Team-leader and location lookup paths

Static pass, 2026-10-11. Reproduce with python3 scripts/analyze_chat_locations.py; check with python3 scripts/test_chat_locations.py. Generated evidence retains verified qagame partitions, leader/cache/format/list traces, literal reference windows and file-backed spatial constants. Original processes/full QVMs do not execute. Recorded callees have zero placeholder returns; isolated leader/location returns are supplied inputs. Floating-point geometry, box/visibility engine services and real formatting are not evaluated. This extends the substitution key inventory.

LOC-001: first matching team leader

Helper 169397 scans indices from zero while index is signed less than count global 34992524. Its record address is global 34992496 + index * 6336. It returns the first index with all three raw predicates:

Record offset 468 !=0.
Record offset 3096 == requested team.
Record offset 3124 !=0.

If no record matches, it returns -1. Zero/negative synthetic counts make no record reads. Both record states 1 and 2 can match; this is broader than delivery's required recipient state 2. A negative leader-flag word also satisfies the nonzero test. The fixtures cover skipped disconnected/wrong-team/unflagged records and multiple matches to verify first-match selection, without assigning complete state/role lifecycles.

The leader substitution passes sender-record field 3096 into this helper. A supplied -1 result skips the name formatter, retaining the lookup's previously requested unknown default. Other observed results load the record pointer at 34091888 + slot * 880, add 504, and request %s into shared buffer 35738436 with capacity 150. Slot 0/2 slices verify that address chain. The helper call, initial default and formatting are not composed/executed here, so no actual no-leader screen text or bounds invariant is established.

Literal-reference windows show helper 169397 in multiple containing functions, including chat lookup 185212. They do not cover computed calls, aliased references or every flag writer.

LOC-002: cached location and formatting wrapper

Helper 268248 first reads object offset 848. A nonzero pointer returns immediately only if signed global time 34992532 < pointed-object field 596. NULL, equality or later time proceeds to spatial lookup. Synthetic cases cover those boundaries and a signed-wrap comparison; they do not establish a safe wrap-aware expiry contract. No cache refresh/store appears in the retained function, so the producers of fields 848/596 remain essential follow-ups.

Wrapper 268637 calls 268248 and returns zero if lookup returns NULL. That failure path makes no formatting call and no direct buffer write in its slice. A nonzero lookup result loads its word at offset 592, requests formatter 70386 with caller buffer/capacity and template %s, then returns 1. The isolated success fixture uses capacity 150, text pointer 0x60000 and destination 0x70000. Success here is a return convention, not proof of a valid source string or successful bounded formatting.

The location substitution forwards sender/shared buffer/capacity 150 to this wrapper. Crosshair branches and team-chat prefix construction also reference it. Failure handling/default text and output preservation must be recovered for every caller before a Rust API contract is complete.

LOC-003: registration, list order and static spatial search

List-builder 264976 is guarded by nonzero global 34999636. Its unguarded path sets that guard to 1, clears head/count globals 34999640/34999644, and requests trap 18 (encoded -19) to set configstring 640 to literal unknown. It visits stride-880 objects beginning at 34091368 while its signed index is below entity count global 34992508.

Each object qualifies only if offset 536 is nonzero and raw word 540 ==8489281. This pass does not assign the raw tag a complete class/hash identity. A qualifying object:

Increments global 34999644 and stores that one-based number at object offset 684.
Requests configstring 640 + number from its string pointer at object offset 592.
Writes the old list head through ***(object + 524) +24**, then makes the object the new head.

The three-object fixture publishes indices 641/642/643 in scan order and links head object 2 -> object 1 -> object 0 -> NULL. Filtering fixtures independently exclude zero field 536 and wrong field 540. The guarded path performs no reset/publication. Guard reset, entity-count capacity, NULL field-524 handling, configstring bounds, map restart and linked-object ownership remain open.

The retained spatial helper shows two search stages after a cache miss:

It copies position words at object offsets 488/492/496, forms a query box by subtracting/adding file-backed 40.0/40.0/52.0 extents at VM addresses 31128/31132/31136, and calls encoded service -33 with four arguments including local result array and maximum 1024. Its returned indices become 34091368 + index * 880. It compares object offset 536 against trigger_location through ASCII comparator 69386 and returns the first match in the supplied engine order.
If that stage finds no match, it traverses head 34999640 via the same *(object+524)+24 links. The code calculates squared coordinate distance, starting with raw float bits 1296039936 (201326592.0) as the limit. Candidate distance <= current best reaches encoded service -27 with two position pointers; a nonzero return updates both best distance and selected object. Equal-distance candidates therefore may replace an earlier selected object. End-of-list returns the selected pointer, initially NULL.

The pinned ABI candidate report, checked against the same qagame hash, labels service numbers 32/26 as G_ENTITIES_IN_BOX/G_IN_PVS and 18 as G_SET_CONFIGSTRING. Those are upstream candidates, not new proof of all shipped native argument/layout semantics. Float execution, engine ordering, portals, collision bounds and native platform correspondence remain unverified. The synthetic list and cache traces do not execute either spatial stage.

Remaining work and Rust dependencies

RE-277–279 record these bounded/static milestones; RE-272 remains open for full substitution behavior. RE-280 tracks leader-flag/state writers, count/slot invariants, caller failure/default behavior, cache writers/expiry/reset, raw class tag derivation, linked-field ownership, full floating-point/box/PVS selection, configstring clients and original-runtime/platform fixtures. Rust location lookup needs explicit cache/ordering/tie rules and ownership backed by that evidence; a generic nearest-point search would not reproduce the observed two-stage control flow by itself.

The AIM-001–003 follow-up recovers the crosshair caller's geometry/trace/result routes. Full spatial services, caller output and runtime behavior remain open under RE-280/284.

The NAT-001–003 follow-up confirms the shipped Linux ELF64 sinf/cosf and trace/PVS/area-query destinations and recovers VM-pointer/native spatial evidence. Earlier upstream-candidate limitations are narrowed for those mappings; full layout/geometry/runtime and other-platform parity remain open under RE-284/288.