Recover team leader and location lookup paths

docs/FINDINGS.md

@@ -270,3 +270,9 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 **F-065 — Observed sampled item names:** weapon-name words use 4020+432*low_byte; sampled indices 0–29 include duplicate None strings and a NULL pointer at 18. This does not establish legal IDs or complete table extent. Game-item types 7/8 select flag/bomb; other paths branch on helper-36717's least-significant bit with RNG semantics unresolved. [ITEM-002](research/CHAT_ITEMS_TIME.md).
 
 **F-066 — Observed countdown predicates:** gametime uses registered timelimit integer times 60000 minus elapsed; nonpositive results request no timelimit even at expiry. Roundtime requires positive remaining and types 4/5/8/10. Boundary/wrap traces are synthetic; timer writers, active cvar bounds, output and original-runtime conformance remain open. [ITEM-003](research/CHAT_ITEMS_TIME.md).
+
+**F-067 — Observed leader selection:** helper 169397 returns the first nonzero-state record with matching team and nonzero leader flag, or -1. The leader substitution uses a stride-880 record-pointer/name address chain on success; isolated failure skips its formatter. Role/state lifecycle, caller default composition and runtime output remain open. [LOC-001](research/CHAT_LOCATIONS.md).
+
+**F-068 — Observed cached location contract:** nonzero object field 848 returns only when signed now < pointed-field 596; equality misses. Wrapper 268637 returns zero without formatting on NULL, otherwise formats pointed-field 592 and returns one. Cache writers, source validity, caller failure handling and signed-wrap conformance remain open. [LOC-002](research/CHAT_LOCATIONS.md).
+
+**F-069 — Observed location list/search structure:** guarded registration publishes unknown at configstring 640, numbers qualifying objects and inserts reverse-order links through *(object+524)+24. Static lookup retains first trigger_location in a 40/40/52 query box, then distance <= best plus visibility fallback. Geometry/engine services, raw tag identity, list lifecycle and runtime/platform parity remain unverified. [LOC-003](research/CHAT_LOCATIONS.md).

docs/PROVISIONAL_TODO.md

@@ -33,7 +33,7 @@ For implementation items, the minimum done condition is a documented contract, a
 
 ### First research batch
 
-Progress: [RE-232–234 / TIME-001–003](research/FRAME_TIMING.md) now cover Linux ELF64 elapsed modification, event sources and pause predicates. The [RE-237–239 follow-up](research/EVENT_QUEUES.md) resolves the pause-field address/bot chain and adds queue/journal evidence. The [RE-241–243 announcement pass](research/AUTH_ANNOUNCEMENTS.md) recovers label tables and recipient paths; The [RE-245–247 cvar pass](research/GAME_CVARS.md) adds all 126 main registration rows and resolves auth_verbosity/callers. The [RE-249–251 change pass](research/CVAR_CHANGES.md) adds cache/notification behavior, four numeric correction branches and direct registration coverage. The [RE-253–255 query pass](research/AUTH_QUERIES.md) adds selector helpers, command-role routing and internal authentication modes. The [RE-257–259 bounds/entry pass](research/SELECTOR_BOUNDS.md) adds integer parsing, selector storage/count evidence and native/QVM/chat route connections. The [RE-261–263 chat pass](research/CHAT_PATHS.md) adds native command metadata/filter evidence and bounded message/recipient paths, including the documented argument-mapping correction. The [RE-265–267 delivery pass](research/CHAT_DELIVERY.md) adds bounded dead-chat predicates, formatter argument routing and echo/fanout calls. The [RE-269–271 expansion pass](research/CHAT_EXPANSION.md) adds marker states, twelve key comparisons and health/momo branches. The [RE-273–275 item/time pass](research/CHAT_ITEMS_TIME.md) adds packed ammunition fields, sampled names and countdown branches. PROV-002 remains open for full output/reset coverage. PROV-001 remains open for complete scheduling and platform coverage.
+Progress: [RE-232–234 / TIME-001–003](research/FRAME_TIMING.md) now cover Linux ELF64 elapsed modification, event sources and pause predicates. The [RE-237–239 follow-up](research/EVENT_QUEUES.md) resolves the pause-field address/bot chain and adds queue/journal evidence. The [RE-241–243 announcement pass](research/AUTH_ANNOUNCEMENTS.md) recovers label tables and recipient paths; The [RE-245–247 cvar pass](research/GAME_CVARS.md) adds all 126 main registration rows and resolves auth_verbosity/callers. The [RE-249–251 change pass](research/CVAR_CHANGES.md) adds cache/notification behavior, four numeric correction branches and direct registration coverage. The [RE-253–255 query pass](research/AUTH_QUERIES.md) adds selector helpers, command-role routing and internal authentication modes. The [RE-257–259 bounds/entry pass](research/SELECTOR_BOUNDS.md) adds integer parsing, selector storage/count evidence and native/QVM/chat route connections. The [RE-261–263 chat pass](research/CHAT_PATHS.md) adds native command metadata/filter evidence and bounded message/recipient paths, including the documented argument-mapping correction. The [RE-265–267 delivery pass](research/CHAT_DELIVERY.md) adds bounded dead-chat predicates, formatter argument routing and echo/fanout calls. The [RE-269–271 expansion pass](research/CHAT_EXPANSION.md) adds marker states, twelve key comparisons and health/momo branches. The [RE-273–275 item/time pass](research/CHAT_ITEMS_TIME.md) adds packed ammunition fields, sampled names and countdown branches. The [RE-277–279 location pass](research/CHAT_LOCATIONS.md) adds leader selection, cache/format boundaries and location-list/spatial evidence. PROV-002 remains open for full output/reset coverage. PROV-001 remains open for complete scheduling and platform coverage.
 
 Start with the open questions raised by the current binary evidence. These tasks depend on the linked reports, not on a working rewrite.
 

docs/RESEARCH_LEDGER.md

@@ -137,3 +137,7 @@ Completed bounded milestones RE-269–271 with `analyze_chat_expansion.py`: pars
 ## 2026-10-11 — Packed chat item fields and countdowns
 
 Completed bounded milestones RE-273–275 with `analyze_chat_items_time.py`: 32 ammo/60 weapon/82 timer slices, thirty file-backed name-word samples and nine game-item mode/bit paths. ITEM-001–003/F-064–066 retain NULL/duplicate samples, explicit table-extent uncertainty, cvar identity and expired-countdown fallback distinctions. Added restricted signed/unsigned right shifts and truncation-based signed remainder to the bounded evaluator. Eight tests check arithmetic failure domains, byte masks, sampled pointers/bounds, death overrides and countdown/type boundaries. RE-272 remains open; RE-276 tracks full producer/table/timer ownership and formatter/runtime/platform behavior. No original process/full QVM or recorded callee executes.
+
+## 2026-10-11 — Team leader and location lookup paths
+
+Completed RE-277–279 bounded/static milestones with `analyze_chat_locations.py`: six leader scans, three name chains, five cache boundaries, two wrapper returns, four registration paths, literal-reference windows and file-backed box extents. LOC-001–003/F-067–069 separate executed synthetic integer slices from retained floating-point/engine spatial code and distinguish upstream ABI candidates from native proof. Seven tests check first-match/nonzero semantics, strict expiry, failure/success formatting requests, guard/filter/numbering/reverse links and static spatial constants/branches. RE-272 remains open; RE-280 tracks writers/ownership/reset/geometry/client/runtime/platform composition. No original process/full QVM or recorded callee executes.

docs/REVERSE_ENGINEERING_TODO.md

@@ -327,3 +327,8 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 - [x] RE-274 Recover weapon-name pointer expression, explicitly sampled indices 0–29 including NULL/duplicate entries, and game-item mode/bit branches ([ITEM-002](research/CHAT_ITEMS_TIME.md)).
 - [x] RE-275 Connect gametime to registered timelimit and recover bounded game/round countdown arithmetic, fallback literals and game-type gates ([ITEM-003](research/CHAT_ITEMS_TIME.md)).
 - [ ] RE-276 Recover complete packed-state producers/selector bounds, stride-432 table layout/extent/legal IDs/consumers, helper-36717 semantics, timer globals/cvar lifecycle and full formatter/original-runtime/platform fixtures.
+
+- [x] RE-277 Recover bounded first-match team-leader predicates, missing result and isolated leader-name address chain ([LOC-001](research/CHAT_LOCATIONS.md)).
+- [x] RE-278 Recover strict location cache-expiry boundaries and isolated NULL/nonzero formatter-wrapper returns ([LOC-002](research/CHAT_LOCATIONS.md)).
+- [x] RE-279 Recover bounded location registration/filter/numbering/reverse-link paths and retain static box/distance/visibility search evidence ([LOC-003](research/CHAT_LOCATIONS.md)).
+- [ ] RE-280 Recover leader/cache/state writers, count/slot bounds, location class-tag derivation/list ownership/reset, caller failure/default behavior, full float/box/PVS search, configstring client consumption and original-runtime/platform fixtures.

docs/research/CHAT_EXPANSION.md

@@ -50,3 +50,5 @@ The `momo` match clears shared buffer byte zero and reads sender-record pointer
 RE-269–271 record parser-state, key-comparison and health/momo milestones. RE-268 remains open for the complete expansion/output contract; RE-272 tracks full capacity-150 copy and append bounds, prefix consumption and buffer aliases, item/ammunition tables, timer arithmetic and cvar identities, location/leader/crosshair callees, momo object writers/consumers and original-runtime/platform fixtures. A Rust implementation will need owned-buffer semantics, exact marker/control-byte behavior and distinct field predicates, backed by completed output specifications before claiming parity.
 
 The [ITEM-001–003 follow-up](CHAT_ITEMS_TIME.md) recovers bounded ammo/weapon/game-item/timer paths and thirty sampled name words. Full table, producer and timing/output contracts remain open under RE-272/276.
+
+The [LOC-001–003 follow-up](CHAT_LOCATIONS.md) recovers leader scan/name paths, location cache/format boundaries and list-building/static spatial evidence. Full caller/output/geometry behavior remains open under RE-272/280.

docs/research/CHAT_LOCATIONS.md

@@ -0,0 +1,48 @@
+# Team-leader and location lookup paths
+
+Static pass, 2026-10-11. Reproduce with `python3 scripts/analyze_chat_locations.py`; check with `python3 scripts/test_chat_locations.py`. [Generated evidence](chat-locations.json) retains verified qagame partitions, leader/cache/format/list traces, literal reference windows and file-backed spatial constants. Original processes/full QVMs do not execute. Recorded callees have zero placeholder returns; isolated leader/location returns are supplied inputs. Floating-point geometry, box/visibility engine services and real formatting are not evaluated. This extends the [substitution key inventory](CHAT_EXPANSION.md).
+
+## LOC-001: first matching team leader
+
+Helper **169397** scans indices from zero while index is signed less than count global **34992524**. Its record address is **global 34992496 + index * 6336**. It returns the first index with all three raw predicates:
+
+- Record offset **468 !=0**.
+- Record offset **3096 == requested team**.
+- Record offset **3124 !=0**.
+
+If no record matches, it returns **-1**. Zero/negative synthetic counts make no record reads. Both record states 1 and 2 can match; this is broader than delivery's required recipient state 2. A negative leader-flag word also satisfies the nonzero test. The fixtures cover skipped disconnected/wrong-team/unflagged records and multiple matches to verify first-match selection, without assigning complete state/role lifecycles.
+
+The `leader` substitution passes sender-record field 3096 into this helper. A supplied -1 result skips the name formatter, retaining the lookup's previously requested `unknown` default. Other observed results load the record pointer at **34091888 + slot * 880**, add **504**, and request `%s` into shared buffer 35738436 with capacity 150. Slot 0/2 slices verify that address chain. The helper call, initial default and formatting are not composed/executed here, so no actual no-leader screen text or bounds invariant is established.
+
+Literal-reference windows show helper 169397 in multiple containing functions, including chat lookup 185212. They do not cover computed calls, aliased references or every flag writer.
+
+## LOC-002: cached location and formatting wrapper
+
+Helper **268248** first reads object offset **848**. A nonzero pointer returns immediately only if signed global time **34992532 < pointed-object field 596**. NULL, equality or later time proceeds to spatial lookup. Synthetic cases cover those boundaries and a signed-wrap comparison; they do not establish a safe wrap-aware expiry contract. No cache refresh/store appears in the retained function, so the producers of fields 848/596 remain essential follow-ups.
+
+Wrapper **268637** calls 268248 and returns zero if lookup returns NULL. That failure path makes no formatting call and no direct buffer write in its slice. A nonzero lookup result loads its word at offset **592**, requests formatter 70386 with caller buffer/capacity and template `%s`, then returns **1**. The isolated success fixture uses capacity 150, text pointer 0x60000 and destination 0x70000. Success here is a return convention, not proof of a valid source string or successful bounded formatting.
+
+The `location` substitution forwards sender/shared buffer/capacity 150 to this wrapper. Crosshair branches and team-chat prefix construction also reference it. Failure handling/default text and output preservation must be recovered for every caller before a Rust API contract is complete.
+
+## LOC-003: registration, list order and static spatial search
+
+List-builder **264976** is guarded by nonzero global **34999636**. Its unguarded path sets that guard to 1, clears head/count globals **34999640/34999644**, and requests trap **18** (encoded -19) to set configstring **640** to literal **`unknown`**. It visits stride-880 objects beginning at **34091368** while its signed index is below entity count global **34992508**.
+
+Each object qualifies only if offset **536** is nonzero and raw word **540 ==8489281**. This pass does not assign the raw tag a complete class/hash identity. A qualifying object:
+
+1. Increments global 34999644 and stores that one-based number at object offset **684**.
+2. Requests configstring **640 + number** from its string pointer at object offset **592**.
+3. Writes the old list head through ***(object + 524) +24**, then makes the object the new head.
+
+The three-object fixture publishes indices 641/642/643 in scan order and links head object 2 -> object 1 -> object 0 -> NULL. Filtering fixtures independently exclude zero field 536 and wrong field 540. The guarded path performs no reset/publication. Guard reset, entity-count capacity, NULL field-524 handling, configstring bounds, map restart and linked-object ownership remain open.
+
+The retained spatial helper shows two search stages after a cache miss:
+
+- It copies position words at object offsets **488/492/496**, forms a query box by subtracting/adding file-backed **40.0/40.0/52.0** extents at VM addresses 31128/31132/31136, and calls encoded service **-33** with four arguments including local result array and maximum **1024**. Its returned indices become `34091368 + index * 880`. It compares object offset 536 against **`trigger_location`** through ASCII comparator 69386 and returns the first match in the supplied engine order.
+- If that stage finds no match, it traverses head 34999640 via the same `*(object+524)+24` links. The code calculates squared coordinate distance, starting with raw float bits **1296039936** (201326592.0) as the limit. Candidate distance **<= current best** reaches encoded service **-27** with two position pointers; a nonzero return updates both best distance and selected object. Equal-distance candidates therefore may replace an earlier selected object. End-of-list returns the selected pointer, initially NULL.
+
+The [pinned ABI candidate report](qvm/qagame.abi-candidates.json), checked against the same qagame hash, labels service numbers 32/26 as **G_ENTITIES_IN_BOX/G_IN_PVS** and 18 as **G_SET_CONFIGSTRING**. Those are upstream candidates, not new proof of all shipped native argument/layout semantics. Float execution, engine ordering, portals, collision bounds and native platform correspondence remain unverified. The synthetic list and cache traces do not execute either spatial stage.
+
+## Remaining work and Rust dependencies
+
+RE-277–279 record these bounded/static milestones; RE-272 remains open for full substitution behavior. RE-280 tracks leader-flag/state writers, count/slot invariants, caller failure/default behavior, cache writers/expiry/reset, raw class tag derivation, linked-field ownership, full floating-point/box/PVS selection, configstring clients and original-runtime/platform fixtures. Rust location lookup needs explicit cache/ordering/tie rules and ownership backed by that evidence; a generic nearest-point search would not reproduce the observed two-stage control flow by itself.

docs/research/README.md

@@ -39,10 +39,11 @@ python3 scripts/test_chat_paths.py
 python3 scripts/test_chat_delivery.py
 python3 scripts/test_chat_expansion.py
 python3 scripts/test_chat_items_time.py
+python3 scripts/test_chat_locations.py
 python3 scripts/storage_policy.py check --require-setup
 ```
 
-The pipeline runs `fetch_analysis_references.py`, `analyze_qvm.py`, `analyze_native.py`, `analyze_vm_abi.py`, `analyze_native_dispatch.py`, `analyze_vm_extensions.py`, `analyze_native_metadata.py`, `analyze_native_coverage.py`, `analyze_auth_drop.py`, `analyze_deferred_auth.py`, `analyze_engine_control.py`, `analyze_frame_timing.py`, `analyze_event_queues.py`, `analyze_auth_announcements.py`, `analyze_game_cvars.py`, `analyze_cvar_changes.py`, `analyze_auth_queries.py`, `analyze_selector_bounds.py`, `analyze_chat_paths.py`, `analyze_chat_delivery.py`, `analyze_chat_expansion.py`, and `analyze_chat_items_time.py` in that order. Python 3.9+ and **LLVM objdump** with x86 ELF/COFF/Mach-O support are required. This pass used Apple LLVM 17.0.0 on macOS arm64; it disassembled x86 images without running them. Upstream references are downloaded only if absent, checked against the committed SHA-256 manifest, and cached under `.cache/research/upstream/`. A clone also needs `git lfs pull` to obtain the derived artifacts/extracted members.
+The pipeline runs `fetch_analysis_references.py`, `analyze_qvm.py`, `analyze_native.py`, `analyze_vm_abi.py`, `analyze_native_dispatch.py`, `analyze_vm_extensions.py`, `analyze_native_metadata.py`, `analyze_native_coverage.py`, `analyze_auth_drop.py`, `analyze_deferred_auth.py`, `analyze_engine_control.py`, `analyze_frame_timing.py`, `analyze_event_queues.py`, `analyze_auth_announcements.py`, `analyze_game_cvars.py`, `analyze_cvar_changes.py`, `analyze_auth_queries.py`, `analyze_selector_bounds.py`, `analyze_chat_paths.py`, `analyze_chat_delivery.py`, `analyze_chat_expansion.py`, `analyze_chat_items_time.py`, and `analyze_chat_locations.py` in that order. Python 3.9+ and **LLVM objdump** with x86 ELF/COFF/Mach-O support are required. This pass used Apple LLVM 17.0.0 on macOS arm64; it disassembled x86 images without running them. Upstream references are downloaded only if absent, checked against the committed SHA-256 manifest, and cached under `.cache/research/upstream/`. A clone also needs `git lfs pull` to obtain the derived artifacts/extracted members.
 
 Generated JSON/JSONL and compressed evidence are regenerated in place; keep prose notes in Markdown. Rerunning the four analysis stages reproduced every generated report and gzip artifact byte-for-byte on the same toolchain. gzip timestamps and stored filenames are fixed. Different objdump versions can produce different disassembly text, so tool version and uncompressed evidence hashes are recorded. Reports are UTF-8 normal Git text, with individual files below the storage policy's 2 MiB limit.
 
@@ -88,3 +89,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 [Radio/chat expansion states and keys](CHAT_EXPANSION.md) adds RE-269–271: marker and length branches, all twelve comparison keys, health labels and momo side-effect writes. Reproduce with `python3 scripts/analyze_chat_expansion.py`; check with `python3 scripts/test_chat_expansion.py`. Full composed parser output, buffer bounds and the remaining substitution bodies stay open.
 
 [Chat ammunition, item names and countdowns](CHAT_ITEMS_TIME.md) adds RE-273–275: packed byte extraction, thirty sampled name words/game-item branches and timer/cvar/gate evidence. Reproduce with `python3 scripts/analyze_chat_items_time.py`; check with `python3 scripts/test_chat_items_time.py`. Complete item tables/producers and timing/output/runtime contracts remain open.
+
+[Team-leader and location lookup paths](CHAT_LOCATIONS.md) adds RE-277–279: first-match leader scan, strict cache/format boundaries, location registration/list order and retained spatial control flow/constants. Reproduce with `python3 scripts/analyze_chat_locations.py`; check with `python3 scripts/test_chat_locations.py`. Geometry/services, ownership, caller output and runtime/platform contracts remain open.

scripts/analyze_binaries.py

@@ -14,7 +14,7 @@ def main():
                    'analyze_deferred_auth.py', 'analyze_engine_control.py', 'analyze_frame_timing.py',
                    'analyze_event_queues.py', 'analyze_auth_announcements.py', 'analyze_game_cvars.py',
                    'analyze_cvar_changes.py', 'analyze_auth_queries.py', 'analyze_selector_bounds.py',
-                   'analyze_chat_paths.py', 'analyze_chat_delivery.py', 'analyze_chat_expansion.py', 'analyze_chat_items_time.py'):
+                   'analyze_chat_paths.py', 'analyze_chat_delivery.py', 'analyze_chat_expansion.py', 'analyze_chat_items_time.py', 'analyze_chat_locations.py'):
         subprocess.run([sys.executable, str(Path('scripts')/script)], check=True)
 
 

scripts/analyze_chat_locations.py

@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+"""Recover leader scan, cached location formatting and location-list registration."""
+import json
+import struct
+from pathlib import Path
+from analyze_deferred_auth import partition_function, trace_slice
+from analyze_game_cvars import vm_string
+from analyze_qvm import decode,write_json
+from analyze_vm_extensions import verified
+
+
+def main():
+    q=json.loads(Path('docs/research/qvm/qagame.json').read_text())
+    d=verified(Path(q['source']['member']['output']).read_bytes(),q['sha256']);h,ins=decode(d)
+    leader=[]
+    cases=[(0,[]),(-1,[]),(3,[(0,1,1),(1,2,1),(2,1,1)]),
+           (3,[(1,1,1),(2,1,1),(2,1,1)]),(3,[(2,1,0),(2,1,0),(2,2,1)]),
+           (3,[(1,1,-1),(0,1,1),(2,1,1)])]
+    for count,records in cases:
+        memory={34992496:0x10000,34992524:count}
+        for i,(state,team,flag) in enumerate(records):
+            a=0x10000+i*6336
+            memory.update({a+468:state,a+3096:team,a+3124:flag})
+        t=trace_slice(ins,169398,169460,memory,{20:1},halt_on_leave=True,capture_stack=True,limit=1024)
+        leader.append({'count':count,'record_state_team_flag':records,'requested_team':1,'trace':t})
+    leader_format=[]
+    for slot in [-1,0,2]:
+        memory={} if slot==-1 else {34091888+slot*880:0x50000}
+        t=trace_slice(ins,185947,186431,memory,{76:slot})
+        leader_format.append({'supplied_leader_return':slot,'trace':t})
+    cache=[]
+    obj,location=0x10000,0x20000
+    for pointer,now,expiry in [(0,1000,0),(location,999,1000),(location,1000,1000),
+                               (location,1001,1000),(location,-2147483640,2147483640)]:
+        m={obj+848:pointer,34992532:now}
+        if pointer:m[pointer+596]=expiry
+        t=trace_slice(ins,268249,268279,m,{4236:obj},halt_on_leave=True,capture_stack=True)
+        cache.append({'pointer':pointer,'now':now,'expiry':expiry,'trace':t})
+    format_traces=[]
+    for result in [0,location]:
+        t=trace_slice(ins,268649,268676,{} if not result else {location+592:0x60000},
+                      {24:result,44:0x70000,48:150},halt_on_leave=True,capture_stack=True)
+        format_traces.append({'supplied_lookup_return':result,'trace':t})
+    lists=[]
+    for guarded,count,fields in [(1,3,[]),(0,0,[]),
+          (0,3,[(1,8489281),(0,8489281),(1,0)]),
+          (0,3,[(1,8489281),(1,8489281),(1,8489281)])]:
+        m={34999636:guarded,34992508:count}
+        for i,(name_present,raw_tag) in enumerate(fields):
+            obj=34091368+i*880
+            m.update({obj+536:0x80000 if name_present else 0,obj+540:raw_tag,
+                      obj+524:0x90000+i*64,obj+592:0xa0000+i*64})
+        t=trace_slice(ins,264977,265088,m,{36:34091368},limit=2048)
+        lists.append({'guard':guarded,'count':count,'name_present_raw_tag':fields,'trace':t})
+    references={}
+    for value in [169397,268248,268637,34999640]:
+        references[str(value)]=[]
+        for j,x in enumerate(ins):
+            if x['opcode']=='CONST' and x['operand']==value:
+                entry=next(k for k in range(j,-1,-1) if ins[k]['opcode']=='ENTER')
+                references[str(value)].append({'instruction':j,'containing_entry':entry,
+                                               'window':ins[max(entry,j-4):j+7]})
+    abi=json.loads(Path('docs/research/qvm/qagame.abi-candidates.json').read_text())
+    if abi['sha256']!=q['sha256']:raise ValueError('ABI provenance changed')
+    services=[r for r in abi['syscalls'] if r['number'] in [18,26,32]]
+    extent=[]
+    for address in [31128,31132,31136]:
+        if address+4>h['data_length']:raise ValueError('box extent outside initialized data')
+        offset=h['data_offset']+address
+        extent.append({'vm_address':address,'raw_bits':struct.unpack_from('<I',d,offset)[0],
+                       'float_value':struct.unpack_from('<f',d,offset)[0]})
+    out={'box_extent_constants':extent,'abi_reference_revision':abi['reference_revision'],'service_candidates':services,'source':q['source'],'sha256':q['sha256'],
+         'functions':{str(e):partition_function(ins,e,d,h) for e in [169397,264976,268248,268637]},
+         'leader_scan_traces':leader,'leader_format_traces':leader_format,'cache_traces':cache,
+         'location_format_traces':format_traces,'registration_traces':lists,'literal_references':references,
+         'strings':{str(a):vm_string(d,h,a) for a in [93224,93227,92460,78042]},
+         'limitations':'Static partitions and bounded synthetic traces, not original runtime/full QVM '
+         'execution. Callees are recorded with zero placeholder returns; isolated lookup/leader returns are '
+         'supplied. Floating-point distance/geometry and engine box/visibility calls are retained but not '
+         'evaluated. Field types, cache writers, list lifecycle/ownership, real formatting and all-platform '
+         'behavior remain open. Literal scans exclude aliases/computed references.'}
+    write_json(Path('docs/research/chat-locations.json'),out)
+    print('Recovered leader selection, cached location formatting and list-building traces')
+
+
+if __name__=='__main__':main()

scripts/test_chat_locations.py

@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+"""Check leader/cache/list boundaries and static spatial branch evidence."""
+import json
+from pathlib import Path
+import unittest
+
+
+class ChatLocationTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.r=json.loads(Path('docs/research/chat-locations.json').read_text())
+        cls.ins={i['index']:i for f in cls.r['functions'].values() for i in f['instructions']}
+
+    def test_first_nonzero_state_matching_flagged_leader(self):
+        rows=self.r['leader_scan_traces']
+        self.assertEqual([x['trace']['stack'] for x in rows],[[-1],[-1],[2],[0],[-1],[0]])
+        for x in rows:
+            t=x['trace'];self.assertEqual(t['calls'],[])
+            expected=next((i for i,(state,team,flag) in enumerate(x['record_state_team_flag'])
+                           if state!=0 and team==x['requested_team'] and flag!=0),-1)
+            self.assertEqual(t['stack'],[expected])
+        self.assertNotIn(169430,rows[2]['trace']['trace'][:10])
+        self.assertEqual(self.ins[169405]['operand'],6336)
+
+    def test_leader_format_failure_and_name_pointer(self):
+        rows=self.r['leader_format_traces'];self.assertEqual(rows[0]['trace']['calls'],[])
+        for x in rows[1:]:
+            calls=x['trace']['calls'];self.assertEqual(len(calls),1)
+            self.assertEqual(calls[0]['target'],70386)
+            self.assertEqual(calls[0]['args'],{'8':35738436,'12':150,'16':78042,'20':0x50000+504})
+
+    def test_cache_expiry_strictness_and_signed_comparison(self):
+        rows=self.r['cache_traces']
+        self.assertEqual([x['trace']['stack'] for x in rows],[[],[0x20000],[],[],[0x20000]])
+        self.assertEqual([268279==self.ins[x['trace']['trace'][-1]]['operand'] for x in rows],
+                         [True,False,True,True,False])
+        for x in rows:self.assertEqual(x['trace']['calls'],[])
+
+    def test_location_format_success_and_null_failure(self):
+        a,b=self.r['location_format_traces']
+        self.assertEqual(a['trace']['calls'],[]);self.assertEqual(a['trace']['stack'],[0])
+        self.assertEqual(b['trace']['stack'],[1])
+        self.assertEqual(b['trace']['calls'][0]['args'],{'8':0x70000,'12':150,'16':93224,'20':0x60000})
+        self.assertEqual(self.r['strings']['93224'],'%s')
+
+    def test_registration_guard_and_empty_reset(self):
+        a,b=self.r['registration_traces'][:2]
+        self.assertEqual(a['trace']['calls'],[])
+        self.assertNotIn('34999640',a['trace']['memory'])
+        self.assertEqual(b['trace']['memory']['34999640'],0)
+        self.assertEqual(b['trace']['memory']['34999644'],0)
+        self.assertEqual(b['trace']['memory']['34999636'],1)
+        self.assertEqual(b['trace']['calls'][0]['args'],{'8':640,'12':92460})
+        self.assertEqual(self.r['strings']['92460'],'unknown')
+
+    def test_registration_filter_numbering_and_reverse_links(self):
+        one,all_rows=self.r['registration_traces'][2:]
+        self.assertEqual(one['trace']['memory']['34999644'],1)
+        self.assertEqual(one['trace']['memory']['34999640'],34091368)
+        t=all_rows['trace'];self.assertEqual(t['memory']['34999644'],3)
+        self.assertEqual(t['memory']['34999640'],34091368+2*880)
+        self.assertEqual([c['args']['8'] for c in t['calls']],[640,641,642,643])
+        self.assertTrue(all(c['target']==-19 for c in t['calls']))
+        for i in range(3):
+            self.assertEqual(t['memory'][str(34091368+i*880+684)],i+1)
+            self.assertEqual(t['memory'][str(0x90000+i*64+24)],0 if i==0 else 34091368+(i-1)*880)
+
+    def test_spatial_function_constants_and_branch_order(self):
+        # Static evidence only: the float/collision callees are not evaluated.
+        self.assertEqual(self.ins[268283]['operand'],1296039936)
+        self.assertEqual([x['float_value'] for x in self.r['box_extent_constants']],[40.0,40.0,52.0])
+        self.assertEqual([x['raw_bits'] for x in self.r['box_extent_constants']],[0x42200000,0x42200000,0x42500000])
+        self.assertEqual((self.ins[268368]['operand'],self.ins[268365]['operand']),(-33,1024))
+        self.assertEqual(self.r['strings']['93227'],'trigger_location')
+        self.assertEqual(self.ins[268590]['opcode'],'LEF')
+        self.assertEqual(self.ins[268590]['operand'],268593)
+        self.assertEqual(self.ins[268601]['operand'],-27)
+        self.assertEqual(self.ins[268607]['operand'],268610)
+        self.assertEqual(self.ins[268621]['operand'],524)
+        self.assertEqual(self.ins[268624]['operand'],24)
+        candidates={x['number']:x['upstream_name_candidate'] for x in self.r['service_candidates']}
+        self.assertEqual(candidates,{18:'G_SET_CONFIGSTRING',26:'G_IN_PVS',32:'G_ENTITIES_IN_BOX'})
+
+
+if __name__=='__main__':unittest.main()