Hooks: central vtable install with restore support

Move vtable patching into hooks.cpp: one call clones the table, validates every
slot, records the originals and installs the clone. Installs happen from the
setup, game and paint threads, so the bookkeeping is mutex-protected.

Client, CInput, IVModelRender, IStudioRender and ISurface all use it, and
hooks_restore_all() can now put every interface back (previously impossible).

1 files changed, 9 insertions, 1 deletions

diff --git a/FIX_PLAN.md b/FIX_PLAN.md
index 2c84122..3ebbd17 100644
--- a/FIX_PLAN.md
+++ b/FIX_PLAN.md
@@ -788,6 +788,14 @@ the engine's override cleared for every model drawn afterwards. This is the fix
 for the corruption described in P2-6; it needs an in-game check because it
 relies on the engine always going through the vtable for that call.
 
+### Batch 6 — hook registry
+
+`hooks.h` / `hooks.cpp` own vtable installation: one call clones, bounds-checks
+every slot, records the originals and installs the clone, with a mutex because
+installs happen from the setup, game and paint threads. `hooks_restore_all()`
+puts every interface back, which previously was impossible. Client, CInput,
+IVModelRender, IStudioRender and ISurface all go through it now.
+
 ### Known remaining work
 
 Deliberately deferred, with reasons:
@@ -800,7 +808,7 @@ Deliberately deferred, with reasons:
 - **P3-2 declarative settings table** — large rewrite of `config_save`,
   `config_load`, `config_reset_defaults` and `build_cards`. It can regress
   config persistence, so it should follow an in-game pass.
-- **P3-3 `esp.cpp` split**, **P3-5 header split**, **P3-6 hook registry** —
+- **P3-3 `esp.cpp` split**, **P3-5 header split** —
   behaviour-neutral moves with a large diff; best done after the current build
   has been validated in-game so a regression is easy to bisect.