- Add reverse_engineered.md section 29.7 documenting the BatchHideUnhide retargeting: sub_771FB8 has two paths (a2=1 smart filter via CheckEntityHide, a2=0 unconditional SetEntityVisible(entity, 0) loop), the Tab key handler at 0x6EFB60 calls both based on master state, and the previous ReadHidePlayerFlag patch only neutralized the a2=1 path leaving Tab broken from master-ON state
- Add SetEntityVisible caller inventory (only 3 callers, all tab-hide-related) proving invisibility status does NOT route through entity[0x64]
- Add new section 45 with the full CMsgUserAttrib case 25 dispatch walkthrough: jump table at 0x8F667B (not the IDA label 0x8F265C which is the JMP instruction), case 25 idx 0x18 -> handler 0x8F401C, self path at 0x8F4051+ with hardcoded buff bit checks (102, 104, 106, ...), non-self path at loc_8F4888 with sub_7527D6 + vtable[51], convergence point and the asymmetric vtable[51] alpha-fade-only-on-set bug
- Document entity layout: +0x28-0x2B color RGBA bytes, +0xAC 28-byte status flag buffer, +0xD5C buff list head
- Document the invis_unstuck.cpp hook strategy including why writing alpha before vtable[51] runs is safe and why a single hook on sub_7527D6 covers both self and non-self via the convergence
- Add new section 46 with the CItem::GetSellPrice (sub_85A12B) decompile, field offsets (+0x4C Price, +0x64 AmountLimit, +0x258 Amount via sub_8596F0), the sole caller in sub_683EFB at 0x6841E4 (item tooltip via string ID 10103), the server-vs-client formula mismatch, and the single-byte patch
- Update the Index with entries for the three new sections