall*)(void*)>(Globals::BaseAddress + 0x02886C70)(&params[0]);
        std::string on = "(null)";
        if (obj && IsReadablePointer(obj, 0x20)) {
            UObject* c = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(obj) + 0x10);
            if (c && IsReadablePointer(c, 0x20)) on = c->GetName();
        }
        std::string pn = "(null)";
        if (pkg && IsReadablePointer(pkg, 0x20)) pn = reinterpret_cast<UObject*>(pkg)->GetName();
        MpLog("[RGSelf #" + std::to_string(n) + "] featureCount=" + std::to_string(fcount)
            + " pkg=" + MpPtr(pkg) + " (" + pn + ") cls=" + MpPtr(afterCls)
            + " -> StaticConstructObject=" + MpPtr(obj) + " (" + on + ")");
        if (obj) {
            if (didClearAbstract && afterCls) {
                *reinterpret_cast<uint32_t*>(reinterpret_cast<uintptr_t>(afterCls) + 0xCC) = savedClassFlags;
            }
            if (didSuppress) *g_RepGraphFeatureArrayNum = savedCount;
            MpLog("[RGSelf #" + std::to_string(n) + "] installing self-constructed driver " + MpPtr(obj));
            return obj;
        }
        MpLog("[RGSelf #" + std::to_string(n) + "] self-construct returned null; falling back to Orig");
    }

    void* ret = reinterpret_cast<void*(__fastcall*)(void*, void*, void*)>(OrigCreateRepDriver)(NetDriver, p2, p3);

    if (didClearAbstract && afterCls) {
        *reinterpret_cast<uint32_t*>(reinterpret_cast<uintptr_t>(afterCls) + 0xCC) = savedClassFlags;
    }
    if (didSuppress) *g_RepGraphFeatureArrayNum = savedCount;

    if (n < 6) {
        std::string retClass = "(null)";
        if (ret && IsReadablePointer(ret, 0x20)) {
            UObject* cls = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(ret) + 0x10);
            if (cls && IsReadablePointer(cls, 0x20)) retClass = cls->GetName();
        }
        MpLog("[CreateRepDriverHook #" + std::to_string(n) + "] Orig returned=" + MpPtr(ret)
            + " (" + retClass + ")  suppressedHelper=" + (didSuppress ? "1" : "0")
            + "  abstractFlagTemporarilyCleared=" + (didClearAbstract ? "1" : "0"));
    }
    return ret;
}

// [Group C cleanup 2026-07-13] SetChannelActorHook + OrigSetChannelActor removed (server actor-channel
// binding logger; pure passthrough+logging, no behavior change).

// [Group C cleanup 2026-07-13] ReplicatePropertiesHook + OrigReplicateProperties + g_loadoutClassCache
// removed ([LoadoutRepProps] loadout owner-only replication logger; pure passthrough+logging, no behavior change).

// [1.12.0 FIX 2026-07-09] Original behavior forced NULLPTR into SetReplicationDriver,
// which disabled Dauntless's ArchonReplicationGraph. That was a 1.4.4-era workaround.
// In 1.12.0, replication actor channels are ONLY opened by the ArchonReplicationGraph;
// the default UE 4.26 fallback path doesn't open actor channels for this build.
// Symptoms of the nullptr-force: Driver->ReplicationDriver=null, OpenChannels.Num stuck
// at 3, ViewTarget=null on connection, no pawn replication, client stuck at loading
// while retry-ClientRestart loops forever. FIX: pass RepDriver through unchanged.
// [2026-07-17 co-op smoothness] The graph fixes each actor's ReplicationPeriodFrame at register time from the
// class default (measured: player period 3 = ~10Hz vs behemoth period 1 = ~30Hz). Writing the live pawn's
// NetUpdateFrequency per-tick is ignored (cached). So raise the BP_PlayerCharacter CDO's NetUpdateFrequency
// (+0x108) / MinNetUpdateFrequency (+0x10C) BEFORE graph init (called from SetReplicationDriverHook, before
// the native init), so player pawns register with period 1 (~30Hz). Gated by PlayerRepBoost(). Cached search.
static void* g_PlayerCharCDO = nullptr;
static bool  g_PlayerCharCDOSearched = false;
static void BoostPlayerCharCDONetFreq() {
    if (!g_PlayerCharCDOSearched) {
        g_PlayerCharCDOSearched = true;
        if (SDK::UObject::GObjects) {
            const int Count = SDK::UObject::GObjects->Num();
            for (int i = 0; i < Count; i++) {
                SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
                if (!Obj) continue;
                if (Obj->GetName() == "Default__BP_PlayerCharacter_C") { g_PlayerCharCDO = Obj; break; }
            }
        }
        MpLog(std::string("[PlayerRepBoost] Default__BP_PlayerCharacter_C CDO = ") + MpPtr(g_PlayerCharCDO));
    }
    if (g_PlayerCharCDO && IsReadablePointer(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(g_PlayerCharCDO) + 0x110), 4)) {
        uintptr_t Cdo = reinterpret_cast<uintptr_t>(g_PlayerCharCDO);
        if (PlayerRepBoost()) {
            float* nuf  = reinterpret_cast<float*>(Cdo + 0x108);
            float* mnuf = reinterpret_cast<float*>(Cdo + 0x10C);
            static bool s_logged = false;
            if (!s_logged) { s_logged = true; MpLog("[PlayerRepBoost] CDO NetUpdateFrequency " + std::to_string(*nuf) + " -> 60, MinNetUpdateFrequency " + std::to_string(*mnuf) + " -> 30"); }
            *nuf = 60.0f;
            *mnuf = 30.0f;
        }
        if (PlayerAlwaysRelevant() && IsReadablePointer(reinterpret_cast<void*>(Cdo + 0x58), 1)) {
            // AActor::bAlwaysRelevant = bit 3 (mask 0x08) of the flags byte at +0x58.
            uint8_t* flags = reinterpret_cast<uint8_t*>(Cdo + 0x58);
            static bool s_arLogged = false;
            if (!s_arLogged) { s_arLogged = true; MpLog("[PlayerAlwaysRelevant] CDO bAlwaysRelevant byte(+0x58)=0x" + std::to_string(*flags) + " -> set bit3"); }
            *flags |= 0x08;
        }
    }
}

void SetReplicationDriverHook(UNetDriver* NetDriver, UReplicationDriver* RepDriver) {
    static std::atomic<int> s_setRepDrvCount{0};
    int n = s_setRepDrvCount.fetch_add(1, std::memory_order_relaxed);

    if (n < 16) {
        std::string clsName = "(null-driver)";
        if (RepDriver && IsReadablePointer(reinterpret_cast<void*>(RepDriver), 0x20)) {
            UObject* CLS = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(RepDriver) + 0x10);
            if (CLS && IsReadablePointer(CLS, 0x20)) {
                clsName = reinterpret_cast<UObject*>(CLS)->GetName();
            } else {
                clsName = "(no-class)";
            }
        }
        MpLog("[SetReplicationDriverHook #" + std::to_string(n) + "] NetDriver=" + MpPtr(NetDriver)
            + " RepDriver=" + MpPtr(RepDriver) + " class=" + clsName);
    }
    if (PlayerRepBoost() || PlayerAlwaysRelevant()) BoostPlayerCharCDONetFreq();
    reinterpret_cast<void(*)(UNetDriver*, UReplicationDriver*)>(OrigSetReplicationDriver)(NetDriver, RepDriver);

    // [GraphState 2026-07-16] Post-install snapshot: after the native SetReplicationDriver runs
    // (SetRepDriverWorld + InitForNetDriver + InitializeActorsInWorld), read the graph's node/connection
    // counts + the world the NetDriver holds. GlobalGraphNodes==0 => InitForNetDriver/InitGlobalGraphNodes
    // never ran; NetDriver.World==0 here => the graph was initialized with a null world (InitializeActorsInWorld
    // routed nothing) — the prime suspect for "installed but replicates nothing".
    if (n < 16 && RepDriver && IsReadablePointer(reinterpret_cast<void*>(RepDriver), 0xB8)) {
        uintptr_t g = reinterpret_cast<uintptr_t>(RepDriver);
        void* gDriver    = *reinterpret_cast<void**>(g + 0x30);
        void* connMgrCls = *reinterpret_cast<void**>(g + 0x28);
        int globalNodes  = *reinterpret_cast<int*>(g + 0xA0);
        int prepNodes    = *reinterpret_cast<int*>(g + 0xB0);
        int connMgrs     = *reinterpret_cast<int*>(g + 0x40);
        int pendConns    = *reinterpret_cast<int*>(g + 0x50);
        void* ndWorld    = (NetDriver && IsReadablePointer(reinterpret_cast<void*>((uintptr_t)NetDriver + 0x148), 8))
                           ? *reinterpret_cast<void**>((uintptr_t)NetDriver + 0x140) : nullptr;
        void* ndRepDrv   = (NetDriver && IsReadablePointer(reinterpret_cast<void*>((uintptr_t)NetDriver + 0x6F0), 8))
                           ? *reinterpret_cast<void**>((uintptr_t)NetDriver + 0x6E8) : nullptr;
        std::string sub = "";
        if (IsReadablePointer(reinterpret_cast<void*>(g), 0x4C8)) {
            void* gridNode  = *reinterpret_cast<void**>(g + 0x498);
            void* alwaysRel = *reinterpret_cast<void**>(g + 0x4A0);
            int arfc        = *reinterpret_cast<int*>(g + 0x4B0);
            int actorsNoC   = *reinterpret_cast<int*>(g + 0x4C0);
            sub = " GridNode=" + MpPtr(gridNode) + " AlwaysRelevantNode=" + MpPtr(alwaysRel)
                + " ARFCList=" + std::to_string(arfc) + " ActorsNoConn=" + std::to_string(actorsNoC);
        }
        MpLog("[SetReplicationDriverHook #" + std::to_string(n) + "] POST-INSTALL graph=" + MpPtr(RepDriver)
            + " graph.NetDriver=" + MpPtr(gDriver) + " ConnMgrClass=" + MpPtr(connMgrCls)
            + " GlobalGraphNodes=" + std::to_string(globalNodes) + " PrepareNodes=" + std::to_string(prepNodes)
            + " ConnMgrs=" + std::to_string(connMgrs) + " PendingConns=" + std::to_string(pendConns)
            + sub
            + " | NetDriver.World=" + MpPtr(ndWorld) + " NetDriver.RepDriver=" + MpPtr(ndRepDrv));
    }
    return;
}

// [Group D cleanup 2026-07-13] GetNetDriverInternalHook + OrigGetNetDriverInternal removed
// (pure passthrough, no forcing; Orig was used only inside the hook; collection fix uses 0x0403A830, not this).

void* OrigGetStartSpot = nullptr;

// [2026-07-16] NATIVE_PLAYERSTART.flag — the legacy GetStartSpotHook below ignores all args and
// always returns the FIRST APlayerStart, so every player is assigned the SAME start. With two
// players the late joiner cannot complete its restart while the first occupies that start (movement
// sticks at MOVE_Custom until the first player leaves). When the flag is set, call the REAL
// ChoosePlayerStart (RVA 0x01811B40; per-player/slot selection); if it returns null, fall back to a
// distinct start per call. Read once (set before launch).
static bool NativePlayerStart() {
    // PRODUCTION: native per-player ChoosePlayerStart is always on (proven; the legacy first-start path
    // assigned every player the SAME start). Independent of the replication emergency fallback.
    return true;
}

// Return the n-th APlayerStart in GObjects (round-robin fallback; no <vector> dependency).
static APlayerStart* NthPlayerStart(int n) {
    if (!SDK::UObject::GObjects) { return nullptr; }
    const int Num = SDK::UObject::GObjects->Num();
    int Total = 0;
    for (int i = 0; i < Num; i++) {
        SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
        if (Obj && !Obj->IsDefaultObject() && Obj->IsA(SDK::APlayerStart::StaticClass())) { Total++; }
    }
    if (Total == 0) { return nullptr; }
    const int Target = ((n % Total) + Total) % Total;
    int Idx = 0;
    for (int i = 0; i < Num; i++) {
        SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
        if (Obj && !Obj->IsDefaultObject() && Obj->IsA(SDK::APlayerStart::StaticClass())) {
            if (Idx == Target) { return (APlayerStart*)Obj; }
            Idx++;
        }
    }
    return nullptr;
}

APlayerStart* GetStartSpotHook(void* a1, void* a2, void* a3) {
    APlayerStart* Chosen = nullptr;
    const char* Mode = "forced";

    if (NativePlayerStart()) {
        Chosen = reinterpret_cast<APlayerStart*(*)(void*, void*, void*)>(OrigGetStartSpot)(a1, a2, a3);
        Mode = "native";
        if (!Chosen) {
            static std::atomic<int> s_fallbackIdx{ 0 };
            Chosen = NthPlayerStart(s_fallbackIdx.fetch_add(1, std::memory_order_relaxed));
            Mode = "fallback";
        }
    } else {
        Chosen = NthPlayerStart(0); // legacy single-player-shaped behaviour: always the first start
    }

    // [2026-07-16] Trace (bounded): a2 is the AController/PlayerController; NetConnection @+0x418.
    // Compare P1 vs P2 chosen-start ptr/name to confirm they get DISTINCT starts under the flag.
    static std::atomic<int> s_psLog{ 0 };
    if (s_psLog.fetch_add(1, std::memory_order_relaxed) < 40) {
        void* netConn = (a2 && IsReadablePointer(a2, 0x420)) ? *reinterpret_cast<void**>((uintptr_t)a2 + 0x418) : nullptr;
        std::string startName = (Chosen && IsReadablePointer(Chosen, 0x40)) ? reinterpret_cast<UObject*>(Chosen)->GetName() : std::string("null");
        std::string pcName = (a2 && IsReadablePointer(a2, 0x40)) ? reinterpret_cast<UObject*>(a2)->GetName() : std::string("?");
        MpLog(std::string("[PlayerStart] mode=") + Mode + " pc=" + MpPtr(a2) + "/" + pcName
            + " netConn=" + MpPtr(netConn) + " chose=" + MpPtr(Chosen) + "/" + startName);
    }
    return Chosen;
}

struct PlayerRoleChargeSnapshot {
    bool Valid = false;
    float MaxAbilityCharge = 0.0f;
    float Value = 0.0f;
    float Rate = 0.0f;
    float LastUpdateTime = 0.0f;
    float MaxValue = 0.0f;
    float MinValue = 0.0f;
    int NetDormancy = -1;
    float NetUpdateFrequency = 0.0f;
};

// [1.14.7 FIX 2026-10-08] The PlayerRole getters are called BY NAME through ProcessEvent, never by RVA.
//
// Callers still pass the 1.12 RVAs below; they are only keys now. On 1.14.7 none of the five is a function
// entry (Ghidra: "No function found" for each), and calling 0x01B983E0 executed an illegal instruction
// (0xC000001D) that killed the Ramsgate hub the moment a real omnicell role was applied (8 October,
// [TempestModifierEnsure] TRACK, account with PR_TEMPEST). The old __try could not catch it: x64 SEH
// unwinds through the CALLEE's unwind data, and a mid-function target makes that unwind meaningless, so the
// module's handler is never reached. All five are reflected UFunctions on AArchonPlayerRole in the 1.14.7
// SDK, so ProcessEvent reaches the right code on any build. An unknown key returns the failure value and
// is never called. The keys are the old 1.12 RVAs kept only as labels; their 1.14.7 bodies (rva-port-audit,
// verified) are 0x01CE30B0 / 0x01CE30E0 / (rate: not mapped) / 0x01CE4BF0 / 0x01CD80F0 - never call them by RVA.
static UFunction* PlayerRoleGetterFor(uintptr_t Key, bool* OutIsBool) {
    static UFunction* s_fns[5] = {};
    static bool s_tried[5] = {};
    static const struct { uintptr_t Key; const char* Name; bool IsBool; } kGetters[5] = {
        { 0x01B983E0, "GetCurrentAbilityCharge",        false },
        { 0x01B98410, "GetCurrentAbilityChargePercent", false },
        { 0x01B98470, "GetCurrentAbilityChargeRate",    false },
        { 0x01B99F30, "GetMaxAbilityCharge",            false },
        { 0x01B8D8A0, "CanActivateAbility",             true  },
    };
    for (int i = 0; i < 5; ++i) {
        if (kGetters[i].Key != Key) continue;
        if (OutIsBool) *OutIsBool = kGetters[i].IsBool;
        if (!s_tried[i]) {
            s_tried[i] = true;
            UClass* RoleClass = SDK::AArchonPlayerRole::StaticClass();
            s_fns[i] = RoleClass ? RoleClass->GetFunction("ArchonPlayerRole", kGetters[i].Name) : nullptr;
        }
        return s_fns[i];
    }
    return nullptr;
}

static bool SafeProcessEventRaw(UObject* Object, UFunction* Function, void* Params) {
    __try {
        Object->ProcessEvent(Function, Params);
        return true;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

static UObject* LivePlayerRoleObject(void* PlayerRole) {
    if (!PlayerRole || !IsReadablePointer(PlayerRole, 0x30) || !IsRegisteredLiveObject(PlayerRole)) return nullptr;
    UObject* Object = reinterpret_cast<UObject*>(PlayerRole);
    return Object->IsA(SDK::AArchonPlayerRole::StaticClass()) ? Object : nullptr;
}

static float SafeCallPlayerRoleFloat(void* PlayerRole, uintptr_t Rva) {
    bool IsBool = false;
    UFunction* Function = PlayerRoleGetterFor(Rva, &IsBool);
    UObject* Object = LivePlayerRoleObject(PlayerRole);
    if (!Function || IsBool || !Object) return -9999.0f;
    alignas(16) uint8_t Params[16] = {};                      // { float ReturnValue; } plus slack
    if (!SafeProcessEventRaw(Object, Function, Params)) return -9999.0f;
    float Value = 0.0f;
    memcpy(&Value, Params, sizeof(Value));
    return Value;
}

static int SafeCallPlayerRoleBoolRva(void* PlayerRole, uintptr_t Rva) {
    bool IsBool = false;
    UFunction* Function = PlayerRoleGetterFor(Rva, &IsBool);
    UObject* Object = LivePlayerRoleObject(PlayerRole);
    if (!Function || !IsBool || !Object) return -1;
    alignas(16) uint8_t Params[16] = {};                      // { bool ReturnValue; } plus slack
    if (!SafeProcessEventRaw(Object, Function, Params)) return -2;
    return Params[0] != 0 ? 1 : 0;
}

// [2026-07-25 AMP GUARD] UWidget::GetOwningPlayer is the virtual at vtable+0x2a0 (confirmed via
// UWidget::execGetOwningPlayer at 0x14378bff0, which does exactly `(*(vtable+0x2a0))(this)`).
// UEscalationRelicChoiceScreen::HandleRelicSelected calls this same slot as the first term of the
// guard that decides whether a relic click is forwarded to the server. It is a pure getter
// (PlayerContext.IsValid() ? PlayerContext.GetPlayerController() : nullptr), so reading it here has
// no side effects. SEH-guarded like the other native probes above.
static void* SafeCallWidgetGetOwningPlayer(void* Widget) {
    __try {
        if (!Widget || !IsReadablePointer(Widget, 0x8)) return nullptr;
        const uintptr_t VTable = *reinterpret_cast<uintptr_t*>(Widget);
        if (!VTable || !IsReadablePointer(reinterpret_cast<void*>(VTable + 0x2A0), 8)) return nullptr;
        void* Fn = *reinterpret_cast<void**>(VTable + 0x2A0);
        if (!Fn) return nullptr;
        return reinterpret_cast<void*(*)(void*)>(Fn)(Widget);
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return nullptr;
    }
}

struct PlayerRoleModifierSnapshot {
    bool Valid = false;
    void* Group = nullptr;
    int DesiredBuffs = -1;
    int DesiredEffects = -1;
    int DesiredAbilities = -1;
    int AppliedBuffs = -1;
    int AppliedEffects = -1;
    int AppliedAbilities = -1;
    int PendingBuffs = -1;
    int PendingEffects = -1;
    int PendingAbilities = -1;
};

static PlayerRoleModifierSnapshot CapturePlayerRoleModifiers(void* PlayerRole) {
    PlayerRoleModifierSnapshot Result{};
    __try {
        if (!PlayerRole || !IsReadablePointer(PlayerRole, 0x300)) return Result;
        const uintptr_t Role = reinterpret_cast<uintptr_t>(PlayerRole);
        Result.DesiredBuffs = *reinterpret_cast<const int*>(Role + 0x2B0);
        Result.DesiredEffects = *reinterpret_cast<const int*>(Role + 0x2C0);
        Result.DesiredAbilities = *reinterpret_cast<const int*>(Role + 0x2D0);
        Result.Group = *reinterpret_cast<void* const*>(Role + 0x2F8);
        if (Result.DesiredBuffs < 0 || Result.DesiredBuffs > 256
            || Result.DesiredEffects < 0 || Result.DesiredEffects > 256
            || Result.DesiredAbilities < 0 || Result.DesiredAbilities > 256) return Result;

        if (Result.Group) {
            if (!IsReadablePointer(Result.Group, 0xD0)) return Result;
            const uintptr_t Group = reinterpret_cast<uintptr_t>(Result.Group);
            Result.AppliedEffects = *reinterpret_cast<const int*>(Group + 0x68);
            Result.AppliedAbilities = *reinterpret_cast<const int*>(Group + 0x78);
            Result.AppliedBuffs = *reinterpret_cast<const int*>(Group + 0x88);
            Result.PendingBuffs = *reinterpret_cast<const int*>(Group + 0xA8);
            Result.PendingEffects = *reinterpret_cast<const int*>(Group + 0xB8);
            Result.PendingAbilities = *reinterpret_cast<const int*>(Group + 0xC8);
            const int Counts[] = { Result.AppliedEffects, Result.AppliedAbilities, Result.AppliedBuffs,
                Result.PendingBuffs, Result.PendingEffects, Result.PendingAbilities };
            for (int Count : Counts) {
                if (Count < 0 || Count > 256) return Result;
            }
        }
        Result.Valid = true;
        return Result;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return PlayerRoleModifierSnapshot{};
    }
}

static std::string PlayerRoleModifierSummary(void* PlayerRole) {
    if (!PlayerRole) return "role=null";
    const PlayerRoleModifierSnapshot Snapshot = CapturePlayerRoleModifiers(PlayerRole);
    if (!Snapshot.Valid) return "role=" + MpPtr(PlayerRole) + " unreadable";
    return "group=" + MpPtr(Snapshot.Group)
        + " desired[b=" + std::to_string(Snapshot.DesiredBuffs)
        + ",e=" + std::to_string(Snapshot.DesiredEffects)
        + ",a=" + std::to_string(Snapshot.DesiredAbilities) + "]"
        + " applied[b=" + std::to_string(Snapshot.AppliedBuffs)
        + ",e=" + std::to_string(Snapshot.AppliedEffects)
        + ",a=" + std::to_string(Snapshot.AppliedAbilities) + "]"
        + " pending[b=" + std::to_string(Snapshot.PendingBuffs)
        + ",e=" + std::to_string(Snapshot.PendingEffects)
        + ",a=" + std::to_string(Snapshot.PendingAbilities) + "]";
}

static PlayerRoleChargeSnapshot CapturePlayerRoleCharge(void* PlayerRole) {
    PlayerRoleChargeSnapshot Result{};
    if (!PlayerRole || !IsReadablePointer(PlayerRole, 0x35C)) return Result;
    const uintptr_t Base = reinterpret_cast<uintptr_t>(PlayerRole);
    Result.Valid = true;
    Result.MaxAbilityCharge = *reinterpret_cast<const float*>(Base + 0x308);
    Result.Value = *reinterpret_cast<const float*>(Base + 0x348);
    Result.Rate = *reinterpret_cast<const float*>(Base + 0x34C);
    Result.LastUpdateTime = *reinterpret_cast<const float*>(Base + 0x350);
    Result.MaxValue = *reinterpret_cast<const float*>(Base + 0x354);
    Result.MinValue = *reinterpret_cast<const float*>(Base + 0x358);
    Result.NetDormancy = *reinterpret_cast<const uint8_t*>(Base + 0xF1);
    Result.NetUpdateFrequency = *reinterpret_cast<const float*>(Base + 0x108);
    return Result;
}

static std::string PlayerRoleChargeSummary(void* PlayerRole) {
    if (!PlayerRole) return "role=null";
    const PlayerRoleChargeSnapshot Snapshot = CapturePlayerRoleCharge(PlayerRole);
    if (!Snapshot.Valid) return "role=" + MpPtr(PlayerRole) + " unreadable";
    const float Current = SafeCallPlayerRoleFloat(PlayerRole, 0x01B983E0);
    const float Percent = SafeCallPlayerRoleFloat(PlayerRole, 0x01B98410);
    const float CurrentRate = SafeCallPlayerRoleFloat(PlayerRole, 0x01B98470);
    const float NativeMax = SafeCallPlayerRoleFloat(PlayerRole, 0x01B99F30);
    // AArchonPlayerRole::CanActivateAbility is the native eligibility query used by the HUD/input
    // path (RVA 0x01B8D8A0). The earlier diagnostic mislabeled vtable +0x688 as the Blueprint
    // policy function; repro 12 + the Tempest asset graph proved it is unrelated. The real native
    // query checks bIsEquipped, charge >= max, and then dispatches CanActivateAbilityBP, whose
    // Tempest override requires at least one Buffs.WindFuryStacks effect.
    const int CanActivateNative = SafeCallPlayerRoleBoolRva(PlayerRole, 0x01B8D8A0);
    // [2026-07-25] Split CanActivateAbility into its three terms so a false result is attributable
    // instead of guessed. Verified against the 1.12 decompile (FUN_141b8d8a0):
    //     bIsEquipped(+0x2F4) != 0
    //  && GetCurrentAbilityCharge(AbilityCharge@+0x348) >= MaxAbilityCharge(+0x308)
    //  && CanActivateAbilityBP()                       <- FUN_142169c10, Blueprint override
    // SDK confirms MaxAbilityCharge@0x308 and AbilityCharge@0x348. The first two terms are plain
    // reads; when both are 1 and canActivateNative is 0, the Blueprint term is the one refusing -
    // that is the "charge is full but the Omnicell will not fire" case, and for Tempest it means the
    // Buffs.WindFuryStacks requirement is unmet. No more inferring which term failed.
    const int TermEquipped = SafeReadU8At(reinterpret_cast<uintptr_t>(PlayerRole), 0x2F4) != 0 ? 1 : 0;
    const int TermCharged = (Current >= Snapshot.MaxAbilityCharge) ? 1 : 0;
    const int TermBlueprint = (TermEquipped && TermCharged && CanActivateNative == 0) ? 0
        : (CanActivateNative == 1 ? 1 : -1);
    return "role=" + MpPtr(PlayerRole)
        + " max=" + std::to_string(Snapshot.MaxAbilityCharge)
        + " lazyValue=" + std::to_string(Snapshot.Value)
        + " lazyRate=" + std::to_string(Snapshot.Rate)
        + " lazyLast=" + std::to_string(Snapshot.LastUpdateTime)
        + " lazyMax=" + std::to_string(Snapshot.MaxValue)
        + " lazyMin=" + std::to_string(Snapshot.MinValue)
        + " current=" + std::to_string(Current)
        + " percent=" + std::to_string(Percent)
        + " currentRate=" + std::to_string(CurrentRate)
        + " nativeMax=" + std::to_string(NativeMax)
        + " canActivateNative=" + std::to_string(CanActivateNative)
        + " termEquipped=" + std::to_string(TermEquipped)
        + " termCharged=" + std::to_string(TermCharged)
        + " termBlueprintCanActivate=" + std::to_string(TermBlueprint)
        + " canNativeRva=" + MpHex(0x01B8D8A0)
        + " dormancy=" + std::to_string(Snapshot.NetDormancy)
        + " netHz=" + std::to_string(Snapshot.NetUpdateFrequency);
}

struct AbilitySpecDiagnostic {
    void* Ability = nullptr;
    void* SourceObject = nullptr;
    int Level = -1;
    int InputId = -1;
};

static AbilitySpecDiagnostic FindAbilitySpecDiagnostic(UAbilitySystemComponent* Component, uint32_t Handle) {
    AbilitySpecDiagnostic Result{};
    if (!Component || !IsReadablePointer(Component, 0x508)) return Result;
    const uintptr_t Items = reinterpret_cast<uintptr_t>(Component) + 0x4F8;
    void* Data = *reinterpret_cast<void**>(Items);
    const int Num = *reinterpret_cast<int*>(Items + 8);
    if (!Data || Num <= 0 || Num > 4096
        || !IsReadablePointer(Data, static_cast<size_t>(Num) * 0xE0)) return Result;
    for (int i = 0; i < Num; ++i) {
        const uintptr_t Spec = reinterpret_cast<uintptr_t>(Data) + static_cast<uintptr_t>(i) * 0xE0;
        if (*reinterpret_cast<const uint32_t*>(Spec + 0x0C) != Handle) continue;
        Result.Ability = *reinterpret_cast<void**>(Spec + 0x10);
        Result.Level = *reinterpret_cast<const int*>(Spec + 0x18);
        Result.InputId = *reinterpret_cast<const int*>(Spec + 0x1C);
        Result.SourceObject = *reinterpret_cast<void**>(Spec + 0x20);
        break;
    }
    return Result;
}

std::string SafeObjectNameForDiagnostic(void* Object) {
    // Mapped/readable memory is not sufficient for a UObject. UE recycles object allocations, so
    // a stale pointer can remain readable while its FName is already invalid; calling GetName on
    // that memory crashed the 0.1.50 client in EscalationFlowContext (read at 0x9E38). Require the
    // O(1) GUObjectArray round-trip before touching the object's name.
    if (!Object) return "null";
    if (!IsReadablePointer(Object, 0x40) || !IsRegisteredLiveObject(Object)) return "<dead>";
    return reinterpret_cast<UObject*>(Object)->GetName();
}

// [2026-07-23 WEAPON XP HUD DIAG] The authoritative game-server progression request contains
// varying kill awards, while the owning client's HUD popup was reported to show a flat +125.
// FExperienceGrant is the value passed from PlayerExperienceComponent to the HUD bar, journey
// objectives, and mastery stinger. Keep one canonical formatter so every consumer can be compared
// field-for-field in the next repro. These diagnostics are passive and separately bounded below.
static std::string ExperienceGrantSummary(const FExperienceGrant& Grant) {
    return "type=" + std::to_string(static_cast<int>(Grant.ExperienceType))
        + " increase=" + std::to_string(Grant.IncreaseAmount)
        + " boost=" + std::to_string(Grant.BoostAmount)
        + " level=" + std::to_string(Grant.PreviousLevel) + "->" + std::to_string(Grant.Level)
        + " levelAmount=" + std::to_string(Grant.PreviousLevelAmount) + "->" + std::to_string(Grant.LevelAmount)
        + " maxLevelAmount=" + std::to_string(Grant.PreviousMaxLevelAmount) + "->" + std::to_string(Grant.MaxLevelAmount);
}

static bool IsClientExperienceGrantConsumer(const std::string& FunctionName) {
    return FunctionName.find("HUDExperienceBar.OnPlayerExperienceGranted") != std::string::npos
        || FunctionName.find("mastery_stinger_manager_C.OnExperienceGranted") != std::string::npos
        || FunctionName.find("Objective_PlayerXP.OnExperienceGranted") != std::string::npos
        || FunctionName.find("PlayerJourneyComponent.HandleGrantPlayerExperience") != std::string::npos;
}

bool ServerTryActivateAbilityInternal(UAbilitySystemComponent* Component, FGameplayAbilitySpecHandle& AbilityHandle, bool InputPressed, FPredictionKey& PredictionKey, FGameplayEventData* TriggerEventData) {
    const AbilitySpecDiagnostic Spec = FindAbilitySpecDiagnostic(Component, AbilityHandle.Handle);
    void* OwnerActor = (Component && IsReadablePointer(Component, 0x3E0))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Component) + 0x3D0) : nullptr;
    void* AvatarActor = (Component && IsReadablePointer(Component, 0x3E0))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Component) + 0x3D8) : nullptr;
    void* PlayerRole = (AvatarActor && IsReadablePointer(AvatarActor, 0x740))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(AvatarActor) + 0x738) : nullptr;
    const std::string ChargeBefore = PlayerRoleChargeSummary(PlayerRole);

    if(InputPressed)
        Component->ServerSetInputPressed(AbilityHandle);

    void* InstancedAbility = nullptr;

    bool Activated = reinterpret_cast<bool(*)(UAbilitySystemComponent*, uint32_t, FPredictionKey*, void**, void*, FGameplayEventData*)>(Globals::BaseAddress + 0x016C85D0)(Component, AbilityHandle.Handle, &PredictionKey, &InstancedAbility, nullptr, TriggerEventData);

    if (!Activated && InputPressed)
        Component->ServerSetInputReleased(AbilityHandle);

    static std::atomic<int> s_abilityActivateLogCount{ 0 };
    if (s_abilityActivateLogCount.fetch_add(1, std::memory_order_relaxed) < 128) {
        MpLog("[AbilityActivate] component=" + MpPtr(Component)
            + " handle=" + std::to_string(AbilityHandle.Handle)
            + " inputPressed=" + std::to_string(InputPressed ? 1 : 0)
            + " activated=" + std::to_string(Activated ? 1 : 0)
            + " owner=" + MpPtr(OwnerActor) + "/" + SafeObjectNameForDiagnostic(OwnerActor)
            + " avatar=" + MpPtr(AvatarActor) + "/" + SafeObjectNameForDiagnostic(AvatarActor)
            + " ability=" + MpPtr(Spec.Ability) + "/" + SafeObjectNameForDiagnostic(Spec.Ability)
            + " source=" + MpPtr(Spec.SourceObject) + "/" + SafeObjectNameForDiagnostic(Spec.SourceObject)
            + " level=" + std::to_string(Spec.Level) + " inputId=" + std::to_string(Spec.InputId)
            + " chargeBefore={" + ChargeBefore + "} chargeAfter={" + PlayerRoleChargeSummary(PlayerRole) + "}");
    }

    return Activated;
}

void* OrigMakeDoDamage = nullptr;

bool MakeDoDamageHook(void* a1, void* a2, void* a3) {
    *(uint8_t*)((uintptr_t)a1 + 0x57C) = 1;

    return true;
}

#include <fstream>

void* OrigProcessEventClient = nullptr;
void* OrigEasyAntiCheatErrorProc = nullptr;
void* OrigEasyAntiCheatStartup = nullptr;

// s_LastPossessedPC / s_LastPossessedAtMs / s_ArchonInputActivated now declared much earlier in
// this file (right before GameEngineTickHook), since its timeout fallback needs them too.

// [PROD] EAC popup suppression is permanent in the private-server build. The private setup
// intentionally ships without the native EasyAntiCheat interface, so EasyAntiCheatErrorProc
// only ever turns that expected init failure into a blocking modal — there is no legitimate
// case where we want the popup shown. Previously gated behind SUPPRESS_EAC_POPUP.flag; now
// unconditionally enabled (no flag required).
static bool SuppressEacPopupEnabled() {
    return true;
}

// Native exec for UArchonGameInstance::EasyAntiCheatErrorProc
// (Ghidra: 0x1420DC460, RVA 0x020DC460).  This is reached directly by the
// EAC startup path, before/without a UObject::ProcessEvent dispatch, which is
// why filtering ProcessEvent alone cannot suppress the modal dialog.
void EasyAntiCheatErrorProcHook(void* Context, void* Stack, void* Result) {
    (void)Context;
    (void)Stack;
    if (SuppressEacPopupEnabled()) {
        if (Result && IsReadablePointer(Result, 1)) {
            *reinterpret_cast<bool*>(Result) = false;
        }
        static bool Logged = false;
        if (!Logged) {
            Logged = true;
            MpLog("[EACPopup] suppressed native EasyAntiCheatErrorProc");
        }
        return;
    }
    if (OrigEasyAntiCheatErrorProc) {
        reinterpret_cast<void(*)(void*, void*, void*)>(OrigEasyAntiCheatErrorProc)(Context, Stack, Result);
    }
}

// FEasyAntiCheatClient::StartupModule (Ghidra 0x14136FE40, RVA 0x0136FE40).
// The popup is emitted from this startup path before ErrorProc is dispatched;
// skipping the module startup is equivalent to the game's -NoEAC branch.
void EasyAntiCheatStartupHook(void* Module) {
    if (SuppressEacPopupEnabled()) {
        (void)Module;
        static bool Logged = false;
        if (!Logged) {
            Logged = true;
            MpLog("[EACPopup] suppressed FEasyAntiCheatClient::StartupModule");
        }
        return;
    }
    if (OrigEasyAntiCheatStartup) {
        reinterpret_cast<void(*)(void*)>(OrigEasyAntiCheatStartup)(Module);
    }
}

// [Group E2 cleanup 2026-07-13] ShouldTraceLoadEvent fwd-decl removed (LoadTrace loggers gone).
static uint8_t SafeReadByte(uintptr_t base, uintptr_t offset, uint8_t fallback);
static bool SafeWriteByte(uintptr_t base, uintptr_t offset, uint8_t value);
static float SafeReadFloat(void* addr, float fallback);
static uintptr_t SafeReadPtr(uintptr_t base, uintptr_t offset);
static bool SafeWriteFloat(uintptr_t base, uintptr_t offset, float value);
static void RefreshPlayerRoleGameplayLifecycle(UObject* PC, const char* TriggerLabel);
static void ReconcileAirshipGameplayHUD(const char* TriggerLabel);
static int TraceEscalationFlowEnter(const char* Side, UObject* Object,
                                    const std::string& FunctionName, void* Parms);
static void TraceEscalationFlowExit(const char* Side, int Seq, UObject* Object,
                                   const std::string& FunctionName, void* Parms);

// [2026-07-23 TRIALS AIRSHIP HUD]
// The private-server input bootstrap can legitimately run while the pre-match airship screen owns
// input. Keep the native HUD actor and replicated ArchonGameState cached from
// BPH_ArchonHUD_C::OnAirshipStateUpdate so the bootstrap can restore the game's intended
// HideGameplayHUD state without disabling loadout/PlayerRole initialization.
static UObject* s_AirshipHUD = nullptr;
static UObject* s_AirshipGameState = nullptr;
static bool s_AirshipHUDCompatHidden = false;

// [Group E2 cleanup 2026-07-13] IsInteractionTraceFn removed (was the [IxnTrace-CLI]/[IxnTrace-SVR] allowlist; both loggers removed).

// [1.12 archon-input-activation cascade — 2026-07-10, extracted to a function 2026-07-21]
// Was inlined in ProcessEventClientHook's OnInputModeChanged branch so the timeout fallback can
// invoke the same input/loadout cascade if the natural event never fires. `TriggerLabel` identifies
// the path in support logs. `AllowCinematicClear` is intentionally stricter: only a stable replay of
// the natural input edge may end cinematic mode; timeout-only recovery is input repair, not proof
// that the world/visual loading lifecycle completed. Caller is responsible for the
// `!s_ArchonInputActivated && PC && !DiagNaturalMode()`
// gate — this function does not re-check it, only the internal reentrancy guard
// (s_ArchonInputActivated = true, set before any ProcessEvent call, same ordering as before).
void TriggerArchonInputActivation(UObject* PC, const char* TriggerLabel, bool AllowCinematicClear) {
    // OnInputModeChanged events raised while this runs are ours, not the game's (see
    // s_LastNaturalGameInput). A structured exception unwinding past this frame would skip the
    // destructor, so ClientRestart also resets the depth for each new possession.
    struct ActivationDepthScope {
        ActivationDepthScope() { ++s_ArchonInputActivationDepth; }
        ~ActivationDepthScope() { --s_ArchonInputActivationDepth; }
    } ActivationDepth;

    uint8_t onlineReady = SafeReadByte(reinterpret_cast<uintptr_t>(PC), 0xC69, 0xEE);

    if (onlineReady != 1) {
        // Force-set. Log both attempt and post-write read-back so we can
        // confirm the write took (also catches page-protection AVs).
        bool wrote = SafeWriteByte(reinterpret_cast<uintptr_t>(PC), 0xC69, 1);
        uint8_t after = SafeReadByte(reinterpret_cast<uintptr_t>(PC), 0xC69, 0xEE);
        MpLog(std::string("[ArchonInputActivate] trigger=") + TriggerLabel + " Force-set bOnlineDataReady: "
            + "was=" + std::to_string(onlineReady)
            + " wrote=" + (wrote ? "ok" : "FAIL")
            + " after=" + std::to_string(after)
            + " PC=" + PC->GetFullName());

        if (after != 1) {
            // Write failed — page probably read-only or PC invalid.
            // Bail without EnableCharacterInput; try again next call.
            return;
        }
        // Fall through — bOnlineDataReady is now 1, proceed to activate.
    }

    // Set guard BEFORE the ProcessEvent call to prevent reentrancy —
    // EnableCharacterInput's internal OnInputModeChanged emission will
    // reach this branch again, and must short-circuit.
    s_ArchonInputActivated = true;

    MpLog(std::string("[ArchonInputActivate] trigger=") + TriggerLabel + " PC=" + PC->GetFullName()
        + " bOnlineDataReady@0xC59=1 (forced or natural)");

    // Resolve the EnableCharacterInput UFunction on the PC's Archon class.
    // We deliberately DO NOT call EnableControllerInput() — the previous
    // build did and it caused the recursion because EnableControllerInput
    // fires OnInputModeChanged internally. EnableCharacterInput(true) is
    // the correct API: it enables the pawn-facing input stack (combat /
    // out-of-combat / HUD / quick-action components at PC+0xC38..0xC50).
    static UFunction* s_EnableCharacterInputFn = nullptr;
    if (!s_EnableCharacterInputFn) {
        s_EnableCharacterInputFn = PC->Class->GetFunction("ArchonPlayerController", "EnableCharacterInput");
        MpLog(std::string("[ArchonInputActivate] Resolve EnableCharacterInput  → ")
            + MpPtr(s_EnableCharacterInputFn));
    }
    if (s_EnableCharacterInputFn) {
        struct { bool bEnableInput; } enableCharParms = { true };
        reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
            PC, s_EnableCharacterInputFn, &enableCharParms);
        MpLog("[ArchonInputActivate] Called AArchonPlayerController::EnableCharacterInput(true)");
    }

    // [1.12 ActiveLoadoutSlotIndex Fix — 2026-07-10; corrected 2026-07-28]
    // The original bootstrap unconditionally selected slot 0 on every possession. That repaired
    // new accounts whose index remained -1, but also overwrote a valid slot 1..5 after hunt travel.
    // Preserve the backend-loaded active index and use slot 0 only as the invalid-index fallback.
    static UFunction* s_GetLoadoutFn = nullptr;
    if (!s_GetLoadoutFn) {
        s_GetLoadoutFn = PC->Class->GetFunction("ArchonPlayerController", "GetLoadout");
    }
    if (s_GetLoadoutFn) {
        struct { UObject* ReturnValue; } getLoadoutParms = { nullptr };
        reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
            PC, s_GetLoadoutFn, &getLoadoutParms);
        if (getLoadoutParms.ReturnValue) {
            static UFunction* s_GetActiveLoadoutSlotFn = getLoadoutParms.ReturnValue->Class->GetFunction("ArchonLoadout", "GetActiveLoadoutSlotIndex");
            int32 ActiveLoadoutSlotIndex = -1;
            if (s_GetActiveLoadoutSlotFn) {
                struct { int32 ReturnValue; } getActiveSlotParms = { -1 };
                reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
                    getLoadoutParms.ReturnValue, s_GetActiveLoadoutSlotFn, &getActiveSlotParms);
                ActiveLoadoutSlotIndex = getActiveSlotParms.ReturnValue;
            }

            if (ActiveLoadoutSlotIndex < 0 || ActiveLoadoutSlotIndex >= 6) {
                static UFunction* s_SetLoadoutSlotFn = getLoadoutParms.ReturnValue->Class->GetFunction("ArchonLoadout", "ServerInternalSetActiveLoadoutSlotIndex");
                if (s_SetLoadoutSlotFn) {
                    struct { int32 InDesiredLoadoutSlotIndex; bool bForceApply; } setSlotParms = { 0, true };
                    reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
                        getLoadoutParms.ReturnValue, s_SetLoadoutSlotFn, &setSlotParms);
                    ActiveLoadoutSlotIndex = 0;
                    MpLog("[ArchonInputActivate] Active loadout was invalid; applied slot 0 fallback");
                }
            }
            else {
                MpLog(std::string("[ArchonInputActivate] Preserved backend-selected active loadout slot ")
                    + std::to_string(ActiveLoadoutSlotIndex));
            }

            // PlayerRole/Omnicell is client-local equipment state (the pawn's PlayerRole pointer
            // is not a Net property in the 1.12 SDK). Re-run the game's real apply routine on the
            // selected local loadout after travel.
            if (ActiveLoadoutSlotIndex >= 0 && OrigApplyPlayerRole) {
                ApplyPlayerRoleHook(getLoadoutParms.ReturnValue);
                MpLog(std::string("[ArchonInputActivate] Re-applied local PlayerRole for active loadout slot ")
                    + std::to_string(ActiveLoadoutSlotIndex));
                UObject* StableRolePawn = nullptr;
                if (IsClientRolePumpPossessionStable(PC, &StableRolePawn)
                    && !MpExeRelativeFlagPresent(L"DISABLE_CLIENT_ROLE_LIFECYCLE_REPLAY.flag")) {
                    RefreshPlayerRoleGameplayLifecycle(PC, "post-apply");
                }
                else {
                    MpLog("[ClientTravelGuard] deferred post-apply PlayerRole lifecycle until possession settles");
                }
            }
        }
        else {
            MpLog("[ArchonInputActivate] PC->GetLoadout() returned null, unable to resolve ActiveLoadoutSlotIndex");
        }
    }

    // [1.12 belt-and-braces input restoration — 2026-07-10]
    // In addition to EnableCharacterInput (which activates the pawn's own input
    // components), also clear any pending ignore-input state on the PC itself.
    // UE4's SetIgnoreMoveInput uses a REFERENCE COUNT — a cinematic that fired
    // "ignore movement" but never fired the matching "resume movement" leaves
    // the counter > 0 permanently. ResetIgnoreMoveInput zeros the counter.
    // Same pattern for SetIgnoreLookInput.
    static UFunction* s_ResetIgnoreMoveInputFn = nullptr;
    static UFunction* s_ResetIgnoreLookInputFn = nullptr;
    static UFunction* s_SetCinematicModeFn    = nullptr;
    if (!s_ResetIgnoreMoveInputFn) {
        s_ResetIgnoreMoveInputFn = PC->Class->GetFunction("Controller", "ResetIgnoreMoveInput");
        MpLog(std::string("[ArchonInputActivate] Resolve ResetIgnoreMoveInput → ")
            + MpPtr(s_ResetIgnoreMoveInputFn));
    }
    if (!s_ResetIgnoreLookInputFn) {
        s_ResetIgnoreLookInputFn = PC->Class->GetFunction("Controller", "ResetIgnoreLookInput");
        MpLog(std::string("[ArchonInputActivate] Resolve ResetIgnoreLookInput → ")
            + MpPtr(s_ResetIgnoreLookInputFn));
    }
    if (!s_SetCinematicModeFn) {
        s_SetCinematicModeFn = PC->Class->GetFunction("PlayerController", "SetCinematicMode");
        MpLog(std::string("[ArchonInputActivate] Resolve SetCinematicMode → ")
            + MpPtr(s_SetCinematicModeFn));
    }
    if (s_ResetIgnoreMoveInputFn) {
        reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
            PC, s_ResetIgnoreMoveInputFn, nullptr);
        MpLog("[ArchonInputActivate] Called AController::ResetIgnoreMoveInput()");
    }
    if (s_ResetIgnoreLookInputFn) {
        reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
            PC, s_ResetIgnoreLookInputFn, nullptr);
        MpLog("[ArchonInputActivate] Called AController::ResetIgnoreLookInput()");
    }
    // Clearing cinematic mode is a world/visual lifecycle transition, not merely input repair.
    // Only do it for the natural OnInputModeChanged edge after the exact possession chain has
    // survived the travel-settle interval. The timeout fallback may restore input, but it must not
    // tell an unfinished map that its arrival/loading presentation has completed.
    //
    // [1.14.7 FIX 2026-10-10, 38_ §21] The natural edge must also have handed control to the player:
    // the game's latest OnInputModeChanged must be true. On a hunt the first natural edge is the arrival
    // cinematic taking input away (false); clearing cinematic mode then made the Blueprint show the
    // gameplay HUD over the arrival beam ~15 s before the cinematic ended (13:52 run: HUD 1->3 inside
    // this call at 13:52:14.926, the game's own hand-over at 13:52:30.375). The airship screen takes
    // input the same way. Ramsgate and Training hand over with a true edge and still get the clear.
    // FORCE_CINEMATIC_CLEAR.flag restores the old any-edge behaviour.
    static int s_ForceCinematicClear = -1;
    if (s_ForceCinematicClear < 0) {
        s_ForceCinematicClear = MpExeRelativeFlagPresent(L"FORCE_CINEMATIC_CLEAR.flag") ? 1 : 0;
        MpLog(std::string("[ArchonInputActivate] cinematic clear needs the game's control hand-over: ")
            + (s_ForceCinematicClear ? "OFF (FORCE_CINEMATIC_CLEAR.flag present)" : "ON (default)"));
    }
    const bool GameGaveControl = s_LastNaturalGameInput == 1 || s_ForceCinematicClear == 1;
    UObject* StableCinematicPawn = nullptr;
    bool StablePossession = false;
    if (AllowCinematicClear && s_NaturalInputModeChangedObserved && GameGaveControl) {
        StablePossession = IsClientRolePumpPossessionStable(PC, &StableCinematicPawn);
    }
    const bool CanClearCinematic = AllowCinematicClear
        && s_NaturalInputModeChangedObserved
        && GameGaveControl
        && StablePossession;
    if (s_SetCinematicModeFn && CanClearCinematic) {
        struct {
            bool bInCinematicMode;
            bool bHidePlayer;
            bool bAffectsHUD;
            bool bAffectsMovement;
            bool bAffectsTurning;
        } cineParms = { false, false, false, false, false };
        reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
            PC, s_SetCinematicModeFn, &cineParms);
        MpLog("[ArchonInputActivate] Called APlayerController::SetCinematicMode(false, ...) after stable natural input edge");
    }
    else if (s_SetCinematicModeFn) {
        MpLog(std::string("[ArchonInputActivate] SKIP SetCinematicMode(false) trigger=")
            + TriggerLabel
            + " allow=" + std::to_string(AllowCinematicClear ? 1 : 0)
            + " naturalInputEdge=" + std::to_string(s_NaturalInputModeChangedObserved ? 1 : 0)
            + " gameInput=" + std::to_string(s_LastNaturalGameInput)
            + " stablePossession=" + std::to_string(StablePossession ? 1 : 0));
    }

    // [1.12 InputConfigCascade — 2026-07-10 — Analysis.md + move.md]
    // Force-run the Dauntless-specific input-init pipeline that natural
    // possession flow was supposed to trigger. Verified from logs (see
    // move.md §4-5): none of ApplyInputConfiguration / SetupArchonInput /
    // SprintPress fired during login, so most action/axis mappings never
    // populated. Result: only pawn-BP-hardcoded axes (MoveForward, Turn,
    // LookUp, TurnRate, LookUpRate) work — everything else (A/D strafe,
    // E interact, Shift sprint, LMB/RMB attack, Space dodge) is dead.
    //
    // Fix: after EnableCharacterInput completes, force the input config
    // to load the Hunter mapping asset (which has full combat controls).
    // Then run SetupArchonInput on the PC to install action bindings.
    //
    // Verified UFunctions (Ghidra exec search):
    //   AArchonPlayerControllerBase::execApplyInputConfiguration @ 0x14216BEB0
    //     Params: struct { EArchonPlayerInputConfiguration Config; bool Return; }
    //   AArchonPlayerControllerBase::execApplyInputConfigurationFromSettings @ 0x14216BF40
    //     Params: (none)
    //   Aplayer_controller_bp_C::SetupArchonInput (BP method, no exec wrapper)
    //   AArchonCharacter::SetupArchonInput @ ArchonCharacter class
    //
    // EArchonPlayerInputConfiguration values: Default=0, Hunter=1.
    static UFunction* s_ApplyInputConfigFn = nullptr;
    static UFunction* s_ApplyInputConfigFromSettingsFn = nullptr;
    static UFunction* s_PCSetupArchonInputFn = nullptr;
    if (!s_ApplyInputConfigFn) {
        s_ApplyInputConfigFn = PC->Class->GetFunction(
            "ArchonPlayerControllerBase", "ApplyInputConfiguration");
        MpLog(std::string("[InputConfigCascade] Resolve ApplyInputConfiguration → ")
            + MpPtr(s_ApplyInputConfigFn));
    }
    if (!s_ApplyInputConfigFromSettingsFn) {
        s_ApplyInputConfigFromSettingsFn = PC->Class->GetFunction(
            "ArchonPlayerControllerBase", "ApplyInputConfigurationFromSettings");
        MpLog(std::string("[InputConfigCascade] Resolve ApplyInputConfigurationFromSettings → ")
            + MpPtr(s_ApplyInputConfigFromSettingsFn));
    }
    if (!s_PCSetupArchonInputFn) {
        // Blueprint UFunction on the player_controller_bp_C class
        s_PCSetupArchonInputFn = PC->Class->GetFunction(
            "player_controller_bp_C", "SetupArchonInput");
        if (!s_PCSetupArchonInputFn) {
            // Fallback: base class version
            s_PCSetupArchonInputFn = PC->Class->GetFunction(
                "ArchonPlayerController", "SetupArchonInput");
        }
        MpLog(std::string("[InputConfigCascade] Resolve PC SetupArchonInput → ")
            + MpPtr(s_PCSetupArchonInputFn));
    }

    // Step 1: Apply the Hunter input configuration (full combat controls).
    // If Hunter mapping is missing/unavailable, fallback to Default.
    if (s_ApplyInputConfigFn) {
        struct {
            uint8_t InputConfiguration;   // EArchonPlayerInputConfiguration::Hunter (1)
            uint8_t Pad[3];
            bool    ReturnValue;
        } cfgParms = { 1, {0,0,0}, false };
        reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
            PC, s_ApplyInputConfigFn, &cfgParms);
        MpLog(std::string("[InputConfigCascade] Called ApplyInputConfiguration(Hunter=1) → ret=")
            + std::to_string(cfgParms.ReturnValue ? 1 : 0));

        // If Hunter returned false (not available), try Default
        if (!cfgParms.ReturnValue) {
            cfgParms.InputConfiguration = 0;
            cfgParms.ReturnValue = false;
            reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
                PC, s_ApplyInputConfigFn, &cfgParms);
            MpLog(std::string("[InputConfigCascade] Hunter unavailable, fell back to Default(0) → ret=")
                + std::to_string(cfgParms.ReturnValue ? 1 : 0));
        }
    }

    // Step 2: Apply from user settings (loads any user-defined key rebinds
    // from savegame. On our fresh install with no savegame, this is
    // essentially a no-op that ensures the config-changed delegate fires).
    if (s_ApplyInputConfigFromSettingsFn) {
        reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
            PC, s_ApplyInputConfigFromSettingsFn, nullptr);
        MpLog("[InputConfigCascade] Called ApplyInputConfigurationFromSettings()");
    }

    // Step 3: Run SetupArchonInput on the PC — installs action bindings
    // and creates the ArchonInputComponent stack (out_of_combat, combat,
    // interaction, HUD, quick-action).
    if (s_PCSetupArchonInputFn) {
        reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
            PC, s_PCSetupArchonInputFn, nullptr);
        MpLog("[InputConfigCascade] Called player_controller_bp_C::SetupArchonInput()");
    }

    // Step 4: Run SetupArchonInput on the pawn. The pawn has its own
    // SetupArchonInput (AArchonCharacter or BP_PlayerCharacter_C) which
    // wires up the pawn-side input components. Fetch pawn via PC+0x250.
    uintptr_t pawnPtr = SafeReadPtr(reinterpret_cast<uintptr_t>(PC), 0x0250);
    if (pawnPtr) {
        UObject* Pawn = reinterpret_cast<UObject*>(pawnPtr);
        static UFunction* s_PawnSetupArchonInputFn = nullptr;
        if (!s_PawnSetupArchonInputFn) {
            s_PawnSetupArchonInputFn = Pawn->Class->GetFunction(
                "BP_PlayerCharacter_C", "SetupArchonInput");
            if (!s_PawnSetupArchonInputFn) {
                s_PawnSetupArchonInputFn = Pawn->Class->GetFunction(
                    "ArchonCharacter", "SetupArchonInput");
            }
            MpLog(std::string("[InputConfigCascade] Resolve pawn SetupArchonInput → ")
                + MpPtr(s_PawnSetupArchonInputFn));
        }
        if (s_PawnSetupArchonInputFn) {
            reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
                Pawn, s_PawnSetupArchonInputFn, nullptr);
            MpLog("[InputConfigCascade] Called pawn SetupArchonInput()");
        }
    }

    // EnableCharacterInput/SetupArchonInput and the late loadout application above are required for
    // movement and Omnicells, but they can also rebuild/show the combat HUD while the airship screen
    // is still active. Re-assert the native airship presentation after the complete cascade.
    ReconcileAirshipGameplayHUD("input-activation");
}

// [2026-07-24 CRASH FIX, round 2] A repeat crash traveling Ramsgate -> Training Dojo (still
// EXCEPTION_ACCESS_VIOLATION, same class of stale-pointer fault) came back with no
// [ApplyPlayerRole][RetryTimeout] FAULTED line - meaning TryApplyPlayerRoleRetryGuarded's guard
// (inside TickPlayerRoleRetries) was NOT what faulted this time. RefreshPlayerRoleGameplayLifecycle,
// called right alongside it in the same client pump below, has the identical unguarded native-pointer-
// chase pattern (PC -> Pawn -> PlayerState/PlayerRole, IsReadablePointer-checked per hop but with no
// protection against the memory having been repurposed for a different object after a level travel),
// and takes s_LastPossessedPC - exactly the kind of pointer a Ramsgate->Training travel invalidates.
// Rather than hardening every function in this pump one at a time (ReconcileAirshipGameplayHUD reads
// its own cached AArchonHUD/AArchonGameState pointers the same way), wrap the ENTIRE pump call in one
// object-free (no std::string/RAII locals in this function's own frame - required for __try, same
// C2712 constraint as TryApplyPlayerRoleRetryGuarded/SafeReadByte elsewhere in this file) guard, so
// ANY of the three faulting is caught here instead of propagating and killing the client.
// [2026-07-25 T-POSE / PAWN INIT POSE] Party members report that on every client exactly ONE other
// player is stuck in the reference ("stretch") pose, and which one differs per client - A sees C,
// B sees A, C sees B. A skeletal mesh sitting in reference pose is a mesh whose anim setup never
// ran, and on AArchonCharacter that is driven by PlayerRole (+0x738).
//
// Everything currently instrumented is LOCAL-pawn only: [PlayerRoleRepNotify] tracks exactly one
// pawn per client (repro 8: Mystic 59 lines for his own PR_TEMPEST pawn, Bobo 69 for his own
// PR_ICEBORNE, rainfallscore none because she has no omnicell equipped). So we have never once
// looked at whether a REMOTE pawn has a PlayerRole, which is precisely what the T-pose is about.
//
// The server side already points at this: [PlayerRolePostActiveRefresh] pushes each
// AArchonPlayerRole to exactly one connection (role=...PR_TEMPEST -> conn=A,
// role=...PR_ICEBORNE -> conn=B) and every push reports wroteData=0.
//
// This census walks GameState->PlayerArray (the same route SampleBleedoutGrace uses) and records
// pawn + PlayerRole for every player the client knows about, so one repro answers: is the
// T-posed player the one whose PlayerRole is null on that client, and is the pattern really a
// rotation. Read-only. Logged only when the picture changes, so a stable hunt costs a line or two.
// Gate off with NO_PAWN_ROLE_CENSUS.flag.
static std::string s_lastPawnRoleCensus;
static int s_pawnRoleCensusCount = 0;
static constexpr int kPawnRoleCensusMax = 240;

static void SampleRemotePawnPlayerRoles() {
    if (s_pawnRoleCensusCount >= kPawnRoleCensusMax) return;
    if (MpExeRelativeFlagPresent(L"NO_PAWN_ROLE_CENSUS.flag")) return;

    UWorld* World = *reinterpret_cast<UWorld**>(Globals::BaseAddress + 0x06FC7F58);
    if (!World || !IsReadablePointer(World, 0x128)) return;
    void* GameState = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(World) + 0x120);
    if (!GameState || !IsReadablePointer(GameState, 0x248)) return;
    void** StateData = *reinterpret_cast<void***>(reinterpret_cast<uintptr_t>(GameState) + 0x238);
    const int StateNum = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(GameState) + 0x240);
    if (!StateData || StateNum <= 0 || StateNum > 64 || !IsReadablePointer(StateData, 8)) return;

    std::string Census;
    int WithRole = 0;
    int WithoutRole = 0;
    for (int i = 0; i < StateNum; ++i) {
        void* State = StateData[i];
        // [2026-07-25 CRASH FIX] IsReadablePointer only proves the memory is MAPPED. A PlayerState
        // whose pawn was destroyed keeps a stale PawnPrivate, and the freed slot is quickly reused,
        // so the pointer stays readable while its UObject header is somebody else's data. Calling
        // IsA() on it then dereferences a garbage ClassPrivate: rainfallscore's client died on
        // EXCEPTION_ACCESS_VIOLATION reading 0x0000002800000031, which is exactly the +0x30
        // StructBaseChainArray read of IsChildOf against ClassPrivate 0x0000002800000001, and her
        // last log line before the fault was this census. IsRegisteredLiveObject round-trips the
        // object through GObjects, which is the only check that distinguishes live from recycled.
        if (!State || !IsReadablePointer(State, 0x310) || !IsRegisteredLiveObject(State)) continue;
        const uintptr_t S = reinterpret_cast<uintptr_t>(State);
        void* Pawn = *reinterpret_cast<void**>(S + 0x280);           // APlayerState::PawnPrivate
        std::string Name = CoreCapFString(reinterpret_cast<void*>(S + 0x300));
        if (Name.empty()) Name = "?";

        // AArchonCharacter::PlayerRole @ +0x738. Liveness first, then readability, then IsA - in
        // that order, because only the liveness check makes the IsA safe.
        void* Role = nullptr;
        bool IsArchonChar = false;
        bool PawnLive = false;
        if (Pawn && IsRegisteredLiveObject(Pawn) && IsReadablePointer(Pawn, 0x740)) {
            PawnLive = true;
            IsArchonChar = reinterpret_cast<UObject*>(Pawn)->IsA(
                SDK::AArchonCharacter::StaticClass());
            if (IsArchonChar) Role = *reinterpret_cast<void**>(
                reinterpret_cast<uintptr_t>(Pawn) + 0x738);
        }
        if (IsArchonChar) { if (Role) ++WithRole; else ++WithoutRole; }
        // A pawn pointer that is set but not live is itself a finding - it means the client is
        // holding a destroyed pawn, which is what the churn below looks like from the inside.
        if (Pawn && !PawnLive) Census += " | " + Name + " pawn=" + MpPtr(Pawn) + " STALE";

        else Census += " | " + Name + " pawn=" + MpPtr(Pawn)
            + " isArchonChar=" + std::to_string(IsArchonChar ? 1 : 0)
            + " playerRole=" + (Role ? MpPtr(Role) : std::string("NULL"));
    }
    if (Census.empty()) return;

    const std::string Line = "players=" + std::to_string(StateNum)
        + " withRole=" + std::to_string(WithRole)
        + " missingRole=" + std::to_string(WithoutRole) + Census;
    if (Line == s_lastPawnRoleCensus) return;   // only log transitions
    s_lastPawnRoleCensus = Line;
    ++s_pawnRoleCensusCount;
    MpLog("[PawnRoleCensus] " + Line);
}

// Its own object-free guard (same pattern as SampleBleedoutGraceGuarded) rather than relying on
// the pump's outer __try: a diagnostic must never be able to take the client down, and this one
// already did once.
static void SampleRemotePawnPlayerRolesGuarded() {
    __try { SampleRemotePawnPlayerRoles(); } __except (EXCEPTION_EXECUTE_HANDLER) {}
}

// ---------------------------------------------------------------------------------------------
// [2026-07-25 CONTROLLER SPLIT DETECTOR]
// ---------------------------------------------------------------------------------------------
// Repro 12 caught the affected client in a state where the widget's owning PlayerController had
// livePC->Player == null while ULocalPlayer::PlayerController pointed somewhere else. That is
// UPlayer::SwitchController's signature: adopt the new controller, null the old one's Player.
//
// The server-side log rules out the obvious cause - it held exactly two PlayerController objects
// for the whole session (player_controller_bp_C_2147480543 / _2147471279, one per player), so no
// replacement controller was ever created and pushed down. That leaves either a client-side
// destroy/recreate of the PC from replication (the same channel churn already measured on the role
// actors) or a bad read. This detector settles it by watching the transition live instead of
// inferring it from a click minutes later.
//
// The check itself needs no weak-pointer resolution at all: APlayerController::Player @ +0x298 on
// the controller we already track. Going non-null -> null IS the orphaning. The cached LocalPlayer
// from the last healthy sample then yields whatever replaced it.
//
// ---------------------------------------------------------------------------------------------
// [2026-07-26 CONTROLLER WATCHPOINT] Catch the write, not the aftermath
// ---------------------------------------------------------------------------------------------
// Repro 13 timed the damage precisely - Bobo's accepted ServerSelectRelicOption at 00:03:41.934,
// MysticFox's controller orphaned at 00:03:42.067, 133ms later, and only ever on the player who
// did NOT select. What that does not give us is the instruction that performed the write, and
// polling cannot: at 1Hz (or even 8Hz) we only ever describe state after the corruption, and we
// cannot tell which of the two writes happened first. That ordering is the direction test:
//     trackedPC->Player cleared first        -> a teardown / SetPlayer(nullptr) path is primary
//     LocalPlayer->PlayerController first    -> a SwitchController / reassignment path is primary
//
// The two writes are:
//     APlayerController::Player      @ PC + 0x298   (verified: FLocalPlayerContext ctor reads
//                                                    param_2[0x53] = +0x298)
//     UPlayer::PlayerController      @ LP + 0x30    (verified against the SDK's UPlayer layout)
//
// Hardware debug registers watch exactly those two addresses, so this needs NO symbol discovery.
// UPlayer::SwitchController / APlayerController::SetPlayer / the destroy path are all unsymbolised
// in this binary, and hooking a function I can only guess at is what produced the bad ChIndex
// offset and the no-op SetOwningPlayer repair. A watchpoint cannot be wrong about which
// instruction wrote: the trap carries RIP.
//
// Debug registers are per-thread, so they are armed from the client pump, which runs on the game
// thread - the same thread the writes happen on. The handler does the absolute minimum (POD ring
// buffer, no allocation, no logging); the pump drains and formats. Anti-cheat is already
// neutralised elsewhere in this file, but if DR0-DR3 are clobbered anyway the drain simply stays
// empty and we fall back to locating SwitchController in Ghidra.
//
// Production default is OFF. Enable only for a targeted controller investigation with
// ENABLE_CONTROLLER_WATCHPOINT.flag; hardware debug registers are unnecessary during ordinary play.
namespace CtrlWatch {
    struct Hit {
        uint64_t TickMs;
        uint32_t ThreadId;
        uint32_t Which;          // 0 = PC->Player, 1 = LocalPlayer->PlayerController
        uint64_t Rip;
        uint64_t Addr;
        uint64_t NewValue;
        uint64_t Stack[10];
    };
    static Hit s_hits[32]{};
    static std::atomic<uint32_t> s_write{ 0 };
    static uint32_t s_read = 0;
    static void* s_veh = nullptr;
    static volatile uint64_t s_watchAddr[2] = { 0, 0 };
    static uint64_t s_modBase = 0, s_modEnd = 0;
    static uint32_t s_armedThread = 0;

    // SEH helpers kept separate: the handler itself must not require object unwinding.
    static uint64_t SafeRead64(uint64_t Addr) {
        __try { return *reinterpret_cast<uint64_t*>(Addr); }
        __except (EXCEPTION_EXECUTE_HANDLER) { return 0; }
    }
    static void SafeScanStack(uint64_t Rsp, uint64_t* Out, int Max) {
        __try {
            const uint64_t* Sp = reinterpret_cast<const uint64_t*>(Rsp);
            int n = 0;
            for (int i = 0; i < 128 && n < Max; ++i) {
                const uint64_t V = Sp[i];
                if (V > s_modBase && V < s_modEnd) Out[n++] = V;
            }
        }
        __except (EXCEPTION_EXECUTE_HANDLER) {}
    }

    static LONG CALLBACK Handler(EXCEPTION_POINTERS* Info) {
        if (!Info || !Info->ExceptionRecord || !Info->ContextRecord) return EXCEPTION_CONTINUE_SEARCH;
        if (Info->ExceptionRecord->ExceptionCode != EXCEPTION_SINGLE_STEP) return EXCEPTION_CONTINUE_SEARCH;
        CONTEXT* C = Info->ContextRecord;
        uint32_t Which = 0xFFFFFFFFu;
        if (C->Dr6 & 0x1) Which = 0;
        else if (C->Dr6 & 0x2) Which = 1;
        if (Which == 0xFFFFFFFFu) return EXCEPTION_CONTINUE_SEARCH;   // not one of ours

        Hit& H = s_hits[s_write.fetch_add(1, std::memory_order_relaxed) % 32];
        H.TickMs = GetTickCount64();
        H.ThreadId = GetCurrentThreadId();
        H.Which = Which;
        H.Rip = C->Rip;
        H.Addr = s_watchAddr[Which];
        H.NewValue = SafeRead64(H.Addr);
        for (int i = 0; i < 10; ++i) H.Stack[i] = 0;
        SafeScanStack(C->Rsp, H.Stack, 10);

        C->Dr6 = 0;
        C->EFlags |= 0x10000;   // RF: do not re-trap the same instruction
        return EXCEPTION_CONTINUE_EXECUTION;
    }

    // DR7 per slot i: L(i) at bit 2i; RW at 16+4i (01=write); LEN at 18+4i (10=8 bytes).
    // 8-byte write watch therefore sets nibble 0b1001 at 16+4i.
    static bool Arm(int Slot, uint64_t Addr) {
        if (Slot < 0 || Slot > 1 || (Addr & 7)) return false;
        CONTEXT C{};
        C.ContextFlags = CONTEXT_DEBUG_REGISTERS;
        HANDLE Thread = GetCurrentThread();
        if (!GetThreadContext(Thread, &C)) return false;
        if (Slot == 0) { C.Dr0 = Addr; C.Dr7 &= ~(0xFULL << 16); C.Dr7 |= (0x9ULL << 16) | 0x1ULL; }
        else           { C.Dr1 = Addr; C.Dr7 &= ~(0xFULL << 20); C.Dr7 |= (0x9ULL << 20) | 0x4ULL; }
        C.Dr6 = 0;
        if (!SetThreadContext(Thread, &C)) return false;
        s_watchAddr[Slot] = Addr;
        s_armedThread = GetCurrentThreadId();
        return true;
    }

    static bool DisarmAll() {
        if (s_watchAddr[0] == 0 && s_watchAddr[1] == 0 && s_armedThread == 0) return true;
        CONTEXT C{};
        C.ContextFlags = CONTEXT_DEBUG_REGISTERS;
        HANDLE Thread = GetCurrentThread();
        if (!GetThreadContext(Thread, &C)) return false;
        C.Dr0 = 0;
        C.Dr1 = 0;
        C.Dr6 = 0;
        C.Dr7 &= ~((0xFULL << 16) | (0xFULL << 20) | 0x5ULL);
        if (!SetThreadContext(Thread, &C)) return false;
        s_watchAddr[0] = 0;
        s_watchAddr[1] = 0;
        s_armedThread = 0;
        return true;
    }

    static bool EnsureHandler() {
        if (s_veh) return true;
        s_modBase = Globals::BaseAddress;
        s_modEnd = Globals::BaseAddress + 0x08000000;   // generous upper bound for the exe image
        s_veh = AddVectoredExceptionHandler(1, Handler);
        return s_veh != nullptr;
    }
}

// Off with NO_CONTROLLER_SPLIT_LOG.flag.
static std::string DescribeSuspectObject(void* Ptr);   // defined with the relic-recovery probes
static void* s_lastHealthyLocalPlayer = nullptr;
static void* s_lastHealthyLocalPlayerController = nullptr;
static bool  s_controllerSplitReported = false;

// Format and emit anything the watchpoint handler captured since the last pump. RIP and every
// stack return address are printed as base+RVA so they drop straight into Ghidra.
static void DrainControllerWatchpointHits() {
    const uint32_t Written = CtrlWatch::s_write.load(std::memory_order_relaxed);
    while (CtrlWatch::s_read != Written) {
        // If the handler outran a 32-entry buffer, skip to the oldest surviving entry.
        if (Written - CtrlWatch::s_read > 32) CtrlWatch::s_read = Written - 32;
        const CtrlWatch::Hit& H = CtrlWatch::s_hits[CtrlWatch::s_read % 32];
        ++CtrlWatch::s_read;

        std::string Stack;
        for (int i = 0; i < 10 && H.Stack[i]; ++i) {
            Stack += (i ? " " : "") + std::string("+0x")
                   + MpHex(H.Stack[i] - Globals::BaseAddress);
        }
        MpLog(std::string("[ControllerWatch] WRITE field=")
            + (H.Which == 0 ? "APlayerController::Player(+0x298)"
                            : "UPlayer::PlayerController(+0x30)")
            + " addr=" + MpPtr(reinterpret_cast<void*>(H.Addr))
            + " newValue=" + DescribeSuspectObject(reinterpret_cast<void*>(H.NewValue))
            + " rip=+0x" + MpHex(H.Rip - Globals::BaseAddress)
            + " tid=" + std::to_string(H.ThreadId)
            + " tickMs=" + std::to_string(H.TickMs)
            + " stack=[" + Stack + "]");
    }
}

static void TickControllerSplitDetector() {
    if (Globals::AmServer) return;
    if (MpExeRelativeFlagPresent(L"NO_CONTROLLER_SPLIT_LOG.flag")) return;

    const bool WatchpointsEnabled = MpExeRelativeFlagPresent(L"ENABLE_CONTROLLER_WATCHPOINT.flag");
    if (WatchpointsEnabled) {
        // Drain first so the write trace is emitted even if the state check below bails out.
        DrainControllerWatchpointHits();
    }
    else {
        static bool s_DefaultWatchpointsDisarmed = false;
        if (!s_DefaultWatchpointsDisarmed) {
            CtrlWatch::DisarmAll();
            s_DefaultWatchpointsDisarmed = true;
            MpLog("[ControllerWatch] disabled by default; create ENABLE_CONTROLLER_WATCHPOINT.flag for a targeted capture");
        }
    }

    MpForgetPossessionIfWorldChanged();
    UObject* PC = s_LastPossessedPC;
    if (!PC || !IsReadablePointer(PC, 0x2A0) || !IsRegisteredLiveObject(PC)) return;
    void* Player = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(PC) + 0x298);

    // Arm/re-arm the two watchpoints whenever the pair we care about changes. Both addresses are
    // 8-byte aligned by construction (0x298 and 0x30 off 16-aligned UObjects).
    if (WatchpointsEnabled && CtrlWatch::EnsureHandler()) {
        const uint64_t WantPcField = reinterpret_cast<uint64_t>(PC) + 0x298;
        if (CtrlWatch::s_watchAddr[0] != WantPcField) {
            const bool Ok = CtrlWatch::Arm(0, WantPcField);
            MpLog("[ControllerWatch] arm slot0 APlayerController::Player pc=" + MpPtr(PC)
                + " addr=" + MpPtr(reinterpret_cast<void*>(WantPcField))
                + " ok=" + std::to_string(Ok ? 1 : 0)
                + " tid=" + std::to_string(GetCurrentThreadId()));
        }
        if (Player && IsReadablePointer(Player, 0x38)) {
            const uint64_t WantLpField = reinterpret_cast<uint64_t>(Player) + 0x30;
            if (CtrlWatch::s_watchAddr[1] != WantLpField) {
                const bool Ok = CtrlWatch::Arm(1, WantLpField);
                MpLog("[ControllerWatch] arm slot1 UPlayer::PlayerController lp=" + MpPtr(Player)
                    + " addr=" + MpPtr(reinterpret_cast<void*>(WantLpField))
                    + " ok=" + std::to_string(Ok ? 1 : 0)
                    + " tid=" + std::to_string(GetCurrentThreadId()));
            }
        }
    }

    if (Player) {
        void* LpController = IsReadablePointer(Player, 0x38)
            ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Player) + 0x30) : nullptr;
        // Healthy sample: remember it so we can name the replacement after an orphaning.
        s_lastHealthyLocalPlayer = Player;
        s_lastHealthyLocalPlayerController = LpController;
        s_controllerSplitReported = false;

        // The other order: still owned, but the LocalPlayer has already moved on.
        if (LpController && LpController != static_cast<void*>(PC)) {
            static void* s_lastMismatchReported = nullptr;
            if (s_lastMismatchReported != LpController) {
                s_lastMismatchReported = LpController;
                MpLog("[ControllerSplit] DIVERGED (old PC still owned) trackedPC="
                    + DescribeSuspectObject(PC)
                    + " localPlayer=" + DescribeSuspectObject(Player)
                    + " localPlayer->PlayerController=" + DescribeSuspectObject(LpController));
            }
        }
        return;
    }

    if (s_controllerSplitReported) return;
    s_controllerSplitReported = true;

    void* Replacement = (s_lastHealthyLocalPlayer
                         && IsReadablePointer(s_lastHealthyLocalPlayer, 0x38)
                         && IsRegisteredLiveObject(s_lastHealthyLocalPlayer))
        ? *reinterpret_cast<void**>(
              reinterpret_cast<uintptr_t>(s_lastHealthyLocalPlayer) + 0x30)
        : nullptr;

    MpLog("[ControllerSplit] ORPHANED trackedPC=" + DescribeSuspectObject(PC)
        + " trackedPC->Player=null"
        + " cachedLocalPlayer=" + DescribeSuspectObject(s_lastHealthyLocalPlayer)
        + " replacementPC=" + DescribeSuspectObject(Replacement)
        + " previousLpController=" + DescribeSuspectObject(s_lastHealthyLocalPlayerController)
        + " trackedPcStillLive=" + std::to_string(IsRegisteredLiveObject(PC) ? 1 : 0)
        + " - this is the moment the amp click and its RPC both start failing");
}

static bool ValidateClientPossessionChain(UObject* PC, UObject* ExpectedPawn, UObject** OutPawn) {
    if (OutPawn) *OutPawn = nullptr;
    if (Globals::AmServer) return false;
    MpForgetPossessionIfWorldChanged();
    if (!PC || PC != s_LastPossessedPC) return false;

    __try {
        if (!IsRegisteredLiveObject(PC) || !IsReadablePointer(PC, 0x2A0)) return false;

        void* LocalPlayer = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(PC) + 0x298);
        if (!LocalPlayer || !IsRegisteredLiveObject(LocalPlayer)
            || !IsReadablePointer(LocalPlayer, 0x38)
            || !reinterpret_cast<UObject*>(LocalPlayer)->IsA(SDK::ULocalPlayer::StaticClass())) {
            return false;
        }
        void* LocalPlayerController = *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(LocalPlayer) + 0x30);
        if (LocalPlayerController != PC) return false;

        UObject* Pawn = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(PC) + 0x250);
        if (!Pawn || (ExpectedPawn && Pawn != ExpectedPawn)
            || !IsRegisteredLiveObject(Pawn) || !IsReadablePointer(Pawn, 0x740)) {
            return false;
        }
        void* PlayerState = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Pawn) + 0x240);
        if (!PlayerState || !IsRegisteredLiveObject(PlayerState)
            || !IsReadablePointer(PlayerState, 0x6B1)) {   // [1.14.7 SDK FIX] bound through bIsActiveGameplay @+0x6B0
            return false;
        }

        if (OutPawn) *OutPawn = Pawn;
        return true;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        if (OutPawn) *OutPawn = nullptr;
        return false;
    }
}

// [1.14.7 TRACE 2026-10-05] Say WHICH link of the possession chain is missing.
//
// Measured: a joined client sits on the loading screen and never arrives. Its log shows only
//   [ClientTravelGuard] waiting for stable LocalPlayer->PlayerController->Pawn chain; repair pump skipped
// and the readiness hook falls through to
//   [ReadinessCompat] PRESERVE_FALSE scope=client-not-allowlisted obj=player_controller_city_bp_C ...
// IsLocalArchonControllerReadinessObject already proves the controller/local-player/ownership links and
// then delegates to IsClientRolePumpPossessionStable, so the failure has to be in the two links only
// ValidateClientPossessionChain adds: the pawn (PC+0x250 vs s_LastRestartPawn) and the player state.
// This reads them OUTSIDE the guard's __try (no change to its logic, no std::string inside __try) and is
// throttled, so a stuck client names the exact missing link instead of only the symptom.
static void MpTracePossessionChainFailure(UObject* PC) {
    static std::atomic<uint64_t> s_lastMs{ 0 };
    const uint64_t Now = GetTickCount64();
    const uint64_t Last = s_lastMs.load(std::memory_order_relaxed);
    if (Last != 0 && Now - Last < 3000) return;
    s_lastMs.store(Now, std::memory_order_relaxed);

    std::string Detail = "pc=" + MpPtr(PC) + " expectedPawn(s_LastRestartPawn)=" + MpPtr(s_LastRestartPawn);
    if (PC && IsReadablePointer(PC, 0x258)) {
        void* Pawn = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(PC) + 0x250);
        Detail += " pcPawn(+0x250)=" + MpPtr(Pawn);
        Detail += " pawnMatchesExpected=" + std::to_string(Pawn != nullptr && Pawn == s_LastRestartPawn ? 1 : 0);
        if (Pawn && IsReadablePointer(Pawn, 0x740)) {
            Detail += " pawnLive=" + std::to_string(IsRegisteredLiveObject(Pawn) ? 1 : 0);
            void* PlayerState = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Pawn) + 0x240);
            Detail += " playerState(+0x240)=" + MpPtr(PlayerState);
            if (PlayerState && IsReadablePointer(PlayerState, 0x6B1)) {
                Detail += " playerStateLive=" + std::to_string(IsRegisteredLiveObject(PlayerState) ? 1 : 0);
            } else {
                Detail += " playerStateUnreadable=1";
            }
        } else {
            Detail += " pawnNullOrUnreadable=1";
        }
    } else {
        Detail += " pcUnreadable=1";
    }
    Detail += " sinceClientRestartMs=" + std::to_string(s_LastPossessedAtMs != 0 ? Now - s_LastPossessedAtMs : 0);
    MpLog("[PossessionChain] link missing: " + Detail);
    MpTraceClientPlayerStateGap(PC);
}

// [1.14.7 CLIENT PLAYER-STATE PROBE 2026-10-05]
// The possession trace proves exactly ONE fact: the owning client's APawn::PlayerState (+0x240) is null
// for the whole session. That single fact has two completely different meanings, and they need
// different fixes, so the trace alone cannot choose between them:
//
//   (a) the client HAS its AArchonPlayerState (reachable from the controller at +0x228) and only the
//       PAWN's replicated copy is missing  -> a property-specific replication gap;
//   (b) the client has NO APlayerState object at all -> the whole client-side player construction path
//       is absent. That path is AArchonPlayerState::PlayerRoleId (Net/RepNotify) -> OnRep_PlayerRoleId
//       -> AArchonCharacter::SetPlayerRole (dllmain.cpp:15621), and it is also what registers the
//       IArchonLoadingInterface participants the load manager polls. Measured consequence already
//       visible in the client log: the readiness poll on the client lists ONLY the bare
//       player_controller_city_bp_C once per second, while the hub lists player_state_bp_C, the
//       armour pieces, the lantern, the sword and two controllers.
//
// This reads the discriminator set. Everything here is read-only, every read is SEH-guarded by the
// SafeRead* helpers, and the GObjects census is bounded (max 8 runs, >=15s apart) because a full walk
// is expensive. Runs on the game thread from the same call site as the possession trace.
static void MpCensusClientPlayerObjects() {
    static std::atomic<int> s_censusRuns{ 0 };
    static std::atomic<uint64_t> s_censusLastMs{ 0 };

    const uint64_t NowMs = GetTickCount64();
    const uint64_t LastMs = s_censusLastMs.load(std::memory_order_relaxed);
    if (LastMs != 0 && NowMs - LastMs < 15000) return;
    if (s_censusRuns.load(std::memory_order_relaxed) >= 8) return;
    s_censusLastMs.store(NowMs, std::memory_order_relaxed);
    s_censusRuns.fetch_add(1, std::memory_order_relaxed);

    const char* Role = Globals::AmServer ? "server" : "client";
    if (!SDK::UObject::GObjects) {
        MpLog(std::string("[PSGapCensus] ") + Role + " GObjects unavailable");
        return;
    }

    const int Count = SDK::UObject::GObjects->Num();
    int PlayerStates = 0;
    int ArchonPlayerStates = 0;
    int Controllers = 0;
    int ArchonCharacters = 0;
    int LocalPlayers = 0;
    int GameStates = 0;
    std::string GameStateDetail;
    std::string Samples;
    std::string CharacterSamples;
    for (int i = 0; i < Count; i++) {
        SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
        if (!Obj || Obj->IsDefaultObject()) continue;
        if (Obj->IsA(SDK::AGameStateBase::StaticClass())) {
            ++GameStates;
            // AGameStateBase::PlayerArray is TArray<APlayerState*> at {Data +0x238, Num +0x240}.
            // The array is replicated to clients, so its count here separates "the GameState told the
            // client about the players but the actors themselves never arrived" from "the client was
            // never told about any player at all".
            if (GameStates == 1 && IsReadablePointer(Obj, 0x248)) {
                const uintptr_t Gs = reinterpret_cast<uintptr_t>(Obj);
                GameStateDetail = " gs=" + MpPtr(Obj)
                    + " gsClass=" + SafeObjectNameForDiagnostic(
                        *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Obj) + 0x10))
                    + " playerArrayNum=" + std::to_string(SafeReadI32At(Gs, 0x240))
                    + " playerArrayData=" + MpPtr(reinterpret_cast<void*>(SafeReadPtr(Gs, 0x238)));
            }
        }
        if (Obj->IsA(SDK::APlayerState::StaticClass())) {
            ++PlayerStates;
            if (PlayerStates <= 4 && IsReadablePointer(Obj, 0x40)) {
                Samples += " | ps" + std::to_string(PlayerStates) + "=" + MpPtr(Obj) + "/" + Obj->GetFullName();
            }
        }
        if (Obj->IsA(SDK::AArchonPlayerState::StaticClass())) ++ArchonPlayerStates;
        if (Obj->IsA(SDK::AArchonPlayerController::StaticClass())) ++Controllers;
        if (Obj->IsA(SDK::AArchonCharacter::StaticClass())) {
            ++ArchonCharacters;
            // [1.14.7 2026-10-08] Name each counted character so archonCharacters=2 is attributable. The
            // network roles separate the cases: the owning client's pawn is AutonomousProxy (Role 2), a
            // character replicated from the hub (e.g. a leaked phantom pawn) is SimulatedProxy (Role 1), and
            // a client-only character never sent by the server is Role 3 with RemoteRole 0.
            if (ArchonCharacters <= 4 && IsReadablePointer(Obj, 0x100)) {
                const uintptr_t A = reinterpret_cast<uintptr_t>(Obj);
                CharacterSamples += " | ch" + std::to_string(ArchonCharacters) + "=" + Obj->GetName()
                    + " role=" + std::to_string(SafeReadU8At(A, 0xF0))
                    + " remoteRole=" + std::to_string(SafeReadU8At(A, 0x5F))
                    + " dying=" + std::to_string(reinterpret_cast<SDK::AActor*>(Obj)->bActorIsBeingDestroyed ? 1 : 0)
                    + " owner=" + SafeObjectNameForDiagnostic(reinterpret_cast<void*>(SafeReadPtr(A, 0xE0)));
            }
        }
        if (Obj->IsA(SDK::ULocalPlayer::StaticClass())) ++LocalPlayers;
    }
    MpLog(std::string("[PSGapCensus] ") + Role + " objects=" + std::to_string(Count)
        + " playerStates=" + std::to_string(PlayerStates)
        + " archonPlayerStates=" + std::to_string(ArchonPlayerStates)
        + " archonControllers=" + std::to_string(Controllers)
        + " archonCharacters=" + std::to_string(ArchonCharacters)
        + " localPlayers=" + std::to_string(LocalPlayers)
        + " gameStates=" + std::to_string(GameStates)
        + " run=" + std::to_string(s_censusRuns.load()) + GameStateDetail + Samples + CharacterSamples);
}

// [1.14.7 CLIENT REPLICATION MEMBERSHIP PROBE 2026-10-05]
//
// Two independent readings now agree that the client is missing exactly the actors that reach it
// through the replication graph's GLOBAL always-relevant route, while everything routed to the OWNING
// CONNECTION or spatially does arrive:
//   client has: player_controller_city_bp_C (route = owning connection), BP_PlayerCharacter_C
//               (a correct AutonomousProxy: role=2 remoteRole=3 owner=<controller>), the whole map
//   client has NOT: APlayerState (bAlwaysRelevant, global node), AGameStateBase (same), and the
//               equipment/player-state IArchonLoadingInterface participants that hang off them.
// The hub side is healthy for both: [PlayerStateRouteGuard] reports flags58=0xA8 (bAlwaysRelevant=1),
// [PlayerStateGlobalMembership] reports persistentMember=1 in the graph's global AlwaysRelevantNode.
//
// This probe closes the loop from the other end: it reads the graph's own per-connection actor-info
// map (the same map UReplicationGraph::ServerReplicateActors fills when a connection gathers an
// actor) and reports whether it ever held the GameState and the PlayerState, plus the persistent
// membership of the global node. Read-only, game thread, bounded to 8 runs at >=5s apart.
// [1.14.7 CLIENT PLAYER-STATE FIX 2026-10-05]
//
// MEASURED ROOT CAUSE (hub [RepConnDiag], client [ClientPSGap]/[PSGapCensus]):
//
//   hub, with the client connected:
//     conns=1/4   (the graph HAS the client connection)
//     gsInGlobalNode=1   psInGlobalNode=1     (GameState and PlayerState ARE members of the graph's
//                                              global AlwaysRelevantNode)
//     conn[0] actorInfoNum=2 hasGameStateInfo=0 hasPlayerStateInfo=0
//     -> the connection's own actor-info map - the map UReplicationGraph::ServerReplicateActors fills
//        for every actor it gathers for that connection - has NEVER contained the GameState or the
//        PlayerState, while it does contain the two actors routed to the owning connection's node.
//   client, inside Ramsgate:
//     worldGameState(+0x120)=null, ctrlPlayerState(+0x228)=null, pawnPlayerState(+0x240)=null,
//     playerStates=0 gameStates=0, while the pawn is a correct replicated proxy
//     (role=2 AutonomousProxy, remoteRole=3, owner=<the controller>, replicates=1).
//
// So the actors that reach the client through the OWNING CONNECTION's node arrive, and the actors
// that are only in the graph's GLOBAL always-relevant node never do. The whole client-side player
// construction path hangs off the PlayerState (AArchonPlayerState::PlayerRoleId -> OnRep_PlayerRoleId
// -> AArchonCharacter::SetPlayerRole) and the load manager's identity gate reads
// manager+0x20 -> controller+0x228, so with no PlayerState the client's readiness poll can only ever
// list the bare controller and the native HasFinishedLoading can never become true - the observed
// [ReadinessCompat] PRESERVE_FALSE scope=client-not-allowlisted loop.
//
// The correction uses exactly the primitive this runtime already proves works for AArchonPlayerRole
// (see RoutePlayerRoleToOwningConnectionRaw above):
//     GetAlwaysRelevantNodeForConnection = RVA 0x01BDB8F0   (per-connection always-relevant node)
//     node->NotifyAddNetworkActor        = vtable +0x270
//     FNewReplicatedActorInfo            = { Actor@0, StreamingLevelName@8, Class@0x10 }
// It is reconciled on a short timer rather than only at registration time, because a PlayerState
// registered before any connection exists (the hub's own phantom) and a late-joining client both
// need the route. Called at the top of GameEngineTickHook, i.e. before the engine tick runs
// ServerReplicateActors, so it never mutates a list the graph is iterating.
// [2026-10-05] Once-per-(actor, connection) record for the opt-in actor-channel bootstrap. Kept as a
// flat table so a repeat pass can never re-open a channel that the graph is already driving.
struct MpBootstrappedPair { void* Actor; void* Connection; };
static MpBootstrappedPair s_bootstrappedPairs[32];

static bool HasBootstrappedPair(void* Actor, void* Connection) {
    for (const MpBootstrappedPair& P : s_bootstrappedPairs) {
        if (P.Actor == Actor && P.Connection == Connection) return true;
    }
    return false;
}

static void RecordBootstrappedPair(void* Actor, void* Connection) {
    for (MpBootstrappedPair& P : s_bootstrappedPairs) {
        if (P.Actor == nullptr) { P.Actor = Actor; P.Connection = Connection; return; }
    }
}

static void MpRouteBaseActorsToConnections() {
    static std::atomic<uint64_t> s_lastMs{ 0 };
    const uint64_t Now = GetTickCount64();
    const uint64_t Last = s_lastMs.load(std::memory_order_relaxed);
    if (Last != 0 && Now - Last < 2000) return;
    s_lastMs.store(Now, std::memory_order_relaxed);

    // Every early return reports itself once, so a silent run is never ambiguous about which gate it
    // stopped at (the previous build returned silently and that cost a run to diagnose).
    static std::atomic<int> s_earlyLogs{ 0 };
    const bool LogEarly = s_earlyLogs.load(std::memory_order_relaxed) < 10;
    auto Bail = [&](const char* Why, const std::string& Extra) {
        if (LogEarly && s_earlyLogs.fetch_add(1, std::memory_order_relaxed) < 10) {
            MpLog(std::string("[BaseActorRoute] bail=") + Why + Extra);
        }
    };

    if (!Globals::AmServer || !Networking::NetDriver) { Bail("no-server-or-driver", ""); return; }
    if (!IsReadablePointer(Networking::NetDriver, 0x6F0)) { Bail("driver-unreadable", ""); return; }

    void* Graph = reinterpret_cast<void*>(
        SafeReadPtr(reinterpret_cast<uintptr_t>(Networking::NetDriver), 0x6E8));
    if (!Graph || !IsReadablePointer(Graph, 0x4C8)) { Bail("no-graph", " graph=" + MpPtr(Graph)); return; }
    if (reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(Graph), 0x30))
        != reinterpret_cast<void*>(Networking::NetDriver)) { Bail("graph-driver-mismatch", ""); return; }

    const RawPointerArray* Conns = reinterpret_cast<const RawPointerArray*>(
        reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x90);
    if (!IsReadablePointer(Conns, sizeof(RawPointerArray))) { Bail("conns-unreadable", ""); return; }
    if (Conns->Num <= 0) { Bail("no-client-connections", ""); return; }
    if (!IsSanePointerArray(Conns->Data, Conns->Num, Conns->Max, 1024)) {
        Bail("conns-insane", " num=" + std::to_string(Conns->Num) + " max=" + std::to_string(Conns->Max));
        return;
    }

    // The registry actors the client cannot construct for itself: the GameState plus every
    // controller's PlayerState.
    void* Actors[8] = {};
    int NumActors = 0;
    SDK::UWorld* World = SDK::UWorld::GetWorld();
    if (World) {
        void* GameState = reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(World), 0x120));
        if (GameState) Actors[NumActors++] = GameState;
    }
    if (SDK::UObject::GObjects) {
        const int Count = SDK::UObject::GObjects->Num();
        for (int i = 0; i < Count && NumActors < 8; i++) {
            SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
            if (!Obj || Obj->IsDefaultObject()) continue;
            if (!Obj->IsA(SDK::AArchonPlayerController::StaticClass())) continue;
            void* PlayerState = reinterpret_cast<void*>(
                SafeReadPtr(reinterpret_cast<uintptr_t>(Obj), 0x228));
            if (PlayerState) Actors[NumActors++] = PlayerState;
        }
    }
    if (NumActors == 0) { Bail("no-registry-actors", ""); return; }

    typedef void* (*GetConnectionNodeFn)(void*, void*);
    const GetConnectionNodeFn GetConnectionNode =
        reinterpret_cast<GetConnectionNodeFn>(Globals::BaseAddress + 0x01BDB8F0);

    void* GlobalNode = reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(Graph), 0x4A0));
    int Added = 0;
    int Bootstrapped = 0;
    std::string Report = " globalNode=" + MpPtr(GlobalNode) + " actors=" + std::to_string(NumActors);
    for (int32_t c = 0; c < Conns->Num && c < 4; ++c) {
        void* Connection = Conns->Data[c];
        if (!Connection || !IsReadablePointer(Connection, 0x140)) {
            Report += " | conn" + std::to_string(c) + "=unreadable";
            continue;
        }

        void* Node = GetConnectionNode(Graph, Connection);
        if (!Node || !IsReadablePointer(Node, 0x68)) {
            Report += " | conn" + std::to_string(c) + "=" + MpPtr(Connection)
                + " node=" + MpPtr(Node) + " NODE_UNUSABLE";
            continue;
        }
        void** NodeVTable = *reinterpret_cast<void***>(Node);
        if (!NodeVTable || !IsReadablePointer(NodeVTable + (0x270 / 8), 8)) {
            Report += " | conn" + std::to_string(c) + " node=" + MpPtr(Node) + " NO_VTABLE";
            continue;
        }
        void* NotifyAdd = NodeVTable[0x270 / 8];
        if (!NotifyAdd) {
            Report += " | conn" + std::to_string(c) + " node=" + MpPtr(Node) + " NO_NOTIFYADD";
            continue;
        }

        Report += " | conn" + std::to_string(c) + "=" + MpPtr(Connection) + " node=" + MpPtr(Node)
            + (Node == GlobalNode ? " SAME_AS_GLOBAL" : " distinct") + " notifyAdd=" + MpAddress(NotifyAdd);
        for (int a = 0; a < NumActors; ++a) {
            void* Actor = Actors[a];
            if (!IsActorSafeForReplicationLifecycle(Actor)) {
                Report += " unsafe(" + MpPtr(Actor) + ")";
                continue;
            }

            // (1) Make the graph aware of this actor for this connection. Idempotent: the node keeps
            //     its own persistent actor list, and the membership read below is the same primitive
            //     the PlayerRole route uses. NOTE: node membership does NOT gate step (2) - measured,
            //     these actors are already members of both the global and the per-connection node and
            //     are still never put on the wire, so tying the channel bootstrap to a membership miss
            //     made it unreachable (a run logged "bootstrapped 0" for that reason).
            if (RepGraphPersistentActorListContains(Node, Actor) != 1) {
                RepGraphActorInfo112 Info{};
                Info.Actor = Actor;
                Info.StreamingLevelName = SDK::FName();
                Info.Class = reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(Actor), 0x10));
                reinterpret_cast<void(*)(void*, const RepGraphActorInfo112&)>(NotifyAdd)(Node, Info);
                ++Added;
            }

            // (2) Open the actor channel itself.
            //
            // MEASURED, and this is the part the node membership does NOT do: with the GameState and
            // every PlayerState already persistent members of BOTH the graph's global AlwaysRelevantNode
            // and this connection's node, the connection's own actor-info map (the map
            // UReplicationGraph::ServerReplicateActors fills for every actor it gathers for a connection)
            // still reported hasGameStateInfo=0 hasPlayerStateInfo=0 for the whole session, and the client
            // reported worldGameState(+0x120)=null, ctrlPlayerState(+0x228)=null and playerStates=0.
            // Graph membership alone therefore does not put these actors on the wire on this build, so use
            // the same direct bootstrap the PlayerRole route already uses - CreateChannel + SetChannelActor
            // + ReplicateActor - which is what actually emits the initial actor/net-guid bunch.
            // OPT-IN, DEFAULT OFF, and ONCE PER (actor, connection) PAIR. The first cut ran
            // unconditionally every 2 s and the hub later exited 0xC0000409, so it is not safe as a
            // repeat-every-tick default; the once-only form below also removes any channel churn. It is
            // still worth trying because membership in BOTH always-relevant nodes is measured NOT to be
            // sufficient on this build - the connection's actor-info map never receives these actors -
            // so something has to open the channel. Create ENABLE_BASE_ACTOR_BOOTSTRAP.flag next to the
            // executable to try it.
            if (!MpExeRelativeFlagPresent(L"ENABLE_BASE_ACTOR_BOOTSTRAP.flag")) continue;
            if (HasBootstrappedPair(Actor, Connection)) continue;
            // (3) ... and this is independent of (1) above. Do not reorder these.
            if (Networking::GetActorChannelIndexForConnection(
                    reinterpret_cast<AActor*>(Actor),
                    reinterpret_cast<UNetConnection*>(Connection)) == 1) {
                Report += " chan(" + MpPtr(Actor) + ")";
                continue;
            }
            Networking::ActorChannelPushDiag PushDiag{};
            const int Pushed = Networking::BootstrapActorChannel(
                reinterpret_cast<AActor*>(Actor), reinterpret_cast<UNetConnection*>(Connection), &PushDiag);
            RecordBootstrappedPair(Actor, Connection);
            ++Bootstrapped;
            Report += " push(" + MpPtr(Actor) + " r=" + std::to_string(Pushed)
                + " existing=" + std::to_string(PushDiag.ExistingChannel ? 1 : 0)
                + " wrote=" + std::to_string(PushDiag.WroteData ? 1 : 0)
                + " blocked=" + std::to_string(PushDiag.Blocked() ? 1 : 0) + ")";
        }
    }

    static std::atomic<int> s_pushLogs{ 0 };
    if (Bootstrapped > 0 && s_pushLogs.fetch_add(1, std::memory_order_relaxed) < 20) {
        MpLog("[BaseActorRoute] bootstrapped " + std::to_string(Bootstrapped)
            + " actor channel(s) for the player-registry actors:" + Report);
    }

    static std::atomic<int> s_logs{ 0 };
    if (s_logs.fetch_add(1, std::memory_order_relaxed) < 6) {
        MpLog("[BaseActorRoute] added=" + std::to_string(Added) + Report);
    }
}

static void MpReportReplicationMembership() {
    static std::atomic<int> s_runs{ 0 };
    static std::atomic<uint64_t> s_lastMs{ 0 };
    const uint64_t Now = GetTickCount64();
    const uint64_t Last = s_lastMs.load(std::memory_order_relaxed);
    if (Last != 0 && Now - Last < 5000) return;
    if (s_runs.load(std::memory_order_relaxed) >= 60) return;   // ~5 min: must cover the client join
    // Boot runs are informative (graph state before any connection); after that only report while a
    // client is actually connected, so the log stays bounded and every line is about a real client.
    const int32_t LiveClients = Networking::NetDriver
        ? SafeReadI32At(reinterpret_cast<uintptr_t>(Networking::NetDriver), 0x98) : 0;
    if (s_runs.load(std::memory_order_relaxed) >= 3 && LiveClients <= 0) return;
    s_lastMs.store(Now, std::memory_order_relaxed);
    s_runs.fetch_add(1, std::memory_order_relaxed);

    if (!Networking::NetDriver) { MpLog("[RepConnDiag] no NetDriver"); return; }
    void* Graph = reinterpret_cast<void*>(
        SafeReadPtr(reinterpret_cast<uintptr_t>(Networking::NetDriver), 0x6E8));
    if (!Graph) { MpLog("[RepConnDiag] the NetDriver has no replication graph"); return; }

    const uintptr_t G = reinterpret_cast<uintptr_t>(Graph);
    const uintptr_t ConnData = SafeReadPtr(G, 0x38);
    const int32_t ConnNum = SafeReadI32At(G, 0x40);
    const int32_t ConnMax = SafeReadI32At(G, 0x44);
    void* GlobalNode = reinterpret_cast<void*>(SafeReadPtr(G, 0x4A0));

    SDK::UWorld* World = SDK::UWorld::GetWorld();
    void* GameState = World
        ? reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(World), 0x120)) : nullptr;

    void* FirstPlayerState = nullptr;
    std::string Controllers;
    int Seen = 0;
    if (SDK::UObject::GObjects) {
        const int Count = SDK::UObject::GObjects->Num();
        for (int i = 0; i < Count && Seen < 4; i++) {
            SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
            if (!Obj || Obj->IsDefaultObject()) continue;
            if (!Obj->IsA(SDK::AArchonPlayerController::StaticClass())) continue;
            void* Ps = reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(Obj), 0x228));
            if (!FirstPlayerState) FirstPlayerState = Ps;
            Controllers += " pc" + std::to_string(++Seen) + "=" + MpPtr(Obj) + "/ps=" + MpPtr(Ps);
        }
    }

    // Which function does the engine's own TickFlush dispatch replication to? It calls the NetDriver
    // vtable slot +0x2A8 unconditionally (Ghidra: FUN_143fae700), so the target address here names the
    // exact replication entry point that is live on this hub.
    void* SraTarget = nullptr;
    {
        void** Vtable = reinterpret_cast<void**>(SafeReadPtr(reinterpret_cast<uintptr_t>(Networking::NetDriver), 0x00));
        if (Vtable && IsReadablePointer(Vtable, 0x2B0)) SraTarget = Vtable[0x2A8 / 8];
    }
    MpLog("[RepConnDiag] run=" + std::to_string(s_runs.load())
        + " clientConns=" + std::to_string(LiveClients)
        + " sraTarget=" + MpAddress(SraTarget)
        + " graph=" + MpPtr(Graph)
        + " conns=" + std::to_string(ConnNum) + "/" + std::to_string(ConnMax)
        + " globalNode=" + MpPtr(GlobalNode)
        + " gameState=" + MpPtr(GameState)
        + " gsInGlobalNode=" + std::to_string(GameState ? RepGraphPersistentActorListContains(GlobalNode, GameState) : -1)
        + " firstPlayerState=" + MpPtr(FirstPlayerState)
        + " psInGlobalNode=" + std::to_string(FirstPlayerState ? RepGraphPersistentActorListContains(GlobalNode, FirstPlayerState) : -1)
        + " controllers={" + Controllers + "}");

    // [2026-10-05] Every replication-relevant field of the registry actors, so the gate that keeps them
    // out of the connection's actor-info map can be read directly instead of inferred.
    void* FieldActors[8] = {};
    int FieldActorCount = 0;
    if (GameState) FieldActors[FieldActorCount++] = GameState;
    if (FirstPlayerState) FieldActors[FieldActorCount++] = FirstPlayerState;
    if (SDK::UObject::GObjects) {
        const int Total = SDK::UObject::GObjects->Num();
        for (int i = 0; i < Total && FieldActorCount < 8; i++) {
            SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
            if (!Obj || Obj->IsDefaultObject()) continue;
            if (!Obj->IsA(SDK::AArchonPlayerController::StaticClass())) continue;
            void* Ps = reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(Obj), 0x228));
            if (!Ps) continue;
            bool Already = false;
            for (int k = 0; k < FieldActorCount; ++k) { if (FieldActors[k] == Ps) { Already = true; break; } }
            if (!Already) FieldActors[FieldActorCount++] = Ps;
        }
    }
    for (int a = 0; a < FieldActorCount; ++a) {
        void* A = FieldActors[a];
        if (!A || !IsReadablePointer(A, 0x110)) continue;
        const uintptr_t P = reinterpret_cast<uintptr_t>(A);
        MpLog("[RepFields] actor=" + MpPtr(A)
            + " class=" + SafeObjectNameForDiagnostic(reinterpret_cast<void*>(SafeReadPtr(P, 0x10)))
            + " flags58=0x" + MpHex(SafeReadU8At(P, 0x58))
            + " flags59=0x" + MpHex(SafeReadU8At(P, 0x59))
            + " bReplicates=" + std::to_string(SafeReadU8At(P, 0x5B) & 1)
            + " flags5C=0x" + MpHex(SafeReadU8At(P, 0x5C))
            + " role=" + std::to_string(SafeReadU8At(P, 0xF0))
            + " remoteRole=" + std::to_string(SafeReadU8At(P, 0x5F))
            + " netDormancy=" + std::to_string(SafeReadU8At(P, 0xF1))
            + " netUpdateFreq=" + std::to_string(*reinterpret_cast<float*>(P + 0x108))
            + " owner=" + MpPtr(reinterpret_cast<void*>(SafeReadPtr(P, 0xE0)))
            + " globalMember=" + std::to_string(RepGraphPersistentActorListContains(GlobalNode, A)));
    }

    // [2026-10-05 node vtable dump] Identify the node classes by their virtual targets. The graph's
    // global AlwaysRelevantNode and a connection's node both resolve their vtable slots to module RVAs;
    // printing them lets the gather routine be decompiled directly instead of guessed at.
    {
        void* DumpNodes[2] = { GlobalNode, nullptr };
        if (IsSanePointerArray(reinterpret_cast<void*>(ConnData), ConnNum, ConnMax, 1024) && ConnNum > 0) {
            void* Conn0 = reinterpret_cast<void**>(ConnData)[0];
            if (Conn0 && IsReadablePointer(Conn0, 0x80)) {
                DumpNodes[1] = reinterpret_cast<void*>(
                    reinterpret_cast<void*(*)(void*, void*)>(
                        Globals::BaseAddress + 0x01BDB8F0)(Graph, Conn0));
            }
        }
        for (int n = 0; n < 2; ++n) {
            void* Node = DumpNodes[n];
            if (!Node) continue;
            void** Vt = *reinterpret_cast<void***>(Node);
            if (!Vt || !IsReadablePointer(Vt, 0x2D0)) continue;
            std::string Slots;
            for (uintptr_t Off = 0x240; Off <= 0x2C8 && Slots.size() < 700; Off += 8) {
                if (!IsReadablePointer(Vt + (Off / 8), 8)) break;
                Slots += " +" + MpHex(Off) + "=" + MpAddress(Vt[Off / 8]) + ";";
            }
            MpLog(std::string("[NodeVtable] ") + (n == 0 ? "globalNode" : "connNode")
                + " node=" + MpPtr(Node) + " vtable=" + MpPtr(Vt) + Slots);
        }
    }

    if (!IsSanePointerArray(reinterpret_cast<void*>(ConnData), ConnNum, ConnMax, 1024)) {
        MpLog("[RepConnDiag] run=" + std::to_string(s_runs.load()) + " connection array unusable");
        return;
    }
    void** Conn = reinterpret_cast<void**>(ConnData);
    for (int32_t c = 0; c < ConnNum && c < 4; ++c) {
        void* ConnMgr = Conn[c];
        if (!ConnMgr || !IsReadablePointer(ConnMgr, 0xE0)) {
            MpLog("[RepConnDiag]   conn[" + std::to_string(c) + "]=unreadable");
            continue;
        }
        const uintptr_t CM = reinterpret_cast<uintptr_t>(ConnMgr);
        const int32_t InfoNum = SafeReadI32At(CM + 0x30, 0x08);
        const void* PsEntry = FirstPlayerState
            ? RepGraphMapFindValue(CM + 0x30, FirstPlayerState, 0x20) : nullptr;
        const void* GsEntry = GameState
            ? RepGraphMapFindValue(CM + 0x30, GameState, 0x20) : nullptr;
        MpLog("[RepConnDiag]   conn[" + std::to_string(c) + "]=" + MpPtr(ConnMgr)
            + " actorInfoNum=" + std::to_string(InfoNum)
            + " hasGameStateInfo=" + std::to_string(GsEntry ? 1 : 0)
            + " hasPlayerStateInfo=" + std::to_string(PsEntry ? 1 : 0));
    }
}

// [1.14.7 2026-10-05 SEND-PATH PROBE]
//
// Measured client state in Ramsgate: the PlayerController exists with its NetConnection, the pawn is a
// correct replicated proxy (replicates=1 role=2 remoteRole=3 owner=PC), and BOTH APawn::PlayerState and
// UWorld::GameState are absent - the GObjects census counts playerStates=0 gameStates=0, so this is a
// genuinely missing actor, not a stale offset. The hub holds both (bReplicates=1, bAlwaysRelevant=1,
// bNetStartup=0, netDormancy=Awake, netUpdateFreq 10.0/1.0) and the GameState reads gsInGlobalNode=1.
// Without its PlayerState the client also never derives AArchonCharacter::PlayerRole, the possession-chain
// check fails, HasFinishedLoading stays false and the client abandons the join on its fixed 120s
// "Loading timeout while joining the server".
//
// This splits the remaining space in half with one line per sample. For the first client connection it
// reports the open UChannel index of each registry actor (GetActorChannelIndexForConnection) and whether
// the replication graph's per-connection actor-info map knows the actor:
//   channel open but actor missing on the client -> the channel exists and never serializes the actor
//   no channel                                   -> the graph never gathered the actor for that connection
// It also prints the graph's connection-manager count, because a graph with zero managers cannot
// replicate anything and every routing question below it is moot.
static void MpSendPathDiag() {
    static uint64_t s_nextMs = 0;
    static int s_samples = 0;
    if (!Globals::AmServer || s_samples >= 90) return;
    if (MpProductionLogProfile()) return;   // [2026-10-11 O3] read-only [SendPath] probe
    const uint64_t Now = static_cast<uint64_t>(GetTickCount64());
    if (Now < s_nextMs) return;

    UNetDriver* Driver = Networking::NetDriver;
    if (!Driver) return;
    const RawPointerArray* Clients = reinterpret_cast<const RawPointerArray*>(
        reinterpret_cast<uintptr_t>(Driver) + 0x90);
    if (!IsReadablePointer(Clients, sizeof(RawPointerArray))
        || !IsSanePointerArray(Clients->Data, Clients->Num, Clients->Max, 1024)
        || Clients->Num <= 0) {
        return;                                  // no client joined: nothing to measure, nothing logged
    }
    s_nextMs = Now + 2000;
    ++s_samples;

    const uintptr_t D = reinterpret_cast<uintptr_t>(Driver);
    void* Graph = reinterpret_cast<void*>(SafeReadPtr(D, 0x6E8));
    void* C0 = Clients->Data[0];
    SDK::UWorld* World = SDK::UWorld::GetWorld();
    void* GameState = World
        ? reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(World), 0x120)) : nullptr;

    void* PC = nullptr;
    if (C0) {
        void* Owning = reinterpret_cast<void*>(
            SafeReadPtr(reinterpret_cast<uintptr_t>(C0), 0x98));
        if (IsRegisteredLiveObject(Owning)
            && reinterpret_cast<UObject*>(Owning)->IsA(SDK::APlayerController::StaticClass())) {
            PC = Owning;
        }
        if (!PC) {
            void* Cand = reinterpret_cast<void*>(
                SafeReadPtr(reinterpret_cast<uintptr_t>(C0), 0x30));
            if (IsRegisteredLiveObject(Cand)
                && reinterpret_cast<UObject*>(Cand)->IsA(SDK::APlayerController::StaticClass())) {
                PC = Cand;
            }
        }
    }
    void* PS = PC ? reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(PC), 0x228)) : nullptr;
    void* Pawn = PC ? reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(PC), 0x250)) : nullptr;

    const int MgrNum = Graph ? SafeReadI32At(reinterpret_cast<uintptr_t>(Graph), 0x40) : -1;

    // Where exactly does the actor get lost? UPlayer::PlayerController sits at UNetConnection+0x28 and
    // is what the graph's per-connection always-relevant gather reads (with OwningActor+0x98 as its
    // fallback); the connection's own always-relevant node is the list the graph actually walks. A
    // bOnlyRelevantToOwner actor is routed there through AActor::GetNetConnection(), so membership of
    // that node separates "never routed" from "routed but never gathered/serialized".
    void* ConnPC = C0 ? reinterpret_cast<void*>(
        SafeReadPtr(reinterpret_cast<uintptr_t>(C0), 0x28)) : nullptr;      // UPlayer::PlayerController
    void* OwningActor = C0 ? reinterpret_cast<void*>(
        SafeReadPtr(reinterpret_cast<uintptr_t>(C0), 0x98)) : nullptr;
    void* GlobalNode = Graph ? reinterpret_cast<void*>(
        SafeReadPtr(reinterpret_cast<uintptr_t>(Graph), 0x4A0)) : nullptr;
    void* ConnNode = (Graph && C0 && IsReadablePointer(C0, 0x80))
        ? reinterpret_cast<void*>(reinterpret_cast<void*(*)(void*, void*)>(
            Globals::BaseAddress + 0x01BDB8F0)(Graph, C0)) : nullptr;

    // Which PlayerState is the client's? The GameState's PlayerArray holds both (the hub always keeps
    // one local player), so print each entry with its owner and mark the one owned by the client PC.
    void* ArrData = GameState ? reinterpret_cast<void*>(
        SafeReadPtr(reinterpret_cast<uintptr_t>(GameState), 0x238)) : nullptr;
    const int ArrNum = GameState ? SafeReadI32At(reinterpret_cast<uintptr_t>(GameState), 0x240) : -1;
    std::string Arr;
    for (int i = 0; i < ArrNum && i < 3; ++i) {
        void* E = ArrData ? reinterpret_cast<void*>(
            SafeReadPtr(reinterpret_cast<uintptr_t>(ArrData), static_cast<uintptr_t>(i) * 8)) : nullptr;
        void* EOwner = E ? reinterpret_cast<void*>(
            SafeReadPtr(reinterpret_cast<uintptr_t>(E), 0xE0)) : nullptr;
        Arr += " a" + std::to_string(i) + "=" + MpPtr(E)
            + "/own=" + MpPtr(EOwner)
            + "/isPc=" + std::to_string(EOwner && EOwner == PC ? 1 : 0);
    }

    auto Chan = [C0](void* Actor) -> int {
        if (!Actor || !C0) return -1;
        return Networking::GetActorChannelIndexForConnection(
            reinterpret_cast<AActor*>(Actor), reinterpret_cast<UNetConnection*>(C0));
    };

    const int GsArrayNum = GameState
        ? SafeReadI32At(reinterpret_cast<uintptr_t>(GameState), 0x240) : -1;

    MpLog("[SendPath] n=" + std::to_string(s_samples)
        + " clients=" + std::to_string(Clients->Num)
        + " conn0=" + MpPtr(C0)
        + " state=" + std::to_string(C0 ? SafeReadI32At(reinterpret_cast<uintptr_t>(C0), 0x134) : -1)
        + " openCh=" + std::to_string(C0 ? SafeReadI32At(reinterpret_cast<uintptr_t>(C0), 0x78) : -1)
        + " graph=" + MpPtr(Graph)
        + " mgrs=" + std::to_string(MgrNum)
        + " gNodes=" + std::to_string(Graph ? SafeReadI32At(reinterpret_cast<uintptr_t>(Graph), 0xB0) : -1)
        + " connPC28=" + MpPtr(ConnPC)
        + " owningActor=" + MpPtr(OwningActor)
        + " connNode=" + MpPtr(ConnNode)
        + " inConnNode{ps=" + std::to_string((ConnNode && PS) ? RepGraphPersistentActorListContains(ConnNode, PS) : -1)
        + " gs=" + std::to_string((ConnNode && GameState) ? RepGraphPersistentActorListContains(ConnNode, GameState) : -1)
        + "}"
        + " inGlobalNode{ps=" + std::to_string((GlobalNode && PS) ? RepGraphPersistentActorListContains(GlobalNode, PS) : -1)
        + " gs=" + std::to_string((GlobalNode && GameState) ? RepGraphPersistentActorListContains(GlobalNode, GameState) : -1)
        + "}"
        + " psOwner=" + (PS ? MpPtr(reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(PS), 0xE0))) : std::string("null"))
        + " pc=" + MpPtr(PC)
        + " ps=" + (PS ? MpPtr(PS) + "/" + SafeObjectNameForDiagnostic(PS) : std::string("null"))
        + " gs=" + (GameState ? MpPtr(GameState) + "/" + SafeObjectNameForDiagnostic(GameState) : std::string("null"))
        + " pawn=" + MpPtr(Pawn)
        + " ch{pc=" + std::to_string(Chan(PC))
        + " ps=" + std::to_string(Chan(PS))
        + " gs=" + std::to_string(Chan(GameState))
        + " pawn=" + std::to_string(Chan(Pawn)) + "}"
        + " gsPlayerArray=" + std::to_string(GsArrayNum) + "{" + Arr + "}"
        + " world=" + MpPtr(World));
}

// [1.14.7 2026-10-10] Without the phantom local player (see InitServerHooks) a server waits in WaitingToStart until
// the first real login starts the match. On the Training Grounds and dedicated hunts that login then misses its spawn
// (HandleStartingNewPlayer saw WaitingToStart) and the player waits for the GameMode's 60 s retry (10 Oct: 61 s from
// PostLogin to possession on Training and on a hunt; 1.2 s on Ramsgate). The phantom's own login used to start the match
// at boot, so a joining player found it InProgress and spawned at once (1.4 s on the 0.2.102 hunt). Starting at boot
// instead is wrong: Training ends a match that starts with no player (0.2.104, 00:41:30: WaitingToStart ->
// WaitingPostMatch). So the K2_PostLogin hook calls this for the first player, before HandleStartingNewPlayer, while
// the match is still WaitingToStart (NumPlayers is already 1 there; Training kept that match InProgress after the
// player left). AGameMode::StartMatch is a reflected UFunction (called by name, no RVA). Once per GameMode.
static void MpStartMatchWithoutPhantom(void* GameMode) {
    static void* s_started = nullptr;
    if (!GameMode || GameMode == s_started || !IsRegisteredLiveObject(GameMode)) return;
    static UFunction* s_fn = nullptr;
    static bool s_tried = false;
    if (!s_tried) {
        s_tried = true;
        UClass* GameModeClass = SDK::AGameMode::StaticClass();
        s_fn = GameModeClass ? GameModeClass->GetFunction("GameMode", "StartMatch") : nullptr;
        MpLog(std::string("[NoLocalPlayer] GameMode.StartMatch ") + (s_fn ? "resolved" : "NOT FOUND - match starts at the first login"));
    }
    if (!s_fn) return;
    s_started = GameMode;
    const bool Ok = SafeProcessEventRaw(reinterpret_cast<UObject*>(GameMode), s_fn, nullptr);
    MpLog(std::string("[NoLocalPlayer] StartMatch at the first login ") + (Ok ? "called" : "FAILED (exception)")
        + " gm=" + MpPtr(GameMode) + " class=" + SafeObjectNameForDiagnostic(GameMode));
}

static void MpTraceClientPlayerStateGap(UObject* PC) {
    std::string D = " pc=" + MpPtr(PC);

    // AController::PlayerState (+0x228, Net/RepNotify) - the pointer the client's own load manager
    // reads as manager+0x20 -> controller+0x228 and then requires a valid NetId from.
    void* CtrlPlayerState = PC ? reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(PC), 0x228)) : nullptr;
    D += " ctrlPlayerState(+0x228)=" + MpPtr(CtrlPlayerState);
    if (CtrlPlayerState) D += "/" + SafeObjectNameForDiagnostic(CtrlPlayerState);

    // APlayerController::NetConnection (+0x418) - proves this really is a network client.
    void* NetConn = PC ? reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(PC), 0x418)) : nullptr;
    D += " netConnection(+0x418)=" + MpPtr(NetConn);

    // Authoritative world/GameState pointers (UWorld::GameState @ +0x120). The census below counts
    // AGameStateBase objects by class; this reads the world's own slot, so a class-name/IsA problem in
    // the census cannot be mistaken for a genuinely absent GameState.
    SDK::UWorld* W = SDK::UWorld::GetWorld();
    D += " world=" + MpPtr(W);
    if (W) {
        void* WorldGameState = reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(W), 0x120));
        D += " worldGameState(+0x120)=" + MpPtr(WorldGameState);
        if (WorldGameState) D += "/" + SafeObjectNameForDiagnostic(WorldGameState);
    }

    void* Pawn = PC ? reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(PC), 0x250)) : nullptr;
    D += " pawn(+0x250)=" + MpPtr(Pawn);
    if (Pawn) {
        D += " pawnController(+0x258)=" + MpPtr(reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(Pawn), 0x258)));
        void* PawnPlayerState = reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(Pawn), 0x240));
        D += " pawnPlayerState(+0x240)=" + MpPtr(PawnPlayerState);
        if (PawnPlayerState) D += "/" + SafeObjectNameForDiagnostic(PawnPlayerState);
        // Replication-relevant actor state: if the client's pawn is a properly replicated
        // AutonomousProxy of the server's pawn, the PlayerState property has no excuse to be missing.
        D += " replicates=" + std::to_string(SafeReadU8At(reinterpret_cast<uintptr_t>(Pawn), 0x5B) & 1);
        D += " role=" + std::to_string(SafeReadU8At(reinterpret_cast<uintptr_t>(Pawn), 0xF0));
        D += " remoteRole=" + std::to_string(SafeReadU8At(reinterpret_cast<uintptr_t>(Pawn), 0x5F));
        D += " owner=" + MpPtr(reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(Pawn), 0xE0)));
        // AArchonCharacter::PlayerRole (+0x738) - the local construction result the game derives from
        // the replicated PlayerRoleId. Non-null here means the client's player really was built.
        D += " pawnRole(+0x738)=" + MpPtr(reinterpret_cast<void*>(SafeReadPtr(reinterpret_cast<uintptr_t>(Pawn), 0x738)));
    }
    MpLog("[ClientPSGap]" + D);
    MpCensusClientPlayerObjects();
}

static bool IsClientRolePumpPossessionStable(UObject* PC, UObject** OutPawn) {
    UObject* Pawn = nullptr;
    const uint64_t Now = GetTickCount64();
    if (!Globals::AmServer) MpForgetPossessionIfWorldChanged();
    if (!s_LastPossessedPC) {
        // Nothing tracked (no possession yet, or its world is gone): not stable, and nothing to trace -
        // the caller's PC may be the freed controller of the previous world.
        s_ClientRolePumpStablePC = nullptr;
        s_ClientRolePumpStablePawn = nullptr;
        s_ClientRolePumpStableSinceMs = 0;
        if (OutPawn) *OutPawn = nullptr;
        return false;
    }
    if (!ValidateClientPossessionChain(PC, s_LastRestartPawn, &Pawn)) {
        MpTracePossessionChainFailure(PC);
        s_ClientRolePumpStablePC = nullptr;
        s_ClientRolePumpStablePawn = nullptr;
        s_ClientRolePumpStableSinceMs = 0;
        if (OutPawn) *OutPawn = nullptr;
        return false;
    }

    if (s_ClientRolePumpStablePC != PC || s_ClientRolePumpStablePawn != Pawn) {
        s_ClientRolePumpStablePC = PC;
        s_ClientRolePumpStablePawn = Pawn;
        s_ClientRolePumpStableSinceMs = Now;
    }

    if (s_LastPossessedAtMs == 0
        || Now - s_LastPossessedAtMs < kClientRolePumpTravelSettleMs
        || Now - s_ClientRolePumpStableSinceMs < kClientRolePumpStableChainMs) {
        if (OutPawn) *OutPawn = nullptr;
        return false;
    }

    if (OutPawn) *OutPawn = Pawn;
    return true;
}

// [1.14.7 DIAG 2026-10-10] Ramsgate NPC collision. The player walks through city NPCs (user, 10 Oct); this runtime
// never changes collision anywhere, so the question is what the game data says. Read-only, client, after each
// arrival: for up to 4 city NPCs (city_interactive_npc_bp - placed interaction props, skeletal meshes, no capsule)
// every primitive component's collision mode (0 none, 1 query, 2 physics, 3 both), object type, profile and
// response to Pawn (0 ignore, 1 overlap, 2 block), plus the local capsule's response to those object types.
// A block needs both sides to answer 2.
static std::string MpPrimitiveCollisionText(SDK::UPrimitiveComponent* C) {
    return C->GetName()
        + " enabled=" + std::to_string(static_cast<int>(C->GetCollisionEnabled()))
        + " type=" + std::to_string(static_cast<int>(C->GetCollisionObjectType()))
        + " profile=" + C->GetCollisionProfileName().ToString()
        + " vsPawn=" + std::to_string(static_cast<int>(C->GetCollisionResponseToChannel(SDK::ECollisionChannel::ECC_Pawn)));
}

static void MpNpcCollisionProbe(UObject* Pawn) {
    if (Globals::AmServer || !Pawn || !UObject::GObjects) return;
    static void* s_pawn = nullptr;
    static int s_attempts = 0;
    static uint64_t s_lastTryMs = 0;
    if (s_pawn != Pawn) { s_pawn = Pawn; s_attempts = 0; s_lastTryMs = GetTickCount64(); }
    if (s_attempts >= 3) return;                                   // done for this arrival
    const uint64_t Now = GetTickCount64();
    if (Now - s_lastTryMs < 4000) return;                          // 4 s apart: NPC sublevels stream in after arrival
    s_lastTryMs = Now;
    ++s_attempts;

    UClass* NpcClass = SDK::UObject::FindClassFast("city_interactive_npc_bp_C");
    if (!NpcClass) { s_attempts = 3; return; }                     // not a map with city NPCs
    UClass* PrimitiveClass = SDK::UPrimitiveComponent::StaticClass();
    std::vector<UObject*> Npcs;
    int Total = 0;
    const int Count = UObject::GObjects->Num();
    for (int i = 0; i < Count; ++i) {
        UObject* Obj = UObject::GObjects->GetByIndex(i);
        if (!Obj || Obj->IsDefaultObject() || !MpIsAGuarded(Obj, NpcClass)) continue;
        ++Total;
        if (Npcs.size() < 4) Npcs.push_back(Obj);
    }
    if (Total == 0) return;                                        // not streamed in yet: retry
    s_attempts = 3;

    std::set<int> NpcTypes;
    MpLog("[NpcCollision] city NPCs in world=" + std::to_string(Total) + " (dumping " + std::to_string(Npcs.size()) + ")");
    for (UObject* Npc : Npcs) {
        if (!IsRegisteredLiveObject(Npc)) continue;
        auto* Actor = reinterpret_cast<SDK::AActor*>(Npc);
        MpLog("[NpcCollision] npc=" + Npc->GetName() + " actorCollision=" + std::to_string(Actor->GetActorEnableCollision() ? 1 : 0));
        SDK::TArray<SDK::UActorComponent*> Comps = Actor->K2_GetComponentsByClass(SDK::TSubclassOf<SDK::UActorComponent>(PrimitiveClass));
        for (int c = 0; c < Comps.Num(); ++c) {
            auto* Prim = reinterpret_cast<SDK::UPrimitiveComponent*>(Comps[c]);
            if (!Prim || !IsRegisteredLiveObject(Prim)) continue;
            NpcTypes.insert(static_cast<int>(Prim->GetCollisionObjectType()));
            MpLog("[NpcCollision]   " + MpPrimitiveCollisionText(Prim));
        }
    }
    if (IsRegisteredLiveObject(Pawn) && Pawn->IsA(SDK::ACharacter::StaticClass())) {
        SDK::UCapsuleComponent* Capsule = reinterpret_cast<SDK::ACharacter*>(Pawn)->CapsuleComponent;
        if (Capsule && IsRegisteredLiveObject(Capsule)) {
            std::string Responses;
            for (int Type : NpcTypes) {
                Responses += " vsType" + std::to_string(Type) + "=" + std::to_string(static_cast<int>(
                    Capsule->GetCollisionResponseToChannel(static_cast<SDK::ECollisionChannel>(Type))));
            }
            MpLog("[NpcCollision] local capsule " + MpPrimitiveCollisionText(Capsule) + Responses);
        }
    }
}

static bool RunClientRolePumpGuarded(UObject* PC, UObject* Pawn) {
    __try {
        TickControllerSplitDetector();
        TickPlayerRoleRetries();
        if (PC && !MpExeRelativeFlagPresent(L"DISABLE_CLIENT_ROLE_LIFECYCLE_REPLAY.flag")) {
            RefreshPlayerRoleGameplayLifecycle(PC, "pump");
        }
        ReconcileAirshipGameplayHUD("role-retry-pump");
        SampleRemotePawnPlayerRolesGuarded();
        TickFrankDroneClientDiag(Pawn, "periodic");
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

// [2026-07-26 AMP CLICK DIAGNOSTIC]
// HandleRelicSelected is all-or-nothing: a null GetOwningPlayer returns without sending the RPC,
// closing the screen, or restoring game input. Repro 14 proved that this is downstream of the
// server sending another PlayerController actor channel. Keep the verified PlayerContext readout
// below, but never repair or replay the client click; controller ownership is fixed at the server
// replication boundary above.

// The component/screen pair the server most recently opened a relic choice on. This is retained
// only to make the rejected-click diagnostic identify the controller that originally owned the
// screen. It never mutates the screen, controller, component, RPC, or input mode.
static void* s_relicScreenComponent = nullptr;
static void* s_relicScreenWidget = nullptr;

// Per-thread click bracket. HandleRelicSelected is not reentrant in practice, but the depth
// counter keeps the "did this click dispatch an RPC" answer correct if it ever becomes so.
static thread_local int  s_relicClickDepth = 0;
static thread_local bool s_relicClickDispatched = false;

// ---------------------------------------------------------------------------------------------
// [2026-07-25 ROOT CAUSE] UUserWidget::PlayerContext, decoded off the binary
// ---------------------------------------------------------------------------------------------
// UUserWidget::SetOwningPlayer (FUN_1437606a0, reached from execSetOwningPlayer 0x1437893d0):
//     if (PC && PC->vtable[0x6d8]() /* IsLocalPlayerController */) {
//         FLocalPlayerContext ctx(PC);          // FUN_143cf4be0
//         *(uint64*)(this + 0x2F4) = ctx[0];
//         *(uint64*)(this + 0x2FC) = ctx[1];
//     }
// and the context constructor itself:
//     ctx[0..1] = TWeakObjectPtr(PC->Player)      <- PC + 0x298, APlayerController::Player
//     ctx[2..3] = TWeakObjectPtr(PC->GetWorld())  <- PC->vtable[0x158]
//
// So the field the whole amp bug hangs on is a 16-byte FLocalPlayerContext at widget + 0x2F4:
//     +0x2F4 WeakLocalPlayer.ObjectIndex   +0x2F8 WeakLocalPlayer.ObjectSerialNumber
//     +0x2FC WeakWorld.ObjectIndex         +0x300 WeakWorld.ObjectSerialNumber
// GetOwningPlayer (vtable+0x2a0) is PlayerContext.IsValid() ? GetPlayerController() : nullptr,
// and IsValid() requires the LocalPlayer weak ptr, the World weak ptr AND
// LocalPlayer->PlayerController (UPlayer::PlayerController @ +0x30) to all resolve.
//
// Two consequences, both of which we needed:
//   1. The previous repair used SetOwningPlayer, whose write is GATED on IsLocalPlayerController().
//      Repro 11 logged owningPlayerNowValid=0 - the call was a no-op. Rebuilding the context
//      directly, exactly as FLocalPlayerContext(PC) does, has no such gate.
//   2. We can finally read the three sub-terms instead of only their collapsed result, so one
//      repro names which of LocalPlayer / World / LocalPlayer->PlayerController goes bad.
static constexpr uintptr_t kUserWidgetPlayerContextOffset = 0x2F4;

// Resolve a TWeakObjectPtr's index through GObjects.
//
// [2026-07-25 CORRECTION] The first cut resolved by index alone and never checked what came back.
// That is exactly the mistake TWeakObjectPtr's {index, serial} pair exists to prevent: a recycled
// slot resolves happily and yields an unrelated object. Repro 12's controller-split reading rests
// on this resolver, so it now verifies:
//   - the object round-trips (GetByIndex(obj->Index) == obj), i.e. it really owns that slot, and
//   - it is of the class the caller expected.
// Anything else returns null rather than a plausible-looking lie. ExpectedClass may be null to
// skip only the class half.
static void* ResolveWeakObjectIndexChecked(int32_t Index, UClass* ExpectedClass) {
    __try {
        if (Index < 0 || !SDK::UObject::GObjects) return nullptr;
        UObject* Obj = SDK::UObject::GObjects->GetByIndex(Index);
        if (!Obj || !IsReadablePointer(Obj, 0x30)) return nullptr;
        if (!IsRegisteredLiveObject(Obj)) return nullptr;          // slot round-trip
        if (ExpectedClass && !Obj->IsA(ExpectedClass)) return nullptr;   // recycled into another type
        return reinterpret_cast<void*>(Obj);
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return nullptr;
    }
}

// Class + name of a pointer we are not sure about, for the diagnostic lines below. Anything that
// fails liveness reports as <dead> rather than being dereferenced for a name.
static std::string DescribeSuspectObject(void* Ptr) {
    if (!Ptr) return "null";
    if (!IsReadablePointer(Ptr, 0x30) || !IsRegisteredLiveObject(Ptr)) return MpPtr(Ptr) + "/<dead>";
    UObject* Obj = reinterpret_cast<UObject*>(Ptr);
    std::string Out = MpPtr(Ptr) + "/" + SafeObjectNameForDiagnostic(Obj);
    if (Obj->Class && IsReadablePointer(Obj->Class, 0x30)) {
        Out += "[" + SafeObjectNameForDiagnostic(reinterpret_cast<UObject*>(Obj->Class)) + "]";
    }
    return Out;
}

// Object is the UPlayerEscalationComponent, Parms->arg0 the UEscalationRelicChoiceScreen it just
// opened. This server-authored pairing is used only for the read-only context diagnostic.
static void NoteRelicChoiceScreenOpened(UObject* Component, void* Parms) {
    if (!Component || !Parms || !IsReadablePointer(Parms, 0x8)) return;
    void* Screen = *reinterpret_cast<void**>(Parms);
    if (!Screen) return;
    s_relicScreenComponent = Component;
    s_relicScreenWidget = Screen;
    MpLog("[RelicClickDiagnostic] armed component=" + MpPtr(Component)
        + " screen=" + MpPtr(Screen));
}

// Called after HandleRelicSelected returns without dispatching ServerSelectRelicOption. Read-only:
// this deliberately does not replay the click, rewrite PlayerContext, force the RPC, close the
// screen, or restore input. Those old recovery actions preserved the invalid ownership graph.
static void LogRejectedRelicClick(UObject* Screen, void* Parms) {
    if (!Screen || !OrigProcessEventClient) return;

    static std::atomic<int> s_relicDiagnosticCount{ 0 };
    const int Seq = s_relicDiagnosticCount.fetch_add(1, std::memory_order_relaxed);
    if (Seq >= 64) return;

    void* InRelic = (Parms && IsReadablePointer(Parms, 0x8))
        ? *reinterpret_cast<void**>(Parms) : nullptr;

    // --- 1. Record why the game refused. This is the evidence the previous repro could not
    //        capture, and it is emitted whether or not the recovery below succeeds. ---
    void* Owner = SafeCallWidgetGetOwningPlayer(Screen);
    const bool OwnerIsArchonPC = Owner && reinterpret_cast<UObject*>(Owner)->IsA(
        SDK::AArchonPlayerController::StaticClass());
    const bool OwnerWeakReadable = Owner && IsReadablePointer(Owner, 0xAF0);
    const int WeakIndex = OwnerWeakReadable
        ? SafeReadI32At(reinterpret_cast<uintptr_t>(Owner), 0xAE8) : INT_MIN;
    const int WeakSerial = OwnerWeakReadable
        ? SafeReadI32At(reinterpret_cast<uintptr_t>(Owner), 0xAEC) : INT_MIN;
    const char* FailedTerm =
          !InRelic          ? "InRelic(null)"
        : !Owner            ? "term1:GetOwningPlayer==null"
        : !OwnerIsArchonPC  ? "term2:!IsA(AArchonPlayerController)"
        : !OwnerWeakReadable? "term3:PC+0xAE8 unreadable"
        : (WeakIndex <= 0)  ? "term3:PC+0xAE8 weak ptr unset"
        :                     "term3:PC+0xAE8 index set but weak ptr resolved null (stale serial)";

    MpLog("[RelicClickDiagnostic] seq=" + std::to_string(Seq)
        + " REJECTED screen=" + MpPtr(Screen)
        + " inRelic=" + MpPtr(InRelic)
        + " owningPlayer=" + MpPtr(Owner)
        + " ownerIsArchonPC=" + std::to_string(OwnerIsArchonPC ? 1 : 0)
        + " weakEscCompIndex=" + std::to_string(WeakIndex)
        + " weakEscCompSerial=" + std::to_string(WeakSerial)
        + " failedTerm=" + FailedTerm);

    UObject* Component = (s_relicScreenWidget == static_cast<void*>(Screen))
        ? reinterpret_cast<UObject*>(s_relicScreenComponent) : nullptr;
    UObject* OwnerPC = (Component && IsRegisteredLiveObject(Component)
        && IsReadablePointer(Component, 0x30)) ? Component->Outer : nullptr;

    const uintptr_t W = reinterpret_cast<uintptr_t>(Screen);
    const int32_t LpIndex   = SafeReadI32At(W, kUserWidgetPlayerContextOffset + 0x0);
    const int32_t LpSerial  = SafeReadI32At(W, kUserWidgetPlayerContextOffset + 0x4);
    const int32_t WldIndex  = SafeReadI32At(W, kUserWidgetPlayerContextOffset + 0x8);
    const int32_t WldSerial = SafeReadI32At(W, kUserWidgetPlayerContextOffset + 0xC);
    void* LocalPlayer = ResolveWeakObjectIndexChecked(
        LpIndex, SDK::ULocalPlayer::StaticClass());
    void* ContextWorld = ResolveWeakObjectIndexChecked(
        WldIndex, SDK::UWorld::StaticClass());
    void* LpController = (LocalPlayer && IsReadablePointer(LocalPlayer, 0x38))
        ? *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(LocalPlayer) + 0x30) : nullptr;
    void* LivePcPlayer = (OwnerPC && IsReadablePointer(OwnerPC, 0x2A0))
        ? *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(OwnerPC) + 0x298) : nullptr;

    MpLog("[RelicClickDiagnostic] seq=" + std::to_string(Seq)
        + " playerContext@0x2F4 lpIndex=" + std::to_string(LpIndex)
        + " lpSerial=" + std::to_string(LpSerial)
        + " lpResolved=" + DescribeSuspectObject(LocalPlayer)
        + " worldIndex=" + std::to_string(WldIndex)
        + " worldSerial=" + std::to_string(WldSerial)
        + " worldResolved=" + DescribeSuspectObject(ContextWorld)
        + " localPlayer->PlayerController=" + DescribeSuspectObject(LpController)
        + " livePC=" + DescribeSuspectObject(OwnerPC)
        + " livePC->Player=" + DescribeSuspectObject(LivePcPlayer)
        + " controllersMatch="
        + std::to_string(LpController == static_cast<void*>(OwnerPC) ? 1 : 0)
        + " deadTerm=" + (LpIndex < 0 || !LocalPlayer
            ? "WeakLocalPlayer(or recycled slot)"
            : (WldIndex < 0 || !ContextWorld
                ? "WeakWorld(or recycled slot)"
                : (!LpController
                    ? "LocalPlayer->PlayerController"
                    : (LpController != static_cast<void*>(OwnerPC)
                        ? "controller-split"
                        : "none(all resolve, controllers match)"))))
        + " action=LOG_ONLY");
    return;

}

// [1.14.7 DIAG 2026-10-08] Client hitch sampler - HITCH_SAMPLER.flag beside the exe, client only. The bounty
// board (U) freezes the client 1-3 s on open and close, no backend call is slow and the module log is quiet, so
// this records WHERE the game thread is. On each U or Escape press it samples the game thread every 100 ms for
// 3 s. While the thread is suspended it only copies the context and the top of its stack (ReadProcessMemory is
// a kernel read - no user-mode lock the suspended thread could hold); decoding and logging happen after
// ResumeThread. Each line: the RIP, the image-.text return addresses found on the stack (heuristic chain), and
// how many client ProcessEvent calls ran since the previous sample.
static std::atomic<uint32_t> g_clientGameThreadId{ 0 };
static std::atomic<uint64_t> g_clientProcessEventCount{ 0 };

static void MpHitchSampleOnce(HANDLE Thread, int Episode, int Sample, uint64_t StartMs, uint64_t& LastPeCount) {
    static uint8_t s_stack[0x3000];
    CONTEXT Ctx{};
    Ctx.ContextFlags = CONTEXT_CONTROL | CONTEXT_INTEGER;
    SIZE_T Copied = 0;
    bool Got = false;
    if (SuspendThread(Thread) == static_cast<DWORD>(-1)) return;
    if (GetThreadContext(Thread, &Ctx)) {
        Got = true;
        for (SIZE_T Want = sizeof(s_stack); Want >= 0x200 && Copied == 0; Want /= 2) {
            SIZE_T Read = 0;
            if (ReadProcessMemory(GetCurrentProcess(), reinterpret_cast<LPCVOID>(Ctx.Rsp), s_stack, Want, &Read)) Copied = Read;
        }
    }
    ResumeThread(Thread);
    if (!Got) return;

    uint64_t TextLo = 0, TextHi = 0;
    if (Globals::BaseAddress) {
        const auto* Dos = reinterpret_cast<const IMAGE_DOS_HEADER*>(Globals::BaseAddress);
        const auto* Nt = reinterpret_cast<const IMAGE_NT_HEADERS*>(Globals::BaseAddress + Dos->e_lfanew);
        const auto* Sec = IMAGE_FIRST_SECTION(Nt);
        for (int i = 0; i < Nt->FileHeader.NumberOfSections; ++i) {
            if (std::memcmp(Sec[i].Name, ".text", 5) == 0) {
                TextLo = Globals::BaseAddress + Sec[i].VirtualAddress;
                TextHi = TextLo + Sec[i].Misc.VirtualSize;
                break;
            }
        }
    }
    const uint64_t PeNow = g_clientProcessEventCount.load(std::memory_order_relaxed);
    std::string Line = "[HitchSample] ep" + std::to_string(Episode) + "." + std::to_string(Sample)
        + " t+" + std::to_string(GetTickCount64() - StartMs) + "ms pe+" + std::to_string(PeNow - LastPeCount)
        + " rip=" + MpAddress(reinterpret_cast<void*>(Ctx.Rip)) + " ret:";
    LastPeCount = PeNow;
    int Found = 0;
    for (SIZE_T Off = 0; Off + 8 <= Copied && Found < 24; Off += 8) {
        const uint64_t Value = *reinterpret_cast<const uint64_t*>(s_stack + Off);
        if (TextLo && Value >= TextLo && Value < TextHi) {
            Line += " " + MpHex(static_cast<uintptr_t>(Value - Globals::BaseAddress));
            ++Found;
        }
    }
    MpLog(Line);
}

static void StartClientHitchSampler() {
    if (!MpExeRelativeFlagPresent(L"HITCH_SAMPLER.flag")) return;
    std::thread([] {
        MpLog("[HitchSample] armed (HITCH_SAMPLER.flag): a U or Escape press samples the game thread every 100 ms for 3 s");
        bool WasDown = false;
        int Episodes = 0;
        for (;;) {
            Sleep(15);
            const bool Down = (GetAsyncKeyState('U') & 0x8000) != 0 || (GetAsyncKeyState(VK_ESCAPE) & 0x8000) != 0;
            if (Down && !WasDown && Episodes < 16) {
                ++Episodes;
                const uint32_t Tid = g_clientGameThreadId.load(std::memory_order_relaxed);
                HANDLE Thread = Tid ? OpenThread(THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION, FALSE, Tid) : nullptr;
                if (!Thread) {
                    MpLog("[HitchSample] ep" + std::to_string(Episodes) + " game thread not available (tid=" + std::to_string(Tid) + ")");
                } else {
                    const uint64_t StartMs = GetTickCount64();
                    uint64_t LastPe = g_clientProcessEventCount.load(std::memory_order_relaxed);
                    for (int i = 0; i < 30; ++i) {
                        MpHitchSampleOnce(Thread, Episodes, i, StartMs, LastPe);
                        Sleep(100);
                    }
                    CloseHandle(Thread);
                    MpLog("[HitchSample] ep" + std::to_string(Episodes) + " done");
                }
            }
            WasDown = Down;
        }
    }).detach();
}

// [1.14.7 2026-10-08] The client hook used to build Function->GetFullName() (outer-chain walk, FName
// conversions, allocations) on EVERY ProcessEvent before ~40 substring tests. Opening the bounty board (U)
// pushes tens of thousands of UFunction calls through here, which showed as a 1-2 s hitch on open and close.
// The name is now built once per UFunction and cached, keyed by address and validated by the object's
// GUObjectArray index and FName, so a recycled address recomputes instead of returning a stale name.
// [2026-10-10 1.14.7 CPU] Also validated by Outer (+0x20), which only makes the cache more conservative, and now
// shared with the server ProcessEventHook (PE_FULLNAME_UNCACHED.flag reverts the server to a per-call build).
// Entries are only ever added or rewritten in place for a different object - never erased - so the reference
// a caller holds stays valid across the nested ProcessEvent calls its own OrigProcessEventClient makes.
// [2026-10-11 1.14.7 O3] The entry also carries the server hook's per-UFunction category mask (MpPeCategoryMask), computed
// the first time the server asks and recomputed whenever the name is.
struct MpFunctionNameCacheEntry {
    int32_t Index; int32_t NameIndex; uint32_t NameNumber; const void* Outer; std::string Name;
    uint64_t PeMask; bool PeMaskValid;
    int8_t TravelSkip;   // [2026-10-16 0.2.142] TravelCause: -1 unknown, 1 = a per-frame function the history leaves out
};
static MpFunctionNameCacheEntry& CachedFunctionNameEntry(UFunction* Function) {
    static thread_local std::unordered_map<const void*, MpFunctionNameCacheEntry> s_names;
    auto It = s_names.find(Function);
    if (It != s_names.end() && It->second.Index == Function->Index
        && It->second.NameIndex == Function->Name.ComparisonIndex && It->second.NameNumber == Function->Name.Number
        && It->second.Outer == Function->Outer) {
        return It->second;
    }
    MpFunctionNameCacheEntry& Slot = s_names[Function];
    Slot.Index = Function->Index;
    Slot.NameIndex = Function->Name.ComparisonIndex;
    Slot.NameNumber = Function->Name.Number;
    Slot.Outer = Function->Outer;
    Slot.Name = Function->GetFullName();
    Slot.PeMask = 0;
    Slot.PeMaskValid = false;
    Slot.TravelSkip = -1;
    return Slot;
}

static const std::string& CachedFunctionFullName(UFunction* Function) {
    static const std::string s_null = "null";
    if (!Function) return s_null;
    return CachedFunctionNameEntry(Function).Name;
}

// [2026-10-16 0.2.141] Client diagnostic, read-only: which game code shows the Gauntlet panel on the hunt map. Gauntlet is
// refused by the backend (GAUNTLET_DISABLED) but its panel still shows, fed by the season stub the client needs to finish
// loading player data (routes/system.ts). Ghidra shows no server-side switch for it and its season loader sits in unanalyzed
// code, so this records the UFunctions that pass ProcessEvent around the panel before anything hides it: the first
// GAUNTLET_CENSUS_BUDGET distinct (function, object class) pairs whose function name, object class name or object name
// mentions "auntlet", with the object, its outer, and the first bytes of the parameters before and after the call (the return
// value lies within them; only UStruct::Size at +0x58 is read). Client only; GAUNTLET_CENSUS_OFF.flag disables it; once the
// budget is used, every call costs one atomic read.
namespace GauntletCensus {
    static constexpr int kBudget = 220;
    static constexpr int kParmBytes = 32;
    static std::atomic<int> s_logged{ 0 };
    static int s_enabled = -1;
    static SRWLOCK s_seenLock = SRWLOCK_INIT;

    static bool Active() {
        if (s_enabled < 0) {
            s_enabled = (Globals::AmServer || MpExeRelativeFlagPresent(L"GAUNTLET_CENSUS_OFF.flag")) ? 0 : 1;
            if (!Globals::AmServer) {
                MpLog(std::string("[GauntletCensus] ") + (s_enabled ? "ENABLED (budget " + std::to_string(kBudget) + " lines)"
                    : "disabled (GAUNTLET_CENSUS_OFF.flag)"));
            }
        }
        return s_enabled == 1 && s_logged.load(std::memory_order_relaxed) < kBudget;
    }

    static bool Mentions(const std::string& Text) { return Text.find("auntlet") != std::string::npos; }

    // Once per class / per FName index, per thread (ProcessEvent can run off the game thread); bounded.
    static bool ClassMentions(UObject* Object) {
        thread_local std::unordered_map<const void*, bool> s_classes;
        void* Class = Object ? reinterpret_cast<void*>(Object->Class) : nullptr;
        if (!Class) return false;
        const auto Found = s_classes.find(Class);
        if (Found != s_classes.end()) return Found->second;
        if (s_classes.size() > 20000) s_classes.clear();
        return s_classes[Class] = Mentions(SafeObjectNameForDiagnostic(Class));
    }

    static bool NameMentions(UObject* Object) {
        thread_local std::unordered_map<int32_t, bool> s_names;
        if (!Object) return false;
        const int32_t Index = Object->Name.ComparisonIndex;
        const auto Found = s_names.find(Index);
        if (Found != s_names.end()) return Found->second;
        if (s_names.size() > 50000) s_names.clear();
        return s_names[Index] = Mentions(SafeObjectNameForDiagnostic(Object));
    }

    static std::string ParmBytes(UFunction* Function, void* Parms) {
        if (!Function || !Parms) return "-";
        const int32_t Size = Function->Size;
        if (Size <= 0 || Size > 0x10000) return "-";
        const int Count = Size < kParmBytes ? Size : kParmBytes;
        if (!IsReadablePointer(Parms, Count)) return "?";
        static const char* const kHex = "0123456789abcdef";
        std::string Out;
        const auto* Bytes = static_cast<const uint8_t*>(Parms);
        for (int i = 0; i < Count; ++i) {
            Out += kHex[Bytes[i] >> 4];
            Out += kHex[Bytes[i] & 15];
        }
        return Out + (Size > Count ? "+" : "") + "/" + std::to_string(Size);
    }

    // Returns the line number when this call is logged (pass it to Exit), else -1.
    static int Enter(UObject* Object, UFunction* Function, const std::string& FunctionName, void* Parms) {
        if (!Active()) return -1;
        if (!Mentions(FunctionName) && !ClassMentions(Object) && !NameMentions(Object)) return -1;
        const std::string ClassName = Object && Object->Class ? SafeObjectNameForDiagnostic(Object->Class) : "null";
        {
            static std::unordered_set<std::string> s_seen;
            AcquireSRWLockExclusive(&s_seenLock);
            const bool Fresh = s_seen.size() < 4096 && s_seen.insert(FunctionName + "|" + ClassName).second;
            ReleaseSRWLockExclusive(&s_seenLock);
            if (!Fresh) return -1;
        }
        const int Seq = s_logged.fetch_add(1, std::memory_order_relaxed);
        if (Seq >= kBudget) return -1;
        UObject* Outer = Object ? Object->Outer : nullptr;
        MpLog("[GauntletCensus] #" + std::to_string(Seq) + " ENTER fn=" + FunctionName
            + " obj=" + (Object ? SafeObjectNameForDiagnostic(Object) : std::string("null")) + " class=" + ClassName
            + " outer=" + (Outer ? SafeObjectNameForDiagnostic(Outer) : std::string("null"))
            + " parms=" + ParmBytes(Function, Parms));
        return Seq;
    }

    static void Exit(int Seq, UFunction* Function, void* Parms) {
        if (Seq < 0 || !Parms) return;
        MpLog("[GauntletCensus] #" + std::to_string(Seq) + " EXIT parms=" + ParmBytes(Function, Parms));
    }
}

// [2026-10-16 0.2.142] Client diagnostic, read-only: what sends the client back to the login screen. A player at the hidden
// ExperienceTrack_PlayerLevel rank 20 returns to Map_LoginMenu ~1 s after reaching a realm's Ramsgate, with no error; the hub
// never sends a return-to-menu (EnqueueDisconnectError never fires), so the client queues the travel itself.
// Records:
//  - a history of the client's game-thread ProcessEvent calls (function full name, nesting depth, time), per-frame functions left out;
//  - after each call, whether FWorldContext.TravelURL (+0xB8 FString, +0xC0 its Num; +0xC8 TravelType - UEngine::TickWorldTravel
//    reads exactly these before Browse, 0x14427D6E0) became set: "[TravelCause] QUEUED" names the call during which it happened,
//    the active call chain and the URL;
//  - on LoadMap of Map_LoginMenu from a play map, and on a queued travel whose URL looks like a return to the menu, the last
//    kDumpLines history entries.
// The world context is the one LoadMap is given (EngineLoadMapDetour). Client only; TRAVEL_CAUSE_OFF.flag disables it.
static std::string MpFStringAt(const void* Base, uintptr_t Offset);   // defined with the LoadMap probe

namespace TravelCause {
    struct Entry { uint64_t Ms; const std::string* Name; uint8_t Depth; };
    static constexpr int kRing = 2048;
    static constexpr int kDumpLines = 160;
    static Entry s_ring[kRing];
    static int s_next = 0;
    static int s_filled = 0;
    static int s_enabled = -1;
    static std::atomic<uintptr_t> s_worldContext{ 0 };
    static std::atomic<int> s_queuedReports{ 0 };
    static std::atomic<int> s_dumps{ 0 };
    static bool s_reportedCurrent = false;
    static thread_local std::vector<const std::string*> t_stack;

    static bool Active() {
        if (s_enabled < 0) {
            s_enabled = (Globals::AmServer || MpExeRelativeFlagPresent(L"TRAVEL_CAUSE_OFF.flag")) ? 0 : 1;
            if (!Globals::AmServer) {
                MpLog(std::string("[TravelCause] ") + (s_enabled ? "ENABLED (history " + std::to_string(kRing) + ", dump "
                    + std::to_string(kDumpLines) + ")" : "disabled (TRAVEL_CAUSE_OFF.flag)"));
            }
        }
        return s_enabled == 1;
    }

    static bool OnGameThread() {
        const DWORD Game = g_clientGameThreadId.load(std::memory_order_relaxed);
        return Game != 0 && Game == GetCurrentThreadId();
    }

    static bool Skip(MpFunctionNameCacheEntry& Entry) {
        if (Entry.TravelSkip < 0) {
            const std::string& N = Entry.Name;
            Entry.TravelSkip = (N.find("Tick") != std::string::npos || N.find("UpdateAnimation") != std::string::npos
                || N.find("AnimGraph") != std::string::npos || N.find("BlueprintThreadSafe") != std::string::npos) ? 1 : 0;
        }
        return Entry.TravelSkip == 1;
    }

    static void SetWorldContext(void* Context) {
        if (!Context || !IsReadablePointer(Context, 0xD0)) return;
        s_worldContext.store(reinterpret_cast<uintptr_t>(Context), std::memory_order_relaxed);
    }

    static int32_t TravelUrlNum() {
        const uintptr_t Context = s_worldContext.load(std::memory_order_relaxed);
        return Context ? *reinterpret_cast<volatile const int32_t*>(Context + 0xC0) : 0;
    }

    // [2026-10-16 0.2.143] Option VALUES are never logged: a server travel URL carries the session's EncryptionToken (a bearer
    // token, logged in clear by 0.2.142). Keeps the address/map before the first '?' and each option's name.
    static std::string RedactUrl(const std::string& Url) {
        const size_t Query = Url.find('?');
        if (Query == std::string::npos) return Url;
        std::string Out = Url.substr(0, Query);
        size_t At = Query;
        while (At != std::string::npos && At < Url.size()) {
            const size_t Next = Url.find('?', At + 1);
            const std::string Option = Url.substr(At + 1, Next == std::string::npos ? std::string::npos : Next - At - 1);
            const size_t Equals = Option.find('=');
            Out += "?" + (Equals == std::string::npos ? Option.substr(0, 32) : Option.substr(0, Equals < 32 ? Equals : 32) + "=<redacted>");
            At = Next;
        }
        return Out;
    }

    static std::string TravelUrl() {
        const uintptr_t Context = s_worldContext.load(std::memory_order_relaxed);
        if (!Context) return "?";
        std::string Url = RedactUrl(MpFStringAt(reinterpret_cast<const void*>(Context), 0xB8));
        return Url + " type=" + std::to_string(*reinterpret_cast<volatile const uint8_t*>(Context + 0xC8));
    }

    static void Dump(const char* Reason) {
        if (s_dumps.fetch_add(1, std::memory_order_relaxed) >= 4) return;
        const uint64_t Now = GetTickCount64();
        const int Count = s_filled < kDumpLines ? s_filled : kDumpLines;
        MpLog(std::string("[TravelCause] HISTORY reason=") + Reason + " last=" + std::to_string(Count) + " (oldest first)");
        for (int i = Count; i >= 1; --i) {
            const Entry& E = s_ring[(s_next - i + kRing) % kRing];
            MpLog("[TravelCause]   -" + std::to_string(Now - E.Ms) + "ms d=" + std::to_string(E.Depth) + " "
                + (E.Name ? *E.Name : std::string("null")));
        }
        MpLog("[TravelCause] HISTORY end");
    }

    // Before the original ProcessEvent: history + call chain. Returns TravelURL's Num before the call (-1 = not tracked).
    static int32_t Before(MpFunctionNameCacheEntry* NameEntry) {
        if (!NameEntry || !Active() || !OnGameThread()) return -1;
        if (!Skip(*NameEntry)) {
            s_ring[s_next] = { GetTickCount64(), &NameEntry->Name, static_cast<uint8_t>(t_stack.size() > 255 ? 255 : t_stack.size()) };
            s_next = (s_next + 1) % kRing;
            if (s_filled < kRing) ++s_filled;
        }
        t_stack.push_back(&NameEntry->Name);
        return TravelUrlNum();
    }

    // After it: report the first call during which (or before which) a travel was queued.
    static void After(MpFunctionNameCacheEntry* NameEntry, int32_t NumBefore) {
        if (NumBefore < 0) return;
        if (!t_stack.empty()) t_stack.pop_back();
        const int32_t NumAfter = TravelUrlNum();
        if (NumAfter <= 1) { s_reportedCurrent = false; return; }
        if (s_reportedCurrent) return;
        s_reportedCurrent = true;
        if (s_queuedReports.fetch_add(1, std::memory_order_relaxed) >= 16) return;
        std::string Chain;
        for (const std::string* Outer : t_stack) Chain += (Chain.empty() ? "" : " <- ") + *Outer;
        const std::string Url = TravelUrl();
        MpLog(std::string("[TravelCause] QUEUED ") + (NumBefore <= 1 ? "during" : "before") + " fn=" + NameEntry->Name
            + " url=" + Url + " depth=" + std::to_string(t_stack.size()) + " chain=[" + Chain + "]");
        if (Url.find("LoginMenu") != std::string::npos || Url.rfind("?", 0) == 0 || Url.find("closed") != std::string::npos
            || Url.find("failed") != std::string::npos) {
            Dump("queued-menu-travel");
        }
    }

    // From EngineLoadMapDetour (client): the destination and the world being left.
    static void OnLoadMap(void* WorldContext, const std::string& Map, const std::string& OldWorldName) {
        if (Globals::AmServer || !Active()) return;
        SetWorldContext(WorldContext);
        if (Map.find("Map_LoginMenu") != std::string::npos && OldWorldName.find("Map_LoginMenu") == std::string::npos
            && OldWorldName.find("Untitled") == std::string::npos && OldWorldName != "none") {
            Dump(("loadmap-login from " + OldWorldName).c_str());
        }
    }
}

void ProcessEventClientHook(UObject* Object, UFunction* Function, void* Parms) {
    g_clientProcessEventCount.fetch_add(1, std::memory_order_relaxed);
    if (g_clientGameThreadId.load(std::memory_order_relaxed) == 0) {
        g_clientGameThreadId.store(GetCurrentThreadId(), std::memory_order_relaxed);   // ProcessEvent runs on the game thread
    }
    // [2026-10-10 1.14.7] Read-only UWorld census around map changes (travel-crash probe). The engine-tick hook is
    // server-only, so the client checks GWorld from here, at most every 250 ms.
    {
        static uint64_t s_worldCensusCheckMs = 0;
        const uint64_t NowMs = GetTickCount64();
        if (NowMs - s_worldCensusCheckMs >= 250) {
            s_worldCensusCheckMs = NowMs;
            MpWorldCensusTick();
        }
    }
    // s_LastPossessedPC is now file-scope (see above) so GameEngineTickHook's timeout fallback
    // can see it too. Captured at ClientRestart so the first OnInputModeChanged callback (fires
    // after loading UI closes) can invoke the Dauntless-specific input activation UFunctions on it.

    // [1.12 REENTRANCY GUARD 2026-07-10] Same defensive pattern as ProcessEventHook.
    // Our EnableCharacterInput/OnInputModeChanged path already caused stack-overflow
    // recursion once (fix: guard flag set BEFORE invoke). This depth counter is a
    // second line of defense — beyond depth 32 we ABSORB (not passthrough), the same
    // change applied to the server-side hook. Passing through kept feeding the
    // game's own recursion in the 8788 crash.
    static thread_local int s_processEventDepthClient = 0;
    struct DepthGuardClient {
        DepthGuardClient()  { ++s_processEventDepthClient; }
        ~DepthGuardClient() { --s_processEventDepthClient; }
    } g_depthGuardClient;

    if (s_processEventDepthClient > 32) {
        static thread_local bool s_reportedRecursionClient = false;
        if (!s_reportedRecursionClient) {
            s_reportedRecursionClient = true;
            std::string FunctionName = Function ? Function->GetFullName() : "null";
            std::string ObjectName = Object ? Object->GetFullName() : "null";
            MpLog("[ProcessEventClientHook] REENTRANCY-GUARD tripped (depth="
                + std::to_string(s_processEventDepthClient) + ") — ABSORBING call. "
                + "fn=" + FunctionName + " obj=" + ObjectName);
        }
        return;   // absorb — do not call OrigProcessEventClient
    }

    /*
    if (GetAsyncKeyState(VK_F9)) {
        for (int i = 0; i < SDK::UObject::GObjects->Num(); i++)
        {
            SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);

            if (!Obj)
                continue;

            if (Obj->IsA(SDK::AActor::StaticClass()))
            {
                if (((AActor*)Obj)->Role == ENetRole::ROLE_Authority) {
                    std::cout << Obj->GetFullName() << std::endl;
                }
            }
        }
        
        while (GetAsyncKeyState(VK_F9)) {

        }
    }
    */

    // [2026-10-16 0.2.142] The cache entry itself, for TravelCause (same lookup CachedFunctionFullName does).
    static const std::string s_nullFunctionName = "null";
    MpFunctionNameCacheEntry* FunctionNameEntry = Function ? &CachedFunctionNameEntry(Function) : nullptr;
    const std::string& FunctionName = FunctionNameEntry ? FunctionNameEntry->Name : s_nullFunctionName;

    // Player-host joins can complete the UE handshake and PostLogin, then be rejected by
    // the client during its first travel/replication frame.  The normal UE diagnostics are
    // not written to mysticparadox_dll_port0.log, which previously made this look like an SDR
    // transport fault.  These are the game's own high-level failure callbacks; record the
    // enum values before the Blueprint handles them, without changing control flow.
    if (Parms && IsReadablePointer(Parms, 2)) {
        static std::atomic<int> s_clientFailureSeq{ 0 };
        const bool IsNetworkFailure = FunctionName.find("HandleNetworkError") != std::string::npos;
        const bool IsTravelFailure = FunctionName.find("HandleTravelError") != std::string::npos;
        const int FailureSeq = (IsNetworkFailure || IsTravelFailure)
            ? s_clientFailureSeq.fetch_add(1, std::memory_order_relaxed) : 16;
        if (FailureSeq < 16 && IsNetworkFailure) {
            const auto* Failure = static_cast<const uint8_t*>(Parms);
            MpLog("[ClientNetworkFailure #" + std::to_string(FailureSeq) + "] type=" + std::to_string(Failure[0])
                + " isServer=" + std::to_string(Failure[1])
                + " fn=" + FunctionName
                + " obj=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object));
        }
        else if (FailureSeq < 16 && IsTravelFailure) {
            const auto* Failure = static_cast<const uint8_t*>(Parms);
            MpLog("[ClientTravelFailure #" + std::to_string(FailureSeq) + "] type=" + std::to_string(Failure[0])
                + " fn=" + FunctionName
                + " obj=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object));
        }
    }

    TraceArtificerDroneEvent("Client", "ENTER", Object, FunctionName, Parms);
    const int EscalationFlowClientSeq = TraceEscalationFlowEnter(
        "Client", Object, FunctionName, Parms);

    // Read-only amp-click diagnostic. Remember which UPlayerEscalationComponent opened the screen
    // so a rejected click can compare its original PC with ULocalPlayer->PlayerController.
    if (Object && Parms
        && FunctionName.find("PlayerEscalationComponent.OnShowRelicChoiceScreen")
               != std::string::npos) {
        NoteRelicChoiceScreenOpened(Object, Parms);
    }
    // Detect: the native body's only observable side effect is the ServerSelectRelicOption
    // dispatch. Seeing it inside the click bracket means the guard passed; not seeing it means
    // the click was silently dropped. This is measured, not predicted from re-reading the guard.
    if (FunctionName.find("PlayerEscalationComponent.ServerSelectRelicOption")
            != std::string::npos) {
        if (s_relicClickDepth > 0) s_relicClickDispatched = true;
    }
    // Bracket the click. RAII so the depth counter survives the early returns further down.
    const bool IsRelicClick = Object
        && FunctionName.find("EscalationRelicChoiceScreen.HandleRelicSelected")
               != std::string::npos;
    struct RelicClickScope {
        bool Active;
        bool Saved;
        explicit RelicClickScope(bool bActive)
            : Active(bActive), Saved(s_relicClickDispatched) {
            if (Active) { ++s_relicClickDepth; s_relicClickDispatched = false; }
        }
        ~RelicClickScope() {
            if (Active) { --s_relicClickDepth; s_relicClickDispatched = Saved; }
        }
    } RelicClickBracket(IsRelicClick);

    // BPH_ArchonHUD_C::OnAirshipStateUpdate is the game's authoritative presentation boundary.
    // Param +0x00 is AArchonGameState*. Cache both objects before the Blueprint runs, then reconcile
    // after it returns so late private-server input/loadout work cannot leave the combat HUD exposed.
    const bool AirshipStateUpdateEvent = Function && Object
        && FunctionName.find(".OnAirshipStateUpdate") != std::string::npos;
    if (AirshipStateUpdateEvent && Parms && IsReadablePointer(Parms, sizeof(void*))) {
        UObject* GameState = *reinterpret_cast<UObject**>(Parms);
        if (GameState && IsReadablePointer(GameState, 0x2D1)) {
            s_AirshipHUD = Object;
            s_AirshipGameState = GameState;
        }
    }

    // These HUD readiness/show paths are known to run after the airship widget has already opened.
    // If one makes the gameplay layer visible again, re-run HideGameplayHUD after the original event.
    const bool AirshipHUDMayHaveBeenShown = Function && (
        FunctionName.find(".ShowGameplayHUD") != std::string::npos
        || FunctionName.find(".Player_HUD_Ready") != std::string::npos
        || FunctionName.find(".Progression_HUD_Ready") != std::string::npos
        || FunctionName.find(".ReceiveGameplayStart") != std::string::npos
        || FunctionName.find(".Refresh_HUD_Widget_Visibility") != std::string::npos
        || FunctionName.find(".Show_HUD") != std::string::npos
        || FunctionName.find(".Show HUD") != std::string::npos);
    // [1.14.7 FIX 2026-10-10, 38_ §21] Most names above are Blueprint-to-Blueprint calls that never pass
    // through ProcessEvent (no [HUDTrace] has ever logged ShowGameplayHUD or Show_HUD). The native
    // visibility setters dispatch OnHUDVisibilityChanged through ProcessEvent on every change
    // (0x01DF9040 -> 0x022B4130), so that event is the reliable "someone just showed the HUD" signal.
    const bool HudVisibilityChangedEvent = Function
        && FunctionName.find(".OnHUDVisibilityChanged") != std::string::npos;

    // [1.14.7 DIAG 2026-10-08] HUD visibility trace, client only, log-only. The 8 Oct hunt showed the
    // gameplay HUD during the arrival beam and nothing recorded which call made it visible (the module's
    // own input-activation cascade ran mid-cinematic at 15:24:22.922, 16 s before the cinematic ended, but
    // that is correlation, not proof). Each HUD lifecycle / cinematic event is logged with the HUD's
    // GameplayHUDVisibility (AArchonHUD +0x361, ESlateVisibility: 0 Visible, 1 Collapsed, 2 Hidden,
    // 3 HitTestInvisible, 4 SelfHitTestInvisible), so one arrival decides who shows the HUD.
    // Answered 10 Oct (38_ §21): the cascade's SetCinematicMode(false) on the cinematic's own false edge.
    if (Function && (AirshipHUDMayHaveBeenShown
        || FunctionName.find(".HideGameplayHUD") != std::string::npos
        || FunctionName.find(".Hide_HUD") != std::string::npos
        || FunctionName.find(".Set_HUD_Visibility") != std::string::npos
        || FunctionName.find(".Toggle_HUD_Visibility") != std::string::npos
        || FunctionName.find(".OnHUDVisibilityChanged") != std::string::npos
        || FunctionName.find(".ClientIslandGameplayStarted") != std::string::npos
        || FunctionName.find(".OnCinematicState") != std::string::npos
        || FunctionName.find(".Restore_Game_Input") != std::string::npos)) {
        int HudVisibility = -1;
        const bool IsHudObject = Object && IsReadablePointer(Object, 0x362)
            && Object->IsA(SDK::AArchonHUD::StaticClass());
        if (IsHudObject) {
            HudVisibility = SafeReadU8At(reinterpret_cast<uintptr_t>(Object), 0x361);
        }
        // [2026-10-10] World actors' ReceiveGameplayStart (~190 per arrival, all visibility -1) spent the
        // 400-line budget within two travels; only the HUD's own ReceiveGameplayStart is logged now.
        const bool WorldActorGameplayStart = !IsHudObject
            && FunctionName.find(".ReceiveGameplayStart") != std::string::npos;
        static std::atomic<int> s_hudTrace{ 0 };
        if (!WorldActorGameplayStart && s_hudTrace.fetch_add(1, std::memory_order_relaxed) < 400) {
            MpLog("[HUDTrace] fn=" + FunctionName
                + " obj=" + SafeObjectNameForDiagnostic(Object)
                + " gameplayHUDVisibility=" + std::to_string(HudVisibility));
        }
    }

    // [2026-07-23 WEAPON XP HUD DIAG] Capture the exact grant struct at each known owning-client
    // consumer. In particular, mastery_stinger_manager_C owns the on-screen popup, while
    // HUDExperienceBar owns the persistent bar. If their input is correct but AnimatePointsAdded
    // below is 125, the defect is in widget presentation; if the struct is already 125, it is
    // upstream of the HUD. Read-only, rare (per XP award), and bounded for long-running clients.
    int WeaponXpClientEventSeq = -1;
    const FExperienceGrant* WeaponXpClientGrant = nullptr;
    if (Function && Parms && IsClientExperienceGrantConsumer(FunctionName)
        && IsReadablePointer(Parms, sizeof(FExperienceGrant))) {
        static std::atomic<int> s_weaponXpClientEventCount{ 0 };
        WeaponXpClientEventSeq = s_weaponXpClientEventCount.fetch_add(1, std::memory_order_relaxed);
        if (WeaponXpClientEventSeq < 256) {
            WeaponXpClientGrant = reinterpret_cast<const FExperienceGrant*>(Parms);
            MpLog("[WeaponXP][ClientEvent] ENTER seq=" + std::to_string(WeaponXpClientEventSeq)
                + " fn=" + FunctionName
                + " obj=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
                + " " + ExperienceGrantSummary(*WeaponXpClientGrant));
        }
    }

    // UArchonProgressBar::AnimatePointsAdded receives the final integer rendered/animated by a
    // progress-bar widget. Log the object name as well so weapon XP can be separated from unrelated
    // hunt-pass or mastery bars without making assumptions about the Blueprint widget subclass.
    if (Function && Parms
        && FunctionName.find("ArchonProgressBar.AnimatePointsAdded") != std::string::npos
        && IsReadablePointer(Parms, sizeof(int32_t))) {
        static std::atomic<int> s_weaponXpBarAnimationCount{ 0 };
        int Seq = s_weaponXpBarAnimationCount.fetch_add(1, std::memory_order_relaxed);
        if (Seq < 256) {
            int32_t AddedAmount = *reinterpret_cast<const int32_t*>(Parms);
            MpLog("[WeaponXP][ClientBar] seq=" + std::to_string(Seq)
                + " added=" + std::to_string(AddedAmount)
                + " obj=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
                + " fn=" + FunctionName);
        }
    }

    // Tempest's passive binds AArchonAbilityCharacter.OnPerfectDodgeDelegate to
    // windfury_pdodge_atkspeed_buff_C.OnPerfectDodge. Trace entry and successful return so the
    // next repro distinguishes "ordinary dodge / took the hit" from the exact perfect-dodge edge
    // that grants Buffs.WindFuryStacks. Read-only and bounded.
    int TempestPerfectDodgeClientSeq = -1;
    if (Function && FunctionName.find("PerfectDodge") != std::string::npos) {
        static std::atomic<int> s_tempestPerfectDodgeClientCount{ 0 };
        TempestPerfectDodgeClientSeq = s_tempestPerfectDodgeClientCount.fetch_add(1, std::memory_order_relaxed);
        if (TempestPerfectDodgeClientSeq < 64) {
            MpLog("[TempestPerfectDodge][Client] ENTER seq=" + std::to_string(TempestPerfectDodgeClientSeq)
                + " fn=" + FunctionName + " obj=" + MpPtr(Object) + "/"
                + SafeObjectNameForDiagnostic(Object));
        }
    }

    // [2026-07-22 OMNICELL repro 11] The refreshed PlayerRole now reaches the owning client with
    // full charge (blue ring), but the Tempest artwork remains dim and tapping V never emits a
    // Tempest activation. Trace the exact Blueprint tap/hold chain without changing its behavior:
    // LanternAbilityPress/Release -> HandleLanternShort/LongPressInput -> PlayerRoleAttackPress ->
    // Client_TryActivateAbility. HeldLanternTime is useful corroboration, but wall-clock duration is
    // captured by the normal nested event ordering in the resulting log.
    const bool PlayerRoleInputEvent = Object && (
        FunctionName.find("BP_PlayerCharacter_C.LanternAbilityPress") != std::string::npos
        || FunctionName.find("BP_PlayerCharacter_C.LanternAbilityRelease") != std::string::npos
        || FunctionName.find("BP_PlayerCharacter_C.HandleLanternShortPressInput") != std::string::npos
        || FunctionName.find("BP_PlayerCharacter_C.HandleLanternLongPressInput") != std::string::npos
        || FunctionName.find("BP_PlayerCharacter_C.PlayerRoleAttackPress") != std::string::npos
        || FunctionName.find("BP_PlayerCharacter_C.Client_TryActivateAbility") != std::string::npos);
    void* InputDiagRole = nullptr;
    void* InputDiagAbilityClass = nullptr;
    float HeldLanternBefore = -1.0f;
    if (PlayerRoleInputEvent && IsReadablePointer(Object, 0x15CC)) {
        InputDiagRole = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Object) + 0x738);
        HeldLanternBefore = *reinterpret_cast<float*>(reinterpret_cast<uintptr_t>(Object) + 0x15C8);
        if (FunctionName.find("Client_TryActivateAbility") != std::string::npos
            && Parms && IsReadablePointer(Parms, sizeof(void*))) {
            InputDiagAbilityClass = *reinterpret_cast<void**>(Parms);
        }
    }

    // [2026-07-24 ACCESSORY-UNLOCK DIAG] A purchased head accessory (AC_HEAD_TRIALS_00) is confirmed
    // granted correctly - real instanceId in the DB, served back unfiltered by our own /inventory
    // route, fetched successfully by the client (200) both right after purchase and after a full
    // relog - yet it never appears in the in-game "Head Accessory" picker.
    //
    // Round 1 (build CADFD1F3) logged CanUseAccessory/IsUnlockedAsTransmogTarget/CanBeTransmogTarget -
    // a live repro came back with ZERO matches, all session, while dozens of other unrelated
    // UFunction calls (InputModeVal, MovementDiag, PlayerRoleRepNotify, ...) logged normally in the
    // same window. Since ProcessEventClientHook sees every UFunction call unconditionally, a true
    // zero means these three are never invoked here at all - the picker doesn't gate per-item through
    // them, so that hypothesis is dead.
    //
    // Round 2: found the real client-side cache instead. SDK (Archon_classes.hpp) shows
    // UArchonLocalPlayer::GetInventoryData() returns a UArchonInventoryData*, which holds
    // `TArray<UArchonInventoryItem*> Items` (+0x30) and `TMap<FString,UArchonInventoryItem*>
    // ItemsByInstanceIdCache` (+0x40) - i.e. the client's own locally-constructed wrapper-object list,
    // separate from the raw server inventory JSON. `UArchonInventoryData::GetItemFromInstanceId`
    // queries that cache by instance id string. If our purchased item's wrapper object was never
    // constructed into THIS cache client-side (for whatever reason - a client-side load/refresh gap,
    // not a server data gap, which is already proven fine), the picker would have nothing to iterate
    // regardless of any per-item unlock check, matching round 1's zero results perfectly. Logging both
    // functions now: GetInventoryData (Object=UArchonLocalPlayer, no item-object fields to read) and
    // GetItemFromInstanceId (Object=UArchonInventoryData, same - the interesting data is Parms/return,
    // not Object's own fields, so ItemId/InstanceId extraction below only applies to the original 3).
    static const bool s_AccessoryUnlockDiagEnabled =
        MpExeRelativeFlagPresent(L"ACCESSORY_UNLOCK_DIAG.flag");
    const bool IsAccessoryItemCheckFn = s_AccessoryUnlockDiagEnabled && Function && (
        FunctionName.find("CanUseAccessory") != std::string::npos
        || FunctionName.find("IsUnlockedAsTransmogTarget") != std::string::npos
        || FunctionName.find("CanBeTransmogTarget") != std::string::npos);
    const bool IsInventoryDataQueryFn = s_AccessoryUnlockDiagEnabled && Function && (
        FunctionName.find("GetInventoryData") != std::string::npos
        || FunctionName.find("GetItemFromInstanceId") != std::string::npos);
    // Round 3: a confirmed repro (tester explicitly opened Personality -> Head Accessory) STILL came
    // back with zero hits on all 5 functions above. Since ProcessEventClientHook sees every client
    // UFunction call unconditionally and dozens of unrelated calls log normally in the same window,
    // that's a real zero, not a missed capture - the picker does not gate through any of them.
    // SDK search (no live-process access needed) found the real entry point instead:
    // UIdentityAccessoryPanel::UpdateView() (Archon_classes.hpp) - the sole native UFUNCTION on the
    // base class both UIdentityHeadAccessoryPanel and UIdentityBackAccessoryPanel inherit, populating
    // a member `FIdentityAssetViewModel AccessoryViewModel`. Critically, FIdentityAssetViewModel
    // (Archon_structs.hpp) inherits from `FOnlineStorePhoenixPurchasableItem` - the SAME store-offer
    // struct family Lady Luck's Store's SKU listing already uses (ItemId, ItemInstanceID,
    // StoreQueryState, an embedded FOnlineStorePhoenixOffer, bIsItemLocked, bIsEquipped). This means
    // the Head/Back Accessory panels most likely do NOT read raw inventory at all - they build their
    // list from the STORE-OFFER data model, which would explain the zero hits on every inventory
    // function perfectly. "UpdateView" is a common MVVM name reused by unrelated widgets in this game,
    // so this is deliberately broad; SafeObjectNameForDiagnostic in the existing post-call log line
    // identifies which widget instance actually called it.
    const bool IsWidgetUpdateViewFn = s_AccessoryUnlockDiagEnabled && Function
        && FunctionName.find("UpdateView") != std::string::npos;
    const bool IsAccessoryUnlockDiagFn = IsAccessoryItemCheckFn || IsInventoryDataQueryFn || IsWidgetUpdateViewFn;
    std::string AccessoryUnlockDiagItemId, AccessoryUnlockDiagInstanceId, AccessoryUnlockDiagParmsBefore;
    if (IsAccessoryItemCheckFn && Object) {
        AccessoryUnlockDiagItemId = IsReadablePointer(Object, 0x80)
            ? CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Object) + 0x70))
            : std::string("?");
        AccessoryUnlockDiagInstanceId = IsReadablePointer(Object, 0x98)
            ? CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Object) + 0x88))
            : std::string("?");
    }
    std::string AccessoryUnlockDiagQueriedInstanceId;
    if (IsAccessoryUnlockDiagFn) {
        AccessoryUnlockDiagParmsBefore = (Parms && IsReadablePointer(Parms, 24))
            ? DumpBytesHex(Parms, 24) : std::string("(unreadable)");
        // GetItemFromInstanceId(const FString& InItemInstanceId) - the queried id is an FString
        // (Data ptr+Num+Max, 16 bytes) at Parms+0x0; decode it the same way ItemId/InstanceId are
        // decoded above, not just as raw hex, so it's directly comparable to the known real
        // instanceId (A45AE24A57F840ECB0E377952C) from the DB.
        if (FunctionName.find("GetItemFromInstanceId") != std::string::npos
            && Parms && IsReadablePointer(Parms, 0x10)) {
            AccessoryUnlockDiagQueriedInstanceId = CoreCapFString(Parms);
        }
    }

    // [2026-07-22 OMNICELL] Client-local retry pump. GameEngineTickHook is installed only by
    // InitServerHooks, so its nominal client branch never executes. ProcessEvent is already on the
    // owning client's game thread and runs continuously; sample only outermost calls and let the
    // retry helper's 1.5s per-entry throttle bound the actual work.
    if (s_processEventDepthClient == 1) {
        static uint32_t s_clientRoleRetryPump = 0;
        if ((++s_clientRoleRetryPump & 0xFF) == 0) {
            UObject* StablePawn = nullptr;
            const bool PossessionStable = IsClientRolePumpPossessionStable(
                s_LastPossessedPC, &StablePawn);
            if (PossessionStable) {
                // [1.14.7 2026-10-05] One-shot arrival census. The moment the possession chain is
                // complete for a NEW (PC, pawn) pair, count the client's player objects once. This is the
                // client-side acceptance reading: playerStates=1, gameStates=1 and archonCharacters=1 -
                // a second archon character would mean an extra server-side player leaked into replication
                // (the hub phantom did until 0.2.110), a missing playerState/gameState means the graph
                // drive regressed. Keyed on the pair so it fires once per arrival and once per travel.
                static void* s_censusPc = nullptr;
                static void* s_censusPawn = nullptr;
                if (s_censusPc != s_LastPossessedPC || s_censusPawn != StablePawn) {
                    s_censusPc = s_LastPossessedPC;
                    s_censusPawn = StablePawn;
                    MpLog("[ArrivalCensus] possession chain complete pc=" + MpPtr(s_LastPossessedPC)
                        + " pawn=" + MpPtr(StablePawn));
                    MpCensusClientPlayerObjects();
                    // [1.14.7 2026-10-10] Read-only economy probes at the same one-shot point (outermost ProcessEvent,
                    // game thread): hunt pass season and component state, the fountain's configuration, and the
                    // feature-flag dump that servers already write at their first readiness check (once per process).
                    MpHuntPassClientProbe(s_LastPossessedPC);
                    MpCoinTossClientProbe(s_LastPossessedPC);
                    DumpFeatureFlags("client arrival");
                }
                if (!RunClientRolePumpGuarded(s_LastPossessedPC, StablePawn)) {
                    MpLog("[ClientRolePump] FAULTED after stable-possession validation - caught, skipping this pump cycle");
                }
                MpNpcCollisionProbe(StablePawn);   // read-only diagnostic, once per arrival (self-throttled)
            }
            else if (s_LastPossessedPC && s_LastPossessedAtMs != 0) {
                static uint64_t s_LastTravelGuardWaitLogMs = 0;
                const uint64_t Now = GetTickCount64();
                if (Now - s_LastTravelGuardWaitLogMs >= 5000) {
                    s_LastTravelGuardWaitLogMs = Now;
                    MpLog("[ClientTravelGuard] waiting for stable LocalPlayer->PlayerController->Pawn chain; repair pump skipped");
                }
            }

            // A natural OnInputModeChanged often arrives 1-2 seconds after ClientRestart, before
            // the visual/map lifecycle is stable. Replay that exact edge only after the same
            // possession-chain guard used by the repair pump has passed. If the event never arrives,
            // the eight-second timeout may restore controls but may not clear cinematic mode.
            if (PossessionStable && s_LastPossessedPC && s_LastPossessedAtMs != 0
                && !s_ArchonInputActivated && !DiagNaturalMode())
            {
                const uint64_t Elapsed = GetTickCount64() - s_LastPossessedAtMs;
                if (s_ArchonInputActivationPending) {
                    MpLog(std::string("[ArchonInputActivate] trigger=deferred-event stable after ")
                        + std::to_string(Elapsed)
                        + "ms; replaying natural OnInputModeChanged activation");
                    TriggerArchonInputActivation(
                        s_LastPossessedPC, "deferred-event", true);
                    if (s_ArchonInputActivated) {
                        s_ArchonInputActivationPending = false;
                    }
                }

                constexpr uint64_t kInputActivateTimeoutMs = 8000;
                if (!s_ArchonInputActivated && Elapsed >= kInputActivateTimeoutMs) {
                    MpLog(std::string("[ArchonInputActivate] trigger=timeout no successful stable activation within ")
                        + std::to_string(Elapsed)
                        + "ms of ClientRestart - restoring input without cinematic completion");
                    TriggerArchonInputActivation(
                        s_LastPossessedPC, "timeout", false);
                }
            }

            // Weapon level and public-hunt eligibility were proven to recover while the native
            // PlayerExperienceComponent.Experiences array remained empty on every capture. The old
            // 45-attempt HUD retry therefore instrumented a non-authoritative path and added travel-
            // time ProcessEvent/native calls without ever succeeding. It is intentionally dormant.
        }
    }

    // Preserve disconnect/login UI and state transitions while observing the actual failure path.
    if (FunctionName.find("LoginScreen") != std::string::npos) {
        MpLog("[LoginScreenDiag] fn=" + FunctionName);
        AutoPressStartFromEvent(Object, FunctionName);
        AutoPlayFromEvent(Object, FunctionName);
        AutoTravelToCityFromEvent(Object, FunctionName);
    }

    // [Group E2 cleanup 2026-07-13] [ReadyFn-CLI] LoadingDispatch readiness-setter logger removed.

    // [Client_Rediness_002 Step 1] Player-start BP edges on the controller + PlayerReady/HUDReady transitions.
    // [Group E2 cleanup 2026-07-13] [PStart-CLI] player-start readiness logger removed.


    // [Group E2 cleanup 2026-07-13] [SpecTrace-CLI] spectator/restart-flow logger removed.


    // [Group E2 cleanup 2026-07-13] [IxnTrace-CLI] interaction-target logger removed.


    // [Group E2 cleanup 2026-07-13] [ClientLoadTrace] load-marker logger removed.


    // [Group E2 cleanup 2026-07-13] [NativeCompletionClient] OnPlayerDataLoadComplete logger removed.


    // Post-ClientOnPostLogin UNFILTERED trace: once ClientOnPostLogin fires we start capturing
    // *every* subsequent ProcessEvent call on the client to find out what fires between the
    // "player is in the world" event and whatever is supposed to dismiss the loading overlay.
    //
    // Anti-noise: skip a small set of ultra-hot tick-family functions that would drown the log
    // (60Hz Tick, ReceivedTick, animation graph updates, etc). Also skip anything containing
    // "Tick" as a whole word since UE4 fires ReceivedTick on every actor every frame.
    // [Group E2 cleanup 2026-07-13] [ClientPostLoginTrace] unfiltered client ProcessEvent capture removed
    // (setup + budgeted trace + the client-only g_postLoginTimeMs seed, which only fed removed diagnostics).


    const int GauntletCensusSeq = GauntletCensus::Enter(Object, Function, FunctionName, Parms);
    const int32_t TravelUrlNumBefore = TravelCause::Before(FunctionNameEntry);
    reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(Object, Function, Parms);
    TravelCause::After(FunctionNameEntry, TravelUrlNumBefore);
    GauntletCensus::Exit(GauntletCensusSeq, Function, Parms);
    TraceArtificerDroneEvent("Client", "EXIT", Object, FunctionName, Parms);

    // After the screen's own handler, so SetSplashImage / HandleGetPatchNotesPayloadSuccess cannot undo it.
    if (FunctionName.find("LoginScreen") != std::string::npos) {
        LoginBranding::OnLoginScreenEvent(Object, FunctionName);
    }
    if (FunctionName.find("OnInitialized") != std::string::npos
        || FunctionName.find("bpw_Credits_C.PreConstruct") != std::string::npos) {
        CreditsBranding::OnCreditsEvent(Object, FunctionName);
    }
    if (FunctionName.find("PressStart") != std::string::npos) {
        PressStartBranding::OnPressStartEvent(Object, FunctionName);
    }

    if (IsAccessoryUnlockDiagFn) {
        static std::atomic<int> s_accessoryUnlockDiagCount{ 0 };
        if (s_accessoryUnlockDiagCount.fetch_add(1, std::memory_order_relaxed) < 2000) {
            std::string ParmsAfter = (Parms && IsReadablePointer(Parms, 24))
                ? DumpBytesHex(Parms, 24) : std::string("(unreadable)");
            // GetInventoryData()'s ReturnValue (a UArchonInventoryData*) and GetItemFromInstanceId's
            // ReturnValue (a UArchonInventoryItem*, after the 16-byte FString input) are both single
            // pointers - decode both possible slots post-call so a null vs. non-null result is explicit
            // rather than left to a raw hex diff.
            void* ReturnValueAtOffset0 = (Parms && IsReadablePointer(Parms, 8))
                ? *reinterpret_cast<void**>(Parms) : nullptr;
            void* ReturnValueAtOffset0x10 = (Parms && IsReadablePointer(Parms, 0x18))
                ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Parms) + 0x10) : nullptr;
            MpLog("[AccessoryUnlockDiag] fn=" + FunctionName
                + " obj=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
                + " itemId=" + AccessoryUnlockDiagItemId
                + " instanceId=" + AccessoryUnlockDiagInstanceId
                + " queriedInstanceId=" + AccessoryUnlockDiagQueriedInstanceId
                + " retAt0x0=" + MpPtr(ReturnValueAtOffset0)
                + " retAt0x10=" + MpPtr(ReturnValueAtOffset0x10)
                + " parmsBefore=[" + AccessoryUnlockDiagParmsBefore + "]"
                + " parmsAfter=[" + ParmsAfter + "]");
        }
    }

    if (AirshipStateUpdateEvent) {
        ReconcileAirshipGameplayHUD("state-update");
    }
    else if (AirshipHUDMayHaveBeenShown) {
        ReconcileAirshipGameplayHUD("hud-show-path");
    }
    else if (HudVisibilityChangedEvent) {
        ReconcileAirshipGameplayHUD("hud-visibility-changed");
    }

    if (WeaponXpClientGrant && WeaponXpClientEventSeq >= 0 && WeaponXpClientEventSeq < 256) {
        MpLog("[WeaponXP][ClientEvent] EXIT seq=" + std::to_string(WeaponXpClientEventSeq)
            + " fn=" + FunctionName + " " + ExperienceGrantSummary(*WeaponXpClientGrant));
    }

    TraceEscalationFlowExit("Client", EscalationFlowClientSeq, Object, FunctionName, Parms);

    // HandleRelicSelected returned without an RPC: record the verified PlayerContext/controller
    // split, but do not alter it. The real fix is server-side PlayerController channel isolation.
    if (IsRelicClick && !s_relicClickDispatched) {
        LogRejectedRelicClick(Object, Parms);
    }

    if (TempestPerfectDodgeClientSeq >= 0 && TempestPerfectDodgeClientSeq < 64) {
        MpLog("[TempestPerfectDodge][Client] EXIT seq=" + std::to_string(TempestPerfectDodgeClientSeq)
            + " fn=" + FunctionName);
    }

    if (PlayerRoleInputEvent) {
        TickFrankDroneClientDiag(Object, "input");
        static std::atomic<int> s_playerRoleInputLogCount{ 0 };
        if (s_playerRoleInputLogCount.fetch_add(1, std::memory_order_relaxed) < 128) {
            const float HeldLanternAfter = IsReadablePointer(Object, 0x15CC)
                ? *reinterpret_cast<float*>(reinterpret_cast<uintptr_t>(Object) + 0x15C8) : -1.0f;
            const int CharacterActive = IsReadablePointer(Object, 0xA1B)
                ? SafeReadByte(reinterpret_cast<uintptr_t>(Object), 0xA1A, 0xEE) : -1;
            const int GameplayEquipped = InputDiagRole
                ? SafeReadByte(reinterpret_cast<uintptr_t>(InputDiagRole), 0x2F5, 0xEE) : -1;
            const int RoleActive = InputDiagRole
                ? SafeReadByte(reinterpret_cast<uintptr_t>(InputDiagRole), 0x2F6, 0xEE) : -1;
            const int BpEquipCalled = InputDiagRole
                ? SafeReadByte(reinterpret_cast<uintptr_t>(InputDiagRole), 0x2F7, 0xEE) : -1;
            MpLog("[PlayerRoleInput] fn=" + FunctionName
                + " pawn=" + MpPtr(Object) + " role=" + MpPtr(InputDiagRole)
                + " held=" + std::to_string(HeldLanternBefore) + "->" + std::to_string(HeldLanternAfter)
                + " charActive=" + std::to_string(CharacterActive)
                + " gameplayEquipped=" + std::to_string(GameplayEquipped)
                + " roleActive=" + std::to_string(RoleActive)
                + " bpEquipCalled=" + std::to_string(BpEquipCalled)
                + " abilityClass=" + MpPtr(InputDiagAbilityClass) + "/"
                + SafeObjectNameForDiagnostic(InputDiagAbilityClass)
                + " charge={" + PlayerRoleChargeSummary(InputDiagRole) + "}"
                + " modifiers={" + PlayerRoleModifierSummary(InputDiagRole) + "}"
                + " frankDrone={" + FrankDroneGateSummary(InputDiagRole) + "}");
        }
    }

    // [1.12 DIAG 2026-07-10] Read bGameInputEnabled from OnInputModeChanged parms so we
    // can see whether the client is in Game input mode or UI-only. User reports "only
    // mouse cursor moves" — that is the signature of UI-only mode.
    //
    // This ALSO acts as the trigger point for our Dauntless-specific input activation
    // fallback: after the FIRST OnInputModeChanged fires, record the natural edge and wait for
    // the exact travel-settle/ownership chain before invoking
    // AArchonPlayerController::EnableCharacterInput(true). Ghidra + the SDK verify the native
    // method at RVA 0x02164060 and the pawn-facing input components at PC+0xC38..0xC50.
    // We deliberately do not call EnableControllerInput because it re-enters this event path.
    // Generic Actor.EnableInput does not reverse Dauntless-specific UI suppression.
    if (Function && Parms && Object
        && FunctionName == "Function BP_PlayerCharacter.BP_PlayerCharacter_C.OnInputModeChanged")
    {
        bool bGameInputEnabled = *reinterpret_cast<bool*>(Parms);
        // [1.14.7 FIX 2026-10-10, 38_ §21] Remember the game's own latest value; events raised by our
        // activation cascade are tagged source=runtime and do not count as the game handing over control.
        const bool FromRuntime = s_ArchonInputActivationDepth > 0;
        const bool CurrentChain = s_LastPossessedPC
            && ValidateClientPossessionChain(s_LastPossessedPC, Object, nullptr);
        if (!FromRuntime && CurrentChain) {
            s_LastNaturalGameInput = bGameInputEnabled ? 1 : 0;
            s_LastNaturalGameInputMs = GetTickCount64();
        }
        MpLog(std::string("[InputModeVal] pawn=") + Object->GetFullName()
            + " bGameInputEnabled=" + (bGameInputEnabled ? "true" : "false")
            + " source=" + (FromRuntime ? "runtime" : "game"));

        // Record the first natural OnInputModeChanged after ClientRestart. Captures prove this
        // can precede stable world rendering, so it is a trigger edge only—not proof that the
        // loading/cinematic lifecycle is complete.
        //
        // s_LastPossessedPC is set when we observe a real ClientRestart on the client
        // (below), so at this point we know we have a live AArchonPlayerController.
        //
        // REENTRANCY: EnableCharacterInput / EnableControllerInput internally fire
        // OnInputModeChanged (that is literally their job). Without a guard set BEFORE
        // the ProcessEvent call, that reentrant OnInputModeChanged hits this same
        // branch, s_ArchonInputActivated is still false → infinite recursion → stack
        // overflow (verified in the previous DLL build, crash trace attached in
        // AGENTS.md). Set the flag first, then invoke.
        //
        // GATING: bOnlineDataReady @ PC+0xC59 must be 1 before we activate Dauntless
        // input. When it is 0 the game itself has not finished online sync yet.
        //
        // Verified 2026-07-10:
        //   - SDK Archon_classes.hpp:24922 → bOnlineDataReady at offset 0xC59 on
        //     AArchonPlayerController (private, non-replicated).
        //   - Ghidra confirms AArchonPlayerController::OnPlayerDataLoadComplete at
        //     RVA 0x141B690F0 directly writes PC+0xC59 = 1.
        //   - RVA 0x141B69C10 is UArchonInventoryDataLoader::OnQueryPlayerInventoryComplete;
        //     it advances the inventory loader but does not itself write the controller field.
        //   - These paths are gated on HTTP responses from PhoenixCharacter/PhoenixInventory
        //     which are timing out in the current setup (`OnSetHttpRequestComplete
        //     Null Response, Timeout` — verified in port8790_ramsgate.log).
        //   - Client HTTP path isn't visible to us; we can't easily identify or
        //     stub the exact endpoint per-run.
        //
        // Workaround: on the FIRST OnInputModeChanged where bOnlineDataReady is 0,
        // force-write it to 1 via SafeWriteByte. bOnlineDataReady is only checked
        // by AArchonPlayerController's own input-gate — the network sync layer has
        // its own independent state — so forcing the flag doesn't cause replication
        // desync. If a downstream system (loadout, inventory, HUD) is missing data,
        // it will log its own warnings (and we've seen those already in Ramsgate
        // — currency widgets, etc.). The trade is: possibly-gearless character
        // in Ramsgate hub, versus can't-move Slayer. We take movement.
        if (!s_ArchonInputActivated && s_LastPossessedPC && !DiagNaturalMode()) {
            if (CurrentChain) {
                s_NaturalInputModeChangedObserved = true;

                UObject* StablePawn = nullptr;
                if (IsClientRolePumpPossessionStable(s_LastPossessedPC, &StablePawn)) {
                    TriggerArchonInputActivation(
                        s_LastPossessedPC, "event", true);
                }
                else {
                    s_ArchonInputActivationPending = true;
                    const uint64_t Elapsed = s_LastPossessedAtMs != 0
                        ? GetTickCount64() - s_LastPossessedAtMs : 0;
                    MpLog(std::string("[ClientTravelGuard] deferred OnInputModeChanged activation; elapsed=")
                        + std::to_string(Elapsed)
                        + "ms settleRequired=" + std::to_string(kClientRolePumpTravelSettleMs)
                        + "ms");
                }
            }
            else {
                MpLog("[ClientTravelGuard] ignored OnInputModeChanged from a non-current pawn/controller chain");
            }
        }
    }

    // [1.12 MovementDiag — 2026-07-10] Root-cause analysis needs concrete data on:
    //   (a) CanMove_ @ pawn+0x15E0 — pawn's own gate (default false; server sets true)
    //   (b) pawn->CharacterMovement @ pawn+0x288 — pointer to CharMoveComp
    //   (c) CharMoveComp->MovementMode @ +0x168 — 0=None, 1=Walking, 2=NavWalking,
    //       3=Falling, 4=Swimming, 5=Flying, 6=Custom
    //   (d) pawn->ReplicatedMovementMode @ pawn+0x328 — net-replicated mode (uint8)
    //
    // Previous tests confirmed: W-key → InpAxisEvt_MoveForward=1.000 fires, our
    // DLL directly calls APawn::AddMovementInput 180+ times, but character does
    // NOT move. AddMovementInput is being called but CharMoveComp is not applying
    // it to physics. This means the CharMoveComp is dead — either misconfigured
    // (null UpdatedComponent, null PawnOwner, MaxWalkSpeed=0), or its tick is
    // disabled, or an override is clearing input every frame.
    //
    // Verified from Engine_classes.hpp:
    //   ACharacter::CharacterMovement offset 0x0288  (line 3678)
    //   ACharacter::ReplicatedMovementMode offset 0x0328  (line 3688)
    //   UMovementComponent::UpdatedComponent offset 0x00B0  (line 4845)
    //   UMovementComponent::Velocity offset 0x00C4  (line 4848)
    //   UPawnMovementComponent::PawnOwner offset 0x0130  (line 6752)
    //   UCharacterMovementComponent::CharacterOwner offset 0x0148  (line 6866)
    //   UCharacterMovementComponent::GravityScale offset 0x0150  (line 6867)
    //   UCharacterMovementComponent::MovementMode offset 0x0168  (line 6873)
    //   UCharacterMovementComponent::MaxWalkSpeed offset 0x018C  (line 6879)
    //   UCharacterMovementComponent::MaxAcceleration offset 0x01A0  (line 6884)
    //   UCharacterMovementComponent::DefaultLandMovementMode offset 0x03B8  (line 6978)
    if (Function && Object
        && FunctionName == "Function BP_PlayerCharacter.BP_PlayerCharacter_C.OnInputModeChanged")
    {
        uintptr_t pawnAddr = reinterpret_cast<uintptr_t>(Object);
        uint8_t canMove = SafeReadByte(pawnAddr, 0x15E0, 0xEE);
        uintptr_t charMove = SafeReadPtr(pawnAddr, 0x0288);
        uintptr_t rootComp = SafeReadPtr(pawnAddr, 0x0130);
        uint8_t replMovMode = SafeReadByte(pawnAddr, 0x0328, 0xEE);
        // AActor::Role @ 0xF0 (ROLE_None=0, SimulatedProxy=1, AutonomousProxy=2, Authority=3)
        // AActor::RemoteRole @ 0x5F
        uint8_t actorRole = SafeReadByte(pawnAddr, 0x00F0, 0xEE);
        uint8_t remoteRole = SafeReadByte(pawnAddr, 0x005F, 0xEE);
        uint8_t movMode = 0xEE, defaultLandMode = 0xEE, customMovMode = 0xEE;
        uintptr_t updatedComp = 0, pawnOwner = 0, characterOwner = 0;
        float velX = 0, velY = 0, velZ = 0, maxWalkSpeed = 0, maxAccel = 0, gravScale = 0;
        if (charMove) {
            movMode = SafeReadByte(charMove, 0x0168, 0xEE);
            customMovMode = SafeReadByte(charMove, 0x0169, 0xEE);
            defaultLandMode = SafeReadByte(charMove, 0x03B8, 0xEE);
            updatedComp = SafeReadPtr(charMove, 0x00B0);
            pawnOwner   = SafeReadPtr(charMove, 0x0130);
            characterOwner = SafeReadPtr(charMove, 0x0148);
            velX = SafeReadFloat(reinterpret_cast<uint8_t*>(charMove) + 0x00C4, 0);
            velY = SafeReadFloat(reinterpret_cast<uint8_t*>(charMove) + 0x00C8, 0);
            velZ = SafeReadFloat(reinterpret_cast<uint8_t*>(charMove) + 0x00CC, 0);
            maxWalkSpeed = SafeReadFloat(reinterpret_cast<uint8_t*>(charMove) + 0x018C, 0);
            maxAccel = SafeReadFloat(reinterpret_cast<uint8_t*>(charMove) + 0x01A0, 0);
            gravScale = SafeReadFloat(reinterpret_cast<uint8_t*>(charMove) + 0x0150, 0);
        }
        // USceneComponent::Mobility @ RootComp+0x14F (0=Static, 1=Stationary, 2=Movable)
        uint8_t mobility = 0xEE;
        float locX = 0, locY = 0, locZ = 0;
        if (rootComp) {
            mobility = SafeReadByte(rootComp, 0x014F, 0xEE);
            locX = SafeReadFloat(reinterpret_cast<uint8_t*>(rootComp) + 0x011C, 0);
            locY = SafeReadFloat(reinterpret_cast<uint8_t*>(rootComp) + 0x0120, 0);
            locZ = SafeReadFloat(reinterpret_cast<uint8_t*>(rootComp) + 0x0124, 0);
        }

        char buf[768];
        _snprintf_s(buf, sizeof(buf), _TRUNCATE,
            "pawn=%s CanMove_=%u Role=%u RemoteRole=%u"
            " CharMove=%p RootComp=%p Updated=%p"
            " PawnOwner=%p CharOwner=%p Mobility=%u"
            " MovMode=%u CustomMovMode=%u DefaultLandMode=%u ReplMovMode=%u"
            " Vel=(%.1f,%.1f,%.1f) MaxWalk=%.1f MaxAcc=%.1f Grav=%.2f"
            " Loc=(%.1f,%.1f,%.1f)",
            Object->GetFullName().c_str(),
            canMove, actorRole, remoteRole,
            reinterpret_cast<void*>(charMove),
            reinterpret_cast<void*>(rootComp),
            reinterpret_cast<void*>(updatedComp),
            reinterpret_cast<void*>(pawnOwner),
            reinterpret_cast<void*>(characterOwner),
            mobility,
            movMode, customMovMode, defaultLandMode, replMovMode,
            velX, velY, velZ, maxWalkSpeed, maxAccel, gravScale,
            locX, locY, locZ);
        MpLog(std::string("[MovementDiag] ") + buf);

        // Force CanMove_ = 1 if not already
        if (canMove != 1) {
            SafeWriteByte(pawnAddr, 0x15E0, 1);
            SafeWriteByte(pawnAddr, 0x1604, 1);  // PreviousCanMove
            MpLog("[ForceCanMove] wrote 1 to pawn+0x15E0 (CanMove_)");
        }

        // Force MovementMode = MOVE_Walking (1) if it's MOVE_None (0)
        if (charMove && movMode == 0) {
            bool ok1 = SafeWriteByte(charMove, 0x0168, 1);
            bool ok2 = SafeWriteByte(charMove, 0x03B8, 1);  // DefaultLandMovementMode
            bool ok3 = SafeWriteByte(pawnAddr, 0x0328, 1);  // ReplicatedMovementMode
            MpLog(std::string("[ForceMovementMode] wrote MOVE_Walking → CharMove+0x168 (")
                + (ok1 ? "ok" : "FAIL") + ") DefaultLandMode (" + (ok2 ? "ok" : "FAIL")
                + ") ReplMovMode (" + (ok3 ? "ok" : "FAIL") + ")");
        }

        // Force Mobility = Movable (2) on RootComp if not already. Static/Stationary
        // mobility means the actor CAN'T be moved at runtime by any means — Velocity
        // writes, AddMovementInput, and even teleport all silently fail.
        if (rootComp && mobility != 2) {
            bool ok = SafeWriteByte(rootComp, 0x014F, 2);
            MpLog(std::string("[ForceMobility] RootComp+0x14F: was=") + std::to_string(mobility)
                + " wrote 2 (Movable) " + (ok ? "ok" : "FAIL"));
        }

        // Force Role = ROLE_AutonomousProxy (2) so the client's local pawn has
        // authority to move itself. If Role were SimulatedProxy, all local movement
        // is ignored and position only updates from server replication.
        if (actorRole != 2 && actorRole != 3) {
            bool ok = SafeWriteByte(pawnAddr, 0x00F0, 2);
            MpLog(std::string("[ForceRole] pawn+0xF0: was=") + std::to_string(actorRole)
                + " wrote 2 (AutonomousProxy) " + (ok ? "ok" : "FAIL"));
        }
    }

    // [1.12 MovementInputDiag — 2026-07-10] Always-log for AddMovementInput/SetMovementMode
    // regardless of trace budget. If InpAxisEvt_MoveForward=1.0 fires but AddMovementInput
    // never fires → blueprint has a hidden gate. If AddMovementInput fires with a valid
    // world direction but character doesn't move → CharMoveComp is broken.
    if (Function && FunctionName.contains("AddMovementInput")) {
        // Parms layout: FVector WorldDirection (0x00-0x0C) + float ScaleValue (0x0C) + bool bForce (0x10)
        float dx = 0, dy = 0, dz = 0, scale = 0;
        if (Parms) {
            dx = SafeReadFloat(reinterpret_cast<uint8_t*>(Parms) + 0x0, 0);
            dy = SafeReadFloat(reinterpret_cast<uint8_t*>(Parms) + 0x4, 0);
            dz = SafeReadFloat(reinterpret_cast<uint8_t*>(Parms) + 0x8, 0);
            scale = SafeReadFloat(reinterpret_cast<uint8_t*>(Parms) + 0xC, 0);
        }
        char buf[128];
        _snprintf_s(buf, sizeof(buf), _TRUNCATE, "%.2f,%.2f,%.2f scale=%.2f", dx, dy, dz, scale);
        MpLog(std::string("[AddMovementInput] obj=") + (Object ? Object->GetFullName() : "null")
            + " dir=(" + buf + ")");
    }
    if (Function && FunctionName.contains("SetMovementMode") && Parms) {
        uint8_t newMode = SafeReadByte(reinterpret_cast<uintptr_t>(Parms), 0, 0xEE);
        MpLog(std::string("[SetMovementMode] obj=") + (Object ? Object->GetFullName() : "null")
            + " newMode=" + std::to_string(newMode));
    }
    if (Function && FunctionName.contains("K2_OnMovementModeChanged") && Parms) {
        // struct { EMovementMode PrevMode; EMovementMode NewMode; uint8 PrevCustom; uint8 NewCustom; }
        uint8_t prev = SafeReadByte(reinterpret_cast<uintptr_t>(Parms), 0, 0xEE);
        uint8_t next = SafeReadByte(reinterpret_cast<uintptr_t>(Parms), 1, 0xEE);
        MpLog(std::string("[K2_OnMovementModeChanged] obj=") + (Object ? Object->GetFullName() : "null")
            + " prev=" + std::to_string(prev) + " new=" + std::to_string(next));
    }

    // [1.12 AxisNonZero — 2026-07-10] Diagnostic: log any axis event with non-zero
    // value. Confirms whether keyboard input reaches the pawn (WASD → 1.0/-1.0 on
    // MoveForward/MoveRight) or mouse input (Turn/LookUp non-zero on mouse move).
    // Uses the fact that InpAxisEvt_* UFunctions on BP_PlayerCharacter take a
    // single float parameter at Parms+0x0. Skip zero (or near-zero) values to
    // avoid drowning the log in the 60Hz tick pattern where UE fires all axis
    // events every frame regardless of input state.
    if (Function && Parms && FunctionName.contains("BP_PlayerCharacter_C.InpAxisEvt_")) {
        float axisValue = SafeReadFloat(Parms, 0.f);
        // [Phase 0k 2026-07-12] [AxisNonZero] logging disabled — ~1,835 lines/min of spam that
        // contaminated the lag measurement; input-reaches-pawn was already confirmed. The ForceMove
        // bypass below still uses axisValue.

        // [1.12 ForceMove — 2026-07-10] BYPASS blueprint gate. The BP graph of
        // InpAxisEvt_MoveForward / InpAxisEvt_MoveRight receives the axis value
        // (confirmed via [AxisNonZero] log firing with value=1.000) but does NOT
        // call AddMovementInput. No [AddMovementInput] entries in the log despite
        // 802 axis events with value=1.000. The BP has a hidden conditional we
        // can't inspect (blueprint bytecode, not accessible via Ghidra).
        //
        // Solution: from the DLL, when we see MoveForward/MoveRight fire with
        // non-zero value, directly dispatch APawn::AddMovementInput ourselves via
        // ProcessEvent. Direction is camera-relative — read PC's ControlRotation.Yaw
        // and compute the XY-plane forward/right vector.
        //
        // ControlRotation is at AController+0x0288 (FRotator: Pitch@0x00, Yaw@0x04,
        // Roll@0x08) — verified Engine_classes.hpp:1802.
        // AddMovementInput Parms layout: FVector WorldDirection (0x00-0x0B),
        // float ScaleValue (0x0C), bool bForce (0x10), pad (0x11-0x13).
        // Total size 0x14 — verified Engine_parameters.hpp:5878.
        bool isForward = FunctionName.contains("InpAxisEvt_MoveForward");
        bool isRight   = FunctionName.contains("InpAxisEvt_MoveRight");
        if ((isForward || isRight) && Object && s_LastPossessedPC
            && (axisValue > 0.05f || axisValue < -0.05f))
        {
            float yawDeg = SafeReadFloat(
                reinterpret_cast<uint8_t*>(s_LastPossessedPC) + 0x288 + 4, 0.f);
            float yawRad = yawDeg * 0.01745329252f; // PI/180
            float cosY = std::cos(yawRad);
            float sinY = std::sin(yawRad);
            float dirX, dirY;
            if (isForward) {
                // Forward on XY plane (ignore pitch): (cos, sin, 0)
                dirX = cosY;
                dirY = sinY;
            } else {
                // Right = Forward rotated -90° around Z: (sin, -cos, 0)
                // UE4 uses left-handed coords with Y = right. RightVector formula:
                // Right = (sinYaw, cosYaw, 0) when Forward = (cosYaw, sinYaw, 0)
                // (verified against Rotator::RotateVector for Roll=Pitch=0)
                dirX = -sinY;
                dirY = cosY;
            }

            // [1.12 ForceMove removed — 2026-07-10] Native input configuration is now restored,
            // so directly forcing APawn::AddMovementInput is no longer necessary.

            // [1.12 ForceVelocity — 2026-07-10] AddMovementInput may be no-op'd
            // by some Dauntless-specific system (root motion lock, GAS movement
            // block, etc). Bypass entirely by writing to CharMoveComp->Velocity
            // directly. If CharMoveComp physics tick runs, velocity vector drives
            // the pawn's UpdatedComponent to a new location.
            //
            // Force 500 units/sec (typical UE walking speed). This gets written
            // every 15ms as long as W is held → sustained motion.
            uintptr_t pawnAddr = reinterpret_cast<uintptr_t>(Object);
            uintptr_t charMove = SafeReadPtr(pawnAddr, 0x0288);
            if (charMove) {
                float speed = 500.0f;
                float vx = dirX * speed * axisValue;
                float vy = dirY * speed * axisValue;
                // [Analysis.md Section 13.E] Client-side ForceVelocity DISABLED.
                // The server-side RemoteRole=AutonomousProxy fix (FORCE-REP patch)
                // should make the client naturally own its movement — no need to
                // write Velocity directly here anymore. Kept commented as escape
                // hatch if the server-side fix regresses.
                //
                // SafeWriteFloat(charMove, 0x00C4, vx);
                // SafeWriteFloat(charMove, 0x00C8, vy);
                static int s_velLogCount = 0;
                if (++s_velLogCount <= 1) {
                    char buf[128];
                    _snprintf_s(buf, sizeof(buf), _TRUNCATE,
                        "DISABLED — target=(%.1f,%.1f) via %s (server RemoteRole fix should suffice)",
                        vx, vy, isForward ? "MoveForward" : "MoveRight");
                    MpLog(std::string("[ForceVelocity] ") + buf);
                }
            }

            // [Analysis.md Section 13.E] Client-side ForceTeleport DISABLED.
            // Same reasoning as ForceVelocity — server-side possession fix should
            // make direct teleport unnecessary. Kept commented for escape hatch.
            //
            // uintptr_t rootCompForTP = SafeReadPtr(reinterpret_cast<uintptr_t>(Object), 0x0130);
            // if (rootCompForTP) { ... K2_SetActorLocation ... }
            static int s_tpDisabledLogCount = 0;
            if (++s_tpDisabledLogCount == 1) {
                MpLog("[ForceTeleport] DISABLED — relying on server-side RemoteRole fix");
            }
        }
    }

    // Track the PlayerController pointer at ClientRestart so the input-activation branch
    // above has a valid target. We deliberately do NOT call any input-related UFunctions
    // during ClientRestart itself — the previous Actor.EnableInput / SetInputMode_GameOnly
    // approach fired too early (loading UI still up) and was the wrong API for Dauntless.
    if (Function && Object
        && FunctionName == "Function Engine.PlayerController.ClientRestart")
    {
        UObject* NewPawn = Parms
            ? reinterpret_cast<UObject*>(SafeReadPtr(reinterpret_cast<uintptr_t>(Parms), 0))
            : nullptr;
        const bool NewPossession = Object != s_LastPossessedPC || NewPawn != s_LastRestartPawn;
        s_LastPossessedPC = Object;
        s_LastRestartPawn = NewPawn;
        s_LastPossessedWorld = *reinterpret_cast<void**>(Globals::BaseAddress + 0x06FC7F58);
        // ClientRestart is per possession, not per process. Seamless/map travel creates a new PC
        // and pawn, so the loadout/input/PlayerRole cascade must be re-armed for that possession.
        // Duplicate ClientRestart RPCs for the same PC+pawn do not re-arm it.
        if (NewPossession) {
            s_LastPossessedAtMs = GetTickCount64();
            s_ArchonInputActivated = false;
            s_ArchonInputActivationPending = false;
            s_NaturalInputModeChangedObserved = false;
            s_LastNaturalGameInput = -1;
            s_LastNaturalGameInputMs = 0;
            s_ArchonInputActivationDepth = 0;
            s_ProgressionHudRefreshPending = false;
            s_ProgressionHudRefreshAttempts = 0;
            s_ProgressionHudRefreshNotBeforeMs = 0;
            s_ClientRolePumpStablePC = nullptr;
            s_ClientRolePumpStablePawn = nullptr;
            s_ClientRolePumpStableSinceMs = 0;
            s_lastHealthyLocalPlayer = nullptr;
            s_lastHealthyLocalPlayerController = nullptr;
            s_controllerSplitReported = false;
            CtrlWatch::DisarmAll();
            ResetClientPlayerRoleRetryStateForTravel();
        }
        MpLog(std::string("[ClientRestartObserved] PC=") + Object->GetFullName()
            + " pawn=" + MpPtr(NewPawn)
            + " newPossession=" + std::to_string(NewPossession ? 1 : 0)
            + " activationRearmed=" + std::to_string(NewPossession ? 1 : 0)
            + " clientRolePumpSettleMs=" + std::to_string(kClientRolePumpTravelSettleMs)
            + " progressionHudRefreshRearmed=0(disabled)");
    }
}

static int NumTimesOnAirshipUpdated = 0;
bool DidDoTravelReset = false;

// [1.12 archon-input-activation helper — 2026-07-10]
// SEH-guarded byte read for arbitrary pointer + offset. Used to safely probe
// SEH-guarded byte read helper — used to inspect fields like
// bOnlineDataReady @ PC+0xC59 without risking an AV in ProcessEventClientHook
// (which holds std::string objects with destructors and therefore cannot host __try).
static uint8_t SafeReadByte(uintptr_t base, uintptr_t offset, uint8_t fallback) {
    __try {
        return *reinterpret_cast<uint8_t*>(base + offset);
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return fallback;
    }
}

// SEH-guarded byte write helper — mirror of SafeReadByte for setting fields like
// PC+0xC59 (bOnlineDataReady) without risking AV inside a __except-hostile function.
static bool SafeWriteByte(uintptr_t base, uintptr_t offset, uint8_t value) {
    __try {
        *reinterpret_cast<uint8_t*>(base + offset) = value;
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

// SEH-guarded float read helper — for reading axis event Parms[0] (the AxisValue
// float) without risking AV if Parms is somehow invalid.
static float SafeReadFloat(void* addr, float fallback) {
    __try {
        return *reinterpret_cast<float*>(addr);
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return fallback;
    }
}

// SEH-guarded pointer read helper — for indirection through Object+offset
// (e.g. pawn->CharacterMovement at pawn+0x288). Returns 0 on AV.
static uintptr_t SafeReadPtr(uintptr_t base, uintptr_t offset) {
    __try {
        return *reinterpret_cast<uintptr_t*>(base + offset);
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return 0;
    }
}

// [2026-07-23 TRIALS AIRSHIP HUD]
// Preserve the normal Dauntless presentation contract:
//   ArchonGameState.IsInPreMatchAirship == true  -> AArchonHUD::HideGameplayHUD
//   transition back to false                    -> AArchonHUD::ShowGameplayHUD once the game hands
//                                                  control to the player (since 10 Oct, see below)
//
// We intentionally invoke the game's native reflected functions instead of touching individual
// widgets or writing GameplayHUDVisibility directly. Party/chat and the airship Ready panel remain
// owned by the normal Blueprint. Only the combat HUD layer is reconciled. Calls are game-thread-only
// (all callers originate from ProcessEventClientHook / its synchronous activation cascade).

// [2026-07-24 CRASH FIX, round 3] A third Ramsgate<->Training crash (this one exiting training) came
// back with NEITHER the round-1 ([ApplyPlayerRole][RetryTimeout] FAULTED) NOR round-2
// ([ClientRolePump] FAULTED) guard having fired for the final, unlogged crash - both guards DID fire
// earlier in the same session and successfully caught faults, proving they work, but something else
// downstream still crashed. ReconcileAirshipGameplayHUD is called from FOUR places
// (input-activation, the pump - now guarded, OnAirshipStateUpdate, ShowGameplayHUD-family events, and
// TickProgressionHudRefresh) but only the pump call site was covered by round 2's wrapper - the other
// three (event-triggered, not periodic) were still fully unguarded. Worse, the risk here starts
// BEFORE the native call: `s_AirshipHUD->Class->GetFunction(...)` dereferences Class itself, which
// can be garbage if s_AirshipHUD's memory was repurposed after a level travel (same failure mode as
// rounds 1-2, just on a different cached pointer). Isolated the whole "resolve UFunction by name,
// then invoke it" sequence into this object-free (no std::string/RAII locals in this function's own
// frame - required for __try) guarded helper, called from BOTH branches below - this way every one
// of the four call sites is protected automatically, not just the pump.
enum class HudFnCallResult { Ok, NotFound, Faulted };
static HudFnCallResult CallHudLifecycleFunctionGuarded(UObject* HudObject, const char* Outer, const char* FuncName) {
    __try {
        if (!HudObject || !HudObject->Class) return HudFnCallResult::NotFound;
        UFunction* Fn = HudObject->Class->GetFunction(Outer, FuncName);
        if (!Fn) return HudFnCallResult::NotFound;
        if (OrigProcessEventClient) {
            reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(HudObject, Fn, nullptr);
        }
        return HudFnCallResult::Ok;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return HudFnCallResult::Faulted;
    }
}

// [1.14.7 FIX 2026-10-10, 38_ §21] The airship state ending is not the player getting control. In every
// 1.12 Escalation capture IsInPreMatchAirship went false while the airship UI was still up
// (airshipUIActive=1), ~3.1 s before the drop and ~19.6 s before the first walking input, so the
// immediate ShowGameplayHUD put the combat HUD over the launch and the arrival beam. The restore now
// waits for the game's own hand-over: a natural OnInputModeChanged(true) after the airship ended that
// stays true for kAirshipHudRestoreStableMs (the drop opens with a 6-8 ms true->false blip). If the
// game shows the HUD first, the native call is a no-op. The timeout keeps a missed edge from leaving
// the HUD hidden. IMMEDIATE_AIRSHIP_HUD_RESTORE.flag restores the old immediate restore.
static uint64_t s_AirshipEndedAtMs = 0;
static constexpr uint64_t kAirshipHudRestoreStableMs = 1000;
static constexpr uint64_t kAirshipHudRestoreTimeoutMs = 45000;
// Hide/Show fire OnHUDVisibilityChanged, which is itself a reconcile trigger; skip that nested call.
// Set only around CallHudLifecycleFunctionGuarded, which catches every fault, so it always clears.
static bool s_AirshipHUDReconcileBusy = false;

static void ReconcileAirshipGameplayHUD(const char* TriggerLabel) {
    if (Globals::AmServer || !OrigProcessEventClient || !s_AirshipHUD || !s_AirshipGameState) return;
    if (s_AirshipHUDReconcileBusy) return;
    // [2026-07-24 ROOT-CAUSE FIX] s_AirshipHUD / s_AirshipGameState are cached at OnAirshipStateUpdate
    // and belong to a specific world. A level travel destroys them while their pointers stay readable
    // (recycled memory), so the IsReadablePointer/->Class checks below would pass on a dead object and
    // the native HUD calls would fault. Confirm both are still live registered objects first; if the
    // travel destroyed them, clear the cache (a fresh airship update in the new world re-populates it)
    // and bail without touching native code. The hidden state died with that HUD, so forget it too.
    if (!IsRegisteredLiveObject(s_AirshipHUD) || !IsRegisteredLiveObject(s_AirshipGameState)) {
        s_AirshipHUD = nullptr;
        s_AirshipGameState = nullptr;
        s_AirshipHUDCompatHidden = false;
        s_AirshipEndedAtMs = 0;
        return;
    }
    if (!IsReadablePointer(s_AirshipHUD, 0x522)
        || !IsReadablePointer(s_AirshipGameState, 0x2D1)
        || !s_AirshipHUD->Class) {
        return;
    }

    const uint8_t InPreMatchAirship = SafeReadByte(
        reinterpret_cast<uintptr_t>(s_AirshipGameState), 0x2D0, 0xEE);
    const uint8_t VisibilityBefore = SafeReadByte(
        reinterpret_cast<uintptr_t>(s_AirshipHUD), 0x361, 0xEE);
    const uint8_t AirshipUIActive = SafeReadByte(
        reinterpret_cast<uintptr_t>(s_AirshipHUD), 0x520, 0xEE);

    if (InPreMatchAirship == 1) {
        s_AirshipEndedAtMs = 0;
        s_AirshipHUDReconcileBusy = true;
        const HudFnCallResult HideResult = CallHudLifecycleFunctionGuarded(s_AirshipHUD, "ArchonHUD", "HideGameplayHUD");
        s_AirshipHUDReconcileBusy = false;
        if (HideResult == HudFnCallResult::Faulted) {
            MpLog(std::string("[AirshipHUD] FAULTED calling HideGameplayHUD trigger=") + TriggerLabel
                + " hud=" + MpPtr(s_AirshipHUD)
                + " (stale pointer, likely a level travel repurposed this object's memory) - caught, skipping");
            return;
        }
        if (HideResult == HudFnCallResult::NotFound) {
            static bool s_LoggedMissingHide = false;
            if (!s_LoggedMissingHide) {
                s_LoggedMissingHide = true;
                MpLog("[AirshipHUD] HideGameplayHUD UFunction not found");
            }
            return;
        }

        const uint8_t VisibilityAfter = SafeReadByte(
            reinterpret_cast<uintptr_t>(s_AirshipHUD), 0x361, 0xEE);

        static int s_HideLogCount = 0;
        if (!s_AirshipHUDCompatHidden || VisibilityBefore != VisibilityAfter || s_HideLogCount == 0) {
            if (s_HideLogCount++ < 32) {
                MpLog(std::string("[AirshipHUD] HIDE trigger=") + TriggerLabel
                    + " hud=" + MpPtr(s_AirshipHUD)
                    + " gameState=" + MpPtr(s_AirshipGameState)
                    + " inPreMatchAirship=1"
                    + " airshipUIActive=" + std::to_string(AirshipUIActive)
                    + " gameplayVisibility=" + std::to_string(VisibilityBefore)
                    + "->" + std::to_string(VisibilityAfter));
            }
        }
        s_AirshipHUDCompatHidden = true;
        return;
    }

    if (InPreMatchAirship == 0 && s_AirshipHUDCompatHidden) {
        static int s_ImmediateRestore = -1;
        if (s_ImmediateRestore < 0) {
            s_ImmediateRestore = MpExeRelativeFlagPresent(L"IMMEDIATE_AIRSHIP_HUD_RESTORE.flag") ? 1 : 0;
            MpLog(std::string("[AirshipHUD] restore waits for the player's control: ")
                + (s_ImmediateRestore ? "OFF (IMMEDIATE_AIRSHIP_HUD_RESTORE.flag present)" : "ON (default)"));
        }
        const uint64_t Now = GetTickCount64();
        const char* RestoreReason = "immediate";
        if (s_ImmediateRestore != 1) {
            if (s_AirshipEndedAtMs == 0) {
                s_AirshipEndedAtMs = Now;
                MpLog(std::string("[AirshipHUD] airship ended trigger=") + TriggerLabel
                    + " airshipUIActive=" + std::to_string(AirshipUIActive)
                    + " gameplayVisibility=" + std::to_string(VisibilityBefore)
                    + " gameInput=" + std::to_string(s_LastNaturalGameInput)
                    + " - combat HUD stays hidden until the game hands control to the player");
            }
            const bool ControlGiven = s_LastNaturalGameInput == 1
                && s_LastNaturalGameInputMs >= s_AirshipEndedAtMs
                && Now - s_LastNaturalGameInputMs >= kAirshipHudRestoreStableMs;
            const bool TimedOut = Now - s_AirshipEndedAtMs >= kAirshipHudRestoreTimeoutMs;
            if (!ControlGiven && !TimedOut) {
                return;
            }
            RestoreReason = ControlGiven ? "player-control" : "timeout";
        }
        const uint64_t SinceAirshipEndMs = s_AirshipEndedAtMs != 0 ? Now - s_AirshipEndedAtMs : 0;

        s_AirshipHUDReconcileBusy = true;
        const HudFnCallResult ShowResult = CallHudLifecycleFunctionGuarded(s_AirshipHUD, "ArchonHUD", "ShowGameplayHUD");
        s_AirshipHUDReconcileBusy = false;
        if (ShowResult == HudFnCallResult::Faulted) {
            MpLog(std::string("[AirshipHUD] FAULTED calling ShowGameplayHUD trigger=") + TriggerLabel
                + " hud=" + MpPtr(s_AirshipHUD)
                + " (stale pointer, likely a level travel repurposed this object's memory) - caught, skipping");
            return;
        }
        if (ShowResult == HudFnCallResult::NotFound) {
            static bool s_LoggedMissingShow = false;
            if (!s_LoggedMissingShow) {
                s_LoggedMissingShow = true;
                MpLog("[AirshipHUD] ShowGameplayHUD UFunction not found");
            }
            return;
        }

        const uint8_t VisibilityAfter = SafeReadByte(
            reinterpret_cast<uintptr_t>(s_AirshipHUD), 0x361, 0xEE);
        MpLog(std::string("[AirshipHUD] RESTORE trigger=") + TriggerLabel
            + " reason=" + RestoreReason
            + " sinceAirshipEndMs=" + std::to_string(SinceAirshipEndMs)
            + " hud=" + MpPtr(s_AirshipHUD)
            + " gameState=" + MpPtr(s_AirshipGameState)
            + " inPreMatchAirship=0"
            + " airshipUIActive=" + std::to_string(AirshipUIActive)
            + " gameplayVisibility=" + std::to_string(VisibilityBefore)
            + "->" + std::to_string(VisibilityAfter));
        s_AirshipHUDCompatHidden = false;
        s_AirshipEndedAtMs = 0;
    }
}

// [move2.md 2026-07-10 PHASE A] SEH-guarded uint8 reader. Used by
// ArchonLoadManagerLoadFailedHook to safely read the loader's "loaded" bool at
// object+0x10. Returns -1 on AV so caller can log a distinguishable value.
static int SafeReadU8At(uintptr_t base, uintptr_t offset) {
    __try {
        return static_cast<int>(*reinterpret_cast<uint8_t*>(base + offset));
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return -1;
    }
}

// [move2.md 2026-07-10 PHASE A] SEH-guarded int32 reader. Used to read the loader
// array count at LoadManager+0x50. Returns -1 on AV.
static int32_t SafeReadI32At(uintptr_t base, uintptr_t offset) {
    __try {
        return *reinterpret_cast<int32_t*>(base + offset);
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return -1;
    }
}

// [2026-07-23 RAMSGATE WEAPON-XP HUD]
// ClientRestart can create the HUD before our private-server bootstrap has selected the active
// loadout and before bOnlineDataReady becomes true. The BP weapon experience bar then keeps its
// cooked placeholder (level 0, 8,888 / 100,000) for the entire Ramsgate visit. Persistence is not
// involved: the server has already loaded the correct inventory and weapon progression.
//
// Re-enter only the game's public/reflected HUD boundary after every dependency is ready. We never
// write XP/rank/threshold fields and, critically, we do not call InitializeExperiences here. Ghidra
// confirms that routine sets its one-time initialized guard even when ExperienceTable is null; the
// old compatibility retry could therefore freeze the component with an empty Experiences array.
// We now wait for the game's natural component lifecycle and replay only BPH_ArchonHUD's own
// Progression HUD Ready event after Experiences is populated. The retry is bounded and re-armed only
// for a new possession.
// [2026-07-23 basic tracking] Permanent, low-volume heartbeat for this whole feature. The bug is
// intermittent - confirmed working on some sessions, and a fresh repro (pid=20520) showed the arm
// event firing (ClientRestartObserved ... progressionHudRefreshRearmed=1) and ArchonInputActivate
// completing normally, but ZERO [WeaponXP][HudInit] output of any kind, including the "blocked at
// top guard" line below that should fire unconditionally once armed. That means either this
// function's body isn't being reached at all for some sessions (something upstream of every
// condition already checked), or the underlying race resolves favorably on its own often enough that
// there is nothing to observe. Rather than add another one-shot diagnostic and hope for a specific
// repro, this stays in place indefinitely at a cost cheap enough to leave on permanently: logs once
// every ~5s (independent of arm state, so it proves the function is even being CALLED every session,
// not just when something is pending) with a running call count and the current pending/attempts
// state. When the placeholder is next seen, grep this marker across the whole session - if the call
// count is 0 or stops advancing, the function itself stopped being invoked; if it keeps advancing
// with pending=0 the whole time, the arm never happened for that repro; if pending=1 with attempts
// climbing, the existing per-attempt logging below takes over.
static void TickProgressionHudRefreshHeartbeat() {
    static uint64_t s_calls = 0;
    static uint64_t s_lastHeartbeatMs = 0;
    ++s_calls;
    const uint64_t Now = GetTickCount64();
    if (s_lastHeartbeatMs != 0 && Now - s_lastHeartbeatMs < 5000) return;
    s_lastHeartbeatMs = Now;
    MpLog("[WeaponXP][HudInit][Heartbeat] calls=" + std::to_string(s_calls)
        + " pending=" + std::to_string(s_ProgressionHudRefreshPending ? 1 : 0)
        + " attempts=" + std::to_string(s_ProgressionHudRefreshAttempts)
        + " ArchonInputActivated=" + std::to_string(s_ArchonInputActivated ? 1 : 0)
        + " LastPossessedPC=" + MpPtr(s_LastPossessedPC));
}

static void TickProgressionHudRefreshInner() {
    if (!s_ProgressionHudRefreshPending) return;   // nothing armed - nothing to diagnose

    // [2026-07-23 diagnostic] A live repro reported the placeholder still showing on a cold first
    // join, with NOT ONE [WeaponXP][HudInit] line anywhere in the client log for the whole session -
    // not "waiting", not "giving up", nothing. That means execution never even reached the loop body
    // below; it was returning from ONE of the five conditions in the combined guard every single
    // time. Static review ruled out DiagNaturalMode (sentinel file absent) and OrigProcessEventClient
    // (its MH_CreateHook logged create=MH_OK/enable=MH_OK for this exact session), but that was
    // inference, not proof - the combined `||` guard gives no way to tell which condition actually
    // fired. Split it so the NEXT capture states the answer directly instead of needing another round
    // of static analysis. Throttled to once/2s while blocked - this only runs at all while a refresh
    // is armed and unresolved, so it is self-limiting (stops on success, on give-up, or on the next
    // possession clearing s_ProgressionHudRefreshPending).
    static uint64_t s_lastGuardLogMs = 0;
    const uint64_t NowGuard = GetTickCount64();
    const bool GuardBlocked = Globals::AmServer || DiagNaturalMode() || !OrigProcessEventClient
        || !s_ArchonInputActivated || !s_LastPossessedPC;
    if (GuardBlocked) {
        if (s_lastGuardLogMs == 0 || NowGuard - s_lastGuardLogMs >= 2000) {
            s_lastGuardLogMs = NowGuard;
            MpLog("[WeaponXP][HudInit] blocked at top guard: AmServer="
                + std::to_string(Globals::AmServer ? 1 : 0)
                + " DiagNaturalMode=" + std::to_string(DiagNaturalMode() ? 1 : 0)
                + " OrigProcessEventClient=" + MpPtr(OrigProcessEventClient)
                + " ArchonInputActivated=" + std::to_string(s_ArchonInputActivated ? 1 : 0)
                + " LastPossessedPC=" + MpPtr(s_LastPossessedPC));
        }
        return;
    }

    const uint64_t Now = GetTickCount64();
    if (Now < s_ProgressionHudRefreshNotBeforeMs) return;

    // [2026-07-23 correction] kMaxAttempts=12 (~13.5s total budget with the 1.5s initial delay) was
    // validated against a repro where bOnlineDataReady went ready only 3s after ClientRestart - a warm
    // re-possession (e.g. returning from Training). Reported regression: the refresh still fails on a
    // genuinely COLD first join (fresh login: auth, initial account/inventory/progression bootstrap)
    // but works on the very next possession (Training -> Ramsgate). That is exactly the shape you'd
    // expect if cold-start readiness sometimes exceeds the old ~13.5s ceiling while a warm travel
    // finishes well inside it - the give-up path (`s_ProgressionHudRefreshAttempts >= kMaxAttempts`)
    // would fire before Progression/PlayerExperience/HUD ever become ready. Widened to a much more
    // generous ceiling; this is a bounded, self-terminating poll (1/sec, a handful of pointer reads +
    // UFunction calls, stops on success or on this ceiling) so a longer ceiling costs nothing extra
    // once the HUD is already ready - it just gives a slow cold boot enough room to finish.
    constexpr uint32_t kMaxAttempts = 45;
    constexpr uint64_t kRetryDelayMs = 1000;
    ++s_ProgressionHudRefreshAttempts;
    s_ProgressionHudRefreshNotBeforeMs = Now + kRetryDelayMs;

    MpForgetPossessionIfWorldChanged();
    UObject* PC = s_LastPossessedPC;
    // [2026-07-24 ROOT-CAUSE FIX] PC is the cached s_LastPossessedPC; a level travel destroys it while
    // the pointer stays readable. Confirm it is still a live registered object before the native
    // GetProgressionComponent/GetPlayerExperienceComponent/GetHUD/InitializeExperiences calls below;
    // if the travel destroyed it, stop this session's refresh rather than faulting into game code.
    if (!IsRegisteredLiveObject(PC)) {
        s_ProgressionHudRefreshPending = false;
        return;
    }
    const uint8_t OnlineReady = SafeReadByte(reinterpret_cast<uintptr_t>(PC), 0xC69, 0xEE);
    if (OnlineReady != 1 || !PC->Class) {
        if (s_ProgressionHudRefreshAttempts >= kMaxAttempts) {
            MpLog("[WeaponXP][HudInit] giving up: player controller never became online-ready");
            s_ProgressionHudRefreshPending = false;
        }
        return;
    }

    static UFunction* s_GetProgressionFn = nullptr;
    static UFunction* s_GetPlayerExperienceFn = nullptr;
    static UFunction* s_GetHUDFn = nullptr;
    if (!s_GetProgressionFn) {
        s_GetProgressionFn = PC->Class->GetFunction(
            "ArchonPlayerController", "GetProgressionComponent");
    }
    if (!s_GetPlayerExperienceFn) {
        s_GetPlayerExperienceFn = PC->Class->GetFunction(
            "ArchonPlayerController", "GetPlayerExperienceComponent");
    }
    if (!s_GetHUDFn) {
        s_GetHUDFn = PC->Class->GetFunction("PlayerController", "GetHUD");
    }

    UObject* Progression = nullptr;
    UObject* PlayerExperience = nullptr;
    UObject* HUD = nullptr;
    if (s_GetProgressionFn) {
        struct { UObject* ReturnValue; } Parms = { nullptr };
        reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
            PC, s_GetProgressionFn, &Parms);
        Progression = Parms.ReturnValue;
    }
    if (s_GetPlayerExperienceFn) {
        struct { UObject* ReturnValue; } Parms = { nullptr };
        reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
            PC, s_GetPlayerExperienceFn, &Parms);
        PlayerExperience = Parms.ReturnValue;
    }
    if (s_GetHUDFn) {
        struct { UObject* ReturnValue; } Parms = { nullptr };
        reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
            PC, s_GetHUDFn, &Parms);
        HUD = Parms.ReturnValue;
    }

    const int ProgressionReady = Progression
        ? SafeReadU8At(reinterpret_cast<uintptr_t>(Progression), 0x290) : -1;
    int ExperienceCount = PlayerExperience
        ? SafeReadI32At(reinterpret_cast<uintptr_t>(PlayerExperience), 0x140) : -1;

    if (!Progression || !PlayerExperience || !HUD || ProgressionReady != 1) {
        if (s_ProgressionHudRefreshAttempts == 1
            || s_ProgressionHudRefreshAttempts == kMaxAttempts) {
            MpLog("[WeaponXP][HudInit] waiting attempt="
                + std::to_string(s_ProgressionHudRefreshAttempts)
                + " progression=" + MpPtr(Progression)
                + " progressionReady=" + std::to_string(ProgressionReady)
                + " playerExperience=" + MpPtr(PlayerExperience)
                + " experienceCount=" + std::to_string(ExperienceCount)
                + " hud=" + MpPtr(HUD));
        }
        if (s_ProgressionHudRefreshAttempts >= kMaxAttempts) {
            MpLog("[WeaponXP][HudInit] giving up after bounded readiness retries");
            s_ProgressionHudRefreshPending = false;
        }
        return;
    }

    if (ExperienceCount <= 0) {
        // [2026-07-27] Do not call InitializeExperiences from this HUD retry. Native 1.12 sets the
        // component's one-time initialized flag at +0x1B8 even when ExperienceTable (+0x130) is null,
        // so invoking it early can permanently produce a successful return with Experiences.Num=0.
        // Compare the live instance against its class default object (UClass::ClassDefaultObject
        // +0x118) to distinguish missing Blueprint defaults from an instance-construction/copy defect.
        const uintptr_t PlayerExperienceAddress = reinterpret_cast<uintptr_t>(PlayerExperience);
        const uintptr_t ExperienceTablePtr = SafeReadPtr(PlayerExperienceAddress, 0x130);
        const uintptr_t ExperienceTrackTablePtr = SafeReadPtr(PlayerExperienceAddress, 0x148);
        const int InitializeGuard = SafeReadU8At(PlayerExperienceAddress, 0x1B8);
        const uintptr_t ExperienceClassPtr = reinterpret_cast<uintptr_t>(PlayerExperience->Class);
        const uintptr_t ExperienceCdoPtr = ExperienceClassPtr
            ? SafeReadPtr(ExperienceClassPtr, 0x118) : 0;
        const uintptr_t CdoExperienceTablePtr = ExperienceCdoPtr
            ? SafeReadPtr(ExperienceCdoPtr, 0x130) : 0;
        const uintptr_t CdoExperienceTrackTablePtr = ExperienceCdoPtr
            ? SafeReadPtr(ExperienceCdoPtr, 0x148) : 0;
        const std::string ExperienceClassName = PlayerExperience->Class
            ? PlayerExperience->Class->GetName() : std::string("(null)");

        if (s_ProgressionHudRefreshAttempts == 1
            || s_ProgressionHudRefreshAttempts == kMaxAttempts
            || (s_ProgressionHudRefreshAttempts % 5) == 0) {
            MpLog("[WeaponXP][HudInit] waiting for natural experience initialization attempt="
                + std::to_string(s_ProgressionHudRefreshAttempts)
                + " class=" + ExperienceClassName
                + " experienceCount=" + std::to_string(ExperienceCount)
                + " initializeGuard=" + std::to_string(InitializeGuard)
                + " experienceTable=" + MpPtr(reinterpret_cast<void*>(ExperienceTablePtr))
                + " experienceTrackTable=" + MpPtr(reinterpret_cast<void*>(ExperienceTrackTablePtr))
                + " cdo=" + MpPtr(reinterpret_cast<void*>(ExperienceCdoPtr))
                + " cdoExperienceTable=" + MpPtr(reinterpret_cast<void*>(CdoExperienceTablePtr))
                + " cdoExperienceTrackTable=" + MpPtr(reinterpret_cast<void*>(CdoExperienceTrackTablePtr)));
        }
        if (s_ProgressionHudRefreshAttempts >= kMaxAttempts) {
            MpLog("[WeaponXP][HudInit] giving up: natural experience lifecycle never populated Experiences");
            s_ProgressionHudRefreshPending = false;
        }
        return;
    }

    UFunction* ProgressionHudReadyFn = HUD->Class
        ? HUD->Class->GetFunction("BPH_ArchonHUD_C", "Progression HUD Ready") : nullptr;
    bool UsedComponentFallback = false;
    if (ProgressionHudReadyFn) {
        reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
            HUD, ProgressionHudReadyFn, nullptr);
    }
    else if (Progression->Class) {
        ProgressionHudReadyFn = Progression->Class->GetFunction(
            "ProgressionComponent", "OnPlayerHUDReady");
        if (ProgressionHudReadyFn) {
            UsedComponentFallback = true;
            reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
                Progression, ProgressionHudReadyFn, nullptr);
        }
    }

    if (!ProgressionHudReadyFn) {
        MpLog("[WeaponXP][HudInit] no Progression HUD Ready function found");
        if (s_ProgressionHudRefreshAttempts >= kMaxAttempts) {
            s_ProgressionHudRefreshPending = false;
        }
        return;
    }

    MpLog("[WeaponXP][HudInit] refreshed native progression HUD"
        " attempt=" + std::to_string(s_ProgressionHudRefreshAttempts)
        + " progressionReady=" + std::to_string(ProgressionReady)
        + " experienceCount=" + std::to_string(ExperienceCount)
        + " naturalExperienceLifecycle=1"
        + " componentFallback=" + std::to_string(UsedComponentFallback ? 1 : 0));
    s_ProgressionHudRefreshPending = false;

    // Progression HUD Ready can show the combat layer. Preserve the separate airship contract.
    ReconcileAirshipGameplayHUD("progression-hud-refresh");
}

// [2026-07-24 CRASH FIX, round 3 continued] TickProgressionHudRefreshInner (above) chases the same
// potentially-stale s_LastPossessedPC through several native OrigProcessEventClient calls
// (GetProgressionComponent, GetPlayerExperienceComponent, GetHUD, Progression HUD Ready) as the
// ApplyPlayerRole/AirshipHUD crash sites fixed earlier the same day -
// same risk (a level travel can repurpose the memory s_LastPossessedPC points at), just not yet
// hardened. Object-free wrapper (required for __try - TickProgressionHudRefreshInner itself is full
// of std::string/MpLog and can't host __try directly) so a fault here is caught instead of crashing.
static bool TickProgressionHudRefreshGuarded() {
    __try {
        TickProgressionHudRefreshInner();
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

static void TickProgressionHudRefresh() {
    TickProgressionHudRefreshHeartbeat();   // unconditional - proves this function is even being called
    if (!TickProgressionHudRefreshGuarded()) {
        MpLog("[WeaponXP][HudInit] FAULTED (stale pointer, likely a level travel repurposed the"
            " cached player controller) - caught, giving up for this session instead of crashing");
        s_ProgressionHudRefreshPending = false;
    }
}

// SEH-guarded float write helper — for writing FVector components (X/Y/Z).
static bool SafeWriteFloat(uintptr_t base, uintptr_t offset, float value) {
    __try {
        *reinterpret_cast<float*>(base + offset) = value;
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

void* OrigProcessEvent = nullptr;

// [1.12.0] SEH-guarded invoker for UNetConnection::SetClientWorldPackageName helper
// at RVA 0x03D64090. Extracted so that __try can live in a function that doesn't
// hold C++ objects requiring unwind (ProcessEventHook holds std::string).
static bool SafeSetClientWorldPackageName(void* NetConn, uint64_t FNameValue) {
    using SetCWPNFn = void(__fastcall*)(void*, uint64_t);
    auto SetCWPN = reinterpret_cast<SetCWPNFn>(Globals::BaseAddress + 0x03F7F050);
    __try {
        SetCWPN(NetConn, FNameValue);
        return true;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

// [Group E2 cleanup 2026-07-13] ShouldTraceLoadEvent removed (unused load-marker allowlist; both LoadTrace loggers already gone).

// [CatalogDump 2026-07-11] Authoritative in-build equipment-catalog enumeration.
//
// Purpose: settle the loading-screen hang's weapon rejection. Server rejects our equipped
// weapon ("Can't find catalog id WP_EB_FROSTFALL_L1" -> "ValidateItemSlot - Unable to set
// valid Weapon" -> "Loadout slot data could not be initialized. Loading can't continue!").
// Two hypotheses:
//   (A) the id is genuinely absent from THIS build's paks (captured data is CL 682486 /
//       2025 service; our client is CL 392819 -> content drift), or
//   (B) the dedicated server's catalog loader failed to load the weapon table.
//
// Method (pure reads, no ProcessEvent / no GetArchonCatalog / no WorldContext): walk GObjects
// for every UEquipmentCatalogItem-derived object and read its ItemId FName directly. Per SDK
// Archon_classes.hpp: `class UEquipmentCatalogItem : public UObject { FName ItemId; // 0x0028 }`.
// The five concrete subclasses (Items_Analysis/sdk_runtime_catalog_object_counts.csv, from the
// live 1.12 object dump) are EquipmentCatalogItem_{Weapon,Armour,Lantern,PlayerRole,WeaponPart}
// with live counts 688/599/131/6/136.
//   -> weapon count ~688 AND WP_EB_FROSTFALL_L1 MISSING  => hypothesis (A): equip a listed weapon.
//   -> weapon count ~0                                    => hypothesis (B): fix the loader.
// The full logged id list is the authoritative valid-ID set to validate every captured item against.
// [Group E cleanup 2026-07-13] DumpEquipmentCatalog removed — in-build catalog enumeration is now done by the
// standalone CatalogExporter injectable (Items_Analysis/catalog_1_12.jsonl), not the live server DLL.

// [Group D2 cleanup 2026-07-13] GetFunctionCallspaceHook + OrigGetFunctionCallspace removed ([Callspace] probe; passthrough+logging).

// [Group D2 cleanup 2026-07-13] OwnerCallspaceHook + OrigOwnerCallspace removed ([OwnerCallspace] probe; passthrough+logging).

// [Group D2 cleanup 2026-07-13] ActorNetModeHook + OrigActorNetMode removed ([NetMode] probe; passthrough+logging).

// [2026-07-18 CORE-CAP] Read a UE FString ({wchar_t* Data; int32 Num; int32 Max}) into a narrow
// std::string for diagnostics. catalogIds/instanceIds/sources are ASCII, so a low-byte copy is fine.
// Fully guarded — never dereferences without IsReadablePointer, bounded length.
std::string CoreCapFString(void* fstr) {
    if (!IsReadablePointer(fstr, 0x0C)) return "";
    wchar_t* Data = *reinterpret_cast<wchar_t**>(fstr);
    int32_t Num = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(fstr) + 0x8);
    if (!Data || Num <= 0 || Num > 1024 || !IsReadablePointer(Data, 2)) return "";
    std::string Out;
    Out.reserve(Num);
    for (int i = 0; i < Num && Data[i] != L'\0'; ++i) Out += static_cast<char>(Data[i] & 0xFF);
    return Out;
}

// [2026-07-22 SHOCK ESCALATION PARTY TRACE] Passive, bounded tracing for the owner-only
// crystal -> relic-choice -> selection -> release chain. The failing three-player repro proved the
// global round transition and all three connections stayed healthy, but existing logs did not expose
// which per-player edge diverged. This logger changes no state and is always available for the next
// intermittent repro; the relic chain and the charge mutators have independent call budgets
// (kEscalationRelicTraceMax / kPlayerRoleChargeTraceMax) so dodge-driven charge traffic cannot
// starve the once-per-round amp-selection evidence.
static bool IsEscalationFlowFunction(const std::string& FunctionName) {
    const char* Markers[] = {
        "EscalationGameModeComponent.SpawnPlayerBuffChoicesForFinishedRound",
        "EscalationGameModeComponent.OnPlayerActivatedCrystal",
        "EscalationGameModeComponent.PlayerChoseRelic",
        "EscalationGameModeComponent.PlayerEscalationRelicsChanged",
        "EscalationGameModeComponent.RelicSelectedBP",
        "EscalationGameModeComponent.SpawnAllRelics",
        "EscalationGameModeComponent.SpawnRelics",
        "EscalationGameModeComponent.SpawnSpecificRelic",
        "EscalationGameModeComponent.SpawnPersonalBuffPickupsForPlayer",
        "PlayerEscalationComponent.ClientDisplayRelicChoiceUI",
        "PlayerEscalationComponent.OnRep_EscalationRelics",
        "PlayerEscalationComponent.OnShowRelicChoiceScreen",
        "PlayerEscalationComponent.RoundEnded",
        "PlayerEscalationComponent.SelectRelicOption",
        "PlayerEscalationComponent.ServerSelectRelicOption",
        "PlayerEscalationComponent.ServerForceReplication",
        "PlayerEscalationComponent.RelicSelectedNative",
        "PlayerEscalationComponent.OnRelicSelected",
        "escalation_buff_gatherable_bp_C.OnInteractionEnabled",
        "escalation_buff_gatherable_bp_C.OnCrystalActivated",
        "escalation_buff_gatherable_bp_C.Failsafe_EnableInteraction",
        "escalation_buff_gatherable_bp_C.OnUserCanceledInteraction",
        "escalation_buff_gatherable_bp_C.OnUserStartedInteraction",
        "escalation_buff_gatherable_bp_C.OnUserCompletedInteraction",
        "escalation_buff_gatherable_bp_C.AuthEnableInteractable",
        "EscalationRelicChoiceScreen.EnableRelicInteractions",
        "EscalationRelicChoiceScreen.HandleRelicSelected",
        "EscalationRelicChoiceScreen.OnRelicSelected",
        "escalation_relic_choice_screen_C.EnableRelicInteraction",
        "escalation_relic_choice_screen_C.BeginRelicAnimations",
        // [2026-07-25] The stuck-amp repro showed ClientDisplayRelicChoiceUI arriving on the owning
        // client with relicOptions=3 in the RPC payload, and then nothing at all: no animation start,
        // no interaction enable, no selection. The markers above only cover the screen's outer edges,
        // so it was impossible to tell whether the screen was built, whether the cards were ever made
        // clickable, or whether a click fired and the selection RPC was lost. These four close that
        // gap - EnableInteract is the per-card gate, HandleButtonClicked is the click itself.
        "escalation_relic_choice_screen_C.Construct",
        "escalation_relic_choice_screen_C.StartNextRelicAnimation",
        "EscalationRelicChoiceWidget.EnableInteract",
        "EscalationRelicChoiceWidget.HandleButtonClicked",
        // [2026-07-25 UNLIMITED OMNICELL CHARGE] ~6/10 party sessions where the Omnicell does fire,
        // the charge is never consumed and it can be spammed. AArchonPlayerRole::AbilityCharge is an
        // FLazyEvalStatistic (+0x348) whose current value is derived from value/rate/lastUpdateTime,
        // so "not consumed" means either ClearAbilityCharge was never dispatched after activation, or
        // it ran and the statistic did not actually move. Tracing these three through the existing
        // ENTER/EXIT bracket gives a before/after charge snapshot per call, which separates those two
        // cases directly. AddAbilityCharge is the dodge-side accumulate; Fill is the debug/refill path.
        "ArchonPlayerRole.ClearAbilityCharge",
        "ArchonPlayerRole.AddAbilityCharge",
        "ArchonPlayerRole.FillAbilityCharge",
        // [2026-07-25 AMP ROOT CAUSE] UEscalationGameModeComponent::SpawnPlayerBuffChoicesForFinishedRound
        // is what gives EVERY player their own relic pickups: its body iterates the full
        // PlayerControllerIterator and calls SpawnPersonalBuffPickupsForPlayer per player. Ghidra xrefs
        // on the implementation (FUN_1419d12f0) show three DATA refs plus exactly ONE code ref - its own
        // exec thunk - so ProcessEvent is the only possible caller and the tracer therefore sees every
        // invocation. It logged zero, so the function truly never runs, which is why the party shares
        // the single level-placed escalation_buff_gatherable actor and the first interactor wins.
        //
        // It is BlueprintCallable, so the caller is the Escalation BP graph, driven by the state
        // machine (rounds are "Events": ... InEvent=6, EventEnding=7, EventSummary=8, BetweenEvents=9).
        // Trace the state machine and the round-finished handlers to determine whether the mode ever
        // reaches the state whose BP handler should call the spawn, or reaches it and does nothing.
        "EscalationGameStateComponent.AuthTrySetState",
        "EscalationGameStateComponent.InternalOnStateChange",
        "EscalationGameStateComponent.OnRep_CurrentState",
        "EscalationGameStateComponent.SetCurrentRound",
        "EscalationGameStateComponent.SetCurrentChallengeLevel",
        "EscalationGameStateComponent.AdvanceToNextState",
        "EscalationGameStateComponent.GameModeContentFinished",
        "EscalationGameModeComponent.AuthGameStateChanged",
        "EscalationGameModeComponent.AuthOnGameStateChanged",
        "EscalationGameModeComponent.AuthOnRoundContentFinished",
        "EscalationGameModeComponent.AuthStartContentsForRound",
        "EscalationGameModeComponent.AuthCleanupActiveContentForRound",
        "EscalationGameModeComponent.PrepareEncounterForRound",
        "EscalationGameModeComponent.StartEncounterForRound",
        "EscalationGameModeComponent.EndOfHuntStarted"
    };
    for (const char* Marker : Markers) {
        if (FunctionName.find(Marker) != std::string::npos) return true;
    }
    return false;
}

static UObject* ResolveEscalationFlowPlayer(UObject* Object, const std::string& FunctionName,
                                            void* Parms, const char* Side) {
    const bool FirstParamIsPlayer =
        FunctionName.find("OnPlayerActivatedCrystal") != std::string::npos
        || FunctionName.find("PlayerChoseRelic") != std::string::npos
        || FunctionName.find("RelicSelectedNative") != std::string::npos
        || FunctionName.find("RelicSelectedBP") != std::string::npos
        || FunctionName.find("SpawnAllRelics") != std::string::npos
        || FunctionName.find("SpawnRelics") != std::string::npos
        || FunctionName.find("SpawnSpecificRelic") != std::string::npos
        || FunctionName.find("SpawnPersonalBuffPickupsForPlayer") != std::string::npos;
    if (FirstParamIsPlayer && Parms && IsReadablePointer(Parms, sizeof(void*))) {
        UObject* Player = *reinterpret_cast<UObject**>(Parms);
        if (Player && IsReadablePointer(Player, 0x258)
            && IsRegisteredLiveObject(Player)
            && Player->IsA(SDK::APlayerController::StaticClass())) return Player;
    }

    // The crystal Blueprint caches the interacting controller at its SDK-verified +0x4F8 field.
    if (Object && FunctionName.find("escalation_buff_gatherable_bp_C.") != std::string::npos
        && IsReadablePointer(Object, 0x500)) {
        UObject* Player = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(Object) + 0x4F8);
        if (Player && IsReadablePointer(Player, 0x258)
            && IsRegisteredLiveObject(Player)
            && Player->IsA(SDK::APlayerController::StaticClass())) return Player;
    }

    // PlayerEscalationComponent is controller-owned. Walk a short Outer chain so derived/BP component
    // instances still resolve without hardcoding a controller-component array offset.
    UObject* Cursor = Object;
    for (int Depth = 0; Cursor && Depth < 4; ++Depth) {
        if (!IsReadablePointer(Cursor, 0x28) || !IsRegisteredLiveObject(Cursor)) break;
        if (Cursor->IsA(SDK::APlayerController::StaticClass())) return Cursor;
        Cursor = Cursor->Outer;
    }

    // Client widget calls are not outered to the controller; correlate them with the current local
    // possession captured by ClientRestart.
    if (Side && strcmp(Side, "Client") == 0 && s_LastPossessedPC
        && IsReadablePointer(s_LastPossessedPC, 0x258)
        && IsRegisteredLiveObject(s_LastPossessedPC)
        && s_LastPossessedPC->IsA(SDK::APlayerController::StaticClass())) {
        return s_LastPossessedPC;
    }
    return nullptr;
}

// [2026-07-25] EEscalationGameModeState (Archon_structs.hpp). Rounds are modelled as "Events", so the
// per-player relic spawn belongs somewhere in EventEnding/EventSummary/BetweenEvents. Decode the raw
// byte so the log is readable without cross-referencing the enum every time.
static const char* EscalationStateName(int State) {
    switch (State) {
        case 0:  return "None";
        case 1:  return "GameNotStarted";
        case 2:  return "InitialPreloading";
        case 3:  return "GameStarting";
        case 4:  return "EventAnnounce";
        case 5:  return "EventBeginning";
        case 6:  return "InEvent";
        case 7:  return "EventEnding";
        case 8:  return "EventSummary";
        case 9:  return "BetweenEvents";
        case 10: return "GameEnding";
        default: return "?";
    }
}

// Offsets verified against the 1.12 SDK dump for UEscalationGameStateComponent:
//   CurrentState 0x120 (uint8)      CurrentChallengeLevel 0x130 (int32)
//   CurrentRound 0x134 (int32)      bHasCurrentRoundEncounter 0x154 (bool)
//   LastRoundScore 0x180 (float)    TotalScore 0x184 (float)
//   bShouldEndGame 0x188 (bool)
static std::string EscalationStateSummary(void* StateComponent) {
    if (!StateComponent || !IsReadablePointer(StateComponent, 0x18C)) return "escState=unreadable";
    const uintptr_t S = reinterpret_cast<uintptr_t>(StateComponent);
    const int State = SafeReadU8At(S, 0x120);
    return "escState=" + MpPtr(StateComponent)
        + " state=" + std::to_string(State) + "(" + EscalationStateName(State) + ")"
        + " round=" + std::to_string(SafeReadI32At(S, 0x134))
        + " challenge=" + std::to_string(SafeReadI32At(S, 0x130))
        + " hasRoundEncounter=" + std::to_string(SafeReadU8At(S, 0x154))
        + " lastRoundScore=" + std::to_string(SafeReadFloat(reinterpret_cast<void*>(S + 0x180), -1.0f))
        + " totalScore=" + std::to_string(SafeReadFloat(reinterpret_cast<void*>(S + 0x184), -1.0f))
        + " shouldEndGame=" + std::to_string(SafeReadU8At(S, 0x188));
}

static std::string EscalationArrayState(UObject* Object) {
    if (!Object || !IsReadablePointer(Object, 0x158)) return "component=n/a";
    // Escalation state machine receivers. The mode component holds its state component at +0xB8, so
    // both sides of the round-transition conversation report the same decoded state/round.
    if (Object->IsA(SDK::UEscalationGameStateComponent::StaticClass())) {
        return EscalationStateSummary(Object);
    }
    if (Object->IsA(SDK::UEscalationGameModeComponent::StaticClass())
        && IsReadablePointer(Object, 0xC0)) {
        void* StateComponent = *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(Object) + 0xB8);
        return "escMode=" + MpPtr(Object) + " " + EscalationStateSummary(StateComponent);
    }
    // [2026-07-25 UNLIMITED OMNICELL CHARGE] For AArchonPlayerRole receivers, emit the full charge
    // snapshot. The tracer already brackets every matched call with ENTER/EXIT, so routing the role
    // through here means a ClearAbilityCharge pair shows the charge immediately before and after the
    // native ran - if ENTER and EXIT both report current==max, the clear was dispatched but did not
    // take effect; if no pair appears at all, activation never asked for the charge to be consumed.
    if (Object->IsA(SDK::AArchonPlayerRole::StaticClass())) {
        return PlayerRoleChargeSummary(Object);
    }
    // [2026-07-25 AMP STALL] Screen-side calls (Construct / BeginRelicAnimations /
    // EnableRelicInteraction / HandleRelicSelected) previously all logged "component=n/a", which told
    // us nothing about why the click was rejected. Surface the screen's own state instead:
    // RelicViewModels (0x4C0 TArray) is what the per-card RelicViewModel pointers come from, and
    // AdvancesEscalation (0x4D0) is passed straight through to SelectRelicOption.
    if (Object->IsA(SDK::UEscalationRelicChoiceScreen::StaticClass())
        && IsReadablePointer(Object, 0x4D8)) {
        const uintptr_t S = reinterpret_cast<uintptr_t>(Object);
        // [2026-07-25 AMP GUARD - all three terms] HandleRelicSelected (0x141d65230) forwards the click
        // only if:  InRelic && GetOwningPlayer() && Owner->IsA(ArchonPlayerController)
        //           && GetPlayerEscalationComponent(Owner)
        // Repro 6 proved InRelic and InRelic->RelicViewModel are both non-null on the failing clicks
        // (and OnRelicSelected, which sits after SelectRelicOption inside the same block, also never
        // fires) - so the failure is one of the other three terms. GetPlayerEscalationComponent
        // (0x141b5fae0) is just a TWeakObjectPtr probe on PC+0xAE8, so log its raw index/serial: an
        // ObjectIndex of 0 or -1 means the weak pointer is unset and the guard rejects the click.
        void* Owner = SafeCallWidgetGetOwningPlayer(Object);
        std::string Guard = " owningPlayer=" + MpPtr(Owner);
        if (Owner) {
            Guard += "/" + SafeObjectNameForDiagnostic(Owner);
            const bool IsArchonPC = reinterpret_cast<UObject*>(Owner)->IsA(
                SDK::AArchonPlayerController::StaticClass());
            Guard += " ownerIsArchonPC=" + std::to_string(IsArchonPC ? 1 : 0);
            if (IsReadablePointer(Owner, 0xAF0)) {
                const uintptr_t O = reinterpret_cast<uintptr_t>(Owner);
                Guard += " weakEscCompIndex=" + std::to_string(SafeReadI32At(O, 0xAE8))
                       + " weakEscCompSerial=" + std::to_string(SafeReadI32At(O, 0xAEC));
            } else {
                Guard += " weakEscComp=<unreadable>";
            }
        } else {
            Guard += " ownerIsArchonPC=? weakEscComp=n/a";
        }
        return "screen=" + MpPtr(Object)
            + " relicViewModels=" + std::to_string(SafeReadI32At(S, 0x4C8))
            + "/" + std::to_string(SafeReadI32At(S, 0x4CC))
            + " advancesEscalation=" + std::to_string(SafeReadU8At(S, 0x4D0))
            + Guard;
    }
    if (!Object->IsA(SDK::UPlayerEscalationComponent::StaticClass())) return "component=n/a";
    const uintptr_t Base = reinterpret_cast<uintptr_t>(Object);
    const int Seasons = SafeReadI32At(Base, 0x128);
    const int SeasonsMax = SafeReadI32At(Base, 0x12C);
    const int Choices = SafeReadI32At(Base, 0x138);
    const int ChoicesMax = SafeReadI32At(Base, 0x13C);
    const int Options = SafeReadI32At(Base, 0x148);
    const int OptionsMax = SafeReadI32At(Base, 0x14C);
    const int Rewards = SafeReadI32At(Base, 0x150);
    return "component=" + MpPtr(Object)
        + " seasons=" + std::to_string(Seasons) + "/" + std::to_string(SeasonsMax)
        + " choices=" + std::to_string(Choices) + "/" + std::to_string(ChoicesMax)
        + " options=" + std::to_string(Options) + "/" + std::to_string(OptionsMax)
        + " roundRewards=" + std::to_string(Rewards);
}

static std::string EscalationFlowParams(const std::string& FunctionName, void* Parms) {
    if (!Parms) return "none";
    const uintptr_t P = reinterpret_cast<uintptr_t>(Parms);
    // State machine parameters. Knowing the requested target state is the point of the whole trace:
    // if AuthTrySetState is never asked for EventEnding/EventSummary/BetweenEvents then the round
    // transition itself is broken; if it is asked and granted, the BP handler that should call
    // SpawnPlayerBuffChoicesForFinishedRound is the thing failing.
    if (FunctionName.find("AuthTrySetState") != std::string::npos) {
        const int NewState = SafeReadU8At(P, 0x0);
        return "newState=" + std::to_string(NewState) + "(" + EscalationStateName(NewState) + ")";
    }
    if (FunctionName.find("InternalOnStateChange") != std::string::npos) {
        const int NewState = SafeReadU8At(P, 0x0);
        const int OldState = SafeReadU8At(P, 0x1);
        return "newState=" + std::to_string(NewState) + "(" + EscalationStateName(NewState) + ")"
            + " oldState=" + std::to_string(OldState) + "(" + EscalationStateName(OldState) + ")";
    }
    if (FunctionName.find("AuthGameStateChanged") != std::string::npos
        || FunctionName.find("AuthOnGameStateChanged") != std::string::npos) {
        const int NewState = SafeReadU8At(P, 0x0);
        return "newState=" + std::to_string(NewState) + "(" + EscalationStateName(NewState) + ")"
            + " transitionType=" + std::to_string(SafeReadU8At(P, 0x1));
    }
    if (FunctionName.find("OnRep_CurrentState") != std::string::npos) {
        const int Prev = SafeReadU8At(P, 0x0);
        return "prevStateByte=" + std::to_string(Prev) + "(" + EscalationStateName(Prev) + ")";
    }
    if (FunctionName.find("SetCurrentRound") != std::string::npos) {
        return "newRound=" + std::to_string(SafeReadI32At(P, 0x0));
    }
    if (FunctionName.find("SetCurrentChallengeLevel") != std::string::npos) {
        return "newChallengeLevel=" + std::to_string(SafeReadI32At(P, 0x0));
    }
    if (FunctionName.find("ForRound") != std::string::npos
        || FunctionName.find("EncounterForRound") != std::string::npos) {
        return "roundIndex=" + std::to_string(SafeReadI32At(P, 0x0));
    }
    if (FunctionName.find("RoundContentFinished") != std::string::npos
        || FunctionName.find("GameModeContentFinished") != std::string::npos) {
        return "content=" + MpPtr(*reinterpret_cast<void**>(Parms))
            + " result=" + std::to_string(SafeReadU8At(P, 0x8));
    }
    if (FunctionName.find("EndOfHuntStarted") != std::string::npos) {
        return "bSuccess=" + std::to_string(SafeReadU8At(P, 0x0));
    }
    // AArchonPlayerRole::AddAbilityCharge(float Amount) - the dodge-side accumulate. Logging the
    // requested delta alongside the ENTER/EXIT charge snapshot shows whether the statistic moved by
    // the amount asked for, which is the other half of the unlimited-charge question.
    if (FunctionName.find("ArchonPlayerRole.AddAbilityCharge") != std::string::npos) {
        return "amount=" + std::to_string(SafeReadFloat(Parms, 0.0f));
    }
    if (FunctionName.find("ArchonPlayerRole.ClearAbilityCharge") != std::string::npos
        || FunctionName.find("ArchonPlayerRole.FillAbilityCharge") != std::string::npos) {
        return "none";
    }
    if (FunctionName.find("ClientDisplayRelicChoiceUI") != std::string::npos) {
        return "relicOptions=" + std::to_string(SafeReadI32At(P, 0x8))
            + " debugChances=" + std::to_string(SafeReadI32At(P, 0x18))
            + " advances=" + std::to_string(SafeReadU8At(P, 0x20));
    }
    if (FunctionName.find("SelectRelicOption") != std::string::npos) {
        std::string RelicId = IsReadablePointer(Parms, 0x8)
            ? reinterpret_cast<SDK::FName*>(Parms)->ToString() : std::string("?");
        return "relicId=" + RelicId + " advances=" + std::to_string(SafeReadU8At(P, 0x8));
    }
    if (FunctionName.find("RelicSelectedNative") != std::string::npos
        || FunctionName.find("RelicSelectedBP") != std::string::npos) {
        return "player=" + MpPtr(*reinterpret_cast<void**>(Parms))
            + " advances=" + std::to_string(SafeReadU8At(P, 0x8));
    }
    // [2026-07-25] SpawnPersonalBuffPickupsForPlayer(const APlayerController* Player,
    //   const TArray<FEscalationBuff>& BuffChoices). Repro 6 showed the fix does reach this for all
    // three players, but every subsequent interaction still went to the single level-placed
    // escalation_buff_gatherable_umbral_bp_1, so we need to know whether it was handed a non-empty
    // list at all. Player is at +0x00, the TArray's Num at +0x10 (ptr at +0x08).
    if (FunctionName.find("SpawnPersonalBuffPickupsForPlayer") != std::string::npos) {
        return "player=" + MpPtr(*reinterpret_cast<void**>(Parms))
            + " buffChoicesPtr=" + MpPtr(IsReadablePointer(Parms, 0x18)
                ? *reinterpret_cast<void**>(P + 0x8) : nullptr)
            + " buffChoicesNum=" + std::to_string(SafeReadI32At(P, 0x10));
    }
    // Catch-all for the newly class-traced EscalationGameModeComponent functions, including the
    // unnamed BlueprintImplementableEvent FUN_1421fd700 dispatches. Its first parameter is the
    // AArchonPlayerController the relic stats are being applied to - resolve its name so a wrong
    // or repeated controller is obvious at a glance.
    if (FunctionName.find("EscalationGameModeComponent.") != std::string::npos
        && IsReadablePointer(Parms, 0x8)) {
        void* Arg0 = *reinterpret_cast<void**>(Parms);
        std::string Out = "arg0=" + MpPtr(Arg0);
        if (Arg0 && IsRegisteredLiveObject(Arg0) && IsReadablePointer(Arg0, 0x30)) {
            Out += "/" + SafeObjectNameForDiagnostic(reinterpret_cast<UObject*>(Arg0));
            Out += " arg0IsArchonPC=" + std::to_string(
                reinterpret_cast<UObject*>(Arg0)->IsA(
                    SDK::AArchonPlayerController::StaticClass()) ? 1 : 0);
        }
        return Out;
    }
    if (FunctionName.find("OnPlayerActivatedCrystal") != std::string::npos
        || FunctionName.find("PlayerChoseRelic") != std::string::npos
        || FunctionName.find("SpawnAllRelics") != std::string::npos
        || FunctionName.find("SpawnRelics") != std::string::npos
        || FunctionName.find("SpawnSpecificRelic") != std::string::npos
        || FunctionName.find("SpawnPersonalBuffPickupsForPlayer") != std::string::npos) {
        return "player=" + MpPtr(*reinterpret_cast<void**>(Parms));
    }
    // [2026-07-25 AMP STALL] UEscalationRelicChoiceScreen::HandleRelicSelected (Ghidra
    // 0x141d65230) gates everything behind:
    //     if (InRelic && (Owner = this->vtable[0x2a0]() /*GetOwningPlayer*/) != null
    //         && Owner->IsA(ArchonPlayerController) && GetPlayerEscalationComponent(Owner) != null)
    //         { if (InRelic->RelicViewModel /*+0x3D0*/) SelectRelicOption(...); ... OnRelicSelected(); }
    // SelectRelicOption itself (0x1422dd110) is an unconditional FindFunctionChecked+ProcessEvent
    // dispatch of ServerSelectRelicOption - it validates nothing - so a missing RPC means this guard
    // rejected the click. The stuck clients emit HandleRelicSelected with neither the RPC nor
    // OnRelicSelected following, which places the failure in the OUTER guard rather than the view
    // model. Dump the three outer inputs plus the view model so one repro identifies the exact term.
    if (FunctionName.find("EscalationRelicChoiceScreen.HandleRelicSelected") != std::string::npos) {
        void* InRelic = IsReadablePointer(Parms, 0x8) ? *reinterpret_cast<void**>(Parms) : nullptr;
        std::string Out = "arg0=" + MpPtr(InRelic);
        if (InRelic && IsReadablePointer(InRelic, 0x3D8)) {
            void* ViewModel = *reinterpret_cast<void**>(
                reinterpret_cast<uintptr_t>(InRelic) + 0x3D0);
            Out += " relicViewModel=" + MpPtr(ViewModel);
            if (ViewModel && IsReadablePointer(ViewModel, 0x110)) {
                Out += " relicIdAt0x108=" + reinterpret_cast<SDK::FName*>(
                    reinterpret_cast<uintptr_t>(ViewModel) + 0x108)->ToString();
            }
        } else {
            Out += " relicViewModel=<unreadable>";
        }
        return Out;
    }
    if (FunctionName.find("OnShowRelicChoiceScreen") != std::string::npos
        || FunctionName.find("HandleRelicSelected") != std::string::npos
        || FunctionName.find("OnUserStartedInteraction") != std::string::npos
        || FunctionName.find("OnUserCompletedInteraction") != std::string::npos
        || FunctionName.find("OnUserCanceledInteraction") != std::string::npos) {
        return "arg0=" + MpPtr(*reinterpret_cast<void**>(Parms));
    }
    return "present";
}

static std::string EscalationFlowContext(UObject* Object, const std::string& FunctionName,
                                         void* Parms, const char* Side) {
    UObject* Player = ResolveEscalationFlowPlayer(Object, FunctionName, Parms, Side);
    void* PlayerState = (Player && IsReadablePointer(Player, 0x230)
        && IsRegisteredLiveObject(Player))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Player) + 0x228) : nullptr;
    const bool PlayerStateLive = PlayerState && IsReadablePointer(PlayerState, 0x310)
        && IsRegisteredLiveObject(PlayerState);
    const std::string PlayerName = PlayerStateLive
        ? CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(PlayerState) + 0x300))
        : std::string();
    UObject* Outer = (Object && IsReadablePointer(Object, 0x28)
        && IsRegisteredLiveObject(Object)) ? Object->Outer : nullptr;
    return " obj=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
        + " outer=" + MpPtr(Outer) + "/" + SafeObjectNameForDiagnostic(Outer)
        + " player=" + MpPtr(Player) + "/" + SafeObjectNameForDiagnostic(Player)
        + " playerState=" + MpPtr(PlayerState)
        + " playerName=" + (PlayerName.empty() ? std::string("?") : PlayerName)
        + " state={" + EscalationArrayState(Object) + "}"
        + " params={" + EscalationFlowParams(FunctionName, Parms) + "}";
}

// [2026-07-25] The charge mutators fire once per dodge, whereas the relic chain fires once per round.
// Sharing a single 512-call budget meant a few minutes of Escalation would exhaust it on charge spam
// and the amp-selection evidence - the thing the repro exists to capture - would never be recorded.
// Give the two categories independent budgets so one cannot starve the other.
static bool IsPlayerRoleChargeTraceFunction(const std::string& FunctionName) {
    return FunctionName.find("ArchonPlayerRole.ClearAbilityCharge") != std::string::npos
        || FunctionName.find("ArchonPlayerRole.AddAbilityCharge") != std::string::npos
        || FunctionName.find("ArchonPlayerRole.FillAbilityCharge") != std::string::npos;
}

// The state machine ticks its own transitions and per-round content churn, so it gets a third budget.
// Three independent pools (relic chain / charge mutators / state machine) means no category can burn
// another's evidence, which is what the one-shot repro depends on.
static bool IsEscalationStateTraceFunction(const std::string& FunctionName) {
    return FunctionName.find("EscalationGameStateComponent.") != std::string::npos
        || FunctionName.find("EscalationGameModeComponent.Auth") != std::string::npos
        || FunctionName.find("EscalationGameModeComponent.PrepareEncounterForRound") != std::string::npos
        || FunctionName.find("EscalationGameModeComponent.StartEncounterForRound") != std::string::npos
        || FunctionName.find("EscalationGameModeComponent.EndOfHuntStarted") != std::string::npos;
}

static constexpr int kEscalationRelicTraceMax = 512;
static constexpr int kPlayerRoleChargeTraceMax = 384;
static constexpr int kEscalationStateTraceMax = 512;

static int TraceEscalationFlowEnter(const char* Side, UObject* Object,
                                    const std::string& FunctionName, void* Parms) {
    if (!IsEscalationFlowFunction(FunctionName)) return -1;
    static std::atomic<int> s_ChargeBudget{ 0 };
    static std::atomic<int> s_StateBudget{ 0 };
    static std::atomic<int> s_RelicBudget{ 0 };
    if (IsPlayerRoleChargeTraceFunction(FunctionName)) {
        if (s_ChargeBudget.fetch_add(1, std::memory_order_relaxed) >= kPlayerRoleChargeTraceMax) {
            return -1;
        }
    } else if (IsEscalationStateTraceFunction(FunctionName)) {
        if (s_StateBudget.fetch_add(1, std::memory_order_relaxed) >= kEscalationStateTraceMax) {
            return -1;
        }
    } else if (s_RelicBudget.fetch_add(1, std::memory_order_relaxed) >= kEscalationRelicTraceMax) {
        return -1;
    }
    static std::atomic<int> s_EscalationFlowSequence{ 0 };
    const int Seq = s_EscalationFlowSequence.fetch_add(1, std::memory_order_relaxed);
    MpLog(std::string("[EscalationFlow][") + Side + "][ENTER #" + std::to_string(Seq)
        + "] fn=" + FunctionName + EscalationFlowContext(Object, FunctionName, Parms, Side));
    return Seq;
}

static void TraceEscalationFlowExit(const char* Side, int Seq, UObject* Object,
                                   const std::string& FunctionName, void* Parms) {
    if (Seq < 0) return;
    MpLog(std::string("[EscalationFlow][") + Side + "][EXIT #" + std::to_string(Seq)
        + "] fn=" + FunctionName + EscalationFlowContext(Object, FunctionName, Parms, Side));
}

// [2026-07-18 CORE-CAP] One-shot server-side capture of the game's inventory CONSUME calls, so a single
// Core Breaker open reveals EXACTLY what the game consumes locally (never reaches the backend today ->
// infinite cores, BUG D). Gated by CORE_CAPTURE.flag next to the game exe (server only). Cached.
static bool CoreCaptureEnabled() {
    static int c = -1;
    if (c < 0) c = MpExeRelativeFlagPresent(L"CORE_CAPTURE.flag") ? 1 : 0;
    return c == 1;
}

// [2026-07-28 TEMPEST SCALE DIAG]
// The 1.12 Tempest Blueprint reads BaseMovementSpeed through
// UAbilitySystemBlueprintLibrary::GetFloatAttributeFromAbilitySystemComponent, calculates
// 1 + ((Clamp(BaseMovementSpeed, 1, 99) - 1) * 5), then writes it to the deferred
// aoe_simple_playerowned_tempest actor through UKismetSystemLibrary::SetFloatPropertyByName.
// Blueprint bytecode can call both native helpers without re-entering ProcessEvent, so this
// diagnostic hooks the Ghidra-confirmed native helper bodies. It is passive, bounded, and installed
// only when TEMPEST_SCALE_DIAG.flag is present next to the executable before launch.
static bool TempestScaleDiagEnabled() {
    static int Enabled = -1;
    if (Enabled < 0) {
        Enabled = MpExeRelativeFlagPresent(L"TEMPEST_SCALE_DIAG.flag") ? 1 : 0;
    }
    return Enabled == 1;
}

struct TempestBaseMoveCapture {
    const UAbilitySystemComponent* AbilitySystem = nullptr;
    float Value = 0.0f;
    bool Found = false;
    ULONGLONG CapturedAtMs = 0;
};

// Game-thread Blueprint execution is serial, but key the cache by ASC so two players activating
// Tempest close together cannot overwrite one another's attribute read.
static thread_local TempestBaseMoveCapture g_TempestBaseMoveCaptures[8]{};

static void NoteTempestBaseMoveCapture(const UAbilitySystemComponent* AbilitySystem,
                                       float Value, bool Found) {
    if (!AbilitySystem) return;

    int Slot = -1;
    int OldestSlot = 0;
    ULONGLONG OldestTime = ~static_cast<ULONGLONG>(0);
    for (int i = 0; i < 8; ++i) {
        const TempestBaseMoveCapture& Entry = g_TempestBaseMoveCaptures[i];
        if (Entry.AbilitySystem == AbilitySystem || Entry.AbilitySystem == nullptr) {
            Slot = i;
            break;
        }
        if (Entry.CapturedAtMs < OldestTime) {
            OldestTime = Entry.CapturedAtMs;
            OldestSlot = i;
        }
    }
    if (Slot < 0) Slot = OldestSlot;
    g_TempestBaseMoveCaptures[Slot] = { AbilitySystem, Value, Found, GetTickCount64() };
}

static bool FindRecentTempestBaseMoveCapture(const UAbilitySystemComponent* AbilitySystem,
                                             float* OutValue, bool* OutFound) {
    if (!AbilitySystem || !OutValue || !OutFound) return false;
    const ULONGLONG Now = GetTickCount64();
    for (const TempestBaseMoveCapture& Entry : g_TempestBaseMoveCaptures) {
        if (Entry.AbilitySystem != AbilitySystem) continue;
        // The read occurs on activation and the AoE write occurs during the dash. Reject a value
        // from an older charge while leaving enough time for the animation/event path.
        if (Entry.CapturedAtMs == 0 || Now - Entry.CapturedAtMs > 5000) return false;
        *OutValue = Entry.Value;
        *OutFound = Entry.Found;
        return true;
    }
    return false;
}

struct TempestAttributeSnapshot {
    bool AscValid = false;
    bool MovementSetFound = false;
    bool HealthSetFound = false;
    float DirectBaseMove = 0.0f;
    float Stamina = 0.0f;
    float MaxStamina = 0.0f;
};

static TempestAttributeSnapshot CaptureTempestAttributeSnapshot(
    UAbilitySystemComponent* AbilitySystem) {
    TempestAttributeSnapshot Result{};
    if (!AbilitySystem || !IsReadablePointer(AbilitySystem, 0x150)
        || !IsRegisteredLiveObject(AbilitySystem)) {
        return Result;
    }

    Result.AscValid = true;
    // 1.12 SDK: UAbilitySystemComponent::SpawnedAttributes @ +0x140.
    const auto* Spawned = reinterpret_cast<const RawPointerArray*>(
        reinterpret_cast<uintptr_t>(AbilitySystem) + 0x140);
    if (!IsReadablePointer(Spawned, sizeof(RawPointerArray))
        || Spawned->Num < 0 || Spawned->Num > 64 || Spawned->Max < Spawned->Num
        || (Spawned->Num > 0
            && (!Spawned->Data
                || !IsReadablePointer(Spawned->Data,
                    static_cast<size_t>(Spawned->Num) * sizeof(void*))))) {
        return Result;
    }

    for (int32_t i = 0; i < Spawned->Num; ++i) {
        UObject* AttributeSet = reinterpret_cast<UObject*>(Spawned->Data[i]);
        if (!AttributeSet || !IsReadablePointer(AttributeSet, 0xC0)
            || !IsRegisteredLiveObject(AttributeSet)) {
            continue;
        }

        if (!Result.MovementSetFound
            && AttributeSet->IsA(UArchonMovementAttributeSet::StaticClass())) {
            // 1.12 SDK: UArchonMovementAttributeSet::BaseMovementSpeed @ +0x30.
            Result.DirectBaseMove = *reinterpret_cast<const float*>(
                reinterpret_cast<uintptr_t>(AttributeSet) + 0x30);
            Result.MovementSetFound = std::isfinite(Result.DirectBaseMove);
        }
        else if (!Result.HealthSetFound
            && AttributeSet->IsA(UArchonHealthAttributeSet::StaticClass())) {
            // 1.12 SDK: UArchonHealthAttributeSet::Stamina @ +0xB4, MaxStamina @ +0xB8.
            Result.Stamina = *reinterpret_cast<const float*>(
                reinterpret_cast<uintptr_t>(AttributeSet) + 0xB4);
            Result.MaxStamina = *reinterpret_cast<const float*>(
                reinterpret_cast<uintptr_t>(AttributeSet) + 0xB8);
            Result.HealthSetFound = std::isfinite(Result.Stamina)
                && std::isfinite(Result.MaxStamina);
        }
    }
    return Result;
}

struct TempestBuffSnapshot {
    bool ScanValid = false;
    bool FleetActive = false;
    bool InvigoratedActive = false;
    bool MoltenActive = false;
    int FleetEffectCount = 0;
    int InvigoratedEffectCount = 0;
    int MoltenEffectCount = 0;
};

static TempestBuffSnapshot CaptureTempestBuffSnapshot(
    AActor* Owner, UAbilitySystemComponent* AbilitySystem) {
    TempestBuffSnapshot Result{};
    if (!Owner || !AbilitySystem || !UObject::GObjects) return Result;
    Result.ScanValid = true;

    const int Count = UObject::GObjects->Num();
    for (int i = 0; i < Count; ++i) {
        UObject* Object = UObject::GObjects->GetByIndex(i);
        if (!Object || Object->IsDefaultObject()
            || !IsReadablePointer(Object, 0x570)
            || !Object->IsA(AArchonBuff::StaticClass())) {
            continue;
        }

        auto* Buff = reinterpret_cast<AArchonBuff*>(Object);
        // Cell buffs associate with their target through AActor::Owner and/or the SDK-verified
        // OwnerAbilitySystemComponent weak pointer at +0x2F8. Resolve the weak index and require exact
        // equality with the Tempest owner's ASC so another player's similarly named buff is ignored.
        UAbilitySystemComponent* BuffOwnerAbilitySystem = nullptr;
        const int32_t OwnerAscIndex = Buff->OwnerAbilitySystemComponent.ObjectIndex;
        if (OwnerAscIndex >= 0 && UObject::GObjects) {
            UObject* ResolvedOwnerAsc = UObject::GObjects->GetByIndex(OwnerAscIndex);
            if (ResolvedOwnerAsc == AbilitySystem) {
                BuffOwnerAbilitySystem = AbilitySystem;
            }
        }
        if (Buff->Owner != Owner && BuffOwnerAbilitySystem != AbilitySystem) continue;

        const std::string ClassName = (Buff->Class && IsRegisteredLiveObject(Buff->Class))
            ? Buff->Class->GetName() : std::string();
        const int EffectCount = Buff->ActiveGameplayEffects.Num();
        const bool Active = Buff->bActive;

        if (ClassName.find("fleetfooted_timed_movespeed_buff_C") != std::string::npos) {
            Result.FleetActive = Result.FleetActive || Active;
            Result.FleetEffectCount = (std::max)(Result.FleetEffectCount, EffectCount);
        }
        else if (ClassName.find("ce_stam_to_movespeed_C") != std::string::npos) {
            // The Invigorated listener actor remains alive while equipped. Its movement modifier is
            // active only while the actor owns an active GameplayEffect.
            Result.InvigoratedActive = Result.InvigoratedActive || (Active && EffectCount > 0);
            Result.InvigoratedEffectCount = (std::max)(
                Result.InvigoratedEffectCount, EffectCount);
        }
        else if (ClassName.find("molten_heart_buff_C") != std::string::npos) {
            // This exact singular class excludes passive ce_molten_hearts_* generator actors.
            Result.MoltenActive = Result.MoltenActive || Active;
            Result.MoltenEffectCount = (std::max)(Result.MoltenEffectCount, EffectCount);
        }
    }
    return Result;
}

static void* OrigGetFloatAttributeFromAbilitySystemComponentDiag = nullptr;
static void* OrigSetFloatPropertyByNameDiag = nullptr;

static float GetFloatAttributeFromAbilitySystemComponentDiagHook(
    const UAbilitySystemComponent* AbilitySystem,
    FGameplayAttribute* Attribute,
    bool* bSuccessfullyFoundAttribute) {
    // Read before the original. Ghidra FUN_14156d7d0 consumes the normalized temporary attribute.
    const std::string AttributeName =
        (Attribute && IsReadablePointer(Attribute, sizeof(FGameplayAttribute)))
        ? CoreCapFString(&Attribute->AttributeName) : std::string();

    const float Result = reinterpret_cast<float(*)(
        const UAbilitySystemComponent*, FGameplayAttribute*, bool*)>(
            OrigGetFloatAttributeFromAbilitySystemComponentDiag)(
                AbilitySystem, Attribute, bSuccessfullyFoundAttribute);

    if (TempestScaleDiagEnabled() && AttributeName == "BaseMovementSpeed") {
        const bool Found = bSuccessfullyFoundAttribute && *bSuccessfullyFoundAttribute;
        NoteTempestBaseMoveCapture(AbilitySystem, Result, Found);
    }
    return Result;
}

static void SetFloatPropertyByNameDiagHook(
    UObject* Object, FName PropertyName, float Value) {
    reinterpret_cast<void(*)(UObject*, FName, float)>(OrigSetFloatPropertyByNameDiag)(
        Object, PropertyName, Value);

    if (!TempestScaleDiagEnabled() || PropertyName.ToString() != "DamageScale"
        || !Object || !IsReadablePointer(Object, 0x120)
        || !IsRegisteredLiveObject(Object)) {
        return;
    }

    const std::string ClassName = (Object->Class && IsRegisteredLiveObject(Object->Class))
        ? Object->Class->GetName() : std::string();
    if (ClassName.find("aoe_simple_playerowned_tempest_C") == std::string::npos) return;

    static std::atomic<int> s_TempestScaleDiagCount{ 0 };
    const int Seq = s_TempestScaleDiagCount.fetch_add(1, std::memory_order_relaxed);
    if (Seq >= 64) return;

    // 1.12 SDK: AActor::Owner @ +0xE0. Tempest supplies the role owner pawn to the deferred
    // spawn. AArchonAbilityCharacter::AbilitySystemComponent is at +0x590.
    auto* Owner = reinterpret_cast<AActor*>(
        *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Object) + 0xE0));
    UAbilitySystemComponent* AbilitySystem = nullptr;
    if (Owner && IsReadablePointer(Owner, 0x598) && IsRegisteredLiveObject(Owner)) {
        AbilitySystem = *reinterpret_cast<UAbilitySystemComponent**>(
            reinterpret_cast<uintptr_t>(Owner) + 0x590);
        if (!AbilitySystem || !IsReadablePointer(AbilitySystem, 0x150)
            || !IsRegisteredLiveObject(AbilitySystem)) {
            AbilitySystem = nullptr;
        }
    }

    float BlueprintBaseMove = 0.0f;
    bool BlueprintBaseMoveFound = false;
    const bool BlueprintReadCaptured = FindRecentTempestBaseMoveCapture(
        AbilitySystem, &BlueprintBaseMove, &BlueprintBaseMoveFound);
    const TempestAttributeSnapshot Attributes =
        CaptureTempestAttributeSnapshot(AbilitySystem);
    const TempestBuffSnapshot Buffs =
        CaptureTempestBuffSnapshot(Owner, AbilitySystem);

    const bool HasBaseMove = BlueprintReadCaptured && BlueprintBaseMoveFound
        && std::isfinite(BlueprintBaseMove);
    const float BaseMoveForFormula = HasBaseMove
        ? BlueprintBaseMove
        : (Attributes.MovementSetFound ? Attributes.DirectBaseMove : 1.0f);
    const float ClampedBaseMove = std::clamp(BaseMoveForFormula, 1.0f, 99.0f);
    const float ComputedScale = 1.0f + ((ClampedBaseMove - 1.0f) * 5.0f);

    MpLog("[TempestScaleDiag] seq=" + std::to_string(Seq)
        + " baseMove=" + std::to_string(BaseMoveForFormula)
        + " baseMoveCaptured=" + std::to_string(BlueprintReadCaptured ? 1 : 0)
        + " baseMoveFound=" + std::to_string(BlueprintBaseMoveFound ? 1 : 0)
        + " directBaseMove=" + std::to_string(Attributes.DirectBaseMove)
        + " movementSetFound=" + std::to_string(Attributes.MovementSetFound ? 1 : 0)
        + " stamina=" + std::to_string(Attributes.Stamina)
        + " maxStamina=" + std::to_string(Attributes.MaxStamina)
        + " healthSetFound=" + std::to_string(Attributes.HealthSetFound ? 1 : 0)
        + " fleetActive=" + std::to_string(Buffs.FleetActive ? 1 : 0)
        + " fleetEffects=" + std::to_string(Buffs.FleetEffectCount)
        + " invigoratedActive=" + std::to_string(Buffs.InvigoratedActive ? 1 : 0)
        + " invigoratedEffects=" + std::to_string(Buffs.InvigoratedEffectCount)
        + " moltenActive=" + std::to_string(Buffs.MoltenActive ? 1 : 0)
        + " moltenEffects=" + std::to_string(Buffs.MoltenEffectCount)
        + " buffScanValid=" + std::to_string(Buffs.ScanValid ? 1 : 0)
        + " computedScale=" + std::to_string(ComputedScale)
        + " spawnedDamageScale=" + std::to_string(Value)
        + " scaleDelta=" + std::to_string(Value - ComputedScale)
        + " owner=" + MpPtr(Owner) + "/" + SafeObjectNameForDiagnostic(Owner)
        + " asc=" + MpPtr(AbilitySystem)
        + " aoe=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object));
}

// [2026-07-28 TEMPEST DOWNSTREAM DAMAGE DIAG]
// The scale capture proved that the authoritative movement attribute and deferred AoE DamageScale
// are correct. This independent flag traces reflected damage boundaries after that write. It does
// not scan GObjects and never changes damage, tags, modifiers, health, or displayed values.
static bool TempestDamageDiagEnabled() {
    static int Enabled = -1;
    if (Enabled < 0) Enabled = MpExeRelativeFlagPresent(L"TEMPEST_DAMAGE_DIAG.flag") ? 1 : 0;
    return Enabled == 1;
}

static bool IsTempestAoeDiagnosticObject(const UObject* Object) {
    if (!Object || !IsReadablePointer(Object, 0x20) || !IsRegisteredLiveObject(Object)) return false;
    return SafeObjectNameForDiagnostic(const_cast<UObject*>(Object)).find(
        "aoe_simple_playerowned_tempest_C") != std::string::npos;
}

static bool IsSaneTempestDiagFloatArray(const TArray<float>& Values, int32_t Limit = 64) {
    const int32_t Num = Values.Num();
    if (Num < 0 || Values.Max() < Num || Num > Limit) return false;
    return Num == 0 || (Values.GetDataPtr()
        && IsReadablePointer(Values.GetDataPtr(), static_cast<size_t>(Num) * sizeof(float)));
}

static std::string TempestDiagFloatArray(const TArray<float>& Values) {
    if (!IsSaneTempestDiagFloatArray(Values)) return "[invalid]";
    const int32_t Num = Values.Num();
    const int32_t Emit = (std::min)(Num, 16);
    const float* Data = Values.GetDataPtr();
    std::string Out = "[";
    for (int32_t i = 0; i < Emit; ++i) {
        if (i) Out += ",";
        Out += std::to_string(Data[i]);
    }
    if (Num > Emit) Out += ",...";
    return Out + "]";
}

static bool IsSaneTempestDiagTags(const FGameplayTagContainer& Container, int32_t Limit = 128) {
    const TArray<FGameplayTag>& Tags = Container.GameplayTags;
    const int32_t Num = Tags.Num();
    if (Num < 0 || Tags.Max() < Num || Num > Limit) return false;
    return Num == 0 || (Tags.GetDataPtr()
        && IsReadablePointer(Tags.GetDataPtr(), static_cast<size_t>(Num) * sizeof(FGameplayTag)));
}

static bool TempestDiagTagsContain(const FGameplayTagContainer& Container, const char* Needle) {
    if (!Needle || !*Needle || !IsSaneTempestDiagTags(Container)) return false;
    const FGameplayTag* Data = Container.GameplayTags.GetDataPtr();
    for (int32_t i = 0; i < Container.GameplayTags.Num(); ++i) {
        if (Data[i].TagName.ToString().find(Needle) != std::string::npos) return true;
    }
    return false;
}

static bool IsTempestTaggedDamage(const FGameplayTagContainer& Tags) {
    return TempestDiagTagsContain(Tags, "Abilities.PlayerRole.Tempest")
        || TempestDiagTagsContain(Tags, "Tempest_Dash")
        || TempestDiagTagsContain(Tags, "Tempest");
}

static std::string TempestDiagTags(const FGameplayTagContainer& Container) {
    if (!IsSaneTempestDiagTags(Container)) return "[invalid]";
    const int32_t Num = Container.GameplayTags.Num();
    const int32_t Emit = (std::min)(Num, 24);
    const FGameplayTag* Data = Container.GameplayTags.GetDataPtr();
    std::string Out = "[";
    for (int32_t i = 0; i < Emit; ++i) {
        if (i) Out += ",";
        Out += Data[i].TagName.ToString();
    }
    if (Num > Emit) Out += ",...";
    return Out + "]";
}

static std::string TempestDamageDataSummary(const FDamageEventData& Data) {
    return "preMit=" + TempestDiagFloatArray(Data.PreMitigationDamages)
        + " true=" + std::to_string(Data.TrueDamage)
        + " multipliers=" + TempestDiagFloatArray(Data.Multipliers)
        + " resistanceDeltas=" + TempestDiagFloatArray(Data.ResistanceDeltas)
        + " postResist=" + TempestDiagFloatArray(Data.PostResistDamages)
        + " explicitPart=" + std::to_string(Data.ExplicitPartBreakDamage)
        + " explicitStagger=" + std::to_string(Data.ExplicitStaggerDamage)
        + " explicitExpose=" + std::to_string(Data.ExplicitExposeDamage)
        + " finalStagger=" + std::to_string(Data.FinalStaggerDamage)
        + " finalExpose=" + std::to_string(Data.FinalExposeDamage)
        + " coreFromBP=" + std::to_string(Data.CoreDamageFromBP)
        + " additive=" + std::to_string(Data.AdditiveDamageMultiplier)
        + " multiplicative=" + std::to_string(Data.MultiplicativeDamageMultiplier)
        + " baseWeaponElemental=" + std::to_string(Data.BaseWeaponElementalHealthDamageModifier)
        + " elementalHealth=" + std::to_string(Data.ElementalHealthDamageModifier);
}

static std::string TempestAbilityInfoSummary(const FArchonAbilityDamageInfo& Info) {
    return "base=" + std::to_string(Info.BaseDamage)
        + " element=" + std::to_string(static_cast<int>(Info.DamageElement))
        + " raw=" + std::to_string(Info.RawDamage)
        + " mitPhysical=" + std::to_string(Info.MitigatedDamage.PhysicalDamage)
        + " mitFlame=" + std::to_string(Info.MitigatedDamage.FlameDamage)
        + " mitFrost=" + std::to_string(Info.MitigatedDamage.FrostDamage)
        + " mitShock=" + std::to_string(Info.MitigatedDamage.ShockDamage)
        + " mitRadiant=" + std::to_string(Info.MitigatedDamage.RadiantDamage)
        + " mitUmbral=" + std::to_string(Info.MitigatedDamage.UmbralDamage)
        + " mitTerra=" + std::to_string(Info.MitigatedDamage.TerraDamage)
        + " mitRawElemental=" + std::to_string(Info.MitigatedDamage.RawElementalDamage)
        + " totalElemental=" + std::to_string(Info.TotalElementalDamage)
        + " totalPhysical=" + std::to_string(Info.TotalPhysicalDamage)
        + " totalApplied=" + std::to_string(Info.TotalDamageApplied)
        + " eventMagnitude=" + std::to_string(Info.Payload.EventMagnitude)
        + " payloadInstigator=" + MpPtr(Info.Payload.Instigator)
        + "/" + SafeObjectNameForDiagnostic(Info.Payload.Instigator)
        + " payloadTarget=" + MpPtr(Info.Payload.Target)
        + "/" + SafeObjectNameForDiagnostic(Info.Payload.Target)
        + " optional1=" + MpPtr(Info.Payload.OptionalObject)
        + "/" + SafeObjectNameForDiagnostic(Info.Payload.OptionalObject)
        + " optional2=" + MpPtr(Info.Payload.OptionalObject2)
        + "/" + SafeObjectNameForDiagnostic(Info.Payload.OptionalObject2)
        + " instigatorTags=" + TempestDiagTags(Info.Payload.InstigatorTags)
        + " targetTags=" + TempestDiagTags(Info.Payload.TargetTags);
}

static std::string TempestPostMitSummary(const FPostMitigationDamageSummary& Data) {
    return "mitAttack=" + std::to_string(Data.MitigatedAttackDamage)
        + " core=" + std::to_string(Data.VsBehemoth_CoreDamage)
        + " part=" + std::to_string(Data.VsBehemoth_PartDamage)
        + " stagger=" + std::to_string(Data.VsBehemoth_StaggerDamage)
        + " wound=" + std::to_string(Data.VsBehemoth_WoundDamage)
        + " elemental=" + std::to_string(Data.ElementalDamage)
        + " rawBase=" + std::to_string(Data.RawBaseDamage)
        + " baseWithMultipliers=" + std::to_string(Data.BaseDamageWithMultipliersApplied);
}

enum class TempestDamageDiagKind : uint8_t { None, PreMitigation };
struct TempestDamageDiagCall { TempestDamageDiagKind Kind = TempestDamageDiagKind::None; int Seq = -1; };

static int NextTempestDamageDiagSeq() {
    static std::atomic<int> Count{ 0 };
    const int Seq = Count.fetch_add(1, std::memory_order_relaxed);
    return Seq < 256 ? Seq : -1;
}

static TempestDamageDiagCall TraceTempestDamageEnter(
    UObject* Object, const std::string& FunctionName, void* Parms) {
    TempestDamageDiagCall Call{};
    if (!TempestDamageDiagEnabled() || !Object || !Parms) return Call;

    if (FunctionName.find("OnPremitigateDamageNonNative") != std::string::npos
        && IsReadablePointer(Parms, sizeof(Params::ArchonDamageTakerInterface_OnPremitigateDamageNonNative))) {
        auto* P = reinterpret_cast<Params::ArchonDamageTakerInterface_OnPremitigateDamageNonNative*>(Parms);
        if (!IsTempestAoeDiagnosticObject(P->DamageGiver) && !IsTempestTaggedDamage(P->DamageEventTags)) return Call;
        Call.Kind = TempestDamageDiagKind::PreMitigation;
        Call.Seq = NextTempestDamageDiagSeq();
        if (Call.Seq >= 0) MpLog("[TempestDamageDiag][PreMit][ENTER] seq=" + std::to_string(Call.Seq)
            + " target=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
            + " giver=" + MpPtr(P->DamageGiver) + "/" + SafeObjectNameForDiagnostic(P->DamageGiver)
            + " hasHit=" + std::to_string(P->bHasHitResult ? 1 : 0)
            + " tags=" + TempestDiagTags(P->DamageEventTags)
            + " " + TempestDamageDataSummary(P->DamageEventData));
        return Call;
    }

    if (FunctionName.find("OnPostMitigationReceivedDamage") != std::string::npos
        && IsReadablePointer(Parms, sizeof(Params::ArchonDamageTakerInterface_OnPostMitigationReceivedDamage))) {
        auto* P = reinterpret_cast<Params::ArchonDamageTakerInterface_OnPostMitigationReceivedDamage*>(Parms);
        if (!IsTempestAoeDiagnosticObject(P->DamageGiver) && !IsTempestTaggedDamage(P->DamageTags)) return Call;
        const int Seq = NextTempestDamageDiagSeq();
        if (Seq >= 0) MpLog("[TempestDamageDiag][PostMit] seq=" + std::to_string(Seq)
            + " target=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
            + " giver=" + MpPtr(P->DamageGiver) + "/" + SafeObjectNameForDiagnostic(P->DamageGiver)
            + " instigator=" + MpPtr(P->DamageInstigator) + "/" + SafeObjectNameForDiagnostic(P->DamageInstigator)
            + " tags=" + TempestDiagTags(P->DamageTags) + " " + TempestPostMitSummary(P->DamageEventData));
        return Call;
    }

    if (FunctionName.find("OnDamageReceivedBP") != std::string::npos
        && IsReadablePointer(Parms, sizeof(Params::ArchonDamageTakerInterface_OnDamageReceivedBP))) {
        auto* P = reinterpret_cast<Params::ArchonDamageTakerInterface_OnDamageReceivedBP*>(Parms);
        if (!IsTempestAoeDiagnosticObject(P->DamageSource)
            && !IsTempestTaggedDamage(P->DamageInfo.Payload.InstigatorTags)) return Call;
        const int Seq = NextTempestDamageDiagSeq();
        if (Seq >= 0) MpLog("[TempestDamageDiag][DamageReceivedBP] seq=" + std::to_string(Seq)
            + " target=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
            + " received=" + std::to_string(P->DamageReceived)
            + " source=" + MpPtr(P->DamageSource) + "/" + SafeObjectNameForDiagnostic(P->DamageSource)
            + " " + TempestAbilityInfoSummary(P->DamageInfo));
        return Call;
    }
    if (FunctionName.find("ArchonBehemoth.ReceivedArchonAbilityDamageOnMonsterPart") != std::string::npos
        && IsReadablePointer(Parms, sizeof(Params::ArchonBehemoth_ReceivedArchonAbilityDamageOnMonsterPart))) {
        auto* P = reinterpret_cast<Params::ArchonBehemoth_ReceivedArchonAbilityDamageOnMonsterPart*>(Parms);
        if (!IsTempestAoeDiagnosticObject(P->DamageCauser)) return Call;
        const int Seq = NextTempestDamageDiagSeq();
        if (Seq >= 0) MpLog("[TempestDamageDiag][AbilityPart] seq=" + std::to_string(Seq)
            + " target=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
            + " part=" + MpPtr(P->MonsterPartActor) + "/" + SafeObjectNameForDiagnostic(P->MonsterPartActor)
            + " received=" + std::to_string(P->DamageReceived)
            + " instigatedBy=" + MpPtr(P->InstigatedBy) + "/" + SafeObjectNameForDiagnostic(P->InstigatedBy)
            + " causer=" + MpPtr(P->DamageCauser) + "/" + SafeObjectNameForDiagnostic(P->DamageCauser)
            + " " + TempestAbilityInfoSummary(P->DamageInfo));
        return Call;
    }

    if (FunctionName.find("ArchonBehemoth.ReceivedArchonAbilityDamage") != std::string::npos
        && FunctionName.find("OnMonsterPart") == std::string::npos
        && IsReadablePointer(Parms, sizeof(Params::ArchonBehemoth_ReceivedArchonAbilityDamage))) {
        auto* P = reinterpret_cast<Params::ArchonBehemoth_ReceivedArchonAbilityDamage*>(Parms);
        if (!IsTempestAoeDiagnosticObject(P->DamageCauser)) return Call;
        const int Seq = NextTempestDamageDiagSeq();
        if (Seq >= 0) MpLog("[TempestDamageDiag][Ability] seq=" + std::to_string(Seq)
            + " target=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
            + " received=" + std::to_string(P->DamageReceived)
            + " instigatedBy=" + MpPtr(P->InstigatedBy) + "/" + SafeObjectNameForDiagnostic(P->InstigatedBy)
            + " causer=" + MpPtr(P->DamageCauser) + "/" + SafeObjectNameForDiagnostic(P->DamageCauser)
            + " " + TempestAbilityInfoSummary(P->DamageInfo));
        return Call;
    }

    if (FunctionName.find("base_gameobject_bp_C.AddDamageText_Internal") != std::string::npos
        && IsReadablePointer(Parms, sizeof(Params::base_gameobject_bp_C_AddDamageText_Internal))) {
        auto* P = reinterpret_cast<Params::base_gameobject_bp_C_AddDamageText_Internal*>(Parms);
        if (!IsTempestAoeDiagnosticObject(P->DamageInstigator) && !IsTempestTaggedDamage(P->DamageTags)) return Call;
        const int Seq = NextTempestDamageDiagSeq();
        if (Seq >= 0) MpLog("[TempestDamageDiag][DamageTextInternal] seq=" + std::to_string(Seq)
            + " target=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
            + " displayed=" + std::to_string(P->Damage)
            + " instigator=" + MpPtr(P->DamageInstigator) + "/" + SafeObjectNameForDiagnostic(P->DamageInstigator)
            + " tags=" + TempestDiagTags(P->DamageTags));
        return Call;
    }

    if (FunctionName.find("base_gameobject_bp_C.MulticastDamageText") != std::string::npos
        && IsReadablePointer(Parms, sizeof(Params::base_gameobject_bp_C_MulticastDamageText))) {
        auto* P = reinterpret_cast<Params::base_gameobject_bp_C_MulticastDamageText*>(Parms);
        if (!IsTempestAoeDiagnosticObject(P->DamageInstigator) && !IsTempestTaggedDamage(P->DamageTags)) return Call;
        const int Seq = NextTempestDamageDiagSeq();
        if (Seq >= 0) MpLog("[TempestDamageDiag][DamageTextMulticast] seq=" + std::to_string(Seq)
            + " target=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
            + " displayed=" + std::to_string(P->DamageAmount)
            + " instigator=" + MpPtr(P->DamageInstigator) + "/" + SafeObjectNameForDiagnostic(P->DamageInstigator)
            + " tags=" + TempestDiagTags(P->DamageTags));
    }
    return Call;
}

static void TraceTempestDamageExit(UObject* Object, void* Parms, const TempestDamageDiagCall& Call) {
    if (Call.Seq < 0 || Call.Kind != TempestDamageDiagKind::PreMitigation || !Parms
        || !IsReadablePointer(Parms, sizeof(Params::ArchonDamageTakerInterface_OnPremitigateDamageNonNative))) return;
    auto* P = reinterpret_cast<Params::ArchonDamageTakerInterface_OnPremitigateDamageNonNative*>(Parms);
    MpLog("[TempestDamageDiag][PreMit][EXIT] seq=" + std::to_string(Call.Seq)
        + " target=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
        + " override=" + std::to_string(P->bOverrideDamageData ? 1 : 0)
        + " outTags=" + TempestDiagTags(P->OutDamageEventTags)
        + " return=" + TempestDamageDataSummary(P->ReturnValue));
}

/*
 * [2026-10-11 1.14.7 O3 ProcessEvent categories] The server hook below tests every reflected call against ~30 name
 * substrings, plus IsEscalationFlowFunction (~50 more) and BleedoutNoteEvent's prefilter - roughly 90 std::string::find
 * calls per ProcessEvent, tens of thousands of times a second on a populated hub. All of those tests depend only on the
 * UFunction's full name, so each one is now evaluated ONCE per UFunction (cached with the name, CachedFunctionNameEntry)
 * into a bit of a 64-bit mask; a call site then runs its original test only when its bit is set. The bit is computed
 * from the very predicate the site tests (or a strict superset of it), so for any name the outcome is identical; the
 * original test is kept behind the bit as the authority. PE_CATEGORY_CACHE_OFF.flag (read once), or the uncached-name
 * mode (PE_FULLNAME_UNCACHED.flag), sets every bit, which is exactly the old behaviour.
 * Flag-gated developer paths (PE_NAME_DIAG, the damage multiplier, CORE_CAPTURE, the Tempest damage trace) are untouched:
 * they cost nothing while their flag is absent.
 */
enum MpPeCategory : int {
    MpPeCat_Econ = 0,              // Prestige | Draft | BountyToken | SeasonalCoin | HuntPass ([EconTrace])
    MpPeCat_PostEvent,             // PostEvent (headless audio absorb)
    MpPeCat_EscalationAuthState,   // EscalationGameModeComponent.AuthOnGameStateChanged
    MpPeCat_HandleBehemothKilled,  // PlayerExperienceComponent.HandleBehemothKilled
    MpPeCat_GrantWeaponXp,         // PlayerExperienceComponent.GrantWeaponExperience
    MpPeCat_GrantPlayerXp,         // PlayerExperienceComponent.GrantPlayerExperience
    MpPeCat_PerfectDodge,          // PerfectDodge
    MpPeCat_Bleedout,              // Bleedout | FinishingHit | NoHealth (BleedoutNoteEvent's own first test)
    MpPeCat_K2PostLogin,           // K2_PostLogin
    MpPeCat_PostLogin,             // PostLogin
    MpPeCat_Possession,            // AcknowledgePossession | CheckClientPossession | AcknowledgePawn
    MpPeCat_VendorCamera,          // vendor_interactive_bp_C.UpdateCameraForAspect
    MpPeCat_ClientRestart,         // == ClientRestart / ClientRetryClientRestart
    MpPeCat_MustSpectate,          // == GameModeBase.MustSpectate
    MpPeCat_PlayerCanRestart,      // == GameModeBase.PlayerCanRestart
    MpPeCat_TryActivateAbility,    // ServerTryActivateAbility (covers ...WithEventData)
    MpPeCat_EscalationFlow,        // IsEscalationFlowFunction
    MpPeCat_DroneTrace,            // SetDronePositionActor (TraceArtificerDroneEvent's own first test)
    MpPeCat_Count
};
static_assert(MpPeCat_Count <= 64, "MpPeCategory must fit the 64-bit mask");

static uint64_t MpPeComputeCategoryMask(const std::string& N) {
    auto Has = [&N](const char* Token) { return N.find(Token) != std::string::npos; };
    uint64_t Mask = 0;
    auto Set = [&Mask](int Bit, bool On) { if (On) Mask |= (1ull << Bit); };
    Set(MpPeCat_Econ, Has("Prestige") || Has("Draft") || Has("BountyToken") || Has("SeasonalCoin") || Has("HuntPass"));
    Set(MpPeCat_PostEvent, Has("PostEvent"));
    Set(MpPeCat_EscalationAuthState, Has("EscalationGameModeComponent.AuthOnGameStateChanged"));
    Set(MpPeCat_HandleBehemothKilled, Has("PlayerExperienceComponent.HandleBehemothKilled"));
    Set(MpPeCat_GrantWeaponXp, Has("PlayerExperienceComponent.GrantWeaponExperience"));
    Set(MpPeCat_GrantPlayerXp, Has("PlayerExperienceComponent.GrantPlayerExperience"));
    Set(MpPeCat_PerfectDodge, Has("PerfectDodge"));
    Set(MpPeCat_Bleedout, Has("Bleedout") || Has("FinishingHit") || Has("NoHealth"));
    Set(MpPeCat_K2PostLogin, Has("K2_PostLogin"));
    Set(MpPeCat_PostLogin, Has("PostLogin"));
    Set(MpPeCat_Possession, Has("AcknowledgePossession") || Has("CheckClientPossession") || Has("AcknowledgePawn"));
    Set(MpPeCat_VendorCamera, Has("vendor_interactive_bp_C.UpdateCameraForAspect"));
    Set(MpPeCat_ClientRestart, N == "Function Engine.PlayerController.ClientRestart"
        || N == "Function Engine.PlayerController.ClientRetryClientRestart");
    Set(MpPeCat_MustSpectate, N == "Function Engine.GameModeBase.MustSpectate");
    Set(MpPeCat_PlayerCanRestart, N == "Function Engine.GameModeBase.PlayerCanRestart");
    Set(MpPeCat_TryActivateAbility, Has("ServerTryActivateAbility"));
    Set(MpPeCat_EscalationFlow, IsEscalationFlowFunction(N));
    Set(MpPeCat_DroneTrace, Has("SetDronePositionActor"));
    return Mask;
}

static std::string MpGrantTraceCallChain();        // defined with [GrantTrace]
static std::string MpGrantTraceUFunctionChain();   // defined with [GrantTrace]

void ProcessEventHook(UObject* Object, UFunction* Function, void* Parms) {
    // [1.12.0 REENTRANCY GUARD 2026-07-10] Safety-net against runaway ProcessEvent
    // recursion. Root cause of the FTUE crash was
    // AArchonCharacter::SetClientAuthoritativeCustomMovement_Implementation
    // (RVA 0x017BBA10): with our NetModeHook forcing return=1 (DedicatedServer), the
    // fn takes the server branch which dispatches the Client_ RPC
    // ClientRequestClientAuthoritativeCustomMovementChange via ProcessEvent. On the
    // dedicated server's local-host player slot, that Client_ RPC gets Local callspace
    // (should be Remote) and runs the exec function locally, which loops back into
    // SetClientAuthoritativeCustomMovement. Infinite recursion.
    //
    // We're not currently hitting this in the Ramsgate hub path (the CACM cinematic
    // fires during hunt intros, not while walking around Ramsgate). But the guard
    // stays as a safety net for any future path that recurses. Beyond depth 32 we
    // ABSORB — return without calling OrigProcessEvent. Passing through would let the
    // game's own recursion continue eating stack (was the 8788 crash pattern in the
    // previous build). Absorbing breaks the chain.
    static thread_local int s_processEventDepth = 0;
    static thread_local UFunction* s_peStack[64] = {};   // [T7 Step 1g] parent UFunction chain for semantic caller ID
    struct DepthGuard {
        DepthGuard(UFunction* f)  {
            if (s_processEventDepth >= 0 && s_processEventDepth < 64) { s_peStack[s_processEventDepth] = f; g_MpPeChain[s_processEventDepth] = f; }
            ++s_processEventDepth;
            g_MpPeChainDepth = s_processEventDepth;
        }
        ~DepthGuard() { --s_processEventDepth; g_MpPeChainDepth = s_processEventDepth; }
    } g_depthGuard(Function);

    if (s_processEventDepth > 32) {
        static thread_local bool s_reportedRecursion = false;
        if (!s_reportedRecursion) {
            s_reportedRecursion = true;
            std::string FunctionName = Function ? Function->GetFullName() : "null";
            std::string ObjectName = Object ? Object->GetFullName() : "null";
            MpLog("[ProcessEventHook] REENTRANCY-GUARD tripped (depth="
                + std::to_string(s_processEventDepth) + ") — ABSORBING call. "
                + "fn=" + FunctionName + " obj=" + ObjectName);
        }
        return;   // DO NOT call OrigProcessEvent — breaks any game-side recursion.
    }

    static UFunction* ServerTryActivateAbilityWithEventData = nullptr;
    static UFunction* ServerTryActivateAbility = nullptr;
    static UFunction* OnAirshipUpdated = nullptr;
    static UFunction* OnPostMitDealtAnyDamage = nullptr;

    // [2026-10-10 1.14.7 CPU] The full name (an Outer-chain walk with FName/FString/std::string allocations at each
    // level) used to be built on EVERY reflected call. It now comes from the client's per-UFunction cache
    // (CachedFunctionFullName: thread_local, validated by Index/FName/Outer, same "null" text). Every use below only
    // reads it. PE_FULLNAME_UNCACHED.flag (read once) builds it per call as before.
    static int s_peNameCacheMode = -1;
    if (s_peNameCacheMode < 0) {
        s_peNameCacheMode = MpExeRelativeFlagPresent(L"PE_FULLNAME_UNCACHED.flag") ? 0 : 1;
        MpLog(std::string("[PENameCache] server full-name cache ")
            + (s_peNameCacheMode ? "ON" : "OFF (PE_FULLNAME_UNCACHED.flag)"));
    }
    std::string FunctionNameUncached;
    MpFunctionNameCacheEntry* PeNameEntry = (s_peNameCacheMode == 1 && Function) ? &CachedFunctionNameEntry(Function) : nullptr;
    const std::string& FunctionName = s_peNameCacheMode == 1
        ? (PeNameEntry ? PeNameEntry->Name : CachedFunctionFullName(nullptr))
        : (FunctionNameUncached = Function ? Function->GetFullName() : std::string("null"));

    // [2026-10-16 0.2.143] Server diagnostic, read-only: who sends a player back to the menu. The client's TravelCause trace
    // (0.2.142) showed the travel to the login screen is queued by this server's ClientReturnToMainMenuWithTextReason RPC, sent
    // right after the Hunt Pass replication, for a player at the hidden ExperienceTrack_PlayerLevel rank 20. Log the native caller
    // chain (RVAs with their function starts) and the reflected chain once per call, at most 32 per process.
    if (FunctionName.find("ClientReturnToMainMenu") != std::string::npos || FunctionName.find("ClientWasKicked") != std::string::npos) {
        static std::atomic<int> s_returnToMenuSeq{ 0 };
        const int Seq = s_returnToMenuSeq.fetch_add(1, std::memory_order_relaxed);
        if (Seq < 32) {
            MpLog("[ReturnToMenuTrace #" + std::to_string(Seq) + "] fn=" + FunctionName
                + " obj=" + (Object ? SafeObjectNameForDiagnostic(Object) : std::string("null"))
                + " native=" + MpGrantTraceCallChain() + " reflected=" + MpGrantTraceUFunctionChain());
        }
    }

    // [2026-10-11 1.14.7 O3] Per-UFunction category mask (see MpPeCategory). ~0 = every test runs (the old behaviour).
    static int s_peCategoryMode = -1;
    if (s_peCategoryMode < 0) {
        s_peCategoryMode = (s_peNameCacheMode == 1 && !MpExeRelativeFlagPresent(L"PE_CATEGORY_CACHE_OFF.flag")) ? 1 : 0;
        MpLog(std::string("[PECategoryCache] server per-UFunction name-test mask ")
            + (s_peCategoryMode ? "ON (PE_CATEGORY_CACHE_OFF.flag reverts)"
                                : (s_peNameCacheMode == 1 ? "OFF (PE_CATEGORY_CACHE_OFF.flag)" : "OFF (PE_FULLNAME_UNCACHED.flag)")));
    }
    uint64_t PeMask = ~0ull;
    if (s_peCategoryMode == 1 && PeNameEntry) {
        if (!PeNameEntry->PeMaskValid) {
            PeNameEntry->PeMask = MpPeComputeCategoryMask(PeNameEntry->Name);
            PeNameEntry->PeMaskValid = true;
        }
        PeMask = PeNameEntry->PeMask;
    }
    auto PeMay = [PeMask](int Bit) { return ((PeMask >> Bit) & 1ull) != 0; };

    // [1.14.7 HEADLESS AUDIO 2026-10-03] A dedicated hub must not play sound. Removing the Wwise
    // output device crashes the process (measured: EXCEPTION_ACCESS_VIOLATION writing 0x...a4, round
    // 25), so the safe layer is here: absorb the game's own sound POSTING while every engine pointer
    // stays valid. UAkGameplayStatics::PostEvent / PostEventAtLocation (strings at 0x1453C96F8 /
    // 0x1453C9708) are the entry points the game uses to play a sound; skipping them means nothing is
    // ever played. Server role only; ENABLE_SERVER_AUDIO.flag restores posting for debugging.
    static int s_audioPostSuppression = -1;
    if (s_audioPostSuppression < 0) {
        s_audioPostSuppression = (Globals::AmServer
            && !MpExeRelativeFlagPresent(L"ENABLE_SERVER_AUDIO.flag")) ? 1 : 0;
        MpLog(std::string("[HeadlessAudio] sound posting ")
            + (s_audioPostSuppression ? "SUPPRESSED (server role)" : "left intact"));
    }
    // [1.14.7 SEASON FLOW DIAGNOSTIC 2026-10-03] PE_NAME_DIAG.flag: log every reflected call whose
    // name mentions hunt pass / progression / season / trigger. The hub never issues the progression
    // configuration query and never asks SelectedHuntPassEndpoint (/huntpass/<account>), so the flow
    // stops upstream of both; this shows exactly which season-related UFUNCTIONs DO run and where the
    // chain stops. Bounded to 400 lines so a long run cannot flood the log.
    static int s_peNameDiag = -1;
    if (s_peNameDiag < 0) {
        s_peNameDiag = MpExeRelativeFlagPresent(L"PE_NAME_DIAG.flag") ? 1 : 0;
        MpLog(std::string("[SeasonFlowDiag] PE name filter ") + (s_peNameDiag ? "ENABLED" : "disabled"));
    }
    if (s_peNameDiag == 1
        && (FunctionName.find("HuntPass") != std::string::npos
            || FunctionName.find("Progression") != std::string::npos
            || FunctionName.find("Season") != std::string::npos
            || FunctionName.find("Trigger") != std::string::npos)) {
        static std::atomic<int> s_seasonFlowSeq{ 0 };
        const int SeasonSeq = s_seasonFlowSeq.fetch_add(1, std::memory_order_relaxed);
        if (SeasonSeq < 400) {
            MpLog("[SeasonFlowDiag] seq=" + std::to_string(SeasonSeq) + " fn=" + FunctionName
                + " obj=" + (Object ? SafeObjectNameForDiagnostic(Object) : std::string("<null>")));
        }
    }

    // [1.14.7 DIAG 2026-10-10] [EconTrace] - the reflected game functions behind the two economy oddities the backend
    // monitors watch ([PrestigeMon]: the hunt server asks for 400 Cache Coins twice per kill and is refused for lack of
    // banked season progress; [DraftMon]: every Ramsgate arrival writes the bounty draft tokens up and back down).
    // Server role, always on, bounded: 8 lines per function name, 200 per process. ECON_TRACE_OFF.flag silences it.
    if (Globals::AmServer && Function) {
        static int s_econTrace = -1;
        // [2026-10-11 O3] Also off with PRODUCTION_LOG_PROFILE.flag.
        if (s_econTrace < 0) s_econTrace = (MpExeRelativeFlagPresent(L"ECON_TRACE_OFF.flag") || MpProductionLogProfile()) ? 0 : 1;
        static std::atomic<int> s_econTotal{ 0 };
        if (s_econTrace == 1 && s_econTotal.load(std::memory_order_relaxed) < 200
            && PeMay(MpPeCat_Econ)
            && (FunctionName.find("Prestige") != std::string::npos
                || FunctionName.find("Draft") != std::string::npos
                || FunctionName.find("BountyToken") != std::string::npos
                || FunctionName.find("SeasonalCoin") != std::string::npos
                || FunctionName.find("HuntPass") != std::string::npos)) {
            static std::mutex s_econMutex;
            static std::unordered_map<std::string, int> s_econPerFn;   // bounded by the number of matching names
            int Count = 0;
            {
                std::lock_guard<std::mutex> Lock(s_econMutex);
                Count = ++s_econPerFn[FunctionName];
            }
            if (Count <= 8) {
                s_econTotal.fetch_add(1, std::memory_order_relaxed);
                MpLog("[EconTrace] fn=" + FunctionName + " obj=" + (Object ? SafeObjectNameForDiagnostic(Object) : std::string("<null>"))
                    + " n=" + std::to_string(Count));
            }
        }
    }

    if (s_audioPostSuppression == 1 && PeMay(MpPeCat_PostEvent) && FunctionName.find("PostEvent") != std::string::npos) {
        static std::atomic<int> s_audioPostAbsorbed{ 0 };
        const int AudioSeq = s_audioPostAbsorbed.fetch_add(1, std::memory_order_relaxed);
        if (AudioSeq < 5) {
            MpLog("[HeadlessAudio] absorbed sound post seq=" + std::to_string(AudioSeq)
                + " fn=" + FunctionName
                + " obj=" + (Object ? SafeObjectNameForDiagnostic(Object) : std::string("<null>")));
        }
        return;   // never reaches OrigProcessEvent: the sound is not posted
    }

    TempestDamageDiagCall TempestDamageCall{};
    if (PeMay(MpPeCat_DroneTrace)) TraceArtificerDroneEvent("Server", "ENTER", Object, FunctionName, Parms);

    // [DEBUG ONLY 2026-07-26] Repro-speedup damage multiplier for local testing (e.g. reproducing
    // the 2-player escalation phase-1 stall without sitting through a doubled-health behemoth).
    // Scales the incoming damage on the four ArchonBehemoth damage-receive events BEFORE they
    // dispatch to the Blueprint, so the multiplied value is what actually gets subtracted from
    // health. Must run on the authoritative dedicated-server process (Globals::AmServer) - scaling
    // it client-side would be a no-op: health is server-authoritative and the client's own copy
    // would just get overwritten by the next replicated health update.
    //
    // Four-way gated so enabling development diagnostics does not also enable combat mutation:
    //   1. MYSTICPARADOX_RUNTIME_PROFILE must be exactly "development".
    //   2. MYSTICPARADOX_ALLOW_DAMAGE_DEBUG must be exactly "1" (the launcher never sets this).
    //   3. debug\DEBUG_DAMAGE_MULTIPLIER.flag must exist (create/delete to toggle; checked once
    //      per process launch, matching every other .flag toggle in this file).
    //   4. MYSTICPARADOX_DEBUG_DAMAGE_MULTIPLIER env var sets the factor (DeployServer forwards its own
    //      process.env to every spawned gameserver, so set this in ParadoxDirector/.env).
    // Global (applies to whoever is dealing damage) - deliberately not scoped to a specific
    // player, since the flag + server-side-only gating is already enough to keep this from ever
    // firing outside an intentional local repro run.
    if (Globals::AmServer && Function && Parms) {
        static const bool s_developmentRuntimeProfile = [] {
            char Profile[32]{};
            DWORD Length = GetEnvironmentVariableA("MYSTICPARADOX_RUNTIME_PROFILE", Profile,
                static_cast<DWORD>(std::size(Profile)));
            char DamageDebug[8]{};
            DWORD DamageLength = GetEnvironmentVariableA("MYSTICPARADOX_ALLOW_DAMAGE_DEBUG", DamageDebug,
                static_cast<DWORD>(std::size(DamageDebug)));
            return Length == 11 && strcmp(Profile, "development") == 0
                && DamageLength == 1 && DamageDebug[0] == '1';
        }();
        static const bool s_debugDamageMultiplierFlagPresent =
            s_developmentRuntimeProfile && MpExeRelativeFlagPresent(L"DEBUG_DAMAGE_MULTIPLIER.flag");

        if (s_debugDamageMultiplierFlagPresent) {
            static float s_debugDamageMultiplier = [] {
                char Buf[64];
                DWORD Len = GetEnvironmentVariableA("MYSTICPARADOX_DEBUG_DAMAGE_MULTIPLIER", Buf, sizeof(Buf));
                if (Len == 0 || Len >= sizeof(Buf)) return 1.0f;
                float Parsed = 1.0f;
                try { Parsed = std::stof(Buf); } catch (...) { return 1.0f; }
                return (Parsed > 0.0f) ? Parsed : 1.0f;
            }();

            if (s_debugDamageMultiplier != 1.0f) {
                float* DamageField = nullptr;

                if (FunctionName.find("ArchonBehemoth.ReceiveArchonDamage") != std::string::npos
                    && IsReadablePointer(Parms, sizeof(Params::ArchonBehemoth_ReceiveArchonDamage))) {
                    DamageField = &reinterpret_cast<Params::ArchonBehemoth_ReceiveArchonDamage*>(Parms)->Damage;
                }
                else if (FunctionName.find("ArchonBehemoth.ReceiveArchonPointDamage") != std::string::npos
                    && IsReadablePointer(Parms, sizeof(Params::ArchonBehemoth_ReceiveArchonPointDamage))) {
                    DamageField = &reinterpret_cast<Params::ArchonBehemoth_ReceiveArchonPointDamage*>(Parms)->Damage;
                }
                else if (FunctionName.find("ArchonBehemoth.ReceiveArchonRadialDamage") != std::string::npos
                    && IsReadablePointer(Parms, sizeof(Params::ArchonBehemoth_ReceiveArchonRadialDamage))) {
                    DamageField = &reinterpret_cast<Params::ArchonBehemoth_ReceiveArchonRadialDamage*>(Parms)->DamageReceived;
                }
                else if (FunctionName.find("ArchonBehemoth.ReceivedArchonAbilityDamage") != std::string::npos
                    && FunctionName.find("OnMonsterPart") == std::string::npos
                    && IsReadablePointer(Parms, sizeof(Params::ArchonBehemoth_ReceivedArchonAbilityDamage))) {
                    DamageField = &reinterpret_cast<Params::ArchonBehemoth_ReceivedArchonAbilityDamage*>(Parms)->DamageReceived;
                }
                else if (FunctionName.find("ArchonBehemoth.ReceivedArchonAbilityDamageOnMonsterPart") != std::string::npos
                    && IsReadablePointer(Parms, sizeof(Params::ArchonBehemoth_ReceivedArchonAbilityDamageOnMonsterPart))) {
                    DamageField = &reinterpret_cast<Params::ArchonBehemoth_ReceivedArchonAbilityDamageOnMonsterPart*>(Parms)->DamageReceived;
                }

                if (DamageField) {
                    float Before = *DamageField;
                    *DamageField = Before * s_debugDamageMultiplier;
                    MpLog("[DebugDamageMultiplier] fn=" + FunctionName
                        + " obj=" + SafeObjectNameForDiagnostic(Object)
                        + " before=" + std::to_string(Before)
                        + " after=" + std::to_string(*DamageField)
                        + " multiplier=" + std::to_string(s_debugDamageMultiplier));
                }
            }
        }
    }

    // Capture after the optional debug multiplier so Guard evidence and diagnostics describe the
    // value actually sent into the game Blueprint.
    P2PHooks::ObserveServerEvent(FunctionName, Parms);

    // Capture after the optional debug multiplier so diagnostics describe the value actually sent
    // into the game Blueprint. Production captures have the multiplier flag absent.
    TempestDamageCall = TraceTempestDamageEnter(Object, FunctionName, Parms);

    // [2026-10-11 O3] Category-gated; [EscalationFlow][Server] lines are off with PRODUCTION_LOG_PROFILE.flag.
    const int EscalationFlowServerSeq = (PeMay(MpPeCat_EscalationFlow) && !MpProductionLogProfile())
        ? TraceEscalationFlowEnter("Server", Object, FunctionName, Parms) : -1;

    // [2026-07-25 AMP ROOT-CAUSE FIX] Observe the escalation round-finished transition so the deferred
    // pump can invoke SpawnPlayerBuffChoicesForFinishedRound, which the shipped Blueprint graph never
    // calls. Recording only - no dispatch from inside this hook. See TickEscalationBuffChoiceSpawn.
    if (Function && Parms && PeMay(MpPeCat_EscalationAuthState)
        && FunctionName.find("EscalationGameModeComponent.AuthOnGameStateChanged")
               != std::string::npos) {
        NoteEscalationStateChangeForBuffChoices(Object, Parms);
    }

    // [2026-07-23 WEAPON XP HUD DIAG] Trace the authoritative inputs before the progression HTTP
    // request is emitted. HandleBehemothKilled supplies the killed actor and its replicated internal
    // ContentLevel; GrantWeaponExperience supplies the native base/bonus split; GrantPlayerExperience
    // confirms whether the parallel Slayer-level award differs. No values are changed.
    int WeaponXpServerGrantSeq = -1;
    Params::PlayerExperienceComponent_GrantWeaponExperience* WeaponXpServerGrant = nullptr;
    if (Function && Parms && PeMay(MpPeCat_HandleBehemothKilled)
        && FunctionName.find("PlayerExperienceComponent.HandleBehemothKilled") != std::string::npos
        && IsReadablePointer(Parms, sizeof(Params::PlayerExperienceComponent_HandleBehemothKilled))) {
        static std::atomic<int> s_weaponXpServerKillCount{ 0 };
        int Seq = s_weaponXpServerKillCount.fetch_add(1, std::memory_order_relaxed);
        if (Seq < 128 && !MpProductionLogProfile()) {   // [2026-10-11 O3] log-only block
            auto* KillParms = reinterpret_cast<Params::PlayerExperienceComponent_HandleBehemothKilled*>(Parms);
            void* Behemoth = KillParms->Behemoth;
            void* ThreatComponent = (Behemoth && IsReadablePointer(Behemoth, 0x67C))
                ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Behemoth) + 0x5E8) : nullptr;
            int32_t ContentLevel = (ThreatComponent && IsReadablePointer(ThreatComponent, 0x10C))
                ? *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(ThreatComponent) + 0x108) : -1;
            float GlobalPower = (Behemoth && IsReadablePointer(Behemoth, 0x67C))
                ? *reinterpret_cast<float*>(reinterpret_cast<uintptr_t>(Behemoth) + 0x678) : -1.0f;
            MpLog("[WeaponXP][ServerKill] seq=" + std::to_string(Seq)
                + " component=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
                + " behemoth=" + MpPtr(Behemoth) + "/" + SafeObjectNameForDiagnostic(Behemoth)
                + " threat=" + MpPtr(ThreatComponent)
                + " contentLevel=" + std::to_string(ContentLevel)
                + " globalPower=" + std::to_string(GlobalPower));
        }
    }

    if (Function && Parms && PeMay(MpPeCat_GrantWeaponXp) && !MpProductionLogProfile()   // [2026-10-11 O3] log-only
        && FunctionName.find("PlayerExperienceComponent.GrantWeaponExperience") != std::string::npos
        && IsReadablePointer(Parms, sizeof(Params::PlayerExperienceComponent_GrantWeaponExperience))) {
        static std::atomic<int> s_weaponXpServerGrantCount{ 0 };
        WeaponXpServerGrantSeq = s_weaponXpServerGrantCount.fetch_add(1, std::memory_order_relaxed);
        if (WeaponXpServerGrantSeq < 256) {
            WeaponXpServerGrant = reinterpret_cast<Params::PlayerExperienceComponent_GrantWeaponExperience*>(Parms);
            MpLog("[WeaponXP][ServerGrant] ENTER seq=" + std::to_string(WeaponXpServerGrantSeq)
                + " component=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
                + " type=" + std::to_string(static_cast<int>(WeaponXpServerGrant->WeaponXPType))
                + " base=" + std::to_string(WeaponXpServerGrant->BaseAmount)
                + " bonus=" + std::to_string(WeaponXpServerGrant->BonusAmount));
        }
    }

    if (Function && Parms && PeMay(MpPeCat_GrantPlayerXp) && !MpProductionLogProfile()   // [2026-10-11 O3] log-only
        && FunctionName.find("PlayerExperienceComponent.GrantPlayerExperience") != std::string::npos
        && IsReadablePointer(Parms, sizeof(Params::PlayerExperienceComponent_GrantPlayerExperience))) {
        static std::atomic<int> s_playerXpServerGrantCount{ 0 };
        int Seq = s_playerXpServerGrantCount.fetch_add(1, std::memory_order_relaxed);
        if (Seq < 256) {
            auto* PlayerGrant = reinterpret_cast<Params::PlayerExperienceComponent_GrantPlayerExperience*>(Parms);
            MpLog("[WeaponXP][ServerPlayerGrant] ENTER seq=" + std::to_string(Seq)
                + " component=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
                + " amount=" + std::to_string(PlayerGrant->Amount));
        }
    }

    // Server-authoritative half of the Tempest perfect-dodge trace. If the passive modifier was
    // installed correctly, its OnPerfectDodge listener appears here and applies the Velocity stack.
    int TempestPerfectDodgeServerSeq = -1;
    if (Function && PeMay(MpPeCat_PerfectDodge) && !MpProductionLogProfile()   // [2026-10-11 O3] log-only
        && FunctionName.find("PerfectDodge") != std::string::npos) {
        static std::atomic<int> s_tempestPerfectDodgeServerCount{ 0 };
        TempestPerfectDodgeServerSeq = s_tempestPerfectDodgeServerCount.fetch_add(1, std::memory_order_relaxed);
        if (TempestPerfectDodgeServerSeq < 64) {
            MpLog("[TempestPerfectDodge][Server] ENTER seq=" + std::to_string(TempestPerfectDodgeServerSeq)
                + " fn=" + FunctionName + " obj=" + MpPtr(Object) + "/"
                + SafeObjectNameForDiagnostic(Object));
        }
    }

    // [2026-07-19] Bleedout-domain capture. ALWAYS ON — the permanent-downed bug is intermittent and
    // there is no second chance to switch a flag on after it happens. Returns immediately for the
    // ~all functions that are not bleedout-related, so the cost is a few string searches.
    // [2026-10-11 O3] Its first test is cached per UFunction (MpPeCat_Bleedout): still always on.
    if (PeMay(MpPeCat_Bleedout)) BleedoutNoteEvent(FunctionName, Object);

    // [2026-07-19 HANG DIAG] Always retain the raw innermost function/object pointers: these are two
    // cheap stores and remain useful in a production hang. The 160-byte name-ring write used to run on
    // every ProcessEvent, was added on the observed regression boundary, and adds avoidable pre-UWorld
    // map-startup work; keep that detailed history
    // behind VERBOSE_DIAG.flag. Gated to the game thread so it reflects the thread that can actually hang.
    {
        uint32_t gt = g_wdGameThreadId.load(std::memory_order_relaxed);
        if (gt == 0 || GetCurrentThreadId() == gt) {
            g_gtPeCurFunc.store(Function, std::memory_order_relaxed);
            g_gtPeCurObj.store(Object, std::memory_order_relaxed);
            if (VerboseDiag()) {
                uint32_t p = g_gtPeRingPos.fetch_add(1, std::memory_order_relaxed) % kPeRing;
                strncpy_s(g_gtPeNameRing[p], sizeof(g_gtPeNameRing[p]), FunctionName.c_str(), _TRUNCATE);
            }
        }
    }

    // A Core Breaker open consumes the core LOCALLY via one of these and never sends a removal to the
    // backend (BUG D infinite cores). Logging the exact call + params in ONE repro gives us what we need
    // to build the removeStacked relay: GrantAndConsumeItemsWithQuantity carries the ConsumeItems array
    // (core catalogId + amount); ServerConsumeItem/ConsumeItem carry the instanceId + amount + source.
    if (Function && Parms && CoreCaptureEnabled()) {
        auto DumpQtyArray = [](void* arrBase) -> std::string {
            // TArray<FPlayFabCatalogItemQuantity> = { Data(0x0); Num(0x8); Max(0xC) }; element = 0x18
            // ({ FString Item(0x0); int32 Amount(0x10) }).
            if (!IsReadablePointer(arrBase, 0x0C)) return "[?]";
            void* Data = *reinterpret_cast<void**>(arrBase);
            int32_t Num = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(arrBase) + 0x8);
            if (!Data || Num < 0 || Num > 256) return "[?]";
            std::string Out = "[";
            for (int i = 0; i < Num; ++i) {
                uintptr_t Elem = reinterpret_cast<uintptr_t>(Data) + static_cast<uintptr_t>(i) * 0x18;
                if (!IsReadablePointer(reinterpret_cast<void*>(Elem), 0x14)) { Out += (i ? ", ?" : "?"); continue; }
                std::string Item = CoreCapFString(reinterpret_cast<void*>(Elem));
                int32_t Amt = *reinterpret_cast<int32_t*>(Elem + 0x10);
                if (i) Out += ", ";
                Out += Item + " x" + std::to_string(Amt);
            }
            return Out + "]";
        };

        if (FunctionName.find("GrantAndConsumeItemsWithQuantity") != std::string::npos) {
            // Parms: GrantItems @0x00, ConsumeItems @0x10, Source FString @0x20.
            MpLog("[CORE-CAP] GrantAndConsumeItemsWithQuantity obj=" + MpPtr(Object)
                + " grant=" + DumpQtyArray(Parms)
                + " consume=" + DumpQtyArray(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Parms) + 0x10))
                + " source=" + CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Parms) + 0x20)));
        }
        else if (FunctionName.find("ServerConsumeItem") != std::string::npos) {
            // Parms: InstanceID FString @0x00, Amount int32 @0x10, Source FString @0x18.
            int32_t Amt = IsReadablePointer(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Parms) + 0x10), 4) ? *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Parms) + 0x10) : 0;
            MpLog("[CORE-CAP] ServerConsumeItem instanceId=" + CoreCapFString(Parms)
                + " amount=" + std::to_string(Amt)
                + " source=" + CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Parms) + 0x18)));
        }
        else if (FunctionName.find("InventoryConsumeItem") != std::string::npos) {
            // Parms: ItemIndex int32 @0x00, Amount int32 @0x04.
            int32_t Idx = IsReadablePointer(Parms, 4) ? *reinterpret_cast<int32_t*>(Parms) : -1;
            int32_t Amt = IsReadablePointer(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Parms) + 0x04), 4) ? *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Parms) + 0x04) : 0;
            MpLog("[CORE-CAP] InventoryConsumeItem itemIndex=" + std::to_string(Idx) + " amount=" + std::to_string(Amt));
        }
        else if (FunctionName.find("ConsumeItem") != std::string::npos) {
            // AArchonInventory::ConsumeItem(UArchonInventoryItem* @0x00, int32 Amount @0x08, FString Source @0x10).
            void* Item = *reinterpret_cast<void**>(Parms);
            int32_t Amt = IsReadablePointer(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Parms) + 0x08), 4) ? *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Parms) + 0x08) : 0;
            std::string InstId = IsReadablePointer(Item, 0x98) ? CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Item) + 0x88)) : std::string("?");
            MpLog("[CORE-CAP] ConsumeItem item=" + MpPtr(Item) + " instanceId=" + InstId
                + " amount=" + std::to_string(Amt)
                + " source=" + CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Parms) + 0x10)));
        }
    }

    // [Group E cleanup 2026-07-13] One-shot post-login timing anchor. (Previously also ran DumpEquipmentCatalog
    // — removed; the catalog is now dumped by the standalone CatalogExporter injectable, not the live server DLL.)
    {
        static std::atomic<bool> s_postLoginAnchor{ false };
        if (Function && PeMay(MpPeCat_K2PostLogin) && FunctionName.find("K2_PostLogin") != std::string::npos) {
            bool expected = false;
            if (s_postLoginAnchor.compare_exchange_strong(expected, true)) {
                g_postLoginTimeMs.store(GetTickCount64(), std::memory_order_relaxed);
            }
        }
    }

    // [2026-07-16] Per-controller post-login trace. These UFunctions (K2_PostLogin,
    // ClientOnPostLogin, PlayerPostLogin) route through this installed ProcessEvent hook on the
    // server, so this reliably confirms each controller reached post-login (unlike the
    // never-installed AGameMode::PostLogin native hook). K2_PostLogin's parm0 is the new
    // APlayerController. A lifecycle snapshot is taken at each so the late-joiner boundary is visible.
    if (Function && PeMay(MpPeCat_PostLogin) && FunctionName.find("PostLogin") != std::string::npos) {
        static std::atomic<int> s_plSeq{ 0 };
        int Seq = s_plSeq.fetch_add(1, std::memory_order_relaxed);
        // [2026-10-11 O3] PRODUCTION_LOG_PROFILE.flag skips the [PostLoginPE] line, its name lookups and the lifecycle
        // snapshot; the match start, AFK write, login stamp and pawn-diagnostic reset below always run.
        const bool PostLoginLog = !MpProductionLogProfile();
        std::string ObjName = (PostLoginLog && Object && IsReadablePointer(Object, 0x40)) ? Object->GetName() : std::string("?");
        std::string Extra;
        if (Parms && FunctionName.find("K2_PostLogin") != std::string::npos) {
            void* NewPlayer = *reinterpret_cast<void**>(Parms);
            std::string PcName = (PostLoginLog && NewPlayer && IsReadablePointer(NewPlayer, 0x40))
                ? reinterpret_cast<UObject*>(NewPlayer)->GetName() : std::string("?");
            Extra = " newPlayer=" + MpPtr(NewPlayer) + "/" + PcName;
            // [1.14.7 phantom removal] Start a still-waiting match before HandleStartingNewPlayer (which runs right after
            // K2_PostLogin) so this first player is spawned at once - see MpStartMatchWithoutPhantom.
            if (Globals::AmServer && g_NoLocalPlayerApplied.load(std::memory_order_relaxed) && Object
                && IsReadablePointer(Object, 0x2C8)
                && reinterpret_cast<SDK::FName*>(reinterpret_cast<uintptr_t>(Object) + 0x02C0)->ToString() == "WaitingToStart") {
                MpStartMatchWithoutPhantom(Object);
            }
            // [2026-10-10 1.14.7 AFK] Mandatory: the GS AFK timeout replicates COND_InitialOnly, so it must be set before
            // this connection's first GameState bunch (the 1 s tick write may not have run yet; it runs on the P2P host
            // too - corrected 11 Oct). Object (the GameMode) only classifies the role while the world has none; writes
            // go to the world's.
            if (Globals::AmServer) MpApplyAfkTimeout(Object, "postlogin");
            if (Globals::AmServer) g_MpLastPostLoginMs.store(GetTickCount64(), std::memory_order_relaxed);
            // [2026-07-18] New login boundary — reset the ClientRestart/pawn-relevancy capture window so
            // this login's possession handoff is traced even if earlier logins used up the old budget.
            g_pawnDiagCount.store(0, std::memory_order_relaxed);
        }
        if (PostLoginLog) {
            MpLog("[PostLoginPE #" + std::to_string(Seq) + "] fn=" + FunctionName
                + " obj=" + MpPtr(Object) + "/" + ObjName + Extra);
            LogArchonLifecycle(("PostLoginPE#" + std::to_string(Seq)).c_str());   // [2026-10-11 O2] world pointers
        }
    }

    // [2026-07-16] Possession-ack RPC trace (routes through this installed ProcessEvent hook on the
    // server). AcknowledgedPawn (PC+0x2A0) is the possession gate: until it == Pawn the server retries
    // ClientRestart. Per ack we log PC + NetConnection (PC+0x418, identifies P1 vs P2) + pawn param +
    // PC.Pawn (PC+0x250) + AcknowledgedPawn BEFORE, and (via the capture + tail read) AFTER the
    // _Implementation runs, to see whether P2's ack arrives while P1 is connected and whether it sticks.
    void* AckCapturePc = nullptr;
    void* AckPawnBefore = nullptr;
    // [2026-10-11 O3] Log-only (BEFORE here, AFTER at the tail via AckCapturePc); off with PRODUCTION_LOG_PROFILE.flag.
    if (Function && PeMay(MpPeCat_Possession) && !MpProductionLogProfile() &&
        (FunctionName.find("AcknowledgePossession") != std::string::npos
            || FunctionName.find("CheckClientPossession") != std::string::npos
            || FunctionName.find("AcknowledgePawn") != std::string::npos)) {
        std::string PossObjName = (Object && IsReadablePointer(Object, 0x420)) ? Object->GetName() : std::string("?");
        void* pawnParam = (Parms && FunctionName.find("AcknowledgePossession") != std::string::npos) ? *reinterpret_cast<void**>(Parms) : nullptr;
        void* pcPawn = nullptr; void* ackPawn = nullptr; void* netConn = nullptr;
        if (Object && IsReadablePointer(Object, 0x420)) {
            uintptr_t Pc = reinterpret_cast<uintptr_t>(Object);
            pcPawn  = *reinterpret_cast<void**>(Pc + 0x250);
            ackPawn = *reinterpret_cast<void**>(Pc + 0x2A0);
            netConn = *reinterpret_cast<void**>(Pc + 0x418);
            if (FunctionName.find("AcknowledgePossession") != std::string::npos) { AckCapturePc = Object; AckPawnBefore = ackPawn; }
        }
        MpLog("[PossessionRPC] fn=" + FunctionName + " pc=" + MpPtr(Object) + "/" + PossObjName
            + " netConn=" + MpPtr(netConn)
            + " pawnParam=" + MpPtr(pawnParam)
            + " PC.Pawn=" + MpPtr(pcPawn)
            + " AcknowledgedPawn(before)=" + MpPtr(ackPawn));
    }

    // [Group E2 cleanup 2026-07-13] [SlotSet] SetActiveLoadoutSlotIndex read-only diagnostic removed
    // (logged loadout slot fields around the dispatch; falls through to the general OrigProcessEvent tail).

    // [Group D2 cleanup 2026-07-13] Interaction callspace/net-mode probe block removed — it logged
    // [IxnTgt-SVR], one-time-installed the component/owner GetFunctionCallspace probes, and tagged
    // g_ixnWrapperTag around the dispatch. ClientInteractionCompleted/FailedToStart now flows to the
    // general OrigProcessEvent dispatch (function tail) unchanged — root fixed by items 1-2.

    // [1.12 VendorInteractionServerFix — 2026-07-10 — move.md §6]
    // vendor_interactive_bp_C:OnUserCompletedInteraction calls UpdateCameraForAspect,
    // which calls UserWidgetFunctions_C:GetCurrentScreenAspectRatio. On a dedicated
    // server (launched with -nullrhi), there is no viewport, so screen dimensions
    // are 0 → returns 0.0 → divide-by-zero in aspect calc → interaction UI never
    // completes properly.
    //
    // Server log evidence (port8790_ramsgate.log:385-397):
    //   [LogScript][Warning] Divide by zero detected: 0.000000 / 0
    //     Function .../vendor_interactive_bp_C:OnUserCompletedInteraction
    //     Function .../vendor_interactive_bp_C:UpdateCameraForAspect
    //     Function .../UserWidgetFunctions_C:GetCurrentScreenAspectRatio
    //
    // Fix: on the SERVER, absorb UpdateCameraForAspect. This is UI/camera code that
    // has no purpose on a dedicated server — the OWNING CLIENT will run its own
    // copy of this function on its own machine (where it has a real viewport) via
    // the natural interaction flow. Absorbing the server-side call prevents the
    // divide-by-zero and keeps server-side state consistent.
    //
    // Safety: this only fires on the SERVER (this is ProcessEventHook, not ClientHook).
    // Client-side UpdateCameraForAspect runs unaffected.
    // [IxnTrace-SVR 2026-07-11] Log the vendor/interaction flow on the server BEFORE the VendorFix
    // absorb below, so UpdateCameraForAspect is still visible. Critically, captures whether the server
    // itself dispatches ClientInteractionCompleted (natural send) — the decider for the vendor-UI fix.
    // [Group E2 cleanup 2026-07-13] [ReadyFn-SVR] LoadingDispatch readiness-setter logger removed.

    // [Group E2 cleanup 2026-07-13] [PStart-SVR] player-start readiness logger removed.


    // [Group E2 cleanup 2026-07-13] [SpecTrace-SVR] + [PEParent-SVR] spectator/restart-flow loggers removed.


    // [Group E2 cleanup 2026-07-13] [IxnTrace-SVR] interaction-target logger removed.


    // [Group E2 cleanup 2026-07-13] [LevelVis-SVR] ServerUpdateLevelVisibility logger removed.


    // [Phase 0P 2026-07-12] Capture the BATCH visibility RPC too — the client sends the initial
    // [Group E2 cleanup 2026-07-13] [LevelVisMulti-SVR] ServerUpdateMultipleLevelsVisibility logger removed.


    if (Function && PeMay(MpPeCat_VendorCamera) && FunctionName.find("vendor_interactive_bp_C.UpdateCameraForAspect")
        != std::string::npos)
    {
        static std::atomic<int> s_vendorAbsorbCount{0};
        int slot = s_vendorAbsorbCount.fetch_add(1, std::memory_order_relaxed);
        if (slot < 3 || (slot % 60) == 0) {
            MpLog("[VendorFix] Absorbed UpdateCameraForAspect on server (slot="
                + std::to_string(slot) + ") — avoids GetCurrentScreenAspectRatio 0/0");
        }
        return;   // ABSORB — do not call OrigProcessEvent
    }

    // [Group E2 cleanup 2026-07-13] [NativeCompletion] OnPlayerDataLoadComplete logger removed.


    // [Group E2 cleanup 2026-07-13] [LoadTrace] server load-marker logger removed.


    // [Group E2 cleanup 2026-07-13] [PossessRoleDiag] possession-chain Role/RemoteRole logger removed.


    // [1.12.0] Pawn actor replication diagnostic.
    //
    // Symptom: server calls Client_ClientRestart(pawn) once, then Client_ClientRetryClientRestart
    // repeatedly, but the client never resolves the pawn NetGUID -> retries with NewPawn==null
    // -> silent early-return -> no possession -> loading screen stays up forever.
    //
    // Since only the PC actor channel is open on the client (retries deliver, RPC delivery
    // to PC works fine), the pawn ACTOR itself is not being considered for replication to
    // this connection. Dump the pawn actor's replication-relevant state on the SERVER at
    // the exact moment ClientRestart / ClientRetryClientRestart is being sent, so we can
    // determine WHICH gate is failing:
    //   - bReplicates (AActor+0x005B bit0)
    //   - Role (AActor+0x00F0)  - should be ROLE_Authority (=3) on server
    //   - RemoteRole (AActor+0x005F) - should be ROLE_AutonomousProxy (=2) or SimulatedProxy (=1)
    //   - Owner (AActor+0x00E0) - should be the PC that owns this connection
    //   - NetDormancy (AActor+0x00F1) - should be DORM_Awake (=1) or DORM_Never (=0)
    //   - NetUpdateFrequency (AActor+0x0108)
    //   - Class name
    //   - Pawn's parent PC's server-side Pawn field (AController+0x0250) to confirm possession
    //
    // ENetRole:   0=None, 1=SimulatedProxy, 2=AutonomousProxy, 3=Authority
    // ENetDormancy: 0=Never, 1=Awake, 2=DormantAll, 3=DormantPartial, 4=Initial
    //
    // First-run findings (21:01:52 log): pawn is BP_PlayerCharacter_C, all standard rep
    // gates PASS (bReplicates=1, Role=Authority, RemoteRole=SimulatedProxy, NetDormancy=Awake,
    // Owner=correct PC, PC.Pawn matches). Yet replication doesn't happen. Standard property
    // checks aren't the blocker - it's upstream in ServerReplicateActors' consider/relevance
    // decision. Force the pawn to be maximally replication-friendly by flipping:
    //   - bAlwaysRelevant (AActor+0x0058 bit 3, mask 0x08) - skip distance-based culling
    //   - NetDormancy = DORM_Never (0) - never dormant
    //   - NetUpdateFrequency = 60.0 - as high as gameplay ticking
    //   - NetPriority = 3.0 (AActor+0x0110) - high priority in the rep list
    if (Function && PeMay(MpPeCat_ClientRestart) && (FunctionName == "Function Engine.PlayerController.ClientRestart"
                     || FunctionName == "Function Engine.PlayerController.ClientRetryClientRestart")) {
        const int PAWN_DIAG_BUDGET = 8;   // per-login: first ClientRestart + a few retries
        int slot = g_pawnDiagCount.fetch_add(1, std::memory_order_relaxed);
        if (Parms && IsReadablePointer(Parms, 0x8)) {
            UObject* PawnObj = *reinterpret_cast<UObject**>(Parms);   // NewPawn @ +0x00

            // Apply force-replicate patch EVERY call (idempotent - flags stay set)
            bool     patchApplied = false;
            uint8_t  before_58 = 0, after_58 = 0;
            uint8_t  before_dorm = 0xFF, after_dorm = 0xFF;
            float    before_freq = 0.0f, after_freq = 0.0f;
            float    before_prio = 0.0f, after_prio = 0.0f;
            uint8_t  before_remoteRole = 0xFF, after_remoteRole = 0xFF;
            if (PawnObj && IsReadablePointer(PawnObj, 0x120)) {
                uint8_t* byte58 = reinterpret_cast<uint8_t*>(reinterpret_cast<uintptr_t>(PawnObj) + 0x58);
                uint8_t* byteDorm = reinterpret_cast<uint8_t*>(reinterpret_cast<uintptr_t>(PawnObj) + 0xF1);
                float*   fFreq   = reinterpret_cast<float*>(reinterpret_cast<uintptr_t>(PawnObj) + 0x108);
                float*   fPrio   = reinterpret_cast<float*>(reinterpret_cast<uintptr_t>(PawnObj) + 0x110);
                // [1.12 ROLE-FIX 2026-07-10] AActor::RemoteRole @ 0x5F.
                // Verified in Assertions.inl:7033 static_assert.
                // Log evidence (mysticparadox_dll_port8790.log:3097) shows this stays at
                // SimulatedProxy(1) even though ClientRestart fires and possession
                // completes. That's because native SetAutonomousProxy(true) is
                // either skipped (PC.NetConnection null at Possess time) or reset
                // later. Client-side result: pawn arrives as SimulatedProxy →
                // ReplicateMoveToServer gated on LocalRole==AutonomousProxy →
                // never fires → server never sees ServerMovePacked → position
                // never updates. Fix: force RemoteRole=AutonomousProxy(2) here at
                // ClientRestart (server-side), BEFORE SetChannelActor #113 opens
                // the channel and serializes the initial replication state to
                // the client. This is Section 13.C of Analysis.md — the
                // analysis notes calling native SetAutonomousProxy is preferred
                // over raw byte write, but that helper isn't a UFUNCTION (native
                // inline, no exec wrapper) and needs Ghidra xref-trace to locate.
                // As a first-attempt fix, the byte write should be sufficient
                // because RemoteRole IS the storage — replication reads it
                // directly. If the write is later reset by some replication-tick
                // logic, we'll escalate to the native helper.
                uint8_t* byteRemoteRole = reinterpret_cast<uint8_t*>(reinterpret_cast<uintptr_t>(PawnObj) + 0x5F);
                before_58 = *byte58;
                before_dorm = *byteDorm;
                before_freq = *fFreq;
                before_prio = *fPrio;
                before_remoteRole = *byteRemoteRole;
                // [2026-07-18] Only force GLOBAL bAlwaysRelevant when the per-connection ViewTarget
                // relevancy fix is OFF. That fix (OwnerPawnRelevancyFix) makes the OWNER see their own
                // pawn via the per-connection always-relevant node WITHOUT marking the pawn globally
                // always-relevant. The old global force left the pawn in BOTH the spatial grid AND the
                // always-relevant set — an inconsistent state the grid-spatialization rebuild
                // (Dauntless-Win64-Shipping.exe+0xEC7304, "Rebuilding spatialization graph") faults on
                // (read null+0x248, ~94x/session, VEH-swallowed on the server but FATAL on clients), and
                // it also caused the co-op armor-hide regression. With the ViewTarget fix on (default),
                // keep the pawn purely spatial for non-owners so the grid stays consistent.
                if (!OwnerPawnRelevancyFix()) {
                    *byte58 = *byte58 | 0x08;   // legacy global always-relevant (superseded by ViewTarget fix)
                }
                *byteDorm = 0;              // DORM_Never
                if (*fFreq < 60.0f) *fFreq = 60.0f;
                if (*fPrio < 3.0f)  *fPrio = 3.0f;
                *byteRemoteRole = 2;        // ROLE_AutonomousProxy (2) — client owns movement
                after_58 = *byte58;
                after_dorm = *byteDorm;
                after_freq = *fFreq;
                after_prio = *fPrio;
                after_remoteRole = *byteRemoteRole;
                patchApplied = true;
            }

            // [2026-07-18] Owner-pawn per-connection relevancy fix. Point the OWNING connection's
            // ViewTarget at the pawn so the stock UReplicationGraph per-connection
            // AlwaysRelevant_ForConnection gather (FUN_140ed15a0, which the Archon graph delegates to)
            // makes the pawn relevant to its owner regardless of spatial-grid state — bypassing the
            // "grid cell not resolved during load" hole that leaves the client stuck (pawn NetGUID never
            // resolves, possession never acknowledged). Owner-only (per-connection) => no global
            // always-relevant, so no armor-hide regression. Object = the PlayerController; PC->NetConnection
            // @ +0x418; UNetConnection::ViewTarget @ +0x90 (same field the connect-time FORCE-VIEWTARGET
            // uses). Re-asserted on each ClientRestart/retry so it sticks through the possession handshake.
            if (OwnerPawnRelevancyFix() && PawnObj && Object && IsReadablePointer(Object, 0x420)) {
                void* netConn = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Object) + 0x418);
                if (netConn && IsReadablePointer(netConn, 0x98)) {
                    void** connViewTarget = reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(netConn) + 0x90);
                    if (*connViewTarget != reinterpret_cast<void*>(PawnObj)) {
                        static std::atomic<int> s_vtLog{ 0 };
                        if (s_vtLog.fetch_add(1, std::memory_order_relaxed) < 8)
                            MpLog("[OwnerPawnRelevancy] conn=" + MpPtr(netConn) + " ViewTarget "
                                + MpPtr(*connViewTarget) + " -> pawn " + MpPtr(PawnObj) + " (per-connection relevancy)");
                        *connViewTarget = reinterpret_cast<void*>(PawnObj);
                    }
                }
            }

            if (slot < PAWN_DIAG_BUDGET && !MpProductionLogProfile()) {   // [2026-10-11 O3] log-only block
                std::string pClass = "(null-pawn)";
                std::string pFullName = "(null-pawn)";
                uint8_t     pReplicatesByte = 0;
                uint8_t     pRemoteRole = 0xFF;
                uint8_t     pRole = 0xFF;
                UObject*    pOwner = nullptr;
                std::string pOwnerClass = "(none)";
                std::string pOwnerName = "(none)";

                if (PawnObj && IsReadablePointer(PawnObj, 0x110)) {
                    pFullName = PawnObj->GetFullName();
                    UObject* Cls = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(PawnObj) + 0x10);
                    if (Cls && IsReadablePointer(Cls, 0x20)) pClass = Cls->GetName();
                    pReplicatesByte = *reinterpret_cast<uint8_t*>(reinterpret_cast<uintptr_t>(PawnObj) + 0x5B);
                    pRemoteRole = *reinterpret_cast<uint8_t*>(reinterpret_cast<uintptr_t>(PawnObj) + 0x5F);
                    pRole = *reinterpret_cast<uint8_t*>(reinterpret_cast<uintptr_t>(PawnObj) + 0xF0);
                    pOwner = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(PawnObj) + 0xE0);
                    if (pOwner && IsReadablePointer(pOwner, 0x20)) {
                        pOwnerName = pOwner->GetFullName();
                        UObject* OwnerCls = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(pOwner) + 0x10);
                        if (OwnerCls && IsReadablePointer(OwnerCls, 0x20)) pOwnerClass = OwnerCls->GetName();
                    }
                }

                void* pcPawn = nullptr;
                if (Object && IsReadablePointer(Object, 0x258)) {
                    pcPawn = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Object) + 0x250);
                }

                bool bReplicates = (pReplicatesByte & 0x01) != 0;
                const char* remoteRoleName =
                    pRemoteRole == 0 ? "None" : pRemoteRole == 1 ? "SimulatedProxy" :
                    pRemoteRole == 2 ? "AutonomousProxy" : pRemoteRole == 3 ? "Authority" : "?";
                const char* roleName =
                    pRole == 0 ? "None" : pRole == 1 ? "SimulatedProxy" :
                    pRole == 2 ? "AutonomousProxy" : pRole == 3 ? "Authority" : "?";

                MpLog("[PAWN #" + std::to_string(slot) + "] fn=" + FunctionName
                    + " pawn=" + MpPtr(PawnObj) + "/" + pClass
                    + " pcPawn(+0x250)=" + MpPtr(pcPawn)
                    + " match=" + std::to_string(pcPawn == PawnObj ? 1 : 0));
                MpLog("[PAWN #" + std::to_string(slot) + "] pawnFullName=" + pFullName);
                MpLog("[PAWN #" + std::to_string(slot) + "] bReplicates=" + std::to_string(bReplicates ? 1 : 0)
                    + " Role=" + std::string(roleName) + "(" + std::to_string(pRole) + ")"
                    + " RemoteRole=" + std::string(remoteRoleName) + "(" + std::to_string(pRemoteRole) + ")");
                MpLog("[PAWN #" + std::to_string(slot) + "] owner=" + MpPtr(pOwner) + "/" + pOwnerClass
                    + " ownerName=" + pOwnerName);
                MpLog("[PAWN #" + std::to_string(slot) + "] FORCE-REP patch applied=" + std::to_string(patchApplied ? 1 : 0)
                    + "  +0x58 before=0x" + std::to_string(before_58) + " after=0x" + std::to_string(after_58)
                    + " (bAlwaysRelevant bit3 mask 0x08)"
                    + "  NetDormancy before=" + std::to_string(before_dorm) + " after=" + std::to_string(after_dorm)
                    + "  NetUpdateFreq before=" + std::to_string(before_freq) + " after=" + std::to_string(after_freq)
                    + "  NetPriority before=" + std::to_string(before_prio) + " after=" + std::to_string(after_prio)
                    + "  RemoteRole before=" + std::to_string(before_remoteRole) + " after=" + std::to_string(after_remoteRole)
                    + " (2=AutonomousProxy)");
            }
        }
    }

    // [1.12.0] Force AGameMode::PlayerCanRestart -> true AND properly set
    // UNetConnection::ClientWorldPackageName via the real setter helper.
    //
    // Setter located in Ghidra as FUN_143d64090 (RVA 0x03D64090):
    //   MOV [RCX+0x1600], RDX      ; store FName
    //   JMP FUN_143d669b0          ; tail-call: notify actor channels of world-load state change
    // Signature: void __fastcall(UNetConnection* this, FName WorldPackageName)
    //
    // IMPORTANT: on the server there are (at least) TWO PlayerControllers:
    //   - Listen-server host slot: PC.Player (+0x298) points at bp_archon_local_player_C
    //                              (a ULocalPlayer subclass). PC.NetConnection (+0x418) is null.
    //   - Real remote client:      PC.Player (+0x298) points at an IpConnection (real UNetConnection).
    //                              PC.NetConnection (+0x418) is also populated with the same ptr.
    //
    // Field layout from SDK/Engine_classes.hpp:
    //   +0x0298  UPlayer*        Player          (generic base of both UPlayer subclasses)
    //   +0x0418  UNetConnection* NetConnection   (populated only when Player IS a UNetConnection)
    //
    // Two-source strategy for robustness:
    //   1) PREFER +0x418 (NetConnection) - guaranteed UNetConnection when non-null
    //   2) FALLBACK to +0x298 (Player) with class-name filter - matches what UE engine
    //      itself does in APlayerController::ServerNotifyLoadedWorld_Implementation
    //      via Cast<UNetConnection>(Player).
    //
    // [T5 Step 1e] MustSpectate return — does the city GameMode classify the returning player as must-spectate?
    // Post-orig (return valid). Parms+0 = APlayerController*, Parms+0x8 = bool ReturnValue.
    static UFunction* CachedMustSpectate = nullptr;
    if ((CachedMustSpectate && Function == CachedMustSpectate) ||
        (!CachedMustSpectate && Function && PeMay(MpPeCat_MustSpectate)
            && FunctionName == "Function Engine.GameModeBase.MustSpectate")) {
        CachedMustSpectate = Function;
        if (Parms && IsReadablePointer(Parms, 0x10)) {
            UObject* PlayerObj = *reinterpret_cast<UObject**>(Parms);
            bool Ret = *reinterpret_cast<bool*>(reinterpret_cast<uintptr_t>(Parms) + 0x8);
            static std::atomic<int> s_msLog{0};
            if (s_msLog.fetch_add(1, std::memory_order_relaxed) < 20)
                MpLog("[MustSpectate] ret=" + std::to_string(Ret ? 1 : 0)
                    + " player=" + (PlayerObj ? PlayerObj->GetFullName() : "null"));
        }
    }

    // UObject layout: Class @ +0x10, Name @ +0x18, Outer @ +0x20.
    static UFunction* CachedPlayerCanRestart = nullptr;
    if ((CachedPlayerCanRestart && Function == CachedPlayerCanRestart) ||
        (!CachedPlayerCanRestart && Function && PeMay(MpPeCat_PlayerCanRestart)
            && FunctionName == "Function Engine.GameModeBase.PlayerCanRestart")) {
        CachedPlayerCanRestart = Function;

        if (Parms && IsReadablePointer(Parms, 0x10)) {
            UObject* PlayerObj = *reinterpret_cast<UObject**>(Parms);
            bool     PriorRet  = *reinterpret_cast<bool*>(reinterpret_cast<uintptr_t>(Parms) + 0x8);

            static std::atomic<int> s_diagLogCount{0};
            const int LOG_BUDGET = 5;

            // Read both connection fields
            UObject* ConnFrom298 = nullptr;   // Player  (+0x298) - could be UNetConnection or ULocalPlayer
            UObject* ConnFrom418 = nullptr;   // NetConnection (+0x418) - dedicated UNetConnection*
            std::string Class298 = "(none)";
            std::string Class418 = "(none)";

            if (PlayerObj && IsReadablePointer(PlayerObj, 0x420)) {
                ConnFrom298 = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(PlayerObj) + 0x298);
                ConnFrom418 = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(PlayerObj) + 0x418);

                if (ConnFrom298 && IsReadablePointer(ConnFrom298, 0x20)) {
                    UObject* ClsObj = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(ConnFrom298) + 0x10);
                    if (ClsObj && IsReadablePointer(ClsObj, 0x20)) Class298 = ClsObj->GetName();
                }
                if (ConnFrom418 && IsReadablePointer(ConnFrom418, 0x20)) {
                    UObject* ClsObj = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(ConnFrom418) + 0x10);
                    if (ClsObj && IsReadablePointer(ClsObj, 0x20)) Class418 = ClsObj->GetName();
                }
            }

            // Resolve which connection to actually use (prefer +0x418 as it's type-safe)
            UObject* NetConnObj = nullptr;
            std::string NetConnClass = "(none)";
            std::string ConnSource = "none";
            if (ConnFrom418) {
                // If +0x418 is populated, it's guaranteed a UNetConnection (per UE4 SetPlayer)
                NetConnObj = ConnFrom418;
                NetConnClass = Class418;
                ConnSource = "+0x418";
            }
            else if (ConnFrom298
                     && Class298.find("Connection") != std::string::npos
                     && Class298.find("local_player") == std::string::npos) {
                // Fallback: use +0x298 only if its class name looks like a real connection
                NetConnObj = ConnFrom298;
                NetConnClass = Class298;
                ConnSource = "+0x298";
            }

            // Walk Outer chain to get world's outermost package FName
            std::string OuterChain;
            uint64_t WorldOutermostFName = 0;
            UObject* TopOuter = nullptr;
            if (PlayerObj) {
                UObject* Cur = PlayerObj;
                TopOuter = Cur;
                for (int hops = 0; hops < 8; ++hops) {
                    if (!IsReadablePointer(Cur, 0x28)) break;
                    if (!OuterChain.empty()) OuterChain += " -> ";
                    OuterChain += Cur->GetFullName();
                    UObject* Nxt = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(Cur) + 0x20);
                    if (!Nxt) break;
                    TopOuter = Nxt;
                    Cur = Nxt;
                }
                if (TopOuter && IsReadablePointer(TopOuter, 0x20)) {
                    WorldOutermostFName = *reinterpret_cast<uint64_t*>(reinterpret_cast<uintptr_t>(TopOuter) + 0x18);
                }
            }

            uint64_t ConnBeforeFName = 0;
            uint64_t ConnAfterFName  = 0;
            bool     SetterInvoked   = false;
            if (NetConnObj && IsReadablePointer(NetConnObj, 0x1608)) {
                ConnBeforeFName = *reinterpret_cast<uint64_t*>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x1600);
                if (WorldOutermostFName != 0) {
                    SetterInvoked = SafeSetClientWorldPackageName(NetConnObj, WorldOutermostFName);
                    ConnAfterFName = *reinterpret_cast<uint64_t*>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x1600);
                }
            }

            int slot = s_diagLogCount.fetch_add(1, std::memory_order_relaxed);
            if (slot < LOG_BUDGET) {
                MpLog("[CWPN #" + std::to_string(slot) + "] object=" + (Object ? Object->GetFullName() : std::string("null"))
                    + " player=" + MpPtr(PlayerObj)
                    + " conn+0x298=" + MpPtr(ConnFrom298) + "/" + Class298
                    + " conn+0x418=" + MpPtr(ConnFrom418) + "/" + Class418
                    + " chosen=" + ConnSource + "/" + NetConnClass);
                MpLog("[CWPN #" + std::to_string(slot) + "] outerChain: " + OuterChain);
                MpLog("[CWPN #" + std::to_string(slot) + "] topFName=" + std::to_string(WorldOutermostFName)
                    + " conn+0x1600 before=" + std::to_string(ConnBeforeFName)
                    + " setterInvoked=" + std::to_string(SetterInvoked ? 1 : 0)
                    + " conn+0x1600 after=" + std::to_string(ConnAfterFName));

                // Connection-state diagnostic (SDK/Engine_classes.hpp):
                //   UPlayer (base of UNetConnection):
                //     +0x0030  APlayerController*  PlayerController      (which PC owns this connection?)
                //   UNetConnection:
                //     +0x0058  UNetDriver*         Driver                (sanity)
                //     +0x0070  TArray<UChannel*>   OpenChannels          {Data@+0x70, Num@+0x78, Max@+0x7C}
                //     +0x0090  AActor*             ViewTarget            (relevance viewer)
                //     +0x0098  AActor*             OwningActor           (relevance viewer owner)
                // If PlayerController/OwningActor on the remote client's IpConnection is the
                // local-host PC instead of the remote client's PC, that's why per-actor rep
                // gates are ignored - the viewer for relevance is the WRONG PC.
                if (NetConnObj && IsReadablePointer(NetConnObj, 0xA0)) {
                    UObject* connPC   = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x30);
                    UObject* connDrv  = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x58);
                    UObject* viewTgt  = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x90);
                    UObject* owning   = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x98);
                    int32_t  chNum    = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x78);
                    std::string connPCName  = (connPC  && IsReadablePointer(connPC,  0x20)) ? connPC->GetFullName()  : std::string("(null-or-unreadable)");
                    std::string viewTgtName = (viewTgt && IsReadablePointer(viewTgt, 0x20)) ? viewTgt->GetFullName() : std::string("(null-or-unreadable)");
                    std::string owningName  = (owning  && IsReadablePointer(owning,  0x20)) ? owning->GetFullName()  : std::string("(null-or-unreadable)");
                    MpLog("[CWPN #" + std::to_string(slot) + "] CONN STATE:"
                        + " PC(+0x30)=" + MpPtr(connPC) + "/" + connPCName);
                    MpLog("[CWPN #" + std::to_string(slot) + "] CONN STATE:"
                        + " OwningActor(+0x98)=" + MpPtr(owning) + "/" + owningName);
                    MpLog("[CWPN #" + std::to_string(slot) + "] CONN STATE:"
                        + " ViewTarget(+0x90)=" + MpPtr(viewTgt) + "/" + viewTgtName
                        + "  Driver(+0x58)=" + MpPtr(connDrv)
                        + "  OpenChannels.Num(+0x78)=" + std::to_string(chNum));

                    // Additional readiness-gate probes for ServerReplicateActors_PrepConnections:
                    //   Connection->State (+0x134, int) - must be USOCK_Open (=3)
                    //     UE 4.26 EConnectionState: Invalid=0, Closed=1, Pending=2, Open=3
                    //     Offset confirmed via Ghidra decompile of FObjectReplicator::UpdateUnmappedObjects
                    //     (FUN_143bb9640) which reads (conn+0x134)==1 -> logs "USOCK_Closed"
                    //   Connection->LastReceiveTime (+0x1D0, double, SDK-exposed) - must be
                    //     within 1.5s of Driver->Time for connection to be considered ready
                    //   Driver->Time (+0x210, float, SDK-exposed) - server-driver accumulated time
                    //   Driver->ReplicationDriver (+0x6E8, UReplicationDriver*, SDK-exposed) -
                    //     if non-null, custom replication pipeline is in use and default
                    //     PrepConnections+ViewTarget path is BYPASSED entirely - this explains
                    //     ViewTarget=null being observed while State=Open and LastReceiveTime fresh.
                    if (IsReadablePointer(NetConnObj, 0x1D8)) {
                        int32_t sockState = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x134);
                        double  lastRecv  = *reinterpret_cast<double*>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x1D0);
                        const char* stateName =
                            sockState == 0 ? "Invalid" :
                            sockState == 1 ? "Closed" :
                            sockState == 2 ? "Pending" :
                            sockState == 3 ? "Open" : "?";

                        float   drvTime   = 0.0f;
                        UObject* repDriver = nullptr;
                        std::string repDriverClass = "(none)";
                        UObject* repDriver6F0 = nullptr;
                        std::string repDriver6F0Class = "(none)";
                        if (connDrv && IsReadablePointer(connDrv, 0x6F8)) {
                            drvTime = *reinterpret_cast<float*>(reinterpret_cast<uintptr_t>(connDrv) + 0x210);
                            repDriver = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(connDrv) + 0x6E8);
                            if (repDriver && IsReadablePointer(repDriver, 0x20)) {
                                UObject* rdCls = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(repDriver) + 0x10);
                                if (rdCls && IsReadablePointer(rdCls, 0x20)) repDriverClass = rdCls->GetName();
                            }
                            // [1.12.0 FIX 2026-07-10] REMOVED the GetName() probe on
                            // +0x6F0->+0x10. +0x6F0 is FNetworkObjectList, NOT UObject.
                            // Its +0x10 is the TSet hash mask (int32 = 131071 = 0x1FFFF)
                            // — not a UClass*. Previous code called virtual GetName() on
                            // that int, dispatched into FName::ToString(FName* this=~0x1FFFE),
                            // and AV'd at 0x1424A4CD4: MOVZX EBX, word ptr [RCX].
                            // Retain raw pointer log only. If you need to probe FNetworkObjectList
                            // contents, use the (also now-gated) Set0 walker below with FULL
                            // vtable+class-index safety validation.
                            repDriver6F0 = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(connDrv) + 0x6F0);
                            repDriver6F0Class = ""; // do NOT resolve — +0x6F0 is a container, not UObject
                        }
                        double delta = static_cast<double>(drvTime) - lastRecv;

                        // [1.12.0 FIX 2026-07-10] REMOVED wider +0x6D0..+0x710 scan. It was
                        // running `->GetName()` on every "readable" pointer in that range,
                        // and IsReadablePointer proves the memory page is mapped, NOT that
                        // the pointer targets a UObject. Same class of bug that AV'd on the
                        // +0x6F0 probe above. If a similar probe is needed in the future,
                        // do raw pointer reads only — do NOT dispatch virtual UE calls
                        // through unvalidated pointers.
                        std::string scanReport = "(disabled — see 1.12.0 fix note)";
                        MpLog("[CWPN #" + std::to_string(slot) + "] Driver-wider: " + scanReport);

                        MpLog("[CWPN #" + std::to_string(slot) + "] CONN STATE:"
                            + " State(+0x134)=" + std::string(stateName) + "(" + std::to_string(sockState) + ")"
                            + "  LastReceiveTime(+0x1D0)=" + std::to_string(lastRecv)
                            + "  Driver->Time(+0x210)=" + std::to_string(drvTime)
                            + "  delta=" + std::to_string(delta)
                            + "  freshOK=" + std::to_string(delta < 1.5 ? 1 : 0));
                        MpLog("[CWPN #" + std::to_string(slot) + "] CONN STATE:"
                            + " Driver->@+0x6E8=" + MpPtr(repDriver) + "/" + repDriverClass
                            + "  Driver->@+0x6F0=" + MpPtr(repDriver6F0) + "/" + repDriver6F0Class);
                    }

                    MpLog("[CWPN #" + std::to_string(slot) + "] pc_match_check: interceptPC=" + MpPtr(PlayerObj)
                        + "  connPC=" + MpPtr(connPC)
                        + "  same=" + std::to_string(PlayerObj == connPC ? 1 : 0));

                    // [VTABLE-DUMP] Log the NetDriver's vtable slots that TickFlush invokes,
                    // so we can identify which function is actually at slot +0x320 (server-side
                    // ServerReplicateActors candidate per TickFlush decompile) and adjacent slots.
                    // If slot +0x320 points at a NO-OP stub in Dauntless, that explains everything.
                    // Convert to RVA (subtract module base) so we can look up in Ghidra offline.
                    if (connDrv && IsReadablePointer(connDrv, 0x10)) {
                        void** driverVtable = *reinterpret_cast<void***>(connDrv);
                        if (driverVtable && IsReadablePointer(driverVtable, 0x400)) {
                            auto rva = [](void* p) -> uint64_t {
                                if (!p) return 0;
                                uintptr_t rvaVal = reinterpret_cast<uintptr_t>(p) - Globals::BaseAddress;
                                return rvaVal;
                            };
                            void* slot2a8 = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(driverVtable) + 0x2A8);
                            void* slot320 = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(driverVtable) + 0x320);
                            void* slot328 = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(driverVtable) + 0x328);
                            void* slot330 = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(driverVtable) + 0x330);
                            void* slot378 = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(driverVtable) + 0x378);

                            char buf[512];
                            _snprintf_s(buf, _TRUNCATE,
                                "[CWPN #%d] VTABLE dump (Driver->vtable=%p): "
                                "+0x2a8=RVA_0x%llX  +0x320=RVA_0x%llX  +0x328=RVA_0x%llX  +0x330=RVA_0x%llX  +0x378=RVA_0x%llX",
                                slot, driverVtable, rva(slot2a8), rva(slot320), rva(slot328), rva(slot330), rva(slot378));
                            MpLog(buf);
                        }
                    }
                }

                // [FORCE-VIEWTARGET] Every UE 4.26 documented gate for
                // ServerReplicateActors_PrepConnections passes (State=Open, OwningActor set,
                // LastReceiveTime fresh, no ReplicationDriver override), yet ViewTarget stays
                // null across intercepts. Force-write it to OwningActor (falling back to
                // PC.Pawn if possessed). If PrepConnections IS running, it will overwrite
                // this next tick (~16ms), and the next CWPN intercept will show either the
                // forced value (PrepConnections isn't running) or null again (it ran and
                // chose null branch). Meanwhile, if the write "sticks", downstream
                // ServerReplicateActors iteration will see ViewTarget != null and MAYBE
                // proceed with actor consideration for this connection.
                if (NetConnObj && IsReadablePointer(NetConnObj, 0xA0)) {
                    UObject* owning = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x98);
                    UObject* preferView = owning;
                    // Prefer PC->Pawn (at AController+0x250) if the PC has one
                    if (owning && IsReadablePointer(owning, 0x258)) {
                        UObject* pcPawn = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(owning) + 0x250);
                        if (pcPawn) preferView = pcPawn;
                    }
                    UObject* viewBefore = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x90);
                    *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x90) = preferView;
                    UObject* viewAfter = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x90);
                    if (slot < LOG_BUDGET) {
                        MpLog("[CWPN #" + std::to_string(slot) + "] FORCE-VIEWTARGET write:"
                            + " viewBefore=" + MpPtr(viewBefore)
                            + " forced=" + MpPtr(preferView)
                            + " viewAfter=" + MpPtr(viewAfter)
                            + " (owning=" + MpPtr(owning) + ")");
                    }

                    // [1.12.0 DIAG 2026-07-10] NetObjectList walker.
                    // NetDriver+0x6F0 is the Dauntless-added actor tracking subsystem
                    // (confirmed via SetChannelActor decompile). Its layout looks like:
                    //   +0x08 = ??? (some count)
                    //   +0xF0 = sparse array data ptr
                    //   +0xF8 = sparse array Num
                    //   +0x124 = HashSize
                    //   +0x128 = hash inline base (part of TSet inline storage)
                    //   +0x130 = external hash ptr (or 0 if using inline)
                    //   +0x138 = hash mask
                    // We probe the counts and try to iterate the sparse array data.
                    // Re-fetch NetDriver from the connection (+0x58 = UNetConnection::Driver)
                    void* dbgDriver = nullptr;
                    if (NetConnObj && IsReadablePointer(NetConnObj, 0x60)) {
                        dbgDriver = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x58);
                    }
                    if (slot < LOG_BUDGET && dbgDriver && IsReadablePointer(dbgDriver, 0x800)) {
                        // [1.12.0 FIX 2026-07-10] Gate the Set0/NetObjList walker behind a
                        // compile-time flag. Actor channel creation is now proven working
                        // (112 channels created, 0 failures per [TickNetLoop] diagnostics),
                        // so this walker's diagnostic value is nil. It has extensive safety
                        // checks (vtable readable, class-index bounds), BUT the state of the
                        // TSet at HasFinishedLoading time (OpenChannels=115) differs from
                        // when this walker was previously tested. Enabling it risks
                        // dispatching virtual GetName() through a stale TSharedPtr from a
                        // destroyed actor's slot, which is another route to the same
                        // FName::ToString AV that crashed us at 0x1424A4CD4.
                        // To re-enable for debugging, flip to `true`.
                        static constexpr bool kEnableSet0Walker = false;
                        void* netObjList = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(dbgDriver) + 0x6F0);
                        if (kEnableSet0Walker && netObjList && IsReadablePointer(netObjList, 0x1A0)) {
                            // Raw memory dump 0x00..0x180 in 8-byte chunks. No GetName() calls —
                            // interpreting arbitrary values as UObjects causes GNames AVs. Just
                            // categorize: small-int (count-like), readable-ptr, unreadable.
                            std::string layout;
                            for (uintptr_t off = 0x00; off <= 0x180; off += 8) {
                                uint64_t v = *reinterpret_cast<uint64_t*>(reinterpret_cast<uintptr_t>(netObjList) + off);
                                if (v == 0) continue;
                                std::string tag;
                                if (v < 0x1000000ull) {
                                    char b[32]; _snprintf_s(b, _TRUNCATE, "int=%llu", (unsigned long long)v);
                                    tag = b;
                                } else if (v >= 0x10000000ull && v < 0x800000000000ull) {
                                    bool readable = IsReadablePointer(reinterpret_cast<void*>(v), 0x18);
                                    char b[48]; _snprintf_s(b, _TRUNCATE, "ptr=0x%llX/%s", (unsigned long long)v, readable ? "r" : "nr");
                                    tag = b;
                                } else {
                                    char b[32]; _snprintf_s(b, _TRUNCATE, "u64=0x%llX", (unsigned long long)v);
                                    tag = b;
                                }
                                char pref[16]; _snprintf_s(pref, _TRUNCATE, "+0x%03llX=", (long long)off);
                                if (!layout.empty()) layout += " ";
                                layout += pref;
                                layout += tag;
                            }
                            MpLog("[CWPN #" + std::to_string(slot) + "] NetObjList@" + MpPtr(netObjList) + " raw: " + layout);

                            // [1.12.0 DIAG 2026-07-10] Actor array walker.
                            // Empirical finding: NetObjList has a TArray-like {Data,Num,Max} at +0x90/+0x98.
                            // Read Data ptr, iterate Num elements (each 8 bytes = pointer).
                            // Each element may be Actor* directly, OR FNetworkObjectInfo* with Actor at +0x10.
                            // Test both interpretations safely.
                            // The actor list is at +0x00 (TSet0 = AllNetworkObjects) not +0x90.
                            // TSet layout: {Data* @+0x00, Num @+0x08 (dword), Max @+0x0C (dword)}
                            // Each element is TSetElement<TSharedPtr<FNetworkObjectInfo>> = 0x18 bytes:
                            //   +0x00 = TSharedPtr::ObjectPtr → FNetworkObjectInfo*
                            //   +0x08 = TSharedPtr::ReferenceController*
                            //   +0x10 = int32 HashNextId + int32 HashIndex
                            // FNetworkObjectInfo::Actor is at some offset in the info struct;
                            // vanilla UE 4.26 has it at +0x00 (TWeakObjectPtr, first 8 bytes contain packed index)
                            // But easier: read the raw actor field at info+0x08 or info+0x10.
                            void* set0Data = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(netObjList) + 0x00);
                            uint32_t set0Num = *reinterpret_cast<uint32_t*>(reinterpret_cast<uintptr_t>(netObjList) + 0x08);
                            uint32_t set0Max = *reinterpret_cast<uint32_t*>(reinterpret_cast<uintptr_t>(netObjList) + 0x0C);
                            if (set0Data && set0Num > 0 && set0Num < 500 && set0Max >= set0Num
                                && IsReadablePointer(set0Data, static_cast<size_t>(set0Max) * 0x18)) {
                                // Dump first 6 elements' first 3 qwords (24 bytes each)
                                std::string elemDump;
                                for (uint32_t i = 0; i < set0Num && i < 6; i++) {
                                    uintptr_t e = reinterpret_cast<uintptr_t>(set0Data) + static_cast<uintptr_t>(i) * 0x18;
                                    uint64_t q0 = *reinterpret_cast<uint64_t*>(e + 0x00);
                                    uint64_t q1 = *reinterpret_cast<uint64_t*>(e + 0x08);
                                    uint64_t q2 = *reinterpret_cast<uint64_t*>(e + 0x10);
                                    char b[128];
                                    _snprintf_s(b, _TRUNCATE, "el[%u]={q0:%llX q1:%llX q2:%llX}",
                                                i, (unsigned long long)q0, (unsigned long long)q1, (unsigned long long)q2);
                                    if (!elemDump.empty()) elemDump += " ";
                                    elemDump += b;
                                }
                                MpLog("[CWPN #" + std::to_string(slot) + "] Set0(AllNetworkObjects) Data=" + MpPtr(set0Data)
                                    + " Num=" + std::to_string(set0Num) + " Max=" + std::to_string(set0Max)
                                    + " raw: " + elemDump);

                                // Try to resolve each element's actor with safety checks
                                int foundPawn = 0, foundPC = 0, parsed = 0;
                                std::string sample;
                                for (uint32_t i = 0; i < set0Num && parsed < 20; i++) {
                                    uintptr_t e = reinterpret_cast<uintptr_t>(set0Data) + static_cast<uintptr_t>(i) * 0x18;
                                    // TSharedPtr::ObjectPtr at el+0x00
                                    void* infoPtr = *reinterpret_cast<void**>(e + 0x00);
                                    if (!infoPtr || !IsReadablePointer(infoPtr, 0x40)) continue;
                                    // FNetworkObjectInfo::Actor - try several candidate offsets
                                    for (uint32_t actorOff : {0x00u, 0x08u, 0x10u, 0x18u}) {
                                        void* actor = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(infoPtr) + actorOff);
                                        if (!actor || !IsReadablePointer(actor, 0x30)) continue;
                                        // Actor vtable check
                                        void* vtable = *reinterpret_cast<void**>(actor);
                                        if (!vtable || !IsReadablePointer(vtable, 8)) continue;
                                        // Class at Actor+0x10
                                        void* cls = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(actor) + 0x10);
                                        if (!cls || !IsReadablePointer(cls, 0x30)) continue;
                                        // Validate FName index at class+0x18
                                        uint32_t clsIdx = *reinterpret_cast<uint32_t*>(reinterpret_cast<uintptr_t>(cls) + 0x18);
                                        if (clsIdx == 0 || clsIdx > 0x2000000u) continue;
                                        // Class object index at class+0x0C (must be < 100000 for real classes)
                                        int32_t clsObjIdx = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(cls) + 0x0C);
                                        if (clsObjIdx < 0 || clsObjIdx > 1000000) continue;
                                        // OK — SAFE to call GetName
                                        UObject* actorObj = reinterpret_cast<UObject*>(actor);
                                        UObject* clsObj = reinterpret_cast<UObject*>(cls);
                                        std::string cName = clsObj->GetName();
                                        std::string aName = actorObj->GetName();
                                        if (cName.find("PlayerCharacter") != std::string::npos) foundPawn++;
                                        if (cName.find("player_controller") != std::string::npos ||
                                            cName.find("PlayerController") != std::string::npos) foundPC++;
                                        if (parsed < 20) {
                                            if (!sample.empty()) sample += ", ";
                                            char b[32]; _snprintf_s(b, _TRUNCATE, "[%u@+0x%X]", i, actorOff);
                                            sample += b;
                                            sample += cName + "/" + aName;
                                        }
                                        parsed++;
                                        break; // done for this element
                                    }
                                }
                                MpLog("[CWPN #" + std::to_string(slot) + "] Set0 actors: Num=" + std::to_string(set0Num)
                                    + " parsed=" + std::to_string(parsed)
                                    + " pawns=" + std::to_string(foundPawn)
                                    + " PCs=" + std::to_string(foundPC));
                                MpLog("[CWPN #" + std::to_string(slot) + "] Set0 sample: " + sample);
                            }
                        }
                    }
                }
            } else if (NetConnObj && IsReadablePointer(NetConnObj, 0xA0)) {
                // [2026-10-10] The FORCE-VIEWTARGET write above sits inside the five-call log budget, so a
                // long-running Ramsgate skipped it from its sixth restart on (Harmonicrain/Undaunted found
                // the same in their 1.12 copy). Same write, without the diagnostics. ClientRestart's owner
                // pawn relevancy fix still re-points the field at the pawn afterwards.
                UObject* owning = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x98);
                UObject* preferView = owning;
                if (owning && IsReadablePointer(owning, 0x258)) {
                    UObject* pcPawn = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(owning) + 0x250);
                    if (pcPawn) preferView = pcPawn;
                }
                *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(NetConnObj) + 0x90) = preferView;
            }

            // [Phase 0c] Gate the PlayerCanRestart force in natural mode. With the flag present, run the
            // ORIGINAL PlayerCanRestart (natural value) instead of forcing true, so restart/possession is
            // genuine evidence. The CWPN/ClientWorldPackageName networking setup above already ran and is kept.
            if (DiagNaturalMode()) {
                static std::atomic<int> s_pcrNat{ 0 };
                if (s_pcrNat.fetch_add(1, std::memory_order_relaxed) < 5)
                    MpLog("[Diag] PlayerCanRestart NOT forced (natural mode) priorRet=" + std::to_string(PriorRet ? 1 : 0));
                reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEvent)(Object, Function, Parms);
                return;
            }

            // Always force PlayerCanRestart -> true (safe for all PC types)
            *reinterpret_cast<bool*>(reinterpret_cast<uintptr_t>(Parms) + 0x8) = true;

            static bool s_loggedPCR = false;
            if (!s_loggedPCR) {
                s_loggedPCR = true;
                MpLog("[PlayerCanRestart] first-intercept — player=" + MpPtr(PlayerObj)
                    + " priorRet=" + std::to_string(PriorRet ? 1 : 0)
                    + " forcedRet=1");
            }
            return; // do NOT call the original
        }
    }

    if (Function == ServerTryActivateAbilityWithEventData || (!ServerTryActivateAbilityWithEventData && PeMay(MpPeCat_TryActivateAbility) && FunctionName.contains("ServerTryActivateAbilityWithEventData"))) {
        ServerTryActivateAbilityWithEventData = Function;

        Params::AbilitySystemComponent_ServerTryActivateAbilityWithEventData* ActivateAbilityParams = (Params::AbilitySystemComponent_ServerTryActivateAbilityWithEventData*)Parms;

        ServerTryActivateAbilityInternal((UAbilitySystemComponent*)Object, ActivateAbilityParams->AbilityToActivate, ActivateAbilityParams->InputPressed, ActivateAbilityParams->PredictionKey, &ActivateAbilityParams->TriggerEventData);
    }
    else if (Function == ServerTryActivateAbility || (!ServerTryActivateAbility && PeMay(MpPeCat_TryActivateAbility) && FunctionName.contains("ServerTryActivateAbility"))) {
        ServerTryActivateAbility = Function;

        Params::AbilitySystemComponent_ServerTryActivateAbility* ActivateAbilityParams = (Params::AbilitySystemComponent_ServerTryActivateAbility*)Parms;

        ServerTryActivateAbilityInternal((UAbilitySystemComponent*)Object, ActivateAbilityParams->AbilityToActivate, ActivateAbilityParams->InputPressed, ActivateAbilityParams->PredictionKey, nullptr);
    }

    /*
    if (Function == OnPostMitDealtAnyDamage || (!OnPostMitDealtAnyDamage && Function->GetFullName().contains("OnPostMitDealtAnyDamage"))) {
        OnPostMitDealtAnyDamage = Function;

        //OnPostMitDamage
        Params::lantern_equipped_ab_C_OnPostMitDealtAnyDamage* LanternParms = (Params::lantern_equipped_ab_C_OnPostMitDealtAnyDamage*)Parms;

        UGameplayAbility* Obj = (UGameplayAbility*)Object;

        ABP_PlayerCharacter_C* PlayerCharacter = (ABP_PlayerCharacter_C*)Obj->GetAvatarActorFromActorInfo();

        if (PlayerCharacter) {
            AArchonWeapon* Weapon = PlayerCharacter->GetWeapon();

            if (Weapon && Weapon->IsA(ABP_EB_Weapon_C::StaticClass())) {
                UFunction* PostMitFunc = Weapon->Class->GetFunction("BP_EB_Weapon_C", "OnPostMitDamage");

                if (PostMitFunc) {
                    //std::cout << "Proc'ing Post-mit callback on compat weapon!" << std::endl;

                    void* NewLanternParms = malloc(sizeof(Params::lantern_equipped_ab_C_OnPostMitDealtAnyDamage));

                    memcpy_s(NewLanternParms, sizeof(Params::lantern_equipped_ab_C_OnPostMitDealtAnyDamage), LanternParms, sizeof(Params::lantern_equipped_ab_C_OnPostMitDealtAnyDamage));

                    reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEvent)(Weapon, PostMitFunc, NewLanternParms);

                    free(NewLanternParms);
                }
            }
        }
    }
    */

    // [Group E2 cleanup 2026-07-13] [DriverNulled] read-only World->NetDriver null-transition monitor removed;
    // the general OrigProcessEvent dispatch (function tail) is preserved.
    reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEvent)(Object, Function, Parms);
    TraceTempestDamageExit(Object, Parms, TempestDamageCall);
    if (PeMay(MpPeCat_DroneTrace)) TraceArtificerDroneEvent("Server", "EXIT", Object, FunctionName, Parms);

    if (WeaponXpServerGrant && WeaponXpServerGrantSeq >= 0 && WeaponXpServerGrantSeq < 256) {
        MpLog("[WeaponXP][ServerGrant] EXIT seq=" + std::to_string(WeaponXpServerGrantSeq)
            + " returned=" + std::to_string(WeaponXpServerGrant->ReturnValue ? 1 : 0)
            + " type=" + std::to_string(static_cast<int>(WeaponXpServerGrant->WeaponXPType))
            + " base=" + std::to_string(WeaponXpServerGrant->BaseAmount)
            + " bonus=" + std::to_string(WeaponXpServerGrant->BonusAmount));
    }

    TraceEscalationFlowExit("Server", EscalationFlowServerSeq, Object, FunctionName, Parms);

    if (TempestPerfectDodgeServerSeq >= 0 && TempestPerfectDodgeServerSeq < 64) {
        MpLog("[TempestPerfectDodge][Server] EXIT seq=" + std::to_string(TempestPerfectDodgeServerSeq)
            + " fn=" + FunctionName);
    }

    // [2026-07-16] Possession ack AFTER-state: did AcknowledgedPawn stick once
    // ServerAcknowledgePossession's _Implementation ran? (before captured at the filter above.)
    // stuck=1 means AcknowledgedPawn == Pawn (possession complete; the ClientRestart retry stops).
    if (AckCapturePc && IsReadablePointer(AckCapturePc, 0x420)) {
        uintptr_t Pc = reinterpret_cast<uintptr_t>(AckCapturePc);
        void* ackAfter = *reinterpret_cast<void**>(Pc + 0x2A0);
        void* pcPawn   = *reinterpret_cast<void**>(Pc + 0x250);
        MpLog("[PossessionRPC] AFTER pc=" + MpPtr(AckCapturePc)
            + " AcknowledgedPawn=" + MpPtr(ackAfter) + " (before=" + MpPtr(AckPawnBefore) + ")"
            + " PC.Pawn=" + MpPtr(pcPawn)
            + " stuck=" + std::to_string((ackAfter != nullptr && ackAfter == pcPawn) ? 1 : 0));
    }
}

// ─── [Client_Rediness_002 Step 1 · 2026-07-12] Authority-side player-start chain (native detours) ───
// These fire on the SERVER as direct C++ calls (raw LoadManager completion callback / virtual /
// RPC impl) that a ProcessEvent hook does NOT observe (temp.md). Diagnostic-only: each calls its
// original exactly once; NONE forces any state. Answers acceptance Q1-4 + Q8:
//   did OnPlayerDataLoadComplete run, with what bWasSuccessful, did it write bOnlineDataReady,
//   which CanRestartPlayer target (vt+0xD10) was called, and was ServerRestartPlayer invoked.
// [Group E2 cleanup 2026-07-13] OrigOnPlayerDataLoadComplete/OrigServerRestartPlayer decls + the ReadyObjClass
// helper removed (only used by the removed [OPDLC]/[RestartTrace] detours).

// [Group E2 cleanup 2026-07-13] OnPlayerDataLoadCompleteHook ([OPDLC] logger) removed.

// [Group E2 cleanup 2026-07-13] ServerRestartPlayerHook ([RestartTrace] logger + dormant Path B
// RESTORE_PLAYING_AFTER_RESTART experiment) removed.

// UWidgetLayoutLibrary::execGetViewportSize(UObject* Context, FFrame& Stack, FVector2D* Result) @ 1.14.7 RVA 0x0398BB50.
// On a headless dedicated server there is no viewport, so GetViewportSize returns 0x0; then
// vendor_interactive_bp_C::UpdateCameraForAspect divides by it (LogScript "Divide by zero detected: 0.0/0"
// x4), corrupting the vendor camera/aspect setup and derailing the completion graph. The prior
// ProcessEvent-based absorb of UpdateCameraForAspect never fires (nested BP->BP call bypasses the
// ProcessEvent hook). Fix at the source: after the original runs, if the returned viewport is
// zero/non-finite, substitute 1920x1080 so the aspect math is well-defined. Flag-gated; the zero-check
// leaves valid (client) results untouched.
static void* OrigGetViewportSize = nullptr;
static void ExecGetViewportSizeHook(void* ctx, void* stack, void* result) {
    reinterpret_cast<void(*)(void*, void*, void*)>(OrigGetViewportSize)(ctx, stack, result);
    static int s_vpFallback = MpExeRelativeFlagPresent(L"VIEWPORT_FALLBACK.flag") ? 1 : 0;
    if (s_vpFallback && result && IsReadablePointer(result, 8)) {
        float* v = reinterpret_cast<float*>(result);        // FVector2D {X=width, Y=height}
        float w = v[0], h = v[1];
        if (!(w > 0.0f) || !(h > 0.0f)) {                   // zero, negative, or NaN
            v[0] = 1920.0f; v[1] = 1080.0f;
            static std::atomic<int> s_vpOnce{ 0 };
            if (s_vpOnce.fetch_add(1, std::memory_order_relaxed) < 3)
                MpLog("[ViewportFallback] " + std::to_string(w) + "x" + std::to_string(h) + " -> 1920x1080");
        }
    }
}

// [Group D2 cleanup 2026-07-13] ProcessRemoteFunctionWrapperHook + OrigProcessRemoteFunctionWrapper removed ([WrapperProbe]; passthrough).

static void InstallHudLegendaryWeaponGuard();   // defined after InstallInteractionCalloutClassGuards (uses CwVerifySite)
static void InstallLoadMapProbe();              // defined after InstallHudLegendaryWeaponGuard (uses CwVerifySite)

void InitClientHooks() {
    MH_STATUS InitStatus = MH_Initialize();
    MpLog(std::string("[InitClientHooks] MH_Initialize=") + MH_StatusToString(InitStatus));
    StartClientHitchSampler();   // HITCH_SAMPLER.flag only

    // Observe the same verified UNetConnection::Close entry used by the server.
    // This records a bounded caller stack on the client that presses Go Now, where
    // server-side disconnect logs alone cannot identify who initiated teardown.
    MH_STATUS ClientCloseCreate = MH_CreateHook(
        (void*)(Globals::BaseAddress + 0x03F62B90), NetConnectionCloseHook, &OrigNetConnectionClose);
    MH_STATUS ClientCloseEnable = MH_EnableHook((void*)(Globals::BaseAddress + 0x03F62B90));
    MpLog(std::string("[InitClientHooks] NetConnectionClose create=")
        + MH_StatusToString(ClientCloseCreate) + " enable=" + MH_StatusToString(ClientCloseEnable));

    // [1.12.0 FIX 2026-07-10] Client-side HasFinishedLoading hook re-enabled.
    // Root cause of frozen initial loading screen despite successful ClientRestart:
    //   - Server runs InitServerHooks and installs HasFinishedLoadingHook at RVA 0x01A60BC0.
    //     Dedicated-server false results retain the legacy compatibility override.
    //   - Client was running InitClientHooks with this flag = false, leaving the client-side
    //     loading gate evaluator (FUN_141A60BC0) unhooked. Some readiness sub-check on the
    //     client PC (likely bOnlineDataReady at AArchonPlayerController+0xC59) never flips
    //     true because the Epic account-progress HTTP callback enters its null-response
    //     branch (see "Failed to update player account progress flag: UnknownError" warning).
    //   - Ghidra confirms FUN_141A60BC0 is the "HasFinishedLoading" FName lookup + vtable+0x20
    //     dispatch, and FUN_141B6FC48 loops asking it "is anything blocking?" — if yes, logs
    //     "%s is blocking the player start." (0x1451DD540) and eventually raises
    //     "Loading timeout while joining the server. Please try again." (0x1451DD5E0).
    //
    // The compatibility override is now client-scoped to the exact local
    // AArchonPlayerController. Every non-controller loading participant keeps its natural result,
    // so arrival cinematics, escalation state, streamed-world objects and equipment visuals cannot
    // be marked ready by this hook. Dedicated-server behavior remains unchanged in this build.
    //
    // The "travel handshake bisect" that originally set this to false is complete —
    // travel/replication is now proven working end-to-end (112 channels created, real
    // ClientRestart delivered).
    //
    // Do NOT flip kEnableArchonLoadingScreenFadeInHook — leaving that disabled lets the
    // original fade state machine operate correctly.
    static constexpr bool kEnableHasFinishedLoadingHook = true;
    static constexpr bool kEnableProcessEventClientHook = true;
    static constexpr bool kEnableArchonLoadingScreenFadeInHook = false;

    // HasFinishedLoadingHook - CONFIRMED RVA 0x01BA5E40
    if (kEnableHasFinishedLoadingHook) {
        MH_STATUS HasFinishedCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x01BA5E40), HasFinishedLoadingHook, &OrigHasFinishedLoading);
        MH_STATUS HasFinishedEnable = MH_EnableHook((void*)(Globals::BaseAddress + 0x01BA5E40));
        MpLog(std::string("[InitClientHooks] HasFinishedLoading create=")
            + MH_StatusToString(HasFinishedCreate)
            + " enable=" + MH_StatusToString(HasFinishedEnable)
            + " target=+" + MpHex(0x01BA5E40));
    }
    else {
        MpLog("[InitClientHooks] HasFinishedLoading skipped for travel handshake bisect");
    }

    // ProcessEventClientHook - CONFIRMED RVA 0x02861880 (same as server)
    if (kEnableProcessEventClientHook) {
        MH_STATUS ProcessEventCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x02861880), ProcessEventClientHook, &OrigProcessEventClient);
        MH_STATUS ProcessEventEnable = MH_EnableHook((void*)(Globals::BaseAddress + 0x02861880));
        MpLog(std::string("[InitClientHooks] ProcessEvent create=")
            + MH_StatusToString(ProcessEventCreate)
            + " enable=" + MH_StatusToString(ProcessEventEnable)
            + " target=+" + MpHex(0x02861880));
    }
    else {
        MpLog("[InitClientHooks] ProcessEvent skipped for travel handshake bisect");
    }

    InstallHudLegendaryWeaponGuard();   // [2026-10-10 1.14.7] late-join null-weapon guard, client only
    InstallLoadMapProbe();              // [2026-10-10 1.14.7] observe-only LoadMap probe (hunt -> Ramsgate crash)

    // Artificer-specific native Blueprint-policy dispatcher.
    // [1.14.7]: 0x0230B750 is execCanActivateAbilityBP with 3-arg exec ABI (UObject*, FFrame&, RESULT_DECL),
    // NOT bool(this). Diagnostic-only hook is skipped pending resolution of the native caller.
    MpLog("[InitClientHooks] Artificer CanActivateAbilityBP hook skipped (ABI unresolved on 1.14.7)");

    // [2026-07-22 OMNICELL] ApplyPlayerRole must run in the owning client as well as the server.
    // AArchonCharacter.PlayerRole (+0x738) is not marked Net in the 1.12 SDK; server success alone
    // cannot create the local equipment object, HUD widget binding, or local input action.
    {
        MH_STATUS AprCreate = MH_CreateHook(
            (void*)(Globals::BaseAddress + 0x01B92B90),
            ApplyPlayerRoleHook,
            &OrigApplyPlayerRole);
        MH_STATUS AprEnable = MH_EnableHook((void*)(Globals::BaseAddress + 0x01B92B90));
        MpLog(std::string("[InitClientHooks] ApplyPlayerRole hook create=")
            + MH_StatusToString(AprCreate) + " enable=" + MH_StatusToString(AprEnable)
            + " target=+" + MpHex(0x01B92B90));
    }

    // Native StartupModule and execEasyAntiCheatErrorProc honor -NoEAC themselves;
    // leave both stock paths intact so EAC-related failures are not hidden by detours.

    // UArchonLoadingScreen::ScreenFadeIn - guard null fade widgets during local join failure paths.
    if (kEnableArchonLoadingScreenFadeInHook) {
        MH_STATUS FadeCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x01E0FBB0), ArchonLoadingScreenFadeInHook, &OrigArchonLoadingScreenFadeIn);
        MH_STATUS FadeEnable = MH_EnableHook((void*)(Globals::BaseAddress + 0x01E0FBB0));
        MpLog(std::string("[InitClientHooks] ArchonLoadingScreenFadeIn create=")
            + MH_StatusToString(FadeCreate)
            + " enable=" + MH_StatusToString(FadeEnable)
            + " target=+" + MpHex(0x01E0FBB0));
    }
    else {
        MpLog("[InitClientHooks] ArchonLoadingScreenFadeIn skipped for travel handshake bisect");
    }

    // GetActorCallspace - needs vtable resolution (index 69)
    // Will be installed lazily from GameEngineTickHook or similar

    // 1.14.7 FCurlHttpRequest::ProcessRequest is the verified URL-consumption
    // boundary. Its hook rewrites the FString at request+0x70 using EngineRealloc.
    {
        constexpr uintptr_t ProcessRequestRva = 0x032C5FE0;
        void* target = reinterpret_cast<void*>(Globals::BaseAddress + ProcessRequestRva);
        MH_STATUS create = MH_CreateHook(target, ProcessRequest, &OrigProcessRequest);
        MH_STATUS enable = create == MH_OK ? MH_EnableHook(target) : create;
        MpLog(std::string("[InitClientHooks] ProcessRequest URL/header hook create=")
            + MH_StatusToString(create) + " enable=" + MH_StatusToString(enable)
            + " target=+" + MpHex(ProcessRequestRva));
    }

    // The old XMPP config detour target at +0x025E6890 does not yet have a verified
    // GetString ABI. Keep the optional redirect and observer uninstalled until mapped.
    MpLog("[InitClientHooks] XMPP config hook skipped (1.14.7 target ABI unresolved)");

    // [1.14.7 login fix 2026-10-03] IsEOSEnabled (+0x01C30030) decides EOS-SDK auth vs MCP auth.
    // The previous note ("Launcher supplies -DisableEOS ... preserve as-is") was disproved by an
    // A/B on this machine: with the flag only on the OS command line, FCommandLine::CmdLine is
    // populated after IsEOSEnabled() has already cached its result, EOS auth runs, and login dies
    // with EOS_Auth_ExchangeCodeNotFound before any request reaches this backend. Forcing the
    // verified getter to 0 restores the proven-working MCP login path.
    {
        MH_STATUS EosCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x01C30030), HookIsEOSEnabled, reinterpret_cast<LPVOID*>(&OrigIsEOSEnabled));
        MH_STATUS EosEnable = EosCreate == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x01C30030)) : EosCreate;
        MpLog(std::string("[InitClientHooks] IsEOSEnabled create=")
            + MH_StatusToString(EosCreate) + " enable=" + MH_StatusToString(EosEnable)
            + " target=+" + MpHex(0x01C30030));
    }

    // Hook LoginOperationFailed (FUN_141c3a160, RVA 0x01C3A160)
    {
        MH_STATUS LogFailCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x01C3A160), HookLoginOperationFailed, reinterpret_cast<LPVOID*>(&OrigLoginOperationFailed));
        MH_STATUS LogFailEnable = LogFailCreate == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x01C3A160)) : LogFailCreate;
        MpLog(std::string("[InitClientHooks] LoginOperationFailed create=")
            + MH_StatusToString(LogFailCreate) + " enable=" + MH_StatusToString(LogFailEnable)
            + " target=+" + MpHex(0x01C3A160));
    }

    // Hook LoginOperationSuccess (FUN_141c3a590, RVA 0x01C3A590)
    {
        MH_STATUS LogSuccCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x01C3A590), HookLoginOperationSuccess, reinterpret_cast<LPVOID*>(&OrigLoginOperationSuccess));
        MH_STATUS LogSuccEnable = LogSuccCreate == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x01C3A590)) : LogSuccCreate;
        MpLog(std::string("[InitClientHooks] LoginOperationSuccess create=")
            + MH_StatusToString(LogSuccCreate) + " enable=" + MH_StatusToString(LogSuccEnable)
            + " target=+" + MpHex(0x01C3A590));
    }

    // [1.14.7 identity diagnostic] read-only; the client's own PlayerState is the reference for a
    // populated net-id object (the removed hub phantom had none).
    InstallLoadMgrBeginHook("client");

    // [1.14.7 EAC ROOT FIX 2026-10-04] Decompiled StartupModule (RVA 0x01474ED0):
    //
    //     if (DAT_146cfbd44 == '\0') {
    //         // logs: "EnableEasyAntiCheatFeatures is false, EAC client will not load"
    //     } else {
    //         uVar4 = FUN_1425e8f70();                 // FCommandLine::Get()  (RVA 0x025E8F70)
    //         cVar3 = FUN_142634de0(uVar4, L"NoEAC");
    //         if (cVar3 == '\0') { ...initialise EAC... }
    //     }
    //
    // Measured on a real client run: os_NoEAC=1 but engine_FCommandLine_NoEAC=0 - the Launcher passes the
    // flag on the OS command line, while the ENGINE's own FCommandLine does not carry it, so the check fails,
    // EAC initialises, IGameClient creation fails (0x01477DD0) and HandleError (0x01476F20) reports it.
    // Absorbing that dialog is not a fix: the client then sits at the login screen with "Online Play may not
    // be available" and never travels.
    //
    // The game's own "do not load EAC" path is this byte, so take it rather than reimplementing the engine's
    // command-line plumbing: DAT_146cfbd44 (RVA 0x06CFBD44) is the EnableEasyAntiCheatFeatures setting.
    // Written repeatedly for the first few seconds because the engine loads its config during boot and can
    // overwrite an early write. Flag gated so it can be turned off for comparison.
    // [1.14.7 EAC ROOT FIX] Hook FCommandLine::Get (RVA 0x025E8F70) BEFORE StartupModule reads it, so the
    // engine's own command line carries -NoEAC and the EAC load is skipped at the source.
    InstallEngineCommandLineHook();

    // [1.14.7 QOS FIX] Resolve the retired latency-test hosts to loopback so the client can measure a region
    // and stop travelling with Current: empty.
    InstallQosHostResolutionHook();

    // [1.14.7 SOCKET DIAGNOSTICS] Show where the client sends and whether the hub receives.
    InstallSocketDiagnostics();

    LogEacStartupFlags("client init");
    if (MpExeRelativeFlagPresent(L"DISABLE_EAC_LOAD.flag") || true) {
        static std::atomic<int> s_eacByteWrites{ 0 };
        const uintptr_t EacSetting = Globals::BaseAddress + 0x06CFBD44;
        if (IsReadablePointer(reinterpret_cast<void*>(EacSetting), 1)) {
            *reinterpret_cast<unsigned char*>(EacSetting) = 0x0;
            const int n = s_eacByteWrites.fetch_add(1, std::memory_order_relaxed);
            if (n < 3) {
                MpLog("[EACFix] set EnableEasyAntiCheatFeatures=0 (RVA 0x06CFBD44) so StartupModule takes the "
                    "no-load path instead of failing IGameClient creation");
            }
        }
        else if (s_eacByteWrites.fetch_add(1, std::memory_order_relaxed) == 0) {
            MpLog("[EACFix] RVA 0x06CFBD44 not readable; left untouched");
        }
    }

    // [1.14.7 EAC] Restore narrowly scoped HandleError interception at the verified RVA 0x01476F20. Only the
    // expected private-client initialisation failure (IGameClient creation) is absorbed; every other EAC
    // error is forwarded to the original, preserving ordinary reporting and Central Guard checks.
    {
        MH_STATUS EacCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x01476F20),
            HookEasyAntiCheatHandleError, reinterpret_cast<LPVOID*>(&OrigEasyAntiCheatHandleError));
        MH_STATUS EacEnable = EacCreate == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x01476F20)) : EacCreate;
        MpLog(std::string("[InitClientHooks] EasyAntiCheat HandleError create=")
            + MH_StatusToString(EacCreate) + " enable=" + MH_StatusToString(EacEnable)
            + " target=+" + MpHex(0x01476F20) + " (scoped: client-init failure only)");
    }

    // Ghidra has no confirmed function boundary at +0x0227BCF0; this diagnostic
    // detour remains uninstalled until the exec thunk/native target mapping is proven.
    MpLog("[InitClientHooks] HasDisconnectError hook skipped (1.14.7 target unresolved)");

    // Hook UArchonGameInstance::EnqueueDisconnectError (FUN_1418fb4d0, RVA 0x018FB4D0)
    {
        MH_STATUS EnqDiscCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x018FB4D0), HookEnqueueDisconnectError, reinterpret_cast<LPVOID*>(&OrigEnqueueDisconnectError));
        MH_STATUS EnqDiscEnable = EnqDiscCreate == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x018FB4D0)) : EnqDiscCreate;
        MpLog(std::string("[InitClientHooks] EnqueueDisconnectError create=")
            + MH_StatusToString(EnqDiscCreate) + " enable=" + MH_StatusToString(EnqDiscEnable)
            + " target=+" + MpHex(0x018FB4D0));
    }

    // Install exit tracing on client so exits are caught with stacks.
    InstallApiHook(L"kernel32.dll", "ExitProcess", ExitProcessHook, reinterpret_cast<LPVOID*>(&OrigExitProcess), "kernel32!ExitProcess");
    InstallApiHook(L"ntdll.dll", "RtlExitUserProcess", RtlExitUserProcessHook, reinterpret_cast<LPVOID*>(&OrigRtlExitUserProcess), "ntdll!RtlExitUserProcess");
    InstallApiHook(L"ntdll.dll", "NtTerminateProcess", NtTerminateProcessHook, reinterpret_cast<LPVOID*>(&OrigNtTerminateProcess), "ntdll!NtTerminateProcess");
    InstallApiHook(L"kernelbase.dll", "TerminateProcess", TerminateProcessHook, reinterpret_cast<LPVOID*>(&OrigTerminateProcess), "kernelbase!TerminateProcess");
    InstallApiHook(L"kernelbase.dll", "RaiseException", RaiseExceptionHook, reinterpret_cast<LPVOID*>(&OrigRaiseException), "kernelbase!RaiseException");
    InstallApiHook(L"ucrtbase.dll", "exit", UcrtExitHook, reinterpret_cast<LPVOID*>(&OrigUcrtExit), "ucrtbase!exit");
    InstallApiHook(L"ucrtbase.dll", "_exit", UcrtUnderscoreExitHook, reinterpret_cast<LPVOID*>(&OrigUcrtUnderscoreExit), "ucrtbase!_exit");
    InstallApiHook(L"ucrtbase.dll", "abort", UcrtAbortHook, reinterpret_cast<LPVOID*>(&OrigUcrtAbort), "ucrtbase!abort");
    InstallApiHook(L"msvcrt.dll", "exit", MsvcrtExitHook, reinterpret_cast<LPVOID*>(&OrigMsvcrtExit), "msvcrt!exit");
    InstallApiHook(L"msvcrt.dll", "_exit", MsvcrtUnderscoreExitHook, reinterpret_cast<LPVOID*>(&OrigMsvcrtUnderscoreExit), "msvcrt!_exit");
    InstallApiHook(L"msvcrt.dll", "abort", MsvcrtAbortHook, reinterpret_cast<LPVOID*>(&OrigMsvcrtAbort), "msvcrt!abort");
    if (!VectoredExceptionHandle) {
        VectoredExceptionHandle = AddVectoredExceptionHandler(1, VectoredExceptionTrace);
        MpLog("[ExceptionTrace] (client) AddVectoredExceptionHandler handle=" + MpPtr(VectoredExceptionHandle));
    }
    // [1.14.7] +0x02657770 is an exception-text formatter, not the UE unhandled-exception
    // filter. Its ABI differs from UEUnhandledExceptionFilterHook, so do not detour it.
    MpLog("[ExitTrace] (client) UEUnhandledExceptionFilter hook skipped (1.14.7 target ABI mismatch)");
}

void* OrigSprint = nullptr;

bool SprintHook(uintptr_t a1, uintptr_t a2) { //char __fastcall UArchonStaminaComponent_TryConsumeStamina_Native(__int64 a1, __int64 a2, char a3, char a4)    
    return true;
}

void* OrigApplyPlayerRole = nullptr;

// [2026-07-22] AArchonPlayerRole owner-node routing.
//
// Repro 6 closed the remaining Omnicell split precisely:
//   * the server creates a valid PR_TEMPEST AArchonPlayerRole, owns it by the pawn, and fully activates it;
//   * PlayerState.PlayerRoleId=PR_TEMPEST reaches the client;
//   * Ramsgate receives a simulated role actor, but Training Dojo never opens that actor on the client.
//
// AArchonPlayerRole has bNetUseOwnerRelevancy but NOT bOnlyRelevantToOwner/bAlwaysRelevant by default.
// The route hook above now changes it to bAlwaysRelevant before Archon initially classifies the actor,
// giving the role exactly one native global route for its whole lifetime. The helpers below retain the
// per-connection initial/state bootstrap; they no longer duplicate globally-routed roles into each
// connection node. This uses the same verified primitives as UArchonReplicationGraph::ServerReplicateActors:
//   GetAlwaysRelevantNodeForConnection = RVA 0x01A8F4C0
//   node->NotifyAddNetworkActor          = vtable +0x270
//   FNewReplicatedActorInfo layout       = { Actor@0, StreamingLevelName@8, Class@0x10 }
//
// It does not make player pawns globally relevant. Tracking entries are keyed by actor+connection because
// all globally-routed roles share the same global node.
using PlayerRoleGraphActorInfo = RepGraphActorInfo112;

struct PlayerRoleGraphRoute {
    void* Actor = nullptr;
    void* Node = nullptr;
    void* Connection = nullptr;
    uint64_t ActiveSeenMs = 0;
    uint64_t LastRefreshMs = 0;
    int RefreshAttempts = 0;
    // Pushes that could not write for a reason unrelated to dirty state (channel pending dormancy or
    // a re-entrant ReplicateActor). Counted separately so they do not consume RefreshAttempts.
    int BlockedDeferrals = 0;
    bool WasFullyActive = false;
    bool PostActiveRefreshComplete = false;
};
/*
 * [2026-10-11 1.14.7 O1 route-table capacity] One entry per (role, connection) pair. The table had 64 entries, which an
 * all-omnicell party of 8 fills (8 roles x 8 connections); a later pair was then silently refused (FreeSlot < 0 ->
 * return 0), so a 9th joiner never got the PlayerRole bootstrap, the post-activation push or the cull re-assert for any
 * role. It now holds 64 roles x 64 connections (4096 pairs, the hub's 64-player plausibility limit) with exactly the
 * same per-pair entry and semantics. Loops visit only the used prefix (s_playerRoleRouteHigh: every entry at or above it
 * is empty; new entries take the lowest free index, as before), and a refused pair is now logged (TABLE_FULL).
 * The per-pair channel-churn state (s_playerRoleChannelStates) is sized the same and indexed like the route, so finding
 * a pair's state is O(1) instead of a scan; the PR_FRANK heartbeat table stays at 64 on purpose (see its comment).
 */
static constexpr int kPlayerRoleRouteCapacity = 64 * 64;
static PlayerRoleGraphRoute s_playerRoleGraphRoutes[kPlayerRoleRouteCapacity]{};
static int s_playerRoleRouteHigh = 0;   // entries [s_playerRoleRouteHigh, capacity) are all empty

struct MpPlayerRoleRouteSpan {
    PlayerRoleGraphRoute* First;
    PlayerRoleGraphRoute* Last;
    PlayerRoleGraphRoute* begin() const { return First; }
    PlayerRoleGraphRoute* end() const { return Last; }
};

// The used prefix of the route table (trailing empty entries trimmed first). Game thread.
static MpPlayerRoleRouteSpan MpActivePlayerRoleRoutes() {
    while (s_playerRoleRouteHigh > 0 && !s_playerRoleGraphRoutes[s_playerRoleRouteHigh - 1].Actor) --s_playerRoleRouteHigh;
    return { s_playerRoleGraphRoutes, s_playerRoleGraphRoutes + s_playerRoleRouteHigh };
}

static int MpPlayerRoleRouteIndex(const PlayerRoleGraphRoute& Route) {
    return static_cast<int>(&Route - s_playerRoleGraphRoutes);
}

// Lowest empty index (the old full-table scan's answer): inside the used prefix, else the first index after it; -1 = full.
static int MpPlayerRoleRouteFreeSlot() {
    for (int i = 0; i < s_playerRoleRouteHigh; ++i) {
        if (!s_playerRoleGraphRoutes[i].Actor) return i;
    }
    return s_playerRoleRouteHigh < kPlayerRoleRouteCapacity ? s_playerRoleRouteHigh : -1;
}

// After an entry at Index was filled.
static void MpPlayerRoleRouteNoteUsed(int Index) {
    if (Index >= s_playerRoleRouteHigh) s_playerRoleRouteHigh = Index + 1;
}

/*
 * [2026-10-11 1.14.7 O1/O2 role pass] A connection-count change re-routes every known role to every connection: roles x
 * (connections + 2) calls of RoutePlayerRoleToOwningConnectionRaw, and each call re-validated EVERY table entry (actor
 * liveness: a VirtualQuery; IsCurrentNetDriverClientConnection: three VirtualQuery calls plus a scan of the client
 * connections). At 40 players that is ~1600 calls x 1600 entries x ~5 system calls - seconds of game thread on every join
 * and leave. A pass (MpRolePassScope, opened by TickPlayerRolePostActivationRefresh and RoutePlayerRoleToAllConnections,
 * game thread, nestable) answers the same questions from a snapshot taken once at its start:
 *   - IsCurrentNetDriverClientConnection: membership in the client connections that were readable (0x140) at the start;
 *   - MpRolePassActorSafe: IsActorSafeForReplicationLifecycle, once per distinct actor;
 *   - the stale-entry sweep in RoutePlayerRoleToOwningConnectionRaw runs once per pass (a later sweep in the same pass
 *     could only find entries the first one already cleared: entries added during the pass were validated with the same
 *     answers).
 * Nothing inside a pass ticks the engine, destroys an actor or closes a connection (it routes, reads and pushes), so the
 * answers cannot change while it runs. Outside a pass (another thread, or no pass open) every check runs as before.
 */
struct MpRolePass {
    int Depth = 0;
    DWORD Thread = 0;
    bool ConnsValid = false;
    bool SweepDone = false;
    int NumConns = 0;
    int NumActors = 0;
    void* Conns[1024] = {};
    const void* Actors[256] = {};
    bool ActorSafe[256] = {};
};
static MpRolePass g_rolePass;

static bool MpRolePassActive() {
    return g_rolePass.Depth > 0 && g_rolePass.Thread == GetCurrentThreadId();
}

// Returns false (and opens nothing) when another thread holds the pass, or with ROLE_PASS_SNAPSHOT_OFF.flag (read once:
// every check then runs directly, as before 11 Oct).
static bool MpRolePassBegin() {
    static int s_off = -1;
    if (s_off < 0) {
        s_off = MpExeRelativeFlagPresent(L"ROLE_PASS_SNAPSHOT_OFF.flag") ? 1 : 0;
        MpLog(std::string("[PlayerRoleGraphRoute] role pass snapshot ")
            + (s_off ? "OFF (ROLE_PASS_SNAPSHOT_OFF.flag): every connection/actor check runs directly"
                     : "ON (ROLE_PASS_SNAPSHOT_OFF.flag reverts)"));
    }
    if (s_off == 1) return false;
    MpRolePass& P = g_rolePass;
    if (P.Depth > 0 && P.Thread != GetCurrentThreadId()) return false;   // never share a pass across threads
    if (P.Depth++ > 0) return true;                                        // nested: reuse the open snapshot
    P.Thread = GetCurrentThreadId();
    P.ConnsValid = false;
    P.SweepDone = false;
    P.NumConns = 0;
    P.NumActors = 0;
    if (!Networking::NetDriver || !IsReadablePointer(Networking::NetDriver, 0xA0)) return true;
    const RawPointerArray* Connections = reinterpret_cast<const RawPointerArray*>(
        reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x90);
    if (!IsReadablePointer(Connections, sizeof(RawPointerArray))
        || !IsSanePointerArray(Connections->Data, Connections->Num, Connections->Max, 1024)) {
        return true;
    }
    P.ConnsValid = true;
    for (int32_t i = 0; i < Connections->Num && P.NumConns < static_cast<int>(std::size(P.Conns)); ++i) {
        void* Connection = Connections->Data[i];
        if (Connection && IsReadablePointer(Connection, 0x140)) P.Conns[P.NumConns++] = Connection;
    }
    return true;
}

struct MpRolePassScope {
    bool Opened;
    MpRolePassScope() : Opened(MpRolePassBegin()) {}
    ~MpRolePassScope() { if (Opened && g_rolePass.Depth > 0) --g_rolePass.Depth; }
    MpRolePassScope(const MpRolePassScope&) = delete;
    MpRolePassScope& operator=(const MpRolePassScope&) = delete;
};

// IsActorSafeForReplicationLifecycle, answered once per actor inside a pass.
static bool MpRolePassActorSafe(void* Actor) {
    if (!Actor || !MpRolePassActive()) return IsActorSafeForReplicationLifecycle(Actor);
    MpRolePass& P = g_rolePass;
    for (int i = 0; i < P.NumActors; ++i) {
        if (P.Actors[i] == Actor) return P.ActorSafe[i];
    }
    const bool Safe = IsActorSafeForReplicationLifecycle(Actor);
    if (P.NumActors < static_cast<int>(std::size(P.Actors))) {
        P.Actors[P.NumActors] = Actor;
        P.ActorSafe[P.NumActors] = Safe;
        ++P.NumActors;
    }
    return Safe;
}

static void PurgeDisconnectedPlayerRoleCaches();

static bool IsCurrentNetDriverClientConnection(void* Connection) {
    if (MpRolePassActive()) {   // [2026-10-11 O1] same answer from the pass snapshot (see MpRolePass)
        if (!Connection || !g_rolePass.ConnsValid) return false;
        for (int i = 0; i < g_rolePass.NumConns; ++i) {
            if (g_rolePass.Conns[i] == Connection) return true;
        }
        return false;
    }
    if (!Connection || !Networking::NetDriver
        || !IsReadablePointer(Networking::NetDriver, 0xA0)
        || !IsReadablePointer(Connection, 0x140)) return false;

    const RawPointerArray* Connections = reinterpret_cast<const RawPointerArray*>(
        reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x90);
    if (!IsReadablePointer(Connections, sizeof(RawPointerArray))
        || !IsSanePointerArray(Connections->Data, Connections->Num, Connections->Max, 1024)) {
        return false;
    }
    for (int32_t i = 0; i < Connections->Num; ++i) {
        if (Connections->Data[i] == Connection) return true;
    }
    return false;
}

// ForcedConnection == nullptr routes to the role's own owning connection (the original behaviour).
// A non-null ForcedConnection routes the same actor into that connection's node instead, which is
// how the remote clients get it - see RoutePlayerRoleToAllConnections below.
static int RoutePlayerRoleToOwningConnectionRaw(void* PlayerRole, void** OutConnection,
                                                 void** OutGraph, void** OutNode,
                                                 int* OutBootstrapResult,
                                                 void* ForcedConnection = nullptr) {
    if (OutConnection) *OutConnection = nullptr;
    if (OutGraph) *OutGraph = nullptr;
    if (OutNode) *OutNode = nullptr;
    if (OutBootstrapResult) *OutBootstrapResult = 0;
    __try {
        // [2026-10-11 O1/O3] Pass-memoised actor check and per-frame pointer checks (MpRolePass, MpReadableThisFrame).
        if (!MpRolePassActorSafe(PlayerRole)
            || !Networking::NetDriver
            || !MpReadableThisFrame(Networking::NetDriver, 0x6F0)) return 0;

        void* Connection = ForcedConnection;
        if (!Connection) {
            uintptr_t VTable = *reinterpret_cast<uintptr_t*>(PlayerRole);
            if (!VTable || !IsReadablePointer(reinterpret_cast<void*>(VTable + 0x4C0), 8)) return 0;
            void* GetNetConnectionFn = *reinterpret_cast<void**>(VTable + 0x4C0);
            if (!GetNetConnectionFn) return 0;
            Connection = reinterpret_cast<void*(*)(void*)>(GetNetConnectionFn)(PlayerRole);
        }
        if (OutConnection) *OutConnection = Connection;
        if (!IsCurrentNetDriverClientConnection(Connection)) return 0;

        void* Graph = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x6E8);
        if (OutGraph) *OutGraph = Graph;
        if (!Graph || !MpReadableThisFrame(Graph, 0x4C8)) return 0;
        if (*reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Graph) + 0x30)
            != reinterpret_cast<void*>(Networking::NetDriver)) return 0;

        const uint8_t ActorFlags58 = SafeReadU8At(
            reinterpret_cast<uintptr_t>(PlayerRole), 0x58);
        const bool UsesGlobalRoute =
            !MpExeRelativeFlagPresent(L"DISABLE_PLAYER_ROLE_GLOBAL_ROUTE.flag")
            && (ActorFlags58 & 0x08u) != 0;
        void* Node = UsesGlobalRoute
            ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Graph) + 0x4A0)
            : reinterpret_cast<void*(*)(void*, void*)>(
                Globals::BaseAddress + 0x01BDB8F0)(Graph, Connection);
        if (OutNode) *OutNode = Node;
        if (!Node || !MpReadableThisFrame(Node, 0x20)) return 0;

        // [2026-10-11 O1] The stale-entry sweep runs once per role pass (see MpRolePass); outside a pass, every call.
        const bool InPass = MpRolePassActive();
        const bool Sweep = !InPass || !g_rolePass.SweepDone;
        if (InPass) g_rolePass.SweepDone = true;
        for (PlayerRoleGraphRoute& Existing : MpActivePlayerRoleRoutes()) {
            if (Sweep && Existing.Actor
                && (!MpRolePassActorSafe(Existing.Actor)
                    || !IsCurrentNetDriverClientConnection(Existing.Connection))) {
                Existing = PlayerRoleGraphRoute{};
                continue;
            }
            if (Existing.Actor == PlayerRole && Existing.Connection == Connection) {
                Existing.Node = Node;
                Existing.Connection = Connection;
                // ApplyPlayerRole runs once before gameplay activation and again after the role is fully
                // initialized. Keep NotifyAddNetworkActor idempotent, but explicitly replicate the existing
                // actor channel again so AbilityCharge and the active-gameplay state are not stranded at the
                // zero-valued first bunch sent by the pre-activation pass.
                const int BootstrapResult = Networking::BootstrapActorChannel(
                    reinterpret_cast<AActor*>(PlayerRole), reinterpret_cast<UNetConnection*>(Connection));
                if (OutBootstrapResult) *OutBootstrapResult = BootstrapResult;
                return 2; // already routed; actor channel refreshed
            }
        }

        const int FreeSlot = MpPlayerRoleRouteFreeSlot();   // [2026-10-11 O1] lowest free index, as before
        if (FreeSlot < 0) return -2;   // table full: reported (rate-limited) by the callers

        if (!UsesGlobalRoute) {
            // Compatibility fallback for an A/B build with the global route disabled. In the fixed
            // path Archon's native RouteAdd already inserted the actor into Graph+0x4A0; adding it
            // again here would create the duplicate routes that caused the old lifetime ambiguity.
            void** NodeVTable = *reinterpret_cast<void***>(Node);
            if (!NodeVTable || !IsReadablePointer(NodeVTable + (0x270 / 8), 8)) return 0;
            void* NotifyAdd = NodeVTable[0x270 / 8];
            if (!NotifyAdd) return 0;

            PlayerRoleGraphActorInfo Info{};
            Info.Actor = PlayerRole;
            Info.StreamingLevelName = SDK::FName();
            Info.Class = *reinterpret_cast<void**>(
                reinterpret_cast<uintptr_t>(PlayerRole) + 0x10);
            reinterpret_cast<void(*)(void*, const PlayerRoleGraphActorInfo&)>(
                NotifyAdd)(Node, Info);
        }
        s_playerRoleGraphRoutes[FreeSlot] = { PlayerRole, Node, Connection };
        MpPlayerRoleRouteNoteUsed(FreeSlot);

        // The native global node is the authoritative ongoing route. Bootstrap only the initial
        // actor-channel/NetGUID bunch and late lifecycle state; the graph keeps the channel relevant.
        const int BootstrapResult = Networking::BootstrapActorChannel(reinterpret_cast<AActor*>(PlayerRole),
            reinterpret_cast<UNetConnection*>(Connection));
        if (OutBootstrapResult) *OutBootstrapResult = BootstrapResult;
        return 1;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return -1;
    }
}

// [2026-10-11 1.14.7 O1] A refused pair used to vanish without a trace; now it is loud (once per 10 s, with a count).
static void MpLogPlayerRoleRouteTableFull(void* PlayerRole, void* Connection, const char* Scope) {
    static uint64_t s_lastMs = 0;
    static uint64_t s_refused = 0;
    ++s_refused;
    const uint64_t Now = GetTickCount64();
    if (s_lastMs != 0 && Now - s_lastMs < 10000) return;
    s_lastMs = Now;
    MpLog("[PlayerRoleGraphRoute] TABLE_FULL role=" + MpPtr(PlayerRole) + " conn=" + MpPtr(Connection)
        + " scope=" + Scope + " capacity=" + std::to_string(kPlayerRoleRouteCapacity)
        + " refusedSoFar=" + std::to_string(s_refused)
        + " - this (role, connection) pair gets NO PlayerRole bootstrap/push/cull re-assert");
}

static void RoutePlayerRoleToOwningConnection(void* PlayerRole) {
    if (!Globals::AmServer || !PlayerRole
        || MpExeRelativeFlagPresent(L"DISABLE_PLAYER_ROLE_OWNER_ROUTE.flag")) return;
    void* Connection = nullptr; void* Graph = nullptr; void* Node = nullptr;
    int BootstrapResult = 0;
    const int Result = RoutePlayerRoleToOwningConnectionRaw(PlayerRole, &Connection, &Graph, &Node,
        &BootstrapResult);
    if (Result == -2) MpLogPlayerRoleRouteTableFull(PlayerRole, Connection, "owner");   // [2026-10-11 O1]
    if (Result == 1 || Result == 2 || Result == -1) {
        MpLog("[PlayerRoleGraphRoute] role=" + MpPtr(PlayerRole)
            + " conn=" + MpPtr(Connection) + " graph=" + MpPtr(Graph) + " node=" + MpPtr(Node)
            + " scope=owner"
            + " result=" + (Result == 1 ? std::string("ADDED")
                : (Result == 2 ? std::string("EXISTING_REFRESHED") : std::string("FAULT")))
            + " bootstrap=" + std::to_string(BootstrapResult));
    }
}

// [2026-07-25 T-POSE / REMOTE PLAYER ROLE] The owner route above was written to fix the *local*
// client's own missing role, and it only ever touches the owning connection's node. Nothing has
// ever routed player A's role to connections B and C - repro 9's server log shows exactly two
// [PlayerRoleGraphRoute] lines for three connections, each pinning one role to its own owner:
//     20:29:29.516  role=2199924457568 conn=2199716539056 node=2199813852768 ADDED
//     20:29:29.762  role=2199836605328 conn=2199834496576 node=2200179096704 ADDED
// (two roles rather than three because rainfallscore had no omnicell equipped, which is correct).
//
// AArchonPlayerRole carries bNetUseOwnerRelevancy and NOT bOnlyRelevantToOwner, so the game's own
// intent is "relevant wherever the owning pawn is relevant" - i.e. to everyone who can see that
// character, not to the owner alone. Left on its ordinary spatial route, a dynamically spawned
// equipment actor with no meaningful spatial presence drifts in and out of the grid, and the
// client-side census caught precisely that: on Mystic's client Bobo's role appeared
// (playerRole=2623543608528 @ 20:31:24.521) and was gone 127ms later, over and over. An actor that
// arrives and then has its channel closed is destroyed client-side, which nulls Pawn->PlayerRole
// and drops the mesh to its reference pose. That is the "stretch pose".
//
// The first correction routed each role into EVERY connection's always-relevant node. Repro 15
// proved that was still incomplete: both role channels on a connection repeatedly closed together
// because the actor itself retained owner/spatial relevancy semantics. The route hook now puts each
// role in the graph's one global AlwaysRelevantNode before native classification. This function
// therefore enumerates connections only to bootstrap/track the initial and late lifecycle bunches;
// it does not add duplicate graph routes in the fixed path.
//
// DISABLE_PLAYER_ROLE_GLOBAL_ROUTE.flag restores the former per-connection node path for A/B.
// DISABLE_PLAYER_ROLE_REMOTE_ROUTE.flag still suppresses remote connection bootstraps.
static void RoutePlayerRoleToAllConnections(void* PlayerRole) {
    if (!Globals::AmServer) return;
    MpRolePassScope Pass;   // [2026-10-11 O1/O2] one snapshot for the owner + every remote connection (see MpRolePass)
    if (!MpRolePassActorSafe(PlayerRole)) return;

    // Owner first, unchanged - it is the one that has always worked and it seeds the dedup table.
    RoutePlayerRoleToOwningConnection(PlayerRole);

    if (MpExeRelativeFlagPresent(L"DISABLE_PLAYER_ROLE_OWNER_ROUTE.flag")
        || MpExeRelativeFlagPresent(L"DISABLE_PLAYER_ROLE_REMOTE_ROUTE.flag")) return;
    if (!Networking::NetDriver || !MpReadableThisFrame(Networking::NetDriver, 0xA0)) return;

    // Re-resolve the owning connection so we can skip it; a failure here is not fatal, it just
    // means we may redo the owner (the actor+node dedup makes that a refresh, not a duplicate).
    void* OwnerConnection = nullptr;
    RoutePlayerRoleToOwningConnectionRaw(PlayerRole, &OwnerConnection, nullptr, nullptr, nullptr);

    const RawPointerArray* ClientConnections = reinterpret_cast<const RawPointerArray*>(
        reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x90);
    if (!IsReadablePointer(ClientConnections, sizeof(RawPointerArray))) return;
    if (!IsSanePointerArray(ClientConnections->Data, ClientConnections->Num,
                            ClientConnections->Max, 1024)) return;

    for (int32_t i = 0; i < ClientConnections->Num; ++i) {
        void* Connection = ClientConnections->Data[i];
        if (!Connection || Connection == OwnerConnection) continue;
        if (!MpReadableThisFrame(Connection, 0x140)) continue;

        void* Graph = nullptr; void* Node = nullptr;
        int BootstrapResult = 0;
        const int Result = RoutePlayerRoleToOwningConnectionRaw(PlayerRole, nullptr, &Graph, &Node,
            &BootstrapResult, Connection);
        if (Result == -2) MpLogPlayerRoleRouteTableFull(PlayerRole, Connection, "remote");   // [2026-10-11 O1]
        if (Result == 1 || Result == -1) {   // ADDED / FAULT are worth a line; refreshes are not
            MpLog("[PlayerRoleGraphRoute] role=" + MpPtr(PlayerRole)
                + " conn=" + MpPtr(Connection) + " graph=" + MpPtr(Graph) + " node=" + MpPtr(Node)
                + " scope=remote"
                + " result=" + (Result == 1 ? std::string("ADDED") : std::string("FAULT"))
                + " bootstrap=" + std::to_string(BootstrapResult));
        }
    }
}

// [2026-07-22 OMNICELL real-hunt repair] The first direct role bunch can be emitted before
// AArchonEquipment finishes its gameplay lifecycle. Shock Escalation proved ApplyPlayerRole is not
// guaranteed to run a third time after that transition: the server Tempest role later held 4/4 charge
// and CanActivateAbility=true while the owning client remained on the pre-active 0/4 snapshot. The
// owner-node route itself was healthy; its existing channel simply never received a final dirty-state
// push at the lifecycle boundary.
//
// Track every routed AArchonPlayerRole (not only Tempest). Once all four native lifecycle bytes have
// remained active for a short settle window, invoke the stock Actor FlushNetDormancy/ForceNetUpdate
// APIs and replicate that exact actor on its existing owner channel. No charge, tags, modifier arrays,
// role IDs, or lifecycle bits are fabricated. The operation is one-shot per active cycle, with three
// bounded retries only when ReplicateActor reports that it wrote no data.
static constexpr uint64_t kPlayerRolePostActiveSettleMs = 1500;
static constexpr uint64_t kPlayerRolePostActiveRetryMs = 1500;
static constexpr int kPlayerRolePostActiveMaxAttempts = 3;
// [2026-07-25] A push that ReplicateActor rejected in its prologue never evaluated the actor's
// properties, so it is not evidence that there was nothing to send. Give those their own budget
// (20 x 1.5s = ~30s, matching the client-side PlayerRoleRepNotify window) instead of letting them
// exhaust the 3 real attempts inside 4.5s and abandon the Omnicell for the rest of the hunt.
static constexpr int kPlayerRolePostActiveMaxBlockedDeferrals = 20;

// [2026-07-25 AMP ROOT-CAUSE FIX] Escalation is supposed to give EVERY player their own relic
// pickups each time a round finishes. UEscalationGameModeComponent::SpawnPlayerBuffChoicesForFinishedRound
// does exactly that: its body (Ghidra FUN_1419d12f0) walks the full PlayerControllerIterator and, for
// each valid AArchonPlayerController with an escalation component and season data, builds that player's
// own option list and async-loads/spawns their pickups.
//
// Evidence that it never runs, and that this is safe to drive ourselves:
//   * Xrefs on the implementation show three DATA refs plus exactly ONE code ref - its own exec thunk.
//     There is no native C++ caller, so ProcessEvent is the only possible entry point, which means the
//     DLL's ProcessEvent tracer observes every invocation. Across four multiplayer repros it logged
//     zero. The function is simply never invoked by the shipped Blueprint graph.
//   * The state machine is confirmed healthy. Repro 4 traced a complete round cycle:
//       InEvent(6) -> EventEnding(7) -> EventSummary(8) -> BetweenEvents(9) -> round 0->1 -> EventAnnounce(4)
//     with GameModeContentFinished/AuthOnRoundContentFinished both firing (result=1). So the round-end
//     signal that should trigger the spawn does arrive; only the spawn call is missing.
//   * Consequence: the party shares the single level-placed escalation_buff_gatherable actor, they queue
//     on it, and the first player to complete the interaction selects with advances=1 which advances the
//     round for everyone. Every "first player wins, rest stuck" repro is this.
//
// We therefore call the game's own function at the round-finished transition. Nothing is fabricated: the
// option lists, the player iteration and the spawning are all the game's. Deferred to the server tick
// pump rather than called inline from ProcessEventHook, because invoking ProcessEvent from inside the
// ProcessEvent hook risks recursion (the hook has a reentrancy guard, but spawning actors underneath it
// is not worth the risk). Deduped per (component, round) so a round can only ever spawn one set.
// Disable with ESCALATION_NO_BUFF_CHOICE_SPAWN.flag next to the exe for A/B.
struct EscalationBuffChoiceRequest {
    void* ModeComponent = nullptr;
    int Round = INT_MIN;
    bool Pending = false;
};
static EscalationBuffChoiceRequest s_escalationBuffChoiceRequest{};
static void* s_escalationBuffChoiceLastComponent = nullptr;
static int s_escalationBuffChoiceLastRound = INT_MIN;

// ============================================================================================
// RETIRED 2026-07-26: relic UI fan-out
// Repro 14 proved the freeze occurs when a player selects an amp even when the other player never
// opens a relic screen. The implementation and all call sites were removed because it added channel
// churn and forced UI onto uninvolved players.
// ============================================================================================

// Called from ProcessEventHook when the mode component is told the state changed. Records only; the
// actual dispatch happens on the next server tick.
static void NoteEscalationStateChangeForBuffChoices(UObject* ModeComponent, void* Parms) {
    if (!Globals::AmServer || !ModeComponent || !Parms) return;
    if (MpExeRelativeFlagPresent(L"ESCALATION_NO_BUFF_CHOICE_SPAWN.flag")) return;
    if (!IsReadablePointer(Parms, 0x2)) return;

    const int NewState = SafeReadU8At(reinterpret_cast<uintptr_t>(Parms), 0x0);
    const int TransitionType = SafeReadU8At(reinterpret_cast<uintptr_t>(Parms), 0x1);
    // EventEnding(7) entry (transitionType 0) is the moment the round has just finished - it lands
    // ~4s before the level-placed crystal becomes interactable in the observed traces, so the per-player
    // pickups exist before anyone can queue on the shared one.
    if (NewState != 7 || TransitionType != 0) return;
    if (!IsReadablePointer(ModeComponent, 0xC0)) return;

    void* StateComponent = *reinterpret_cast<void**>(
        reinterpret_cast<uintptr_t>(ModeComponent) + 0xB8);
    const int Round = (StateComponent && IsReadablePointer(StateComponent, 0x138))
        ? SafeReadI32At(reinterpret_cast<uintptr_t>(StateComponent), 0x134) : INT_MIN;

    if (s_escalationBuffChoiceLastComponent == ModeComponent
        && s_escalationBuffChoiceLastRound == Round) {
        return; // already served this round
    }
    s_escalationBuffChoiceRequest.ModeComponent = ModeComponent;
    s_escalationBuffChoiceRequest.Round = Round;
    s_escalationBuffChoiceRequest.Pending = true;
    MpLog("[EscalationBuffChoiceSpawn] queued mode=" + MpPtr(ModeComponent)
        + " round=" + std::to_string(Round)
        + " trigger=EventEnding(7) entry");
}

static void TickEscalationBuffChoiceSpawn() {
    if (!Globals::AmServer || !OrigProcessEvent) return;
    if (!s_escalationBuffChoiceRequest.Pending) return;

    EscalationBuffChoiceRequest Request = s_escalationBuffChoiceRequest;
    s_escalationBuffChoiceRequest.Pending = false;

    UObject* ModeComponent = reinterpret_cast<UObject*>(Request.ModeComponent);
    if (!ModeComponent || !IsReadablePointer(ModeComponent, 0xC0)
        || !IsRegisteredLiveObject(ModeComponent)) {
        MpLog("[EscalationBuffChoiceSpawn] skipped: mode component no longer live mode="
            + MpPtr(Request.ModeComponent) + " round=" + std::to_string(Request.Round));
        return;
    }

    UFunction* SpawnFn = ModeComponent->Class
        ? ModeComponent->Class->GetFunction("EscalationGameModeComponent",
                                            "SpawnPlayerBuffChoicesForFinishedRound")
        : nullptr;
    if (!SpawnFn) {
        MpLog("[EscalationBuffChoiceSpawn] SpawnPlayerBuffChoicesForFinishedRound UFunction not found"
            " on mode=" + MpPtr(ModeComponent));
        return;
    }

    s_escalationBuffChoiceLastComponent = Request.ModeComponent;
    s_escalationBuffChoiceLastRound = Request.Round;
    MpLog("[EscalationBuffChoiceSpawn] dispatching mode=" + MpPtr(ModeComponent)
        + " round=" + std::to_string(Request.Round));
    reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEvent)(
        ModeComponent, SpawnFn, nullptr);
    MpLog("[EscalationBuffChoiceSpawn] dispatched  mode=" + MpPtr(ModeComponent)
        + " round=" + std::to_string(Request.Round));
}

// [2026-07-25 OMNICELL CHANNEL CHURN] Edge-triggered actor-channel presence log.
//
// Repro 10 narrowed the omnicell flicker to one thing: the server's two AArchonPlayerRole actors
// are stable for the whole match, but each client keeps minting a NEW role UObject every few
// seconds, and every one arrives with gameplayEquipped=0 roleActive=0 bpEquipCalled=0. A fresh
// object for a stable server actor is a fresh NetGUID resolve, which means the actor channel
// closed and reopened. The HUD binds to Pawn->PlayerRole, so it unbinds every time.
//
// What we have never been able to see is the server side of that: when the channel drops, and what
// the actor's dormancy/relevancy state is at that instant. This polls channel presence for every
// (role, connection) pair already in the route table and logs ONLY transitions, so a healthy hunt
// costs one OPEN line per pair and nothing more. Everything read here is read-only.
//
// Turn off with NO_PLAYER_ROLE_CHANNEL_LOG.flag.
struct PlayerRoleChannelState {
    void* Actor = nullptr;
    void* Connection = nullptr;
    int LastChIndex = -3;      // -3 = never sampled
    int Transitions = 0;
};
// [2026-10-11 1.14.7 O1] Diagnostic-only state, one per route entry: same capacity as the route table and stored at the
// route's own index (a pair's route index is fixed for the route's lifetime), so the old scan over 64 states - and the
// silent drop once 64 pairs were tracked - are gone. A state left over from a different pair at that index is reset
// (the old table could find a pair's previous state at another index; the only difference is one extra first-sample
// OPEN line). Off with PRODUCTION_LOG_PROFILE.flag as well as NO_PLAYER_ROLE_CHANNEL_LOG.flag.
static PlayerRoleChannelState s_playerRoleChannelStates[kPlayerRoleRouteCapacity]{};

static void TickPlayerRoleChannelChurn() {
    if (!Globals::AmServer) return;
    if (MpExeRelativeFlagPresent(L"NO_PLAYER_ROLE_CHANNEL_LOG.flag") || MpProductionLogProfile()) return;

    for (const PlayerRoleGraphRoute& Route : MpActivePlayerRoleRoutes()) {
        if (!Route.Actor || !Route.Connection) continue;
        if (!MpRolePassActorSafe(Route.Actor)) continue;
        if (!IsCurrentNetDriverClientConnection(Route.Connection)) continue;

        const int ChIndex = Networking::GetActorChannelIndexForConnection(
            reinterpret_cast<AActor*>(Route.Actor),
            reinterpret_cast<UNetConnection*>(Route.Connection));

        PlayerRoleChannelState* Slot = &s_playerRoleChannelStates[MpPlayerRoleRouteIndex(Route)];
        if (Slot->Actor != Route.Actor || Slot->Connection != Route.Connection) {
            Slot->Actor = Route.Actor;
            Slot->Connection = Route.Connection;
            Slot->LastChIndex = -3;
            Slot->Transitions = 0;
        }

        // Only an open<->closed flip is interesting; a stable channel logs nothing.
        const bool WasOpen = Slot->LastChIndex >= 0;
        const bool IsOpen = ChIndex >= 0;
        if (Slot->LastChIndex != -3 && WasOpen == IsOpen) continue;
        const bool FirstSample = Slot->LastChIndex == -3;
        Slot->LastChIndex = ChIndex;
        if (!FirstSample) ++Slot->Transitions;

        const uintptr_t Role = reinterpret_cast<uintptr_t>(Route.Actor);
        MpLog(std::string("[PlayerRoleChannel] ") + (IsOpen ? "OPEN " : "CLOSED")
            + " role=" + MpPtr(Route.Actor)
            + " itemId=" + (IsReadablePointer(Route.Actor, 0x250)
                ? CoreCapFString(reinterpret_cast<void*>(Role + 0x240)) : std::string("?"))
            + " conn=" + MpPtr(Route.Connection)
            + " channelPresent=" + std::to_string(ChIndex)
            + " transitions=" + std::to_string(Slot->Transitions)
            + " flags58=" + MpHex(SafeReadU8At(Role, 0x58))
            + " flags59=" + MpHex(SafeReadU8At(Role, 0x59))
            + " globalPersistentMember="
            + std::to_string(RepGraphPersistentActorListContains(Route.Node, Route.Actor))
            + " netDormancy=" + std::to_string(SafeReadU8At(Role, 0xF1))
            + " bIsEquipped=" + std::to_string(SafeReadU8At(Role, 0x2F4))
            + " gameplayEquipped=" + std::to_string(SafeReadU8At(Role, 0x2F5))
            + " activeGameplay=" + std::to_string(SafeReadU8At(Role, 0x2F6)));
    }
}

// [2026-07-26] Keep the relevance settings asserted for the whole hunt.
//
// RouteAddNetworkActorToNodes is the single registration point and is where both fixes are really
// applied, but three things can undo them: a replication-graph rebuild recreates
// FGlobalActorReplicationInfo from the class map; FGlobalActorReplicationInfoMap::Get creates a
// fresh entry from the class map if one was dropped; and a connection that gathered an actor before
// the hook ran still holds its own snapshot of the spatial cull distance. This re-asserts the same
// settings roughly once a second and logs ONLY when it actually had to change something, so a
// healthy hunt costs nothing and a regression is visible immediately. Everything it writes is a
// replication-graph setting - no actor flags, no gameplay state, no channel manipulation.

// ---------------------------------------------------------------------------------------------
// [2026-07-26 ARTIFICER DRONE — CLIENT GATE + SERVER CHANNEL DIAGNOSTICS]
// ---------------------------------------------------------------------------------------------
//
// The cooked frank_player_role_bp asset is extractable with the repository's repak/UAssetGUI
// tools. Its bytecode proves that the Blueprint term in AArchonPlayerRole::CanActivateAbility is:
//
//   Super::CanActivateAbilityBP()
//   && IsValid(MyDrone)
//   && MyDrone.CurrentOwningPositionActor == GetOwner()
//
// MyDrone is a replicated ObjectProperty (RepIndex 15); CurrentOwningPositionActor is an
// unreplicated ObjectProperty maintained by the role's reliable multicast SetDronePositionActor.
// Repro 4 proves the server passes this term after the first activation while the owning client
// fails it. Consequently the decisive state must be sampled on the CLIENT, while the server must
// independently report the drone's graph route/channel state for that client's connection.
//
// This block is deliberately READ-ONLY for the repro. It does not alter the drone's cull distance,
// connection snapshot, route flags, node membership, timeout, dormancy, transform, or Blueprint
// fields. Mutating before the first clean capture would erase the baseline and still would not prove
// whether the client lost MyDrone or merely retained a stale CurrentOwningPositionActor.
//
// Layout, from the SDK's own FField/FProperty/FFieldClass/UStruct definitions (Basic.hpp,
// CoreUObject_classes.hpp) - these are real reflection primitives, not guesses:
//   UStruct::SuperStruct, UStruct::ChildProperties are typed members (see SDK types below).
//   FField::ClassPrivate, FField::Next, FField::Name are typed members.
//   FProperty::Offset is a typed member (byte offset of the value on the owning UObject).
//   FFieldClass::Name identifies the concrete property kind ("ObjectProperty",
//   "WeakObjectProperty", ...), read the same way as any other FName.
static FProperty* FindPropertyByNameInChain(UStruct* Struct, const char* TargetName) {
    int StructGuard = 0;
    while (Struct && StructGuard++ < 32) {
        if (!IsReadablePointer(Struct, sizeof(UStruct))) return nullptr;
        FField* Field = Struct->ChildProperties;
        int FieldGuard = 0;
        while (Field && FieldGuard++ < 512) {
            if (!IsReadablePointer(Field, sizeof(FField))) break;
            const int32_t Comp = Field->Name.ComparisonIndex;
            const uint32_t Num = Field->Name.Number;
            if (Comp > 0 && Comp < 0x100000) {
                FName Resolved{Comp, static_cast<uint32_t>(Num)};
                if (Resolved.ToString() == TargetName) {
                    return IsReadablePointer(Field, sizeof(FProperty))
                        ? reinterpret_cast<FProperty*>(Field) : nullptr;
                }
            }
            Field = Field->Next;
        }
        Struct = Struct->SuperStruct;
    }
    return nullptr;
}

static std::string FieldClassNameOf(FField* Field) {
    if (!Field || !IsReadablePointer(Field, sizeof(FField))) return "?";
    FFieldClass* Fc = Field->ClassPrivate;
    if (!Fc || !IsReadablePointer(Fc, sizeof(FFieldClass))) return "?";
    const int32_t Comp = Fc->Name.ComparisonIndex;
    const uint32_t Num = Fc->Name.Number;
    if (Comp <= 0 || Comp >= 0x100000) return "?";
    return FName{Comp, static_cast<uint32_t>(Num)}.ToString();
}

// Resolves an FObjectProperty/FWeakObjectProperty-typed field's value at Owner+Offset into a live
// UObject*. OutRawValue preserves a direct ObjectProperty's raw pointer even when the target was
// destroyed/unregistered; that distinction is essential because a null/dead MyDrone directly
// makes Artificer's IsValid(MyDrone) gate false.
static void* ReadObjectLikePropertyValue(
    void* Owner, FProperty* Field, std::string* OutFieldClass,
    void** OutRawValue = nullptr, int32_t* OutOffset = nullptr) {
    if (OutRawValue) *OutRawValue = nullptr;
    if (OutOffset) *OutOffset = -1;
    const std::string FieldClass = FieldClassNameOf(Field);
    if (OutFieldClass) *OutFieldClass = FieldClass;
    if (!Owner || !Field || !IsReadablePointer(Field, sizeof(FProperty))) return nullptr;
    const int32_t Offset = Field->Offset;
    if (OutOffset) *OutOffset = Offset;
    if (Offset < 0 || Offset > 0x10000) return nullptr;
    const uintptr_t ValueAddr = reinterpret_cast<uintptr_t>(Owner) + static_cast<uintptr_t>(Offset);
    if (!IsReadablePointer(reinterpret_cast<void*>(ValueAddr), 8)) return nullptr;

    if (FieldClass == "WeakObjectProperty") {
        const int32_t Index = *reinterpret_cast<int32_t*>(ValueAddr);
        void* Resolved = ResolveWeakObjectIndexChecked(Index, nullptr);
        if (OutRawValue) *OutRawValue = Resolved;
        return Resolved;
    }
    if (FieldClass == "ObjectProperty" || FieldClass == "ClassProperty") {
        void* Raw = *reinterpret_cast<void**>(ValueAddr);
        if (OutRawValue) *OutRawValue = Raw;
        if (!Raw || !IsReadablePointer(Raw, 0x30) || !IsRegisteredLiveObject(Raw)) return nullptr;
        return Raw;
    }
    return nullptr;
}

// Use the native world-location accessor. USceneComponent+0x11C is RelativeLocation and cannot be
// labeled world-space for an attached root.
static bool GetActorWorldLocation(void* Actor, float& X, float& Y, float& Z) {
    X = Y = Z = 0.0f;
    if (!Actor || !IsReadablePointer(Actor, 0x138) || !IsRegisteredLiveObject(Actor)) return false;
    __try {
        const FVector Location = reinterpret_cast<AActor*>(Actor)->K2_GetActorLocation();
        X = Location.X;
        Y = Location.Y;
        Z = Location.Z;
        return true;
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

struct FrankDroneGateSnapshot {
    bool Applicable = false;
    void* Role = nullptr;
    void* RoleOwner = nullptr;
    FProperty* DroneField = nullptr;
    std::string DroneFieldClass;
    int32_t DroneFieldOffset = -1;
    void* DroneRaw = nullptr;
    void* Drone = nullptr;
    FProperty* PositionField = nullptr;
    std::string PositionFieldClass;
    int32_t PositionFieldOffset = -1;
    void* PositionActorRaw = nullptr;
    void* PositionActor = nullptr;
    bool MatchesRoleOwner = false;
};

static FrankDroneGateSnapshot CaptureFrankDroneGate(void* PlayerRole) {
    FrankDroneGateSnapshot Result{};
    if (!PlayerRole || !IsReadablePointer(PlayerRole, 0x360)
        || !IsRegisteredLiveObject(PlayerRole)) return Result;
    if (!IsReadablePointer(PlayerRole, 0x250)
        || CoreCapFString(reinterpret_cast<void*>(
            reinterpret_cast<uintptr_t>(PlayerRole) + 0x240)) != "PR_FRANK") return Result;

    Result.Applicable = true;
    Result.Role = PlayerRole;
    Result.RoleOwner = IsReadablePointer(PlayerRole, 0xE8)
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(PlayerRole) + 0xE0) : nullptr;

    UObject* RoleObject = reinterpret_cast<UObject*>(PlayerRole);
    Result.DroneField = RoleObject->Class
        ? FindPropertyByNameInChain(RoleObject->Class, "MyDrone") : nullptr;
    Result.Drone = Result.DroneField
        ? ReadObjectLikePropertyValue(PlayerRole, Result.DroneField,
            &Result.DroneFieldClass, &Result.DroneRaw, &Result.DroneFieldOffset)
        : nullptr;

    if (Result.Drone) {
        UObject* DroneObject = reinterpret_cast<UObject*>(Result.Drone);
        Result.PositionField = DroneObject->Class
            ? FindPropertyByNameInChain(
                DroneObject->Class, "CurrentOwningPositionActor") : nullptr;
        Result.PositionActor = Result.PositionField
            ? ReadObjectLikePropertyValue(Result.Drone, Result.PositionField,
                &Result.PositionFieldClass, &Result.PositionActorRaw,
                &Result.PositionFieldOffset)
            : nullptr;
    }
    Result.MatchesRoleOwner =
        Result.PositionActorRaw != nullptr && Result.PositionActorRaw == Result.RoleOwner;
    return Result;
}

static std::string FrankDroneGateSummary(void* PlayerRole) {
    const FrankDroneGateSnapshot S = CaptureFrankDroneGate(PlayerRole);
    if (!S.Applicable) return "not-PR_FRANK";
    return "role=" + MpPtr(S.Role)
        + " roleOwner=" + MpPtr(S.RoleOwner)
        + " myDroneField=" + std::string(S.DroneField ? "FOUND" : "NOT_FOUND")
        + " fieldClass=" + (S.DroneField ? S.DroneFieldClass : std::string("?"))
        + " fieldOffset=" + std::to_string(S.DroneFieldOffset)
        + " droneRaw=" + MpPtr(S.DroneRaw)
        + " droneLive=" + MpPtr(S.Drone)
        + "/" + SafeObjectNameForDiagnostic(S.Drone)
        + " positionField=" + std::string(S.PositionField ? "FOUND" : "NOT_FOUND")
        + " positionFieldClass="
        + (S.PositionField ? S.PositionFieldClass : std::string("?"))
        + " positionFieldOffset=" + std::to_string(S.PositionFieldOffset)
        + " currentOwningPositionActorRaw=" + MpPtr(S.PositionActorRaw)
        + " currentOwningPositionActorLive=" + MpPtr(S.PositionActor)
        + " matchesRoleOwner=" + std::to_string(S.MatchesRoleOwner ? 1 : 0);
}

static std::string DescribePropertyChain(UStruct* Struct, int MaxFields = 96) {
    std::string Out;
    int StructGuard = 0;
    int FieldCount = 0;
    while (Struct && StructGuard++ < 32 && FieldCount < MaxFields) {
        if (!IsReadablePointer(Struct, sizeof(UStruct))) break;
        if (!Out.empty()) Out += " | ";
        Out += "class=" + Struct->GetName() + "{";
        FField* Field = Struct->ChildProperties;
        int FieldGuard = 0;
        bool First = true;
        while (Field && FieldGuard++ < 512 && FieldCount < MaxFields) {
            if (!IsReadablePointer(Field, sizeof(FField))) break;
            const int32_t Comp = Field->Name.ComparisonIndex;
            const uint32_t Num = Field->Name.Number;
            if (Comp > 0 && Comp < 0x100000) {
                if (!First) Out += ",";
                First = false;
                Out += FName{Comp, Num}.ToString()
                    + ":" + FieldClassNameOf(Field);
                if (IsReadablePointer(Field, sizeof(FProperty))) {
                    Out += "@" + std::to_string(
                        reinterpret_cast<FProperty*>(Field)->Offset);
                }
                ++FieldCount;
            }
            Field = Field->Next;
        }
        Out += "}";
        Struct = Struct->SuperStruct;
    }
    if (FieldCount >= MaxFields) Out += " ...(capped)";
    return Out;
}

// ProcessEvent-level trace for the reliable multicast that maintains the client-only part of the
// Artificer gate. This catches the real Blueprint UFunction even though cooked Blueprint functions
// have no stable native RVA. Object candidates in the parameter buffer are resolved through the
// live GObjects table, so the repro identifies the exact position actor/drone object without relying
// on an unverified cooked parameter layout.
static void TraceArtificerDroneEvent(
    const char* Side, const char* Phase, UObject* Object,
    const std::string& FunctionName, void* Parms) {
    if (FunctionName.find("SetDronePositionActor") == std::string::npos) return;

    static std::atomic<int> s_traceBudget{0};
    const int Sequence = s_traceBudget.fetch_add(1, std::memory_order_relaxed);
    if (Sequence >= 512) return;

    std::string Candidates;
    if (Parms && IsReadablePointer(Parms, 0x20)) {
        for (uintptr_t Offset = 0; Offset < 0x20; Offset += sizeof(void*)) {
            void* Candidate = *reinterpret_cast<void**>(
                reinterpret_cast<uintptr_t>(Parms) + Offset);
            if (!Candidate || !IsReadablePointer(Candidate, 0x20)
                || !IsRegisteredLiveObject(Candidate)) continue;
            UObject* CandidateObject = reinterpret_cast<UObject*>(Candidate);
            if (!Candidates.empty()) Candidates += ",";
            Candidates += "+" + MpHex(Offset) + "=" + MpPtr(Candidate)
                + "/" + SafeObjectNameForDiagnostic(Candidate)
                + "[" + (CandidateObject->Class
                    ? CandidateObject->Class->GetName() : std::string("?")) + "]";
        }
    }
    if (Candidates.empty()) Candidates = "(none)";

    std::string Gate;
    if (Object && IsReadablePointer(Object, 0x360)
        && IsRegisteredLiveObject(Object)
        && Object->IsA(SDK::AArchonPlayerRole::StaticClass())
        && CoreCapFString(reinterpret_cast<void*>(
            reinterpret_cast<uintptr_t>(Object) + 0x240)) == "PR_FRANK") {
        Gate = " gate={" + FrankDroneGateSummary(Object) + "}";
    }

    MpLog("[FrankSetDronePositionActor] side=" + std::string(Side ? Side : "?")
        + " phase=" + std::string(Phase ? Phase : "?")
        + " seq=" + std::to_string(Sequence)
        + " fn=" + FunctionName
        + " obj=" + MpPtr(Object) + "/" + SafeObjectNameForDiagnostic(Object)
        + " class=" + (Object && Object->Class
            ? Object->Class->GetName() : std::string("?"))
        + " parms=" + MpPtr(Parms)
        + " objectCandidates={" + Candidates + "}" + Gate);
}

// Native dispatcher used by AArchonPlayerRole::CanActivateAbility after the equipped and charge
// terms have passed. Ghidra verifies RVA 0x02169C10 resolves CanActivateAbilityBP and invokes it via
// ProcessEvent, returning the Blueprint bool. Hooking this exact boundary tells us whether Artificer
// flips false, on which live role object, and what the MyDrone/position-actor state was on that same
// call. It is diagnostic only: the Blueprint result is returned unchanged.
void* OrigFrankCanActivateAbilityBP = nullptr;
bool __fastcall FrankCanActivateAbilityBPHook(void* PlayerRole) {
    using Fn = bool(__fastcall*)(void*);
    if (!PlayerRole || !IsReadablePointer(PlayerRole, 0x360)
        || !IsRegisteredLiveObject(PlayerRole)
        || !reinterpret_cast<UObject*>(PlayerRole)->IsA(
            SDK::AArchonPlayerRole::StaticClass())
        || CoreCapFString(reinterpret_cast<void*>(
            reinterpret_cast<uintptr_t>(PlayerRole) + 0x240)) != "PR_FRANK") {
        return reinterpret_cast<Fn>(OrigFrankCanActivateAbilityBP)(PlayerRole);
    }

    const bool Result = reinterpret_cast<Fn>(OrigFrankCanActivateAbilityBP)(PlayerRole);
    const FrankDroneGateSnapshot Drone = CaptureFrankDroneGate(PlayerRole);
    const uint64_t Now = GetTickCount64();

    struct HookState {
        void* Role = nullptr;
        int LastResult = -1;
        uint64_t LastLogMs = 0;
        uint64_t Calls = 0;
        bool FieldInventoryLogged = false;
    };
    static HookState s_states[32]{};
    HookState* Slot = nullptr;
    HookState* Free = nullptr;
    for (HookState& State : s_states) {
        if (State.Role == PlayerRole) {
            Slot = &State;
            break;
        }
        if (!State.Role && !Free) Free = &State;
    }
    if (!Slot && Free) {
        Free->Role = PlayerRole;
        Slot = Free;
    }
    if (!Slot) return Result;

    ++Slot->Calls;
    const bool Changed = Slot->LastResult < 0
        || Slot->LastResult != (Result ? 1 : 0);
    const bool Heartbeat = Slot->LastLogMs == 0 || Now - Slot->LastLogMs >= 5000;
    Slot->LastResult = Result ? 1 : 0;
    if (Changed || Heartbeat) {
        Slot->LastLogMs = Now;
        UObject* RoleObject = reinterpret_cast<UObject*>(PlayerRole);
        const float Current = SafeCallPlayerRoleFloat(PlayerRole, 0x01B983E0);
        const float Maximum = *reinterpret_cast<float*>(
            reinterpret_cast<uintptr_t>(PlayerRole) + 0x308);
        MpLog("[FrankCanActivateBPHook] side="
            + std::string(Globals::AmServer ? "Server" : "Client")
            + " role=" + MpPtr(PlayerRole)
            + " object=" + RoleObject->GetName()
            + " class=" + (RoleObject->Class
                ? RoleObject->Class->GetName() : std::string("?"))
            + " owner=" + MpPtr(Drone.RoleOwner)
            + " result=" + std::to_string(Result ? 1 : 0)
            + " changed=" + std::to_string(Changed ? 1 : 0)
            + " calls=" + std::to_string(Slot->Calls)
            + " equipped=" + std::to_string(
                SafeReadU8At(reinterpret_cast<uintptr_t>(PlayerRole), 0x2F4) ? 1 : 0)
            + " charge=" + std::to_string(Current)
            + "/" + std::to_string(Maximum)
            + " droneGate={" + FrankDroneGateSummary(PlayerRole) + "}");
    }

    // Repro 16 reported MyDrone=NOT_FOUND even though this same Blueprint override sometimes
    // returned true. Emit the live class's real FProperty inventory once, making an incorrect
    // reflection premise visible instead of silently treating NOT_FOUND as null gameplay state.
    if (!Drone.DroneField && !Slot->FieldInventoryLogged) {
        Slot->FieldInventoryLogged = true;
        UObject* RoleObject = reinterpret_cast<UObject*>(PlayerRole);
        MpLog("[FrankPropertyInventory] side="
            + std::string(Globals::AmServer ? "Server" : "Client")
            + " role=" + MpPtr(PlayerRole)
            + " class=" + (RoleObject->Class
                ? RoleObject->Class->GetName() : std::string("?"))
            + " properties={"
            + (RoleObject->Class
                ? DescribePropertyChain(RoleObject->Class) : std::string("(no-class)"))
            + "}");
    }
    return Result;
}

struct FrankDroneClientState {
    void* Role = nullptr;
    void* DroneRaw = nullptr;
    void* Drone = nullptr;
    void* PositionActorRaw = nullptr;
    void* RoleOwner = nullptr;
    bool DroneFieldFound = false;
    bool PositionFieldFound = false;
    bool MatchesRoleOwner = false;
    uint64_t LastLogMs = 0;
};
static FrankDroneClientState s_frankDroneClientState{};

// Runs on the owning client from ProcessEventClientHook's periodic pump and at every tap/hold input
// boundary. This is the only process that can directly prove whether the local MyDrone reference or
// its unreplicated CurrentOwningPositionActor became stale after the first Artificer activation.
static void TickFrankDroneClientDiag(void* Pawn, const char* Trigger) {
    if (Globals::AmServer) return;
    if (!Pawn || !IsReadablePointer(Pawn, 0x740) || !IsRegisteredLiveObject(Pawn)) return;
    void* Role = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Pawn) + 0x738);
    const FrankDroneGateSnapshot S = CaptureFrankDroneGate(Role);
    if (!S.Applicable) {
        s_frankDroneClientState = FrankDroneClientState{};
        return;
    }

    const uint64_t Now = GetTickCount64();
    const bool Changed =
        s_frankDroneClientState.Role != S.Role
        || s_frankDroneClientState.DroneRaw != S.DroneRaw
        || s_frankDroneClientState.Drone != S.Drone
        || s_frankDroneClientState.PositionActorRaw != S.PositionActorRaw
        || s_frankDroneClientState.RoleOwner != S.RoleOwner
        || s_frankDroneClientState.DroneFieldFound != (S.DroneField != nullptr)
        || s_frankDroneClientState.PositionFieldFound != (S.PositionField != nullptr)
        || s_frankDroneClientState.MatchesRoleOwner != S.MatchesRoleOwner;
    const bool Heartbeat = s_frankDroneClientState.LastLogMs == 0
        || Now - s_frankDroneClientState.LastLogMs >= 5000;
    if (!Changed && !Heartbeat && std::string(Trigger ? Trigger : "") != "input") return;

    s_frankDroneClientState.Role = S.Role;
    s_frankDroneClientState.DroneRaw = S.DroneRaw;
    s_frankDroneClientState.Drone = S.Drone;
    s_frankDroneClientState.PositionActorRaw = S.PositionActorRaw;
    s_frankDroneClientState.RoleOwner = S.RoleOwner;
    s_frankDroneClientState.DroneFieldFound = S.DroneField != nullptr;
    s_frankDroneClientState.PositionFieldFound = S.PositionField != nullptr;
    s_frankDroneClientState.MatchesRoleOwner = S.MatchesRoleOwner;
    s_frankDroneClientState.LastLogMs = Now;

    MpLog("[FrankDroneDiag][Client] trigger=" + std::string(Trigger ? Trigger : "?")
        + " pawn=" + MpPtr(Pawn)
        + " " + FrankDroneGateSummary(Role)
        + " charge={" + PlayerRoleChargeSummary(Role) + "}");
}

static void* FindRepGraphConnectionActorInfo(
    void* Graph, void* Connection, void* Actor) {
    if (!Graph || !Connection || !Actor || !IsReadablePointer(Graph, 0x48)) return nullptr;
    const uintptr_t G = reinterpret_cast<uintptr_t>(Graph);
    void** ConnData = *reinterpret_cast<void***>(G + kRepGraphConnectionsData);
    const int32_t ConnNum = *reinterpret_cast<int32_t*>(G + kRepGraphConnectionsNum);
    const int32_t ConnMax = *reinterpret_cast<int32_t*>(G + kRepGraphConnectionsMax);
    if (!IsSanePointerArray(ConnData, ConnNum, ConnMax, 1024)) return nullptr;
    for (int32_t i = 0; i < ConnNum; ++i) {
        void* ConnMgr = ConnData[i];
        if (!ConnMgr || !IsReadablePointer(ConnMgr, 0xE0)) continue;
        if (*reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(ConnMgr) + 0x28)
            != Connection) continue;
        return RepGraphMapFindValue(
            reinterpret_cast<uintptr_t>(ConnMgr) + kRepGraphConnActorInfoMap,
            Actor, 0x20);
    }
    return nullptr;
}

struct FrankDroneServerState {
    void* Role = nullptr;
    void* Connection = nullptr;
    void* DroneRaw = nullptr;
    void* PositionActorRaw = nullptr;
    int LastChIndex = -3;
    int LastDroneLive = -1;
    int LastMatchesOwner = -1;
    int Transitions = 0;
    uint64_t LastLogMs = 0;
};
// [2026-10-11 1.14.7 O1] Deliberately kept at 64 pairs: this is a read-only diagnostic whose every tracked pair logs a
// heartbeat each 5 s, so tracking all PR_FRANK x connection pairs of a 40-player hub would add dozens of lines a second.
// Saturating it only stops logging for further pairs (nothing is routed or repaired here); that now logs once.
static FrankDroneServerState s_frankDroneServerStates[64]{};

// Server counterpart: scoped strictly to PR_FRANK and read-only. It records the drone's native
// route flags, global-node membership, global replication settings, per-connection cull snapshot,
// close frame and actor-channel transitions. This identifies a channel/relevance loss without
// pretending that the server's Blueprint fields describe the owning client's local state.
// [2026-10-11 1.14.7 O1/O3] The role snapshot (CaptureFrankDroneGate: two reflection-chain property searches with an
// FName->string per field) depends only on the role, so it is taken once per role per pass instead of once per
// (role, connection) pair. Off with PRODUCTION_LOG_PROFILE.flag.
static void TickFrankDroneDiagnostics(void* Graph) {
    if (!Globals::AmServer || !Graph || MpProductionLogProfile()) return;

    struct RoleSnap { void* Role; FrankDroneGateSnapshot Snap; };
    std::vector<RoleSnap> Snaps;   // distinct roles of this pass
    for (const PlayerRoleGraphRoute& Route : MpActivePlayerRoleRoutes()) {
        if (!Route.Actor || !Route.Connection) continue;
        if (!MpRolePassActorSafe(Route.Actor)) continue;

        const FrankDroneGateSnapshot* Cached = nullptr;
        for (const RoleSnap& R : Snaps) {
            if (R.Role == Route.Actor) { Cached = &R.Snap; break; }
        }
        if (!Cached) {
            Snaps.push_back({ Route.Actor, CaptureFrankDroneGate(Route.Actor) });
            Cached = &Snaps.back().Snap;
        }
        const FrankDroneGateSnapshot S = *Cached;
        if (!S.Applicable) continue;

        float DroneX = 0, DroneY = 0, DroneZ = 0, OwnerX = 0, OwnerY = 0, OwnerZ = 0;
        const bool HaveDroneLoc = S.Drone && GetActorWorldLocation(S.Drone, DroneX, DroneY, DroneZ);
        const bool HaveOwnerLoc =
            S.RoleOwner && GetActorWorldLocation(S.RoleOwner, OwnerX, OwnerY, OwnerZ);
        const float Distance = (HaveDroneLoc && HaveOwnerLoc)
            ? std::sqrt((DroneX - OwnerX) * (DroneX - OwnerX) + (DroneY - OwnerY) * (DroneY - OwnerY)
                + (DroneZ - OwnerZ) * (DroneZ - OwnerZ))
            : -1.0f;

        const int ChIndex = S.Drone
            ? Networking::GetActorChannelIndexForConnection(
                reinterpret_cast<AActor*>(S.Drone),
                reinterpret_cast<UNetConnection*>(Route.Connection))
            : -1;
        FrankDroneServerState* Slot = nullptr;
        FrankDroneServerState* Free = nullptr;
        for (FrankDroneServerState& State : s_frankDroneServerStates) {
            if (State.Role == Route.Actor && State.Connection == Route.Connection) {
                Slot = &State;
                break;
            }
            if (!State.Role && !Free) Free = &State;
        }
        if (!Slot && Free) {
            Free->Role = Route.Actor;
            Free->Connection = Route.Connection;
            Slot = Free;
        }
        if (!Slot) {
            static bool s_fullLogged = false;   // [2026-10-11 O1] saturation is now visible (once)
            if (!s_fullLogged) {
                s_fullLogged = true;
                MpLog("[FrankDroneDiag][Server] state table full (" + std::to_string(std::size(s_frankDroneServerStates))
                    + " pairs); further PR_FRANK x connection pairs are not traced (diagnostic only, logged once)");
            }
            continue;
        }

        const bool WasOpen = Slot->LastChIndex >= 0;
        const bool IsOpen = ChIndex >= 0;
        const bool ChannelTransitioned = Slot->LastChIndex != -3 && WasOpen != IsOpen;
        if (ChannelTransitioned) ++Slot->Transitions;
        const bool StateChanged = Slot->LastChIndex == -3
            || Slot->DroneRaw != S.DroneRaw
            || Slot->PositionActorRaw != S.PositionActorRaw
            || Slot->LastDroneLive != (S.Drone ? 1 : 0)
            || Slot->LastMatchesOwner != (S.MatchesRoleOwner ? 1 : 0)
            || ChannelTransitioned;
        const uint64_t Now = GetTickCount64();
        const bool Heartbeat = Slot->LastLogMs == 0 || Now - Slot->LastLogMs >= 5000;
        Slot->DroneRaw = S.DroneRaw;
        Slot->PositionActorRaw = S.PositionActorRaw;
        Slot->LastChIndex = ChIndex;
        Slot->LastDroneLive = S.Drone ? 1 : 0;
        Slot->LastMatchesOwner = S.MatchesRoleOwner ? 1 : 0;
        if (!StateChanged && !Heartbeat) continue;
        Slot->LastLogMs = Now;

        void* GlobalInfo = S.Drone ? RepGraphFindGlobalActorInfo(Graph, S.Drone) : nullptr;
        void* ConnInfo = S.Drone
            ? FindRepGraphConnectionActorInfo(Graph, Route.Connection, S.Drone) : nullptr;
        const float GlobalCull = GlobalInfo && IsReadablePointer(GlobalInfo, 0x90)
            ? *reinterpret_cast<float*>(
                reinterpret_cast<uintptr_t>(GlobalInfo) + kRepGraphGlobalCullDistance)
            : -1.0f;
        const float GlobalCullSq = GlobalInfo && IsReadablePointer(GlobalInfo, 0x90)
            ? *reinterpret_cast<float*>(
                reinterpret_cast<uintptr_t>(GlobalInfo) + kRepGraphGlobalCullDistanceSq)
            : -1.0f;
        const int GlobalTimeout = GlobalInfo && IsReadablePointer(GlobalInfo, 0x32)
            ? *reinterpret_cast<uint16_t*>(
                reinterpret_cast<uintptr_t>(GlobalInfo) + kRepGraphGlobalChannelTimeout)
            : -1;
        const float ConnCull = ConnInfo && IsReadablePointer(ConnInfo, 0x30)
            ? *reinterpret_cast<float*>(
                reinterpret_cast<uintptr_t>(ConnInfo) + kRepGraphConnCullDistance)
            : -1.0f;
        const float ConnCullSq = ConnInfo && IsReadablePointer(ConnInfo, 0x30)
            ? *reinterpret_cast<float*>(
                reinterpret_cast<uintptr_t>(ConnInfo) + kRepGraphConnCullDistanceSq)
            : -1.0f;
        const uint32_t CloseFrame = ConnInfo && IsReadablePointer(ConnInfo, 0x30)
            ? *reinterpret_cast<uint32_t*>(reinterpret_cast<uintptr_t>(ConnInfo) + 0x24)
            : 0;
        void* AlwaysRelevantNode = IsReadablePointer(Graph, 0x4A8)
            ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Graph) + 0x4A0)
            : nullptr;
        const int GlobalMember = S.Drone && AlwaysRelevantNode
            ? RepGraphPersistentActorListContains(AlwaysRelevantNode, S.Drone) : -1;
        const uintptr_t DroneBase = reinterpret_cast<uintptr_t>(S.Drone);

        MpLog("[FrankDroneDiag][Server] role=" + MpPtr(S.Role)
            + " conn=" + MpPtr(Route.Connection)
            + " droneRaw=" + MpPtr(S.DroneRaw)
            + " droneLive=" + MpPtr(S.Drone) + "/" + SafeObjectNameForDiagnostic(S.Drone)
            + " myDroneField=" + std::string(S.DroneField ? "FOUND" : "NOT_FOUND")
            + " myDroneOffset=" + std::to_string(S.DroneFieldOffset)
            + " roleOwner=" + MpPtr(S.RoleOwner)
            + " currentOwningPositionActorRaw=" + MpPtr(S.PositionActorRaw)
            + " positionField=" + std::string(S.PositionField ? "FOUND" : "NOT_FOUND")
            + " positionOffset=" + std::to_string(S.PositionFieldOffset)
            + " matchesRoleOwner=" + std::to_string(S.MatchesRoleOwner ? 1 : 0)
            + " flags58=" + (S.Drone ? MpHex(SafeReadU8At(DroneBase, 0x58)) : std::string("?"))
            + " flags59=" + (S.Drone ? MpHex(SafeReadU8At(DroneBase, 0x59)) : std::string("?"))
            + " globalPersistentMember=" + std::to_string(GlobalMember)
            + " globalCull=" + std::to_string(GlobalCull)
            + " globalCullSq=" + std::to_string(GlobalCullSq)
            + " globalTimeout=" + std::to_string(GlobalTimeout)
            + " connCull=" + std::to_string(ConnCull)
            + " connCullSq=" + std::to_string(ConnCullSq)
            + " closeFrame=" + std::to_string(CloseFrame)
            + " channelPresent=" + std::to_string(ChIndex)
            + " channelTransitions=" + std::to_string(Slot->Transitions)
            + " droneWorld=(" + std::to_string(DroneX) + ","
            + std::to_string(DroneY) + "," + std::to_string(DroneZ) + ")"
            + " ownerWorld=(" + std::to_string(OwnerX) + ","
            + std::to_string(OwnerY) + "," + std::to_string(OwnerZ) + ")"
            + " distanceFromOwner=" + std::to_string(Distance)
            + " mutation=NONE");
    }
}

/*
 * [2026-10-11 1.14.7 O3 relevance pass on change] Parts 1 and 2 below search the graph's global actor map (a linear walk
 * of thousands of entries) once per role and once per pawn, and every connection's actor-info map once per role, and
 * built their log strings whether or not anything changed - every ~2 s, growing with roles x connections. They only
 * re-assert settings that the route hook already writes at registration (ArchonRouteAddNetworkActorHook), and in every
 * log since 26 Jul they have never had to correct anything ([PlayerRoleCullGuard] and "[PawnChannelGrace] source=tick":
 * 0 lines in the 8776-8790 logs of 9-11 Oct). They now run when the input set changes - the graph pointer, the client
 * connection count, the set of routed roles or the set of possessed pawns (an order-independent signature) - and at
 * least every 15 s as a safety net. Part 3 (the read-only Artificer diagnostic) keeps its own cadence. The detail
 * strings are built only for a line that is logged. RELEVANCE_PASS_EVERY_TICK.flag (read once) runs parts 1-2 on every
 * call again.
 */
static void TickRepGraphRelevanceSettings() {
    if (!Globals::AmServer || !RepGraphRelevanceFixEnabled()) return;
    if (!Networking::NetDriver || !MpReadableThisFrame(Networking::NetDriver, 0x6F0)) return;
    void* Graph = *reinterpret_cast<void**>(
        reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x6E8);
    if (!Graph || !MpReadableThisFrame(Graph, 0x4C8)) return;
    if (*reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Graph) + 0x30)
        != reinterpret_cast<void*>(Networking::NetDriver)) return;

    static int s_everyTick = -1;
    if (s_everyTick < 0) {
        s_everyTick = MpExeRelativeFlagPresent(L"RELEVANCE_PASS_EVERY_TICK.flag") ? 1 : 0;
        MpLog(std::string("[RelevancePass] role/pawn relevance re-assert ")
            + (s_everyTick ? "on every pass (RELEVANCE_PASS_EVERY_TICK.flag)"
                           : "on change of graph/connections/roles/pawns, else every 15 s (default)"));
    }
    bool RunSettings = true;
    if (s_everyTick == 0) {
        // Order-independent signature of the inputs; reads only, SEH-guarded for the pawn chain.
        uint64_t RoleSum = 0, RoleXor = 0, RoleCount = 0;
        for (const PlayerRoleGraphRoute& Route : MpActivePlayerRoleRoutes()) {
            if (!Route.Actor) continue;
            const uint64_t A = reinterpret_cast<uintptr_t>(Route.Actor);
            RoleSum += A * 0x9E3779B97F4A7C15ull;
            RoleXor ^= (A >> 4) | (A << 60);
            ++RoleCount;   // pairs, not distinct roles: a role reaching one more connection also counts as a change
        }
        uint64_t PawnSum = 0, PawnXor = 0;
        const uintptr_t Driver = reinterpret_cast<uintptr_t>(Networking::NetDriver);
        const int32_t ConnNum = SafeReadI32At(Driver, 0x98);
        const uintptr_t ConnData = SafeReadPtr(Driver, 0x90);
        for (int32_t i = 0; ConnData && i < ConnNum && i < 1024; ++i) {
            const uintptr_t Conn = SafeReadPtr(ConnData, static_cast<uintptr_t>(i) * sizeof(void*));
            const uintptr_t PC = Conn ? SafeReadPtr(Conn, 0x30) : 0;
            const uintptr_t Pawn = PC ? SafeReadPtr(PC, 0x250) : 0;
            PawnSum += static_cast<uint64_t>(Pawn) * 0xC2B2AE3D27D4EB4Full + static_cast<uint64_t>(Conn);
            PawnXor ^= static_cast<uint64_t>(Pawn) ^ (static_cast<uint64_t>(Conn) << 1);
        }
        const uint64_t Signature = (RoleSum ^ (RoleXor * 31) ^ (RoleCount << 48))
            ^ ((PawnSum ^ (PawnXor * 131)) * 0x100000001B3ull)
            ^ (static_cast<uint64_t>(reinterpret_cast<uintptr_t>(Graph)) * 7) ^ (static_cast<uint64_t>(ConnNum) << 40);
        static uint64_t s_lastSignature = 0;
        static uint64_t s_lastRunMs = 0;
        const uint64_t Now = GetTickCount64();
        RunSettings = s_lastRunMs == 0 || Signature != s_lastSignature || Now - s_lastRunMs >= 15000;
        if (RunSettings) {
            s_lastSignature = Signature;
            s_lastRunMs = Now;
        }
    }
    if (!RunSettings) {
        TickFrankDroneDiagnostics(Graph);   // part 3 only
        return;
    }

    // 1) Every AArchonPlayerRole we know about: global settings plus any stale per-connection
    //    snapshot. Keyed on the distinct actors in the route table, which is populated by
    //    ApplyPlayerRoleHook for every equipped role on the server.
    // [2026-10-11 O1] Distinct roles up to the route capacity (was 64: roles past the 64th were re-asserted every time
    // they appeared, i.e. once per pair).
    static void* s_seenRoles[kPlayerRoleRouteCapacity];
    int SeenRoleCount = 0;
    for (const PlayerRoleGraphRoute& Route : MpActivePlayerRoleRoutes()) {
        if (!Route.Actor) continue;
        bool Duplicate = false;
        for (int i = 0; i < SeenRoleCount; ++i) {
            if (s_seenRoles[i] == Route.Actor) { Duplicate = true; break; }
        }
        if (Duplicate) continue;
        if (SeenRoleCount < kPlayerRoleRouteCapacity) {
            s_seenRoles[SeenRoleCount++] = Route.Actor;
        }
        if (!MpRolePassActorSafe(Route.Actor)) continue;

        std::string Detail;
        void* RoleGlobalInfo = RepGraphFindGlobalActorInfo(Graph, Route.Actor);
        const int GlobalResult = RepGraphApplyGlobalSettings(
            RoleGlobalInfo, true, kRepGraphPlayerChannelGraceFrames, &Detail, true);
        const int Cleared = RepGraphClearConnectionCullDistance(Graph, Route.Actor);
        if (Cleared > 0 && Detail.empty()) {
            // Unchanged global settings: re-read them for the same "before->after" text the old line printed.
            RepGraphApplyGlobalSettings(RoleGlobalInfo, true, kRepGraphPlayerChannelGraceFrames, &Detail);
        }
        if (GlobalResult == 1 || Cleared > 0) {
            MpLog("[PlayerRoleCullGuard] role=" + MpPtr(Route.Actor)
                + " itemId=" + (IsReadablePointer(Route.Actor, 0x250)
                    ? CoreCapFString(reinterpret_cast<void*>(
                        reinterpret_cast<uintptr_t>(Route.Actor) + 0x240))
                    : std::string("?"))
                + " globalResult=" + std::to_string(GlobalResult)
                + " connectionSnapshotsCleared=" + std::to_string(Cleared)
                + Detail);
        }
    }

    // 2) Every currently possessed player pawn: channel grace only. Resolved through the net
    //    driver's client connections (UPlayer::PlayerController @ +0x30, APlayerController::Pawn @
    //    +0x250) so this can only ever touch a real player character, never a behemoth or a
    //    level actor.
    if (!MpReadableThisFrame(Networking::NetDriver, 0xA0)) return;
    const RawPointerArray* Connections = reinterpret_cast<const RawPointerArray*>(
        reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x90);
    if (!MpReadableThisFrame(Connections, sizeof(RawPointerArray))) return;
    if (!IsSanePointerArray(Connections->Data, Connections->Num, Connections->Max, 1024)) return;
    for (int32_t i = 0; i < Connections->Num; ++i) {
        void* Connection = Connections->Data[i];
        if (!Connection || !MpReadableThisFrame(Connection, 0x140)) continue;
        void* PC = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Connection) + 0x30);
        if (!PC || !IsReadablePointer(PC, 0x258) || !IsRegisteredLiveObject(PC)) continue;
        void* Pawn = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(PC) + 0x250);
        if (!Pawn || !IsReadablePointer(Pawn, 0x60) || !IsRegisteredLiveObject(Pawn)) continue;

        std::string Detail;   // [2026-10-11 O3] built only when the settings changed (the only case that logs)
        const int Result = RepGraphApplyGlobalSettings(
            RepGraphFindGlobalActorInfo(Graph, Pawn), false,
            kRepGraphPlayerChannelGraceFrames, &Detail, true);
        if (Result == 1) {
            MpLog("[PawnChannelGrace] source=tick pawn=" + MpPtr(Pawn)
                + " conn=" + MpPtr(Connection) + " result=" + std::to_string(Result) + Detail);
        }
    }

    // 3) Read-only Artificer diagnostics. The cooked Blueprint gate is confirmed; this correlates
    // the authoritative drone with its per-connection replication state without changing it.
    TickFrankDroneDiagnostics(Graph);
}

static void TickPlayerRolePostActivationRefresh() {    if (!Globals::AmServer || !OrigProcessEvent
        || MpExeRelativeFlagPresent(L"DISABLE_PLAYER_ROLE_OWNER_ROUTE.flag")) return;

    // [2026-10-11 1.14.7 O1/O2] One role pass for the whole once-a-second tick: the purge, the churn log, the relevance
    // re-assert, the connection-edge re-route and the post-activation loop all answer "is this connection current / is
    // this role alive" from one snapshot (see MpRolePass).
    MpRolePassScope Pass;
    PurgeDisconnectedPlayerRoleCaches();
    TickPlayerRoleChannelChurn();
    TickRepGraphRelevanceSettings();

    // [2026-07-25 T-POSE] Roles are routed when ApplyPlayerRole runs, which for an already-equipped
    // player happened before a later joiner's connection existed - that joiner would then never
    // receive the earlier players' role actors and would see them in reference pose for the whole
    // hunt. Edge-trigger off the connection count and re-run the all-connections route for every
    // role we know about, so joining order stops mattering. Cheap: only fires when Num changes,
    // and the actor+node dedup turns the already-routed pairs into refreshes.
    if (!MpExeRelativeFlagPresent(L"DISABLE_PLAYER_ROLE_REMOTE_ROUTE.flag")
        && Networking::NetDriver && MpReadableThisFrame(Networking::NetDriver, 0xA0)) {
        const RawPointerArray* Connections = reinterpret_cast<const RawPointerArray*>(
            reinterpret_cast<uintptr_t>(Networking::NetDriver) + 0x90);
        if (MpReadableThisFrame(Connections, sizeof(RawPointerArray))
            && IsSanePointerArray(Connections->Data, Connections->Num, Connections->Max, 1024)) {
            static int32_t s_lastRoutedConnCount = -1;
            if (Connections->Num != s_lastRoutedConnCount) {
                MpLog("[PlayerRoleGraphRoute] connection count "
                    + std::to_string(s_lastRoutedConnCount) + " -> "
                    + std::to_string(Connections->Num) + " - re-routing known roles to all");
                s_lastRoutedConnCount = Connections->Num;
                // Snapshot the distinct actors first: RoutePlayerRoleToAllConnections writes new
                // entries into s_playerRoleGraphRoutes, so iterating it live would be unsound.
                // [2026-10-11 O1] Up to the route capacity (was 64 distinct roles).
                static void* s_edgeActors[kPlayerRoleRouteCapacity];
                int ActorCount = 0;
                for (const PlayerRoleGraphRoute& Entry : MpActivePlayerRoleRoutes()) {
                    if (!Entry.Actor) continue;
                    bool Seen = false;
                    for (int i = 0; i < ActorCount; ++i) if (s_edgeActors[i] == Entry.Actor) { Seen = true; break; }
                    if (!Seen && ActorCount < kPlayerRoleRouteCapacity) s_edgeActors[ActorCount++] = Entry.Actor;
                }
                for (int i = 0; i < ActorCount; ++i) {
                    if (MpRolePassActorSafe(s_edgeActors[i])) {
                        RoutePlayerRoleToAllConnections(s_edgeActors[i]);
                    } else {
                        PurgePlayerRoleLifetimeCaches(s_edgeActors[i], "connection-edge-invalid-actor");
                    }
                }
            }
        }
    }

    const uint64_t Now = GetTickCount64();
    for (PlayerRoleGraphRoute& Entry : MpActivePlayerRoleRoutes()) {
        if (!Entry.Actor) continue;
        if (!MpRolePassActorSafe(Entry.Actor)
            || !IsCurrentNetDriverClientConnection(Entry.Connection)
            || !MpReadableThisFrame(Entry.Node, 0x20)) {
            Entry = PlayerRoleGraphRoute{};
            continue;
        }

        const uintptr_t Role = reinterpret_cast<uintptr_t>(Entry.Actor);
        const int Equipped = SafeReadU8At(Role, 0x2F4);
        const int GameplayEquipped = SafeReadU8At(Role, 0x2F5);
        const int ActiveGameplay = SafeReadU8At(Role, 0x2F6);
        const int BpEquipCalled = SafeReadU8At(Role, 0x2F7);
        const bool FullyActive = Equipped == 1 && GameplayEquipped == 1
            && ActiveGameplay == 1 && BpEquipCalled == 1;

        if (!FullyActive) {
            // Re-arm if the same role actor is unequipped and later enters another gameplay cycle.
            Entry.ActiveSeenMs = 0;
            Entry.LastRefreshMs = 0;
            Entry.RefreshAttempts = 0;
            Entry.WasFullyActive = false;
            Entry.PostActiveRefreshComplete = false;
            continue;
        }

        if (!Entry.WasFullyActive) {
            Entry.WasFullyActive = true;
            Entry.ActiveSeenMs = Now;
            MpLog("[PlayerRolePostActiveRefresh] WAIT role=" + MpPtr(Entry.Actor)
                + " itemId=" + CoreCapFString(reinterpret_cast<void*>(Role + 0x240))
                + " conn=" + MpPtr(Entry.Connection)
                + " settleMs=" + std::to_string(kPlayerRolePostActiveSettleMs)
                + " charge={" + PlayerRoleChargeSummary(Entry.Actor) + "}");
            continue;
        }
        if (Entry.PostActiveRefreshComplete
            || Now - Entry.ActiveSeenMs < kPlayerRolePostActiveSettleMs
            || (Entry.LastRefreshMs != 0 && Now - Entry.LastRefreshMs < kPlayerRolePostActiveRetryMs)) {
            continue;
        }

        if (Entry.RefreshAttempts >= kPlayerRolePostActiveMaxAttempts) {
            Entry.PostActiveRefreshComplete = true;
            MpLog("[PlayerRolePostActiveRefresh] EXHAUSTED role=" + MpPtr(Entry.Actor)
                + " itemId=" + CoreCapFString(reinterpret_cast<void*>(Role + 0x240))
                + " attempts=" + std::to_string(Entry.RefreshAttempts)
                + " blockedDeferrals=" + std::to_string(Entry.BlockedDeferrals)
                + " charge={" + PlayerRoleChargeSummary(Entry.Actor) + "}");
            continue;
        }

        UObject* RoleObject = reinterpret_cast<UObject*>(Entry.Actor);
        static UFunction* s_FlushNetDormancyFn = nullptr;
        static UFunction* s_ForceNetUpdateFn = nullptr;
        if (RoleObject->Class) {
            if (!s_FlushNetDormancyFn) {
                s_FlushNetDormancyFn = RoleObject->Class->GetFunction("Actor", "FlushNetDormancy");
            }
            if (!s_ForceNetUpdateFn) {
                s_ForceNetUpdateFn = RoleObject->Class->GetFunction("Actor", "ForceNetUpdate");
            }
        }

        const int DormancyBefore = SafeReadU8At(Role, 0xF1);
        // [2026-07-25 VERIFIED IN GHIDRA] AActor::FlushNetDormancy (execFlushNetDormancy
        // 0x1440be810 -> 0x143953bf0) wraps its entire body in `GetNetMode() != NM_Client &&
        // NetDormancy > DORM_Awake && !PendingKill`. NetDormancy lives at Actor+0xF1 - the same byte
        // read above - and these role actors report 1 (DORM_Awake). `1 < 1` is false, so the flush
        // returns having done nothing at all: no UNetDriver::FlushActorDormancy, no graph-side flush.
        // The old log said flush=1 meaning only "the UFunction was dispatched", which read as though
        // a flush had happened. Report whether it could actually have had an effect.
        const bool FlushCanTakeEffect = DormancyBefore > 1;
        const bool FlushDispatched = s_FlushNetDormancyFn != nullptr;
        const bool ForceDispatched = s_ForceNetUpdateFn != nullptr;
        if (s_FlushNetDormancyFn) {
            reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEvent)(
                RoleObject, s_FlushNetDormancyFn, nullptr);
        }
        if (s_ForceNetUpdateFn) {
            reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEvent)(
                RoleObject, s_ForceNetUpdateFn, nullptr);
        }

        Entry.LastRefreshMs = Now;
        Networking::ActorChannelPushDiag PushDiag{};
        const int BootstrapResult = Networking::BootstrapActorChannel(
            reinterpret_cast<AActor*>(Entry.Actor),
            reinterpret_cast<UNetConnection*>(Entry.Connection), &PushDiag);
        const bool WroteData = BootstrapResult == 2 || BootstrapResult == 3;
        if (WroteData) Entry.PostActiveRefreshComplete = true;

        // Only charge a real attempt when ReplicateActor actually got as far as looking at the
        // actor's properties. A prologue rejection (pending dormancy / re-entrant replication) means
        // we never tried, so retrying later is the correct response rather than giving up.
        const bool Deferred = !WroteData && PushDiag.Blocked()
            && Entry.BlockedDeferrals < kPlayerRolePostActiveMaxBlockedDeferrals;
        if (Deferred) {
            ++Entry.BlockedDeferrals;
        } else if (!WroteData) {
            ++Entry.RefreshAttempts;
        }

        MpLog("[PlayerRolePostActiveRefresh] PUSH attempt=" + std::to_string(Entry.RefreshAttempts)
            + " role=" + MpPtr(Entry.Actor)
            + " itemId=" + CoreCapFString(reinterpret_cast<void*>(Role + 0x240))
            + " conn=" + MpPtr(Entry.Connection)
            + " activeForMs=" + std::to_string(Now - Entry.ActiveSeenMs)
            + " dormancy=" + std::to_string(DormancyBefore)
            + " flush=" + std::to_string(FlushDispatched ? 1 : 0)
            + " flushCanTakeEffect=" + std::to_string(FlushCanTakeEffect ? 1 : 0)
            + " force=" + std::to_string(ForceDispatched ? 1 : 0)
            + " bootstrap=" + std::to_string(BootstrapResult)
            + " wroteData=" + std::to_string(WroteData ? 1 : 0)
            + " gateRead=" + std::to_string(PushDiag.Valid ? 1 : 0)
            + " pendingDormancy=" + std::to_string(PushDiag.PendingDormancy ? 1 : 0)
            + " reentrant=" + std::to_string(PushDiag.ReplicatingReentrant ? 1 : 0)
            + " resendAllData=" + std::to_string(PushDiag.ResendAllDataState)
            + " deferred=" + std::to_string(Deferred ? 1 : 0)
            + " blockedDeferrals=" + std::to_string(Entry.BlockedDeferrals)
            + " complete=" + std::to_string(Entry.PostActiveRefreshComplete ? 1 : 0)
            + " charge={" + PlayerRoleChargeSummary(Entry.Actor) + "}");
    }
}

// [2026-07-22 OMNICELL repro 12] Tempest gameplay-modifier verification and bounded repair.
//
// The Tempest catalog row contains BOTH parts needed for the real mechanic:
//   GameplayModifiersToAddWhileGameplayActive.BuffClasses[0]
//       = windfury_pdodge_atkspeed_buff_C (binds OnPerfectDodge and grants Buffs.WindFuryStacks)
//   GameplayModifiersToAddWhileGameplayActive.GameplayAbilityClasses[0]
//       = tempest_player_role_ab_C (consumes one stack on tap-V activation)
//
// Repro 12 proved the authoritative PR_TEMPEST actor reaches bIsEquippedForGameplay=1,
// bIsActiveGameplay=1 and bCalledBPHandleEquipForGameplay=1. It did not prove that the async soft-class
// applications started by that transition actually populated AppliedGameplayModifiersWhileActive. A
// missing passive listener exactly explains the remaining UI: blue/full outer charge ring, dim center,
// native CanActivateAbility=false forever because Buffs.WindFuryStacks can never be granted.
//
// This check is intentionally conservative:
//   * server/game-thread only;
//   * PR_TEMPEST only;
//   * waits three seconds after the role FIRST becomes fully gameplay-active;
//   * never touches lifecycle bits, charge, tags, or stack counts;
//   * treats either APPLIED or PENDING modifiers as owned by the native path and does nothing;
//   * re-dispatches the game's reflected ApplyGameplay*ToOwner methods only when the catalog expects a
//     class while BOTH its applied and pending arrays are empty; at most three bounded attempts.
//
// Thus a healthy role is diagnostics-only, while a dropped async-application edge is repaired through
// the exact native API with the exact catalog-provided soft-class arrays (no hardcoded asset load).
struct TempestModifierEnsureEntry {
    void* PlayerRole = nullptr;
    uint64_t ActiveSeenMs = 0;
    uint64_t LastRepairMs = 0;
    uint64_t LastStateLogMs = 0;
    int RepairAttempts = 0;
    bool InUse = false;
};
// [2026-10-11 1.14.7 O1] 16 -> 64 (one PR_TEMPEST role per player on a 64-player hub); a full table now logs once
// instead of on every refused role.
static TempestModifierEnsureEntry s_tempestModifierEnsure[64]{};
static constexpr uint64_t kTempestModifierSettleMs = 3000;
static constexpr uint64_t kTempestModifierRetryMs = 3500;
static constexpr int kTempestModifierMaxAttempts = 3;

static void NoteTempestModifierRole(void* PlayerRole) {
    if (!Globals::AmServer || !IsActorSafeForReplicationLifecycle(PlayerRole)
        || !IsReadablePointer(PlayerRole, 0x300)) return;
    const std::string ItemId = CoreCapFString(
        reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(PlayerRole) + 0x240));
    if (ItemId != "PR_TEMPEST") return;

    int FreeSlot = -1;
    for (int i = 0; i < static_cast<int>(std::size(s_tempestModifierEnsure)); ++i) {
        TempestModifierEnsureEntry& Entry = s_tempestModifierEnsure[i];
        if (Entry.InUse && Entry.PlayerRole == PlayerRole) return;
        if (!Entry.InUse && FreeSlot < 0) FreeSlot = i;
    }
    if (FreeSlot < 0) {
        static bool s_fullLogged = false;
        if (!s_fullLogged) {
            s_fullLogged = true;
            MpLog("[TempestModifierEnsure] tracking table full (" + std::to_string(std::size(s_tempestModifierEnsure))
                + " roles); role=" + MpPtr(PlayerRole) + " is not watched (logged once)");
        }
        return;
    }
    s_tempestModifierEnsure[FreeSlot].PlayerRole = PlayerRole;
    s_tempestModifierEnsure[FreeSlot].InUse = true;
    MpLog("[TempestModifierEnsure] TRACK role=" + MpPtr(PlayerRole)
        + " state={" + PlayerRoleModifierSummary(PlayerRole) + "}");
}

struct TempestRawUeArray {
    void* Data;
    int32_t Num;
    int32_t Max;
};
static_assert(sizeof(TempestRawUeArray) == 0x10, "UE TArray layout drift");

static bool DispatchTempestModifierApply(void* PlayerRole, uintptr_t ArrayOffset,
                                         const char* FunctionName, const char* Kind) {
    if (!IsActorSafeForReplicationLifecycle(PlayerRole) || !OrigProcessEvent
        || !IsReadablePointer(PlayerRole, ArrayOffset + 0x10)) {
        MpLog(std::string("[TempestModifierEnsure] ") + Kind + " dispatch prerequisites missing role="
            + MpPtr(PlayerRole) + " origPE=" + MpPtr(OrigProcessEvent));
        return false;
    }

    const TempestRawUeArray Source = *reinterpret_cast<const TempestRawUeArray*>(
        reinterpret_cast<uintptr_t>(PlayerRole) + ArrayOffset);
    if (!Source.Data || Source.Num <= 0 || Source.Num > 256 || Source.Max < Source.Num
        || !IsReadablePointer(Source.Data, 1)) {
        MpLog(std::string("[TempestModifierEnsure] ") + Kind + " catalog array invalid data="
            + MpPtr(Source.Data) + " num=" + std::to_string(Source.Num)
            + " max=" + std::to_string(Source.Max));
        return false;
    }

    UObject* RoleObject = reinterpret_cast<UObject*>(PlayerRole);
    UFunction* ApplyFunction = RoleObject->Class
        ? RoleObject->Class->GetFunction("ArchonEquipment", FunctionName) : nullptr;
    if (!ApplyFunction) {
        MpLog(std::string("[TempestModifierEnsure] ") + Kind + " UFunction missing: " + FunctionName);
        return false;
    }

    // Reflected parms are exactly one 0x10 TArray. The game copies/queues the catalog soft classes;
    // the source array remains owned by the role and is not modified here.
    TempestRawUeArray Params = Source;
    reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEvent)(
        RoleObject, ApplyFunction, &Params);
    return true;
}

static void TickTempestModifierEnsure() {
    if (!Globals::AmServer) return;
    const uint64_t Now = GetTickCount64();

    for (TempestModifierEnsureEntry& Entry : s_tempestModifierEnsure) {
        if (!Entry.InUse) continue;
        void* PlayerRole = Entry.PlayerRole;
        if (!IsActorSafeForReplicationLifecycle(PlayerRole)
            || !IsReadablePointer(PlayerRole, 0x300)) {
            Entry = TempestModifierEnsureEntry{};
            continue;
        }
        const std::string ItemId = CoreCapFString(
            reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(PlayerRole) + 0x240));
        if (ItemId != "PR_TEMPEST") {
            Entry = TempestModifierEnsureEntry{};
            continue;
        }

        const int Equipped = SafeReadU8At(reinterpret_cast<uintptr_t>(PlayerRole), 0x2F4);
        const int GameplayEquipped = SafeReadU8At(reinterpret_cast<uintptr_t>(PlayerRole), 0x2F5);
        const int ActiveGameplay = SafeReadU8At(reinterpret_cast<uintptr_t>(PlayerRole), 0x2F6);
        const int BpEquipCalled = SafeReadU8At(reinterpret_cast<uintptr_t>(PlayerRole), 0x2F7);
        if (Equipped != 1 || GameplayEquipped != 1 || ActiveGameplay != 1 || BpEquipCalled != 1) {
            Entry.ActiveSeenMs = 0;
            continue;
        }

        if (Entry.ActiveSeenMs == 0) {
            Entry.ActiveSeenMs = Now;
            Entry.LastStateLogMs = Now;
            MpLog("[TempestModifierEnsure] ACTIVE_WAIT role=" + MpPtr(PlayerRole)
                + " settleMs=" + std::to_string(kTempestModifierSettleMs)
                + " state={" + PlayerRoleModifierSummary(PlayerRole) + "}");
            continue;
        }
        if (Now - Entry.ActiveSeenMs < kTempestModifierSettleMs) continue;

        const PlayerRoleModifierSnapshot Before = CapturePlayerRoleModifiers(PlayerRole);
        if (!Before.Valid) {
            if (Now - Entry.LastStateLogMs >= 10000) {
                Entry.LastStateLogMs = Now;
                MpLog("[TempestModifierEnsure] INVALID_SNAPSHOT role=" + MpPtr(PlayerRole));
            }
            continue;
        }

        const int AppliedBuffs = Before.Group ? Before.AppliedBuffs : 0;
        const int AppliedAbilities = Before.Group ? Before.AppliedAbilities : 0;
        const int PendingBuffs = Before.Group ? Before.PendingBuffs : 0;
        const int PendingAbilities = Before.Group ? Before.PendingAbilities : 0;

        // [2026-07-25 GUARD ORDER FIX] HEALTHY is now evaluated before CATALOG_EMPTY. The escalation
        // logs showed this loop emitting `CATALOG_EMPTY ... desired[b=0,e=0,a=0] applied[b=1,e=0,a=1]`
        // every 10s for the whole hunt: the role already had both native modifiers applied - the exact
        // state this function's own HEALTHY branch accepts - but the desired-catalog read returned 0,
        // so the CATALOG_EMPTY `continue` fired first and the HEALTHY branch below was unreachable.
        // Because only HEALTHY resets Entry, the watcher never settled and the Tempest safety net was
        // permanently short-circuited for precisely the roles it exists to protect. Applied modifiers
        // are the authoritative outcome, so check them first.
        if (AppliedBuffs > 0 && AppliedAbilities > 0) {
            MpLog("[TempestModifierEnsure] HEALTHY role=" + MpPtr(PlayerRole)
                + " native catalog modifiers already applied; state={"
                + PlayerRoleModifierSummary(PlayerRole) + "}");
            Entry = TempestModifierEnsureEntry{};
            continue;
        }

        // Tempest's extracted catalog row has one buff + one ability. Zero means catalog/default
        // propagation is missing, not something that can be safely repaired by guessing a class path.
        if (Before.DesiredBuffs <= 0 || Before.DesiredAbilities <= 0) {
            if (Now - Entry.LastStateLogMs >= 10000) {
                Entry.LastStateLogMs = Now;
                MpLog("[TempestModifierEnsure] CATALOG_EMPTY role=" + MpPtr(PlayerRole)
                    + " state={" + PlayerRoleModifierSummary(PlayerRole) + "}");
            }
            continue;
        }

        if (PendingBuffs > 0 || PendingAbilities > 0) {
            if (Now - Entry.LastStateLogMs >= 10000) {
                Entry.LastStateLogMs = Now;
                MpLog("[TempestModifierEnsure] NATIVE_PENDING role=" + MpPtr(PlayerRole)
                    + " elapsedActiveMs=" + std::to_string(Now - Entry.ActiveSeenMs)
                    + " state={" + PlayerRoleModifierSummary(PlayerRole) + "}");
            }
            continue;
        }

        const bool NeedBuffs = AppliedBuffs <= 0;
        const bool NeedAbilities = AppliedAbilities <= 0;
        if ((!NeedBuffs && !NeedAbilities)
            || (Entry.LastRepairMs != 0 && Now - Entry.LastRepairMs < kTempestModifierRetryMs)) continue;
        if (Entry.RepairAttempts >= kTempestModifierMaxAttempts) {
            MpLog("[TempestModifierEnsure] EXHAUSTED role=" + MpPtr(PlayerRole)
                + " attempts=" + std::to_string(Entry.RepairAttempts)
                + " state={" + PlayerRoleModifierSummary(PlayerRole) + "}");
            Entry = TempestModifierEnsureEntry{};
            continue;
        }

        Entry.LastRepairMs = Now;
        ++Entry.RepairAttempts;
        const bool BuffDispatch = !NeedBuffs || DispatchTempestModifierApply(
            PlayerRole, 0x2A8, "ApplyGameplayBuffsToOwner", "buff");
        const bool AbilityDispatch = !NeedAbilities || DispatchTempestModifierApply(
            PlayerRole, 0x2C8, "ApplyGameplayAbilitiesToOwner", "ability");
        MpLog("[TempestModifierEnsure] REPAIR attempt=" + std::to_string(Entry.RepairAttempts)
            + " role=" + MpPtr(PlayerRole)
            + " requestedBuff=" + std::to_string(NeedBuffs ? 1 : 0)
            + " requestedAbility=" + std::to_string(NeedAbilities ? 1 : 0)
            + " dispatchBuff=" + std::to_string(BuffDispatch ? 1 : 0)
            + " dispatchAbility=" + std::to_string(AbilityDispatch ? 1 : 0)
            + " before={group=" + MpPtr(Before.Group)
            + " appliedBuffs=" + std::to_string(AppliedBuffs)
            + " appliedAbilities=" + std::to_string(AppliedAbilities) + "}"
            + " after={" + PlayerRoleModifierSummary(PlayerRole) + "}");
    }
}

// [2026-07-24 TEMPEST CHARGE/STACK DIAG] Intermittent "unlimited Tempest until the perfect-dodge buff
// timer expires" report (random-time; not every hunt). Buffs.WindFuryStacks tag counts can't be read
// statically (GAS data), but the game's OWN authoritative eligibility query already encodes the answer:
// AArchonPlayerRole::CanActivateAbility (RVA 0x01B8D8A0) returns true only when the charge attribute is
// full AND (via the Tempest CanActivateAbilityBP override) at least one Buffs.WindFuryStacks is present.
// GetCurrentAbilityCharge (0x01B983E0) drops on each tap-V, so a charge DECREASE marks an activation.
// Read the log like this - focus on samples where charge is FULL (the charge gate is satisfied, so
// CanActivate then reflects WindFuryStacks presence alone):
//   * WORKING   -> after an activation, once charge refills to full, CanActivate is 0 (stack consumed)
//                  until a new perfect dodge regrants it (0->1);
//   * UNLIMITED -> charge-full CanActivate stays pinned at 1 across multiple activations with no dodge
//                  between, for the whole windfury buff window - the smoking gun (stack not consumed).
// Server-side only (authoritative activation gate), fully read-only, gated by TEMPEST_CHARGE_DIAG.flag.
struct TempestChargeDiagEntry {
    void* PlayerRole = nullptr;
    bool InUse = false;
    int LastCanActivate = -99;
    int LastChargeMilli = INT32_MIN;   // last sampled current-charge * 1000
    uint64_t LastHeartbeatMs = 0;
};
// [2026-10-11 1.14.7 O1] 16 -> 64. Diagnostic only (TEMPEST_CHARGE_DIAG.flag); a full table logs once.
static TempestChargeDiagEntry s_tempestChargeDiag[64]{};

static void PurgePlayerRoleLifetimeCaches(void* PlayerRole, const char* Reason) {
    if (!PlayerRole) return;

    int RouteCount = 0;
    int ChannelCount = 0;
    int FrankCount = 0;
    int ModifierCount = 0;
    int ChargeCount = 0;

    for (PlayerRoleGraphRoute& Entry : MpActivePlayerRoleRoutes()) {   // [2026-10-11 O1] used prefix
        if (Entry.Actor == PlayerRole) {
            Entry = PlayerRoleGraphRoute{};
            ++RouteCount;
        }
    }
    for (PlayerRoleChannelState& Entry : s_playerRoleChannelStates) {
        if (Entry.Actor == PlayerRole) {
            Entry = PlayerRoleChannelState{};
            ++ChannelCount;
        }
    }
    for (FrankDroneServerState& Entry : s_frankDroneServerStates) {
        if (Entry.Role == PlayerRole) {
            Entry = FrankDroneServerState{};
            ++FrankCount;
        }
    }
    for (TempestModifierEnsureEntry& Entry : s_tempestModifierEnsure) {
        if (Entry.InUse && Entry.PlayerRole == PlayerRole) {
            Entry = TempestModifierEnsureEntry{};
            ++ModifierCount;
        }
    }
    for (TempestChargeDiagEntry& Entry : s_tempestChargeDiag) {
        if (Entry.InUse && Entry.PlayerRole == PlayerRole) {
            Entry = TempestChargeDiagEntry{};
            ++ChargeCount;
        }
    }

    if (RouteCount || ChannelCount || FrankCount || ModifierCount || ChargeCount) {
        MpLog("[PlayerRoleLifetimePurge] role=" + MpPtr(PlayerRole)
            + " reason=" + std::string(Reason ? Reason : "unknown")
            + " routes=" + std::to_string(RouteCount)
            + " channelStates=" + std::to_string(ChannelCount)
            + " frankStates=" + std::to_string(FrankCount)
            + " tempestModifier=" + std::to_string(ModifierCount)
            + " tempestCharge=" + std::to_string(ChargeCount));
    }
}

static void PurgeDisconnectedPlayerRoleCaches() {
    for (PlayerRoleGraphRoute& Route : MpActivePlayerRoleRoutes()) {   // [2026-10-11 O1] used prefix, pass checks
        if (!Route.Actor) continue;

        if (!MpRolePassActorSafe(Route.Actor)) {
            void* Actor = Route.Actor;
            PurgePlayerRoleLifetimeCaches(Actor, "tick-invalid-actor");
            continue;
        }
        if (IsCurrentNetDriverClientConnection(Route.Connection)) continue;

        void* Actor = Route.Actor;
        void* Connection = Route.Connection;
        Route = PlayerRoleGraphRoute{};

        int ChannelCount = 0;
        int FrankCount = 0;
        for (PlayerRoleChannelState& Entry : s_playerRoleChannelStates) {
            if (Entry.Actor == Actor && Entry.Connection == Connection) {
                Entry = PlayerRoleChannelState{};
                ++ChannelCount;
            }
        }
        for (FrankDroneServerState& Entry : s_frankDroneServerStates) {
            if (Entry.Role == Actor && Entry.Connection == Connection) {
                Entry = FrankDroneServerState{};
                ++FrankCount;
            }
        }

        MpLog("[PlayerRoleLifetimePurge] role=" + MpPtr(Actor)
            + " conn=" + MpPtr(Connection)
            + " reason=disconnected-connection routes=1"
            + " channelStates=" + std::to_string(ChannelCount)
            + " frankStates=" + std::to_string(FrankCount));
    }
}

static void NoteTempestChargeDiagRole(void* PlayerRole) {
    if (!Globals::AmServer || !IsActorSafeForReplicationLifecycle(PlayerRole)
        || !MpExeRelativeFlagPresent(L"TEMPEST_CHARGE_DIAG.flag")) return;
    for (const TempestChargeDiagEntry& E : s_tempestChargeDiag) {
        if (E.InUse && E.PlayerRole == PlayerRole) return;
    }
    for (TempestChargeDiagEntry& E : s_tempestChargeDiag) {
        if (!E.InUse) {
            E = TempestChargeDiagEntry{};
            E.PlayerRole = PlayerRole;
            E.InUse = true;
            MpLog("[TempestChargeDiag] TRACK role=" + MpPtr(PlayerRole)
                + " state={" + PlayerRoleChargeSummary(PlayerRole) + "}");
            return;
        }
    }
    static bool s_fullLogged = false;   // [2026-10-11 O1]
    if (!s_fullLogged) {
        s_fullLogged = true;
        MpLog("[TempestChargeDiag] tracking table full (" + std::to_string(std::size(s_tempestChargeDiag))
            + " roles); role=" + MpPtr(PlayerRole) + " is not traced (logged once)");
    }
}

static void TickTempestChargeDiag() {
    if (!Globals::AmServer || !MpExeRelativeFlagPresent(L"TEMPEST_CHARGE_DIAG.flag")) return;
    const uint64_t Now = GetTickCount64();
    for (TempestChargeDiagEntry& E : s_tempestChargeDiag) {
        if (!E.InUse) continue;
        void* Role = E.PlayerRole;
        if (!IsActorSafeForReplicationLifecycle(Role) || !IsReadablePointer(Role, 0x360)) {
            E = TempestChargeDiagEntry{}; continue;
        }
        const std::string ItemId = CoreCapFString(
            reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Role) + 0x240));
        if (ItemId != "PR_TEMPEST") { E = TempestChargeDiagEntry{}; continue; }

        const float Current = SafeCallPlayerRoleFloat(Role, 0x01B983E0);    // GetCurrentAbilityCharge
        const float MaxCharge = SafeCallPlayerRoleFloat(Role, 0x01B99F30);  // GetMaxAbilityCharge
        const int CanActivate = SafeCallPlayerRoleBoolRva(Role, 0x01B8D8A0); // CanActivateAbility
        if (Current <= -9990.0f) continue;   // native call faulted; skip this sample
        const int CurMilli = static_cast<int>(Current * 1000.0f);

        const bool Activation = (E.LastChargeMilli != INT32_MIN)
            && (CurMilli < E.LastChargeMilli - 400);        // charge dropped >=0.4 => a tap-V fired
        const bool CanFlip = (E.LastCanActivate != -99) && (CanActivate != E.LastCanActivate);
        const bool Heartbeat = (Now - E.LastHeartbeatMs) >= 5000;

        if (Activation || CanFlip || Heartbeat) {
            const char* Evt = Activation ? "ACTIVATION" : (CanFlip ? "CANACT_FLIP" : "heartbeat");
            const bool ChargeFull = MaxCharge > 0.0f && Current >= MaxCharge - 0.05f;
            const char* StacksHint = (!ChargeFull) ? "unknown(charge<max)"
                : (CanActivate == 1 ? "PRESENT(>=1)" : "ABSENT(0)");
            MpLog(std::string("[TempestChargeDiag] role=") + MpPtr(Role)
                + " event=" + Evt
                + " charge=" + std::to_string(Current) + "/" + std::to_string(MaxCharge)
                + " canActivate=" + std::to_string(CanActivate)
                + " (was " + std::to_string(E.LastCanActivate) + ")"
                + " windFuryStacks=" + StacksHint);
            if (Heartbeat) E.LastHeartbeatMs = Now;
        }
        E.LastChargeMilli = CurMilli;
        if (CanActivate >= 0) E.LastCanActivate = CanActivate;
    }
}

// [2026-07-21] Timeout-retry for the ApplyPlayerRole HUD gap (Omnicell/PlayerRole equipped but
// absent from the HUD and unusable). Root cause: ApplyPlayerRole (FUN_141a4b790) unconditionally
// ends by calling AArchonCharacter::SetPlayerRole(PlayerRoleClass, PlayerRoleId) on the pawn - when
// PlayerRole/Slot are still null (inventory-instance replication race, same class as Plans/A1.md),
// it calls SetPlayerRole(nullptr, "") instead of skipping, which is what clears the ability from
// the HUD. The engine's OWN rep-notify handler (FUN_141a71b20) re-runs ApplyPlayerRole once the
// data actually replicates in and self-heals this - but a real repro showed that path taking
// 20-40+ seconds, well after possession-time HUD setup already ran with null data. This proactively
// re-invokes the exact same real function on a bounded ~1.5s interval instead of passively waiting.
struct PendingPlayerRoleRetry {
    void* LoadoutPtr = nullptr;
    uint64_t FirstSeenInvalidMs = 0;
    uint64_t LastRetryMs = 0;
    uint64_t LastWaitLogMs = 0;
    int RetryCount = 0;
    bool InUse = false;
};
constexpr int kMaxPendingPlayerRoleRetries = 8;          // generous for both hub and hunt server sizes
constexpr uint64_t kPlayerRoleRetryIntervalMs = 1500;
constexpr int kMaxPlayerRoleRetryAttempts = 20;           // ~30s ceiling - matches the slowest natural resolution observed
constexpr uint64_t kPlayerRoleRetryWindowMs =
    kPlayerRoleRetryIntervalMs * kMaxPlayerRoleRetryAttempts;
constexpr uint64_t kPlayerRoleWaitLogIntervalMs = 5000;
static PendingPlayerRoleRetry s_pendingPlayerRoleRetries[kMaxPendingPlayerRoleRetries];

static void ResetClientPlayerRoleRetryStateForTravel() {
    if (Globals::AmServer) return;
    for (PendingPlayerRoleRetry& Entry : s_pendingPlayerRoleRetries) {
        Entry = PendingPlayerRoleRetry{};
    }
}

// Same getters ApplyPlayerRole (FUN_141a4b790) uses internally to compute PlayerRole + Slot:
// Inter = FUN_01A52080(this), Role = FUN_01A95C60(Inter), Slot = FUN_0173F670(Inter). Read-only.
static void GetPlayerRoleAndSlot(void* LoadoutPtr, void** OutRole, void** OutSlot) {
    *OutRole = nullptr; *OutSlot = nullptr;
    if (!LoadoutPtr || !IsReadablePointer(LoadoutPtr, 0x40)) return;
    // [1.14.7 VERIFIED GETTERS 2026-10-05] These three addresses are CORRECT for 1.14.7 and were never
    // the problem. They were briefly swapped for 0x01A52080 / 0x01A95C60 / 0x0173F670 on the strength of a
    // stale comment elsewhere in this file; in the 1.14.7 executable those land inside unrelated functions,
    // one of them inside an instruction. Ghidra confirms the getters actually called by 1.14.7
    // ApplyPlayerRole are the three below:
    //     0x01B99FB0  active loadout slot data (intermediate)
    //     0x01BE1EE0  PlayerRole inventory item
    //     0x01861E40  PlayerRole slot
    // Do NOT "fix" a null role by changing these. A null PlayerRole is legitimate when no omnicell is
    // equipped - the starter loadout seeds player_role: null deliberately, the 1.12 repro record shows a
    // playable player with the same null role, and 1.14.7's getter supports returning null. See the
    // optional-equipment note on TickPlayerRoleRetries.
    void* Inter = reinterpret_cast<void*(*)(void*)>(Globals::BaseAddress + 0x01B99FB0)(LoadoutPtr);
    if (!Inter || !IsReadablePointer(Inter, 0x40)) return;
    *OutRole = reinterpret_cast<void*(*)(void*)>(Globals::BaseAddress + 0x01BE1EE0)(Inter);
    *OutSlot = reinterpret_cast<void*(*)(void*)>(Globals::BaseAddress + 0x01861E40)(Inter);
}

// A valid inventory item + slot is only the INPUT to ApplyPlayerRole. Success means the active
// controller has a pawn and that pawn owns the matching AArchonPlayerRole equipment object.
// This distinction matters on the client: the loadout/menu can already display PR_TEMPEST while
// an early apply ran before ClientRestart and therefore left the local pawn/HUD empty.
static bool IsPlayerRoleAppliedToPawn(void* LoadoutPtr, void** OutRole = nullptr, void** OutSlot = nullptr,
                                     void** OutPawn = nullptr, void** OutPawnRole = nullptr) {
    void* Role = nullptr; void* Slot = nullptr;
    GetPlayerRoleAndSlot(LoadoutPtr, &Role, &Slot);

    void* PC = (LoadoutPtr && IsReadablePointer(LoadoutPtr, 0x638))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(LoadoutPtr) + 0x630) : nullptr;
    void* Pawn = (PC && IsReadablePointer(PC, 0x258))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(PC) + 0x250) : nullptr;
    void* PawnRole = (Pawn && IsReadablePointer(Pawn, 0x740))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Pawn) + 0x738) : nullptr;

    if (OutRole) *OutRole = Role;
    if (OutSlot) *OutSlot = Slot;
    if (OutPawn) *OutPawn = Pawn;
    if (OutPawnRole) *OutPawnRole = PawnRole;

    if (!Role || !Slot || !Pawn || !PawnRole) return false;
    const std::string InputId = CoreCapFString(
        reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Role) + 0x70));
    const std::string PawnId = CoreCapFString(
        reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(PawnRole) + 0x240));
    return !InputId.empty() && InputId == PawnId;
}

// Called from ApplyPlayerRoleHook on every real call: register a loadout pointer until the matching
// role is actually installed on its pawn. Fixed-size best-effort table; if full, the native
// rep-notify remains a fallback.
static void NotePlayerRoleValidity(void* LoadoutPtr, bool AppliedToPawn) {
    int FreeSlot = -1;
    for (int i = 0; i < kMaxPendingPlayerRoleRetries; ++i) {
        if (s_pendingPlayerRoleRetries[i].InUse && s_pendingPlayerRoleRetries[i].LoadoutPtr == LoadoutPtr) {
            if (AppliedToPawn) s_pendingPlayerRoleRetries[i] = PendingPlayerRoleRetry{};
            return;
        }
        if (FreeSlot < 0 && !s_pendingPlayerRoleRetries[i].InUse) FreeSlot = i;
    }
    if (AppliedToPawn || FreeSlot < 0) return;
    const uint64_t RegisteredAtMs = GetTickCount64();
    PendingPlayerRoleRetry& Entry = s_pendingPlayerRoleRetries[FreeSlot];
    Entry = PendingPlayerRoleRetry{};
    Entry.LoadoutPtr = LoadoutPtr;
    Entry.FirstSeenInvalidMs = RegisteredAtMs;
    // Do not let the scheduler phase turn a newly registered entry into an immediate retry.
    Entry.LastRetryMs = RegisteredAtMs;
    Entry.InUse = true;
}

// [2026-07-24 CRASH FIX] A new player's client crashed (EXCEPTION_ACCESS_VIOLATION reading a
// plausible-looking, non-null address - the signature of following a stale pointer through
// repurposed memory, not a null/wild pointer) traveling Ramsgate -> Training Dojo while a
// PlayerRole retry was still pending for the OLD Ramsgate loadout. IsReadablePointer (the guard
// below) only proves the memory is currently MAPPED - it cannot prove Entry.LoadoutPtr is still
// the SAME live AArchonLoadout object. UE4's object pool reuses freed UObject memory quickly, so a
// "readable" pointer can silently point at a completely different, differently-shaped object by the
// time this runs. The crash log shows exactly this: the SAME retry-table pointer's resolved
// role/slot/pawn/pawnRole read as valid non-null on attempt 14, then all read null on attempt 15 -
// the level travel tore down the old pawn/loadout out from under a still-pending retry entry, and
// the very next native call is presumed to be what faulted.
// GetPlayerRoleAndSlot (inside IsPlayerRoleAppliedToPawn) and OrigApplyPlayerRole both call directly
// into real, native game code with Entry.LoadoutPtr as `this` - if that memory has been repurposed,
// either call can fault deep inside game code, past anything we range-check ourselves beforehand.
// Isolated here into an object-free wrapper (no std::string/RAII locals in this function's own
// frame - required for __try; matching SafeReadByte/SampleBleedoutGraceGuarded elsewhere in this
// file, which hit the identical C2712 "can't __try in a function needing object unwinding"
// constraint) so a fault is caught and the entry discarded, instead of taking the whole client down.
static bool TryApplyPlayerRoleRetryGuarded(
    void* LoadoutPtr, void** OutRole, void** OutSlot, void** OutPawn, void** OutPawnRole,
    bool* OutAppliedBefore, bool* OutAppliedAfter)
{
    __try {
        *OutAppliedBefore = IsPlayerRoleAppliedToPawn(LoadoutPtr, OutRole, OutSlot, OutPawn, OutPawnRole);
        if (!*OutAppliedBefore && OrigApplyPlayerRole) {
            reinterpret_cast<void(*)(void*)>(OrigApplyPlayerRole)(LoadoutPtr);
        }
        *OutAppliedAfter = IsPlayerRoleAppliedToPawn(LoadoutPtr);
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

// Probe the exact retry prerequisites without invoking ApplyPlayerRole. In particular, an
// AArchonLoadout can be live and have valid PlayerRole/Slot data before its PlayerController owns
// a pawn. Calling the native apply in that window executes SetPlayerRole against an incomplete
// possession chain and can prevent PlayerStart/ClientRestart from completing.
static bool TryProbePlayerRoleRetryGuarded(
    void* LoadoutPtr, void** OutRole, void** OutSlot, void** OutPawn, void** OutPawnRole,
    bool* OutApplied)
{
    __try {
        *OutApplied = IsPlayerRoleAppliedToPawn(
            LoadoutPtr, OutRole, OutSlot, OutPawn, OutPawnRole);
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

// Called from GameEngineTickHook on the server and ProcessEventClientHook on the client. Re-runs the
// real ApplyPlayerRole until the matching role exists on the pawn; it does not synthesize equipment
// or flip lifecycle bits.
static void TickPlayerRoleRetries() {
    uint64_t Now = GetTickCount64();
    for (int i = 0; i < kMaxPendingPlayerRoleRetries; ++i) {
        PendingPlayerRoleRetry& Entry = s_pendingPlayerRoleRetries[i];
        if (!Entry.InUse) continue;

        if (Now - Entry.FirstSeenInvalidMs >= kPlayerRoleRetryWindowMs) {
            MpLog("[ApplyPlayerRole][RetryTimeout] loadout=" + MpPtr(Entry.LoadoutPtr)
                + " expired after " + std::to_string(Now - Entry.FirstSeenInvalidMs)
                + "ms attempts=" + std::to_string(Entry.RetryCount)
                + " - discarding bounded retry entry");
            Entry = PendingPlayerRoleRetry{};
            continue;
        }
        if (!IsReadablePointer(Entry.LoadoutPtr, 0x40)
            || Entry.RetryCount >= kMaxPlayerRoleRetryAttempts) {
            Entry = PendingPlayerRoleRetry{};
            continue;
        }
        if (Now - Entry.LastRetryMs < kPlayerRoleRetryIntervalMs) continue;

        // [2026-07-24 ROOT-CAUSE FIX] THE fix for the "new player travels Ramsgate->Training and
        // crashes" report. A new player has no PlayerRole/Omnicell yet, so this entry never resolves
        // and stays armed for the full ~30s retry window (an established player's entry clears in a
        // second or two). If the player boards the airship to Training during that window, the old
        // Ramsgate loadout this entry cached is destroyed - but its raw pointer stays "readable"
        // (freed UObject memory is recycled, not unmapped), so IsReadablePointer above does NOT catch
        // it, and the native ApplyPlayerRole call below faults inside game code. Verify the loadout is
        // still a live registered object FIRST; if the travel destroyed it, discard the entry here
        // without ever entering native code, so the fault - and the follow-on crash the SEH catch
        // could not prevent - simply never happens.
        if (!IsRegisteredLiveObject(Entry.LoadoutPtr)) {
            MpLog("[ApplyPlayerRole][RetryTimeout] loadout=" + MpPtr(Entry.LoadoutPtr)
                + " no longer a live registered object (owning world torn down, e.g. Ramsgate->Training"
                " travel) - discarding retry entry WITHOUT calling native code");
            Entry = PendingPlayerRoleRetry{};
            continue;
        }

        void* RoleBefore = nullptr; void* SlotBefore = nullptr;
        void* PawnBefore = nullptr; void* PawnRoleBefore = nullptr;
        bool AppliedBefore = false;
        const bool ProbeSurvived = TryProbePlayerRoleRetryGuarded(
            Entry.LoadoutPtr, &RoleBefore, &SlotBefore, &PawnBefore, &PawnRoleBefore,
            &AppliedBefore);

        if (!ProbeSurvived) {
            MpLog("[ApplyPlayerRole][RetryTimeout] loadout=" + MpPtr(Entry.LoadoutPtr)
                + " FAULTED probing retry prerequisites (stale pointer, likely a level travel tore"
                " down the owning pawn/loadout) - caught, discarding retry entry");
            Entry = PendingPlayerRoleRetry{};
            continue;
        }

        if (AppliedBefore) {
            Entry = PendingPlayerRoleRetry{};
            continue;
        }

        // Both data inputs and the possession target must exist before retrying. PawnRole is
        // deliberately not required: creating/installing that object is the native apply's job.
        if (!RoleBefore || !SlotBefore || !PawnBefore) {
            if (Entry.LastWaitLogMs == 0
                || Now - Entry.LastWaitLogMs >= kPlayerRoleWaitLogIntervalMs) {
                Entry.LastWaitLogMs = Now;
                MpLog("[ApplyPlayerRole][RetryWait] loadout=" + MpPtr(Entry.LoadoutPtr)
                    + " elapsedMs=" + std::to_string(Now - Entry.FirstSeenInvalidMs)
                    + " role=" + MpPtr(RoleBefore) + " slot=" + MpPtr(SlotBefore)
                    + " pawn=" + MpPtr(PawnBefore) + " pawnRole=" + MpPtr(PawnRoleBefore)
                    + " - waiting for valid role+slot+pawn; native apply NOT called");
            }
            continue;
        }

        bool AppliedAfter = false;
        const bool ApplySurvived = TryApplyPlayerRoleRetryGuarded(
            Entry.LoadoutPtr, &RoleBefore, &SlotBefore, &PawnBefore, &PawnRoleBefore,
            &AppliedBefore, &AppliedAfter);
        if (!ApplySurvived) {
            MpLog("[ApplyPlayerRole][RetryTimeout] loadout=" + MpPtr(Entry.LoadoutPtr)
                + " FAULTED re-running native apply after prerequisite probe - caught, discarding"
                " retry entry instead of crashing");
            Entry = PendingPlayerRoleRetry{};
            continue;
        }
        if (AppliedBefore) {
            Entry = PendingPlayerRoleRetry{};
            continue;
        }

        Entry.LastRetryMs = Now;
        Entry.RetryCount++;
        MpLog("[ApplyPlayerRole][RetryTimeout] attempt=" + std::to_string(Entry.RetryCount)
            + " loadout=" + MpPtr(Entry.LoadoutPtr) + " elapsedMs=" + std::to_string(Now - Entry.FirstSeenInvalidMs)
            + " role=" + MpPtr(RoleBefore) + " slot=" + MpPtr(SlotBefore)
            + " pawn=" + MpPtr(PawnBefore) + " pawnRole=" + MpPtr(PawnRoleBefore)
            + " - re-running native apply");

        if (AppliedAfter) {
            MpLog("[ApplyPlayerRole][RetryTimeout] resolved after " + std::to_string(Entry.RetryCount)
                + " attempt(s), matching role is now installed on pawn loadout=" + MpPtr(Entry.LoadoutPtr));
            Entry = PendingPlayerRoleRetry{};
        }
    }
}

// [2026-07-16] ApplyPlayerRole (1.12 RVA 0x01A4B790, 1.14.7 0x01B92B90; found via the string xref
// "[ApplyPlayerRole] %s - null PlayerRole [%s] and/or Slot [%s]" -> FUN_141a4b790). This is
// where the late joiner's PlayerRole is null until P1 leaves. Trace entry/exit + the object so
// the exact call timing (first call vs the delayed second call after P1 leaves) correlates with
// the [NetConnEdge] / [Lifecycle] snapshots. Read-only passthrough; single arg (this).
#pragma intrinsic(_ReturnAddress)
void ApplyPlayerRoleHook(void* a1) {
    // Caller return address FIRST. MinHook detours preserve the caller's return address on the
    // stack (the patched prologue jmps here without pushing), so _ReturnAddress() is the call site
    // in the invoking function. Map to the 4 known ApplyPlayerRole callers; raw retRva logged too.
    uintptr_t Ret = reinterpret_cast<uintptr_t>(_ReturnAddress());
    uintptr_t RetRva = (Ret >= Globals::BaseAddress) ? (Ret - Globals::BaseAddress) : Ret;
    // [1.14.7 2026-10-08] These ranges were the 1.12 callers (0x01A664A0 / 0x01A4B6C0 / 0x01A4B720 / call
    // 0x01A729C3), so every 1.14.7 call was labelled "other". Remapped from the direct E8 callers of
    // ApplyPlayerRole 0x01B92B90 on 1.14.7, which pair 1:1 with the 1.12 callers of 0x01A4B790 (same
    // in-function offsets +0x39 / +0x49; caller4's call moved +0x702 -> +0x71B in its fragment).
    const char* Caller =
        (RetRva >= 0x01BAAF50 && RetRva < 0x01BAAFE2) ? "possession(0x01BAAF50)" :
        (RetRva >= 0x01B92AC0 && RetRva < 0x01B92B20) ? "apply-all(0x01B92AC0)" :
        (RetRva >= 0x01B92B20 && RetRva < 0x01B92B90) ? "repfield-case8(0x01B92B20)" :
        (RetRva >= 0x01BB91A8 && RetRva < 0x01BB9BA4) ? "caller4(~0x01BB98C3)" : "other";

    static std::atomic<int> s_aprSeq{ 0 };
    int Seq = s_aprSeq.fetch_add(1, std::memory_order_relaxed);

    // Replicate the exact getters ApplyPlayerRole (FUN_141a4b790) uses to compute PlayerRole + Slot,
    // so we log their validity for EVERY call (the native log only prints when one is null). Same
    // accessors, same 'this', called immediately by the original anyway -> safe.
    //
    // [1.14.7 CORRECTION 2026-10-05] The RVAs this comment used to name (0x01A52080 -> intermediate;
    // 0x01A95C60 -> PlayerRole; 0x0173F670 -> Slot) are 1.12 addresses and are WRONG for 1.14.7 - all
    // three land inside unrelated functions, one inside an instruction. They are removed rather than
    // relabelled so nobody follows them again. The verified 1.14.7 getters are in GetPlayerRoleAndSlot:
    // 0x01B99FB0 / 0x01BE1EE0 / 0x01861E40.
    void* Role = nullptr; void* Slot = nullptr;
    GetPlayerRoleAndSlot(a1, &Role, &Slot);
    std::string Name = (a1 && IsReadablePointer(a1, 0x40)) ? reinterpret_cast<UObject*>(a1)->GetName() : std::string("?");

    MpLog("[ApplyPlayerRole #" + std::to_string(Seq) + "] ENTER this=" + MpPtr(a1) + "/" + Name
        + " caller=" + Caller + " retRva=+" + MpHex(RetRva)
        + " PlayerRole=" + (Role ? "Valid" : "INVALID") + "(" + MpPtr(Role) + ")"
        + " Slot=" + (Slot ? "Valid" : "INVALID") + "(" + MpPtr(Slot) + ")");

    reinterpret_cast<void(*)(void*)>(OrigApplyPlayerRole)(a1);

    // The input pointers being non-null only proves that the loadout resolved *some* inventory
    // item and slot. Record their real IDs and the pawn-side result after the native apply. This
    // distinguishes a wrong/stale role reference from SetPlayerRole failing to spawn/equip the
    // AArchonPlayerRole or failing to enter gameplay. Offsets are SDK-verified for 1.12.0:
    // UArchonInventoryItem ItemId +0x70 / InstanceId +0x88; UArchonLoadoutItemSlot CachedItem
    // +0xB8; AArchonLoadout PlayerController +0x630; APlayerController Pawn +0x250;
    // AArchonCharacter PlayerRole +0x738; AArchonEquipment ItemId +0x240 and equip flags +0x2F4.
    std::string InputRoleId = CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Role) + 0x70));
    std::string InputRoleInstance = CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Role) + 0x88));
    void* SlotCachedItem = (Slot && IsReadablePointer(Slot, 0xC0))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Slot) + 0xB8) : nullptr;
    std::string SlotCachedId = SlotCachedItem
        ? CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(SlotCachedItem) + 0x70)) : std::string();

    void* PC = (a1 && IsReadablePointer(a1, 0x638))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(a1) + 0x630) : nullptr;
    void* Pawn = (PC && IsReadablePointer(PC, 0x258))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(PC) + 0x250) : nullptr;
    void* PawnRole = (Pawn && IsReadablePointer(Pawn, 0x740))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Pawn) + 0x738) : nullptr;
    void* PlayerState = (Pawn && IsReadablePointer(Pawn, 0x248))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Pawn) + 0x240) : nullptr;
    // [1.14.7 SDK FIX 2026-10-05] AArchonPlayerState::PlayerRoleId is at +0x648, NOT +0x638. The fresh SDK
    // (Archon_classes.hpp:26164-26165) shows +0x638 is Pad_638[0x10] and PlayerRoleId is the FString at
    // +0x648 - so the old read came out of a padding array. Bound covers the whole FString through +0x658.
    std::string PlayerStateRoleId = (PlayerState && IsReadablePointer(PlayerState, 0x658))
        ? CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(PlayerState) + 0x648))
        : std::string();
    std::string PawnRoleId = PawnRole
        ? CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(PawnRole) + 0x240)) : std::string();
    std::string PawnRoleInstance = PawnRole
        ? CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(PawnRole) + 0x250)) : std::string();
    int Equipped = PawnRole ? SafeReadU8At(reinterpret_cast<uintptr_t>(PawnRole), 0x2F4) : -1;
    int EquippedGameplay = PawnRole ? SafeReadU8At(reinterpret_cast<uintptr_t>(PawnRole), 0x2F5) : -1;
    int ActiveGameplay = PawnRole ? SafeReadU8At(reinterpret_cast<uintptr_t>(PawnRole), 0x2F6) : -1;
    int BpEquipCalled = PawnRole ? SafeReadU8At(reinterpret_cast<uintptr_t>(PawnRole), 0x2F7) : -1;
    int RoleActorFlags58 = PawnRole ? SafeReadU8At(reinterpret_cast<uintptr_t>(PawnRole), 0x58) : -1;
    int RoleActorFlags59 = PawnRole ? SafeReadU8At(reinterpret_cast<uintptr_t>(PawnRole), 0x59) : -1;
    int RoleActorFlags5B = PawnRole ? SafeReadU8At(reinterpret_cast<uintptr_t>(PawnRole), 0x5B) : -1;
    int RoleActorRole = PawnRole ? SafeReadU8At(reinterpret_cast<uintptr_t>(PawnRole), 0xF0) : -1;
    int RoleActorRemoteRole = PawnRole ? SafeReadU8At(reinterpret_cast<uintptr_t>(PawnRole), 0x5F) : -1;
    void* RoleActorOwner = (PawnRole && IsReadablePointer(PawnRole, 0xE8))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(PawnRole) + 0xE0) : nullptr;
    // [1.14.7 CORRECTION 2026-10-05] A null PlayerRole is LEGITIMATE and must not be treated as a fault.
    // Evidence: the starter loadout seeds player_role: null deliberately (starterManifest.ts); the 1.12
    // repro record (Progress/02_NETWORK_REPLICATION.md) shows a playable player with the same null role;
    // and 1.14.7's own getter supports returning null, with ApplyPlayerRole handling absent equipment.
    // A null pointer alone cannot distinguish three states, so classify them:
    //   Slot == null                       -> LOADOUT PENDING   : it may yet resolve; keep the repair armed
    //   Slot != null && Role == null       -> EXPLICITLY UNEQUIPPED (no omnicell): do NOT arm
    //   Role != null && !AppliedToPawn     -> EQUIPPED BUT UNRESOLVED / stale: arm the repair
    // The middle case is the one that produced the pointless ~30s retry churn
    //   [ApplyPlayerRole][RetryWait] ... role=null slot=Valid(...) ... (repeating)
    //   [ApplyPlayerRole][RetryTimeout] expired after 30218ms attempts=0 - discarding bounded retry entry
    // and that expiry only discards a retry entry - it does NOT send the client back to login. An earlier
    // reading of mine linked those two by timestamp; matching timestamps are not causation.
    const bool LoadoutResolved = (Slot != nullptr);
    const bool RoleEquipped = (Role != nullptr);
    const bool AppliedToPawn = RoleEquipped && LoadoutResolved && Pawn && PawnRole
        && !InputRoleId.empty() && InputRoleId == PawnRoleId;
    if (RoleEquipped || !LoadoutResolved) {
        NotePlayerRoleValidity(a1, AppliedToPawn);
    }
    if (AppliedToPawn) {
        // Every connection, not just the owner's - remote clients need this actor to draw the
        // character at all. See RoutePlayerRoleToAllConnections.
        RoutePlayerRoleToAllConnections(PawnRole);
        NoteTempestModifierRole(PawnRole);
        NoteTempestChargeDiagRole(PawnRole);
    }
    const std::string RoleCharge = PlayerRoleChargeSummary(PawnRole);
    MpLog("[PlayerRoleState #" + std::to_string(Seq) + "] inputId=" + InputRoleId
        + " inputInstance=" + InputRoleInstance + " slotCached=" + MpPtr(SlotCachedItem)
        + "/" + SlotCachedId + " pc=" + MpPtr(PC) + " pawn=" + MpPtr(Pawn)
        + " playerState=" + MpPtr(PlayerState) + " playerStateRoleId=" + PlayerStateRoleId
        + " pawnRole=" + MpPtr(PawnRole) + " pawnRoleId=" + PawnRoleId
        + " pawnRoleInstance=" + PawnRoleInstance + " equipped=" + std::to_string(Equipped)
        + " gameplayEquipped=" + std::to_string(EquippedGameplay)
        + " activeGameplay=" + std::to_string(ActiveGameplay)
        + " bpEquipCalled=" + std::to_string(BpEquipCalled)
        + " roleActorOwner=" + MpPtr(RoleActorOwner)
        + " netFlags58=" + std::to_string(RoleActorFlags58)
        + " netFlags59=" + std::to_string(RoleActorFlags59)
        + " netFlags5B=" + std::to_string(RoleActorFlags5B)
        + " role=" + std::to_string(RoleActorRole)
        + " remoteRole=" + std::to_string(RoleActorRemoteRole)
        + " charge={" + RoleCharge + "}"
        + " modifiers={" + PlayerRoleModifierSummary(PawnRole) + "}"
        + " appliedToPawn=" + std::to_string(AppliedToPawn ? 1 : 0));

    MpLog("[ApplyPlayerRole #" + std::to_string(Seq) + "] EXIT  this=" + MpPtr(a1) + "/" + Name + " caller=" + Caller);
}

// The pawn-side AArchonCharacter::PlayerRole pointer is intentionally NOT a replicated property.
// The game's client construction path is AArchonPlayerState::PlayerRoleId (+0x638, Net/RepNotify)
// -> OnRep_PlayerRoleId -> AArchonCharacter::SetPlayerRole. Repro 5 proved that travel can leave the
// new Dojo pawn with PlayerRole=null even though the loadout contains PR_TEMPEST and the authoritative
// server has a fully-active role. Replaying ApplyPlayerRole cannot repair that client-side state: it
// is the loadout/server application path. When the replicated PlayerRoleId is already present, replay
// the game's own missed RepNotify before continuing the normal active-gameplay lifecycle. This is the
// same natural path that created the old working PR_DARKNESS role; no role ID, class, pointer, or flags
// are fabricated by the DLL.
//
// AArchonPlayerState::OnRep_IsActiveGameplay normally drives
// AArchonCharacter::HandleActiveGameplayStateChanged. If PlayerRole is installed after that
// transition (our compatibility loadout cascade is intentionally late), the newly-created role
// remains merely equipped: bIsEquipped=1 while bIsEquippedForGameplay/bIsActiveGameplay and the BP
// equip callback stay 0. Re-dispatch the real character handler with the real replicated
// PlayerState value and bForceUpdate=true. Never write the equipment lifecycle bytes directly.
static void RefreshPlayerRoleGameplayLifecycle(UObject* PC, const char* TriggerLabel) {
    if (Globals::AmServer || !PC || !OrigProcessEventClient || !IsReadablePointer(PC, 0x258)) return;
    // [2026-07-24 ROOT-CAUSE FIX] PC here is s_LastPossessedPC, cached at ClientRestart. A level travel
    // destroys it; the pointer stays readable (recycled memory) so IsReadablePointer above passes, but
    // chasing PC->Pawn->PlayerState/PlayerRole into native code then faults. Confirm PC is still a live
    // registered object before touching it.
    if (!IsRegisteredLiveObject(PC)) return;

    void* Pawn = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(PC) + 0x250);
    if (!Pawn || !IsReadablePointer(Pawn, 0x740)) return;
    void* PlayerState = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Pawn) + 0x240);
    void* PlayerRole = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Pawn) + 0x738);
    // [1.14.7 SDK FIX 2026-10-05] Bound through +0x6B1: bIsActiveGameplay is the bool at +0x6B0
    // (SDK line 26170) and PlayerRoleId the FString at +0x648 (line 26165). The old 0x691 bound and the
    // 0x638 read were both stale.
    if (!PlayerState || !IsReadablePointer(PlayerState, 0x6B1)) return;

    if (!PlayerRole) {
        const std::string ReplicatedRoleId = IsReadablePointer(PlayerState, 0x658)
            ? CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(PlayerState) + 0x648))
            : std::string();

        // Bound RepNotify replay per pawn + replicated role id. Earlier candidates retried forever
        // when the role actor never arrived, which repeatedly rebuilt client-side role/HUD state.
        // The normal loadout retry has the same 20-attempt/~30s ceiling; match it here.
        static void* s_LastRoleNotifyPawn = nullptr;
        static std::string s_LastRoleNotifyId;
        static uint64_t s_LastRoleNotifyMs = 0;
        static int s_RoleNotifyAttempts = 0;
        static uint64_t s_RoleNotifyExhaustedAtMs = 0;
        static void* s_LastEmptyRoleIdPawn = nullptr;
        const uint64_t NotifyNow = GetTickCount64();
        if (ReplicatedRoleId.empty()) {
            if (s_LastEmptyRoleIdPawn != Pawn) {
                s_LastEmptyRoleIdPawn = Pawn;
                MpLog(std::string("[PlayerRoleRepNotify] trigger=") + TriggerLabel
                    + " pawn=" + MpPtr(Pawn) + " playerState=" + MpPtr(PlayerState)
                    + " PlayerRoleId is empty; waiting for replication");
            }
            return;
        }
        if (s_LastRoleNotifyPawn != Pawn || s_LastRoleNotifyId != ReplicatedRoleId) {
            s_LastRoleNotifyPawn = Pawn;
            s_LastRoleNotifyId = ReplicatedRoleId;
            s_LastRoleNotifyMs = 0;
            s_RoleNotifyAttempts = 0;
            s_RoleNotifyExhaustedAtMs = 0;
        }
        // [2026-07-24] A live repro (mid-hunt, no travel/death/respawn in the preceding 26 minutes -
        // the role simply went null with zero causal trace in any existing diagnostic) hit this
        // exact 20-attempt ceiling: every single replay returned pawnRoleAfter=null, then - because
        // neither Pawn nor ReplicatedRoleId ever change again for the rest of that hunt - this branch
        // returned immediately forever, permanently abandoning the player's Omnicell for the
        // remainder of the fight. The true native cause (why OnRep_PlayerRoleId's vtable-dispatched
        // SetPlayerRole keeps failing) isn't confirmed yet, but "try 20 times then give up forever"
        // guarantees permanent loss even if the underlying condition would have cleared on its own.
        // Give it periodic fresh batches instead of one final verdict: after a long cooldown, reset
        // the attempt counter and try again. Same per-attempt throttle as before, so this costs
        // nothing extra while healthy - it only matters for the case that used to be unrecoverable.
        constexpr uint64_t kRoleNotifyGiveUpCooldownMs = 30000;
        if (s_RoleNotifyAttempts >= kMaxPlayerRoleRetryAttempts) {
            if (s_RoleNotifyExhaustedAtMs == 0) s_RoleNotifyExhaustedAtMs = NotifyNow;
            if (NotifyNow - s_RoleNotifyExhaustedAtMs < kRoleNotifyGiveUpCooldownMs) return;
            MpLog(std::string("[PlayerRoleRepNotify] pawn=") + MpPtr(Pawn)
                + " exhausted " + std::to_string(kMaxPlayerRoleRetryAttempts)
                + " attempts with no success - retrying after a "
                + std::to_string(kRoleNotifyGiveUpCooldownMs / 1000)
                + "s cooldown instead of giving up for the rest of the hunt");
            s_RoleNotifyAttempts = 0;
            s_RoleNotifyExhaustedAtMs = 0;
        }
        if (s_LastRoleNotifyPawn == Pawn && NotifyNow - s_LastRoleNotifyMs < 1500) return;
        s_LastRoleNotifyMs = NotifyNow;
        ++s_RoleNotifyAttempts;

        // [2026-07-24 ROOT-CAUSE FIX] Replaying AArchonPlayerState::OnRep_PlayerRoleId here was a
        // NO-OP for rebuilding the role. Verified in Ghidra: that native (FUN_141ba7350) only mirrors
        // the PlayerRoleId FString (PlayerState+0x638 -> +0x648); it NEVER touches the Character's
        // PlayerRole pointer at Pawn+0x738. That is why every one of the 20 replay attempts logged
        // pawnRoleAfter=null - the lever cannot possibly work. The ONLY native path that installs
        // Pawn+0x738 is ApplyPlayerRole (FUN_141a4b790 @ RVA 0x1A4B790), which ends by calling
        // AArchonCharacter::SetPlayerRole (vtable+0xa80). That is exactly what the login/apply cascade
        // and TickPlayerRoleRetries already use successfully; the mid-hunt null just had no retry entry
        // armed (the login entry cleared once the role first applied), so nothing re-ran the real apply.
        // Re-run it here on the owning loadout via the existing crash-guarded helper. If the loadout's
        // own role/slot reference also went null, ApplyPlayerRole logs "[ApplyPlayerRole] ... null
        // PlayerRole and/or Slot" natively - a deeper signal that the loss is upstream of the pawn.
        // Legacy OnRep replay stays available for A/B via USE_LEGACY_ROLE_ONREP_REPAIR.flag.
        UObject* PlayerStateObject = reinterpret_cast<UObject*>(PlayerState);
        if (MpExeRelativeFlagPresent(L"USE_LEGACY_ROLE_ONREP_REPAIR.flag")) {
            UFunction* OnRepPlayerRoleIdFn = PlayerStateObject->Class
                ? PlayerStateObject->Class->GetFunction("ArchonPlayerState", "OnRep_PlayerRoleId")
                : nullptr;
            if (!OnRepPlayerRoleIdFn) {
                MpLog("[PlayerRoleRepNotify] OnRep_PlayerRoleId UFunction not found");
                return;
            }
            reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
                PlayerStateObject, OnRepPlayerRoleIdFn, nullptr);
            PlayerRole = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Pawn) + 0x738);
            MpLog(std::string("[PlayerRoleRepNotify] trigger=") + TriggerLabel
                + " pawn=" + MpPtr(Pawn) + " playerState=" + MpPtr(PlayerState)
                + " attempt=" + std::to_string(s_RoleNotifyAttempts)
                + " replicatedId=" + ReplicatedRoleId + " replayed OnRep_PlayerRoleId (LEGACY no-op lever)"
                + " pawnRoleAfter=" + MpPtr(PlayerRole));
            if (!PlayerRole) return;
        }
        else {
            // Resolve the owning AArchonLoadout (the same object the login cascade passes to
            // ApplyPlayerRole) and re-run the REAL apply through the crash-guarded helper.
            UObject* PCObject = reinterpret_cast<UObject*>(PC);
            static UFunction* s_RepairGetLoadoutFn = nullptr;
            if (!s_RepairGetLoadoutFn && PCObject->Class) {
                s_RepairGetLoadoutFn = PCObject->Class->GetFunction("ArchonPlayerController", "GetLoadout");
            }
            void* Loadout = nullptr;
            if (s_RepairGetLoadoutFn) {
                struct { void* ReturnValue; } getLoadout{ nullptr };
                reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
                    PCObject, s_RepairGetLoadoutFn, &getLoadout);
                Loadout = getLoadout.ReturnValue;
            }
            if (!Loadout || !IsRegisteredLiveObject(Loadout)) {
                MpLog(std::string("[PlayerRoleRepNotify] trigger=") + TriggerLabel
                    + " pawn=" + MpPtr(Pawn) + " attempt=" + std::to_string(s_RoleNotifyAttempts)
                    + " replicatedId=" + ReplicatedRoleId
                    + " could not resolve a live owning loadout to re-apply; will retry");
                return;
            }
            void* RoleRef = nullptr; void* SlotRef = nullptr; void* PawnRef = nullptr; void* PawnRoleRef = nullptr;
            bool AppliedBefore = false; bool AppliedAfter = false;
            const bool Survived = TryApplyPlayerRoleRetryGuarded(
                Loadout, &RoleRef, &SlotRef, &PawnRef, &PawnRoleRef, &AppliedBefore, &AppliedAfter);
            PlayerRole = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Pawn) + 0x738);
            MpLog(std::string("[PlayerRoleRepNotify] trigger=") + TriggerLabel
                + " pawn=" + MpPtr(Pawn) + " playerState=" + MpPtr(PlayerState)
                + " attempt=" + std::to_string(s_RoleNotifyAttempts)
                + " replicatedId=" + ReplicatedRoleId + " re-ran REAL ApplyPlayerRole"
                + " loadout=" + MpPtr(Loadout)
                + " loadoutRoleRef=" + MpPtr(RoleRef) + " loadoutSlotRef=" + MpPtr(SlotRef)
                + " survived=" + std::to_string(Survived ? 1 : 0)
                + " pawnRoleAfter=" + MpPtr(PlayerRole));
            if (!PlayerRole) return;
        }
    }
    if (!IsReadablePointer(PlayerRole, 0x2F8)) return;

    // [1.14.7 SDK FIX 2026-10-05] bIsActiveGameplay is +0x6B0 (SDK line 26170), not +0x690 - the old
    // offset sits inside Pad_658[0x40] and could only ever read padding.
    const uint8_t PlayerStateActive = SafeReadByte(reinterpret_cast<uintptr_t>(PlayerState), 0x6B0, 0xEE);
    const uint8_t EquippedGameplayBefore = SafeReadByte(reinterpret_cast<uintptr_t>(PlayerRole), 0x2F5, 0xEE);
    const uint8_t RoleActiveBefore = SafeReadByte(reinterpret_cast<uintptr_t>(PlayerRole), 0x2F6, 0xEE);
    const uint8_t BpCalledBefore = SafeReadByte(reinterpret_cast<uintptr_t>(PlayerRole), 0x2F7, 0xEE);
    if (PlayerStateActive != 1
        || (EquippedGameplayBefore == 1 && RoleActiveBefore == 1 && BpCalledBefore == 1)) return;

    // This is a compatibility notification, not a state convergence loop. The 1.12 owning-client
    // branch intentionally leaves these authoritative lifecycle bytes at zero even when the role is
    // fully usable. Retrying until they become one therefore never converges and replays downstream
    // gameplay/HUD notifications. Dispatch at most once for each concrete pawn + role pair.
    static void* s_LastLifecyclePawn = nullptr;
    static void* s_LastLifecycleRole = nullptr;
    if (s_LastLifecyclePawn == Pawn && s_LastLifecycleRole == PlayerRole) return;
    s_LastLifecyclePawn = Pawn;
    s_LastLifecycleRole = PlayerRole;

    UObject* PawnObject = reinterpret_cast<UObject*>(Pawn);
    UFunction* HandleActiveFn = PawnObject->Class
        ? PawnObject->Class->GetFunction("ArchonCharacter", "HandleActiveGameplayStateChanged")
        : nullptr;
    if (!HandleActiveFn) {
        static bool s_LoggedMissingHandleActive = false;
        if (!s_LoggedMissingHandleActive) {
            s_LoggedMissingHandleActive = true;
            MpLog("[PlayerRoleLifecycle] HandleActiveGameplayStateChanged UFunction not found");
        }
        return;
    }

    struct {
        bool bInIsActiveGameplay;
        bool bForceUpdate;
    } Params = { true, true };
    reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEventClient)(
        PawnObject, HandleActiveFn, &Params);

    const uint8_t EquippedGameplayAfter = SafeReadByte(reinterpret_cast<uintptr_t>(PlayerRole), 0x2F5, 0xEE);
    const uint8_t RoleActiveAfter = SafeReadByte(reinterpret_cast<uintptr_t>(PlayerRole), 0x2F6, 0xEE);
    const uint8_t BpCalledAfter = SafeReadByte(reinterpret_cast<uintptr_t>(PlayerRole), 0x2F7, 0xEE);
    MpLog(std::string("[PlayerRoleLifecycle] trigger=") + TriggerLabel
        + " pc=" + MpPtr(PC) + " pawn=" + MpPtr(Pawn) + " role=" + MpPtr(PlayerRole)
        + " playerStateActive=" + std::to_string(PlayerStateActive)
        + " gameplayEquipped=" + std::to_string(EquippedGameplayBefore)
        + "->" + std::to_string(EquippedGameplayAfter)
        + " roleActive=" + std::to_string(RoleActiveBefore)
        + "->" + std::to_string(RoleActiveAfter)
        + " bpEquipCalled=" + std::to_string(BpCalledBefore)
        + "->" + std::to_string(BpCalledAfter));
}

// [2026-07-19] Late-joiner PlayerHuntId backfill (Public Hunt Server Reuse — Part A).
// See Plans/PUBLIC_HUNT_SERVER_REUSE_PLAN.md. On a shared/public hunt server, a player whose uid was NOT
// in the "?PlayerHuntIds=" launch string (a late joiner routed in by DeployServer reuse) reaches
// AArchonPlayerController::OnPlayerDataLoadComplete (RVA 0x01B690F0), runs ReadPlayerHuntIDFromCommandLine,
// finds no uid match, and leaves UHuntSystemComponent.PlayerHuntId (+0x180) EMPTY. Every progression
// consumer gates on that field: ServerOnHuntCompleted (+0x188 < 2 => all rewards skipped),
// UObjective::IsInRequiredRegion / HasRequiredPlayerHuntTags (=> objective progress / kill credit skipped).
// Since every player on a public server shares ONE hunt id, backfill it from the server's own launch args
// via the sanctioned DebugSetPlayerHuntID UFunction (Net RepNotify -> replicates to the client). No-op for
// in-launch players (field already set); also fixes the pre-existing uid-mismatch edge case. Reversible via
// DISABLE_PLAYER_HUNTID_BACKFILL.flag.
void* OrigOnPlayerDataLoadComplete = nullptr;

// The player hunt id shared by everyone on this server = huntId of the first "uid:huntId" entry of the
// launch ExpectedPlayerString (identical to what in-launch players receive from "?PlayerHuntIds=").
static std::wstring ServerSharedPlayerHuntId() {
    if (!Globals::ExpectedPlayerString) return L"";
    std::wstring S(Globals::ExpectedPlayerString);
    size_t Colon = S.find(L':');
    if (Colon == std::wstring::npos) return L"";
    size_t Start = Colon + 1;
    size_t Comma = S.find(L',', Start);
    return S.substr(Start, Comma == std::wstring::npos ? std::wstring::npos : Comma - Start);
}

// [2026-07-22 TRIALS PRODUCTION SCHEDULE] CONFIRMED ROOT CAUSE (Ghidra):
// FGameplayScheduler::Initialize (0x141c412e0) builds
// a state per row ONCE (guarded by an "already initialized" flag; later calls are no-ops), COPYING each
// row's window into the state. The eval (FUN_141c3b530) then compares those copies to RAW system UtcNow
// (FUN_14246c300) — it does NOT apply USchedulerComponent.TimeSpanOffset (+0x130). Arena rows are
// non-repeating 2019-2022 windows -> permanently past at real 2026 -> never active (only the repeatable
// escalation row survives). This is why the offset writes (v1-v4) AND the post-init RowMap patch (v5) all
// failed: the offset field is ignored, and the state holds a stale COPY made before we could patch. FIX:
// hook Initialize and rewrite one arena row's window to span "now" BEFORE the states are copied -> the
// arena state is built current -> the first eval marks it active -> replicated to the client -> Trials
// ungreys and that week's behemoth is launchable.
//
// Production behavior is always enabled. All 181 numbered rows are rewritten as contiguous UTC windows.
// TRIALS_ROTATION_MINUTES controls the interval (default 10080 = seven days; 30 is useful for testing).
// DeployServer uses the same Unix-epoch bucket formula. A spawned arena process receives
// MYSTICPARADOX_TRIALS_WEEK so an in-progress trial stays pinned to the exact matchmaker row it launched with.
void* OrigSchedulerInitialize = nullptr;

static constexpr int kTrialsRotationRowCount = 181;
static constexpr int kDefaultTrialsRotationMinutes = 7 * 24 * 60;

static int TrialsRotationMinutes() {
    static int Cached = 0;
    if (Cached != 0) return Cached;

    Cached = kDefaultTrialsRotationMinutes;
    char Value[32] = {};
    DWORD n = GetEnvironmentVariableA("TRIALS_ROTATION_MINUTES", Value, static_cast<DWORD>(sizeof(Value)));
    if (n > 0 && n < sizeof(Value)) {
        char* End = nullptr;
        long Parsed = std::strtol(Value, &End, 10);
        if (End != Value && *End == '\0' && Parsed >= 1 && Parsed <= 525600) {
            Cached = static_cast<int>(Parsed);
        }
    }
    return Cached;
}

static int TrialsLaunchWeekOverride() {
    char Value[16] = {};
    DWORD n = GetEnvironmentVariableA("MYSTICPARADOX_TRIALS_WEEK", Value, static_cast<DWORD>(sizeof(Value)));
    if (n == 0 || n >= sizeof(Value)) return 0;
    char* End = nullptr;
    long Parsed = std::strtol(Value, &End, 10);
    return (End != Value && *End == '\0' && Parsed >= 1 && Parsed <= kTrialsRotationRowCount)
        ? static_cast<int>(Parsed) : 0;
}

static bool TryParseTrialsScheduleWeek(const std::string& RowName, int& WeekOut) {
    static const std::string Prefix = "Scheduled_Arena_Hunt_";
    if (RowName.size() != Prefix.size() + 3 || RowName.compare(0, Prefix.size(), Prefix) != 0) return false;
    const char* Digits = RowName.c_str() + Prefix.size();
    if (Digits[0] < '0' || Digits[0] > '9' || Digits[1] < '0' || Digits[1] > '9' || Digits[2] < '0' || Digits[2] > '9') return false;
    int Week = (Digits[0] - '0') * 100 + (Digits[1] - '0') * 10 + (Digits[2] - '0');
    if (Week < 1 || Week > kTrialsRotationRowCount) return false;
    WeekOut = Week;
    return true;
}

static std::string TrialsScheduleRowName(int Week) {
    std::ostringstream Name;
    Name << "Scheduled_Arena_Hunt_" << std::setfill('0') << std::setw(3) << Week;
    return Name.str();
}

static void PatchArenaScheduleForCurrentTime(void* tablesArr) {
    // tablesArr = TArray<UDataTable*>* : data @ +0x0, Num (int) @ +0x8.
    if (!tablesArr || !IsReadablePointer(tablesArr, 0x10)) return;
    void** data = *reinterpret_cast<void***>(tablesArr);
    int num = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(tablesArr) + 8);
    if (!data || num <= 0 || num > 64 || !IsReadablePointer(data, 8)) return;

    FILETIME ft; GetSystemTimeAsFileTime(&ft);
    int64_t realNow = static_cast<int64_t>((static_cast<uint64_t>(ft.dwHighDateTime) << 32) | ft.dwLowDateTime) + 504911232000000000LL;
    constexpr int64_t kTicksPerHour = 36000000000LL;
    constexpr int64_t kTicksPerMinute = 600000000LL;
    constexpr int64_t kTicksPerDay = 864000000000LL;
    constexpr int64_t kNativeArenaWeek = kTicksPerDay * 7;
    constexpr int64_t kUnixEpochDotNetTicks = 621355968000000000LL;
    const int RotationMinutes = TrialsRotationMinutes();
    const int64_t RotationTicks = static_cast<int64_t>(RotationMinutes) * kTicksPerMinute;
    const int64_t Bucket = (realNow - kUnixEpochDotNetTicks) / RotationTicks;
    const int CurrentWeek = static_cast<int>(Bucket % kTrialsRotationRowCount) + 1;
    const int64_t BucketStart = kUnixEpochDotNetTicks + Bucket * RotationTicks;
    const int LaunchWeek = TrialsLaunchWeekOverride();

    for (int t = 0; t < num; ++t) {
        UObject* tobj = reinterpret_cast<UObject*>(data[t]);
        if (!tobj || !IsReadablePointer(tobj, 0x40)) continue;
        std::string tname = tobj->GetName();
        if (tname.find("arena") == std::string::npos && tname.find("Arena") == std::string::npos) continue;
        SDK::UDataTable* dt = static_cast<SDK::UDataTable*>(tobj);
        uint8_t* Rows[kTrialsRotationRowCount + 1] = {};
        int FoundRows = 0;
        for (auto& pair : dt->RowMap) {
            std::string rn = pair.Key().GetRawString();
            uint8_t* row = pair.Value();
            if (!row || !IsReadablePointer(row, 0x30)) continue;
            int Week = 0;
            if (!TryParseTrialsScheduleWeek(rn, Week)) continue;
            Rows[Week] = row;
            ++FoundRows;
        }

        if (LaunchWeek > 0) {
            uint8_t* target = Rows[LaunchWeek];
            if (target) {
                // A launched Trial retains its selected row for a native week. This avoids a UTC bucket
                // boundary changing modifiers during an in-progress fight, without reintroducing the old
                // multi-year interval that corrupted unrelated HUD presentation.
                const int64_t NewStart = realNow - kTicksPerHour;
                *reinterpret_cast<int64_t*>(target + 0x20) = NewStart;
                *reinterpret_cast<int64_t*>(target + 0x28) = NewStart + kNativeArenaWeek;
            }
            MpLog(target
                ? "[TrialsSchedule] Initialize: launch-pinned row='" + TrialsScheduleRowName(LaunchWeek)
                    + "' duration=7d table=" + tname
                : "[TrialsSchedule] Initialize: launch-pinned row missing '" + TrialsScheduleRowName(LaunchWeek)
                    + "' table=" + tname);
            continue;
        }

        int PatchedRows = 0;
        for (int Week = 1; Week <= kTrialsRotationRowCount; ++Week) {
            uint8_t* target = Rows[Week];
            if (!target) continue;
            const int Forward = (Week - CurrentWeek + kTrialsRotationRowCount) % kTrialsRotationRowCount;
            const int64_t NewStart = BucketStart + static_cast<int64_t>(Forward) * RotationTicks;
            *reinterpret_cast<int64_t*>(target + 0x20) = NewStart;
            *reinterpret_cast<int64_t*>(target + 0x28) = NewStart + RotationTicks;
            ++PatchedRows;
        }
        MpLog("[TrialsSchedule] Initialize: rotating intervalMinutes=" + std::to_string(RotationMinutes)
            + " currentRow='" + TrialsScheduleRowName(CurrentWeek) + "' patchedRows=" + std::to_string(PatchedRows)
            + "/" + std::to_string(FoundRows) + " bucketStartTicks=" + std::to_string(BucketStart)
            + " horizonEndTicks=" + std::to_string(BucketStart + static_cast<int64_t>(kTrialsRotationRowCount) * RotationTicks)
            + " table=" + tname);
    }
}

void SchedulerInitializeHook(void* self, void* tablesArr) {
    __try { PatchArenaScheduleForCurrentTime(tablesArr); }
    __except (EXCEPTION_EXECUTE_HANDLER) {}
    reinterpret_cast<void(*)(void*, void*)>(OrigSchedulerInitialize)(self, tablesArr);
}

void ApplyTrialsScheduleOffset(UObject* PC) {
    if (!PC || !IsReadablePointer(PC, 0x780)) return;

    // Resolve AArchonPlayerController::GetSchedulerComponent() -> the per-player USchedulerComponent.
    static UFunction* s_GetSchedFn = nullptr;
    if (!s_GetSchedFn) {
        s_GetSchedFn = PC->Class->GetFunction("ArchonPlayerController", "GetSchedulerComponent");
        MpLog(std::string("[TrialsSchedule] resolve GetSchedulerComponent -> ") + MpPtr(s_GetSchedFn));
    }
    if (!s_GetSchedFn) return;
    struct { UObject* ReturnValue; } getParms{ nullptr };
    reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEvent)(PC, s_GetSchedFn, &getParms);
    UObject* Sched = getParms.ReturnValue;
    if (!Sched || !IsReadablePointer(Sched, 0x138)) { MpLog("[TrialsSchedule] scheduler component not ready"); return; }

    static UFunction* s_SetOffFn = nullptr;
    if (!s_SetOffFn) {
        s_SetOffFn = Sched->Class->GetFunction("SchedulerComponent", "ServerSetScheduleOffset");
        MpLog(std::string("[TrialsSchedule] resolve ServerSetScheduleOffset -> ") + MpPtr(s_SetOffFn));
    }
    static UFunction* s_UpdateFn = nullptr;
    if (!s_UpdateFn) {
        s_UpdateFn = Sched->Class->GetFunction("SchedulerComponent", "UpdateSchedules");
        MpLog(std::string("[TrialsSchedule] resolve UpdateSchedules -> ") + MpPtr(s_UpdateFn));
    }
    if (!s_UpdateFn) { MpLog("[TrialsSchedule] UpdateSchedules unresolved; cannot re-evaluate"); return; }

    // v4 diagnostic: which schedule tables does THIS scheduler hold, and where does now+offset land? v3
    // showed only the repeatable escalation hunt goes active at either sign -> either the arena table isn't
    // in this component's ScheduleTables, or the offset misses the 2019-2022 arena window.
    {
        void* stData = IsReadablePointer(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Sched) + 0xD0), 8)
                     ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Sched) + 0xD0) : nullptr;
        int stNum = IsReadablePointer(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Sched) + 0xD8), 4)
                     ? *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Sched) + 0xD8) : 0;
        MpLog("[TrialsSchedule] ScheduleTables count=" + std::to_string(stNum));
        for (int i = 0; i < stNum && i < 16 && stData; ++i) {
            UObject* dt = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(stData) + static_cast<uintptr_t>(i) * 8);
            MpLog("[TrialsSchedule]   table[" + std::to_string(i) + "] = "
                + ((dt && IsReadablePointer(dt, 0x20)) ? dt->GetName() : std::string("?")));
        }
        FILETIME ft; GetSystemTimeAsFileTime(&ft);
        int64_t realNow = static_cast<int64_t>((static_cast<uint64_t>(ft.dwHighDateTime) << 32) | ft.dwLowDateTime) + 504911232000000000LL;
        MpLog("[TrialsSchedule] realNow(.NET ticks)=" + std::to_string(realNow)
            + " (arena windows span 636988644000000000..638085348000000000; escalation-heroic is repeatable=always-on)");
    }

    // AvailableScheduledItems @ +0xE0 = TArray<FScheduledItemReplicatedInfo{FString ID@+0x0, int64 EndTime
    // @+0x10}> (stride 0x18), Num @ +0xE8. Enumerate active items + flag any Arena/Trial id.
    auto scanActive = [&](bool& arenaOut) -> int {
        arenaOut = false;
        void* items = IsReadablePointer(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Sched) + 0xE0), 8)
                    ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Sched) + 0xE0) : nullptr;
        int num = IsReadablePointer(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Sched) + 0xE8), 4)
                    ? *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Sched) + 0xE8) : 0;
        if (!items || num <= 0 || num > 4096) return num;
        for (int i = 0; i < num && i < 24; ++i) {
            uintptr_t entry = reinterpret_cast<uintptr_t>(items) + static_cast<uintptr_t>(i) * 0x18;
            if (!IsReadablePointer(reinterpret_cast<void*>(entry), 0x10)) break;
            wchar_t* idData = *reinterpret_cast<wchar_t**>(entry);
            int idNum = *reinterpret_cast<int32_t*>(entry + 8);
            std::wstring id = (idData && idNum > 0 && IsReadablePointer(idData, 2)) ? std::wstring(idData) : L"";
            if (id.find(L"Arena") != std::wstring::npos || id.find(L"Trial") != std::wstring::npos) arenaOut = true;
            MpLog("[TrialsSchedule]   active[" + std::to_string(i) + "] = " + MpNarrow(id));
        }
        return num;
    };

    // The FGameplayScheduler::Initialize hook (SchedulerInitializeHook) already rewrote an arena row's
    // window to span "now" BEFORE the scheduler copied its row states, so the arena hunt should now be in
    // the active set. Re-evaluate + push (refresh the replicated set to the client), then confirm.
    reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEvent)(Sched, s_UpdateFn, nullptr);
    bool arena = false;
    int cnt = scanActive(arena);
    MpLog("[TrialsSchedule] active set: count=" + std::to_string(cnt) + " arenaActive=" + std::to_string(arena ? 1 : 0));
    MpLog(std::string("[TrialsSchedule] RESULT arena/trial active = ") + (arena
        ? "YES (Trials should ungrey + launch that week's behemoth)"
        : "NO - Initialize hook likely did not fire for this scheduler; look for the 'Initialize: pre-build patched' line above"));
}

void OnPlayerDataLoadCompleteHook(UObject* PC, bool bWasSuccessful) {
    const uintptr_t PCAddress = reinterpret_cast<uintptr_t>(PC);
    const uintptr_t LoadManager = PC && IsReadablePointer(PC, 0xA78)
        ? SafeReadPtr(PCAddress, 0xA70)
        : 0;
    if (ClearPlayerDataLoadRecovery(LoadManager, PCAddress)) {
        MpLog("[PlayerDataRecovery] completed after retry success="
            + std::to_string(bWasSuccessful ? 1 : 0)
            + " manager=" + MpPtr(reinterpret_cast<void*>(LoadManager))
            + " playerController=" + MpPtr(PC));
    }

    // Original first: it runs ReadPlayerHuntIDFromCommandLine (sets PlayerHuntId for in-launch players) and
    // ServerRestartPlayer. PlayerHuntId is consumed only at hunt completion / objective ticks, long after.
    reinterpret_cast<void(*)(UObject*, bool)>(OrigOnPlayerDataLoadComplete)(PC, bWasSuccessful);

    // Trials is activated before FGameplayScheduler::Initialize copies/evaluates the patched arena row.
    // Do not call SchedulerComponent::UpdateSchedules from this per-player readiness callback: the live
    // A/B proved that re-entrant refresh corrupts Ramsgate HUD initialization.
    if (!bWasSuccessful) return;

    if (MpExeRelativeFlagPresent(L"DISABLE_PLAYER_HUNTID_BACKFILL.flag")) return;
    if (!PC || !IsReadablePointer(PC, 0x770)) return;

    // AArchonPlayerController::HuntSystem @ +0x768 (SDK Archon_classes.hpp).
    UObject* HuntSystem = *reinterpret_cast<UObject**>(reinterpret_cast<uintptr_t>(PC) + 0x768);
    if (!HuntSystem || !IsReadablePointer(HuntSystem, 0x190)) return;

    // UHuntSystemComponent.PlayerHuntId: FString @ +0x180, ArrayNum (length incl. null) @ +0x188.
    int32_t HuntIdLen = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(HuntSystem) + 0x188);
    if (HuntIdLen >= 2) return;   // already populated (in-launch player) -> no-op

    std::wstring HuntId = ServerSharedPlayerHuntId();
    if (HuntId.empty()) {
        MpLog("[HuntIdBackfill] PlayerHuntId empty but no hunt id in ExpectedPlayerString; skipping");
        return;
    }

    static UFunction* s_DebugSetPlayerHuntIDFn = nullptr;
    if (!s_DebugSetPlayerHuntIDFn) {
        s_DebugSetPlayerHuntIDFn = HuntSystem->Class->GetFunction("HuntSystemComponent", "DebugSetPlayerHuntID");
        MpLog(std::string("[HuntIdBackfill] resolve DebugSetPlayerHuntID -> ") + MpPtr(s_DebugSetPlayerHuntIDFn));
    }
    if (!s_DebugSetPlayerHuntIDFn) return;

    // DebugSetPlayerHuntID(const FString& HuntID) reads the FString and copies it into +0x180. A non-owning
    // FString view over our local wide buffer is valid for the duration of the call (same pattern as the
    // API-key FStrings elsewhere in this file).
    struct { FString HuntID; } Parms{ FString(HuntId.c_str()) };
    reinterpret_cast<void(*)(UObject*, UFunction*, void*)>(OrigProcessEvent)(HuntSystem, s_DebugSetPlayerHuntIDFn, &Parms);
    MpLog("[HuntIdBackfill] PlayerHuntId was empty -> set '" + MpNarrow(HuntId) + "'");
}

// ============================================================================
// [1.14.7 headless-server fix 2026-10-03] Keep dedicated hubs window-free.
//
// WHY THIS EXISTS (verified, not assumed):
//   * The target executable is the WindowsClient shipping build (its paks are
//     Archon_*_WindowsClient.pak). In a client build UE's platform "server only" property is
//     false, so FApp::CanEverRender() stays true and the engine creates a D3D11 device plus a
//     top-level game window even when the process is launched with -server -nullrhi.
//     This is the same limitation the file already documents at the MP_FORCE_WARP note
//     ("-nullrhi alone does NOT suppress D3D11 device creation on the Shipping client").
//   * Ghidra confirms the flag itself is parsed correctly: the RHI decision reads
//     FParse::Param(FCommandLine::Get(), L"nullrhi") and caches it (FUN_14413fd70), so the
//     command line is not the problem - the build is.
//   * Observed symptom before this fix: every dedicated hub owned a VISIBLE top-level window
//     titled "Dauntless" (IsWindowVisible == true) and initialised a real RHI
//     (LogRHI shader pipeline cache, shader platform 0).
//
// WHAT IT DOES: hides this process's own top-level windows while the process runs as a server.
// It hides nothing else, never touches another process, skips the console window, and is fully
// reversible at runtime: create SHOW_SERVER_WINDOW.flag next to the game executable to keep the
// window visible for interactive debugging.
static volatile LONG g_ServerWindowHides = 0;

static BOOL CALLBACK MpServerHideWindowProc(HWND hwnd, LPARAM) {
    DWORD owner = 0;
    GetWindowThreadProcessId(hwnd, &owner);
    if (owner != GetCurrentProcessId()) return TRUE;          // never touch another process
    if (hwnd == GetConsoleWindow()) return TRUE;              // never hide our own console
    if (!IsWindowVisible(hwnd)) return TRUE;                  // already hidden
    ShowWindow(hwnd, SW_HIDE);
    InterlockedIncrement(&g_ServerWindowHides);
    return TRUE;
}

static DWORD WINAPI MpServerWindowHiderThread(LPVOID) {
    bool logged = false;
    // Fast poll while the engine boots and creates its window...
    for (int i = 0; i < 240; ++i) {
        EnumWindows(MpServerHideWindowProc, 0);
        if (!logged && InterlockedCompareExchange(&g_ServerWindowHides, 0, 0) > 0) {
            logged = true;
            MpLog("[HeadlessServer] hid the dedicated-server game window (SW_HIDE)");
        }
        Sleep(250);
    }
    // ...then keep it hidden (the engine can re-show it on map changes).
    for (;;) {
        EnumWindows(MpServerHideWindowProc, 0);
        Sleep(3000);
    }
}

// ---------------------------------------------------------------------------
// [1.14.7 headless ROOT FIX, part 2 - 2026-10-03] Suppress the window at the Win32 boundary.
//
// Measured evidence that this is required (per-second sampling of the live hub):
//     t=1s  handle=0        VISIBLE=False
//     t=3s  handle=3607666  VISIBLE=True    <- engine creates and SHOWS its window
//     t=8s  handle=0        VISIBLE=False   <- the polling hider catches it
// i.e. the window really is created and really is visible for several seconds; a polling hider
// can only ever hide it after the fact. Forcing the cached FApp::CanEverRender() byte to 0 did
// NOT stop creation either (the same run still logged LogRHI shader-pipeline-cache initialisation
// and still produced the window), so this WindowsClient build creates the window through a path
// that does not consult that flag.
//
// Therefore, for the server role only, this process's own windows are hidden at creation and any
// ShowWindow(SW_SHOW*) on them is rewritten to SW_HIDE. Nothing outside this process is touched
// (windows are matched by owning process id) and the console window is never affected.
using CreateWindowExWFn = HWND(WINAPI*)(DWORD, LPCWSTR, LPCWSTR, DWORD, int, int, int, int, HWND, HMENU, HINSTANCE, LPVOID);
static CreateWindowExWFn OrigCreateWindowExW = nullptr;
static HWND WINAPI HookCreateWindowExW(DWORD ExStyle, LPCWSTR ClassName, LPCWSTR WindowName, DWORD Style,
    int X, int Y, int Width, int Height, HWND Parent, HMENU Menu, HINSTANCE Instance, LPVOID Param) {
    HWND Window = OrigCreateWindowExW
        ? OrigCreateWindowExW(ExStyle, ClassName, WindowName, Style, X, Y, Width, Height, Parent, Menu, Instance, Param)
        : nullptr;
    if (Window != nullptr && Globals::AmServer) {
        ShowWindow(Window, SW_HIDE);
        InterlockedIncrement(&g_ServerWindowHides);
    }
    return Window;
}

using ShowWindowFn = BOOL(WINAPI*)(HWND, int);
static ShowWindowFn OrigShowWindowApi = nullptr;
static BOOL WINAPI HookShowWindowApi(HWND Window, int Command) {
    if (Globals::AmServer && Command != SW_HIDE && Window != nullptr) {
        DWORD Owner = 0;
        GetWindowThreadProcessId(Window, &Owner);
        if (Owner == GetCurrentProcessId() && Window != GetConsoleWindow()) {
            InterlockedIncrement(&g_ServerWindowHides);
            return OrigShowWindowApi ? OrigShowWindowApi(Window, SW_HIDE) : TRUE;
        }
    }
    return OrigShowWindowApi ? OrigShowWindowApi(Window, Command) : TRUE;
}

static void InstallServerWindowSuppressionHooks() {
    static volatile LONG installed = 0;
    if (InterlockedCompareExchange(&installed, 1, 0) != 0) return;
    InstallApiHook(L"user32.dll", "CreateWindowExW", reinterpret_cast<LPVOID>(HookCreateWindowExW),
        reinterpret_cast<LPVOID*>(&OrigCreateWindowExW), "[HeadlessServer]");
    InstallApiHook(L"user32.dll", "ShowWindow", reinterpret_cast<LPVOID>(HookShowWindowApi),
        reinterpret_cast<LPVOID*>(&OrigShowWindowApi), "[HeadlessServer]");
    MpLog(std::string("[HeadlessServer] window suppression hooks installed create=")
        + (OrigCreateWindowExW ? "ok" : "FAIL")
        + " show=" + (OrigShowWindowApi ? "ok" : "FAIL"));
}

// [1.14.7] Byte-verified instruction patch helper: validate the exact expected bytes
// (opcode + decoded RIP-relative target) before writing, fail closed, flush the icache.
static bool MpPatchBytesVerified(uintptr_t Rva, const uint8_t* Expected, const uint8_t* Replacement,
                                 size_t Length, const char* Tag) {
    uint8_t* Site = reinterpret_cast<uint8_t*>(Globals::BaseAddress + Rva);
    // NOTE: IsReadablePointer() cannot be used here - it rejects non-8-byte-aligned pointers
    // because it is written for object pointers, and instruction sites are arbitrary addresses.
    // Use a direct VirtualQuery page check instead.
    {
        MEMORY_BASIC_INFORMATION Info{};
        if (VirtualQuery(Site, &Info, sizeof(Info)) == 0
            || Info.State != MEM_COMMIT
            || (Info.Protect & (PAGE_GUARD | PAGE_NOACCESS)) != 0) {
            MpLog(std::string("[BytePatch] ") + Tag + " unreadable at +" + MpHex(Rva) + " - skipped (fail closed)");
            return false;
        }
        const uintptr_t RegionEnd = reinterpret_cast<uintptr_t>(Info.BaseAddress) + Info.RegionSize;
        if (reinterpret_cast<uintptr_t>(Site) + Length > RegionEnd) {
            MpLog(std::string("[BytePatch] ") + Tag + " spans a page boundary at +" + MpHex(Rva) + " - skipped (fail closed)");
            return false;
        }
    }
    if (memcmp(Site, Expected, Length) != 0) {
        MpLog(std::string("[BytePatch] ") + Tag + " byte guard FAILED at +" + MpHex(Rva) + " - skipped (fail closed)");
        return false;
    }
    DWORD OldProtect = 0;
    if (!VirtualProtect(Site, Length, PAGE_EXECUTE_READWRITE, &OldProtect)) {
        MpLog(std::string("[BytePatch] ") + Tag + " VirtualProtect failed at +" + MpHex(Rva)
            + " err=" + std::to_string(GetLastError()));
        return false;
    }
    memcpy(Site, Replacement, Length);
    VirtualProtect(Site, Length, OldProtect, &OldProtect);
    FlushInstructionCache(GetCurrentProcess(), Site, Length);
    MpLog(std::string("[BytePatch] ") + Tag + " patched at +" + MpHex(Rva));
    return true;
}

// ============================================================================
// [1.14.7 identity diagnostic 2026-10-03] READ-ONLY. Logs the owner chain the player-data gate
// depends on, plus the net-id object and its vtable, so the real FUniqueNetId class can be
// identified from a live process instead of guessed:
//   manager+0x20 -> PlayerController      (documented in Progress/32)
//   controller+0x228 -> PlayerState       (verified in FUN_141c29400)
//   PlayerState+0x250 -> id type, +0x258 -> shared net-id OBJECT, +0x260 -> its control block
//   netId+0x00 -> the object's vtable
// Nothing is written and no behaviour changes: the detour calls the original immediately.
using LoadMgrBeginFn = void(*)(void*);
static LoadMgrBeginFn OrigLoadMgrBegin = nullptr;

// ============================================================================
// [1.14.7 PROGRESSION DIAGNOSTICS 2026-10-03] The hub's player-data aggregation stalls because
// UProgressionComponent::ReadFromBackend (FUN_141a6aab0) takes its WAIT branch:
//
//     cVar4 = FUN_1419053a0(gameInstance);        // "progression configuration loaded?"
//     if (cVar4) { FUN_141a4de80(this); return; } // loaded  -> CompleteLoadInternal()
//     else       { ...bind &UProgressionComponent::CompleteLoadInternal to a delegate... }  // WAIT
//
// and the client separately logs
//   GetProgressionConfiguration - Track %s not found in the cached progression configs.
//   Make sure to call QueryProgressionConfiguration first.
// while NO /progression/config request ever reaches the backend. These two read-only hooks record
// (a) whether the configuration predicate ever returns true and (b) whether CompleteLoadInternal ever
// runs, which is the difference between "waiting for the config query" and "config loaded but the
// completion path is broken". Nothing is modified; both hooks call the original immediately.
using ProgConfigLoadedFn = bool(*)(void*);
static ProgConfigLoadedFn OrigProgConfigLoaded = nullptr;

using ProgCompleteLoadInternalFn = void(*)(void*);
static ProgCompleteLoadInternalFn OrigProgCompleteLoadInternal = nullptr;

// ============================================================================
// [1.14.7 FIX 2026-10-10] Wake the components that ReadFromBackend parked.
//
// ReadFromBackend (FUN_141a6aab0, decompiled) receives the component's interface at +0xB0 and, when the
// configuration predicate is FALSE, appends {weak component, FName "CompleteLoadInternal"} to the game
// instance's list at +0x550. Nothing on this build ever calls that back (no reflected UFunction carries
// the name - see the 2026-10-05 note in ProgConfigLoadedHook), so a parked component waits until the load
// manager gives up 60 s later. The phantom local player used to hide this: its own boot-time load fetched
// the configuration, so a real player's predicate was already TRUE and took the direct path. Without the
// phantom (0.2.103+) every first Training/hunt join parked and took 61 s; Ramsgate escaped
// only because other City code re-checks the predicate.
//
// The ReadFromBackend hook records the parked component; MpProgressionWaitPoll re-checks the predicate from
// the server tick and, once it is TRUE, calls the verified CompleteLoadInternal body - exactly what
// ReadFromBackend does on its own TRUE branch. g_ProgCompleted (filled by the CompleteLoadInternal hook)
// keeps every component to one completion.
static thread_local int t_progPredicateResult = -1;    // last predicate answer on this thread (-1 = not asked)
static std::mutex g_ProgWaitMutex;
static std::vector<void*> g_ProgWaiters;               // parked UProgressionComponents
static std::set<void*> g_ProgCompleted;                // components CompleteLoadInternal already ran for
static std::atomic<int> g_ProgWaiterCount{ 0 };
static ULONGLONG g_ProgWaitSince = 0;                  // when the oldest current waiter parked
// [2026-10-11 1.14.7 O2] Components that took ReadFromBackend's WAIT branch and have not completed since - the only way a
// component becomes "stranded" (configuration received, setup never finished: see ProgConfigLoadedHook). Unlike
// g_ProgWaiters this list is not emptied by MpProgressionWaitPoll's resume or its 90 s give-up; an entry leaves when
// CompleteLoadInternal runs for it or when it is no longer a live object. Guarded by g_ProgWaitMutex.
static std::vector<void*> g_ProgStrandCandidates;
static bool g_ProgStrandCandidatesOverflow = false;   // a candidate did not fit: fall back to the full walk

static bool MpProgressionAlreadyCompleted(void* Component) {
    std::lock_guard<std::mutex> Lock(g_ProgWaitMutex);
    return g_ProgCompleted.count(Component) != 0;
}

static void ProgCompleteLoadInternalHook(void* This) {
    static volatile LONG logged = 0;
    if (InterlockedCompareExchange(&logged, 1, 0) == 0) {
        MpLog("[ProgDiag] CompleteLoadInternal RUNS this=" + MpPtr(This));
    }
    if (This) {
        std::lock_guard<std::mutex> Lock(g_ProgWaitMutex);
        if (g_ProgCompleted.size() > 4096) g_ProgCompleted.clear();   // bound; a hub never gets near this
        g_ProgCompleted.insert(This);
        g_ProgWaiters.erase(std::remove(g_ProgWaiters.begin(), g_ProgWaiters.end(), This), g_ProgWaiters.end());
        g_ProgWaiterCount.store(static_cast<int>(g_ProgWaiters.size()), std::memory_order_relaxed);
        g_ProgStrandCandidates.erase(std::remove(g_ProgStrandCandidates.begin(), g_ProgStrandCandidates.end(), This),
            g_ProgStrandCandidates.end());   // [2026-10-11 O2]
    }
    if (OrigProgCompleteLoadInternal) {
        OrigProgCompleteLoadInternal(This);
    }
}

using ProgReadFromBackendFn = void(*)(void*);
static ProgReadFromBackendFn OrigProgReadFromBackend = nullptr;

static void ProgReadFromBackendHook(void* Interface) {
    t_progPredicateResult = -1;
    if (OrigProgReadFromBackend) {
        OrigProgReadFromBackend(Interface);
    }
    // Only the WAIT branch asks the predicate and gets FALSE; every other exit leaves -1 or 1.
    if (t_progPredicateResult != 0 || !Interface || !Globals::AmServer) return;

    void* Component = reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Interface) - 0xB0);
    size_t Waiters = 0;
    {
        std::lock_guard<std::mutex> Lock(g_ProgWaitMutex);
        g_ProgCompleted.erase(Component);   // a new waiter at a recycled address is not completed
        if (g_ProgWaiters.empty()) g_ProgWaitSince = GetTickCount64();
        if (std::find(g_ProgWaiters.begin(), g_ProgWaiters.end(), Component) == g_ProgWaiters.end()) {
            g_ProgWaiters.push_back(Component);
        }
        // [2026-10-11 O2] Also a stranding candidate for ProgConfigLoadedHook (bounded; past the bound the hook walks
        // GObjects again, as before).
        if (std::find(g_ProgStrandCandidates.begin(), g_ProgStrandCandidates.end(), Component) == g_ProgStrandCandidates.end()) {
            if (g_ProgStrandCandidates.size() < 1024) g_ProgStrandCandidates.push_back(Component);
            else g_ProgStrandCandidatesOverflow = true;
        }
        Waiters = g_ProgWaiters.size();
        g_ProgWaiterCount.store(static_cast<int>(Waiters), std::memory_order_relaxed);
    }
    MpLog("[ProgWait] ReadFromBackend parked component=" + MpPtr(Component)
        + " (configuration not loaded yet) waiters=" + std::to_string(Waiters));
}

static bool ProgConfigLoadedHook(void* GameInstance) {
    bool Loaded = OrigProgConfigLoaded ? OrigProgConfigLoaded(GameInstance) : false;

    // ========================================================================
    // [1.14.7 FIX 2026-10-05] Resume a STRANDED progression component.
    //
    // ReadFromBackend (FUN_141a6aab0) takes its WAIT branch when configuration is not ready yet and binds a
    // DYNAMIC delegate named CompleteLoadInternal to the component. The audit established that the component's
    // class hierarchy has NO reflected UFunction with that name, so Unreal's function cache holds a null
    // result and the dispatcher SKIPS the callback. Configuration and season selection then finish, but the
    // component never starts its progression queries - which is why the loaders stay incomplete and the hub's
    // PlayerData load times out.
    //
    // The native body at RVA 0x01A4DE80 is already verified by this file (it is the target of
    // ProgCompleteLoadInternalHook and of the ReadFromBackend call above). Call it DIRECTLY, on this (game)
    // thread, once per component, and only after the configuration predicate genuinely reports ready.
    //
    // Flag meanings, audit-verified (the earlier +0x3F0 reading was wrong):
    //   +0x3F0 = configuration received        +0x3F8 = finished setup        +0x414 = initialization guard
    // So the stranded state is exactly: configuration received AND setup never finished.
    //
    // [2026-10-11 1.14.7 O2] The search below was a full GObjects walk (~208k objects, an IsA each) on EVERY predicate
    // call while fewer than 8 resumes had happened - in practice on every call for the process lifetime, and City code
    // asks the predicate at every join. A component can only reach the stranded state through ReadFromBackend's WAIT
    // branch, which ProgReadFromBackendHook records (g_ProgStrandCandidates), so only those components are examined -
    // with the same checks, in the same order, and the same resume. The walk is kept for LEGACY_LIFECYCLE_WALK.flag and
    // for the (theoretical) candidate-list overflow.
    if (Loaded && GameInstance && SDK::UObject::GObjects) {
        static std::atomic<int> s_resumes{ 0 };
        bool UseWalk = MpLegacyLifecycleWalk();
        std::vector<void*> Candidates;
        if (!UseWalk && s_resumes.load(std::memory_order_relaxed) < 8) {
            std::lock_guard<std::mutex> Lock(g_ProgWaitMutex);
            UseWalk = g_ProgStrandCandidatesOverflow;
            if (!UseWalk) Candidates = g_ProgStrandCandidates;
        }
        if (!UseWalk && !Candidates.empty() && s_resumes.load(std::memory_order_relaxed) < 8) {
            std::vector<void*> Gone;
            for (void* Candidate : Candidates) {
                SDK::UObject* Obj = reinterpret_cast<SDK::UObject*>(Candidate);
                if (!IsReadablePointer(Obj, 0x420) || !IsRegisteredLiveObject(Obj)) { Gone.push_back(Candidate); continue; }
                if (Obj->IsDefaultObject() || !Obj->IsA(SDK::UProgressionComponent::StaticClass())) {
                    Gone.push_back(Candidate);
                    continue;
                }
                if (MpProgressionAlreadyCompleted(Obj)) continue;
                const uintptr_t Base = reinterpret_cast<uintptr_t>(Obj);
                const uint8_t ConfigReceived = *reinterpret_cast<const uint8_t*>(Base + 0x3F0);
                const uint8_t FinishedSetup = *reinterpret_cast<const uint8_t*>(Base + 0x3F8);
                if (ConfigReceived == 0 || FinishedSetup != 0) continue;   // not stranded
                if (s_resumes.fetch_add(1, std::memory_order_relaxed) >= 8) break;
                MpLog("[ProgResume] stranded component this=" + MpPtr(Obj)
                    + " configReceived=" + std::to_string(static_cast<int>(ConfigReceived))
                    + " finishedSetup=" + std::to_string(static_cast<int>(FinishedSetup))
                    + " -> calling the verified CompleteLoadInternal body (+0x1A4DE80)");
                reinterpret_cast<void(*)(void*)>(Globals::BaseAddress + 0x01A4DE80)(Obj);
            }
            if (!Gone.empty()) {
                std::lock_guard<std::mutex> Lock(g_ProgWaitMutex);
                for (void* G : Gone) {
                    g_ProgStrandCandidates.erase(std::remove(g_ProgStrandCandidates.begin(), g_ProgStrandCandidates.end(), G),
                        g_ProgStrandCandidates.end());
                }
            }
        }
        if (UseWalk && s_resumes.load(std::memory_order_relaxed) < 8) {
            const int Count = SDK::UObject::GObjects->Num();
            for (int i = 0; i < Count; ++i) {
                SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
                if (!Obj || Obj->IsDefaultObject()) continue;
                if (!Obj->IsA(SDK::UProgressionComponent::StaticClass())) continue;

                // Validate live identity before touching native state (the delegate held a WEAK reference).
                if (!IsReadablePointer(Obj, 0x420)) continue;
                if (!IsRegisteredLiveObject(Obj)) continue;

                // [2026-10-10] FinishedSetup stays 0 after a completion, so without this the same component was
                // resumed again at every later join (Ramsgate 10 Oct: one component three times).
                if (MpProgressionAlreadyCompleted(Obj)) continue;

                const uintptr_t Base = reinterpret_cast<uintptr_t>(Obj);
                const uint8_t ConfigReceived = *reinterpret_cast<const uint8_t*>(Base + 0x3F0);
                const uint8_t FinishedSetup = *reinterpret_cast<const uint8_t*>(Base + 0x3F8);
                if (ConfigReceived == 0 || FinishedSetup != 0) continue;   // not stranded

                if (s_resumes.fetch_add(1, std::memory_order_relaxed) >= 8) break;
                MpLog("[ProgResume] stranded component this=" + MpPtr(Obj)
                    + " configReceived=" + std::to_string(static_cast<int>(ConfigReceived))
                    + " finishedSetup=" + std::to_string(static_cast<int>(FinishedSetup))
                    + " -> calling the verified CompleteLoadInternal body (+0x1A4DE80)");
                reinterpret_cast<void(*)(void*)>(Globals::BaseAddress + 0x01A4DE80)(Obj);
            }
        }
    }

    // [1.14.7 active hunt pass] capture the game instance (this hook receives it) and drive the game's
    // own FindActiveHuntPassRow once, on this (game) thread, two calls in.
    if (GameInstance) {
        g_archonGameInstanceForHuntPass = GameInstance;
    }
    // [1.14.7 hunt pass query] issue the genuine configuration query once, two readiness checks in.
    // [2026-10-16] Always, with no flag. It was gated by CALL_HUNTPASS_QUERY.flag, which only a
    // development install had: on every other PC a realm hub never queried the progression configuration, so a player's
    // progression load waited for it ("ReadFromBackend will WAIT for the config event", then "still not loaded after 90 s"), the
    // game's player-data timeout fired twice and the hub sent the player back to the menu 120 s after Ramsgate loaded (fresh
    // installs). A hub with the flag issued the query at boot and loaded.
    static std::atomic<int> s_huntPassQueryState{ 0 };
    {
        const int QState = s_huntPassQueryState.load();
        if (QState == 1) {
            s_huntPassQueryState.store(2);
            CallHuntPassSeasonQuery();
        } else if (QState == 0) {
            s_huntPassQueryState.store(1);
        }
    }

    static std::atomic<int> s_huntPassDriveState{ 0 };
    if (MpExeRelativeFlagPresent(L"CALL_FIND_ACTIVE_HUNTPASS.flag")) {
        const int State = s_huntPassDriveState.load();
        if (State == 1) {
            s_huntPassDriveState.store(2);
            CallFindActiveHuntPassRow("second readiness check");
        } else if (State == 0) {
            s_huntPassDriveState.store(1);
        }
    }

    // [1.14.7 EXPERIMENT 2026-10-03] FORCE_PROGRESSION_CONFIG_READY.flag: the progression
    // configuration query is never issued on this build (verified: the predicate returns FALSE, no
    // /progression/objectives or /progression/config request is ever attempted, CompleteLoadInternal
    // never runs), and everything else in the loader set waits on that component. This makes the
    // predicate report ready on the SERVER role so ReadFromBackend takes its own
    // CompleteLoadInternal() path, which is exactly what the game does when the configuration IS
    // loaded. Nothing else is faked: the native completion runs with whatever state it has, so the
    // measurement answers "is the missing configuration completion the single blocker?".
    static int s_forceConfigReady = -1;
    if (s_forceConfigReady < 0) {
        s_forceConfigReady = (Globals::AmServer
            && MpExeRelativeFlagPresent(L"FORCE_PROGRESSION_CONFIG_READY.flag")) ? 1 : 0;
        MpLog(std::string("[ProgDiag] FORCE_PROGRESSION_CONFIG_READY ")
            + (s_forceConfigReady ? "ACTIVE (server role): the configuration predicate will report ready"
                                  : "inactive"));
    }
    if (s_forceConfigReady == 1 && !Loaded) {
        static std::atomic<int> s_forcedReady{ 0 };
        const int ForcedSeq = s_forcedReady.fetch_add(1, std::memory_order_relaxed);
        if (ForcedSeq < 5) {
            MpLog("[ProgDiag] config predicate forced TRUE seq=" + std::to_string(ForcedSeq)
                + " (gameInstance=" + MpPtr(GameInstance) + ")");
        }
        Loaded = true;
    }
    static volatile LONG loggedTrue = 0;
    static volatile LONG loggedFalse = 0;
    if (Loaded && InterlockedCompareExchange(&loggedTrue, 1, 0) == 0) {
        MpLog("[ProgDiag] progression configuration predicate returned TRUE (gameInstance="
            + MpPtr(GameInstance) + ")");
    }
    if (!Loaded && InterlockedCompareExchange(&loggedFalse, 1, 0) == 0) {
        MpLog("[ProgDiag] progression configuration predicate returned FALSE (gameInstance="
            + MpPtr(GameInstance) + ") - ReadFromBackend will WAIT for the config event");
    }
    t_progPredicateResult = Loaded ? 1 : 0;
    return Loaded;
}

// [1.14.7 FIX 2026-10-10] Server tick: resume parked progression components once the configuration is loaded
// (see the block comment above ProgCompleteLoadInternalHook). Acts when the server runs without the phantom
// local player (every server role since 0.2.110), or with PROGRESSION_WAIT_RESUME.flag; if the byte guard ever
// fails and a phantom exists, its own early load makes the predicate TRUE before a real player arrives, and
// resuming its component would give it a full player-data load. The predicate is asked at most every 200 ms and only while
// something is parked; the original is called directly, so the hook's object scan does not run here.
static void MpProgressionWaitPoll() {
    if (!Globals::AmServer || g_ProgWaiterCount.load(std::memory_order_relaxed) == 0) return;

    static int s_enabled = -1;
    if (s_enabled < 0 && Globals::BaseAddress) {
        s_enabled = (g_NoLocalPlayerApplied.load(std::memory_order_relaxed)
            || MpExeRelativeFlagPresent(L"PROGRESSION_WAIT_RESUME.flag")) ? 1 : 0;
        MpLog(std::string("[ProgWait] resume of parked components ")
            + (s_enabled ? "ACTIVE (no phantom local player, or PROGRESSION_WAIT_RESUME.flag)"
                         : "inactive (the phantom's early load covers it)"));
    }
    if (s_enabled != 1) {
        std::lock_guard<std::mutex> Lock(g_ProgWaitMutex);
        g_ProgWaiters.clear();
        g_ProgWaiterCount.store(0, std::memory_order_relaxed);
        return;
    }

    static ULONGLONG s_lastCheck = 0;
    const ULONGLONG Now = GetTickCount64();
    if (Now - s_lastCheck < 200) return;
    s_lastCheck = Now;

    void* GameInstance = g_archonGameInstanceForHuntPass;
    if (!GameInstance || !OrigProgConfigLoaded || !IsRegisteredLiveObject(GameInstance)) return;

    ULONGLONG Since = 0;
    {
        std::lock_guard<std::mutex> Lock(g_ProgWaitMutex);
        Since = g_ProgWaitSince;
    }
    if (!OrigProgConfigLoaded(GameInstance)) {
        // The load manager gives up at 60 s and PlayerDataRecovery takes over; stop asking after that.
        if (Since != 0 && Now - Since > 90000) {
            std::lock_guard<std::mutex> Lock(g_ProgWaitMutex);
            MpLog("[ProgWait] configuration still not loaded after 90 s; dropping "
                + std::to_string(g_ProgWaiters.size()) + " parked component(s) to the load-failure recovery");
            g_ProgWaiters.clear();
            g_ProgWaiterCount.store(0, std::memory_order_relaxed);
        }
        return;
    }

    std::vector<void*> Ready;
    {
        std::lock_guard<std::mutex> Lock(g_ProgWaitMutex);
        Ready.swap(g_ProgWaiters);
        g_ProgWaiterCount.store(0, std::memory_order_relaxed);
    }
    for (void* Component : Ready) {
        if (MpProgressionAlreadyCompleted(Component)) {
            MpLog("[ProgWait] component=" + MpPtr(Component) + " already completed; nothing to resume");
            continue;
        }
        SDK::UObject* Obj = reinterpret_cast<SDK::UObject*>(Component);
        if (!IsReadablePointer(Component, 0x420) || !IsRegisteredLiveObject(Component)
            || Obj->IsDefaultObject() || !Obj->IsA(SDK::UProgressionComponent::StaticClass())) {
            MpLog("[ProgWait] component=" + MpPtr(Component) + " is gone or not a progression component; skipped");
            continue;
        }
        MpLog("[ProgWait] configuration loaded " + std::to_string(Since ? Now - Since : 0)
            + " ms after the first park -> CompleteLoadInternal component=" + MpPtr(Component));
        reinterpret_cast<void(*)(void*)>(Globals::BaseAddress + 0x01A4DE80)(Component);
    }
}

static void InstallProgressionDiagnostics() {
    MH_STATUS LoadedCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x019053A0),
        ProgConfigLoadedHook, reinterpret_cast<LPVOID*>(&OrigProgConfigLoaded));
    MH_STATUS LoadedEnable = LoadedCreate == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x019053A0)) : LoadedCreate;
    MpLog(std::string("[ProgDiag] config predicate hook (+0x19053A0) create=")
        + MH_StatusToString(LoadedCreate) + " enable=" + MH_StatusToString(LoadedEnable));

    MH_STATUS CompleteCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x01A4DE80),
        ProgCompleteLoadInternalHook, reinterpret_cast<LPVOID*>(&OrigProgCompleteLoadInternal));
    MH_STATUS CompleteEnable = CompleteCreate == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x01A4DE80)) : CompleteCreate;
    MpLog(std::string("[ProgDiag] CompleteLoadInternal hook (+0x1A4DE80) create=")
        + MH_StatusToString(CompleteCreate) + " enable=" + MH_StatusToString(CompleteEnable));

    // [1.14.7 FIX 2026-10-10] ReadFromBackend (entry confirmed in the 1.14.7 database): records parked components.
    MH_STATUS ReadCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x01A6AAB0),
        ProgReadFromBackendHook, reinterpret_cast<LPVOID*>(&OrigProgReadFromBackend));
    MH_STATUS ReadEnable = ReadCreate == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x01A6AAB0)) : ReadCreate;
    MpLog(std::string("[ProgWait] ReadFromBackend hook (+0x1A6AAB0) create=")
        + MH_StatusToString(ReadCreate) + " enable=" + MH_StatusToString(ReadEnable));
}

// ============================================================================
// [1.14.7 DIAG 2026-10-10] [GrantTrace] - which game code issues each inventory transaction.
// FUN_140dbb560 (RVA 0x00DBB560, a function entry in the 1.14.7 database and in .pdata) builds the POST /inventory body.
// Decompiled argument layout: arg4 = { FString source @+0x00, FString transactionId @+0x10 } (written as "source" and
// "transactionId"); arg5 = adds, 0x50-byte entries { FName catalogId @+0x00, int32 quantity @+0x08 }; arg6 = saved
// instances; arg7 = stacked removes, 0x38-byte entries { FName @+0x10, int32 amount @+0x18 }; arg8 = 0x40-byte entries.
// The backend's [GrantMon] logs the same transaction by id; this side adds the native call chain (exe RVAs with their
// function starts), which names the code behind grants such as the 4 daily draft tokens added on every arrival.
// Server role, read-only (the original always runs), 400 lines per process; GRANT_TRACE_OFF.flag skips the hook.
using InventoryTxnBuildFn = void*(*)(void*, void*, void*, void*, void*, void*, void*, void*);
static InventoryTxnBuildFn OrigInventoryTxnBuild = nullptr;
static uintptr_t ResolveFunctionStartRva(uintptr_t Rva);   // defined with the callout guards (.pdata lookup)

static std::string MpGrantTraceItems(void* Array, uintptr_t Stride, uintptr_t NameOffset, uintptr_t CountOffset) {
    if (!Array || !IsReadablePointer(Array, 0x10)) return "[]";
    void* Data = *reinterpret_cast<void**>(Array);
    const int32_t Num = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Array) + 0x8);
    if (Num <= 0) return "[]";
    if (Num > 256 || !Data || !IsReadablePointer(Data, static_cast<size_t>(Num) * Stride)) return "[?" + std::to_string(Num) + "]";
    std::string Out = "[";
    for (int32_t i = 0; i < Num && i < 24; ++i) {
        const uintptr_t Entry = reinterpret_cast<uintptr_t>(Data) + static_cast<uintptr_t>(i) * Stride;
        if (i) Out += ", ";
        Out += reinterpret_cast<SDK::FName*>(Entry + NameOffset)->ToString()
            + " x" + std::to_string(*reinterpret_cast<int32_t*>(Entry + CountOffset));
    }
    return Out + (Num > 24 ? ", ...]" : "]");
}

static int MpGrantTraceCount(void* Array) {
    if (!Array || !IsReadablePointer(Array, 0x10)) return -1;
    return *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Array) + 0x8);
}

static std::string MpGrantTraceCallChain() {
    void* Frames[14] = {};
    const USHORT Count = RtlCaptureStackBackTrace(2, 14, Frames, nullptr);   // skip this helper and the detour
    std::string Out;
    for (USHORT i = 0; i < Count; ++i) {
        const uintptr_t Address = reinterpret_cast<uintptr_t>(Frames[i]);
        const uintptr_t Rva = Address - Globals::BaseAddress;
        const uintptr_t Start = Address > Globals::BaseAddress ? ResolveFunctionStartRva(Rva) : 0;
        Out += Start ? (" +" + MpHex(Rva) + "(fn " + MpHex(Start) + ")") : (" " + MpAddress(Frames[i]));
    }
    return Out;
}

// The innermost reflected functions executing on this thread (Blueprint graphs and UFunction thunks), innermost first.
// Native-only paths (an HTTP completion, for example) have none and print "-".
static std::string MpGrantTraceUFunctionChain() {
    std::string Out;
    const int Depth = g_MpPeChainDepth < 64 ? g_MpPeChainDepth : 64;
    int Printed = 0;
    for (int i = Depth - 1; i >= 0 && Printed < 6; --i) {
        SDK::UFunction* Function = g_MpPeChain[i];
        if (!Function || !IsRegisteredLiveObject(Function)) continue;
        std::string Name = Function->GetFullName();
        if (Name.rfind("Function ", 0) == 0) Name = Name.substr(9);
        Out += (Printed++ ? " <- " : "") + Name;
    }
    return Out.empty() ? "-" : Out;
}

static void* InventoryTxnBuildHook(void* Self, void* Out, void* Ids, void* Meta, void* Adds, void* Saves, void* Removes, void* Third) {
    static std::atomic<int> s_budget{ 0 };
    if (!MpProductionLogProfile()   // [2026-10-11 O3] log-only
        && s_budget.fetch_add(1, std::memory_order_relaxed) < 400 && Meta && IsReadablePointer(Meta, 0x20)) {
        MpLog("[GrantTrace] txn=" + CoreCapFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Meta) + 0x10))
            + " source=\"" + CoreCapFString(Meta) + "\""
            + " adds=" + MpGrantTraceItems(Adds, 0x50, 0x00, 0x08)
            + " stackedRemoves=" + MpGrantTraceItems(Removes, 0x38, 0x10, 0x18)
            + " saves=" + std::to_string(MpGrantTraceCount(Saves))
            + " other=" + std::to_string(MpGrantTraceCount(Third))
            + " ufunctions=" + MpGrantTraceUFunctionChain()
            + " caller=" + MpGrantTraceCallChain());
    }
    return OrigInventoryTxnBuild(Self, Out, Ids, Meta, Adds, Saves, Removes, Third);
}

// [1.14.7 DIAG 2026-10-10] [CooldownTrace] - every UCooldownComponent::GetCooldownStartTime lookup (FUN_141a032f0, RVA
// 0x01A032F0, a .pdata entry). Decompiled: bool (UCooldownComponent* this, const FString& Id, FDateTime& Out); it
// returns false with "no valid backend data!" while this+0x100 (backend data loaded) is 0, else searches the
// TArray at this+0x108 (count +0x110) of 0x18-byte { FString id, FDateTime started } entries. The daily bounty
// (UBountyComponent_Daily::ServerInitializeBounties: "bounty cooldown not found ... using hunt pass start") and the
// patrol bonus Blueprint (periodic_reward_bpc_C.OnRefreshCooldownStatus) both decide "new period" from it, and both
// still fire on every arrival although the backend now stores and serves their cooldowns (38_ section 19.7). This
// records, per lookup: the id, found or not, the date, whether the component had its data yet, and who asked.
using CooldownStartTimeFn = uint64_t(*)(void*, void*, void*);
static CooldownStartTimeFn OrigCooldownStartTime = nullptr;

static std::string MpTicksToIso(int64_t Ticks) {
    constexpr int64_t kUnixEpochTicks = 621355968000000000LL;   // FDateTime ticks (100 ns since 0001-01-01) at 1970
    if (Ticks <= kUnixEpochTicks) return std::to_string(Ticks);
    const time_t Seconds = static_cast<time_t>((Ticks - kUnixEpochTicks) / 10000000LL);
    tm Utc{};
    if (gmtime_s(&Utc, &Seconds) != 0) return std::to_string(Ticks);
    char Buffer[32] = {};
    strftime(Buffer, sizeof(Buffer), "%Y-%m-%dT%H:%M:%SZ", &Utc);
    return Buffer;
}

static uint64_t CooldownStartTimeHook(void* Component, void* Id, void* Out) {
    // The id FString is passed by value: the original frees its buffer before returning, so read it first.
    static std::atomic<int> s_budget{ 0 };
    const bool Trace = !MpProductionLogProfile()   // [2026-10-11 O3] log-only
        && s_budget.fetch_add(1, std::memory_order_relaxed) < 300;
    const std::string IdText = Trace ? CoreCapFString(Id) : std::string();
    const uint64_t Ret = OrigCooldownStartTime(Component, Id, Out);
    if (Trace) {
        const bool Found = (Ret & 0xFF) != 0;
        const int64_t Ticks = (Found && Out && IsReadablePointer(Out, 8)) ? *reinterpret_cast<int64_t*>(Out) : 0;
        const bool Readable = Component && IsReadablePointer(Component, 0x118);
        const int Loaded = Readable ? *reinterpret_cast<uint8_t*>(reinterpret_cast<uintptr_t>(Component) + 0x100) : -1;
        const int Entries = Readable ? *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Component) + 0x110) : -1;
        MpLog("[CooldownTrace] id=" + IdText + " found=" + (Found ? "1" : "0")
            + " value=" + (Found ? MpTicksToIso(Ticks) : std::string("-"))
            + " backendData=" + std::to_string(Loaded) + " entries=" + std::to_string(Entries)
            + " component=" + MpPtr(Component) + "/" + (Component ? SafeObjectNameForDiagnostic(Component) : std::string("null"))
            + " ufunctions=" + MpGrantTraceUFunctionChain()
            + " caller=" + MpGrantTraceCallChain());
    }
    return Ret;
}

static void InstallCooldownTraceHook() {
    constexpr uintptr_t kStartTimeRva = 0x01A032F0;
    if (ResolveFunctionStartRva(kStartTimeRva) != kStartTimeRva) {
        MpLog("[CooldownTrace] NOT installed: +" + MpHex(kStartTimeRva) + " is not a function entry in this build's .pdata");
        return;
    }
    void* Target = reinterpret_cast<void*>(Globals::BaseAddress + kStartTimeRva);
    const MH_STATUS Create = MH_CreateHook(Target, reinterpret_cast<void*>(&CooldownStartTimeHook), reinterpret_cast<LPVOID*>(&OrigCooldownStartTime));
    const MH_STATUS Enable = Create == MH_OK ? MH_EnableHook(Target) : Create;
    MpLog(std::string("[CooldownTrace] GetCooldownStartTime hook (+0x1A032F0) create=") + MH_StatusToString(Create)
        + " enable=" + MH_StatusToString(Enable));
}

// [1.14.7 DIAG 2026-10-11] [KillXP] - why a Behemoth kill on a dedicated hunt grants no weapon XP and no Hunt Pass XP.
// UPlayerExperienceComponent::HandleBehemothKilled (FUN_141a62960) runs on every kill ([WeaponXP][ServerKill]) and makes
// two awards from FPlayerProgressionTuningData: weapon XP from BehemothXPTuningData (+0x20) and Hunt Pass XP from
// BehemothXPTuningDataHuntPass (+0x88). Each amount is FUN_141a44ec0(&component, behemoth, tuning) (float):
//   base = FUN_141a57f80(component, behemoth, tuning)   int; 0 when the weapon lookup below fails (silent below
//          Warning verbosity). diff = behemoth level - player weapon level: diff > 0 -> BaseXP + bonus over
//          min(diff, NumXPBonusLevels); |diff| > NumXPPenaltyLevels -> MinXP; else BaseXP - penalty * |diff|; then
//          times the player's XP multiplier (FUN_142284720).
//   + StarBonus[behemoth star level] (FUN_142239e50).
// FUN_141a57a50(component, weapon category, out) resolves the equipped weapon's level (out+4). A positive weapon amount
// goes to FUN_141a62540(component, base, bonus, type 9, out) (native GrantWeaponExperience); a positive Hunt Pass
// amount to FUN_141a1bcf0(huntPassComponent, amount) -> AddProgressToSelectedTrack. In the 10 Oct repro six kills
// reached HandleBehemothKilled and no XP request left the hunt server. These pass-through hooks log every step's value
// so the zero is located. All five targets are .pdata entries; nothing is changed. KILL_XP_TRACE_OFF.flag disables.
using KillXpWeaponLevelFn = uint64_t(*)(void*, uint64_t, void*);
using KillXpBaseFn = int32_t(*)(void*, void*, void*);
using KillXpAmountFn = float(*)(void**, void*, void*);
using KillXpGrantWeaponFn = void(*)(void*, uint64_t, uint64_t, uint64_t, void*);
using KillXpHuntPassAddFn = void(*)(void*, uint64_t);
static KillXpWeaponLevelFn OrigKillXpWeaponLevel = nullptr;
static KillXpBaseFn OrigKillXpBase = nullptr;
static KillXpAmountFn OrigKillXpAmount = nullptr;
static KillXpGrantWeaponFn OrigKillXpGrantWeapon = nullptr;
static KillXpHuntPassAddFn OrigKillXpHuntPassAdd = nullptr;
static std::atomic<int> g_KillXpBudget{ 0 };
// FUN_141a57a50 has 30 callers (UI getters among them); it is logged only while the kill-XP base runs on this thread.
static thread_local int g_KillXpBaseDepth = 0;

static bool MpKillXpLogBudget() { return g_KillXpBudget.fetch_add(1, std::memory_order_relaxed) < 400; }

// FCreatureXPTuningData { int32 BaseXP; int32 MinXP; float XPBonus; float XPPenalty; int32 NumXPBonusLevels;
// int32 NumXPPenaltyLevels; } at the start of FBehemothXPTuningData (StarBonus TMap<int32,float> at +0x18, Num at +0x20).
static std::string MpKillXpTuning(void* Tuning) {
    if (!Tuning || !IsReadablePointer(Tuning, 0x28)) return "tuning=unreadable";
    const uintptr_t T = reinterpret_cast<uintptr_t>(Tuning);
    return "tuning{base=" + std::to_string(*reinterpret_cast<int32_t*>(T + 0x00))
        + " min=" + std::to_string(*reinterpret_cast<int32_t*>(T + 0x04))
        + " bonus=" + std::to_string(*reinterpret_cast<float*>(T + 0x08))
        + " penalty=" + std::to_string(*reinterpret_cast<float*>(T + 0x0C))
        + " bonusLevels=" + std::to_string(*reinterpret_cast<int32_t*>(T + 0x10))
        + " penaltyLevels=" + std::to_string(*reinterpret_cast<int32_t*>(T + 0x14))
        + " starBonusEntries=" + std::to_string(*reinterpret_cast<int32_t*>(T + 0x20)) + "}";
}

static uint64_t KillXpWeaponLevelHook(void* Component, uint64_t Category, void* Out) {
    const uint64_t Ret = OrigKillXpWeaponLevel(Component, Category, Out);
    if (g_KillXpBaseDepth > 0 && MpKillXpLogBudget()) {
        std::string Fields = "out=unreadable";
        if (Out && IsReadablePointer(Out, 0x1C)) {
            const uintptr_t O = reinterpret_cast<uintptr_t>(Out);
            Fields = "out{flag=" + std::to_string(*reinterpret_cast<uint8_t*>(O)) + " level=" + std::to_string(*reinterpret_cast<int32_t*>(O + 4))
                + " q8=" + MpHex(*reinterpret_cast<uint64_t*>(O + 8)) + " q10=" + MpHex(*reinterpret_cast<uint64_t*>(O + 0x10))
                + " i18=" + std::to_string(*reinterpret_cast<int32_t*>(O + 0x18)) + "}";
        }
        MpLog("[KillXP] weaponLevel category=" + std::to_string(Category & 0xFF) + " ok=" + std::to_string(Ret & 0xFF) + " " + Fields
            + " component=" + MpPtr(Component));
    }
    return Ret;
}

static int32_t KillXpBaseHook(void* Component, void* Behemoth, void* Tuning) {
    ++g_KillXpBaseDepth;
    const int32_t Base = OrigKillXpBase(Component, Behemoth, Tuning);
    --g_KillXpBaseDepth;
    if (MpKillXpLogBudget()) {
        MpLog("[KillXP] base=" + std::to_string(Base) + " behemoth=" + (Behemoth ? SafeObjectNameForDiagnostic(Behemoth) : std::string("null"))
            + " " + MpKillXpTuning(Tuning));
    }
    return Base;
}

static float KillXpAmountHook(void** ComponentRef, void* Behemoth, void* Tuning) {
    const float Amount = OrigKillXpAmount(ComponentRef, Behemoth, Tuning);
    if (MpKillXpLogBudget()) {
        // The caller passes &tuning+0x20 for weapon XP and &tuning+0x88 for the Hunt Pass; name it by the struct offset.
        MpLog("[KillXP] amount=" + std::to_string(Amount) + " behemoth=" + (Behemoth ? SafeObjectNameForDiagnostic(Behemoth) : std::string("null"))
            + " tuning=" + MpPtr(Tuning));
    }
    return Amount;
}

static std::string MpProbeFName(const SDK::FName& Name);   // defined with the hunt pass probes

// [2026-10-11] The banking state GrantExperience (0x01A5FEA0) branches on for a capped weapon: UPlayerExperienceComponent
// BankingExperienceConfigTable +0x1C0, BankingConfigRowName +0x1C8 (None = no bank: XP over the cap is dropped),
// BankingLevelsUnlockedCount +0x1D0, BankingExperienceMultiplier +0x1D4. InitializeBankingUnlocks (0x01A666D0) is the only
// server writer, from the player's Slayer's Path (BankedXP_* nodes) when the journey loads and when a node unlocks.
static std::string MpKillXpBanking(void* Component) {
    if (!Component || !IsReadablePointer(Component, 0x1D8)) return "banking=unreadable";
    const uintptr_t C = reinterpret_cast<uintptr_t>(Component);
    return "banking{table=" + MpPtr(*reinterpret_cast<void**>(C + 0x1C0))
        + " row=" + MpProbeFName(*reinterpret_cast<const SDK::FName*>(C + 0x1C8))
        + " levels=" + std::to_string(*reinterpret_cast<int32_t*>(C + 0x1D0))
        + " multiplier=" + std::to_string(*reinterpret_cast<float*>(C + 0x1D4)) + "}";
}

static void KillXpGrantWeaponHook(void* Component, uint64_t Base, uint64_t Bonus, uint64_t Type, void* Out) {
    if (MpKillXpLogBudget()) {
        MpLog("[KillXP] GrantWeaponExperience base=" + std::to_string(static_cast<int32_t>(Base)) + " bonus=" + std::to_string(static_cast<int32_t>(Bonus))
            + " type=" + std::to_string(Type & 0xFF) + " " + MpKillXpBanking(Component) + " component=" + MpPtr(Component));
    }
    OrigKillXpGrantWeapon(Component, Base, Bonus, Type, Out);
}

static void KillXpHuntPassAddHook(void* HuntPass, uint64_t Amount) {
    if (MpKillXpLogBudget()) {
        MpLog("[KillXP] HuntPass add amount=" + std::to_string(static_cast<int32_t>(Amount)) + " component=" + MpPtr(HuntPass));
    }
    OrigKillXpHuntPassAdd(HuntPass, Amount);
}

static void InstallKillXpTrace() {
    if (MpExeRelativeFlagPresent(L"KILL_XP_TRACE_OFF.flag")) {
        MpLog("[KillXP] off (KILL_XP_TRACE_OFF.flag present)");
        return;
    }
    struct Target { uintptr_t Rva; void* Hook; void** Orig; const char* Name; };
    const Target Targets[] = {
        { 0x01A57A50, reinterpret_cast<void*>(&KillXpWeaponLevelHook), reinterpret_cast<void**>(&OrigKillXpWeaponLevel), "weapon level" },
        { 0x01A57F80, reinterpret_cast<void*>(&KillXpBaseHook), reinterpret_cast<void**>(&OrigKillXpBase), "base XP" },
        { 0x01A44EC0, reinterpret_cast<void*>(&KillXpAmountHook), reinterpret_cast<void**>(&OrigKillXpAmount), "kill XP amount" },
        { 0x01A62540, reinterpret_cast<void*>(&KillXpGrantWeaponHook), reinterpret_cast<void**>(&OrigKillXpGrantWeapon), "GrantWeaponExperience" },
        { 0x01A1BCF0, reinterpret_cast<void*>(&KillXpHuntPassAddHook), reinterpret_cast<void**>(&OrigKillXpHuntPassAdd), "Hunt Pass add" },
    };
    for (const Target& T : Targets) {
        if (ResolveFunctionStartRva(T.Rva) != T.Rva) {
            MpLog(std::string("[KillXP] ") + T.Name + " NOT hooked: +" + MpHex(T.Rva) + " is not a function entry in this build's .pdata");
            continue;
        }
        void* Address = reinterpret_cast<void*>(Globals::BaseAddress + T.Rva);
        const MH_STATUS Create = MH_CreateHook(Address, T.Hook, reinterpret_cast<LPVOID*>(T.Orig));
        const MH_STATUS Enable = Create == MH_OK ? MH_EnableHook(Address) : Create;
        MpLog(std::string("[KillXP] ") + T.Name + " hook (+" + MpHex(T.Rva) + ") create=" + MH_StatusToString(Create)
            + " enable=" + MH_StatusToString(Enable));
    }
}

static void InstallGrantTraceHook() {
    if (MpExeRelativeFlagPresent(L"GRANT_TRACE_OFF.flag")) {
        MpLog("[GrantTrace] off (GRANT_TRACE_OFF.flag present)");
        return;
    }
    InstallCooldownTraceHook();
    constexpr uintptr_t kTxnBuildRva = 0x00DBB560;
    if (ResolveFunctionStartRva(kTxnBuildRva) != kTxnBuildRva) {
        MpLog("[GrantTrace] NOT installed: +0x" + MpHex(kTxnBuildRva) + " is not a function entry in this build's .pdata");
        return;
    }
    void* Target = reinterpret_cast<void*>(Globals::BaseAddress + kTxnBuildRva);
    const MH_STATUS Create = MH_CreateHook(Target, reinterpret_cast<void*>(&InventoryTxnBuildHook), reinterpret_cast<LPVOID*>(&OrigInventoryTxnBuild));
    const MH_STATUS Enable = Create == MH_OK ? MH_EnableHook(Target) : Create;
    MpLog(std::string("[GrantTrace] inventory transaction builder hook (+0xDBB560) create=") + MH_StatusToString(Create)
        + " enable=" + MH_StatusToString(Enable));
}

// ============================================================================
// [1.14.7 HEADLESS AUDIO 2026-10-03] A dedicated hub must not produce sound. Window suppression
// alone left the process initialising audio, so launching a hub played the game's launch audio on
// the host machine. The audible path is Wwise, not UE's audio device:
//   [LogAkAudio] Number of audio channels found: 7.1
//   [LogAkAudio] Audio Banks - Of 1 banks, 1 were loaded for the game state change.
//   [LogAudio]   Audio Device Manager Initialization Failed!   (UE's own device fails either way)
// and UE's -nosound (now passed by the DeployServer) does NOT cover the plugin.
//
// FUN_1417b1620 is the Wwise OUTPUT-DEVICE initialisation: it calls AK::StreamMgr::CreateDevice and
// FUN_1417db1b0 to set the output up, guarded by a once-flag (DAT_146d1f3d0), and has exactly one
// direct call site (FUN_1417bdcd0). Returning without calling it leaves no output device, so the
// sound engine has nowhere to play - which is what a dedicated server wants.
// HEADLESS_AUDIO_DISABLE.flag is deliberately NOT used: silence is the default for the server role.
// Set ENABLE_SERVER_AUDIO.flag next to the game executable to restore the original behaviour.
using WwiseDeviceInitFn = void(*)(void*);
static WwiseDeviceInitFn OrigWwiseDeviceInit = nullptr;

static void WwiseDeviceInitHook(void* This) {
    static volatile LONG logged = 0;
    if (InterlockedCompareExchange(&logged, 1, 0) == 0) {
        MpLog("[HeadlessAudio] Wwise output-device init suppressed (server role) this=" + MpPtr(This));
    }
    // Intentionally does not call the original.
}

static void InstallHeadlessAudioHook() {
    // MEASURED (round 25): suppressing this device init DOES silence the hub (no "Number of audio
    // channels found", no "Audio Banks ... loaded"), but the process then dies during boot:
    //     [LogWindows][Error] Fatal error!
    //     Unhandled Exception: EXCEPTION_ACCESS_VIOLATION writing address 0x00000000000000a4
    // i.e. something downstream writes through a pointer the skipped init should have set. Audio is
    // therefore left INTACT by default and this is opt-in for further work. The promising safer route
    // is to let the device initialise but suppress sound POSTING (the AkSoundEngine post-event entry)
    // so nothing is ever played, instead of removing the device underneath the engine.
    if (!MpExeRelativeFlagPresent(L"DISABLE_SERVER_AUDIO.flag")) {
        MpLog("[HeadlessAudio] audio left intact (DISABLE_SERVER_AUDIO.flag not present; the device-init"
            " suppression was measured to crash the hub)");
        return;
    }
    MH_STATUS Create = MH_CreateHook((void*)(Globals::BaseAddress + 0x017B1620),
        WwiseDeviceInitHook, reinterpret_cast<LPVOID*>(&OrigWwiseDeviceInit));
    MH_STATUS Enable = Create == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x017B1620)) : Create;
    MpLog(std::string("[HeadlessAudio] Wwise device init hook (+0x17B1620) create=")
        + MH_StatusToString(Create) + " enable=" + MH_StatusToString(Enable));
}

// ============================================================================
// [1.14.7 PROGRESSION CACHE PROBE 2026-10-03] FUN_141902E60 is the lookup the progression component
// uses for its "cached progression configs" (a global map keyed by track name). Its signature is
// undefined8* FUN_141902E60(undefined8* Out): it returns Out and writes the found config (or null)
// into Out[0]. ProgressionConfigurationReady() (0x01A78080, one of the four readiness steps that
// CompleteLoadInternal runs) calls it, and the client warns
//   GetProgressionConfiguration - Track <name> not found in the cached progression configs.
// This read-only probe records whether the lookup EVER finds anything, which decides between
// "the cache is never populated" and "the cache is populated but the wrong tracks are asked for".
using ProgCacheLookupFn = void*(*)(void*);
static ProgCacheLookupFn OrigProgCacheLookup = nullptr;

static void* ProgCacheLookupHook(void* Out) {
    void* Result = OrigProgCacheLookup ? OrigProgCacheLookup(Out) : nullptr;
    static std::atomic<int> s_cacheProbeSeq{ 0 };
    const int Seq = s_cacheProbeSeq.fetch_add(1, std::memory_order_relaxed);
    if (Seq < 40) {
        void* Found = nullptr;
        if (Out && IsReadablePointer(Out, sizeof(void*))) {
            Found = *reinterpret_cast<void**>(Out);
        }
        MpLog(std::string("[ProgCacheProbe] seq=") + std::to_string(Seq)
            + (Found ? " FOUND config=" : " MISS (cache empty) out=") + MpPtr(Found ? Found : Out));

        // [1.14.7 INTERFACE VTABLE DUMP 2026-10-03] FUN_1419053a0 - the configuration predicate that
        // ReadFromBackend waits on - gets the online progression interface through this very lookup and then
        // calls its vtable +0x70 to ask "is the configuration loaded". Dumping the slots as RVAs lets the
        // query method (the one that issues the request and binds the completion) be identified and
        // decompiled instead of guessed at.
        static int s_vtableDumped = 0;
        if (s_vtableDumped == 0 && Found && Globals::BaseAddress && IsReadablePointer(Found, 0x08)) {
            s_vtableDumped = 1;
            // Flag gated, once: try the likely query slot (see the block comment on CallInterfaceQuerySlot).
            if (MpExeRelativeFlagPresent(L"CALL_IFACE_QUERY.flag")) {
                CallInterfaceQuerySlot(Found, 0x08);
            }
            const uintptr_t Vtable = *reinterpret_cast<uintptr_t*>(Found);
            if (IsReadablePointer(reinterpret_cast<void*>(Vtable), 0x90)) {
                MpLog("[IfaceVtable] interface=" + MpPtr(Found) + " vtableRVA=0x"
                    + MpHex(Vtable - Globals::BaseAddress));
                for (uintptr_t Off = 0; Off <= 0x88; Off += 0x08) {
                    const uintptr_t Slot = *reinterpret_cast<uintptr_t*>(Vtable + Off);
                    MpLog("[IfaceVtable]   +0x" + MpHex(Off) + " -> RVA 0x"
                        + MpHex(Slot - Globals::BaseAddress));
                }
            }
        }
    }
    return Result;
}

static void InstallProgressionCacheProbe() {
    MH_STATUS Create = MH_CreateHook((void*)(Globals::BaseAddress + 0x01902E60),
        ProgCacheLookupHook, reinterpret_cast<LPVOID*>(&OrigProgCacheLookup));
    MH_STATUS Enable = Create == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x01902E60)) : Create;
    MpLog(std::string("[ProgCacheProbe] cache lookup hook (+0x1902E60) create=")
        + MH_StatusToString(Create) + " enable=" + MH_StatusToString(Enable));
}

// ============================================================================
// [1.14.7 PROGRESSION READINESS PROBE 2026-10-03] FUN_141a69560 is the progression component's
// readiness predicate (24 lines, decompiled):
//
//   if (controller at +0x3e0 valid && controller->Role == 3)        // server authority
//       return flags[0x403] && flags[0x404] && flags[0x405] && flags[0x406];
//   else                                                            // client
//       return flags[0x404] && flags[0x406] && flags[0x2d9];
//
// UBountyComponent::GetNextBountyTokenGrantTime resolves the progression component from its own +0x84
// weak pointer, calls this, and on failure logs
//   "[%s] %s() - progression component not ready on player: %s"
// followed by
//   "[%s] %s() - failed to get season dates for player: %s"
// which leads to Disconnect -> LeavingMap. So these four bytes are the exact gate that still fails.
//
// The probe logs the four server flags and the predicate result; FORCE_PROGRESSION_READY.flag sets
// them (server role only) so the downstream path can be measured.
using ProgReadyFn = unsigned char(*)(void*);
static ProgReadyFn OrigProgReady = nullptr;

// ============================================================================
// [1.14.7 ACTIVE HUNT PASS 2026-10-03] The hunt pass component fails on this build with:
//   UHuntPassComponent::LoadComplete: Failed to hunt pass season for rowname None
//   UHuntPassComponent::LoadComplete: Main Hunt Pass 'none' is not valid or active
//   UHuntPassComponent::GetPlayerTotalXpForHuntPass: Failed to lookup hunt pass data for 'none'
// and UArchonGameInstance::FindActiveHuntPassRow (FUN_1418fd230) - the function that resolves the active
// hunt pass row and is the source of the OnActiveHuntPassFound event the progression component waits on -
// never runs (its own "finding row." log line is absent from a full hub run). Nothing else populates the
// game instance's ActiveHuntPassData, so the hunt pass season stays 'none', the season-table lookup uses
// an empty row name, the bounty component cannot get season dates and the hub leaves the map.
//
// This drives the game's own function once, on the GAME THREAD (the readiness predicate runs there), a
// couple of calls in - the same pattern that unblocked the progression configuration predicate. Flag
// gated: CALL_FIND_ACTIVE_HUNTPASS.flag.
using FindActiveHuntPassRowFn = void(*)(void*);
static FindActiveHuntPassRowFn OrigFindActiveHuntPassRow = nullptr;

static void CallFindActiveHuntPassRow(const char* Why) {
    if (g_archonGameInstanceForHuntPass == nullptr) {
        MpLog(std::string("[ActiveHuntPass] ") + Why + ": game instance not captured yet");
        return;
    }
    MpLog(std::string("[ActiveHuntPass] calling UArchonGameInstance::FindActiveHuntPassRow (") + Why
        + ") instance=" + MpPtr(g_archonGameInstanceForHuntPass));
    if (OrigFindActiveHuntPassRow) {
        OrigFindActiveHuntPassRow(g_archonGameInstanceForHuntPass);
    } else if (Globals::BaseAddress) {
        reinterpret_cast<FindActiveHuntPassRowFn>(Globals::BaseAddress + 0x018FD230)(
            g_archonGameInstanceForHuntPass);
    }
}

// [1.14.7 ACTIVE HUNT PASS PROBE 2026-10-03] FindActiveHuntPassRow (FUN_1418fd230) takes an id from the
// game instance via FUN_143e31050, looks it up in the cached progression configs with FUN_141902e60, and
// only proceeds when that lookup is non-null AND *(gameInstance+0x6e0) is non-null; the resolved row is
// stored at gameInstance+0x6d0 (zeroed on entry). This probe reads all of those around the call so the
// failing precondition is identified instead of guessed.
using FindActiveRowFn = void(*)(void*);
static FindActiveRowFn OrigFindActiveRow = nullptr;

// [1.14.7 WINDOW LOOKUP HOOK 2026-10-03] Direct calls to the cached config object's window lookup
// (vtable +0x88) returned ok=0 for every key, including keys the served config definitely contains - so
// the invocation was unreliable (calling convention or output layout). Hooking the real slot instead lets
// the game make the calls and only observes them.
using WindowLookupFn = bool(*)(void*, void*, void*, int);
static WindowLookupFn OrigWindowLookup = nullptr;
static volatile LONG g_windowLookupHooked = 0;

static bool WindowLookupHook(void* Config, void* Key, void* Out, int Flags) {
    const bool Ok = OrigWindowLookup ? OrigWindowLookup(Config, Key, Out, Flags) : false;
    static std::atomic<int> s_seq{ 0 };
    const int Seq = s_seq.fetch_add(1, std::memory_order_relaxed);
    // Log every SUCCESS, plus every lookup for a season id we added to the config (season43..season50),
    // so the cap cannot hide the answer for the newest seasons. The rest is counted only.
    bool Interesting = Ok;
    if (!Interesting && Key && IsReadablePointer(Key, 0x10)) {
        const uintptr_t StrPtr = *reinterpret_cast<uintptr_t*>(Key);
        const int32_t StrLen = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Key) + 0x08);
        if (StrPtr && StrLen > 0 && StrLen < 64
            && IsReadablePointer(reinterpret_cast<void*>(StrPtr), static_cast<size_t>(StrLen) * 2)) {
            const std::wstring W(reinterpret_cast<const wchar_t*>(StrPtr), static_cast<size_t>(StrLen - 1));
            if (W.rfind(L"season4", 0) == 0 || W.rfind(L"season5", 0) == 0) Interesting = true;
        }
    }
    if (Interesting || Seq < 4) {
        std::string KeyText = "<unreadable>";
        if (Key && IsReadablePointer(Key, 0x10)) {
            const uintptr_t StrPtr = *reinterpret_cast<uintptr_t*>(Key);
            const int32_t StrLen = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Key) + 0x08);
            if (StrPtr && StrLen > 0 && StrLen < 256
                && IsReadablePointer(reinterpret_cast<void*>(StrPtr), static_cast<size_t>(StrLen) * 2)) {
                KeyText = MpNarrow(std::wstring(reinterpret_cast<const wchar_t*>(StrPtr), static_cast<size_t>(StrLen - 1)));
            } else {
                KeyText = "<len=" + std::to_string(StrLen) + ">";
            }
        }
        long long Start = 0, End = 0;
        int Flag = -1;
        if (Out && IsReadablePointer(Out, 0x18)) {
            Start = *reinterpret_cast<long long*>(Out);
            End = *reinterpret_cast<long long*>(reinterpret_cast<uintptr_t>(Out) + 0x08);
            Flag = *reinterpret_cast<unsigned char*>(reinterpret_cast<uintptr_t>(Out) + 0x10);
        }
        MpLog("[WindowLookup] seq=" + std::to_string(Seq)
            + " key='" + KeyText + "'"
            + " flags=" + std::to_string(Flags)
            + " ok=" + std::to_string(Ok ? 1 : 0)
            + " start=" + std::to_string(Start)
            + " end=" + std::to_string(End)
            + " flag=" + std::to_string(Flag));
    }
    return Ok;
}

static void TryHookWindowLookup(void* ConfigObject) {
    if (!ConfigObject || InterlockedCompareExchange(&g_windowLookupHooked, 1, 0) != 0) return;
    if (!IsReadablePointer(ConfigObject, 0x08)) return;
    const uintptr_t Vtable = *reinterpret_cast<uintptr_t*>(ConfigObject);
    if (!IsReadablePointer(reinterpret_cast<void*>(Vtable), 0x90)) return;
    void* Target = reinterpret_cast<void*>(*reinterpret_cast<uintptr_t*>(Vtable + 0x88));
    MH_STATUS Create = MH_CreateHook(Target, WindowLookupHook, reinterpret_cast<LPVOID*>(&OrigWindowLookup));
    MH_STATUS Enable = Create == MH_OK ? MH_EnableHook(Target) : Create;
    const uintptr_t TargetRva = reinterpret_cast<uintptr_t>(Target) - Globals::BaseAddress;
    MpLog("[WindowLookup] hook target=" + MpPtr(Target) + " RVA=0x" + MpHex(TargetRva)
        + " configVtable=0x" + MpHex(Vtable) + " create=" + MH_StatusToString(Create)
        + " enable=" + MH_StatusToString(Enable));
}

// [1.14.7 ACTIVE SEASON OVERRIDE 2026-10-03] UHuntPassComponent::LoadComplete resolves its season with
//   lVar10 = FUN_1418e6c70(lVar10, *(undefined8 *)(gameInstance + 0x6d0), ...);
// i.e. it reads the season id from gameInstance+0x6d0 - the very field FindActiveHuntPassRow fails to set
// (its per-season config lookup returns ok=0 for every season; section AV). With the field empty the
// lookup uses row 'None', the component falls back to 'none', the hunt pass season never resolves, the
// bounty component cannot get season dates and the hub leaves the map.
// This writes a season id the game's own table contains and marks enabled (season43..season50, section AT)
// into that field, using the engine allocator so any later free stays valid.
// NOTE (2026-10-03): the first version of this wrote a 16-byte FString (data pointer + Num + Max) into the
// field. That crashed the hub one second later - EXCEPTION_ACCESS_VIOLATION reading 0xffffffffffffffff -
// because the field is only EIGHT bytes: FindActiveHuntPassRow stores exactly one qword there
// (*(longlong *)(entryIndex * 0x18 + *arrayPtr), i.e. entry[0]), so the extra 8 bytes clobbered +0x6d8.
// The value is copied verbatim from the row entry the game itself would have stored.
static void SetGameInstanceActiveSeason(void* GameInstance, uintptr_t RowEntryValue) {
    if (!GameInstance || RowEntryValue == 0) return;
    const uintptr_t Field = reinterpret_cast<uintptr_t>(GameInstance) + 0x6D0;
    *reinterpret_cast<uintptr_t*>(Field) = RowEntryValue;
    MpLog("[ActiveSeason] wrote gameInstance+0x6d0 = " + MpPtr(reinterpret_cast<void*>(RowEntryValue))
        + " (8 bytes, copied from the game's own row entry)");
}

// [1.14.7 LOADCOMPLETE PROBE 2026-10-03] UHuntPassComponent::LoadComplete (FUN_141a19450) resolves its
// season with
//   lVar10 = FUN_1418e6c70(lVar10, *(undefined8 *)(*(longlong *)(param_1 + 0xd0) + 0x6d0), &DAT_145034784, 1);
// so this probe reads gameInstance+0x6d0 (and the value it holds) at the moment LoadComplete runs, which
// says whether the value written by the FORCE_ACTIVE_SEASON override survives to the lookup or is re-zeroed
// by another FindActiveHuntPassRow call in between.
using LoadCompleteFn = void(*)(void*);
static LoadCompleteFn OrigLoadComplete = nullptr;

static void LoadCompleteProbeHook(void* Component) {
    static std::atomic<int> s_seq{ 0 };
    const int Seq = s_seq.fetch_add(1, std::memory_order_relaxed);
    if (Seq < 4 && Component && IsReadablePointer(Component, 0xD8)) {
        void* Instance = *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Component) + 0xD0);
        uintptr_t SeasonField = 0;
        if (Instance && IsReadablePointer(Instance, 0x6D8)) {
            SeasonField = *reinterpret_cast<uintptr_t*>(reinterpret_cast<uintptr_t>(Instance) + 0x6D0);
        }
        MpLog("[LoadCompleteProbe] seq=" + std::to_string(Seq)
            + " component=" + MpPtr(Component)
            + " instance=" + MpPtr(Instance)
            + " gameInstance+0x6d0=" + std::to_string(SeasonField));
    }
    if (OrigLoadComplete) OrigLoadComplete(Component);
}

static void InstallLoadCompleteProbe() {
    MH_STATUS Create = MH_CreateHook((void*)(Globals::BaseAddress + 0x01A19450),
        LoadCompleteProbeHook, reinterpret_cast<LPVOID*>(&OrigLoadComplete));
    MH_STATUS Enable = Create == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x01A19450)) : Create;
    MpLog(std::string("[LoadCompleteProbe] hook (+0x1A19450) create=") + MH_StatusToString(Create)
        + " enable=" + MH_StatusToString(Enable));
}

// [1.14.7 FINDROW PROBE 2026-10-03] FUN_1418E6C70 is UDataTable::FindRow - the function behind every
// "requested invalid row 'None'" / "specified no row" message in this investigation. UHuntPassComponent
// ::LoadComplete calls it with the season id taken from gameInstance+0x6d0. Logging the (table, name,
// result) triple shows exactly which name it searches for and whether the table contains it, which is the
// last unknown in the hunt pass chain.
using FindRowFn = void*(*)(void*, unsigned long long, void*, char);
static FindRowFn OrigFindRow = nullptr;

// [1.14.7 FIX 2026-10-03] This hook originally returned void while UDataTable::FindRow returns a row
// pointer. The caller then received whatever was left in RAX (observed: 1), took the non-null branch and
// dereferenced [RAX+0x10], which is the recorded EXCEPTION_ACCESS_VIOLATION reading 0x11 at RVA 0x01A19CBF.
// The return value MUST be preserved.
static void* FindRowProbeHook(void* Table, unsigned long long RowName, void* Out, char Param4) {
    void* Result = OrigFindRow ? OrigFindRow(Table, RowName, Out, Param4) : nullptr;
    static std::atomic<int> s_seq{ 0 };
    const int Seq = s_seq.fetch_add(1, std::memory_order_relaxed);
    if (Seq < 14) {
        MpLog("[FindRowProbe] seq=" + std::to_string(Seq)
            + " table=" + MpPtr(Table)
            + " nameLow=" + std::to_string(static_cast<unsigned int>(RowName & 0xFFFFFFFFu))
            + " nameHigh=" + std::to_string(static_cast<unsigned int>(RowName >> 32))
            + " p4=" + std::to_string(static_cast<int>(Param4))
            + " result=" + MpPtr(Result));
    }
    return Result;
}

static void InstallFindRowProbe() {
    MH_STATUS Create = MH_CreateHook((void*)(Globals::BaseAddress + 0x018E6C70),
        FindRowProbeHook, reinterpret_cast<LPVOID*>(&OrigFindRow));
    MH_STATUS Enable = Create == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x018E6C70)) : Create;
    MpLog(std::string("[FindRowProbe] hook (+0x18E6C70) create=") + MH_StatusToString(Create)
        + " enable=" + MH_StatusToString(Enable));
}

// [1.14.7 CONFIG CALLBACK PROBE 2026-10-03] FUN_140E73D40 is the completion of the progression
// configuration query (it references the "OnQueryProgressionConfigurationComplete" string) and it is what
// populates the online progression interface's configuration map at interface+0x30 - the map the season
// lookup reads through the virtual at 0x00E5E910. Logging whether it runs, and what the interface holds
// afterwards, settles whether the configuration is ever populated - the question the season failure reduces
// to.
using ConfigCompleteFn = void(*)(long long, void*, long long*, void*, long long*);
static ConfigCompleteFn OrigConfigComplete = nullptr;

static void ConfigCompleteProbeHook(long long Interface, void* P2, long long* P3, void* P4, long long* P5) {
    static std::atomic<int> s_seq{ 0 };
    const int Seq = s_seq.fetch_add(1, std::memory_order_relaxed);
    if (Seq < 4) {
        MpLog("[ConfigCompleteProbe] seq=" + std::to_string(Seq)
            + " ENTER interface=" + MpPtr(reinterpret_cast<void*>(Interface)));
    }
    if (OrigConfigComplete) OrigConfigComplete(Interface, P2, P3, P4, P5);
    if (Seq < 4) {
        std::string Fields = "<unreadable>";
        if (IsReadablePointer(reinterpret_cast<void*>(Interface), 0x48)) {
            Fields = "";
            for (int Off = 0x28; Off <= 0x40; Off += 8) {
                Fields += " +0x" + std::to_string(Off) + "="
                    + MpPtr(reinterpret_cast<void*>(SafeReadPtr(Interface + Off, 0x00)));
            }
        }
        MpLog("[ConfigCompleteProbe] seq=" + std::to_string(Seq) + " AFTER" + Fields);
    }
}

static void InstallConfigCompleteProbe() {
    MH_STATUS Create = MH_CreateHook((void*)(Globals::BaseAddress + 0x00E73D40),
        ConfigCompleteProbeHook, reinterpret_cast<LPVOID*>(&OrigConfigComplete));
    MH_STATUS Enable = Create == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x00E73D40)) : Create;
    MpLog(std::string("[ConfigCompleteProbe] hook (+0xE73D40) create=") + MH_StatusToString(Create)
        + " enable=" + MH_StatusToString(Enable));
}

// [1.14.7 INTERFACE QUERY CALL 2026-10-03] The online progression interface's vtable was dumped (RVA
// 0x513E990): +0x70 -> 0xE62C80 is the "is the configuration loaded" check that FUN_1419053a0 calls, and
// +0x88 -> 0xE5E910 is the season window lookup (already hooked). The string "QueryProgressionConfiguration"
// is referenced at 0x140E7CB97 and 0x140E7CDE8, i.e. inside the function at slot +0x08 (0xE7C9A0) - the
// likely issuer of the configuration query. Nothing calls it in a normal hub run (the completion
// FUN_140E73D40 never fires), so this calls it once, flag gated, and logs the outcome; a new request in the
// backend log would confirm it is the query.
static void CallInterfaceQuerySlot(void* Interface, uintptr_t SlotOffset) {
    if (!Interface || !IsReadablePointer(Interface, 0x08)) return;
    const uintptr_t Vtable = *reinterpret_cast<uintptr_t*>(Interface);
    if (!IsReadablePointer(reinterpret_cast<void*>(Vtable), SlotOffset + 8)) return;
    const uintptr_t Target = *reinterpret_cast<uintptr_t*>(Vtable + SlotOffset);
    MpLog("[IfaceQueryCall] calling slot +0x" + MpHex(SlotOffset) + " RVA 0x"
        + MpHex(Target - Globals::BaseAddress) + " interface=" + MpPtr(Interface));
    using QueryFn = void(*)(void*);
    reinterpret_cast<QueryFn>(Target)(Interface);
    MpLog("[IfaceQueryCall] slot +0x" + MpHex(SlotOffset) + " returned");
}

// [1.14.7 CALLER SCAN 2026-10-03] The game-instance callback FUN_1418F0FD0 is called directly from
// 0x1418FBA34, inside a function Ghidra has not analysed. Scanning backwards for the usual int3 padding
// locates the function start so it can be hooked (and, if it never runs, called with the game instance -
// a signature we can infer from the callback it invokes).
static uintptr_t FindFunctionStart(uintptr_t CallSite, size_t MaxBack) {
    for (uintptr_t A = CallSite; A > CallSite - MaxBack; --A) {
        if (!IsReadablePointer(reinterpret_cast<void*>(A), 0x10)) break;
        const unsigned char* P = reinterpret_cast<const unsigned char*>(A);
        if (P[0] == 0xCC && P[1] == 0xCC && P[2] != 0xCC) return A + 2;
        if (P[0] == 0xCC && P[1] == 0xCC && P[2] == 0xCC && P[3] != 0xCC) return A + 3;
        if (P[0] == 0xCC && P[1] == 0x48 && (P[2] == 0x89 || P[2] == 0x8B)) return A + 1;
    }
    return 0;
}

using GameInstanceQueryFn = void(*)(void*);
static GameInstanceQueryFn OrigGameInstanceQuery = nullptr;

static void GameInstanceQueryHook(void* GameInstance) {
    static std::atomic<int> s_seq{ 0 };
    const int Seq = s_seq.fetch_add(1, std::memory_order_relaxed);
    if (Seq < 4) {
        MpLog("[GameInstanceQuery] CALLED seq=" + std::to_string(Seq)
            + " instance=" + MpPtr(GameInstance));
    }
    if (OrigGameInstanceQuery) OrigGameInstanceQuery(GameInstance);
}

static void InstallGameInstanceQueryHook() {
    const uintptr_t CallSite = Globals::BaseAddress + 0x018FBA34;
    const uintptr_t Start = FindFunctionStart(CallSite, 0x600);
    if (!Start) {
        MpLog("[GameInstanceQuery] could not locate the function start before 0x" + MpHex(CallSite - Globals::BaseAddress));
        return;
    }
    MH_STATUS Create = MH_CreateHook(reinterpret_cast<void*>(Start),
        GameInstanceQueryHook, reinterpret_cast<LPVOID*>(&OrigGameInstanceQuery));
    MH_STATUS Enable = Create == MH_OK ? MH_EnableHook(reinterpret_cast<void*>(Start)) : Create;
    MpLog(std::string("[GameInstanceQuery] hook start RVA 0x") + MpHex(Start - Globals::BaseAddress)
        + " create=" + MH_StatusToString(Create) + " enable=" + MH_StatusToString(Enable));
}

// [1.14.7 FEATURE FLAG DUMP 2026-10-03] SDK: UFeatureFlag derives from UObject and carries
//   TMap<EFeatureBranches,bool> PerBranchSettings;          // 0x28
//   TMap<ENativeBuildConfiguration,bool> PerConfigurationSettings;  // 0x78
//   TMap<FName,bool> PerEnvironmentSettings;                // 0xC8
//   bool bEnabled;                                          // 0x118   <- the master switch
// and the hunt pass season is selected through a feature flag (GetFeatureFlagCurrentHuntPassSeasonData).
// Enumerating the loaded flags with their bEnabled state shows whether a season-related flag is simply off,
// which would be a one-byte runtime fix rather than a protocol problem.
static void DumpFeatureFlags(const char* Tag) {
    static std::atomic<int> s_done{ 0 };
    if (s_done.fetch_add(1, std::memory_order_relaxed) != 0) return;
    if (!SDK::UObject::GObjects) {
        MpLog("[FeatureFlags] GObjects unavailable");
        return;
    }
    const int32_t Count = SDK::UObject::GObjects->Num();
    MpLog(std::string("[FeatureFlags] ") + Tag + " objects=" + std::to_string(Count));
    int Found = 0;
    int Disabled = 0;
    int Logged = 0;
    for (int32_t i = 0; i < Count && Found < 600; ++i) {
        SDK::UObject* Obj = SDK::UObject::GObjects->GetByIndex(i);
        if (!Obj) continue;
        if (!Obj->IsA(SDK::UFeatureFlag::StaticClass())) continue;
        const bool Enabled = *reinterpret_cast<bool*>(reinterpret_cast<uintptr_t>(Obj) + 0x118);
        if (!Enabled) Disabled++;
        Found++;
        // Log every blueprint feature flag (the *_bpff_C family, which is where season-style flags live) and
        // every flag whose name mentions season/hunt/pass/event, plus the first ten others for context.
        // [2026-10-10] Also progression/network: ProgressionNetworkOptimizationsFeature (class getter 0x1424B1490) gates
        // the hunt pass grant path FUN_140E9F090. Called once per process on servers (first readiness check) and on the
        // client (first arrival census).
        std::string Name = Obj->GetName();
        const bool Interesting = Name.find("bpff") != std::string::npos
            || Name.find("season") != std::string::npos
            || Name.find("Season") != std::string::npos
            || Name.find("hunt") != std::string::npos
            || Name.find("Hunt") != std::string::npos
            || Name.find("pass") != std::string::npos
            || Name.find("Pass") != std::string::npos
            || Name.find("event") != std::string::npos
            || Name.find("Event") != std::string::npos
            || Name.find("Progression") != std::string::npos
            || Name.find("progression") != std::string::npos
            || Name.find("Network") != std::string::npos;
        if (Interesting || Logged < 10) {
            MpLog("[FeatureFlags]   " + Name + " bEnabled=" + std::to_string(Enabled ? 1 : 0));
            if (!Interesting) Logged++;
        }
    }
    MpLog("[FeatureFlags] total=" + std::to_string(Found) + " disabled=" + std::to_string(Disabled));
}

// ============================================================================
// [1.14.7 DIAG 2026-10-10] Hunt pass and fountain probes: [HuntPassProbe] / [CoinTossProbe] (client, arrival census)
// and [HuntPassState] (server tick). Read-only: no field is written and no native function is called, except the
// reflected KismetTextLibrary.Conv_TextToString that turns the season-table texts into strings (client, game thread,
// outermost ProcessEvent). Layouts from the SDK:
//   AArchonPlayerController::HuntPassComponent +0x730 (Archon_classes.hpp)
//   UHuntPassComponent: MainHuntPassId +0x1B4 / SelectedHuntPassId +0x1BC (FName), MainHuntPassSeasonEndDate +0x1C8
//     (FDateTime), RefreshCount +0x1D0, bSelectedPassActive +0x1D4, bReplicated +0x1D5, bDidAutoClaimRewardsWhenLoading
//     +0x1D6, ActiveHuntPassData +0x1D8 = TArray<FReplicatedHuntPassData> (0x1C each: FName ID; bool bIsPrestige,
//     bIsCompleted, bHasPremium; int32 Rank, ConfirmedRank, ConfirmedPremiumRank, RankProgress)
//   UArchonGameInstance: +0x6D0 is SDK padding; FindActiveHuntPassRow (FUN_1418fd230) stores qword 0 of the active row's
//     RowMap entry there, i.e. the row-name FName (see SetGameInstanceActiveSeason). HuntPassSeasonTable +0x6E0.
//   FHuntPassSeasonDataTable (0x270): base FOnlineProgressionTrackTableData { ProgressionTrack +0x08 (FString),
//     StartDate +0x30, EndDate +0x38 }, IsMainHuntPassSeason +0x78, SeasonTitle +0x80, HuntRewardItemId +0x118,
//     HuntRewardItemAmount +0x128, ProgressPerGatherable +0x160, bAvailableInCurrentBuild +0x164, Assets +0x228,
//     OverallSeasonName +0x258.
// Note IsReadablePointer insists on 8-byte alignment, so 4-aligned fields (the FNames, the 0x1C array entries) are
// covered by checking their 8-aligned owner over the whole range instead.

// FString -> printable ASCII (quotes and non-ASCII become '?'), capped.
static std::string MpProbeFString(const void* FStr, size_t MaxChars = 160) {
    if (!FStr || !IsReadablePointer(FStr, 0x10)) return "<unreadable>";
    const wchar_t* Data = *reinterpret_cast<const wchar_t* const*>(FStr);
    const int32_t Num = *reinterpret_cast<const int32_t*>(reinterpret_cast<uintptr_t>(FStr) + 0x08);
    const int32_t Max = *reinterpret_cast<const int32_t*>(reinterpret_cast<uintptr_t>(FStr) + 0x0C);
    if (!Data || Num <= 0) return "";
    if (Num > 32768 || Max < Num || !IsReadablePointer(Data, static_cast<size_t>(Num) * sizeof(wchar_t))) {
        return "<bad fstring num=" + std::to_string(Num) + ">";
    }
    std::string Out;
    for (int32_t i = 0; i < Num && Out.size() < MaxChars; ++i) {
        const wchar_t C = Data[i];
        if (C == L'\0') break;
        Out += (C >= 0x20 && C < 0x7F && C != L'"') ? static_cast<char>(C) : '?';
    }
    return Out;
}

// FName by value. An FNameEntryId is block (bits 16..28) | offset; anything outside that range prints raw.
static std::string MpProbeFName(const SDK::FName& Name) {
    if (Name.ComparisonIndex == 0 && Name.Number == 0) return "None";
    if (Name.ComparisonIndex < 0 || Name.ComparisonIndex >= 0x20000000) {
        uint64_t Raw = 0;
        std::memcpy(&Raw, &Name, sizeof(Raw));
        return "<fname " + MpHex(Raw) + ">";
    }
    return Name.ToString();
}

// No objects with destructors in this frame (the SDK's FText/FString have none), so __try is legal (C2712).
static bool MpConvTextToStringGuarded(const SDK::FText* Text, SDK::FString* Out) {
    __try {
        *Out = SDK::UKismetTextLibrary::Conv_TextToString(*Text);
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

// FText -> string through the reflected Conv_TextToString (FText::ToString, which also resolves localized texts; the
// SDK's FText::ToString reads TextData+0x28, which is only right for generated texts). The caller must be on the game
// thread at the outermost ProcessEvent (the arrival census is): the nested call re-enters the client hook at depth 2,
// where none of the census/pump work runs. "<text>" whenever the text or the function is not usable. The returned
// FString was allocated by the native body and is released with MpEngineFree.
static std::string MpProbeText(const SDK::FText* Text) {
    if (!Text || !IsReadablePointer(Text, sizeof(SDK::FText))) return "<text>";
    const void* TextData = *reinterpret_cast<void* const*>(Text);
    if (!TextData || !IsReadablePointer(TextData, 0x10)) return "<text>";
    static int s_kismetReady = -1;
    if (s_kismetReady < 0) {
        SDK::UClass* Cls = SDK::UKismetTextLibrary::StaticClass();
        s_kismetReady = (Cls && IsRegisteredLiveObject(Cls) && SDK::UKismetTextLibrary::GetDefaultObj()
            && Cls->GetFunction("KismetTextLibrary", "Conv_TextToString")) ? 1 : 0;
        if (s_kismetReady != 1) MpLog("[HuntPassProbe] KismetTextLibrary.Conv_TextToString unavailable; texts print as <text>");
    }
    if (s_kismetReady != 1) return "<text>";
    SDK::FString Result;
    if (!MpConvTextToStringGuarded(Text, &Result)) return "<text-fault>";
    const std::string Out = MpProbeFString(&Result, 96);
    MpEngineFree(*reinterpret_cast<void**>(&Result));
    return Out;
}

// The game instance's season table (+0x6E0), only when it is live and its row struct really is FHuntPassSeasonDataTable.
static SDK::UDataTable* MpHuntPassSeasonTable(SDK::UObject* GameInstance, std::string& Why) {
    if (!GameInstance || !IsReadablePointer(GameInstance, 0x6F0)) { Why = "game instance unreadable"; return nullptr; }
    auto* Table = reinterpret_cast<SDK::UDataTable*>(SafeReadPtr(reinterpret_cast<uintptr_t>(GameInstance), 0x6E0));
    if (!Table || !IsReadablePointer(Table, sizeof(SDK::UDataTable)) || !IsRegisteredLiveObject(Table)
        || !MpIsAGuarded(Table, SDK::UDataTable::StaticClass())) {
        Why = "no live table at +0x6E0";
        return nullptr;
    }
    SDK::UScriptStruct* RowStruct = Table->RowStruct;
    if (!RowStruct || !IsReadablePointer(RowStruct, 0x60) || !IsRegisteredLiveObject(RowStruct)
        || RowStruct->GetName() != "HuntPassSeasonDataTable"
        || RowStruct->Size < static_cast<int32_t>(sizeof(SDK::FHuntPassSeasonDataTable))) {
        Why = "row struct is not HuntPassSeasonDataTable";
        return nullptr;
    }
    const int32_t Rows = Table->RowMap.Num();
    if (Rows < 0 || Rows > 2000) {
        Why = "implausible row count " + std::to_string(Rows);
        return nullptr;
    }
    return Table;
}

struct MpHuntPassView {
    bool Ok = false;
    std::string Main;
    std::string Selected;
    std::string MainEnd;
    uint32_t RefreshCount = 0;
    int SelectedActive = -1;
    int Replicated = -1;
    int AutoClaimed = -1;
    int32_t ActiveCount = -1;
    std::string Passes;             // every ActiveHuntPassData entry
    std::string SelectedProgress;   // rank/confirmed/progress of the entry whose ID is SelectedHuntPassId
};

static MpHuntPassView MpReadHuntPassComponent(SDK::UObject* Component) {
    MpHuntPassView V;
    if (!Component || !IsReadablePointer(Component, 0x1E8) || !IsRegisteredLiveObject(Component)
        || !MpIsAGuarded(Component, SDK::UHuntPassComponent::StaticClass())) {
        return V;
    }
    const auto* HP = reinterpret_cast<const SDK::UHuntPassComponent*>(Component);
    int64_t EndTicks = 0;
    std::memcpy(&EndTicks, &HP->MainHuntPassSeasonEndDate, sizeof(EndTicks));
    V.Main = MpProbeFName(HP->MainHuntPassId);
    V.Selected = MpProbeFName(HP->SelectedHuntPassId);
    V.MainEnd = EndTicks ? MpTicksToIso(EndTicks) : std::string("0");
    V.RefreshCount = HP->RefreshCount;
    V.SelectedActive = *reinterpret_cast<const uint8_t*>(&HP->bSelectedPassActive);
    V.Replicated = *reinterpret_cast<const uint8_t*>(&HP->bReplicated);
    V.AutoClaimed = *reinterpret_cast<const uint8_t*>(&HP->bDidAutoClaimRewardsWhenLoading);

    const uintptr_t C = reinterpret_cast<uintptr_t>(Component);
    const uintptr_t Data = *reinterpret_cast<const uintptr_t*>(C + 0x1D8);
    const int32_t Num = *reinterpret_cast<const int32_t*>(C + 0x1E0);
    const int32_t Max = *reinterpret_cast<const int32_t*>(C + 0x1E4);
    constexpr size_t kStride = sizeof(SDK::FReplicatedHuntPassData);   // 0x1C
    V.ActiveCount = Num;
    if (Num < 0 || Num > 256 || Max < Num
        || (Num > 0 && (!Data || !IsReadablePointer(reinterpret_cast<void*>(Data), static_cast<size_t>(Num) * kStride)))) {
        V.Passes = "<unreadable num=" + std::to_string(Num) + ">";
    } else {
        for (int32_t i = 0; i < Num && i < 64; ++i) {
            const auto* E = reinterpret_cast<const SDK::FReplicatedHuntPassData*>(Data + static_cast<size_t>(i) * kStride);
            const std::string Progress = std::to_string(E->Rank) + "/" + std::to_string(E->ConfirmedRank)
                + "/" + std::to_string(E->RankProgress);
            V.Passes += std::string(i ? "; " : "") + MpProbeFName(E->ID)
                + " prestige=" + std::to_string(*reinterpret_cast<const uint8_t*>(&E->bIsPrestige))
                + " completed=" + std::to_string(*reinterpret_cast<const uint8_t*>(&E->bIsCompleted))
                + " premium=" + std::to_string(*reinterpret_cast<const uint8_t*>(&E->bHasPremium))
                + " rank=" + std::to_string(E->Rank) + " confirmed=" + std::to_string(E->ConfirmedRank)
                + " premiumConfirmed=" + std::to_string(E->ConfirmedPremiumRank)
                + " progress=" + std::to_string(E->RankProgress);
            if (V.SelectedProgress.empty() && E->ID == HP->SelectedHuntPassId) V.SelectedProgress = Progress;
        }
        if (Num > 64) V.Passes += "; ...";
    }
    if (V.SelectedProgress.empty()) V.SelectedProgress = "-";
    V.Ok = true;
    return V;
}

static void MpDumpHuntPassSeasonRows(SDK::UDataTable* Table, uint64_t ActiveRaw) {
    MpLog("[HuntPassProbe] season table " + SafeObjectNameForDiagnostic(Table) + " rows="
        + std::to_string(Table->RowMap.Num()) + " (once per process; ACTIVE = gameInstance+0x6D0)");
    int Logged = 0;
    for (auto& Pair : Table->RowMap) {
        if (Logged++ >= 400) break;
        uint64_t KeyRaw = 0;
        std::memcpy(&KeyRaw, &Pair.Key(), sizeof(KeyRaw));
        std::string Line = "[HuntPassProbe] row=" + MpProbeFName(Pair.Key())
            + ((ActiveRaw != 0 && KeyRaw == ActiveRaw) ? " ACTIVE" : "");
        const uint8_t* Row = Pair.Value();
        if (!Row || !IsReadablePointer(Row, sizeof(SDK::FHuntPassSeasonDataTable))) {
            MpLog(Line + " rowData=" + MpPtr(Row) + " unreadable");
            continue;
        }
        const auto* R = reinterpret_cast<const SDK::FHuntPassSeasonDataTable*>(Row);
        int64_t StartTicks = 0;
        int64_t EndTicks = 0;
        std::memcpy(&StartTicks, &R->StartDate, sizeof(StartTicks));
        std::memcpy(&EndTicks, &R->EndDate, sizeof(EndTicks));
        Line += " main=" + std::to_string(*reinterpret_cast<const uint8_t*>(&R->IsMainHuntPassSeason))
            + " availableInBuild=" + std::to_string(*reinterpret_cast<const uint8_t*>(&R->bAvailableInCurrentBuild))
            + " track=" + MpProbeFString(&R->ProgressionTrack, 64)
            + " start=" + MpTicksToIso(StartTicks) + " end=" + MpTicksToIso(EndTicks)
            + " title=\"" + MpProbeText(&R->SeasonTitle) + "\""
            + " overall=\"" + MpProbeText(&R->OverallSeasonName) + "\""
            + " assets=" + (R->Assets ? "1" : "0")
            + " perGatherable=" + std::to_string(R->ProgressPerGatherable)
            + " huntReward=" + MpProbeFString(&R->HuntRewardItemId, 64) + " x" + std::to_string(R->HuntRewardItemAmount);
        MpLog(Line);
    }
}

// Client, once per arrival (bounded): the game instance's active season, the local hunt pass component, and once per
// process every row of the season table.
static void MpHuntPassClientProbe(UObject* PC) {
    if (Globals::AmServer) return;
    static int s_runs = 0;
    if (++s_runs > 64) return;

    SDK::UObject* GameInstance = nullptr;
    SDK::UWorld* World = SDK::UWorld::GetWorld();
    if (World && IsReadablePointer(World, 0x188) && IsRegisteredLiveObject(World)) {
        SDK::UObject* Candidate = World->OwningGameInstance;
        if (Candidate && IsReadablePointer(Candidate, 0x6F0) && IsRegisteredLiveObject(Candidate)
            && MpIsAGuarded(Candidate, SDK::UArchonGameInstance::StaticClass())) {
            GameInstance = Candidate;
        }
    }
    uint64_t ActiveRaw = 0;
    if (GameInstance) {
        std::memcpy(&ActiveRaw, reinterpret_cast<const void*>(reinterpret_cast<uintptr_t>(GameInstance) + 0x6D0), sizeof(ActiveRaw));
    }
    std::string Why;
    SDK::UDataTable* Table = GameInstance ? MpHuntPassSeasonTable(GameInstance, Why) : nullptr;
    if (!GameInstance) Why = "no live UArchonGameInstance";
    // +0x6D0 is only named when it equals one of the table's row keys, which also proves it is a valid FName.
    std::string ActiveName = ActiveRaw ? "<not a row key>" : "None";
    if (Table && ActiveRaw) {
        for (auto& Pair : Table->RowMap) {
            uint64_t KeyRaw = 0;
            std::memcpy(&KeyRaw, &Pair.Key(), sizeof(KeyRaw));
            if (KeyRaw == ActiveRaw) {
                ActiveName = MpProbeFName(Pair.Key());
                break;
            }
        }
    }
    MpLog("[HuntPassProbe] arrival run=" + std::to_string(s_runs) + " pc=" + MpPtr(PC)
        + " gameInstance=" + MpPtr(GameInstance) + " activeSeason=" + ActiveName + " raw=" + MpHex(ActiveRaw)
        + " seasonTable=" + MpPtr(Table)
        + (Table ? " rows=" + std::to_string(Table->RowMap.Num()) : " (" + Why + ")"));

    SDK::UObject* Component = nullptr;
    if (PC && IsReadablePointer(PC, 0x738) && IsRegisteredLiveObject(PC)
        && MpIsAGuarded(PC, SDK::AArchonPlayerController::StaticClass())) {
        Component = reinterpret_cast<SDK::AArchonPlayerController*>(PC)->HuntPassComponent;
    }
    const MpHuntPassView V = MpReadHuntPassComponent(Component);
    if (!V.Ok) {
        MpLog("[HuntPassProbe] component=" + MpPtr(Component) + " unavailable (no live UHuntPassComponent at pc+0x730)");
    } else {
        MpLog("[HuntPassProbe] component=" + MpPtr(Component) + " main=" + V.Main + " selected=" + V.Selected
            + " mainSeasonEnd=" + V.MainEnd + " refreshCount=" + std::to_string(V.RefreshCount)
            + " selectedActive=" + std::to_string(V.SelectedActive) + " replicated=" + std::to_string(V.Replicated)
            + " autoClaimed=" + std::to_string(V.AutoClaimed) + " active=" + std::to_string(V.ActiveCount)
            + " passes=[" + V.Passes + "]");
    }

    static bool s_rowsDumped = false;
    if (!s_rowsDumped && Table) {
        s_rowsDumped = true;
        MpDumpHuntPassSeasonRows(Table, ActiveRaw);
    }
}

// Server, from GameEngineTickHook: every connected player's hunt pass component, at most every 10 s, one line per
// controller whose values changed since its last line.
static void MpHuntPassServerStateTick() {
    if (!Globals::AmServer || !Globals::Listening || !Networking::NetDriver) return;
    if (MpProductionLogProfile()) return;   // [2026-10-11 O3] read-only [HuntPassState] trace
    static uint64_t s_lastMs = 0;
    const uint64_t Now = GetTickCount64();
    if (s_lastMs != 0 && Now - s_lastMs < 10000) return;
    s_lastMs = Now;

    const uintptr_t Driver = reinterpret_cast<uintptr_t>(Networking::NetDriver);
    if (!IsReadablePointer(Networking::NetDriver, 0xA0)) return;
    auto** Connections = *reinterpret_cast<SDK::UNetConnection***>(Driver + 0x90);
    const int32_t Count = *reinterpret_cast<int32_t*>(Driver + 0x98);
    const int32_t Max = *reinterpret_cast<int32_t*>(Driver + 0x9C);
    if (!IsSanePointerArray(Connections, Count, Max, 1024)) return;

    static std::unordered_map<void*, std::string> s_lastState;   // game thread only
    std::unordered_map<void*, std::string> Seen;
    for (int32_t i = 0; i < Count; ++i) {
        SDK::UNetConnection* Conn = Connections[i];
        if (!Conn || !IsReadablePointer(Conn, 0x140)) continue;
        SDK::APlayerController* PC = Conn->PlayerController;
        if (!PC || !IsReadablePointer(PC, 0x738) || !IsRegisteredLiveObject(PC)
            || !MpIsAGuarded(PC, SDK::AArchonPlayerController::StaticClass())) {
            continue;
        }
        const MpHuntPassView V = MpReadHuntPassComponent(reinterpret_cast<SDK::AArchonPlayerController*>(PC)->HuntPassComponent);
        if (!V.Ok) continue;
        const std::string State = "main=" + V.Main + " selected=" + V.Selected + " active=" + std::to_string(V.ActiveCount)
            + " sel(rank/confirmed/progress)=" + V.SelectedProgress
            + " selectedActive=" + std::to_string(V.SelectedActive) + " refreshCount=" + std::to_string(V.RefreshCount)
            + " mainSeasonEnd=" + V.MainEnd;
        Seen[PC] = State;
        const auto It = s_lastState.find(PC);
        if (It != s_lastState.end() && It->second == State) continue;
        MpLog("[HuntPassState] pc=" + MpPtr(PC) + "/" + SafeObjectNameForDiagnostic(PC) + " " + State
            + " passes=[" + V.Passes + "]");
    }
    s_lastState.swap(Seen);   // controllers that left are forgotten, so a reused address logs again
}

// Client, at the arrival census until both are found (at most 6 arrivals): the fountain stinger's DailyBonusItemId
// (UCoinTossStinger +0x360 FString, on the native and the cointoss_stringer_bpw_C default objects) and the live
// UArchonActivitiesProgressionComponent: DailyBundleStoreQueryTag +0x150, DebugDailyBundleStoreQueryTag +0x160 (FString)
// and the bytes at +0x220/+0x221, which lie inside the SDK's unnamed Pad_210[0x6B8] (no field names available).
static void MpCoinTossClientProbe(UObject* PC) {
    if (Globals::AmServer || !UObject::GObjects) return;
    static bool s_done = false;
    static int s_attempts = 0;
    if (s_done || s_attempts >= 6) return;
    ++s_attempts;

    std::string Line = "[CoinTossProbe] attempt=" + std::to_string(s_attempts);
    SDK::UObject* NativeCdo = SDK::UCoinTossStinger::GetDefaultObj();
    if (NativeCdo && IsReadablePointer(NativeCdo, 0x370) && IsRegisteredLiveObject(NativeCdo)) {
        Line += " nativeDefault.DailyBonusItemId=\""
            + MpProbeFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(NativeCdo) + 0x360)) + "\"";
    } else {
        Line += " nativeDefault=unavailable";
    }
    bool StingerFound = false;
    SDK::UClass* StingerClass = SDK::UObject::FindClassFast("cointoss_stringer_bpw_C");
    if (StingerClass && IsReadablePointer(StingerClass, 0x120) && IsRegisteredLiveObject(StingerClass)) {
        SDK::UObject* Cdo = StingerClass->ClassDefaultObject;
        if (Cdo && IsReadablePointer(Cdo, 0x370) && IsRegisteredLiveObject(Cdo)
            && MpIsAGuarded(Cdo, SDK::UCoinTossStinger::StaticClass())) {
            StingerFound = true;
            Line += " " + SafeObjectNameForDiagnostic(Cdo) + ".DailyBonusItemId=\""
                + MpProbeFString(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(Cdo) + 0x360)) + "\"";
        } else {
            Line += " cointoss_stringer_bpw_C default object unavailable";
        }
    } else {
        Line += " cointoss_stringer_bpw_C not loaded";
    }

    int Found = 0;
    SDK::UClass* ActivitiesClass = SDK::UArchonActivitiesProgressionComponent::StaticClass();
    if (ActivitiesClass) {
        const int Count = UObject::GObjects->Num();
        for (int i = 0; i < Count && Found < 3; ++i) {
            UObject* Obj = UObject::GObjects->GetByIndex(i);
            if (!Obj || Obj->IsDefaultObject() || !MpIsAGuarded(Obj, ActivitiesClass)) continue;
            if (!IsReadablePointer(Obj, 0x228)) continue;
            ++Found;
            const uintptr_t A = reinterpret_cast<uintptr_t>(Obj);
            Line += " | activities=" + MpPtr(Obj) + " outer=" + SafeObjectNameForDiagnostic(Obj->Outer)
                + (Obj->Outer == PC ? " (local pc)" : "")
                + " DailyBundleStoreQueryTag=\"" + MpProbeFString(reinterpret_cast<void*>(A + 0x150)) + "\""
                + " DebugDailyBundleStoreQueryTag=\"" + MpProbeFString(reinterpret_cast<void*>(A + 0x160)) + "\""
                + " byte220=" + std::to_string(SafeReadU8At(A, 0x220))
                + " byte221=" + std::to_string(SafeReadU8At(A, 0x221));
        }
    }
    if (Found == 0) Line += " | no live UArchonActivitiesProgressionComponent";
    MpLog(Line);
    s_done = StingerFound && Found > 0;
}

// [1.14.7 HUNT PASS QUERY CALL 2026-10-03] Route 2 from section BC/BD: the progression configuration is
// never populated because nothing issues the query, and OnQueryProgressionConfigurationComplete (which
// fills the online progression interface's configuration map at +0x30) never runs. The SDK gives the exact
// signature:
//   void UArchonGameInstance::QueryCurrentHuntPassSeasonData(
//       const TDelegate<void(bool bHasData, const FHuntPassSeasonDataTable& HuntPassData)>& Event);
// and TDelegate<Ret(Args...)> is a 16-byte FScriptDelegate, so an unbound (zeroed) delegate is a valid
// argument: the callback simply will not fire, while the QUERY itself - the part that was missing - is
// issued. Called on the game thread from the readiness hook (always since 2026-10-16; CALL_HUNTPASS_QUERY.flag is no longer read).
static void CallHuntPassSeasonQuery() {
    void* GameInstance = g_archonGameInstanceForHuntPass;
    if (!GameInstance) {
        MpLog("[HuntPassQuery] game instance not captured yet");
        return;
    }
    MpLog("[HuntPassQuery] calling UArchonGameInstance::QueryCurrentHuntPassSeasonData (unbound delegate) instance="
        + MpPtr(GameInstance));
    SDK::UArchonGameInstance* GI = reinterpret_cast<SDK::UArchonGameInstance*>(GameInstance);
    SDK::TDelegate<void(bool, const SDK::FHuntPassSeasonDataTable&)> Event{};
    GI->QueryCurrentHuntPassSeasonData(Event);
    MpLog("[HuntPassQuery] returned");
}

// [1.14.7 MASTERY ARRAY PROBE 2026-10-03] FUN_1419fbcd0 (UHuntPassComponent::DoesHuntPassHaveUnclaimedRewards)
// matches the requested track id against an array on the component itself:
//   plVar13 = *(longlong **)(param_1 + 0x1d8);                          // array
//   plVar8  = *(int *)(param_1 + 0x1e0) * 0x1c + plVar13;               // count * stride 0x1c
//   if (*param_2 == *plVar7) { ... }                                    // id match
// and logs "Failed to lookup hunt pass data for '%s'" when nothing matches. With the configuration now
// populating (section BF) this is the next lookup that fails, so the probe reports whether the array is
// empty (unpopulated) or populated with ids that do not include the requested one.
// [1.14.7 FIX 2026-10-04] UHuntPassComponent::DoesHuntPassHaveUnclaimedRewards returns bool; this probe
// declared void and dropped the return value, the same ABI mistake that made FindRowProbeHook fault. The
// hook now returns the original's result.
using UnclaimedRewardsFn = bool(*)(void*, void*);
static UnclaimedRewardsFn OrigUnclaimedRewards = nullptr;

static bool UnclaimedRewardsProbeHook(void* Component, void* TrackId) {
    static std::atomic<int> s_seq{ 0 };
    const int Seq = s_seq.fetch_add(1, std::memory_order_relaxed);
    if (Seq < 6 && Component && IsReadablePointer(Component, 0x1E8)) {
        const uintptr_t Array = *reinterpret_cast<uintptr_t*>(reinterpret_cast<uintptr_t>(Component) + 0x1D8);
        const int32_t Count = *reinterpret_cast<int32_t*>(reinterpret_cast<uintptr_t>(Component) + 0x1E0);
        // Resolve the requested id and the first few array ids so the mismatch is visible by name.
        std::string Wanted = "<unresolved>";
        std::string Have = "";
        if (TrackId && IsReadablePointer(TrackId, 0x08)) {
            const SDK::FName* WantedName = reinterpret_cast<const SDK::FName*>(TrackId);
            Wanted = WantedName->ToString();
        }
        if (Array && Count > 0 && Count < 200) {
            for (int i = 0; i < Count && i < 6; ++i) {
                const SDK::FName* EntryName = reinterpret_cast<const SDK::FName*>(Array + static_cast<uintptr_t>(i) * 0x1c);
                Have += " [" + std::to_string(i) + "]" + EntryName->ToString();
            }
        }
        MpLog("[MasteryProbe] seq=" + std::to_string(Seq)
            + " count=" + std::to_string(Count)
            + " wanted='" + Wanted + "'"
            + " have:" + Have);
    }
    // [1.14.7 FIX 2026-10-04] The original returns bool; its result must be preserved.
    return OrigUnclaimedRewards ? OrigUnclaimedRewards(Component, TrackId) : false;
}

static void InstallMasteryProbe() {
    MH_STATUS Create = MH_CreateHook((void*)(Globals::BaseAddress + 0x019FBCD0),
        UnclaimedRewardsProbeHook, reinterpret_cast<LPVOID*>(&OrigUnclaimedRewards));
    MH_STATUS Enable = Create == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x019FBCD0)) : Create;
    MpLog(std::string("[MasteryProbe] hook (+0x19FBCD0) create=") + MH_StatusToString(Create)
        + " enable=" + MH_StatusToString(Enable));
}

// ============================================================================
// [1.14.7 INTERACTION CALLOUT OnSetDisabled GUARD 2026-10-04]
// Confirmed crash: at game RVA 0x01E5414E the function UInteractionCalloutWidget::OnSetDisabled executes
//     mov rcx, [this + 0x3A8]      ; InteractionHint (SDK Archon_classes.hpp:46493, UWidget*)
//     mov r10, [rcx]               ; rcx is null on a headless dedicated server -> EXCEPTION_ACCESS_VIOLATION
// The crash reproduces on the Training/Dojo hub roughly 80 s after every spawn and drives the DeployServer's
// "Training Dojo Crashed! Restarting!" loop. This is the same failure family as the existing
// InteractionCalloutHideHoldText guard (null widget member on -nullrhi), so it follows the same shape: when
// the binding is absent the visual callback is skipped, and when it is present the original runs unchanged.
//
// The ABI is the native UFunction body signature taken from the SDK:
//     void OnSetDisabled(bool bNewIsDisabled, const class FText& DisabledReasonText,
//                        class UTexture2D* DisabledIconTexture);
// so: this in RCX, bool in DL, FText& in R8, UTexture2D* in R9. [2026-10-08 correction] The body OWNS the
// FText (see ReleaseOwnedFTextParameter below), so every skip path releases it; the pass-through forwards it.
//
// The function start is resolved from the module's own .pdata exception directory rather than hard-coded,
// because only the faulting instruction address is known.

struct MpRuntimeFunction { uint32_t BeginAddress; uint32_t EndAddress; uint32_t UnwindInfoAddress; };

static uintptr_t ResolveFunctionStartRva(uintptr_t Rva) {
    const uintptr_t Base = Globals::BaseAddress;
    if (!Base) return 0;
    const auto* Dos = reinterpret_cast<const IMAGE_DOS_HEADER*>(Base);
    if (!IsReadablePointer(const_cast<IMAGE_DOS_HEADER*>(Dos), sizeof(IMAGE_DOS_HEADER))) return 0;
    if (Dos->e_magic != IMAGE_DOS_SIGNATURE) return 0;
    const auto* Nt = reinterpret_cast<const IMAGE_NT_HEADERS*>(Base + Dos->e_lfanew);
    if (!IsReadablePointer(const_cast<IMAGE_NT_HEADERS*>(Nt), sizeof(IMAGE_NT_HEADERS))) return 0;
    if (Nt->Signature != IMAGE_NT_SIGNATURE) return 0;
    const auto* Sec = IMAGE_FIRST_SECTION(Nt);
    for (int i = 0; i < Nt->FileHeader.NumberOfSections; ++i) {
        if (std::memcmp(Sec[i].Name, ".pdata", 6) != 0) continue;
        const auto* Funcs = reinterpret_cast<const MpRuntimeFunction*>(Base + Sec[i].VirtualAddress);
        const size_t Count = Sec[i].Misc.VirtualSize / sizeof(MpRuntimeFunction);
        if (!Count || !IsReadablePointer(const_cast<MpRuntimeFunction*>(Funcs), Count * sizeof(MpRuntimeFunction))) return 0;
        size_t Lo = 0, Hi = Count;
        while (Lo < Hi) {
            const size_t Mid = Lo + (Hi - Lo) / 2;
            const MpRuntimeFunction& F = Funcs[Mid];
            if (Rva < F.BeginAddress) Hi = Mid;
            else if (Rva >= F.EndAddress) Lo = Mid + 1;
            else return F.BeginAddress;
        }
        return 0;
    }
    return 0;
}

using InteractionCalloutSetDisabledFn = void(*)(void*, bool, const void*, void*);
static InteractionCalloutSetDisabledFn OrigInteractionCalloutSetDisabled = nullptr;

// [1.14.7 2026-10-04] Exact replication of the native body's tail, read from the 1.14.7 disassembly of
// FUN_141e54110 (the function at RVA 0x01E54110 containing the crash site 0x01E5414E). The FText parameter
// is OWNED by the callee: the body bumps the refcount when it copies the text, and at its tail releases the
// parameter's own shared pointer:
//
//     plVar5 = param_3[1];                       // FText shared data (offset +8 in the 0x18-byte FText)
//     if (plVar5 != 0) {
//         old = *(int *)(plVar5 + 8);            // refcount at +8
//         *(int *)(plVar5 + 8) = old - 1;
//         if (old == 1) {                        // i.e. the new value is 0
//             (**(code **)*plVar5)(plVar5);      // vtable[0](ptr)      - destructor
//             if (--*(int *)(plVar5 + 0xc) == 1)
//                 (**(code **)(*plVar5 + 8))(plVar5, 1);   // vtable[1](ptr, 1) - free
//         }
//     }
//
// An early return that skips this leaks a reference whenever a reason text is present - the bug the audit
// found in the first version of this guard. InterlockedDecrement returns the NEW value, so "old == 1" is
// "new == 0"; that equivalence is the only liberty taken.
static void ReleaseOwnedFTextParameter(const void* TextParam) {
    if (!TextParam) return;
    const uintptr_t P = reinterpret_cast<uintptr_t>(TextParam);
    if (!IsReadablePointer(const_cast<void*>(TextParam), 0x18)) return;

    uintptr_t Shared = *reinterpret_cast<const uintptr_t*>(P + 0x08);
    if (!Shared || !IsReadablePointer(reinterpret_cast<void*>(Shared), 0x10)) return;

    auto* RefCount = reinterpret_cast<volatile int32_t*>(Shared + 0x08);
    if (InterlockedDecrement(reinterpret_cast<volatile LONG*>(RefCount)) != 0) {
        return;
    }

    void** Vtable = *reinterpret_cast<void***>(Shared);
    if (!Vtable || !IsReadablePointer(Vtable, 0x10)) return;
    if (Vtable[0]) {
        reinterpret_cast<void(*)(void*)>(Vtable[0])(reinterpret_cast<void*>(Shared));
    }
    auto* SecondCount = reinterpret_cast<volatile int32_t*>(Shared + 0x0C);
    if (InterlockedDecrement(reinterpret_cast<volatile LONG*>(SecondCount)) == 0 && Vtable[1]) {
        reinterpret_cast<void(*)(void*, int)>(Vtable[1])(reinterpret_cast<void*>(Shared), 1);
    }
}

// [1.14.7 ABI AUDIT FOLLOW-UP 2026-10-04] Return types are not the whole ABI. The audit found that the
// native body RELEASES an owned FText reference before returning (the release is inlined, so there is no
// separate destructor to call). An outright early return therefore skips that release and leaks a reference
// whenever a reason text is present - my bug in the first version of this guard.
//
// [2026-10-08 correction] The guard does NOT swap in a sibling widget (an earlier draft did). It forwards the
// call unchanged when every member the body dereferences is bound, and otherwise skips it after performing the
// body's own FText release via ReleaseOwnedFTextParameter. +0x3B0 is DisabledReason on this class
// (Archon_classes.hpp UInteractionCalloutWidget); "SlayerLevel +0x3B0" belongs to UAirshipSlotWidget.
static void InteractionCalloutSetDisabledHook(void* Widget, bool bNewIsDisabled,
    const void* DisabledReasonText, void* DisabledIconTexture) {
    if (!Widget) {
        // [2026-10-08] The body owns the FText even when it would fault; release it here too.
        ReleaseOwnedFTextParameter(DisabledReasonText);
        MpLog("[InteractionCalloutSetDisabled] skipping null widget (owned FText released)");
        return;
    }
    // [1.14.7 2026-10-08 TIGHTENED] The body stores DL to +0x3E8 and then dereferences, on EVERY path,
    // InteractionHint +0x3A8 (0x1E5414E), DisabledReason +0x3B0 (0x1E5416C) and DisabledIcon +0x3B8
    // (0x1E54193); only the later SetBrushFromTexture is conditional. Testing +0x3A8 alone left two faults.
    const uintptr_t Base = reinterpret_cast<uintptr_t>(Widget);
    if (*reinterpret_cast<void**>(Base + 0x3A8) && *reinterpret_cast<void**>(Base + 0x3B0)
        && *reinterpret_cast<void**>(Base + 0x3B8)) {
        if (OrigInteractionCalloutSetDisabled) {
            OrigInteractionCalloutSetDisabled(Widget, bNewIsDisabled, DisabledReasonText, DisabledIconTexture);
        }
        return;
    }

    // Unbound member: skip the native body, but first perform the FText release it would have done itself.
    ReleaseOwnedFTextParameter(DisabledReasonText);

    static std::atomic<uint64_t> s_skipSeq{ 0 };
    const uint64_t Seq = s_skipSeq.fetch_add(1, std::memory_order_relaxed);
    if (Seq < 8 || (Seq % 1024) == 0) {
        std::string Null;
        if (!*reinterpret_cast<void**>(Base + 0x3A8)) Null += "InteractionHint(+0x3A8)";
        if (!*reinterpret_cast<void**>(Base + 0x3B0)) Null += std::string(Null.empty() ? "" : ",") + "DisabledReason(+0x3B0)";
        if (!*reinterpret_cast<void**>(Base + 0x3B8)) Null += std::string(Null.empty() ? "" : ",") + "DisabledIcon(+0x3B8)";
        MpLog("[InteractionCalloutSetDisabled] skipping widget=" + MpPtr(Widget) + " null=" + Null
            + " disabled=" + std::to_string(bNewIsDisabled ? 1 : 0) + " count=" + std::to_string(Seq + 1)
            + " (owned FText parameter released to match the native tail)");
    }
}

static void InstallInteractionCalloutSetDisabledGuard() {
    constexpr uintptr_t CrashRva = 0x01E5414E;
    const uintptr_t StartRva = ResolveFunctionStartRva(CrashRva);
    if (!StartRva) {
        MpLog("[InteractionCalloutSetDisabled] .pdata lookup failed for RVA 0x" + MpHex(CrashRva)
            + "; guard NOT installed");
        return;
    }
    void* Target = reinterpret_cast<void*>(Globals::BaseAddress + StartRva);
    MH_STATUS Create = MH_CreateHook(Target, InteractionCalloutSetDisabledHook,
        reinterpret_cast<LPVOID*>(&OrigInteractionCalloutSetDisabled));
    MH_STATUS Enable = Create == MH_OK ? MH_EnableHook(Target) : Create;
    MpLog(std::string("[InteractionCalloutSetDisabled] guard on function start rva=+") + MpHex(StartRva)
        + " (crash site +" + MpHex(CrashRva) + ") create=" + MH_StatusToString(Create)
        + " enable=" + MH_StatusToString(Enable));
}

// ---------------------------------------------------------------------------------------------
// [1.14.7 FIX 2026-10-08] UInteractionCalloutWidget CLASS GUARDS (server roles only)
// ---------------------------------------------------------------------------------------------
//
// MEASURED: the 8 Oct dedicated hunt (pid 40488) died at 15:26:39.806 with an AV at +0x1E3EB23 -
// `mov rcx,[rcx+0x388]` (Keyboard) then `mov rax,[rcx]` in FUN_141E3EB10, the class's input-key refresh
// helper - reached from UWidgetComponent::TickComponent (screen-space branch) -> FWorldWidgetScreenLayer::
// AddComponent -> TakeWidget -> OnWidgetRebuilt -> NativePreConstruct override (vtable 0x14580D298 +0x340 =
// 0x01E50370, which tail-jumps into the helper). The engine's crash handler then held the dead server for
// 60 s (frozen behemoth, client-side desync) before "Fatal error!". It is the THIRD crash site of this class on
// headless servers: HideHoldText (+0x3C0, Ramsgate) and OnSetDisabled (+0x3A8, Training) are guarded above.
// The bound sub-widgets are null on server roles; the screen-space add happens because the server has the
// phantom ULocalPlayer with a PlayerController and a viewport.
//
// Design (read-only RE + adversarial review, 8 Oct): guard EVERY entry of this class that dereferences a bound
// sub-widget, not just the measured site - guarding the helper alone moves the crash to NativeOnInputSwap
// (Gamepad +0x390 at 0x1E4E088, reached from the parent NativeConstruct) and then to
// UImage::GetDynamicMaterial(RadialAnimImage +0x398) at 0x38F4ECA. Where a parent exists the guard still runs
// the parent (Blueprint Construct/PreConstruct, the input-swap delegate registration and the cached gamepad
// flag stay intact) and drops only the visual work on the missing sub-widget. Every target is a .pdata entry;
// every prologue and every parent call is verified in the installed exe before hooking (fail closed). The
// three core sites (P0) install all-or-nothing with rollback: a half-installed group is exactly the state
// that moves the crash. A null `this` is never forwarded to an original. DISABLE_CALLOUT_GUARDS.flag reverts.
// The game client never runs InitServerHooks, so nothing here touches it.
//
// SDK offsets (Archon_classes.hpp UInteractionCalloutWidget): Keyboard +0x388, Gamepad +0x390,
// RadialAnimImage +0x398, frame +0x3A0, InteractionHint +0x3A8, DisabledReason +0x3B0, DisabledIcon +0x3B8,
// HoldText +0x3C0, ProgressMaterial +0x3E0. UUserWidget::WidgetTree +0x260, UWidgetTree::RootWidget +0x28,
// APlayerController::PlayerInput +0x348.

static bool CalloutGuardsEnabled() {
    static int c = -1;
    if (c < 0) {
        c = MpExeRelativeFlagPresent(L"DISABLE_CALLOUT_GUARDS.flag") ? 0 : 1;
        MpLog(std::string("[CalloutGuard] DISABLE_CALLOUT_GUARDS.flag ")
            + (c ? "absent -> class guards installed (default)" : "PRESENT -> class guards NOT installed"));
    }
    return c == 1;
}

struct CwMember { uintptr_t Offset; const char* Name; };

static std::string CwNullMembers(void* W, std::initializer_list<CwMember> Members) {
    std::string Out;
    for (const CwMember& M : Members) {
        if (*reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(W) + M.Offset) == nullptr) {
            if (!Out.empty()) Out += ",";
            Out += std::string(M.Name) + "(+" + MpHex(M.Offset) + ")";
        }
    }
    return Out.empty() ? std::string("none") : Out;
}

// One census line per process, on the first skip: is every bound member null on servers (unproven - only
// Keyboard was measured)?
static void CwCensusOnce(void* W) {
    static std::atomic<bool> s_done{ false };
    if (!W || s_done.exchange(true)) return;
    const uintptr_t B = reinterpret_cast<uintptr_t>(W);
    void* Tree = *reinterpret_cast<void**>(B + 0x260);
    void* Root = (Tree && IsReadablePointer(Tree, 0x30)) ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Tree) + 0x28) : nullptr;
    auto At = [B](uintptr_t Off) { return MpPtr(*reinterpret_cast<void**>(B + Off)); };
    MpLog("[CalloutGuard] census widget=" + MpPtr(W) + "/" + SafeObjectNameForDiagnostic(W)
        + " tree(+0x260)=" + MpPtr(Tree) + " root(tree+0x28)=" + MpPtr(Root)
        + " kb=" + At(0x388) + " gp=" + At(0x390) + " radial=" + At(0x398) + " frame=" + At(0x3A0)
        + " hint=" + At(0x3A8) + " reason=" + At(0x3B0) + " icon=" + At(0x3B8) + " hold=" + At(0x3C0)
        + " progressMid=" + At(0x3E0));
}

// Rate-limited skip log. The null-member list is built ONLY when the line is actually written (the per-frame
// NativeTick path must stay at plain loads), the counters are 64-bit so they never wrap into a log flood, and
// the census runs only alongside a written line. FixedNull names the member directly; otherwise Members is
// evaluated against W.
static void CwLogSkip(std::atomic<uint64_t>& Counter, const char* Site, void* W, const char* FixedNull,
                      std::initializer_list<CwMember> Members, const char* Action, uint64_t FirstN, uint64_t Every) {
    const uint64_t Seq = Counter.fetch_add(1, std::memory_order_relaxed);
    if (Seq >= FirstN && !(Every > 0 && (Seq % Every) == 0)) return;
    const std::string NullMembers = FixedNull ? std::string(FixedNull) : (W ? CwNullMembers(W, Members) : std::string("this"));
    MpLog(std::string("[CalloutGuard] site=") + Site + " widget=" + MpPtr(W) + " null=" + NullMembers
        + " action=" + Action + " count=" + std::to_string(Seq + 1));
    CwCensusOnce(W);
}

using CwVoidFn = void(*)(void*);
using CwInputSwapFn = void(*)(void*, bool);
using CwNativeTickFn = void(*)(void*, const void*, float);
using CwFloatFn = void(*)(void*, float);
using CwPtrFn = void(*)(void*, void*);
using CwTextWhenEnabledFn = void(*)(void*, const void*, float, bool);

static CwVoidFn OrigCwRefreshKeys = nullptr;
static CwVoidFn OrigCwNativeConstruct = nullptr;
static CwInputSwapFn OrigCwInputSwap = nullptr;
static CwNativeTickFn OrigCwNativeTick = nullptr;
static CwFloatFn OrigCwShowFillProgress = nullptr;
static CwVoidFn OrigCwHideFillProgress = nullptr;
static CwPtrFn OrigCwDisabledIconWhenEnabled = nullptr;
static CwTextWhenEnabledFn OrigCwDisabledTextWhenEnabled = nullptr;

// Parent (Super) bodies, each verified at install time as the E8 target inside the hooked function's own bytes
// and as a .pdata entry. By-name dispatch is not an option for these: it is virtual and would land back here.
static constexpr uintptr_t kCwNativeConstructSuperRva = 0x01E4A480;   // UArchonUserWidgetBase::NativeConstruct
static constexpr uintptr_t kCwInputSwapSuperRva = 0x01E4DEE0;         // UArchonUserWidgetBase::NativeOnInputSwap
static constexpr uintptr_t kCwNativeTickSuperRva = 0x01E50390;        // parent NativeTick

// P0-a, FUN_141E3EB10 (key refresh helper). Callers: NativePreConstruct's tail jump, OnHighlightInteraction,
// and UAirshipSlotWidget::SelectSlot (via OnHighlightInteraction) on hubs. Dereferences Keyboard and Gamepad
// unconditionally, then passes a PlayerController's PlayerInput (+0x348) to a helper (0x4297CC0) that does not
// null-check it (fault site 0x4297CDE).
//
// [review 2026-10-08] The PC the helper dereferences is its CACHED weak pointer at +0x318 when that is valid
// (0x1E3EB43 IsValid / 0x1E3EBC6 Get); only when the cache is invalid does it call GetOwningPlayer (vtable
// +0x2A0, at 0x1E3EB52), and it stores and uses that result only if it casts to AArchonPlayerController. A
// non-Archon owner never reaches the PlayerInput dereference. The guard mirrors that order so it tests the
// object the helper will actually use.
static void CwRefreshKeysDetour(void* W) {
    static std::atomic<uint64_t> s_skips{ 0 };
    if (!Globals::AmServer) { if (W) OrigCwRefreshKeys(W); return; }
    if (!W) { CwLogSkip(s_skips, "RefreshInputKeys", W, "this", {}, "skipped", 8, 1024); return; }
    const uintptr_t B = reinterpret_cast<uintptr_t>(W);
    if (*reinterpret_cast<void**>(B + 0x388) && *reinterpret_cast<void**>(B + 0x390)) {
        const int32_t* WeakPc = reinterpret_cast<const int32_t*>(B + 0x318);
        void* Pc = ResolveWeakObj(WeakPc[0], WeakPc[1]);
        if (!Pc) {
            Pc = reinterpret_cast<void*(*)(void*)>((*reinterpret_cast<void***>(W))[0x2A0 / 8])(W);
            if (Pc && !reinterpret_cast<SDK::UObject*>(Pc)->IsA(SDK::AArchonPlayerController::StaticClass())) {
                Pc = nullptr;                                   // the helper's cast fails: no PlayerInput read
            }
        }
        if (!Pc || *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(Pc) + 0x348)) {
            OrigCwRefreshKeys(W);
            return;
        }
        CwLogSkip(s_skips, "RefreshInputKeys", W, "PlayerInput(pc+0x348)", {}, "skipped", 8, 1024);
        return;
    }
    CwLogSkip(s_skips, "RefreshInputKeys", W, nullptr, { {0x388, "Keyboard"}, {0x390, "Gamepad"} }, "skipped", 8, 1024);
}

// P0-b, FUN_141E4BA00 (NativeConstruct override, vtable +0x348): parent, then
// UImage::GetDynamicMaterial(RadialAnimImage) which reads [rcx+0x1B8] unchecked; the result is stored at
// +0x3E0 (ProgressMaterial), whose only reader is NativeTick (guarded below).
static void CwNativeConstructDetour(void* W) {
    static std::atomic<uint64_t> s_skips{ 0 };
    if (!W) return;                                                      // virtual call: never null in practice
    if (!Globals::AmServer || *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(W) + 0x398)) {
        OrigCwNativeConstruct(W);
        return;
    }
    reinterpret_cast<CwVoidFn>(Globals::BaseAddress + kCwNativeConstructSuperRva)(W);
    CwLogSkip(s_skips, "NativeConstruct", W, "RadialAnimImage(+0x398)", {}, "super-only", 8, 1024);
}

// P0-c, FUN_141E4E050 (NativeOnInputSwap override, vtable +0x4B8; also reached by name when the PC's
// OnInputSwap delegate broadcasts): parent, then Gamepad->SetVisibility and Keyboard->SetVisibility, unchecked.
static void CwInputSwapDetour(void* W, bool bUsingGamepad) {
    static std::atomic<uint64_t> s_skips{ 0 };
    if (!W) return;
    const uintptr_t B = reinterpret_cast<uintptr_t>(W);
    if (!Globals::AmServer || (*reinterpret_cast<void**>(B + 0x388) && *reinterpret_cast<void**>(B + 0x390))) {
        OrigCwInputSwap(W, bUsingGamepad);
        return;
    }
    reinterpret_cast<CwInputSwapFn>(Globals::BaseAddress + kCwInputSwapSuperRva)(W, bUsingGamepad);
    CwLogSkip(s_skips, "NativeOnInputSwap", W, nullptr, { {0x388, "Keyboard"}, {0x390, "Gamepad"} }, "super-only", 8, 1024);
}

// P1, FUN_141E50A70 (NativeTick override, vtable +0x358). Per-frame: plain loads on the pass-through and the
// skip path; CwLogSkip builds strings only for the lines it writes (first 4, then every 100000th).
static void CwNativeTickDetour(void* W, const void* Geometry, float DeltaTime) {
    static std::atomic<uint64_t> s_skips{ 0 };
    if (!W) return;
    const uintptr_t B = reinterpret_cast<uintptr_t>(W);
    if (!Globals::AmServer || (*reinterpret_cast<void**>(B + 0x398) && *reinterpret_cast<void**>(B + 0x3E0))) {
        OrigCwNativeTick(W, Geometry, DeltaTime);
        return;
    }
    reinterpret_cast<CwNativeTickFn>(Globals::BaseAddress + kCwNativeTickSuperRva)(W, Geometry, DeltaTime);
    CwLogSkip(s_skips, "NativeTick", W, nullptr, { {0x398, "RadialAnimImage"}, {0x3E0, "ProgressMaterial"} },
        "super-only", 4, 100000);
}

// P2, Blueprint-callable natives with the same defect shape (unmeasured on servers, guarded because the sibling
// natives HideHoldText and OnSetDisabled were measured crashing on hubs).
static void CwShowFillProgressDetour(void* W, float Duration) {
    static std::atomic<uint64_t> s_skips{ 0 };
    if (!W) { CwLogSkip(s_skips, "OnShowFillProgress", W, "this", {}, "skipped", 8, 1024); return; }
    const uintptr_t B = reinterpret_cast<uintptr_t>(W);
    if (!Globals::AmServer || (*reinterpret_cast<void**>(B + 0x398) && *reinterpret_cast<void**>(B + 0x3A0))) {
        OrigCwShowFillProgress(W, Duration);
        return;
    }
    CwLogSkip(s_skips, "OnShowFillProgress", W, nullptr, { {0x398, "RadialAnimImage"}, {0x3A0, "frame"} }, "skipped", 8, 1024);
}

static void CwHideFillProgressDetour(void* W) {
    static std::atomic<uint64_t> s_skips{ 0 };
    if (!W) { CwLogSkip(s_skips, "OnHideFillProgress", W, "this", {}, "skipped", 8, 1024); return; }
    const uintptr_t B = reinterpret_cast<uintptr_t>(W);
    if (!Globals::AmServer || (*reinterpret_cast<void**>(B + 0x398) && *reinterpret_cast<void**>(B + 0x3A0))) {
        OrigCwHideFillProgress(W);
        return;
    }
    CwLogSkip(s_skips, "OnHideFillProgress", W, nullptr, { {0x398, "RadialAnimImage"}, {0x3A0, "frame"} }, "skipped", 8, 1024);
}

static void CwDisabledIconWhenEnabledDetour(void* W, void* Texture) {
    static std::atomic<uint64_t> s_skips{ 0 };
    if (!W) { CwLogSkip(s_skips, "OnSetShowDisabledIconWhenEnabled", W, "this", {}, "skipped", 8, 1024); return; }
    if (!Globals::AmServer || *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(W) + 0x3B8)) {
        OrigCwDisabledIconWhenEnabled(W, Texture);
        return;
    }
    CwLogSkip(s_skips, "OnSetShowDisabledIconWhenEnabled", W, "DisabledIcon(+0x3B8)", {}, "skipped", 8, 1024);
}

// The body OWNS its by-value FText copy (the exec stub bumps the refcount for the copy; the body releases it at
// its tail), so every skip path releases it, exactly like the OnSetDisabled guard above. The pass-through path
// never touches it.
static void CwDisabledTextWhenEnabledDetour(void* W, const void* Text, float VerticalOffset, bool bMarkAsEnabled) {
    static std::atomic<uint64_t> s_skips{ 0 };
    if (!W) {
        ReleaseOwnedFTextParameter(Text);
        CwLogSkip(s_skips, "OnSetShowDisabledTextWhenEnabled", W, "this", {}, "skipped+ftext-released", 8, 1024);
        return;
    }
    const uintptr_t B = reinterpret_cast<uintptr_t>(W);
    const bool Bound = *reinterpret_cast<void**>(B + 0x3B0)
        && (!bMarkAsEnabled || (*reinterpret_cast<void**>(B + 0x3A8) && *reinterpret_cast<void**>(B + 0x3B8)));
    if (!Globals::AmServer || Bound) {
        OrigCwDisabledTextWhenEnabled(W, Text, VerticalOffset, bMarkAsEnabled);
        return;
    }
    ReleaseOwnedFTextParameter(Text);
    CwLogSkip(s_skips, "OnSetShowDisabledTextWhenEnabled", W, nullptr,
        { {0x3B0, "DisabledReason"}, {0x3A8, "InteractionHint"}, {0x3B8, "DisabledIcon"} }, "skipped+ftext-released", 8, 1024);
}

struct CwSite {
    const char* Name;
    uintptr_t Rva;
    const uint8_t* Expect;       // static storage (no initializer_list lifetime questions)
    size_t ExpectLen;
    uintptr_t SuperCallOffset;   // 0 = no parent call to verify
    uintptr_t SuperRva;
    void* Detour;
    void** Orig;
};

// Returns nullptr when the site is safe to hook, else a reason. Only reads .text.
static const char* CwVerifySite(const CwSite& S) {
    if (ResolveFunctionStartRva(S.Rva) != S.Rva) return "not-pdata-entry";
    const uint8_t* P = reinterpret_cast<const uint8_t*>(Globals::BaseAddress + S.Rva);
    const size_t Need = (std::max)(S.ExpectLen, static_cast<size_t>(S.SuperCallOffset + 5));
    if (!IsReadablePointer(const_cast<uint8_t*>(P), Need)) return "unreadable";
    if (memcmp(P, S.Expect, S.ExpectLen) != 0) return "prologue-mismatch";
    if (S.SuperCallOffset) {
        const uint8_t* C = P + S.SuperCallOffset;
        if (C[0] != 0xE8) return "super-mismatch";
        int32_t Rel = 0;
        memcpy(&Rel, C + 1, sizeof(Rel));
        const intptr_t Target = static_cast<intptr_t>(S.Rva + S.SuperCallOffset + 5) + Rel;
        if (Target != static_cast<intptr_t>(S.SuperRva)) return "super-mismatch";
        if (ResolveFunctionStartRva(S.SuperRva) != S.SuperRva) return "super-not-entry";
    }
    return nullptr;
}

// [2026-10-10 1.14.7 RAM] Byte guard for the backup OOM pool release (MpReleaseBackupOomPool). Not a hook: it proves the
// pool global (+0x6DACBD0) and size (0x2000000) through SetupMemoryPools' own bytes, and that the only reader,
// OnOutOfMemory, still null-checks the pool before freeing it. Returns nullptr when both match, else a reason.
static const char* MpVerifyBackupOomPoolSites() {
    // 0x02525890: sub rsp,28; mov ecx,0x2000000; call 0x02661D90 (VirtualAlloc thunk); mov [rip+0x0488732B],rax
    static const uint8_t kSetupPools[21] = { 0x48, 0x83, 0xEC, 0x28, 0xB9, 0x00, 0x00, 0x00, 0x02, 0xE8, 0xF2, 0xC4,
                                             0x13, 0x00, 0x48, 0x89, 0x05, 0x2B, 0x73, 0x88, 0x04 };
    const CwSite Setup{ "FGenericPlatformMemory::SetupMemoryPools", 0x02525890, kSetupPools, sizeof(kSetupPools), 0, 0,
                        nullptr, nullptr };
    if (const char* Why = CwVerifySite(Setup)) return Why;
    // 0x02529C00 OnOutOfMemory: at +0x57 mov rcx,[rip+0x04882F72] (0x02529C5E + 0x04882F72 = the pool global 0x06DACBD0);
    // at +0x68 test rcx,rcx; je 0x02529D5B (a null pool is skipped).
    constexpr uintptr_t kOomRva = 0x02529C00;
    if (ResolveFunctionStartRva(kOomRva) != kOomRva) return "oom-handler-not-pdata-entry";
    const uint8_t* Oom = reinterpret_cast<const uint8_t*>(Globals::BaseAddress + kOomRva);
    if (!IsReadablePointer(Oom, 0x80)) return "oom-handler-unreadable";
    static const uint8_t kLoad[7] = { 0x48, 0x8B, 0x0D, 0x72, 0x2F, 0x88, 0x04 };
    static const uint8_t kTest[5] = { 0x48, 0x85, 0xC9, 0x0F, 0x84 };
    if (memcmp(Oom + 0x57, kLoad, sizeof(kLoad)) != 0 || memcmp(Oom + 0x68, kTest, sizeof(kTest)) != 0) {
        return "oom-handler-mismatch";
    }
    return nullptr;
}

static void CwLogInstalled(const CwSite& S, MH_STATUS Create, MH_STATUS Enable) {
    MpLog(std::string("[CalloutGuard] install site=") + S.Name + " rva=+" + MpHex(S.Rva)
        + " entry=pdata bytes=match super=" + (S.SuperCallOffset ? ("+" + MpHex(S.SuperRva) + "(decoded)") : std::string("none"))
        + " create=" + MH_StatusToString(Create) + " enable=" + MH_StatusToString(Enable));
}

// Expected entry bytes, verified on the installed 1.14.7 exe (design review, 8 Oct). Parent calls are checked as
// entry + offset so no new mid-function RVA literal appears in the source.
static const uint8_t kCwBytesRefreshKeys[] = { 0x40,0x53,0x57,0x41,0x57,0x48,0x83,0xEC,0x70,0x4C,0x8B,0xF9,0x48,0x8B,0x89,0x88,0x03,0x00,0x00 };
static const uint8_t kCwBytesNativeConstruct[] = { 0x40,0x53,0x48,0x83,0xEC,0x20,0x48,0x8B,0xD9,0xE8,0x72,0xEA,0xFF,0xFF,0x48,0x8B,0x8B,0x98,0x03,0x00,0x00 };
static const uint8_t kCwBytesInputSwap[] = { 0x48,0x89,0x5C,0x24,0x08,0x48,0x89,0x6C,0x24,0x10,0x48,0x89,0x74,0x24,0x18,0x57,0x48,0x83,0xEC,0x20,0x0F,0xB6,0xF2 };
static const uint8_t kCwBytesNativeTick[] = { 0x48,0x89,0x5C,0x24,0x10,0x57,0x48,0x83,0xEC,0x70,0x48,0x8B,0xD9,0xE8,0x0E,0xF9,0xFF,0xFF };
static const uint8_t kCwBytesShowFill[] = { 0x40,0x53,0x48,0x83,0xEC,0x30,0x0F,0x29,0x74,0x24,0x20,0x48,0x8B,0xD9 };
static const uint8_t kCwBytesHideFill[] = { 0x48,0x89,0x5C,0x24,0x10,0x57,0x48,0x83,0xEC,0x20,0x48,0x8B,0xD9 };
static const uint8_t kCwBytesIconWhenEnabled[] = { 0x48,0x89,0x5C,0x24,0x08,0x57,0x48,0x83,0xEC,0x20,0x48,0x8B,0xFA,0x48,0x8B,0xD9,0x48,0x8B,0x89,0xB8,0x03,0x00,0x00 };
static const uint8_t kCwBytesTextWhenEnabled[] = { 0x48,0x89,0x5C,0x24,0x10,0x48,0x89,0x6C,0x24,0x18,0x48,0x89,0x74,0x24,0x20,0x57,0x48,0x83,0xEC,0x50 };

static void InstallInteractionCalloutClassGuards() {
    if (!CalloutGuardsEnabled()) return;

    CwSite P0[] = {
        { "RefreshInputKeys", 0x01E3EB10, kCwBytesRefreshKeys, sizeof(kCwBytesRefreshKeys),
          0, 0, reinterpret_cast<void*>(&CwRefreshKeysDetour), reinterpret_cast<void**>(&OrigCwRefreshKeys) },
        { "NativeConstruct", 0x01E4BA00, kCwBytesNativeConstruct, sizeof(kCwBytesNativeConstruct),
          0x09, kCwNativeConstructSuperRva,
          reinterpret_cast<void*>(&CwNativeConstructDetour), reinterpret_cast<void**>(&OrigCwNativeConstruct) },
        { "NativeOnInputSwap", 0x01E4E050, kCwBytesInputSwap, sizeof(kCwBytesInputSwap),
          0x1A, kCwInputSwapSuperRva,
          reinterpret_cast<void*>(&CwInputSwapDetour), reinterpret_cast<void**>(&OrigCwInputSwap) },
    };
    CwSite Independent[] = {
        { "NativeTick", 0x01E50A70, kCwBytesNativeTick, sizeof(kCwBytesNativeTick),
          0x0D, kCwNativeTickSuperRva,
          reinterpret_cast<void*>(&CwNativeTickDetour), reinterpret_cast<void**>(&OrigCwNativeTick) },
        { "OnShowFillProgress", 0x01E544B0, kCwBytesShowFill, sizeof(kCwBytesShowFill),
          0, 0, reinterpret_cast<void*>(&CwShowFillProgressDetour), reinterpret_cast<void**>(&OrigCwShowFillProgress) },
        { "OnHideFillProgress", 0x01E52450, kCwBytesHideFill, sizeof(kCwBytesHideFill),
          0, 0, reinterpret_cast<void*>(&CwHideFillProgressDetour), reinterpret_cast<void**>(&OrigCwHideFillProgress) },
        { "OnSetShowDisabledIconWhenEnabled", 0x01E542C0, kCwBytesIconWhenEnabled, sizeof(kCwBytesIconWhenEnabled),
          0, 0, reinterpret_cast<void*>(&CwDisabledIconWhenEnabledDetour), reinterpret_cast<void**>(&OrigCwDisabledIconWhenEnabled) },
        { "OnSetShowDisabledTextWhenEnabled", 0x01E54320, kCwBytesTextWhenEnabled, sizeof(kCwBytesTextWhenEnabled),
          0, 0, reinterpret_cast<void*>(&CwDisabledTextWhenEnabledDetour), reinterpret_cast<void**>(&OrigCwDisabledTextWhenEnabled) },
    };

    // P0: all-or-nothing. Verify all, create all (roll back on any failure), queue-enable all, apply once,
    // and remove all three if the apply did not succeed.
    [&]() {
        for (const CwSite& S : P0) {
            if (const char* Why = CwVerifySite(S)) {
                MpLog(std::string("[CalloutGuard] install group=P0 ABORTED site=") + S.Name + " reason=" + Why
                    + " (no hook in group installed)");
                return;
            }
        }
        void* Created[3] = {};
        int NumCreated = 0;
        // [review 2026-10-08] MH_RemoveHook can fail (and leave the hook enabled), so the rollback reports what
        // it could NOT remove instead of claiming a clean group: a half-installed P0 is the state to see.
        auto RollBack = [&]() -> std::string {
            std::string Left;
            for (int i = 0; i < NumCreated; ++i) {
                const MH_STATUS R = MH_RemoveHook(Created[i]);
                if (R != MH_OK) Left += std::string(Left.empty() ? "" : ",") + P0[i].Name + ":" + MH_StatusToString(R);
            }
            return Left.empty() ? std::string("all created hooks removed")
                                : std::string("REMOVE FAILED, STILL INSTALLED: ") + Left;
        };
        for (const CwSite& S : P0) {
            void* Target = reinterpret_cast<void*>(Globals::BaseAddress + S.Rva);
            const MH_STATUS C = MH_CreateHook(Target, S.Detour, S.Orig);
            if (C != MH_OK) {
                const std::string Result = RollBack();
                MpLog(std::string("[CalloutGuard] install group=P0 ABORTED site=") + S.Name
                    + " reason=create:" + MH_StatusToString(C) + " (" + Result + ")");
                return;
            }
            Created[NumCreated++] = Target;
        }
        MH_STATUS Queue = MH_OK;
        for (int i = 0; i < NumCreated && Queue == MH_OK; ++i) Queue = MH_QueueEnableHook(Created[i]);
        const MH_STATUS Apply = Queue == MH_OK ? MH_ApplyQueued() : Queue;
        if (Apply != MH_OK) {
            const std::string Result = RollBack();
            MpLog(std::string("[CalloutGuard] install group=P0 ABORTED reason=enable:") + MH_StatusToString(Apply)
                + " (" + Result + ")");
            return;
        }
        for (const CwSite& S : P0) CwLogInstalled(S, MH_OK, MH_OK);
    }();

    // P1/P2: independent per site.
    for (const CwSite& S : Independent) {
        if (const char* Why = CwVerifySite(S)) {
            MpLog(std::string("[CalloutGuard] install site=") + S.Name + " SKIPPED reason=" + Why);
            continue;
        }
        void* Target = reinterpret_cast<void*>(Globals::BaseAddress + S.Rva);
        const MH_STATUS C = MH_CreateHook(Target, S.Detour, S.Orig);
        const MH_STATUS E = C == MH_OK ? MH_EnableHook(Target) : C;
        if (C == MH_OK && E != MH_OK) MH_RemoveHook(Target);
        CwLogInstalled(S, C, E);
    }
}

// [2026-10-10 1.14.7] Late-join legendary HUD guard (client only). UHUDLegendaryAbilityWidget's construct function
// 0x01F7AA00 (NativeConstruct by its vtable slot - CANDIDATE name) calls the HandleWeaponEquipped native 0x01F6D4F0
// directly at 0x01F7AED2 with Pawn->Weapon (+0x5F0, getter 0x018CE900) unchecked. When the controller's Inventory
// (PC+0x9B8) has replicated but no weapon is equipped yet, 0x01F6D6BE reads InWeapon->ItemId.Num (+0x248) -> AV. The
// other callers are null-safe: the exec thunk 0x023D1180 (ProcessEvent / delegate path; the equip broadcast never passes
// null) and HandleLoadoutChanged 0x01F6D480 (tests the weapon; its exec 0x023D1160 is a frameless leaf that tail-jumps
// there). The same construct has already bound the handler to AArchonCharacter::OnWeaponEquipped (+0x5F8), which the
// equip function 0x018D71B0 broadcasts with the non-null primary weapon, so skipping the null call loses nothing (the
// client chain that equips the weapon after a late join is untraced: until a live run shows a skip line followed by the
// icon appearing, a skip may leave the default icon until HandleLoadoutChanged runs - never worse than stock, which
// faults). STATIC PROOF ONLY: no 1.14.7 dump at exe+0x1F6D6BE yet; live late-join A/B pending. The friend's 1.12 fix
// guards the matching native (1.12 0x01DF77C0, matched by shape: vtable +0x2A0 call, weapon in rdx; tools/rva-port-audit.py
// pairs it by prologue alone with 1.12 0x019E8E80, unverified). A hook on the native body covers all three callers; the crashing call is
// native-to-native and never reaches ProcessEvent. Servers build no HUD (no local player since 0.2.111) and never install
// it. DISABLE_HUD_LEGENDARY_GUARD.flag reverts.
static constexpr uintptr_t kHudLegendaryWeaponEquippedRva = 0x01F6D4F0;
static const uint8_t kHudLegendaryWeaponEquippedBytes[] = { 0x40,0x55,0x53,0x56,0x57,0x41,0x54,0x48,0x8D,0xAC,0x24,0xB0,
                                                            0xFE,0xFF,0xFF,0x48,0x81,0xEC,0x50,0x02,0x00,0x00 };
using HudLegendaryWeaponEquippedFn = void(__fastcall*)(void* Widget, void* InWeapon);
static HudLegendaryWeaponEquippedFn OrigHudLegendaryWeaponEquipped = nullptr;

static void __fastcall HudLegendaryWeaponEquippedDetour(void* Widget, void* InWeapon) {
    // No logging and no CRT once DLL_PROCESS_DETACH has begun (0.2.96 exit crash, 38_ §18.2); a null weapon is still skipped.
    if (MpProcessDetaching()) {
        if (InWeapon) OrigHudLegendaryWeaponEquipped(Widget, InWeapon);
        return;
    }
    if (!InWeapon) {
        static std::atomic<uint32_t> s_skips{ 0 };
        const uint32_t N = s_skips.fetch_add(1, std::memory_order_relaxed) + 1;
        if (N <= 8 || (N & (N - 1)) == 0) {
            MpLog("[HudLegendaryGuard] HandleWeaponEquipped(InWeapon=null) skipped widget=" + MpPtr(Widget)
                + " n=" + std::to_string(N) + " (re-runs from Character.OnWeaponEquipped when the weapon is equipped)");
        }
        return;
    }
    OrigHudLegendaryWeaponEquipped(Widget, InWeapon);
}

static void InstallHudLegendaryWeaponGuard() {
    if (Globals::AmServer) return;
    if (MpExeRelativeFlagPresent(L"DISABLE_HUD_LEGENDARY_GUARD.flag")) {
        MpLog("[HudLegendaryGuard] DISABLE_HUD_LEGENDARY_GUARD.flag present -> not installed");
        return;
    }
    const CwSite S{ "HUDLegendaryAbilityWidget::HandleWeaponEquipped", kHudLegendaryWeaponEquippedRva,
        kHudLegendaryWeaponEquippedBytes, sizeof(kHudLegendaryWeaponEquippedBytes), 0, 0,
        reinterpret_cast<void*>(&HudLegendaryWeaponEquippedDetour), reinterpret_cast<void**>(&OrigHudLegendaryWeaponEquipped) };
    if (const char* Why = CwVerifySite(S)) {
        MpLog(std::string("[HudLegendaryGuard] NOT installed rva=+") + MpHex(S.Rva) + " reason=" + Why
            + " (late-join null-weapon HUD crash left unguarded)");
        return;
    }
    void* Target = reinterpret_cast<void*>(Globals::BaseAddress + S.Rva);
    const MH_STATUS C = MH_CreateHook(Target, S.Detour, S.Orig);
    const MH_STATUS E = C == MH_OK ? MH_EnableHook(Target) : C;
    if (C == MH_OK && E != MH_OK) MH_RemoveHook(Target);
    MpLog(std::string("[HudLegendaryGuard] install rva=+") + MpHex(S.Rva) + " entry=pdata bytes=match create="
        + MH_StatusToString(C) + " enable=" + MH_StatusToString(E));
}

// [2026-10-10 1.14.7 travel-crash probe, client only, observe-only] UEngine::LoadMap = 0x04271370 (named by its own
// strings: "LoadMap: %s", "Failed to load package '%s'", "Took %f seconds after InitializeForWorld(%s)"; .pdata primary
// entry). ABI from its only engine caller (UArchon LoadMap wrapper 0x01909C10, call at 0x01909EA6): rcx = engine,
// rdx = FWorldContext&, r8 = FURL* (by-value copy; Map FString at +0x28), r9 = UPendingNetGame*, [rsp+0x28] = FString&
// Error; returns bool. The hunt -> Ramsgate crash faults inside it (0x04272D28, the new world's PersistentLevel is null
// before LoadPackagesFully); this logs the destination, the old world and every UWorld in memory at entry, and the
// result and duration at exit, so the next crash shows what LoadMap found. NO_LOADMAP_PROBE.flag disables it.
static constexpr uintptr_t kEngineLoadMapRva = 0x04271370;
static const uint8_t kEngineLoadMapBytes[] = {
    0x48, 0x89, 0x5C, 0x24, 0x20,                  // mov [rsp+0x20], rbx
    0x55, 0x56, 0x57, 0x41, 0x54, 0x41, 0x55,      // push rbp / rsi / rdi / r12 / r13
    0x41, 0x56, 0x41, 0x57,                        // push r14 / r15
    0x48, 0x8D, 0xAC, 0x24, 0x00, 0xFE, 0xFF, 0xFF,// lea rbp, [rsp-0x200]
    0x48, 0x81, 0xEC, 0x00, 0x03, 0x00, 0x00,      // sub rsp, 0x300
};
using EngineLoadMapFn = bool(__fastcall*)(void* Engine, void* WorldContext, void* Url, void* Pending, void* Error);
static EngineLoadMapFn OrigEngineLoadMap = nullptr;

static std::string MpFStringAt(const void* Base, uintptr_t Offset) {
    if (!Base || !IsReadablePointer(Base, Offset + 0x10)) return "?";
    const wchar_t* Data = *reinterpret_cast<wchar_t* const*>(reinterpret_cast<uintptr_t>(Base) + Offset);
    const int32_t Num = *reinterpret_cast<const int32_t*>(reinterpret_cast<uintptr_t>(Base) + Offset + 8);
    if (!Data || Num <= 1 || Num > 1024 || !IsReadablePointer(Data, static_cast<size_t>(Num) * sizeof(wchar_t))) return "";
    std::string Out;
    for (int32_t i = 0; i < Num - 1; ++i) Out.push_back(Data[i] < 128 ? static_cast<char>(Data[i]) : '?');
    return Out;
}

static void* MpWorldContextWorld(void* WorldContext) {
    return (WorldContext && IsReadablePointer(WorldContext, 0x288))
        ? *reinterpret_cast<void**>(reinterpret_cast<uintptr_t>(WorldContext) + 0x280) : nullptr;
}

static bool __fastcall EngineLoadMapDetour(void* Engine, void* WorldContext, void* Url, void* Pending, void* Error) {
    if (MpProcessDetaching()) return OrigEngineLoadMap(Engine, WorldContext, Url, Pending, Error);
    void* OldWorld = MpWorldContextWorld(WorldContext);
    const std::string Map = MpFStringAt(Url, 0x28);
    const std::string OldWorldName = OldWorld ? SafeObjectNameForDiagnostic(OldWorld) : std::string("none");
    MpLog("[LoadMap] enter map=" + Map + " pending=" + MpPtr(Pending) + " context=" + MpPtr(WorldContext)
        + " oldWorld=" + MpPtr(OldWorld) + "/" + OldWorldName);
    TravelCause::OnLoadMap(WorldContext, Map, OldWorldName);   // [2026-10-16 0.2.142] client: the history before a return to the menu
    MpWorldCensus("loadmap-enter");

    // The census above has just released the stuck Async keep flag of every leftover world (MpReleaseZombieKeepFlags,
    // 0.2.125), so LoadMap's full purge frees them before its FindPackage. The guard below is the opt-in last resort for
    // a leftover held by something else.
    // [2026-10-10 1.14.7 safety net] If the destination map's previous UWorld is still in memory as a pending-kill
    // leftover, LoadMap's FindPackage would reuse it and crash on its null PersistentLevel (21:14:50). Fail this travel
    // before LoadMap touches anything instead: the engine then handles it as a load failure (UPendingNetGame::
    // LoadMapCompleted -> BrowseToDefaultMap), i.e. back to the login screen rather than a crash. Only pending-kill
    // worlds count, never a world that is merely still loading. OPT-IN (ENABLE_ZOMBIE_LOADMAP_GUARD.flag) until the
    // holder is known: if it keeps the leftover alive after the login screen too, every later Ramsgate travel would
    // be refused, a login loop worse than the crash.
    static int s_zombieGuard = -1;
    if (s_zombieGuard < 0) {
        s_zombieGuard = MpExeRelativeFlagPresent(L"ENABLE_ZOMBIE_LOADMAP_GUARD.flag") ? 1 : 0;
        MpLog(std::string("[LoadMap] leftover-world guard ") + (s_zombieGuard ? "ON (ENABLE_ZOMBIE_LOADMAP_GUARD.flag)" : "OFF (default; diagnostics only)"));
    }
    if (s_zombieGuard && !Map.empty()) {
        std::string Short = Map.substr(Map.find_last_of('/') == std::string::npos ? 0 : Map.find_last_of('/') + 1);
        if (Short.find('.') != std::string::npos) Short = Short.substr(0, Short.find('.'));
        MpWorldCensusEntry Worlds[64]{};
        int Objects = 0;
        int Found = MpWorldCensusScan(Worlds, 64, &Objects);
        if (Found < 0) Found = -Found - 1;
        for (int i = 0; i < Found; ++i) {
            if (Worlds[i].World == OldWorld || !(Worlds[i].ItemFlags & 0x20000000)) continue;
            if (SafeObjectNameForDiagnostic(Worlds[i].World) != Short) continue;
            if (MpZombieKeepFlagReleased(Worlds[i].World)) continue;   // LoadMap's own full purge frees it (0.2.125)
            MpLog("[LoadMap] REFUSED map=" + Map + ": its previous world " + MpPtr(Worlds[i].World)
                + " is a pending-kill leftover (level=" + (Worlds[i].Level ? MpPtr(Worlds[i].Level) : std::string("NULL"))
                + "); failing this travel instead of reusing it and crashing (ENABLE_ZOMBIE_LOADMAP_GUARD.flag)");
            MpReportZombieWorld(Worlds[i].World, "loadmap-refused");
            return false;
        }
    }
    const uint64_t T0 = GetTickCount64();
    const bool Ok = OrigEngineLoadMap(Engine, WorldContext, Url, Pending, Error);
    void* NewWorld = MpWorldContextWorld(WorldContext);
    MpLog(std::string("[LoadMap] exit ok=") + (Ok ? "1" : "0") + " ms=" + std::to_string(GetTickCount64() - T0)
        + " world=" + MpPtr(NewWorld) + "/" + (NewWorld ? SafeObjectNameForDiagnostic(NewWorld) : std::string("none"))
        + (Ok ? "" : " error=" + MpFStringAt(Error, 0)));
    return Ok;
}

static void InstallLoadMapProbe() {
    if (Globals::AmServer) return;
    if (MpExeRelativeFlagPresent(L"NO_LOADMAP_PROBE.flag")) {
        MpLog("[LoadMap] NO_LOADMAP_PROBE.flag present -> probe not installed");
        return;
    }
    const CwSite S{ "UEngine::LoadMap", kEngineLoadMapRva, kEngineLoadMapBytes, sizeof(kEngineLoadMapBytes), 0, 0,
        reinterpret_cast<void*>(&EngineLoadMapDetour), reinterpret_cast<void**>(&OrigEngineLoadMap) };
    if (const char* Why = CwVerifySite(S)) {
        MpLog(std::string("[LoadMap] probe NOT installed rva=+") + MpHex(S.Rva) + " reason=" + Why);
        return;
    }
    void* Target = reinterpret_cast<void*>(Globals::BaseAddress + S.Rva);
    const MH_STATUS C = MH_CreateHook(Target, S.Detour, S.Orig);
    const MH_STATUS E = C == MH_OK ? MH_EnableHook(Target) : C;
    if (C == MH_OK && E != MH_OK) MH_RemoveHook(Target);
    MpLog(std::string("[LoadMap] probe install rva=+") + MpHex(S.Rva) + " entry=pdata bytes=match create="
        + MH_StatusToString(C) + " enable=" + MH_StatusToString(E));
}

// [2026-10-10 1.14.7] Installs the opt-in TickFilterHelper hook (see TickFilterHelperDetour). Called at the end of
// InitServerHooks, after the no-local-player patch has set g_NoLocalPlayerApplied. Both flags are read once here.
static const uint8_t kTickFilterHelperBytes[] = { 0x48,0x89,0x5C,0x24,0x08,0x48,0x89,0x74,0x24,0x10,0x57,0x48,0x83,0xEC,0x20,
                                                  0x41,0x0F,0xB6,0xD8,0x0F,0xB6,0xF2 };
static const uint8_t kTickFilterExecBytes[] = { 0x40,0x53,0x56,0x57,0x48,0x83,0xEC,0x20,0x33,0xFF,0x49,0x8B,0xF0 };

static void InstallServerTickFilter() {
    if (!Globals::AmServer) return;
    const bool Fix = MpExeRelativeFlagPresent(L"SERVER_TICK_FILTER.flag");
    const bool Census = MpExeRelativeFlagPresent(L"TICK_FILTER_CENSUS.flag");
    if (!Fix && !Census) {
        MpLog("[TickFilter] OFF (default): neither SERVER_TICK_FILTER.flag nor TICK_FILTER_CENSUS.flag present; no hook, "
              "the game answers, manual TickStamina unchanged");
        return;
    }
    if (Globals::AuthMode != Globals::ServerAuthMode::GlobalGameserver) {
        MpLog("[TickFilter] not installed: not a DeployServer instance (AuthMode is not GlobalGameserver); flags ignored, "
              "manual TickStamina unchanged");
        return;
    }
    if (!g_NoLocalPlayerApplied.load(std::memory_order_relaxed)) {
        MpLog("[TickFilter] not installed: the no-local-player patch is not applied (a local player could own an authority "
              "pawn); flags ignored, manual TickStamina unchanged");
        return;
    }
    const CwSite Filter{ "UArchonGameplayStatics::TickFilterHelper", 0x019480B0, kTickFilterHelperBytes,
        sizeof(kTickFilterHelperBytes), 0, 0, reinterpret_cast<void*>(&TickFilterHelperDetour),
        reinterpret_cast<void**>(&OrigTickFilterHelper) };
    if (const char* Why = CwVerifySite(Filter)) {
        MpLog(std::string("[TickFilter] NOT installed: filter rva=+") + MpHex(Filter.Rva) + " reason=" + Why
            + "; the game answers, manual TickStamina unchanged");
        return;
    }
    g_TickFilterCensus.store(Census, std::memory_order_relaxed);   // read by the hook from its first call
    void* FilterTarget = reinterpret_cast<void*>(Globals::BaseAddress + Filter.Rva);
    const MH_STATUS FC = MH_CreateHook(FilterTarget, Filter.Detour, Filter.Orig);
    const MH_STATUS FE = FC == MH_OK ? MH_EnableHook(FilterTarget) : FC;
    if (FE != MH_OK) {
        if (FC == MH_OK) MH_RemoveHook(FilterTarget);
        g_TickFilterCensus.store(false, std::memory_order_relaxed);
        MpLog(std::string("[TickFilter] NOT installed: filter create=") + MH_StatusToString(FC) + " enable="
            + MH_StatusToString(FE) + "; the game answers, manual TickStamina unchanged");
        return;
    }
    g_ServerTickFilterActive.store(Fix, std::memory_order_relaxed);

    std::string ExecStatus = "not hooked (census off)";
    if (Census) {
        const CwSite Exec{ "execTickFilterHelper", 0x0229DB70, kTickFilterExecBytes, sizeof(kTickFilterExecBytes), 0, 0,
            reinterpret_cast<void*>(&TickFilterExecDetour), reinterpret_cast<void**>(&OrigTickFilterExec) };
        if (const char* Why = CwVerifySite(Exec)) {
            ExecStatus = std::string("NOT hooked reason=") + Why + " (census rows carry no call site)";
        } else {
            void* ExecTarget = reinterpret_cast<void*>(Globals::BaseAddress + Exec.Rva);
            const MH_STATUS EC = MH_CreateHook(ExecTarget, Exec.Detour, Exec.Orig);
            const MH_STATUS EE = EC == MH_OK ? MH_EnableHook(ExecTarget) : EC;
            if (EC == MH_OK && EE != MH_OK) MH_RemoveHook(ExecTarget);
            ExecStatus = std::string("create=") + MH_StatusToString(EC) + " enable=" + MH_StatusToString(EE)
                + (EE == MH_OK ? "" : " (census rows carry no call site)");
        }
    }
    const char* Mode = Fix && Census ? "SERVER ANSWERS for BP_PlayerCharacter_C + census (SERVER_TICK_FILTER.flag + TICK_FILTER_CENSUS.flag)"
                     : Fix ? "SERVER ANSWERS for BP_PlayerCharacter_C (SERVER_TICK_FILTER.flag); manual TickStamina skipped once the class is cached"
                           : "CENSUS ONLY (TICK_FILTER_CENSUS.flag): the game's answer is returned unchanged";
    MpLog(std::string("[TickFilter] mode=") + Mode + "; filter rva=+" + MpHex(Filter.Rva)
        + " entry=pdata bytes=match create=" + MH_StatusToString(FC) + " enable=" + MH_StatusToString(FE)
        + "; exec rva=+" + MpHex(static_cast<uintptr_t>(0x0229DB70)) + " " + ExecStatus);
}

// [1.14.7 FIX 2026-10-08] Bound the engine crash handler's wait on server roles. After a game-thread crash the
// native ReportCrash (FUN_14265CEC0) blocks in WaitForSingleObject(CrashHandledEvent, 60000) for the
// crash-reporter thread; on the 8 Oct hunt that thread never finished, so every connected client saw a frozen
// world for 60 s before "Fatal error!" and exit 3. The 60000 is the single `mov edx,0xEA60` in .text, at
// 0x0265CF15 (opcode byte BA). Patch it to 5000: the native crash folder/minidump path is kept wherever it works
// (healthy cases finished in under 0.8 s), and a stalled reporter can no longer freeze clients for a minute.
// A server-side minidump-and-terminate detour was designed too, but is deferred (deadlock risks under loader
// lock, Guard thresholds on the P2P host). DISABLE_CRASH_WAIT_SHORTEN.flag reverts.
// Forensic caveat (review 8 Oct): ReportCrash hands the filter's EXCEPTION_POINTERS to the reporter thread
// (stored at 0x265CEE1) and returns EXCEPTION_EXECUTE_HANDLER when the wait expires; the handler then unwinds
// over that stack. A reporter still writing UE4Minidump.dmp after 5 s can therefore produce a truncated dump
// or one with an overwritten exception context. Healthy reporters finished in under 0.8 s.
static void InstallServerCrashWaitBound() {
    if (MpExeRelativeFlagPresent(L"DISABLE_CRASH_WAIT_SHORTEN.flag")) {
        MpLog("[CrashWait] DISABLE_CRASH_WAIT_SHORTEN.flag present -> native 60000 ms crash wait kept");
        return;
    }
    if (ResolveFunctionStartRva(0x0265CF15) != 0x0265CEC0) {
        MpLog("[CrashWait] +0x265CF15 is not inside ReportCrash (+0x265CEC0) on this exe - not patched");
        return;
    }
    static const uint8_t Expected[5] = { 0xBA, 0x60, 0xEA, 0x00, 0x00 };      // mov edx, 60000
    static const uint8_t Replacement[5] = { 0xBA, 0x88, 0x13, 0x00, 0x00 };   // mov edx, 5000
    const bool Ok = MpPatchBytesVerified(0x0265CF15, Expected, Replacement, 5, "ReportCrash wait 60000->5000");
    MpLog(std::string("[CrashWait] ReportCrash wait at +0x265CF15 60000->5000 ms: ")
        + (Ok ? "patched" : "NOT patched (byte guard or protection failed; see the line above)"));
}

// [1.14.7 FIX 2026-10-08] Ramsgate crashed at 22:05:09 (AV reading 0x40 at +0x1B8627C, "Fatal error!", exit 3)
// while a player joined. FUN_141b86160 runs after an inventory update on the server's AArchonInventory: it takes
// the owner (+0xE0, must be an AArchonPlayerController), the controller's LOADOUT (+0x9C8) and five equipped-item
// getters (0x01BA4FF0, 0x01B9CA60, 0x01B9FF30, 0x01B9A620, 0x01BA08D0), then compares the updated items with them -
// assuming all five exist. Each getter first calls GetActiveLoadoutSlotData (0x01B99FB0) and returns null while
// ActiveLoadoutSlotIndex is still -1, so an inventory update that reaches this function before the joining player's
// loadout picks its slot dereferences null+0x38 (the hub logged "GetActiveLoadoutSlotData - Attempt to access invalid
// slot index. Active Slot = [-1]" just before). The guard skips exactly that case: no valid active slot, or any of
// the five getters null. The refresh it skips only re-checks equipped items; loadout initialisation re-runs it.
// Seen once (first occurrence in the hub logs); servers only; DISABLE_INVENTORY_REFRESH_GUARD.flag reverts.
using InventoryEquippedRefreshFn = void(__fastcall*)(void*, void*);
using EquippedItemGetterFn = void*(__fastcall*)(void*);
static InventoryEquippedRefreshFn OrigInventoryEquippedRefresh = nullptr;
static constexpr uintptr_t kInventoryEquippedRefreshRva = 0x01B86160;
static constexpr uintptr_t kEquippedItemGetterRvas[5] = { 0x01BA4FF0, 0x01B9CA60, 0x01B9FF30, 0x01B9A620, 0x01BA08D0 };

static void __fastcall InventoryEquippedRefreshGuard(void* Inventory, void* UpdatedItems) {
    const char* SkipReason = nullptr;
    int32_t ActiveSlot = -2;
    void* Owner = (Inventory && IsReadablePointer(Inventory, 0xE8)) ? *reinterpret_cast<void**>(reinterpret_cast<uint8_t*>(Inventory) + 0xE0) : nullptr;
    if (Owner && IsReadablePointer(Owner, 0x9D0)
        && reinterpret_cast<UObject*>(Owner)->IsA(AArchonPlayerController::StaticClass())) {
        AArchonLoadout* Loadout = reinterpret_cast<AArchonPlayerController*>(Owner)->LOADOUT;
        if (Loadout && IsReadablePointer(Loadout, 0x690)) {
            ActiveSlot = Loadout->ActiveLoadoutSlotIndex;
            if (!Loadout->LoadoutSlotDataArray.IsValidIndex(ActiveSlot) || !Loadout->LoadoutSlotDataArray[ActiveSlot]) {
                SkipReason = "no valid active loadout slot";
            } else {
                for (uintptr_t Rva : kEquippedItemGetterRvas) {
                    if (!reinterpret_cast<EquippedItemGetterFn>(Globals::BaseAddress + Rva)(Loadout)) {
                        SkipReason = "an equipped-item getter returned null";
                        break;
                    }
                }
            }
        }
    }
    if (SkipReason) {
        static std::atomic<uint64_t> s_skips{ 0 };
        const uint64_t N = s_skips.fetch_add(1, std::memory_order_relaxed);
        if (N < 20 || (N % 100) == 0) {
            MpLog(std::string("[InventoryRefreshGuard] skipped equipped-item refresh #") + std::to_string(N + 1)
                + ": " + SkipReason + " (activeSlot=" + std::to_string(ActiveSlot) + " inventory=" + MpPtr(Inventory) + ")");
        }
        return;
    }
    OrigInventoryEquippedRefresh(Inventory, UpdatedItems);
}

static void InstallInventoryRefreshGuard() {
    if (MpExeRelativeFlagPresent(L"DISABLE_INVENTORY_REFRESH_GUARD.flag")) {
        MpLog("[InventoryRefreshGuard] DISABLE_INVENTORY_REFRESH_GUARD.flag present -> not installed");
        return;
    }
    if (ResolveFunctionStartRva(kInventoryEquippedRefreshRva) != kInventoryEquippedRefreshRva) {
        MpLog("[InventoryRefreshGuard] +0x1B86160 is not a function entry on this exe - not installed");
        return;
    }
    for (uintptr_t Rva : kEquippedItemGetterRvas) {
        if (ResolveFunctionStartRva(Rva) != Rva) {
            MpLog("[InventoryRefreshGuard] getter +" + MpHex(Rva) + " is not a function entry on this exe - not installed");
            return;
        }
    }
    void* Target = reinterpret_cast<void*>(Globals::BaseAddress + kInventoryEquippedRefreshRva);
    const MH_STATUS Create = MH_CreateHook(Target, reinterpret_cast<LPVOID>(&InventoryEquippedRefreshGuard),
        reinterpret_cast<LPVOID*>(&OrigInventoryEquippedRefresh));
    const MH_STATUS Enable = Create == MH_OK ? MH_EnableHook(Target) : Create;
    MpLog(std::string("[InventoryRefreshGuard] equipped-item refresh guard (+0x1B86160) create=") + MH_StatusToString(Create)
        + " enable=" + MH_StatusToString(Enable));
}

static void FindActiveRowProbeHook(void* GameInstance) {
    const uintptr_t GI = reinterpret_cast<uintptr_t>(GameInstance);
    const bool Readable = GameInstance != nullptr && IsReadablePointer(GameInstance, 0x6F0);
    void* Field6e0 = Readable ? *reinterpret_cast<void**>(GI + 0x6E0) : nullptr;
    void* Field6d0Before = Readable ? *reinterpret_cast<void**>(GI + 0x6D0) : nullptr;

    void* Id = nullptr;
    void* CacheFound = nullptr;
    if (Globals::BaseAddress && GameInstance) {
        Id = reinterpret_cast<void*(*)(void*)>(Globals::BaseAddress + 0x03E31050)(GameInstance);
        if (Id) {
            unsigned char Out[16] = { 0 };
            reinterpret_cast<void*(*)(void*, void*)>(Globals::BaseAddress + 0x01902E60)(Out, Id);
            CacheFound = *reinterpret_cast<void**>(Out);
        }
    }

    if (CacheFound) {
        TryHookWindowLookup(CacheFound);
    }

    MpLog("[ActiveHuntPassProbe] enter instance=" + MpPtr(GameInstance)
        + " field6e0=" + MpPtr(Field6e0)
        + " id=" + MpPtr(Id)
        + " cacheFound=" + MpPtr(CacheFound)
        + " field6d0_before=" + MpPtr(Field6d0Before));

    if (OrigFindActiveRow) {
        OrigFindActiveRow(GameInstance);
    }

    // [1.14.7 active season override] FindActiveHuntPassRow zeroes +0x6d0 and fails to set it, so write a
    // season the table really has - the same field LoadComplete reads for its season-table lookup.
    if (MpExeRelativeFlagPresent(L"FORCE_ACTIVE_SEASON.flag")) {
        static std::atomic<int> s_seasonWriteState{ 0 };
        if (s_seasonWriteState.fetch_add(1, std::memory_order_relaxed) == 0) {
            // Take the value from the table's own entry for the newest enabled season, exactly as
            // FindActiveHuntPassRow would have stored it.
            void* Table = IsReadablePointer(GameInstance, 0x6E8) ? *reinterpret_cast<void**>(GI + 0x6E0) : nullptr;
            uintptr_t RowEntryValue = 0;
            if (Table && IsReadablePointer(Table, 0x10)) {
                const uintptr_t Vt2 = *reinterpret_cast<uintptr_t*>(Table);
                void* Data2 = reinterpret_cast<void*(*)(void*)>(*reinterpret_cast<uintptr_t*>(Vt2 + 0x280))(Table);
                if (Data2 && IsReadablePointer(Data2, 0x30)) {
                    const uintptr_t Arr = *reinterpret_cast<uintptr_t*>(Data2);
                    const int Cnt = *reinterpret_cast<int*>(reinterpret_cast<uintptr_t>(Data2) + 0x28);
                    if (Arr && Cnt > 0 && Cnt < 400) {
                        RowEntryValue = SafeReadPtr(Arr + static_cast<uintptr_t>(Cnt - 1) * 0x18, 0x00);
                    }
                }
            }
            if (RowEntryValue) {
                SetGameInstanceActiveSeason(GameInstance, RowEntryValue);
            } else {
                MpLog("[ActiveSeason] could not read the last row entry; nothing written");
            }
        }
    }

    void* Field6d0After = Readable ? *reinterpret_cast<void**>(GI + 0x6D0) : nullptr;
    MpLog("[ActiveHuntPassProbe] after field6d0=" + MpPtr(Field6d0After));

    // [1.14.7 row-key dump] Walk the table the selection iterates: instance+0x6e0 -> vtable +0x280 gives
    // the entry array; entries are stride 0x18 with the row data pointer at +8, and the window lookup is
    // keyed by (rowData + 8). Logging the keys says whether the served config can ever match them.
    static int s_rowDumpState = 0;
    if (s_rowDumpState == 0 && Readable && Globals::BaseAddress) {
        s_rowDumpState = 1;
        void* Table = *reinterpret_cast<void**>(GI + 0x6E0);
        if (Table && IsReadablePointer(Table, 0x10)) {
            using VtableFn = void*(*)(void*);
            const uintptr_t Vtable = *reinterpret_cast<uintptr_t*>(Table);
            void* Data = reinterpret_cast<VtableFn>(*reinterpret_cast<uintptr_t*>(Vtable + 0x280))(Table);
            MpLog("[HuntPassRows] table=" + MpPtr(Table) + " data=" + MpPtr(Data));
            if (Data && IsReadablePointer(Data, 0x30)) {
                const uintptr_t DataPtr = *reinterpret_cast<uintptr_t*>(Data);
                const int Count = *reinterpret_cast<int*>(reinterpret_cast<uintptr_t>(Data) + 0x28);
                MpLog("[HuntPassRows] array=" + MpPtr((void*)DataPtr) + " count=" + std::to_string(Count));
                const int Limit = Count > 0 && Count < 400 ? Count : 0;

                // [1.14.7 2026-10-03] REMOVED the direct-call window/key probes: they allocated a 24-byte output
                // struct while a successful lookup writes fields through +0x70 (including copies), so a successful
                // call could corrupt memory - and every call returned 0 anyway (section AU).
                // Log the first rows AND the last rows: the newest seasons are what should be active, and
                // the earlier dump showed enabled=0 on the oldest ones.
                std::vector<int> RowIndices;
                for (int i = 0; i < Limit && i < 8; ++i) RowIndices.push_back(i);
                for (int i = (Limit > 8 ? Limit - 8 : 0); i < Limit; ++i) RowIndices.push_back(i);
                for (int i : RowIndices) {
                    const uintptr_t Entry = DataPtr + static_cast<uintptr_t>(i) * 0x18;
                    const uintptr_t RowData = SafeReadPtr(Entry, 0x08);
                    if (!RowData || !IsReadablePointer(reinterpret_cast<void*>(RowData), 0x40)) {
                        MpLog("[HuntPassRows]   [" + std::to_string(i) + "] rowData=" + MpPtr((void*)RowData));
                        continue;
                    }
                    const uintptr_t KeyAddr = RowData + 0x08;
                    const int32_t Key0 = SafeReadI32At(KeyAddr, 0x00);
                    const int32_t Key1 = SafeReadI32At(KeyAddr, 0x04);
                    const uintptr_t StrPtr = SafeReadPtr(KeyAddr, 0x00);
                    const int32_t StrLen = SafeReadI32At(KeyAddr, 0x08);
                    std::string AsString = "<not a string>";
                    if (StrPtr && StrLen > 0 && StrLen < 256
                        && IsReadablePointer(reinterpret_cast<void*>(StrPtr), static_cast<size_t>(StrLen) * 2)) {
                        AsString = MpNarrow(std::wstring(reinterpret_cast<const wchar_t*>(StrPtr), static_cast<size_t>(StrLen - 1)));
                    }
                    MpLog("[HuntPassRows]   [" + std::to_string(i) + "] rowData=" + MpPtr((void*)RowData)
                        + " key=(" + std::to_string(Key0) + "," + std::to_string(Key1) + ")"
                        + " enabled=" + std::to_string(SafeReadU8At(RowData, 0x78))
                        + " asString=" + AsString);
                }
            }
        }
    }
}

static void InstallActiveHuntPassDriver() {
    MH_STATUS Create = MH_CreateHook((void*)(Globals::BaseAddress + 0x018FD230),
        FindActiveRowProbeHook, reinterpret_cast<LPVOID*>(&OrigFindActiveRow));
    MH_STATUS Enable = Create == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x018FD230)) : Create;
    MpLog(std::string("[ActiveHuntPass] FindActiveHuntPassRow probe hook (+0x18FD230) create=")
        + MH_StatusToString(Create) + " enable=" + MH_StatusToString(Enable));
}

static unsigned char ProgReadyHook(void* This) {
    const unsigned char Result = OrigProgReady ? OrigProgReady(This) : 0;

    // [1.14.7 loader state dump trigger 2026-10-03] The first attempt drove this from the server tick and
    // never fired (0 [LoaderDump] lines in a 539 MB log). This hook is demonstrably called repeatedly, so
    // the one-shot dump is triggered here instead: 25s after the first readiness check.
    static std::atomic<int> s_loaderDumpState{ 0 };
    static ULONGLONG s_firstReadyCheck = 0;
    if (s_loaderDumpState.load() == 0) {
        s_firstReadyCheck = GetTickCount64();
        s_loaderDumpState.store(1);
        DumpFeatureFlags("first readiness check");
    } else if (s_loaderDumpState.load() == 1 && GetTickCount64() - s_firstReadyCheck > 25000) {
        s_loaderDumpState.store(2);
        DumpLoadManagerEntries("t+25s from first readiness check");
    }
    const uintptr_t P = reinterpret_cast<uintptr_t>(This);

    static int s_forceReady = -1;
    if (s_forceReady < 0) {
        s_forceReady = (Globals::AmServer
            && MpExeRelativeFlagPresent(L"FORCE_PROGRESSION_READY.flag")) ? 1 : 0;
        MpLog(std::string("[ProgReady] FORCE_PROGRESSION_READY ")
            + (s_forceReady ? "ACTIVE (server role): the four readiness flags will be forced" : "inactive"));
    }

    int F403 = -1, F404 = -1, F405 = -1, F406 = -1;
    if (This && IsReadablePointer(This, 0x410)) {
        F403 = *reinterpret_cast<unsigned char*>(P + 0x403);
        F404 = *reinterpret_cast<unsigned char*>(P + 0x404);
        F405 = *reinterpret_cast<unsigned char*>(P + 0x405);
        F406 = *reinterpret_cast<unsigned char*>(P + 0x406);
    }

    static std::atomic<int> s_readySeq{ 0 };
    const int Seq = s_readySeq.fetch_add(1, std::memory_order_relaxed);
    if (Seq < 12) {
        MpLog("[ProgReady] seq=" + std::to_string(Seq)
            + " result=" + std::to_string(static_cast<int>(Result))
            + " flags 0x403=" + std::to_string(F403) + " 0x404=" + std::to_string(F404)
            + " 0x405=" + std::to_string(F405) + " 0x406=" + std::to_string(F406)
            + " this=" + MpPtr(This));
    }

    if (s_forceReady == 1 && Result == 0 && This && IsReadablePointer(This, 0x410)) {
        *reinterpret_cast<unsigned char*>(P + 0x403) = 1;
        *reinterpret_cast<unsigned char*>(P + 0x404) = 1;
        *reinterpret_cast<unsigned char*>(P + 0x405) = 1;
        *reinterpret_cast<unsigned char*>(P + 0x406) = 1;
        return 1;
    }
    return Result;
}

static void InstallProgressionReadinessProbe() {
    MH_STATUS Create = MH_CreateHook((void*)(Globals::BaseAddress + 0x01A69560),
        ProgReadyHook, reinterpret_cast<LPVOID*>(&OrigProgReady));
    MH_STATUS Enable = Create == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x01A69560)) : Create;
    MpLog(std::string("[ProgReady] readiness hook (+0x1A69560) create=")
        + MH_StatusToString(Create) + " enable=" + MH_StatusToString(Enable));
}

// [1.14.7 LOADER STATE DUMP 2026-10-03] LoadFailed no longer fires (forced config predicate), so the
// per-loader states are invisible exactly when they matter. LoadMgrBeginHook captures the manager
// pointer and the server tick dumps its entries once, ~25s after listening, using the same layout as
// the LoadFailed diagnostic: manager+0x48 array, +0x50 count, stride 0x10; entry+0x08 loader;
// loader+0x10 bLoaded, +0x11 bLoading.
static void* g_lastLoadManager = nullptr;

static void DumpLoadManagerEntries(const char* Tag) {
    void* Manager = g_lastLoadManager;
    if (!Manager || !IsReadablePointer(Manager, 0x58)) {
        MpLog(std::string("[LoaderDump] ") + Tag + " no manager captured yet");
        return;
    }
    const uintptr_t Mgr = reinterpret_cast<uintptr_t>(Manager);
    const uintptr_t ArrayBase = SafeReadPtr(Mgr, 0x48);
    const int32_t ArrayCount = SafeReadI32At(Mgr, 0x50);
    MpLog(std::string("[LoaderDump] ") + Tag + " manager=" + MpPtr(Manager)
        + " array=" + MpPtr((void*)ArrayBase) + " count=" + std::to_string(ArrayCount));
    if (!ArrayBase || ArrayCount <= 0 || ArrayCount > 64) {
        MpLog("[LoaderDump] entry array unusable");
        return;
    }
    for (int i = 0; i < ArrayCount; ++i) {
        const uintptr_t Entry = ArrayBase + static_cast<uintptr_t>(i) * 0x10;
        const uintptr_t Loader = SafeReadPtr(Entry, 0x08);
        void* Owner = ResolveWeakObj(SafeReadI32At(Entry, 0x00), SafeReadI32At(Entry, 0x04));
        int LoadedFlag = -1;
        int LoadingFlag = -1;
        if (Loader && IsReadablePointer(reinterpret_cast<void*>(Loader), 0x28)) {
            LoadedFlag = SafeReadU8At(Loader, 0x10);
            LoadingFlag = SafeReadU8At(Loader, 0x11);
        }
        MpLog("[LoaderDump]   [" + std::to_string(i) + "] owner="
            + (Owner ? SafeObjectNameForDiagnostic(Owner) : std::string("<null>"))
            + " loaded=" + std::to_string(LoadedFlag)
            + " loading=" + std::to_string(LoadingFlag));
    }
}

static void LogPlayerIdentityChain(const char* Tag, void* Manager) {
    const uintptr_t Mgr = reinterpret_cast<uintptr_t>(Manager);
    const uintptr_t Controller = SafeReadPtr(Mgr, 0x20);
    const uintptr_t PlayerState = Controller ? SafeReadPtr(Controller, 0x228) : 0;
    const uintptr_t IdType = PlayerState ? SafeReadPtr(PlayerState, 0x250) : 0;
    const uintptr_t NetId = PlayerState ? SafeReadPtr(PlayerState, 0x258) : 0;
    const uintptr_t NetIdControl = PlayerState ? SafeReadPtr(PlayerState, 0x260) : 0;
    const uintptr_t NetIdVtable = NetId ? SafeReadPtr(NetId, 0x00) : 0;

    MpLog(std::string("[IdentityDiag] ") + Tag
        + " manager=" + MpPtr(Manager)
        + " controller=" + MpPtr((void*)Controller)
        + " playerState=" + MpPtr((void*)PlayerState)
        + " idType=" + MpPtr((void*)IdType)
        + " netId=" + MpPtr((void*)NetId)
        + " netIdControl=" + MpPtr((void*)NetIdControl)
        + " netIdVtable=" + MpPtr((void*)NetIdVtable)
        + " stateName=" + (PlayerState ? SafeObjectNameForDiagnostic((void*)PlayerState) : std::string("<null>")));
}

static void LoadMgrBeginHook(void* This) {
    g_lastLoadManager = This;
    LogPlayerIdentityChain("Begin", This);

    if (OrigLoadMgrBegin) {
        OrigLoadMgrBegin(This);
    }
}

static void InstallLoadMgrBeginHook(const char* Role) {
    static volatile LONG installed = 0;
    if (InterlockedCompareExchange(&installed, 1, 0) != 0) return;
    MH_STATUS Create = MH_CreateHook((void*)(Globals::BaseAddress + 0x01C997A0),
        LoadMgrBeginHook, reinterpret_cast<LPVOID*>(&OrigLoadMgrBegin));
    MH_STATUS Enable = Create == MH_OK ? MH_EnableHook((void*)(Globals::BaseAddress + 0x01C997A0)) : Create;
    MpLog(std::string("[IdentityDiag] UArchonLoadManager::Begin hook (") + Role + ") create="
        + MH_StatusToString(Create) + " enable=" + MH_StatusToString(Enable) + " target=+0x1C997A0");
}

static void StartServerWindowHider() {
    if (MpExeRelativeFlagPresent(L"SHOW_SERVER_WINDOW.flag")) {
        MpLog("[HeadlessServer] window hiding DISABLED by SHOW_SERVER_WINDOW.flag");
        return;
    }
    static volatile LONG started = 0;
    if (InterlockedCompareExchange(&started, 1, 0) != 0) return;
    InstallServerWindowSuppressionHooks();
    HANDLE thread = CreateThread(nullptr, 0, MpServerWindowHiderThread, nullptr, 0, nullptr);
    if (thread != nullptr) {
        CloseHandle(thread);
        MpLog("[HeadlessServer] window hider thread started (server role; no game window will be shown)");
    }
    else {
        MpLog("[HeadlessServer] window hider thread FAILED err=" + std::to_string(GetLastError()));
    }
}

static void InstallServerHeadlessSetup() {
    const char* authModeStr = "Unknown";
    if (Globals::AuthMode == Globals::ServerAuthMode::GlobalGameserver) authModeStr = "GlobalGameserver";
    else if (Globals::AuthMode == Globals::ServerAuthMode::HuntCapability) authModeStr = "HuntCapability";
    else if (Globals::AuthMode == Globals::ServerAuthMode::Invalid) authModeStr = "Invalid";

    const bool hasNullRhi = std::string(GetCommandLineA()).contains("-nullrhi");
    // [2026-10-11 1.14.7] Watchdog= shows the empty-server watchdog switch Init chose (on for every full-argument launch,
    // the player host's included; off only in the manual-test launch).
    MpLog(std::string("[InitRole] AmServer=") + (Globals::AmServer ? "1" : "0")
        + " AuthMode=" + authModeStr
        + " NullRHI=" + (hasNullRhi ? "1" : "0")
        + " Watchdog=" + (EnableWatchdog ? "1" : "0")
        + P2PHooks::DescribeRole());

    // ========================================================================
    // [1.14.7 headless ROOT FIX, CORRECTED 2026-10-04] The engine's nullrhi cache must NOT be written.
    //
    // The byte at RVA 0x06CD7878 is not FApp::CanEverRender(). Ghidra (1.14.7 program, CL 647472)
    // shows it is the cached result of FParse::Param(FCommandLine::Get(), L"nullrhi"):
    //   * initializer (inlined in every reader, e.g. FUN_14413fd70 and the RHI startup itself):
    //         _Init_thread_header(&DAT_146cd787c);
    //         if (guard == -1) { DAT_146cd7878 = FUN_142634de0(FCommandLine::Get(), L"nullrhi");
    //                            _Init_thread_footer(&DAT_146cd787c); }
    //   * its consumer, the native RHI entry point FUN_14349a760:
    //         if (... || DAT_146cd7878 != 0) { FUN_14348f3b0(); goto done; }   // NullDrv
    //         DAT_146f5a0b0 = FUN_1434ab980();                                 // real D3D device
    // A nonzero value therefore MEANS "-nullrhi was requested" and selects the null driver.
    //
    // The previous revision of this function wrote 0 to the byte and 2 to its magic-static guard.
    // That overrode the requested NullRHI mode, took the hardware branch above and gave every
    // dedicated hub a real D3D device (measured: 40% and 31% of the GPU 3D engine, with the window
    // merely hidden by SW_HIDE). It also never suppressed the window it was meant to fix.
    //
    // Fix: leave the byte and its guard entirely to the engine's own initializer, which runs inside
    // RHI startup after the command line is complete, so "-nullrhi" reaches NullDrv as intended.
    // Server role only; clients keep rendering normally.
    const uint8_t NullRhiCache = *reinterpret_cast<uint8_t*>(Globals::BaseAddress + 0x06CD7878);
    const int32_t NullRhiGuard = *reinterpret_cast<int32_t*>(Globals::BaseAddress + 0x06CD787C);
    MpLog(std::string("[HeadlessServer] nullrhi cache left to the engine (pre-init value=")
        + std::to_string(static_cast<unsigned>(NullRhiCache))
        + " guard=" + std::to_string(NullRhiGuard)
        + " cmdline NullRHI=" + (hasNullRhi ? "1" : "0")
        + "); the engine's own initializer in RHI startup now selects NullDrv vs hardware");

    // Safety net: if any window still appears, hide it (see the headless-server fix above).
    StartServerWindowHider();
}

// [2026-10-10 1.14.7 RAM] No Chromium/CEF on any server role (DeployServer hubs and dedicated hunts, the player host).
// RVA 0x00F357D0 = FWebBrowserWidgetModule::StartupModule: .pdata entry 0x00F357D0, the only reference is slot 1 of
// the module vtable 0x05162920 (wide name "WebBrowserWidget" at 0x05162960); tools/rva-port-audit.py: <- 1.12
// 0x00EF8990 VERIFIED (identical prologue). It makes a UWebBrowserAssetManager, loads the WebBrowser module and calls
// IWebBrowserModule::Get().GetSingleton() (FWebBrowserModule vtable +0x48 = 0x045AA2E0), whose first call constructs
// FWebBrowserSingleton (0x045B3C10): CefInitialize plus an UnrealCEFSubProcess.exe gpu-process child (10 Oct: one per
// hub, ~111 MB private each), then sets the default materials (vcalls +0x80 / +0x88). The engine module ignores
// -nocef. A server shows no web pages; the module's ShutdownModule is an empty `ret`, its destructor never reads the
// asset manager (+8) and FWebBrowserModule::ShutdownModule is null-safe, so skipping leaves the module loaded and
// inert. A later client-UI GetSingleton call (login/purchase flow, UArchonWebBrowserWindow) would still create CEF
// lazily, as today. Installed from DllMain (winmm proxy -> LoadLibraryW), before PreInit starts plugin modules;
// clients never run InitServerHooks. Replaces the old player-host-only copy in p2p/PlayerHost.cpp.
// KEEP_WEB_BROWSER.flag leaves the module startup alone. Wrong bytes / not a .pdata entry: no hook, CEF starts.
static void MpWebBrowserWidgetStartupSkip(void*) {
    MpLog("[RenderData] skipped WebBrowserWidget module startup; Chromium/CEF not started on this server");
}

// mov rax,rsp; push rsi; sub rsp,70h; cmp qword ptr [rcx+8],0 (WebBrowserAssetMgr); mov rsi,rcx; jne rel32
static const uint8_t kWebBrowserWidgetStartupBytes[] = {
    0x48, 0x8B, 0xC4, 0x56, 0x48, 0x83, 0xEC, 0x70, 0x48, 0x83, 0x79, 0x08, 0x00, 0x48, 0x8B, 0xF1, 0x0F, 0x85 };

static void InstallServerWebBrowserSkip() {
    if (!Globals::AmServer) return;
    if (MpExeRelativeFlagPresent(L"KEEP_WEB_BROWSER.flag")) {
        MpLog("[RenderData] WebBrowserWidget startup skip DISABLED by KEEP_WEB_BROWSER.flag; Chromium/CEF will start");
        return;
    }
    const CwSite Site{ "WebBrowserWidget::StartupModule", 0x00F357D0,
        kWebBrowserWidgetStartupBytes, sizeof(kWebBrowserWidgetStartupBytes), 0, 0,
        reinterpret_cast<void*>(&MpWebBrowserWidgetStartupSkip), nullptr };
    if (const char* Why = CwVerifySite(Site)) {
        MpLog(std::string("[RenderData] WebBrowserWidget startup skip NOT installed: ") + Why
            + " target=+" + MpHex(Site.Rva) + "; Chromium/CEF left enabled");
        return;
    }
    void* const Target = reinterpret_cast<void*>(Globals::BaseAddress + Site.Rva);
    const MH_STATUS Create = MH_CreateHook(Target, Site.Detour, nullptr);
    const MH_STATUS Enable = (Create == MH_OK) ? MH_EnableHook(Target) : Create;
    if (Create == MH_OK && Enable != MH_OK) MH_RemoveHook(Target);
    MpLog(std::string("[RenderData] WebBrowserWidget startup skip ") + (Enable == MH_OK ? "installed" : "NOT installed")
        + " create=" + MH_StatusToString(Create) + " enable=" + MH_StatusToString(Enable) + " target=+" + MpHex(Site.Rva)
        + " entry=pdata bytes=match" + (Enable == MH_OK ? "" : "; Chromium/CEF left enabled"));
}

void InitServerHooks() {
    InitLog("[InitServerHooks] Entry - MH_Initialize");
    MH_Initialize();
    InitLog("[InitServerHooks] MH_Initialize OK");

    // [1.14.7 NULLRHI ROOT FIX 2026-10-04] Installed before the RHI selector reads the engine command
    // line: without it the engine's own FCommandLine never carries -nullrhi (see HookFCommandLineGet),
    // so a dedicated hub initialised a hardware D3D11 device even with -nullrhi on the OS line.
    InstallEngineCommandLineHook();

    InstallServerHeadlessSetup();
    // Every server role: no Chromium/CEF (see InstallServerWebBrowserSkip).
    InstallServerWebBrowserSkip();
    // The optional player-hosted mode's server hooks (P2PHooks.h; nothing without the module).
    P2PHooks::InstallServerHooks();

    InstallApiHook(L"kernel32.dll", "ExitProcess", ExitProcessHook, reinterpret_cast<LPVOID*>(&OrigExitProcess), "kernel32!ExitProcess");
    InstallApiHook(L"ntdll.dll", "RtlExitUserProcess", RtlExitUserProcessHook, reinterpret_cast<LPVOID*>(&OrigRtlExitUserProcess), "ntdll!RtlExitUserProcess");
    InstallApiHook(L"ntdll.dll", "NtTerminateProcess", NtTerminateProcessHook, reinterpret_cast<LPVOID*>(&OrigNtTerminateProcess), "ntdll!NtTerminateProcess");
    InstallApiHook(L"kernelbase.dll", "TerminateProcess", TerminateProcessHook, reinterpret_cast<LPVOID*>(&OrigTerminateProcess), "kernelbase!TerminateProcess");
    InstallApiHook(L"kernelbase.dll", "RaiseException", RaiseExceptionHook, reinterpret_cast<LPVOID*>(&OrigRaiseException), "kernelbase!RaiseException");
    InstallApiHook(L"ucrtbase.dll", "exit", UcrtExitHook, reinterpret_cast<LPVOID*>(&OrigUcrtExit), "ucrtbase!exit");
    InstallApiHook(L"ucrtbase.dll", "_exit", UcrtUnderscoreExitHook, reinterpret_cast<LPVOID*>(&OrigUcrtUnderscoreExit), "ucrtbase!_exit");
    InstallApiHook(L"ucrtbase.dll", "abort", UcrtAbortHook, reinterpret_cast<LPVOID*>(&OrigUcrtAbort), "ucrtbase!abort");
    InstallApiHook(L"msvcrt.dll", "exit", MsvcrtExitHook, reinterpret_cast<LPVOID*>(&OrigMsvcrtExit), "msvcrt!exit");
    InstallApiHook(L"msvcrt.dll", "_exit", MsvcrtUnderscoreExitHook, reinterpret_cast<LPVOID*>(&OrigMsvcrtUnderscoreExit), "msvcrt!_exit");
    InstallApiHook(L"msvcrt.dll", "abort", MsvcrtAbortHook, reinterpret_cast<LPVOID*>(&OrigMsvcrtAbort), "msvcrt!abort");
    VectoredExceptionHandle = AddVectoredExceptionHandler(1, VectoredExceptionTrace);
    MpLog("[ExceptionTrace] AddVectoredExceptionHandler handle=" + MpPtr(VectoredExceptionHandle));

    // UE's top-level crash/exception filter. It calls FPlatformMisc::RequestExit(1),
    // which is the immediate source of the observed code=3 TerminateProcess.
    // [1.14.7] +0x02657770 is an exception-text formatter, not the UE unhandled-exception
    // filter. Its ABI differs from UEUnhandledExceptionFilterHook, so do not detour it.
    MpLog("[ExitTrace] UEUnhandledExceptionFilter hook skipped (1.14.7 target ABI mismatch)");

    // [1.12.0] Only enable CONFIRMED hooks from HOOK_TARGETS_1.12.0.md

    // ProcessEvent - CONFIRMED RVA 0x02861880
    MH_CreateHook((void*)(Globals::BaseAddress + 0x02861880), ProcessEventHook, &OrigProcessEvent);
    MH_EnableHook((void*)(Globals::BaseAddress + 0x02861880));

    // [2026-07-28 TEMPEST SCALE DIAG] Native boundaries reached directly from Blueprint bytecode:
    //   FUN_14156d7d0 - GetFloatAttributeFromAbilitySystemComponent body, RVA 0x0156D7D0.
    //   FUN_143ccf210 - SetFloatPropertyByName body, RVA 0x03CCF210.
    // Install only for an explicit repro so production pays no detour or GObjects-scan cost.
    // [1.14.7 2026-10-08] Both are 1.12 RVAs that land MID-FUNCTION on 1.14.7 (0x0156D7D0 is +0x260 into
    // FUN_14156d570, 0x03CCF210 is +0x580 into FUN_143ccec90, per the .pdata sweep), so TEMPEST_SCALE_DIAG.flag
    // is refused until they are remapped; a detour there would corrupt whatever function it lands in.
    // tools/rva-port-audit.py: 0x03CCF210 -> 0x03EE7D60 (bidirectionally verified); 0x0156D7D0 is ambiguous
    // (two equal 1.14.7 matches), so the diag stays refused.
    if (TempestScaleDiagEnabled()) {
        MpLog("[TempestScaleDiag] refused on 1.14.7: hook targets 0x0156D7D0 / 0x03CCF210 are 1.12 RVAs "
              "that are not function entries on this build");
    }
    if (false) {
        MH_STATUS GetFloatCreate = MH_CreateHook(
            (void*)(Globals::BaseAddress + 0x0156D7D0),
            GetFloatAttributeFromAbilitySystemComponentDiagHook,
            &OrigGetFloatAttributeFromAbilitySystemComponentDiag);
        MH_STATUS GetFloatEnable = MH_EnableHook(
            (void*)(Globals::BaseAddress + 0x0156D7D0));
        MpLog(std::string("[TempestScaleDiag] GetFloatAttribute hook create=")
            + MH_StatusToString(GetFloatCreate)
            + " enable=" + MH_StatusToString(GetFloatEnable)
            + " target=+" + MpHex(0x0156D7D0));

        MH_STATUS SetFloatCreate = MH_CreateHook(
            (void*)(Globals::BaseAddress + 0x03CCF210),
            SetFloatPropertyByNameDiagHook,
            &OrigSetFloatPropertyByNameDiag);
        MH_STATUS SetFloatEnable = MH_EnableHook(
            (void*)(Globals::BaseAddress + 0x03CCF210));
        MpLog(std::string("[TempestScaleDiag] SetFloatPropertyByName hook create=")
            + MH_StatusToString(SetFloatCreate)
            + " enable=" + MH_StatusToString(SetFloatEnable)
            + " target=+" + MpHex(0x03CCF210));
    }

    if (TempestDamageDiagEnabled()) {
        MpLog("[TempestDamageDiag] enabled: passive ProcessEvent damage tracing active; keep TEMPEST_SCALE_DIAG.flag off");
    }

    // [1.14.7] OnPlayerDataLoadComplete native body (exec wrapper at +0x02305430).
    // The previous 1.12 RVA +0x01B690F0 is not a function in this binary. The native body
    // is +0x01CB33B0 and matches OnPlayerDataLoadCompleteHook(UObject*, bool).
    MH_CreateHook((void*)(Globals::BaseAddress + 0x01CB33B0), OnPlayerDataLoadCompleteHook, &OrigOnPlayerDataLoadComplete);
    MH_EnableHook((void*)(Globals::BaseAddress + 0x01CB33B0));

    // [1.14.7] Knockout diagnostic remains disabled: the old +0x01B8ACD0 target is an
    // unrelated function in this binary and no matching native method/ABI has been proven.
    MpLog("[InitServerHooks] Knockout diagnostic hook skipped (1.14.7 native target unresolved)");

    // [1.14.7] FGameplayScheduler::Initialize at RVA 0x01D95B70. Rewrites an arena schedule
    // row's window to span "now" BEFORE the scheduler copies its row states, so the (raw-UtcNow) eval marks
    // the arena hunt current -> Trials ungreys + launchable. This compatibility path is production-default.
    MH_STATUS SchedInitCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x01D95B70), SchedulerInitializeHook, &OrigSchedulerInitialize);
    MH_STATUS SchedInitEnable = MH_EnableHook((void*)(Globals::BaseAddress + 0x01D95B70));
    MpLog(std::string("[InitServerHooks] FGameplayScheduler::Initialize create=")
        + MH_StatusToString(SchedInitCreate) + " enable=" + MH_StatusToString(SchedInitEnable)
        + " target=+" + MpHex(0x01D95B70));

    // [2026-07-16] ApplyPlayerRole - RVA 0x01B92B90 (string xref "[ApplyPlayerRole] %s - null
    // PlayerRole...", FUN_141a4b790). Traces the late-joiner PlayerRole-null completion path.
    MH_STATUS AprCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x01B92B90), ApplyPlayerRoleHook, &OrigApplyPlayerRole);
    MH_STATUS AprEnable = MH_EnableHook((void*)(Globals::BaseAddress + 0x01B92B90));
    MpLog(std::string("[InitServerHooks] ApplyPlayerRole hook create=")
        + MH_StatusToString(AprCreate) + " enable=" + MH_StatusToString(AprEnable)
        + " target=+" + MpHex(0x01B92B90));

    // 1.14.7 getter at +0x02F00330 returns the GameMapsSettings FString at offset +0x70 (GameDefaultMap).
    // Ghidra confirms +0x02D2BD50 is not a function entry; that earlier RVA comment was stale.
    MH_CreateHook((void*)(Globals::BaseAddress + 0x02F00330), GetGameDefaultMap, &OrigGetDefaultMap);
    MH_EnableHook((void*)(Globals::BaseAddress + 0x02F00330));

    // GameEngineTickHook - base UEngine::Tick RVA 0x03E10AB0 (maps from 1.12 0x03BFDB50, slot +0x2B0)
    MH_CreateHook((void*)(Globals::BaseAddress + 0x03E10AB0), GameEngineTickHook, &OrigGameEngineTick);
    MH_EnableHook((void*)(Globals::BaseAddress + 0x03E10AB0));

    // UInteractionCalloutWidget::HideHoldText native body (1.14.7 RVA 0x01E42F00;
    // exec wrapper at 0x023FEC00). Ramsgate boots through
    // UAirshipSlotWidget::InitSlot and can hit a null widget+0x3C0 member here,
    // causing UE's unhandled-exception path to RequestExit(1) -> exit code 3.
    MH_CreateHook((void*)(Globals::BaseAddress + 0x01E42F00), InteractionCalloutHideHoldTextHook, &OrigInteractionCalloutHideHoldText);
    MH_EnableHook((void*)(Globals::BaseAddress + 0x01E42F00));

    // UArchonLoadingScreen::ScreenFadeIn. Dedicated -nullrhi servers still call this
    // during failed player-load paths; the original dereferences LoadingScreen+0x3E8
    // without a null check and crashes at RVA 0x01CADEA6.
    MH_STATUS FadeCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x01E0FBB0), ArchonLoadingScreenFadeInHook, &OrigArchonLoadingScreenFadeIn);
    MH_STATUS FadeEnable = MH_EnableHook((void*)(Globals::BaseAddress + 0x01E0FBB0));
    MpLog(std::string("[InitServerHooks] ArchonLoadingScreenFadeIn create=")
        + MH_StatusToString(FadeCreate)
        + " enable=" + MH_StatusToString(FadeEnable)
        + " target=+" + MpHex(0x01E0FBB0));

    // UNetDriver::TickDispatch inner helper. It walks ClientConnections at
    // NetDriver+0x90 using Num at +0x98 with no per-element validation; bad
    // connection bookkeeping after local load failure crashes at RVA 0x03D91CEB.
    MH_STATUS NetDriverTickCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x03FAE420), NetDriverTickDispatchInnerHook, &OrigNetDriverTickDispatchInner);
    MH_STATUS NetDriverTickEnable = MH_EnableHook((void*)(Globals::BaseAddress + 0x03FAE420));
    MpLog(std::string("[InitServerHooks] NetDriverTickDispatchInner create=")
        + MH_StatusToString(NetDriverTickCreate)
        + " enable=" + MH_StatusToString(NetDriverTickEnable)
        + " target=+" + MpHex(0x03FAE420));

    // ProcessRequest - Ghidra-confirmed 1.14.7 URL consumer and header boundary.
    MH_CreateHook((void*)(Globals::BaseAddress + 0x032C5FE0), ProcessRequest, &OrigProcessRequest);
    MH_EnableHook((void*)(Globals::BaseAddress + 0x032C5FE0));

    // [1.14.7 REMOVED 2026-10-05] The character parse probe (hook at 0x0DEE610) is no longer installed. It
    // answered its question - the requester holds an empty id (heldNum=0) - and its findings are recorded.
    // Diagnostics are removed now: one of them crashed the process, and none are needed for the fixes.

    // [1.14.7 2026-10-04] The 0x1BAF7F0 / 0x1CB3C37 loader hooks were REMOVED. They were installed from
    // RtlLookupFunctionEntry's BeginAddress, which can be a CHAINED continuation fragment rather than a real
    // entry, and hooking that crashed the hub with exit code 3:
    //   ucrtbase!sprintf_s<260> -> MpLog -> MpProbeLoaderArgs -> MpLoaderFrame6Hook
    // The resolver now follows UNW_FLAG_CHAININFO to the primary entry; re-measure the chain before hooking
    // any of those frames again.

    // [1.14.7 2026-10-04] The SetURL hook attempt was REMOVED: MinHook returned MH_ERROR_UNSUPPORTED_FUNCTION
    // for RVA 0x03102740, so it is not a hookable function entry and the runtime comment naming it as
    // FCurlHttpRequest::SetURL is wrong. The association is measured from ProcessRequest's caller chain instead
    // (see MpProbeCharacterRequestAssociation), which needs no extra hook.

    // The ProcessRequest detour rewrites allowlisted HTTP(S) URLs for the host too.

    // [1.14.7] UNetDriver::SetReplicationDriver at +0x03FACF60; installs ReplicationDriver.
    MH_CreateHook((void*)(Globals::BaseAddress + 0x03FACF60), SetReplicationDriverHook, &OrigSetReplicationDriver);
    MH_EnableHook((void*)(Globals::BaseAddress + 0x03FACF60));

    // [1.14.7 2026-10-05] The hub access-violates ~90 s after a client joins with every added flag absent.
    // Both frames are decompiled: FUN_143d47a90 (RVA 0x03D47A90, 628 bytes) is a direction query that hands
    // its component's FInterpCurveVector at +0x448 to the evaluator FUN_141091d50. At the fault the curve
    // pointer itself was wild (0xDFD633F8) and the first read of it (Num, curve+8) faulted at 0xDFD63400, so
    // the component - not the evaluator - is already unusable. Detouring the entry lets a corrupt curve
    // return a zero direction instead of taking the process down. DISABLE_SPLINE_GUARD.flag reverts it.
    if (SplineGuardEnabled()) {
        MH_STATUS SplineCreate = MH_CreateHook(
            (void*)(Globals::BaseAddress + 0x03D47A90), SplineDirectionGuard, &OrigSplineDirection);
        MH_STATUS SplineEnable = MH_EnableHook((void*)(Globals::BaseAddress + 0x03D47A90));
        MpLog(std::string("[InitServerHooks] SplineDirectionGuard create=")
            + MH_StatusToString(SplineCreate)
            + " enable=" + MH_StatusToString(SplineEnable)
            + " target=+" + MpHex(0x03D47A90));

        // [1.14.7 2026-10-05] OPT-IN ONLY - measured unsafe. A detour at this call site crashes on its own
        // compiled prologue (`movaps [rsp+150h],xmm6` faulted at MysticParadox.dll+0x22569, hub pid 37160 at
        // 23:30:51): the engine reaches the evaluator with a stack this hook's prologue cannot assume. The
        // +0x1091D5D fault is recovered in VectoredExceptionTrace instead, which needs no stack assumptions.
        if (MpExeRelativeFlagPresent(L"ENABLE_SPLINE_EVAL_HOOK.flag")) {
            MH_STATUS EvalCreate = MH_CreateHook(
                (void*)(Globals::BaseAddress + 0x1091D50), SplineCurveEvalGuard, &OrigSplineCurveEval);
            MH_STATUS EvalEnable = MH_EnableHook((void*)(Globals::BaseAddress + 0x1091D50));
            MpLog(std::string("[InitServerHooks] SplineCurveEvalGuard create=")
                + MH_StatusToString(EvalCreate)
                + " enable=" + MH_StatusToString(EvalEnable)
                + " target=+" + MpHex(0x1091D50));
        }
    }

    // [1.14.7] +0x03F90E20 has no verified function boundary/ABI; skip the old read-only probe.
    MpLog("[InitServerHooks] ServerReplicateActors probe skipped (1.14.7 target unresolved)");
    // [2026-10-11 1.14.7] Say so when the dead A/B flag is present, so nobody reads a capture as "rate capped".
    if (MpExeRelativeFlagPresent(L"SRA_RATE_CAP.flag")) {
        MpLog("[SraRateCap] SRA_RATE_CAP.flag present but has NO EFFECT on 1.14.7 (its hook is not installed; "
              "MpDriveReplicationGraph drives the graph every frame)");
    }

    // [1.14.7 2026-10-05] UArchonReplicationGraph::ServerReplicateActors (vtable +0x2F8, RVA
    // 0x01C034C0), pass-through counter only. Its decompiled body is the deferred owner-only route plus
    // UReplicationGraph::ServerReplicateActors, so whether this fires tells us whether the engine drives
    // the graph at all - the question the whole missing-PlayerState blocker turns on.
    {
        MH_STATUS SraCreate = MH_CreateHook(
            (void*)(Globals::BaseAddress + 0x01C034C0), ArchonGraphSraHook, &OrigArchonGraphSra);
        MH_STATUS SraEnable = MH_EnableHook((void*)(Globals::BaseAddress + 0x01C034C0));
        MpLog(std::string("[InitServerHooks] ArchonGraph ServerReplicateActors create=")
            + MH_StatusToString(SraCreate)
            + " enable=" + MH_StatusToString(SraEnable)
            + " target=+" + MpHex(0x01C034C0));
    }

    // [2026-07-26 AMP FREEZE ROOT FIX] Normalize every PlayerController before Archon's graph
    // classifies it. Ghidra-confirmed UArchonReplicationGraph::RouteAddNetworkActorToNodes.
    MH_STATUS PcRouteCreate = MH_CreateHook(
        (void*)(Globals::BaseAddress + 0x01BFE430),
        ArchonRouteAddNetworkActorHook, &OrigArchonRouteAddNetworkActor);
    MH_STATUS PcRouteEnable = MH_EnableHook(
        (void*)(Globals::BaseAddress + 0x01BFE430));
    MpLog(std::string("[InitServerHooks] PlayerController route guard create=")
        + MH_StatusToString(PcRouteCreate)
        + " enable=" + MH_StatusToString(PcRouteEnable)
        + " target=+" + MpHex(0x01BFE430));

    // PlayerRole global-membership diagnostic. Pass-through only; the role relevance change
    // remains entirely in RouteAddNetworkActorToNodes above.
    MH_STATUS RoleRouteRemoveCreate = MH_CreateHook(
        (void*)(Globals::BaseAddress + 0x01BFE4C0),
        ArchonRouteRemoveNetworkActorHook, &OrigArchonRouteRemoveNetworkActor);
    MH_STATUS RoleRouteRemoveEnable = MH_EnableHook(
        (void*)(Globals::BaseAddress + 0x01BFE4C0));
    MpLog(std::string("[InitServerHooks] PlayerRole route-remove diagnostic create=")
        + MH_StatusToString(RoleRouteRemoveCreate)
        + " enable=" + MH_StatusToString(RoleRouteRemoveEnable)
        + " target=+" + MpHex(0x01BFE4C0));

    // [2026-10-10 1.14.7] PlayerController pre-channel guard on UReplicationGraph::ReplicateSingleActor
    // (0x00F2C230; ABI and call path in the comment above RepGraphReplicateSingleActorGuardHook). The old
    // +0x00F27260 guess was never installed. Fail closed: the hook goes in only when the target is a .pdata
    // entry with the expected prologue; otherwise the SetChannelActor and ReplicateActor guards below
    // still enforce the invariant.
    {
        static const uint8_t PreChannelExpect[] = {
            0x40, 0x55,                                // push rbp
            0x53, 0x56, 0x57,                          // push rbx / rsi / rdi
            0x41, 0x55, 0x41, 0x56,                    // push r13 / r14
            0x48, 0x8D, 0x6C, 0x24, 0xE9,              // lea rbp, [rsp-0x17]
            0x48, 0x81, 0xEC, 0xD8, 0x00, 0x00, 0x00,  // sub rsp, 0xD8
        };
        const CwSite PreChannelSite{ "ReplicateSingleActor", 0x00F2C230,
            PreChannelExpect, sizeof(PreChannelExpect), 0, 0,
            reinterpret_cast<void*>(&RepGraphReplicateSingleActorGuardHook),
            &OrigRepGraphReplicateSingleActor };
        if (const char* Reason = CwVerifySite(PreChannelSite)) {
            MpLog(std::string("[InitServerHooks] PlayerController pre-channel guard NOT installed: ")
                + Reason + " target=+" + MpHex(PreChannelSite.Rva));
        } else {
            MH_STATUS PreChannelCreate = MH_CreateHook(
                reinterpret_cast<void*>(Globals::BaseAddress + PreChannelSite.Rva),
                PreChannelSite.Detour, PreChannelSite.Orig);
            MH_STATUS PreChannelEnable = MH_EnableHook(
                reinterpret_cast<void*>(Globals::BaseAddress + PreChannelSite.Rva));
            MpLog(std::string("[InitServerHooks] PlayerController pre-channel guard create=")
                + MH_StatusToString(PreChannelCreate)
                + " enable=" + MH_StatusToString(PreChannelEnable)
                + " target=+" + MpHex(PreChannelSite.Rva) + " entry=pdata bytes=match");
        }
    }

    // Universal PlayerController binding invariant. This catches native SetChannelActor callers
    // outside the RepGraph helper and blocks a wrong-connection initial bunch before serialization.
    MH_STATUS PcSetChannelCreate = MH_CreateHook(
        (void*)(Globals::BaseAddress + 0x03D8FB20),
        PlayerControllerSetChannelActorGuardHook,
        &OrigPlayerControllerSetChannelActor);
    MH_STATUS PcSetChannelEnable = MH_EnableHook(
        (void*)(Globals::BaseAddress + 0x03D8FB20));
    MpLog(std::string("[InitServerHooks] PlayerController SetChannelActor guard create=")
        + MH_StatusToString(PcSetChannelCreate)
        + " enable=" + MH_StatusToString(PcSetChannelEnable)
        + " target=+" + MpHex(0x03D8FB20));

    // Final fail-closed ownership invariant. This hook is production-always because allowing a
    // remote PlayerController's initial bunch would make stock OnActorChannelOpen replace the
    // receiving client's controller. REPGRAPH_DIAG.flag only controls the frequency tally inside.
    MH_STATUS PcChannelCreate = MH_CreateHook(
        (void*)(Globals::BaseAddress + 0x03D8A2D0),
        ReplicateActorFreqHook, &OrigReplicateActorFreq);
    MH_STATUS PcChannelEnable = MH_EnableHook(
        (void*)(Globals::BaseAddress + 0x03D8A2D0));
    MpLog(std::string("[InitServerHooks] PlayerController channel guard create=")
        + MH_StatusToString(PcChannelCreate)
        + " enable=" + MH_StatusToString(PcChannelEnable)
        + " target=+" + MpHex(0x03D8A2D0)
        + (RepGraphDiag() ? " (RepFreq diag also enabled)" : ""));

    // Artificer-specific native Blueprint-policy dispatcher.
    // [1.14.7]: 0x0230B750 is execCanActivateAbilityBP with 3-arg exec ABI (UObject*, FFrame&, RESULT_DECL),
    // NOT bool(this). Diagnostic-only hook is skipped pending resolution of the native caller.
    MpLog("[InitServerHooks] Artificer CanActivateAbilityBP hook skipped (ABI unresolved on 1.14.7)");

    // [Group C cleanup 2026-07-13] The old broad SetChannelActor/ReplicateProperties diagnostic probes
    // remain removed. The narrow PlayerController ownership guard above was reintroduced on 2026-07-28
    // because it blocks a proven connection-fatal invariant violation rather than collecting telemetry.

    // [1.12.0 FIX 2026-07-10] CreateReplicationDriver (FUN_143d72a80, RVA 0x03D72A80).
    // Confirmed via decompile: reads global gate at 0x06729DA8, then NetDriver+0x178.
    // If either is null-equivalent, prints "ReplicationDriverClass is null!" and
    // returns 0. Our hook force-populates both.
    g_RepDriverEnableFlag = reinterpret_cast<uint32_t*>(Globals::BaseAddress + 0x06AD6F54);
    // Also grab the ReplicationGraphFeature helper TArray (from FUN_143d72cd0 -> &DAT_146ce9588).
    // Layout: {void* Data, int32 Num, int32 Max}. We need Data ptr and Num.
    g_RepGraphFeatureArrayData = reinterpret_cast<void**>(Globals::BaseAddress + 0x06FB12E0);
    g_RepGraphFeatureArrayNum  = reinterpret_cast<int*>(Globals::BaseAddress + 0x06FB12E0 + 8);
    MH_CreateHook((void*)(Globals::BaseAddress + 0x03F8D8E0), CreateRepDriverHook, &OrigCreateRepDriver);
    MH_EnableHook((void*)(Globals::BaseAddress + 0x03F8D8E0));

    // [Group D cleanup 2026-07-13] GetNetDriverInternalHook install removed (pure passthrough probe).

    // [1.14.7] Old +0x03D56360 IsLevelInitForActor target is not verified in this binary.
    MpLog("[InitServerHooks] IsLevelInitForActor hook skipped (1.14.7 target unresolved)");

    // [1.14.7] Old +0x01916D60 target has three pointer inputs and void return; it does not
    // match GetStartSpotHook's APlayerStart* return ABI. Skip until the native boundary is resolved.
    MpLog("[InitServerHooks] GetStartSpot hook skipped (1.14.7 ABI mismatch)");

    // InternalGetNetMode (0x03F91EB0) - direct callers hit this helper and it virtual-calls UNetDriver::IsServer at vtable +0x378.
    MH_CreateHook((void*)(Globals::BaseAddress + 0x03F91EB0), InternalNetModeHook, &OrigInternalNetModeHook);
    MH_EnableHook((void*)(Globals::BaseAddress + 0x03F91EB0));

    // World/GetNetMode (0x042CC560, old 1.12 RVA 0x0409EC10) - reads World->NetDriver at +0x38 then virtual-calls vtable +0x378.
    // NOTE: 0x042CC6E0 was incorrectly mapped earlier; it returns GIsClient and must NOT be hooked.
    MH_CreateHook((void*)(Globals::BaseAddress + 0x042CC560), WorldNetModeHook, &OrigWorldNetModeHook);
    MH_EnableHook((void*)(Globals::BaseAddress + 0x042CC560));

    // [1.14.7] The old IsNetReady target is absent. A same-slot candidate is not yet proven
    // to implement this override, so keep the force-ready hook disabled.
    MpLog("[InitServerHooks] IsNetReady hook skipped (1.14.7 target unresolved)");

    // The former log-verbosity byte +0x069F6290 has no verified 1.14.7 symbol/xref; do not write it.

    // [1.14.7] Old +0x00A59270 NotifyClientDisconnected target has no verified function/ABI.
    MpLog("[InitServerHooks] NotifyClientDisconnected hook skipped (1.14.7 target unresolved)");

    // Safe disconnect observation: no guessed UObject dereference, only scalar connection fields
    // plus return-address stack. This identifies why a post-login client tears down its channel.
    MH_STATUS CloseCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x03F62B90), NetConnectionCloseHook, &OrigNetConnectionClose);
    MH_STATUS CloseEnable = MH_EnableHook((void*)(Globals::BaseAddress + 0x03F62B90));
    MpLog(std::string("[InitServerHooks] NetConnectionClose hook create=")
        + MH_StatusToString(CloseCreate) + " enable=" + MH_StatusToString(CloseEnable));


    // [1.12.0] Do not hook 0x00A6F224 here. Disassembly shows it is four bytes into
    // UIpNetDriver::TickDispatch (entry 0x00A6F220), not the old FixupNetworkNotify
    // helper. Hooking mid-prologue corrupts the TickDispatch stack frame and can poison
    // UIpNetDriver disconnect bookkeeping. Listen() already passes UWorld+0x28 as the
    // network notify, so this patch path is not needed for 1.12.0.

    // HasFinishedLoadingHook - runtime-confirmed RVA 0x01BA5E40
    MH_CreateHook((void*)(Globals::BaseAddress + 0x01BA5E40), HasFinishedLoadingHook, &OrigHasFinishedLoading);
    MH_EnableHook((void*)(Globals::BaseAddress + 0x01BA5E40));

    // [Group E2 cleanup 2026-07-13] OnPlayerDataLoadComplete + ServerRestartPlayer diagnostic detour installs removed
    // ([OPDLC]/[RestartTrace] loggers + dormant Path B experiment; passthrough, no forcing).
    // [A2 2026-07-12] Headless-server viewport fallback; 1.14.7 idmap maps this exec thunk to RVA 0x0398BB50.
    // Fixes vendor UpdateCameraForAspect divide-by-zero (viewport 0x0 on the dedicated server).
    {
        MH_STATUS c = MH_CreateHook((void*)(Globals::BaseAddress + 0x0398BB50), ExecGetViewportSizeHook, &OrigGetViewportSize);
        MH_STATUS e = c == MH_OK
            ? MH_EnableHook((void*)(Globals::BaseAddress + 0x0398BB50))
            : c;
        MpLog(std::string("[InitServerHooks] GetViewportSize create=") + MH_StatusToString(c) + " enable=" + MH_StatusToString(e) + " target=+" + MpHex(0x0398BB50));
    }
    // [Group D2 cleanup 2026-07-13] ProcessRemoteFunctionWrapper + ActorNetMode diagnostic hook installs removed.

    // ServerBootCrash - CONFIRMED RVA 0x02659A20
    MH_CreateHook((void*)(Globals::BaseAddress + 0x02659A20), ServerBootCrash, &OrigServerBootCrash);
    MH_EnableHook((void*)(Globals::BaseAddress + 0x02659A20));

    // [1.14.7 REMAP 2026-10-03] UArchonLoadManager::LoadFailed is +0x01CB0010.
    //
    // Verification (no assumptions):
    //   * The ASCII literal "UArchonLoadManager::LoadFailed" at 0x1454C0088 has exactly three
    //     xrefs, all inside FUN_141cb0010 - the same string-anchor method that identified the
    //     1.12 target (then +0x01B65EB0).
    //   * ABI: Ghidra decompiles FUN_141cb0010 as "void FUN_141cb0010(longlong param_1)" -
    //     one pointer argument, void return, matching ArchonLoadManagerLoadFailedHook(void*).
    //   * Layout: the UArchonLoadManager class is byte-identical between the 1.12.0 and 1.14.7
    //     SDK dumps (Pad_28[0x18], LoadFailedTimeSeconds @0x40, Pad_44[0x2C]), so the documented
    //     retry reads the same fields: controller +0x20, entry array +0x48, count +0x50, stride
    //     0x10 per {FWeakObjectPtr owner, loader*} entry.
    //
    // Why it matters: without this hook the documented one-shot recovery
    // (Progress/32_PLAYER_DATA_LOAD_RECOVERY.md) is inert on 1.14.7, so a single loader stuck at
    // bLoaded=0/bLoading=1 leaves the manager deadlocked until the 66s timeout, which then fails
    // the map reload ("LoadMap: failed to Listen") and kills the hub when a client joins.
    {
        MH_STATUS LoadFailCreate = MH_CreateHook((void*)(Globals::BaseAddress + 0x01CB0010),
            ArchonLoadManagerLoadFailedHook, &OrigArchonLoadManagerLoadFailed);
        MH_STATUS LoadFailEnable = LoadFailCreate == MH_OK
            ? MH_EnableHook((void*)(Globals::BaseAddress + 0x01CB0010))
            : LoadFailCreate;
        MpLog(std::string("[InitServerHooks] LoadFailed create=") + MH_StatusToString(LoadFailCreate)
            + " enable=" + MH_StatusToString(LoadFailEnable) + " target=+" + MpHex(0x01CB0010));
    }

    // [1.14.7 identity diagnostic] read-only; logs the gate's owner chain on every player-data Begin.
    InstallLoadMgrBeginHook("server");

    // [1.14.7 progression diagnostics] read-only; records the configuration predicate result and
    // whether CompleteLoadInternal ever runs (see the block comment near the definitions).
    InstallProgressionDiagnostics();

    // [1.14.7 diag 2026-10-10] read-only; names the game code behind every inventory transaction ([GrantTrace]).
    InstallGrantTraceHook();
    // [1.14.7 diag 2026-10-11] read-only; follows a Behemoth kill's weapon and Hunt Pass XP to the zero ([KillXP]).
    InstallKillXpTrace();

    // [1.14.7 headless audio] a dedicated hub must not play sound (see the block comment).
    InstallHeadlessAudioHook();

    // [1.14.7 SOCKET DIAGNOSTICS] Log recvfrom sources so an arriving client datagram is visible.
    InstallSocketDiagnostics();

    // [1.14.7 REMOVED] InstallCe8B6Guard() was deleted - it hooked a mid-function address and was itself
    // the cause of the CRT fault it was meant to guard (see the block comment at its former definition).

    // [1.14.7 progression cache probe] read-only; answers whether the client's config cache is ever
    // populated (see the block comment near the definitions).
    InstallProgressionCacheProbe();

    // [1.14.7 progression readiness probe] logs the four readiness flags the bounty component gates on
    // (see the block comment near the definitions).
    InstallProgressionReadinessProbe();

    // [1.14.7 ABI AUDIT 2026-10-04] The six probes below are DISABLED.
    //
    // Two of them were declared void while their targets return a value, which handed the caller a garbage
    // RAX and killed the process - the recorded faults were EXCEPTION_ACCESS_VIOLATION reading 0x11
    // (FindRowProbeHook, RVA 0x01A19CBF) and 0xC0000005 reading 0x0. Both were fixed, but the audit shows
    // the declaration cannot be trusted in general: Ghidra reports void for these targets even when they do
    // return a value (it reported void for DoesHuntPassHaveUnclaimedRewards, which the binary registration
    // shows returns bool), and our own decompiles of FindActiveHuntPassRow and LoadComplete say void for
    // functions whose return is unverified.
    //
    // The diagnostic value no longer justifies that risk now the investigation is complete, so only hooks
    // with a verified signature stay installed:
    //   - the progression cache probe       void*(void*)            (its result is used as a pointer)
    //   - the progression readiness probe   unsigned char(void*)    (the predicate returns a byte)
    //   - the InteractionCallout guard      SDK-verified native UFunction body signature
    //   - the pre-existing progression diagnostics and headless-audio hooks
    // Re-enable any probe below only after confirming its real signature.
    // InstallActiveHuntPassDriver();
    // InstallLoadCompleteProbe();
    // InstallFindRowProbe();
    // InstallConfigCompleteProbe();
    // InstallGameInstanceQueryHook();
    // InstallMasteryProbe();

    // [1.14.7 confirmed Training crash] UInteractionCalloutWidget::OnSetDisabled dereferences a null
    // InteractionHint (widget+0x3A8) on a headless server. Guarded, original preserved when bound.
    InstallInteractionCalloutSetDisabledGuard();

    // [1.14.7 2026-10-08] The rest of the UInteractionCalloutWidget family (8 Oct hunt crash at +0x1E3EB23) and
    // a 5 s bound on the engine crash handler's wait. Both server-only; see their definitions.
    InstallInteractionCalloutClassGuards();
    InstallServerCrashWaitBound();
    InstallInventoryRefreshGuard();

    // [1.14.7] Old +0x0243A310 lands on the final byte of a CALL instruction; never detour it.
    MpLog("[InitServerHooks] native GetCommandLine hook skipped (1.14.7 target is mid-instruction)");

    // [WARP force 2026-07-15] GPU-less VPS boot. Opt-in + reversible via MP_FORCE_WARP.flag
    // next to the game .exe (absent = stock behaviour). Bypasses the D3D11 IsSupported() gate
    // and forces D3D11CreateDevice -> WARP so the headless server boots without a GPU.
    {
        wchar_t ExeW[MAX_PATH];
        DWORD nw = GetModuleFileNameW(nullptr, ExeW, MAX_PATH);
        MpLog(std::string("[WARP] exe=") + ((nw > 0 && nw < MAX_PATH) ? MpNarrow(std::wstring(ExeW, nw)) : std::string("?"))
            + "  (put MP_FORCE_WARP.flag in that folder)  detected=" + (MpForceWarpEnabled() ? "YES" : "no"));
    }
    if (MpForceWarpEnabled()) {
        InstallWarpForceHooks();
        Globals::Move10Status += " [WARP force ENABLED (MP_FORCE_WARP.flag present)]";
    } else {
        Globals::Move10Status += " [WARP force off (no MP_FORCE_WARP.flag)]";
    }

    // The old 1.12 boot-patch site (+0x017BD9BC) is not mapped in the 1.14.7 Ghidra database.
    // Do not rely on a coincidental byte signature to mutate an unverified instruction site.
    MpLog("[ServerPatch] legacy 1.12 boot patch disabled on 1.14.7 (target unresolved)");

#if 0 // [1.12.0] In-code GIsServer/GIsClient reinforcement patches DISABLED: the mov byte[rip+disp32],imm bytes are 1.4.4-specific (disp32 -> old globals) and must be re-crafted per 1.12.0 site. Direct global writes in Init() (0x06B5325A/0x06B53259) are used instead. Sites if re-enabled: A=0x009E4FD1 B=0x009E4FDE C=0x009E9507 E=0x009E9501 (D TBD).
    //GIsServer and GIsClient
    VirtualProtect((void*)(Globals::BaseAddress + 0x7961AE), 0x9, PAGE_READWRITE, &oldProtect);

    *(uint8_t*)(Globals::BaseAddress + 0x7961AE + 0x0) = 0xC6;
    *(uint8_t*)(Globals::BaseAddress + 0x7961AE + 0x1) = 0x05;
    *(uint8_t*)(Globals::BaseAddress + 0x7961AE + 0x2) = 0x84;
    *(uint8_t*)(Globals::BaseAddress + 0x7961AE + 0x3) = 0x5A;
    *(uint8_t*)(Globals::BaseAddress + 0x7961AE + 0x4) = 0x6B;
    *(uint8_t*)(Globals::BaseAddress + 0x7961AE + 0x5) = 0x05;
    *(uint8_t*)(Globals::BaseAddress + 0x7961AE + 0x6) = 0x00;
    *(uint8_t*)(Globals::BaseAddress + 0x7961AE + 0x7) = 0x90;
    *(uint8_t*)(Globals::BaseAddress + 0x7961AE + 0x8) = 0x90;

    VirtualProtect((void*)(Globals::BaseAddress + 0x7961AE), 0x9, oldProtect, &oldProtect);

    VirtualProtect((void*)(Globals::BaseAddress + 0x7961BB), 0x9, PAGE_READWRITE, &oldProtect);

    *(uint8_t*)(Globals::BaseAddress + 0x7961BB + 0x0) = 0xC6;
    *(uint8_t*)(Globals::BaseAddress + 0x7961BB + 0x1) = 0x05;
    *(uint8_t*)(Globals::BaseAddress + 0x7961BB + 0x2) = 0x78;
    *(uint8_t*)(Globals::BaseAddress + 0x7961BB + 0x3) = 0x5A;
    *(uint8_t*)(Globals::BaseAddress + 0x7961BB + 0x4) = 0x6B;
    *(uint8_t*)(Globals::BaseAddress + 0x7961BB + 0x5) = 0x05;
    *(uint8_t*)(Globals::BaseAddress + 0x7961BB + 0x6) = 0x01;
    *(uint8_t*)(Globals::BaseAddress + 0x7961BB + 0x7) = 0x90;
    *(uint8_t*)(Globals::BaseAddress + 0x7961BB + 0x8) = 0x90;

    VirtualProtect((void*)(Globals::BaseAddress + 0x7961BB), 0x9, oldProtect, &oldProtect);

    VirtualProtect((void*)(Globals::BaseAddress + 0x79A81B), 0x7, PAGE_READWRITE, &oldProtect);

    *(uint8_t*)(Globals::BaseAddress + 0x79A81B + 0x0) = 0xC6;
    *(uint8_t*)(Globals::BaseAddress + 0x79A81B + 0x1) = 0x05;
    *(uint8_t*)(Globals::BaseAddress + 0x79A81B + 0x2) = 0x17;
    *(uint8_t*)(Globals::BaseAddress + 0x79A81B + 0x3) = 0x14;
    *(uint8_t*)(Globals::BaseAddress + 0x79A81B + 0x4) = 0x6B;
    *(uint8_t*)(Globals::BaseAddress + 0x79A81B + 0x5) = 0x05;
    *(uint8_t*)(Globals::BaseAddress + 0x79A81B + 0x6) = 0x00;

    VirtualProtect((void*)(Globals::BaseAddress + 0x79A81B), 0x7, oldProtect, &oldProtect);

    VirtualProtect((void*)(Globals::BaseAddress + 0x79A680), 0x1, PAGE_READWRITE, &oldProtect);

    *(uint8_t*)(Globals::BaseAddress + 0x79A680 + 0x0) = 0x00;

    VirtualProtect((void*)(Globals::BaseAddress + 0x79A680), 0x1, oldProtect, &oldProtect);

    VirtualProtect((void*)(Globals::BaseAddress + 0x79A815), 0x1, PAGE_READWRITE, &oldProtect);

    *(uint8_t*)(Globals::BaseAddress + 0x79A815 + 0x0) = 0x01;

    VirtualProtect((void*)(Globals::BaseAddress + 0x79A815), 0x1, oldProtect, &oldProtect);
#endif

    // [1.14.7 2026-10-10 PHANTOM REMOVAL] No game viewport or local player on any server role. The phantom was the local
    // player UGameEngine::Init (0x03E07010) creates because this -server boot of the client build runs with GIsClient=1
    // (early boot writes it at 0x9F9433). Init tests GIsClient at 0x03E07349 and, when it is 0, jumps at 0x03E07353 over
    // the block that creates the game viewport client (RSI); right after, 0x03E07457 tests RSI and jumps to 0x03E0770D,
    // past the window and first-player setup - the engine's own dedicated-server path. Making that jump unconditional
    // keeps GIsClient=1 for the rest of the boot (forcing GIsClient=0 instead stalled the Slate/UI setup and the LoadMap
    // listen gate at 0x04272A80), so no viewport, no window and no local player exist and the first LoadMap spawns no
    // PlayerController; the first real login starts the match (MpStartMatchWithoutPhantom). Opt-in in 0.2.103-0.2.108,
    // the DeployServer default in 0.2.109, every server role (P2P player hosts too) since 0.2.110, which also removed
    // the phantom workarounds - so a failed byte guard is loud: nothing suppresses a phantom any more. 38_ 19.3-19.4.
    if (Globals::AuthMode != Globals::ServerAuthMode::Invalid) {
        static const uint8_t Expected[6] = { 0x0F, 0x84, 0xD3, 0x00, 0x00, 0x00 };     // jz 0x03E0742C
        static const uint8_t Replacement[6] = { 0xE9, 0xD4, 0x00, 0x00, 0x00, 0x90 };  // jmp 0x03E0742C; nop
        const bool Ok = MpPatchBytesVerified(0x03E07353, Expected, Replacement, 6,
            "UGameEngine::Init viewport/local-player block skip");
        g_NoLocalPlayerApplied.store(Ok, std::memory_order_relaxed);
        MpLog(std::string("[NoLocalPlayer] ") + (Ok
            ? "APPLIED: this server boots without a game viewport or local player; the first login starts the match"
            : "NOT APPLIED (byte guard failed - see the line above): this server WILL have a phantom local player, and "
              "no phantom suppression exists any more - check the game build"));
    }

    // [2026-10-10 1.14.7] Opt-in Blueprint tick filter (SERVER_TICK_FILTER.flag / TICK_FILTER_CENSUS.flag; default: no
    // hook). Must follow the block above: it requires g_NoLocalPlayerApplied.
    InstallServerTickFilter();

    InitLog("[InitServerHooks] Hooks and patches installed, returning");
}

void Init() {
    InitLog("[Init] Entry");
    // [2026-10-10 1.14.7 CPU] Resolve the exe directory for the flag-file cache once and decide the cache mode
    // (UNCACHED_FLAG_FILES.flag) before anything reads a flag; no lock is held here (see MpExeRelativeFlagPresent).
    MpResolveExeDirW();
    MpDecideFlagCacheMode();
    // [2026-10-13 realms S1] Decide the backend address (MYSTICPARADOX_BACKEND_URL or the built-in one) before any hook
    // that builds a backend URL is installed; MainThread logs the result (no logging under the loader lock).
    MpResolveBackendAddress();

    Globals::AmServer = std::string(GetCommandLineA()).contains("-server");
    Globals::BaseAddress = (uintptr_t)GetModuleHandleA(nullptr);
    InitLog(std::string("[Init] BaseAddress=") + std::to_string(Globals::BaseAddress) + " AmServer=" + (Globals::AmServer ? "1" : "0"));

    if (Globals::AmServer) {
        std::string AuthMode;
        if (!MpReadEnvironment("MYSTICPARADOX_AUTH_MODE", AuthMode, 32) || AuthMode == "GLOBAL_GAMESERVER") {
            Globals::AuthMode = Globals::ServerAuthMode::GlobalGameserver;
        }
        else if (P2PHooks::ClaimAuthMode(AuthMode)) {
            Globals::AuthMode = Globals::ServerAuthMode::HuntCapability;
        }
        else {
            Globals::AuthMode = Globals::ServerAuthMode::Invalid;
        }
    }

    // [1.14.7] Runtime-confirmed engine globals.
    if (Globals::AmServer) {
        *(uint8_t*)(Globals::BaseAddress + 0x06E1EADA) = 0x1; // GIsServer
        *(uint8_t*)(Globals::BaseAddress + 0x06E1EAD9) = 0x0; // GIsClient
    }

    // [1.12.0] UC::FMemory::Init removed: modern Dumper-7 SDK requires no memory-realloc init (per UsingTheSDK.md; UC::FMemory namespace no longer exists). (1.4.4 engine Realloc was RVA 0x023BB590.)

    if (Globals::AmServer) {
        int NumArgs = 0;

        wchar_t** Args = CommandLineToArgvW(GetCommandLineW(), &NumArgs);
        InitLog(std::string("[Init] NumArgs=") + std::to_string(NumArgs));

        if (NumArgs > 8) {
            // DeployServer launch with full args
            // CommandLineToArgvW returns one heap block owned by the caller. Persist-copy
            // each value because GetGameDefaultMap is called much later on engine threads;
            // keeping raw Args[n] pointers caused a late std::wstring(wchar_t*) AV.
            if (Globals::AuthMode == Globals::ServerAuthMode::GlobalGameserver) {
                Globals::ServerAPIKeyStorage = Args[1];
                Globals::ServerAPIKey = Globals::ServerAPIKeyStorage.c_str();
            }
            else if (Globals::AuthMode == Globals::ServerAuthMode::HuntCapability) {
                // The optional player-hosted mode reads and validates its own launch environment
                // (P2PHooks.h). It never carries the gameserver API key.
                P2PHooks::ReadLaunch(NumArgs, Args);
                Globals::ServerAPIKey = nullptr;
                Globals::ServerAPIKeyStorage.clear();
            }            Globals::MapPathStorage = Args[3];
            Globals::BehemothPathStorage = Args[4];
            Globals::MatchmakerHuntIdStorage = Args[5];
            Globals::ExpectedPlayerStringStorage = Args[6];
            Globals::MyIpAndPortStorage = Args[7];

            Globals::Port = std::stoi(std::wstring(Args[2]));
            Globals::MapPath = Globals::MapPathStorage.c_str();
            Globals::BehemothPath = Globals::BehemothPathStorage.c_str();
            Globals::MatchmakerHuntId = Globals::MatchmakerHuntIdStorage.c_str();
            Globals::ExpectedPlayerString = Globals::ExpectedPlayerStringStorage.c_str();
            Globals::MyIpAndPort = Globals::MyIpAndPortStorage.c_str();

            InitLog(std::string("[Init] Parsed DeployServer args: Port=") + std::to_string(Globals::Port));

            // [2026-10-11 1.14.7 P2P host] Also by AuthMode: a player-hosted (HuntCapability) server is disposable on
            // any port. (Checked while doing this: EnableWatchdog is constant-initialised to true and only the manual
            // test branch below clears it, so every launch with this full argument list - the player host's included,
            // whatever its port - already had the watchdog; this condition states the intent, it changes nothing.)
            if (Globals::Port >= 8776 || Globals::AuthMode == Globals::ServerAuthMode::HuntCapability) {
                // [2026-07-18 stale-hunt ROOT FIX] This previously forced EnableWatchdog=FALSE for ALL
                // deploy ports (>=8776), which silently disabled BOTH empty-server reapers: the tick
                // watchdog's `if(EnableWatchdog)` block never ran (so GameModeEmptyState() never published
                // g_wdGameModePtr/g_wdIsHub for the thread), AND the background thread self-disables on
                // !EnableWatchdog. Result: empty hunts never self-terminated and leaked their concurrent
                // slot -> DeployServer "Hunt server capacity reached (2/2)". Enable it. Persistent hubs
                // (ramsgate BPGM_City_C / training BPGM_ArchonTrainingGrounds_C) are protected by the hub
                // exemption (g_wdIsHub==1 is never reaped) on BOTH the thread and the tick exit path below,
                // so ONLY disposable instances (hunts / islands / escalation) are reaped when empty 50s.
                EnableWatchdog = true;
                Globals::EnableLogging = true;
            }
        }
        else {
            // Manual testing mode - parse URL args from command line. The player-hosted mode's launch
            // is never read here, so that mode stops before listen (P2PHooks::StartServer).
            InitLog("[Init] Manual test mode - parsing URL args");
            std::string cmdLine = GetCommandLineA();
            InitLog("[Init] Command line captured for local parsing; details suppressed");

            // Default values for manual testing
            Globals::Port = 8777;
            static std::wstring DefaultMapPath = L"Ramsgate";
            Globals::MapPath = DefaultMapPath.c_str();
            Globals::EnableLogging = true;
            EnableWatchdog = false;

            // Try to parse Port from URL if present
            size_t portPos = cmdLine.find("Port=");
            if (portPos != std::string::npos) {
                int parsedPort = std::stoi(cmdLine.substr(portPos + 5));
                if (parsedPort > 0) {
                    Globals::Port = parsedPort;
                    InitLog(std::string("[Init] Parsed Port from URL: ") + std::to_string(Globals::Port));
                }
            }

            // Try to parse map name from URL
            size_t mapStart = cmdLine.find_first_not_of(" \t", cmdLine.find_first_of(" \t") + 1);
            if (mapStart != std::string::npos && cmdLine[mapStart] != '-') {
                size_t mapEnd = cmdLine.find_first_of("? \t", mapStart);
                if (mapEnd != std::string::npos) {
                    std::string mapName = cmdLine.substr(mapStart, mapEnd - mapStart);
                    static std::wstring parsedMapPath = std::wstring(mapName.begin(), mapName.end());
                    Globals::MapPath = parsedMapPath.c_str();
                    InitLog(std::string("[Init] Parsed Map: ") + mapName);
                }
            }

            std::string mapStr;
            if (Globals::MapPath) {
                for (const wchar_t* p = Globals::MapPath; *p; ++p) mapStr += (char)*p;
            }
            InitLog(std::string("[Init] Manual test mode: Port=") + std::to_string(Globals::Port) + " Map=" + mapStr);
        }

        InitLog("[Init] Calling InitServerHooks...");
        InitServerHooks();
        InitLog("[Init] InitServerHooks returned OK");
    }
    else {
        Globals::EnableLogging = true;

        InitClientHooks();
    }

    InitLog("[Init] About to create MainThread...");
    DWORD threadId;
    CreateThread(nullptr, 0x1000, (LPTHREAD_START_ROUTINE)MainThread, nullptr, 0, &threadId);
    InitLog("[Init] MainThread created, returning from DllMain");
}

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        DisableThreadLibraryCalls(hModule);
        Init();
        break;
    case DLL_PROCESS_DETACH:
        // Before this module's CRT shuts down: no logging from here on (see g_MpProcessDetaching).
        InterlockedExchange(&g_MpProcessDetaching, 1);
        break;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
        break;
    }
    return TRUE;
}