# Chat policy, formats and delivery calls

Static pass, 2026-10-11. Reproduce with `python3 scripts/analyze_chat_delivery.py`; check with `python3 scripts/test_chat_delivery.py`. [Generated evidence](chat-delivery.json) includes the verified qagame hash, function partitions, initialized-data mode table, 512 policy paths and bounded argument/field/call traces. No original process or complete QVM executes. Recorded CALLs return zero placeholders; formatting, cleanup and delivery callees are not entered. These slices extend the [recipient front gates](CHAT_PATHS.md), without composing a complete recipient decision.

## DEL-001: classification and dead-chat policy

Helper 186721 derives five boolean locals from sender/recipient record pointers at object offset 520. Exact raw predicates are:

| Flag used below | Local | Record predicate |
| --- | ---: | --- |
| S, label-supported SUB interpretation | 56 | sender offset 3740 equals 1 |
| P, label-supported SPEC interpretation | 44 | sender offset 3096 equals 3 |
| D, label-supported DEAD interpretation | 60 | sender offset 4 equals 3 OR offset 4324 is nonzero |
| T, recipient spectator-like predicate | 64 | recipient offset 3096 is signed >=3 |
| U, recipient dead-like predicate | 68 | recipient offset 4 equals 3 OR offset 4324 is nonzero |

Names are provisional field interpretations. In particular, recipient T accepts values greater than 3 whereas sender P requires exactly 3. Offset 4324 supplies an alternative condition rather than replacing the offset-4 comparison. Five bounded raw-field fixtures exercise each flag and both death alternatives. Global 34999596 can skip classification and policy before this slice; its identity, initialized flag values and lifecycle remain open.

At instruction 187058, nonzero global **34999652** bypasses the following policy. Otherwise registered **g_deadchat** integer mirror **34067996** selects these acceptance predicates. Let A = S OR P OR D, G = game-type mirror 34090788 equals 9, and M = incoming channel mode equals 1:

| g_deadchat | Acceptance within this policy slice |
| --- | --- |
| 1 | (NOT P OR T OR G) AND (NOT A OR T OR U OR M OR G) |
| 2 | NOT P OR T OR G |
| Other observed values 0 and 3 | NOT A OR T OR U OR G |

Mode 1's exception in policy 1 does not override the first spectator restriction. For example, spectator-to-nonspectator remains rejected even if the recipient satisfies U; a dead nonspectator-to-live nonspectator can pass mode 1. Game-type value 9 permits every tested combination at this slice. It does not override earlier mute/ignore/state/team gates.

The collector enumerates policies 0/1/2/3, modes 0/1, game types 0/9 and all 32 flag vectors. Accepted counts are respectively **114/109/112/114**, out of 128 per policy. Each trace reaches actual acceptance instruction 187154 or rejection instruction 187379. This is bounded instruction evidence with synthetic memory, not a runtime server capture or a claim about every cvar domain.

## DEL-002: modes, labels and formatter arguments

Send helper 187381 reads a five-entry table at VM address **29376**. Modes 0/1/2/3/4 dispatch to instructions **187423/187476/187565/187423/187643**. Signed values outside 0–4 take the mode-0 target. These are name/prefix construction destinations, distinct from the later formatting decisions in delivery helper 186721.

The delivery formatter selects an integer channel value: mode 3 forces 3; otherwise sender-record offset 3096 equal to 2 or 1 produces 2 or 1, with other values producing 0. Exact string templates and argument routing are:

| Mode | Template / routing |
| --- | --- |
| 0, ordinary | `%s "%d" "%s%s%s%c%c%s"`, command `cchat` |
| 1, team | Same template, command `tcchat` |
| 2, private | `cchat "%d" "%s[pm] %s %s%s%c%c%s"` |
| 3 | Ordinary template, command `tcchat`, integer channel 3 |
| 4, emote | `me "%d" "%s%c%c%s"` |

Ordinary arguments after the command/channel are SUB-or-DEAD label, SPEC label, name prefix, caret byte 94, supplied color byte and text pointer. `(SUB) ` takes precedence over `(DEAD) ` when both flags are set; `(SPEC) ` is independent. Missing labels use the actual empty string. Private arguments include `^3`, direction **`->` for sender-to-self** or **`<-` for a different recipient**, `^7`, name prefix, caret/color and text. Emote forwards name prefix/caret/color/text without those ordinary labels.

Prefix strings at VM addresses 77696/77653/77619/77589 contain **byte 25 (0x19)**: respectively `%s%c%c\x19: `, `%s%c%c\x19\x19: `, `\x19%s%c%c\x19: ` and `*%s%c%c\x19 `. The JSON preserves the control bytes. Their client parsing/rendering meaning remains open; do not normalize them to spaces or confuse them with the cleanup helper's byte 31.

Seven fixtures record exact formatter-70458 argument words. The following trap **17**, encoded CALL target **-18**, receives signed recipient index `(object - 34091368) / 880`. Aligned fixture objects verify recipient slot 3 and sender echo slot 2. Its command pointer is **zero only because the evaluator supplies a placeholder formatter return**; no formatted command, string escaping, actual NULL send or rendered output is established.

## DEL-003: explicit recipient echo and slot fanout

The explicit-recipient tail first calls delivery helper 186721 with the recipient and prefix at local 196. Sender-to-self receives one call. A different recipient receives a second call toward the sender, using prefix local 264, unless **sender object offset 424 AND 8** is nonzero. The fixtures yield call counts 1/2/1 for self / other with zero flags / other with bit 8. The bit's full field identity and every flag mutation remain open.

The fanout tail visits `34091368 + i * 880` for indices below signed count global **34992524**, calling 186721 per visited slot. Count-zero and count-three fixtures record zero/three delivery calls. With cleanup local 192 zero, text pointer is local 40. With it nonzero, helper 70241 is called **per iteration**, and its placeholder zero return is forwarded to delivery. These observations do not establish effective recipients: each recorded delivery callee can reject through its own gates. Count lifetime, ownership, real cleanup mutation, reliable queues and client rendering remain incomplete.

## Remaining work

RE-265–267 record these bounded milestones. RE-264 stays open for the complete chat contract; RE-268 adds specific follow-ups: text-expansion helper 186435 and key lookup 185212, all raw flag/global writers, prefix construction/copy/escaping, private-message callers and client command consumption, plus original-runtime and macOS/Linux comparison fixtures. Rust/Bevy behavior should be specified from these predicates while retaining the unresolved field identities and output contracts as explicit dependencies.

The [EXP-001–003 follow-up](CHAT_EXPANSION.md) recovers parser states, key comparisons and health/momo branches. Full text-expansion/copy/output behavior remains open under RE-268/272.