urt-rs / docs /research /CHAT_LOCATIONS.md

Recover native trig spatial and VM pointer contracts

0ef6dab 30 days ago

7.48 kB

# Team-leader and location lookup paths

Static pass, 2026-10-11. Reproduce with `python3 scripts/analyze_chat_locations.py`; check with `python3 scripts/test_chat_locations.py`. [Generated evidence](chat-locations.json) retains verified qagame partitions, leader/cache/format/list traces, literal reference windows and file-backed spatial constants. Original processes/full QVMs do not execute. Recorded callees have zero placeholder returns; isolated leader/location returns are supplied inputs. Floating-point geometry, box/visibility engine services and real formatting are not evaluated. This extends the [substitution key inventory](CHAT_EXPANSION.md).

## LOC-001: first matching team leader

Helper **169397** scans indices from zero while index is signed less than count global **34992524**. Its record address is **global 34992496 + index * 6336**. It returns the first index with all three raw predicates:

- Record offset **468 !=0**.
- Record offset **3096 == requested team**.
- Record offset **3124 !=0**.

If no record matches, it returns **-1**. Zero/negative synthetic counts make no record reads. Both record states 1 and 2 can match; this is broader than delivery's required recipient state 2. A negative leader-flag word also satisfies the nonzero test. The fixtures cover skipped disconnected/wrong-team/unflagged records and multiple matches to verify first-match selection, without assigning complete state/role lifecycles.

The `leader` substitution passes sender-record field 3096 into this helper. A supplied -1 result skips the name formatter, retaining the lookup's previously requested `unknown` default. Other observed results load the record pointer at **34091888 + slot * 880**, add **504**, and request `%s` into shared buffer 35738436 with capacity 150. Slot 0/2 slices verify that address chain. The helper call, initial default and formatting are not composed/executed here, so no actual no-leader screen text or bounds invariant is established.

Literal-reference windows show helper 169397 in multiple containing functions, including chat lookup 185212. They do not cover computed calls, aliased references or every flag writer.

## LOC-002: cached location and formatting wrapper

Helper **268248** first reads object offset **848**. A nonzero pointer returns immediately only if signed global time **34992532 < pointed-object field 596**. NULL, equality or later time proceeds to spatial lookup. Synthetic cases cover those boundaries and a signed-wrap comparison; they do not establish a safe wrap-aware expiry contract. No cache refresh/store appears in the retained function, so the producers of fields 848/596 remain essential follow-ups.

Wrapper **268637** calls 268248 and returns zero if lookup returns NULL. That failure path makes no formatting call and no direct buffer write in its slice. A nonzero lookup result loads its word at offset **592**, requests formatter 70386 with caller buffer/capacity and template `%s`, then returns **1**. The isolated success fixture uses capacity 150, text pointer 0x60000 and destination 0x70000. Success here is a return convention, not proof of a valid source string or successful bounded formatting.

The `location` substitution forwards sender/shared buffer/capacity 150 to this wrapper. Crosshair branches and team-chat prefix construction also reference it. Failure handling/default text and output preservation must be recovered for every caller before a Rust API contract is complete.

## LOC-003: registration, list order and static spatial search

List-builder **264976** is guarded by nonzero global **34999636**. Its unguarded path sets that guard to 1, clears head/count globals **34999640/34999644**, and requests trap **18** (encoded -19) to set configstring **640** to literal **`unknown`**. It visits stride-880 objects beginning at **34091368** while its signed index is below entity count global **34992508**.

Each object qualifies only if offset **536** is nonzero and raw word **540 ==8489281**. This pass does not assign the raw tag a complete class/hash identity. A qualifying object:

1. Increments global 34999644 and stores that one-based number at object offset **684**.
2. Requests configstring **640 + number** from its string pointer at object offset **592**.
3. Writes the old list head through ***(object + 524) +24**, then makes the object the new head.
The three-object fixture publishes indices 641/642/643 in scan order and links head object 2 -> object 1 -> object 0 -> NULL. Filtering fixtures independently exclude zero field 536 and wrong field 540. The guarded path performs no reset/publication. Guard reset, entity-count capacity, NULL field-524 handling, configstring bounds, map restart and linked-object ownership remain open.
The retained spatial helper shows two search stages after a cache miss:
- It copies position words at object offsets **488/492/496**, forms a query box by subtracting/adding file-backed **40.0/40.0/52.0** extents at VM addresses 31128/31132/31136, and calls encoded service **-33** with four arguments including local result array and maximum **1024**. Its returned indices become `34091368 + index * 880`. It compares object offset 536 against **`trigger_location`** through ASCII comparator 69386 and returns the first match in the supplied engine order.
- If that stage finds no match, it traverses head 34999640 via the same `*(object+524)+24` links. The code calculates squared coordinate distance, starting with raw float bits **1296039936** (201326592.0) as the limit. Candidate distance **<= current best** reaches encoded service **-27** with two position pointers; a nonzero return updates both best distance and selected object. Equal-distance candidates therefore may replace an earlier selected object. End-of-list returns the selected pointer, initially NULL.
The [pinned ABI candidate report](qvm/qagame.abi-candidates.json), checked against the same qagame hash, labels service numbers 32/26 as **G_ENTITIES_IN_BOX/G_IN_PVS** and 18 as **G_SET_CONFIGSTRING**. Those are upstream candidates, not new proof of all shipped native argument/layout semantics. Float execution, engine ordering, portals, collision bounds and native platform correspondence remain unverified. The synthetic list and cache traces do not execute either spatial stage.

## Remaining work and Rust dependencies

RE-277–279 record these bounded/static milestones; RE-272 remains open for full substitution behavior. RE-280 tracks leader-flag/state writers, count/slot invariants, caller failure/default behavior, cache writers/expiry/reset, raw class tag derivation, linked-field ownership, full floating-point/box/PVS selection, configstring clients and original-runtime/platform fixtures. Rust location lookup needs explicit cache/ordering/tie rules and ownership backed by that evidence; a generic nearest-point search would not reproduce the observed two-stage control flow by itself.

The [AIM-001–003 follow-up](CHAT_CROSSHAIR.md) recovers the crosshair caller's geometry/trace/result routes. Full spatial services, caller output and runtime behavior remain open under RE-280/284.

The [NAT-001–003 follow-up](NATIVE_SPATIAL.md) confirms the shipped Linux ELF64 sinf/cosf and trace/PVS/area-query destinations and recovers VM-pointer/native spatial evidence. Earlier upstream-candidate limitations are narrowed for those mappings; full layout/geometry/runtime and other-platform parity remain open under RE-284/288.

	# Team-leader and location lookup paths

	Static pass, 2026-10-11. Reproduce with `python3 scripts/analyze_chat_locations.py`; check with `python3 scripts/test_chat_locations.py`. [Generated evidence](chat-locations.json) retains verified qagame partitions, leader/cache/format/list traces, literal reference windows and file-backed spatial constants. Original processes/full QVMs do not execute. Recorded callees have zero placeholder returns; isolated leader/location returns are supplied inputs. Floating-point geometry, box/visibility engine services and real formatting are not evaluated. This extends the [substitution key inventory](CHAT_EXPANSION.md).

	## LOC-001: first matching team leader

	Helper 169397 scans indices from zero while index is signed less than count global 34992524. Its record address is *global 34992496 + index 6336**. It returns the first index with all three raw predicates:

	- Record offset 468 !=0.
	- Record offset 3096 == requested team.
	- Record offset 3124 !=0.

	If no record matches, it returns -1. Zero/negative synthetic counts make no record reads. Both record states 1 and 2 can match; this is broader than delivery's required recipient state 2. A negative leader-flag word also satisfies the nonzero test. The fixtures cover skipped disconnected/wrong-team/unflagged records and multiple matches to verify first-match selection, without assigning complete state/role lifecycles.

	The `leader` substitution passes sender-record field 3096 into this helper. A supplied -1 result skips the name formatter, retaining the lookup's previously requested `unknown` default. Other observed results load the record pointer at *34091888 + slot 880, add 504**, and request `%s` into shared buffer 35738436 with capacity 150. Slot 0/2 slices verify that address chain. The helper call, initial default and formatting are not composed/executed here, so no actual no-leader screen text or bounds invariant is established.

	Literal-reference windows show helper 169397 in multiple containing functions, including chat lookup 185212. They do not cover computed calls, aliased references or every flag writer.

	## LOC-002: cached location and formatting wrapper

	Helper 268248 first reads object offset 848. A nonzero pointer returns immediately only if signed global time 34992532 < pointed-object field 596. NULL, equality or later time proceeds to spatial lookup. Synthetic cases cover those boundaries and a signed-wrap comparison; they do not establish a safe wrap-aware expiry contract. No cache refresh/store appears in the retained function, so the producers of fields 848/596 remain essential follow-ups.

	Wrapper 268637 calls 268248 and returns zero if lookup returns NULL. That failure path makes no formatting call and no direct buffer write in its slice. A nonzero lookup result loads its word at offset 592, requests formatter 70386 with caller buffer/capacity and template `%s`, then returns 1. The isolated success fixture uses capacity 150, text pointer 0x60000 and destination 0x70000. Success here is a return convention, not proof of a valid source string or successful bounded formatting.

	The `location` substitution forwards sender/shared buffer/capacity 150 to this wrapper. Crosshair branches and team-chat prefix construction also reference it. Failure handling/default text and output preservation must be recovered for every caller before a Rust API contract is complete.

	## LOC-003: registration, list order and static spatial search

	List-builder 264976 is guarded by nonzero global 34999636. Its unguarded path sets that guard to 1, clears head/count globals 34999640/34999644, and requests trap 18 (encoded -19) to set configstring 640 to literal `unknown`. It visits stride-880 objects beginning at 34091368 while its signed index is below entity count global 34992508.

	Each object qualifies only if offset 536 is nonzero and raw word 540 ==8489281. This pass does not assign the raw tag a complete class/hash identity. A qualifying object:

	1. Increments global 34999644 and stores that one-based number at object offset 684.
	2. Requests configstring 640 + number from its string pointer at object offset 592.
	3. Writes the old list head through *(object + 524) +24, then makes the object the new head.

	The three-object fixture publishes indices 641/642/643 in scan order and links head object 2 -> object 1 -> object 0 -> NULL. Filtering fixtures independently exclude zero field 536 and wrong field 540. The guarded path performs no reset/publication. Guard reset, entity-count capacity, NULL field-524 handling, configstring bounds, map restart and linked-object ownership remain open.

	The retained spatial helper shows two search stages after a cache miss:

	- It copies position words at object offsets 488/492/496, forms a query box by subtracting/adding file-backed 40.0/40.0/52.0 extents at VM addresses 31128/31132/31136, and calls encoded service -33 with four arguments including local result array and maximum 1024. Its returned indices become `34091368 + index * 880`. It compares object offset 536 against `trigger_location` through ASCII comparator 69386 and returns the first match in the supplied engine order.
	- If that stage finds no match, it traverses head 34999640 via the same `(object+524)+24` links. The code calculates squared coordinate distance, starting with raw float bits 1296039936* (201326592.0) as the limit. Candidate distance <= current best reaches encoded service -27 with two position pointers; a nonzero return updates both best distance and selected object. Equal-distance candidates therefore may replace an earlier selected object. End-of-list returns the selected pointer, initially NULL.

	The [pinned ABI candidate report](qvm/qagame.abi-candidates.json), checked against the same qagame hash, labels service numbers 32/26 as G_ENTITIES_IN_BOX/G_IN_PVS and 18 as G_SET_CONFIGSTRING. Those are upstream candidates, not new proof of all shipped native argument/layout semantics. Float execution, engine ordering, portals, collision bounds and native platform correspondence remain unverified. The synthetic list and cache traces do not execute either spatial stage.

	## Remaining work and Rust dependencies

	RE-277–279 record these bounded/static milestones; RE-272 remains open for full substitution behavior. RE-280 tracks leader-flag/state writers, count/slot invariants, caller failure/default behavior, cache writers/expiry/reset, raw class tag derivation, linked-field ownership, full floating-point/box/PVS selection, configstring clients and original-runtime/platform fixtures. Rust location lookup needs explicit cache/ordering/tie rules and ownership backed by that evidence; a generic nearest-point search would not reproduce the observed two-stage control flow by itself.

	The [AIM-001–003 follow-up](CHAT_CROSSHAIR.md) recovers the crosshair caller's geometry/trace/result routes. Full spatial services, caller output and runtime behavior remain open under RE-280/284.

	The [NAT-001–003 follow-up](NATIVE_SPATIAL.md) confirms the shipped Linux ELF64 sinf/cosf and trace/PVS/area-query destinations and recovers VM-pointer/native spatial evidence. Earlier upstream-candidate limitations are narrowed for those mappings; full layout/geometry/runtime and other-platform parity remain open under RE-284/288.