fix(chat): Campaign CH user-gate round 2 -- portal notice rerouted to SpewBox, verbatim /help extraction, jump-in-air evidence

Item 2: retail's portal-space "In Portal Space..." notice is the SpewBox
(ECM_UI::SendNotice_DisplayStringInfo(0x1A,...) -> AddTextToScroll(str,
0x1A, 1, 0), hardcoded to the SpewBox per the decomp), not a dedicated
centered overlay. PortalWaitNoticeController and its lease are deleted;
PortalTunnelPresentation's per-rotation-segment cadence now writes
straight into RuntimeCommunicationState.AddText(ClientLocal) -- the
SpewBox's own dedupe-at-index-0 handles the repetition exactly as
retail's does. Register row AP-184 records the surface fix and the AP-178
scope extension.

Items 4+5: /help text was partially fabricated -- the user caught the
"/help death" meta-message. Generalized
tools/pdb-extract/sweep_weenie_strings.py to decode narrow
PStringBase<char> literals (the ClientCommunicationSystem::Help* family's
shape) alongside its original UTF-16LE support, then swept every
HelpXxxGroup function's exact byte extent against the PDB-paired
acclient.exe. 4 of 7 group topics (death/status/text/allegiances) are now
complete verbatim listings; the other 3 (channels/chatting/commands) keep
an honest UNVERIFIED note citing HelpStupidChannelHack @0x0056f290 (a
genuinely undecodable BN-mislabeled-fragment mechanism) instead of the
old fabricated sentinel. 7 of ~35 channel one-liners are also now
verbatim. ISSUES.md #364 tracks the remainder;
RetailCommandHelpTableTests.cs pins every result byte-exact.

Item 1: jump-in-air refusal still silent live is NOT reproduced and NOT
speculatively fixed. Exhaustive static re-audit found the mechanism
correct by construction (single-writer OnWalkable, exactly-once-per-frame
Update()/Capture(), no interfering edge-history resets). A live headless
repro (new jump-probe bot policy, real ACE connect) was blocked --
probeaccount2 has no character, and the graphical client already owned
testaccount this session so the task's own fallback rule forbade using
it. Two temporary probes are left behind ACDREAM_PROBE_JUMP=1 (blocked
entirely in Headless by the existing multi-session static-state guard --
graphical-only for the next round).

Item 3 confirmed fixed, no regression. Item 6 (resize: no diagonal
cursors, cannot grow Y from bottom-right) folded into CH6a's existing
scope.

Full Release suite: 12,267 passed / 4 skipped / 0 failed (up from
12,221/4/0).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/ISSUES.md

@@ -121,6 +121,38 @@ than a REJECT-review fix batch; CH5-or-later.
 **Campaign:** `docs/plans/2026-08-09-chat-parity-campaign.md` (Campaign CH,
 CH4 REJECT-review).
 
+## #364 — Three `/help` group topics still partial: HelpStupidChannelHack unresolved
+
+**Status:** OPEN — filed 2026-08-09, Campaign CH user-gate round 2, item 3.
+The user caught `/help death` printing an acdream meta-message instead of
+retail's real listing; all 7 `ClientCommunicationSystem::HelpXxxGroup`
+nodes were re-extracted verbatim from the PDB-paired binary via a
+generalized `tools/pdb-extract/sweep_weenie_strings.py --ascii-only`.
+4 of 7 (death/status/text/allegiances) are now COMPLETE verbatim listings
+(`RetailCommandHelpTable.DeathGroupDetail` etc.). 3 remain PARTIAL
+(`ChannelsGroupDetail`, `ChattingGroupDetail`, `CommandsGroupDetail`):
+their detail text is built (in full or in part) by
+`ClientCommunicationSystem::HelpStupidChannelHack @0x0056f290`, which
+constructs its output from three string fragments Binary Ninja
+mis-attributes to unrelated vtable slots (the classic BN pooled/
+mislabeled-data artifact — `&ClientCommunicationSystem::\`vftable'.
+RecvNotice_StartBarberNotice` etc. are NOT real vtable dispatch)
+concatenated around a live `ChannelSystem::GetChannelName` call —
+genuinely not decodable from a static string sweep. Each partial group
+keeps its own summary line (fully verbatim) and an explicit UNVERIFIED
+note citing the address; `chatting` additionally resolves 7 of its 8
+detail entries (only the 5 HelpStupidChannelHack-delegated channel-alias
+lines are missing). The same mechanism also blocks 5 of ~35 channel
+one-liners in `ByVerb` (fellowship/monarch/patron/vassals/covassal
+family), which stay acdream-authored summaries. Resolving
+HelpStupidChannelHack requires reading the three mislabeled string
+fragments directly out of `.rdata` by address (not by BN symbol name) and
+confirming the channel-name substring logic — a focused follow-up, not
+guessed.
+
+**Campaign:** `docs/plans/2026-08-09-chat-parity-campaign.md` (Campaign CH,
+user gate round 2).
+
 ## Note — six invented chat verbs removed for registry parity (2026-08-09)
 
 Campaign CH slice CH4 deleted `/gen`, `/cv`, `/lookingforgroup`, `/tr`,