# Team-leader and location lookup paths

Static pass, 2026-10-11. Reproduce with `python3 scripts/analyze_chat_locations.py`; check with `python3 scripts/test_chat_locations.py`. [Generated evidence](chat-locations.json) retains verified qagame partitions, leader/cache/format/list traces, literal reference windows and file-backed spatial constants. Original processes/full QVMs do not execute. Recorded callees have zero placeholder returns; isolated leader/location returns are supplied inputs. Floating-point geometry, box/visibility engine services and real formatting are not evaluated. This extends the [substitution key inventory](CHAT_EXPANSION.md).

## LOC-001: first matching team leader

Helper **169397** scans indices from zero while index is signed less than count global **34992524**. Its record address is **global 34992496 + index * 6336**. It returns the first index with all three raw predicates:

- Record offset **468 !=0**.
- Record offset **3096 == requested team**.
- Record offset **3124 !=0**.

If no record matches, it returns **-1**. Zero/negative synthetic counts make no record reads. Both record states 1 and 2 can match; this is broader than delivery's required recipient state 2. A negative leader-flag word also satisfies the nonzero test. The fixtures cover skipped disconnected/wrong-team/unflagged records and multiple matches to verify first-match selection, without assigning complete state/role lifecycles.

The `leader` substitution passes sender-record field 3096 into this helper. A supplied -1 result skips the name formatter, retaining the lookup's previously requested `unknown` default. Other observed results load the record pointer at **34091888 + slot * 880**, add **504**, and request `%s` into shared buffer 35738436 with capacity 150. Slot 0/2 slices verify that address chain. The helper call, initial default and formatting are not composed/executed here, so no actual no-leader screen text or bounds invariant is established.

Literal-reference windows show helper 169397 in multiple containing functions, including chat lookup 185212. They do not cover computed calls, aliased references or every flag writer.

## LOC-002: cached location and formatting wrapper

Helper **268248** first reads object offset **848**. A nonzero pointer returns immediately only if signed global time **34992532 < pointed-object field 596**. NULL, equality or later time proceeds to spatial lookup. Synthetic cases cover those boundaries and a signed-wrap comparison; they do not establish a safe wrap-aware expiry contract. No cache refresh/store appears in the retained function, so the producers of fields 848/596 remain essential follow-ups.

Wrapper **268637** calls 268248 and returns zero if lookup returns NULL. That failure path makes no formatting call and no direct buffer write in its slice. A nonzero lookup result loads its word at offset **592**, requests formatter 70386 with caller buffer/capacity and template `%s`, then returns **1**. The isolated success fixture uses capacity 150, text pointer 0x60000 and destination 0x70000. Success here is a return convention, not proof of a valid source string or successful bounded formatting.

The `location` substitution forwards sender/shared buffer/capacity 150 to this wrapper. Crosshair branches and team-chat prefix construction also reference it. Failure handling/default text and output preservation must be recovered for every caller before a Rust API contract is complete.

## LOC-003: registration, list order and static spatial search

List-builder **264976** is guarded by nonzero global **34999636**. Its unguarded path sets that guard to 1, clears head/count globals **34999640/34999644**, and requests trap **18** (encoded -19) to set configstring **640** to literal **`unknown`**. It visits stride-880 objects beginning at **34091368** while its signed index is below entity count global **34992508**.

Each object qualifies only if offset **536** is nonzero and raw word **540 ==8489281**. This pass does not assign the raw tag a complete class/hash identity. A qualifying object:

1. Increments global 34999644 and stores that one-based number at object offset **684**.
2. Requests configstring **640 + number** from its string pointer at object offset **592**.
3. Writes the old list head through ***(object + 524) +24**, then makes the object the new head.

The three-object fixture publishes indices 641/642/643 in scan order and links head object 2 -> object 1 -> object 0 -> NULL. Filtering fixtures independently exclude zero field 536 and wrong field 540. The guarded path performs no reset/publication. Guard reset, entity-count capacity, NULL field-524 handling, configstring bounds, map restart and linked-object ownership remain open.

The retained spatial helper shows two search stages after a cache miss:

- It copies position words at object offsets **488/492/496**, forms a query box by subtracting/adding file-backed **40.0/40.0/52.0** extents at VM addresses 31128/31132/31136, and calls encoded service **-33** with four arguments including local result array and maximum **1024**. Its returned indices become `34091368 + index * 880`. It compares object offset 536 against **`trigger_location`** through ASCII comparator 69386 and returns the first match in the supplied engine order.
- If that stage finds no match, it traverses head 34999640 via the same `*(object+524)+24` links. The code calculates squared coordinate distance, starting with raw float bits **1296039936** (201326592.0) as the limit. Candidate distance **<= current best** reaches encoded service **-27** with two position pointers; a nonzero return updates both best distance and selected object. Equal-distance candidates therefore may replace an earlier selected object. End-of-list returns the selected pointer, initially NULL.

The [pinned ABI candidate report](qvm/qagame.abi-candidates.json), checked against the same qagame hash, labels service numbers 32/26 as **G_ENTITIES_IN_BOX/G_IN_PVS** and 18 as **G_SET_CONFIGSTRING**. Those are upstream candidates, not new proof of all shipped native argument/layout semantics. Float execution, engine ordering, portals, collision bounds and native platform correspondence remain unverified. The synthetic list and cache traces do not execute either spatial stage.

## Remaining work and Rust dependencies

RE-277–279 record these bounded/static milestones; RE-272 remains open for full substitution behavior. RE-280 tracks leader-flag/state writers, count/slot invariants, caller failure/default behavior, cache writers/expiry/reset, raw class tag derivation, linked-field ownership, full floating-point/box/PVS selection, configstring clients and original-runtime/platform fixtures. Rust location lookup needs explicit cache/ordering/tie rules and ownership backed by that evidence; a generic nearest-point search would not reproduce the observed two-stage control flow by itself.

The [AIM-001–003 follow-up](CHAT_CROSSHAIR.md) recovers the crosshair caller's geometry/trace/result routes. Full spatial services, caller output and runtime behavior remain open under RE-280/284.

The [NAT-001–003 follow-up](NATIVE_SPATIAL.md) confirms the shipped Linux ELF64 sinf/cosf and trace/PVS/area-query destinations and recovers VM-pointer/native spatial evidence. Earlier upstream-candidate limitations are narrowed for those mappings; full layout/geometry/runtime and other-platform parity remain open under RE-284/288.