urt-rs / docs /research /CHAT_DELIVERY.md

Recover chat expansion states and substitution keys

9038fbf about 1 month ago

7 kB

# Chat policy, formats and delivery calls

Static pass, 2026-10-11. Reproduce with `python3 scripts/analyze_chat_delivery.py`; check with `python3 scripts/test_chat_delivery.py`. [Generated evidence](chat-delivery.json) includes the verified qagame hash, function partitions, initialized-data mode table, 512 policy paths and bounded argument/field/call traces. No original process or complete QVM executes. Recorded CALLs return zero placeholders; formatting, cleanup and delivery callees are not entered. These slices extend the [recipient front gates](CHAT_PATHS.md), without composing a complete recipient decision.

## DEL-001: classification and dead-chat policy

Helper 186721 derives five boolean locals from sender/recipient record pointers at object offset 520. Exact raw predicates are:

| Flag used below | Local | Record predicate |
| --- | ---: | --- |
| S, label-supported SUB interpretation | 56 | sender offset 3740 equals 1 |
| P, label-supported SPEC interpretation | 44 | sender offset 3096 equals 3 |
| D, label-supported DEAD interpretation | 60 | sender offset 4 equals 3 OR offset 4324 is nonzero |
| T, recipient spectator-like predicate | 64 | recipient offset 3096 is signed >=3 |
| U, recipient dead-like predicate | 68 | recipient offset 4 equals 3 OR offset 4324 is nonzero |

Names are provisional field interpretations. In particular, recipient T accepts values greater than 3 whereas sender P requires exactly 3. Offset 4324 supplies an alternative condition rather than replacing the offset-4 comparison. Five bounded raw-field fixtures exercise each flag and both death alternatives. Global 34999596 can skip classification and policy before this slice; its identity, initialized flag values and lifecycle remain open.

At instruction 187058, nonzero global **34999652** bypasses the following policy. Otherwise registered **g_deadchat** integer mirror **34067996** selects these acceptance predicates. Let A = S OR P OR D, G = game-type mirror 34090788 equals 9, and M = incoming channel mode equals 1:
| g_deadchat | Acceptance within this policy slice |
| --- | --- |
| 1 | (NOT P OR T OR G) AND (NOT A OR T OR U OR M OR G) |
| 2 | NOT P OR T OR G |
| Other observed values 0 and 3 | NOT A OR T OR U OR G |
Mode 1's exception in policy 1 does not override the first spectator restriction. For example, spectator-to-nonspectator remains rejected even if the recipient satisfies U; a dead nonspectator-to-live nonspectator can pass mode 1. Game-type value 9 permits every tested combination at this slice. It does not override earlier mute/ignore/state/team gates.
The collector enumerates policies 0/1/2/3, modes 0/1, game types 0/9 and all 32 flag vectors. Accepted counts are respectively **114/109/112/114**, out of 128 per policy. Each trace reaches actual acceptance instruction 187154 or rejection instruction 187379. This is bounded instruction evidence with synthetic memory, not a runtime server capture or a claim about every cvar domain.
## DEL-002: modes, labels and formatter arguments
Send helper 187381 reads a five-entry table at VM address **29376**. Modes 0/1/2/3/4 dispatch to instructions **187423/187476/187565/187423/187643**. Signed values outside 0–4 take the mode-0 target. These are name/prefix construction destinations, distinct from the later formatting decisions in delivery helper 186721.
The delivery formatter selects an integer channel value: mode 3 forces 3; otherwise sender-record offset 3096 equal to 2 or 1 produces 2 or 1, with other values producing 0. Exact string templates and argument routing are:
| Mode | Template / routing |
| --- | --- |
| 0, ordinary | `%s "%d" "%s%s%s%c%c%s"`, command `cchat` |
| 1, team | Same template, command `tcchat` |
| 2, private | `cchat "%d" "%s[pm] %s %s%s%c%c%s"` |
| 3 | Ordinary template, command `tcchat`, integer channel 3 |
| 4, emote | `me "%d" "%s%c%c%s"` |
Ordinary arguments after the command/channel are SUB-or-DEAD label, SPEC label, name prefix, caret byte 94, supplied color byte and text pointer. `(SUB) ` takes precedence over `(DEAD) ` when both flags are set; `(SPEC) ` is independent. Missing labels use the actual empty string. Private arguments include `^3`, direction **`->` for sender-to-self** or **`<-` for a different recipient**, `^7`, name prefix, caret/color and text. Emote forwards name prefix/caret/color/text without those ordinary labels.

Prefix strings at VM addresses 77696/77653/77619/77589 contain **byte 25 (0x19)**: respectively `%s%c%c\x19: `, `%s%c%c\x19\x19: `, `\x19%s%c%c\x19: ` and `*%s%c%c\x19 `. The JSON preserves the control bytes. Their client parsing/rendering meaning remains open; do not normalize them to spaces or confuse them with the cleanup helper's byte 31.

Seven fixtures record exact formatter-70458 argument words. The following trap **17**, encoded CALL target **-18**, receives signed recipient index `(object - 34091368) / 880`. Aligned fixture objects verify recipient slot 3 and sender echo slot 2. Its command pointer is **zero only because the evaluator supplies a placeholder formatter return**; no formatted command, string escaping, actual NULL send or rendered output is established.

## DEL-003: explicit recipient echo and slot fanout

The explicit-recipient tail first calls delivery helper 186721 with the recipient and prefix at local 196. Sender-to-self receives one call. A different recipient receives a second call toward the sender, using prefix local 264, unless **sender object offset 424 AND 8** is nonzero. The fixtures yield call counts 1/2/1 for self / other with zero flags / other with bit 8. The bit's full field identity and every flag mutation remain open.

The fanout tail visits `34091368 + i * 880` for indices below signed count global **34992524**, calling 186721 per visited slot. Count-zero and count-three fixtures record zero/three delivery calls. With cleanup local 192 zero, text pointer is local 40. With it nonzero, helper 70241 is called **per iteration**, and its placeholder zero return is forwarded to delivery. These observations do not establish effective recipients: each recorded delivery callee can reject through its own gates. Count lifetime, ownership, real cleanup mutation, reliable queues and client rendering remain incomplete.

## Remaining work

RE-265–267 record these bounded milestones. RE-264 stays open for the complete chat contract; RE-268 adds specific follow-ups: text-expansion helper 186435 and key lookup 185212, all raw flag/global writers, prefix construction/copy/escaping, private-message callers and client command consumption, plus original-runtime and macOS/Linux comparison fixtures. Rust/Bevy behavior should be specified from these predicates while retaining the unresolved field identities and output contracts as explicit dependencies.

The [EXP-001–003 follow-up](CHAT_EXPANSION.md) recovers parser states, key comparisons and health/momo branches. Full text-expansion/copy/output behavior remains open under RE-268/272.

	# Chat policy, formats and delivery calls

	Static pass, 2026-10-11. Reproduce with `python3 scripts/analyze_chat_delivery.py`; check with `python3 scripts/test_chat_delivery.py`. [Generated evidence](chat-delivery.json) includes the verified qagame hash, function partitions, initialized-data mode table, 512 policy paths and bounded argument/field/call traces. No original process or complete QVM executes. Recorded CALLs return zero placeholders; formatting, cleanup and delivery callees are not entered. These slices extend the [recipient front gates](CHAT_PATHS.md), without composing a complete recipient decision.

	## DEL-001: classification and dead-chat policy

	Helper 186721 derives five boolean locals from sender/recipient record pointers at object offset 520. Exact raw predicates are:

	\| Flag used below \| Local \| Record predicate \|
	\| --- \| ---: \| --- \|
	\| S, label-supported SUB interpretation \| 56 \| sender offset 3740 equals 1 \|
	\| P, label-supported SPEC interpretation \| 44 \| sender offset 3096 equals 3 \|
	\| D, label-supported DEAD interpretation \| 60 \| sender offset 4 equals 3 OR offset 4324 is nonzero \|
	\| T, recipient spectator-like predicate \| 64 \| recipient offset 3096 is signed >=3 \|
	\| U, recipient dead-like predicate \| 68 \| recipient offset 4 equals 3 OR offset 4324 is nonzero \|

	Names are provisional field interpretations. In particular, recipient T accepts values greater than 3 whereas sender P requires exactly 3. Offset 4324 supplies an alternative condition rather than replacing the offset-4 comparison. Five bounded raw-field fixtures exercise each flag and both death alternatives. Global 34999596 can skip classification and policy before this slice; its identity, initialized flag values and lifecycle remain open.

	At instruction 187058, nonzero global 34999652 bypasses the following policy. Otherwise registered g_deadchat integer mirror 34067996 selects these acceptance predicates. Let A = S OR P OR D, G = game-type mirror 34090788 equals 9, and M = incoming channel mode equals 1:

	\| g_deadchat \| Acceptance within this policy slice \|
	\| --- \| --- \|
	\| 1 \| (NOT P OR T OR G) AND (NOT A OR T OR U OR M OR G) \|
	\| 2 \| NOT P OR T OR G \|
	\| Other observed values 0 and 3 \| NOT A OR T OR U OR G \|

	Mode 1's exception in policy 1 does not override the first spectator restriction. For example, spectator-to-nonspectator remains rejected even if the recipient satisfies U; a dead nonspectator-to-live nonspectator can pass mode 1. Game-type value 9 permits every tested combination at this slice. It does not override earlier mute/ignore/state/team gates.

	The collector enumerates policies 0/1/2/3, modes 0/1, game types 0/9 and all 32 flag vectors. Accepted counts are respectively 114/109/112/114, out of 128 per policy. Each trace reaches actual acceptance instruction 187154 or rejection instruction 187379. This is bounded instruction evidence with synthetic memory, not a runtime server capture or a claim about every cvar domain.

	## DEL-002: modes, labels and formatter arguments

	Send helper 187381 reads a five-entry table at VM address 29376. Modes 0/1/2/3/4 dispatch to instructions 187423/187476/187565/187423/187643. Signed values outside 0–4 take the mode-0 target. These are name/prefix construction destinations, distinct from the later formatting decisions in delivery helper 186721.

	The delivery formatter selects an integer channel value: mode 3 forces 3; otherwise sender-record offset 3096 equal to 2 or 1 produces 2 or 1, with other values producing 0. Exact string templates and argument routing are:

	\| Mode \| Template / routing \|
	\| --- \| --- \|
	\| 0, ordinary \| `%s "%d" "%s%s%s%c%c%s"`, command `cchat` \|
	\| 1, team \| Same template, command `tcchat` \|
	\| 2, private \| `cchat "%d" "%s[pm] %s %s%s%c%c%s"` \|
	\| 3 \| Ordinary template, command `tcchat`, integer channel 3 \|
	\| 4, emote \| `me "%d" "%s%c%c%s"` \|

	Ordinary arguments after the command/channel are SUB-or-DEAD label, SPEC label, name prefix, caret byte 94, supplied color byte and text pointer. `(SUB) ` takes precedence over `(DEAD) ` when both flags are set; `(SPEC) ` is independent. Missing labels use the actual empty string. Private arguments include `^3`, direction `->` for sender-to-self or `<-` for a different recipient, `^7`, name prefix, caret/color and text. Emote forwards name prefix/caret/color/text without those ordinary labels.

	Prefix strings at VM addresses 77696/77653/77619/77589 contain byte 25 (0x19): respectively `%s%c%c\x19: `, `%s%c%c\x19\x19: `, `\x19%s%c%c\x19: ` and `*%s%c%c\x19 `. The JSON preserves the control bytes. Their client parsing/rendering meaning remains open; do not normalize them to spaces or confuse them with the cleanup helper's byte 31.

	Seven fixtures record exact formatter-70458 argument words. The following trap 17, encoded CALL target -18, receives signed recipient index `(object - 34091368) / 880`. Aligned fixture objects verify recipient slot 3 and sender echo slot 2. Its command pointer is zero only because the evaluator supplies a placeholder formatter return; no formatted command, string escaping, actual NULL send or rendered output is established.

	## DEL-003: explicit recipient echo and slot fanout

	The explicit-recipient tail first calls delivery helper 186721 with the recipient and prefix at local 196. Sender-to-self receives one call. A different recipient receives a second call toward the sender, using prefix local 264, unless sender object offset 424 AND 8 is nonzero. The fixtures yield call counts 1/2/1 for self / other with zero flags / other with bit 8. The bit's full field identity and every flag mutation remain open.

	The fanout tail visits `34091368 + i * 880` for indices below signed count global 34992524, calling 186721 per visited slot. Count-zero and count-three fixtures record zero/three delivery calls. With cleanup local 192 zero, text pointer is local 40. With it nonzero, helper 70241 is called per iteration, and its placeholder zero return is forwarded to delivery. These observations do not establish effective recipients: each recorded delivery callee can reject through its own gates. Count lifetime, ownership, real cleanup mutation, reliable queues and client rendering remain incomplete.

	## Remaining work

	RE-265–267 record these bounded milestones. RE-264 stays open for the complete chat contract; RE-268 adds specific follow-ups: text-expansion helper 186435 and key lookup 185212, all raw flag/global writers, prefix construction/copy/escaping, private-message callers and client command consumption, plus original-runtime and macOS/Linux comparison fixtures. Rust/Bevy behavior should be specified from these predicates while retaining the unresolved field identities and output contracts as explicit dependencies.

	The [EXP-001–003 follow-up](CHAT_EXPANSION.md) recovers parser states, key comparisons and health/momo branches. Full text-expansion/copy/output behavior remains open under RE-268/272.