Three function-entry detours, off unless `aivisit=on`:
* StrategyAIAgent::AssignFleetsAndIssueOrders -- the bracket, recording
(agent, task, pass, walked vector, its slots in index order);
* StrategyAIAgent::ClaimShipsOfFleet -- the head loop, one row per element;
* StrategyAIAgent::ReleaseShipsOfFleet -- the tail loop, one row per element.
The two per-element targets have exactly ONE caller each in the whole image and
that caller is the third target, so the module's traffic cannot come from
anywhere else in the game and no return-address filter is needed. The element
loop's own body is deliberately not patched: its first instruction is a branch
target, which is the shape rule 19 exists for.
Each element row carries the element address (the hypothesis under test), the
fleet's id, its ship ids and its Location pointer. The ship ids are the join key
to the command block's list 10; the join must not be by position because the
walk can visit more elements than it emits commands for.
Reads of game addresses are probed before every access and laundered through a
register, so a wrong offset logs a zero instead of faulting inside a detour.
Also: shim.cfg.bupin, which is shim.cfg.bppin plus exactly three non-comment
lines, and is marked `# exhaustive` so tools/check_shim_configs.py enforces
that every registered hook is named in it.
55408a980a