erik/acdream
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(chat): CH2 rework — SpewBox tick-driven visibility + binary-derived error table

Browse source 
Reworks Campaign CH slice CH2 per the REJECT-review findings doc
(docs/research/2026-08-09-ch2-review-findings.md).

BLOCKER 1 — SpewBoxController never rendered a line and leaked its
pending queue. LinesProvider only ran through UiText.OnDraw, which
gates on Visible — and the box started invisible, so the provider (the
sole caller of SpewBoxState.Tick) never ran. Gave the controller an
explicit per-frame Tick(now) driven by UiRoot's global-message-3
broadcast (a zero-size GlobalTimeSink child, the same pattern
VendorUiController.DragOverGlobalTimeSink already uses), matching
retail's gmSpewBoxUI::Update. LinesProvider now only returns the
cache. Tests rewritten to drive root.Tick(...) instead of calling the
provider directly, plus new coverage for visibility-without-a-draw,
queue-drain-without-a-draw, and bounded-queue-across-many-ticks.

BLOCKER 2 — re-derived the HandleFailureEvent routing table from the
PDB-paired binary instead of the pseudo-C's ~33-char string previews.
tools/pdb-extract/sweep_weenie_strings.py sweeps every push imm32 in
VA 0x571990-0x575480, dereferences into .rdata/.data, and decodes the
full UTF-16LE literal. Added the 5 ids dispatched via else-if (missed
by case-label enumeration), resolved 0x4F8 (previously excluded),
fixed 18 wrong strings (16 the review flagged + 2 more — 0x4E9 and
0x518 — an automated diff between every swept literal and the landed
table found). Every changed row cross-checked against ACE's
WeenieError/WeenieErrorWithString enum doc comments; both oracles
agreed on every row, including a case where the review's own proposed
text for the new 0x4E8 row was itself wrong (it was 0x4E9's text) —
corrected via the else-if block's own instruction address plus the ACE
cross-check. Pinned table count: 344 (338 + 5 + 0x4F8).

SHOULD-FIX 1 — RuntimeCommunicationState.ResetSpewBox was dead code;
folded into the ChatIdentity generation-reset stage (same lifetime
boundary), with a reset assertion added to the existing populated-reset
test.

SHOULD-FIX 2 — AddText trimmed only the trailing end and invented an
empty-string early return; retail's AddTextToScroll trims both ends
(trim(&str, 1, 1, ws)) and has no empty guard. Both retired.

SHOULD-FIX 3 — ShowWeenieError bypassed the AddText chokepoint via
ChatLog.OnWeenieError (hardcoded LogTextType 0x00); routed through
Communication.AddText(Resolve(code, param)) instead, and
ChatLog.OnWeenieError is deleted — GameEventWiring's legacy no-router
fallback now resolves + calls OnSystemMessage directly.

SHOULD-FIX 4 — retail's HandleFailureEvent switch has no default case;
an unmapped id now resolves to a null Text (silence toward the
player) instead of the invented "WeenieError 0xNNNN" hex fallback,
with a diagnostics-only console log line for the id.

NITs — AP-TBD placeholders corrected to their real register rows
(AP-178, not the unrelated AP-177 lifetime row); filed AP-180 for the
windowId dual-destination gap and corrected three stale "lands with
CH2" comments; extended SpewBoxLayoutDumpDiagnostic from dats.Portal
to dats.Local and found the SpewBox element for real — LayoutDesc
0x21000011, element 0x10000048, size 450x72, MaxConcurrentItems
(ListBox property 0x10000028) = 4, not retail's code default of 1.
AP-178 narrowed accordingly; SpewBoxState.MaxConcurrentItems and
SpewBoxController's extent/anchor/OneLine are now authored rather than
placeholder (absolute screen position and colour remain open); fixed
the "19 ids... lists 18" miscount by retiring the stale paragraph in
the class doc rewrite; aligned the UseDone handler's silent-status
check with the other two WeenieError handlers.

Full Release suite: 11,914 passed / 4 skipped / 0 failed (build 0
errors).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Erik 2026-08-09 18:14:08 +02:00
parent b3ba4c6663
commit e0e7888308
22 changed files with 1164 additions and 336 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/architecture/retail-divergence-register.md
View file

File diff suppressed because one or more lines are too long

9
docs/plans/2026-08-09-chat-parity-campaign.md
View file

@ -1,9 +1,10 @@
# Campaign CH — chat & interface-text retail parity
**Status:** ACTIVE 2026-08-09 — CH1 complete (implementation `172c6f9a` +
review fixes `34d8a3c0`); CH2 code-complete (`77c8296e`), pending the
in-client user gate (jump-in-air / jump-loaded refusals showing on-screen,
not in chat).
review fixes `34d8a3c0`); CH2 code-complete (`77c8296e`), REJECT-reviewed
(`docs/research/2026-08-09-ch2-review-findings.md`) and reworked
(`9a6fee6e`), pending the in-client user gate (jump-in-air / jump-loaded
refusals showing on-screen, not in chat).
**Why now:** first track of the alpha-release program (chat is the most
visible daily surface for the friend-alpha). User-directed 2026-08-09.
@ -102,7 +103,7 @@ implementer per slice against a pinned contract (per
|---|---|---|---|---|
| R1–R4 research | `see docs/research/2026-08-09-chat-retail-*` | — | — | — |
| CH1 colors | `172c6f9a` | 11,835 passed / 4 skipped / 0 failed | APPROVE-WITH-FIXES; fixed `34d8a3c0` | pending |
| CH2 interface text | `77c8296e` | 11,890 passed / 4 skipped / 0 failed | REJECT (`docs/research/2026-08-09-ch2-review-findings.md`); rework in progress | pending |
| CH2 interface text | `77c8296e`, reworked `9a6fee6e` | 11,914 passed / 4 skipped / 0 failed | REJECT; reworked `9a6fee6e` (`docs/research/2026-08-09-ch2-review-findings.md`) | pending |
| CH3 side channels | — | — | — | — |
| CH4 commands | — | — | — | — |
| CH5 closeout | — | — | — | — |

29
src/AcDream.App/Net/LiveSessionRuntimeFactory.cs
View file

@ -332,13 +332,34 @@ internal sealed class LiveSessionRuntimeFactory
// Default, NOT 0x1A (corrected 2026-08-09, Opus review of
// 172c6f9a). Retail types command output like @version/@loc
// green; 0x1A (bright red) is reserved for genuine refusals.
// The refusal-vs-informational split lands with CH2's producer
// rewiring (SpewBox routing) — see
// docs/research/2026-08-09-chat-retail-interface-text.md §7.2.
//
// Comment corrected 2026-08-09, CH2 REJECT-review rework
// (NIT 2, docs/research/2026-08-09-ch2-review-findings.md):
// CH2's SpewBox routing covers WeenieError/WeenieErrorWithString
// ids (see ShowWeenieError below), which carry their own
// resolved RetailLogTextType — it did NOT reach this sink,
// which takes plain pre-formatted text with no error code
// attached. Per-call-site refusal-vs-informational
// classification of this sink's callers, plus retail's
// windowId dual-destination echo (register row AP-180), remain
// unstarted — CH4/CH5 scope at the earliest, not CH2.
ShowSystemMessage:
text => _domain.Communication.Chat.OnSystemMessage(text, 0x00u),
// SHOULD-FIX 3 (docs/research/2026-08-09-ch2-review-findings.md):
// route through the AddText chokepoint instead of the deleted
// ChatLog.OnWeenieError, which hardcoded LogTextType 0x00 —
// several ShowWeenieError call sites (e.g. 0x0561, the friends-
// list-full refusal) resolve to ClientLocal and belong in the
// SpewBox, not green in chat. An id WeenieErrorMessages has no
// row for resolves to a null Text — retail's switch has no
// default case, so it produces no player-facing text.
ShowWeenieError:
code => _domain.Communication.Chat.OnWeenieError(code, null),
code =>
{
(string? text, RetailLogTextType type) = WeenieErrorMessages.Resolve(code, null);
if (text is not null)
_domain.Communication.AddText(text, type);
},
PlayerPublicWeenieBitfield: () =>
_domain.EntityObjects.Objects.Get(_player.Identity.ServerGuid)?
.PublicWeenieBitfield,

177
src/AcDream.App/UI/SpewBoxController.cs
View file

@ -10,37 +10,98 @@ namespace AcDream.App.UI;
/// <c>ClickThrough</c> <see cref="UiText"/> block at a high
/// <see cref="UiElement.ZOrder"/>. Unlike that controller's single
/// overwrite-only slot, this reads <see cref="SpewBoxVM"/>'s bounded,
/// newest-on-top, per-entry-expiring queue every frame — the retained UI
/// tree has no separate per-frame "Update(dt)" hook, so
/// <see cref="UiText.LinesProvider"/> (already polled once per render pass)
/// doubles as this controller's tick source.
/// newest-on-top, per-entry-expiring queue every frame.
/// </summary>
/// <remarks>
/// <b>Position / font / colour / max-items are PLACEHOLDERS.</b> The task
/// C.7 LayoutDesc dump (<c>SpewBoxLayoutDumpDiagnostic</c>) was attempted
/// and completed EXHAUSTIVELY against the installed DAT's entire LayoutDesc
/// id range (<c>0x21000000</c>-<c>0x21000075</c>, 101 of 118 possible ids
/// populated, sanity-checked against 3 independently-known ids) and found
/// ZERO elements of class <c>0x10000016</c> anywhere — <c>gmSpewBoxUI</c> is
/// mounted directly from C++ code, not resolved from any authored
/// LayoutDesc tree, so its screen position/extent/font/colour and the
/// authored <c>MaxConcurrentItems</c> ListBox property are simply not
/// recoverable this way. See the divergence register rows this class cites
/// for each specific placeholder.
/// <b>CH2 REJECT-review rework, BLOCKER 1
/// (<c>docs/research/2026-08-09-ch2-review-findings.md</c>):</b> the
/// original landing drove the queue drain from
/// <see cref="UiText.LinesProvider"/>, which <c>UiText.OnDraw</c> only
/// calls when the element is ALREADY <c>Visible</c> — and the element
/// starts invisible, so the provider was never invoked, no line ever drew,
/// and <see cref="SpewBoxState"/>'s pending queue never drained (an
/// unbounded per-session leak). Retail's own <c>gmSpewBoxUI::Update</c>
/// drains off the UI tick (global message 3,
/// <c>UIElementManager::UseTime @0x0045CFD0</c>), not off drawing —
/// <see cref="GlobalTimeSink"/> reproduces that: it is a zero-size child
/// mounted alongside <see cref="_text"/> purely so <see cref="UiRoot"/>'s
/// per-frame <c>BroadcastGlobalUiTime</c> walk reaches it (the same
/// pattern <c>VendorUiController.DragOverGlobalTimeSink</c> uses for
/// <c>gmVendorUI::ListenToGlobalMessage</c>). <see cref="Tick"/> pulls
/// <see cref="SpewBoxVM.Lines"/>, caches the resulting lines, and sets
/// <see cref="_text"/>'s <c>Visible</c> flag; <see cref="UiText.LinesProvider"/>
/// now only ever returns the cache — it is polled by drawing, but no
/// longer double-duties as the tick source, so lines become visible and
/// the queue drains even across a frame where nothing gets drawn (headless,
/// a hidden window, or simply before the first render pass).
/// </remarks>
/// <remarks>
/// <b>Position / font / colour are still PLACEHOLDERS; extent and
/// max-items are now AUTHORED.</b> CH2 REJECT-review rework, NIT 3
/// (<c>docs/research/2026-08-09-ch2-review-findings.md</c>): the task C.7
/// LayoutDesc dump (<c>SpewBoxLayoutDumpDiagnostic</c>) originally searched
/// only <c>dats.Portal</c> — EXHAUSTIVELY, against the entire installed
/// LayoutDesc id range (<c>0x21000000</c>-<c>0x21000075</c>, 101 of 118
/// possible ids populated, sanity-checked against 3 independently-known
/// ids) — and found ZERO elements of class <c>0x10000016</c> there.
/// Extending the identical sweep to <c>dats.Local</c>
/// (<c>client_local_English.dat</c>) found it: LayoutDesc
/// <c>0x21000011</c>, element <c>0x10000048</c> (<c>gmSpewBoxUI</c>),
/// position <c>(0,0)</c> RELATIVE TO ITS PARENT (edge codes
/// <c>leftEdge=3/rightEdge=3</c> — <c>ElementReader.ToAnchors</c>'s own doc
/// comment names 3 as "centered", a mode that projection cannot represent;
/// <c>topEdge=1</c> — top-anchored per that same helper), size
/// <c>450×72</c>, one child (ListBox <c>0x10000049</c>, matching
/// <c>gmSpewBoxUI::PostInit</c>'s <c>GetChildRecursive(0x10000049)</c>
/// verbatim) carrying <c>MaxConcurrentItems</c> (property
/// <c>0x10000028</c>) = <c>4</c>, not retail's code-default <c>1</c>. The
/// PARENT this element mounts under (and therefore the ABSOLUTE screen
/// position) is still unresolved — <c>(0,0)</c> is parent-relative, and the
/// parent is presumably assigned by the same C++ code the research doc's
/// §1.1 describes, not by another LayoutDesc this sweep can walk to. See
/// the divergence register rows this class cites for each remaining
/// placeholder.
/// </remarks>
internal sealed class SpewBoxController : IDisposable
{
/// <summary>
/// Register row AP-TBD (position/extent): retail's authored screen
/// position for the SpewBox host is unknown (see class remarks); this
/// centered-top placement is acdream's own choice, not a retail value.
/// Register row AP-178 (screen position): retail's authored ABSOLUTE
/// screen position is still unknown — the LayoutDesc dump (see class
/// remarks) recovered the element's position as <c>(0,0)</c> relative
/// to a PARENT this sweep could not identify, so this centered-top
/// placement remains acdream's own choice, not a resolved retail value.
/// (The SIBLING row AP-177 — the invented line-lifetime timeout — lives
/// in <see cref="SpewBoxState.DefaultLifetime"/>'s own doc comment, not
/// here; this controller does not own that concern.)
/// </summary>
private const float TopOffset = 60f;
private const float BoxHeight = 40f;
/// <summary>
/// Register row AP-TBD (colour): the chat colour table's <c>0x1A</c>
/// entry (<c>colorBrightRed</c>) is explicitly NOT this — retail's own
/// Register row AP-178 (extent): AUTHORED, not a placeholder — the
/// LayoutDesc dump (see class remarks) found the SpewBox element sized
/// <c>450×72</c> in <c>dats.Local</c>. Retail's own edge codes
/// (<c>leftEdge=3</c>/<c>rightEdge=3</c>, "centered" per
/// <c>ElementReader.ToAnchors</c>'s doc comment) mean the box is a
/// FIXED-width block horizontally centered in its parent, not a
/// full-viewport stretch — the constructor below anchors it that way
/// (a one-time centered <see cref="UiText.Left"/> computed against
/// <see cref="UiRoot.Width"/>, <see cref="AnchorEdges.Top"/> only) since
/// <see cref="AnchorEdges"/> has no "centered, fixed-width" flag
/// combination to express retail's mode 3 directly.
/// </summary>
private const float SpewBoxWidth = 450f;
private const float SpewBoxHeight = 72f;
/// <summary>
/// Register row AP-178 (colour): retail's authored colour for THIS
/// element remains unresolved — the LayoutDesc dump (see class remarks)
/// found only two direct-state properties on the SpewBox element/ListBox
/// (a bool at <c>0x3B</c> and the <c>MaxConcurrentItems</c> integer at
/// <c>0x10000028</c>); no colour property surfaced in that direct-state
/// dump, and the per-<c>UIStateId</c> <c>States</c> dictionary (hover/
/// pressed/etc. variants, which could carry it) was not walked this
/// pass. The chat colour table's <c>0x1A</c> entry
/// (<c>colorBrightRed</c>) is explicitly NOT this — retail's own
/// <c>BuildChatColorLookupTable</c> writes to <c>ChatInterface::m_chatLog</c>,
/// a completely different element tree the SpewBox never touches
/// (research doc §3.2.3). This warm-yellow placeholder follows the
@ -53,6 +114,8 @@ internal sealed class SpewBoxController : IDisposable
private readonly UiRoot _root;
private readonly UiText _text;
private readonly SpewBoxVM _vm;
private readonly GlobalTimeSink _timeSink;
private UiText.Line[] _lines = Array.Empty<UiText.Line>();
private bool _disposed;
public SpewBoxController(UiRoot root, SpewBoxVM vm)
@ -62,43 +125,63 @@ internal sealed class SpewBoxController : IDisposable
_text = new UiText
{
Name = "SpewBox",
Left = 0f,
// Centered fixed-width block (retail's "mode 3" edge code on
// both left and right) — see the AP-178 extent comment above.
Left = (root.Width - SpewBoxWidth) / 2f,
Top = TopOffset,
Width = root.Width,
Height = BoxHeight,
Anchors = AnchorEdges.Left | AnchorEdges.Top | AnchorEdges.Right,
Width = SpewBoxWidth,
Height = SpewBoxHeight,
Anchors = AnchorEdges.Top,
Centered = true,
OneLine = true,
// AUTHORED MaxConcurrentItems is 4, not retail's code-default 1
// (see SpewBoxState.MaxConcurrentItems) — OneLine=true would
// silently collapse the box back down to showing only the
// newest of up to 4 concurrent lines.
OneLine = false,
ClickThrough = true,
ZOrder = int.MaxValue,
DefaultColor = SpewBoxColor,
Visible = false,
};
_text.LinesProvider = ComputeLines;
_text.LinesProvider = () => _lines;
_root.AddChild(_text);
_timeSink = new GlobalTimeSink(Tick);
_root.AddChild(_timeSink);
}
/// <summary>
/// Polled once per render pass by <see cref="UiText"/> — this IS the
/// SpewBox's per-frame tick (drains <c>SpewBoxState</c>'s pending queue
/// and prunes expired entries; see <see cref="SpewBoxVM.Lines"/>).
/// <see cref="SpewBoxVM.Lines"/> returns newest-first, matching retail's
/// <c>InsertItem(item, 0)</c>; <c>OneLine</c> mode only ever draws
/// index 0, so with retail's code-default
/// <c>MaxConcurrentItems == 1</c> this always shows the current line.
/// The SpewBox's per-frame tick, driven by <see cref="UiRoot"/>'s
/// global-message-3 broadcast via <see cref="GlobalTimeSink"/> — the
/// direct analogue of <c>gmSpewBoxUI::Update</c>. Drains
/// <see cref="SpewBoxState"/>'s pending queue and prunes expired
/// entries (see <see cref="SpewBoxVM.Lines"/>), caches the resulting
/// display lines, and sets <see cref="_text"/>'s visibility. Runs
/// whether or not a draw pass follows.
/// </summary>
private IReadOnlyList<UiText.Line> ComputeLines()
/// <param name="nowSeconds">
/// <see cref="UiRoot"/>'s own per-frame clock — <b>not</b>
/// <c>Environment.TickCount64</c> — matching every other
/// <see cref="IUiGlobalTimeListener"/> consumer's time source.
/// </param>
private void Tick(double nowSeconds)
{
double nowSeconds = Environment.TickCount64 / 1000.0;
// SpewBoxVM.Lines returns newest-first, matching retail's
// InsertItem(item, 0) — with OneLine now false and the AUTHORED
// MaxConcurrentItems == 4 (see SpewBoxState.MaxConcurrentItems),
// up to 4 lines render, newest on top.
IReadOnlyList<SpewBoxLine> lines = _vm.Lines(nowSeconds);
_text.Visible = lines.Count > 0;
if (lines.Count == 0)
return Array.Empty<UiText.Line>();
{
_lines = Array.Empty<UiText.Line>();
return;
}
var result = new UiText.Line[lines.Count];
for (int i = 0; i < lines.Count; i++)
result[i] = new UiText.Line(lines[i].Text, SpewBoxColor);
return result;
_lines = result;
}
public void Dispose()
@ -107,6 +190,24 @@ internal sealed class SpewBoxController : IDisposable
return;
_root.RemoveChild(_text);
_root.RemoveChild(_timeSink);
_disposed = true;
}
/// <summary>
/// A runtime-only, zero-size, always-invisible-to-hit-testing helper
/// that opts this controller into retail's global UI message 3 — see
/// the class remarks and <c>VendorUiController.DragOverGlobalTimeSink</c>
/// for the identical pattern. <see cref="SpewBoxController"/> is not
/// itself a <see cref="UiElement"/> (it wraps one), so it cannot
/// directly implement <see cref="IUiGlobalTimeListener"/> the way
/// <see cref="UiButton"/> does — <see cref="UiRoot.Tick"/>'s broadcast
/// walks the ELEMENT tree, not arbitrary controllers.
/// </summary>
private sealed class GlobalTimeSink : UiElement, IUiGlobalTimeListener
{
private readonly Action<double> _onGlobalUiTime;
public GlobalTimeSink(Action<double> onGlobalUiTime) => _onGlobalUiTime = onGlobalUiTime;
public void OnGlobalUiTime(double nowSeconds) => _onGlobalUiTime(nowSeconds);
}
}

64
src/AcDream.Core.Net/GameEventWiring.cs
View file

@ -248,39 +248,53 @@ public static class GameEventWiring
// Campaign CH slice CH2: retail resolves BOTH the display text and
// the AddTextToScroll destination type from the SAME per-id switch
// (ClientCommunicationSystem::HandleFailureEvent @0x00571990 — see
// WeenieErrorMessages' full 338-row port). When a router is wired
// WeenieErrorMessages' full 344-row port). When a router is wired
// (the production path), the resolved type decides chat vs SpewBox;
// otherwise this falls back to the legacy chat-only path so callers
// that don't wire the router (older tests) keep their prior shape.
// otherwise this falls back to a direct chat append so callers that
// don't wire the router (older tests) keep a working, if
// SpewBox-less, path.
//
// REJECT-review rework (SHOULD-FIX 3/4,
// docs/research/2026-08-09-ch2-review-findings.md): the legacy
// fallback no longer routes through the deleted ChatLog.OnWeenieError
// (SHOULD-FIX 3 — that chokepoint bypass is retired everywhere, not
// just at the ShowWeenieError call site) and an unmapped id resolves
// to a null Text — retail's switch has no default case, so it
// produces NO text toward the player (SHOULD-FIX 4). Both branches
// below skip display for a null Text and log the raw id instead, so
// an unmapped code stays visible to US without ever reaching chat.
registrar.Register(GameEventType.WeenieError, e =>
{
var code = GameEvents.ParseWeenieError(e.Payload.Span);
if (code is null) return;
if (WeenieErrorMessages.IsSilentClientControlStatus(code.Value)) return;
var (text, type) = WeenieErrorMessages.Resolve(code.Value, null);
if (text is null)
{
Console.WriteLine($"[weenie-error] unmapped code=0x{code.Value:X4}");
return;
}
if (onInterfaceText is not null)
{
if (WeenieErrorMessages.IsSilentClientControlStatus(code.Value)) return;
var (text, type) = WeenieErrorMessages.Resolve(code.Value, null);
onInterfaceText(text, type);
}
else
{
chat.OnWeenieError(code.Value, param: null);
}
chat.OnSystemMessage(text, chatType: (uint)type);
});
registrar.Register(GameEventType.WeenieErrorWithString, e =>
{
var p = GameEvents.ParseWeenieErrorWithString(e.Payload.Span);
if (p is null) return;
if (WeenieErrorMessages.IsSilentClientControlStatus(p.Value.ErrorCode)) return;
var (text, type) = WeenieErrorMessages.Resolve(p.Value.ErrorCode, p.Value.Interpolation);
if (text is null)
{
Console.WriteLine(
$"[weenie-error] unmapped code=0x{p.Value.ErrorCode:X4} param={p.Value.Interpolation}");
return;
}
if (onInterfaceText is not null)
{
if (WeenieErrorMessages.IsSilentClientControlStatus(p.Value.ErrorCode)) return;
var (text, type) = WeenieErrorMessages.Resolve(p.Value.ErrorCode, p.Value.Interpolation);
onInterfaceText(text, type);
}
else
{
chat.OnWeenieError(p.Value.ErrorCode, p.Value.Interpolation);
}
chat.OnSystemMessage(text, chatType: (uint)type);
});
// ── Combat ────────────────────────────────────────────────
@ -590,11 +604,27 @@ public static class GameEventWiring
+ $"err={(err is null ? "n/a" : $"0x{err.Value:X4}")}");
}
if (err is null) return;
// Already the diagnostics-only log line SHOULD-FIX 4 asks for —
// it fires unconditionally, so an unmapped code below stays
// visible to US even though it produces no player-facing text.
Console.WriteLine($"[use-done] err=0x{err.Value:X4}");
onUseDone?.Invoke(err.Value);
if (err.Value == 0) return;
// NIT 6 (docs/research/2026-08-09-ch2-review-findings.md):
// aligned with the WeenieError/WeenieErrorWithString handlers
// above, which check this before resolving. Harmless either
// way today — 0x3B/0x3C have no HandleFailureEvent case, so
// WeenieErrorMessages.Resolve already returns a null Text for
// them — but an explicit early-out here is more direct than
// relying on that coincidence, and guards against a future
// table addition accidentally making one of these two
// resolvable when retail's own switch genuinely has no case
// for either.
if (WeenieErrorMessages.IsSilentClientControlStatus(err.Value)) return;
var (text, type) = WeenieErrorMessages.Resolve(err.Value, null);
if (text is null) return;
if (onInterfaceText is not null)
onInterfaceText(text, type);
else

53
src/AcDream.Core/Chat/ChatLog.cs
View file

@ -183,45 +183,20 @@ public sealed class ChatLog
});
}
/// <summary>WeenieError (0x028A) / WeenieErrorWithString (0x028B).</summary>
/// <remarks>
/// Phase I.5: previously-orphaned parser. The server fires this when a
/// game-logic action fails (e.g. "you don't have enough mana", "you
/// can't pick that up"). Routed as <see cref="ChatKind.System"/>; the
/// <c>ChannelId</c> field carries the WeenieError code so plugins can
/// filter or react. <paramref name="param"/> is the interpolated
/// substring (null for plain WeenieError, set for WeenieErrorWithString).
/// </remarks>
public void OnWeenieError(uint errorId, string? param)
{
if (WeenieErrorMessages.IsSilentClientControlStatus(errorId))
return;
// Phase I (post-launch fix): translate the wire code into the
// retail-faithful template via WeenieErrorMessages. Many codes
// are *informational* (e.g. 0x051B "You have entered the X
// channel.", 0x051D "Turbine Chat is enabled.") not errors;
// the old "WeenieError 0xNNNN" framing was misleading. Unknown
// codes still fall back to the raw "WeenieError 0xNNNN[: param]"
// form so nothing is silently lost. See
// WeenieErrorMessages.Format for the templates + lookup table.
string text = WeenieErrorMessages.Format(errorId, param);
Append(new ChatEntry(
Kind: ChatKind.System,
Sender: "",
Text: text,
SenderGuid: 0,
ChannelId: errorId)
{
// Retail's HandleFailureEvent @0x00571990 dispatches per ERROR
// CODE across an ~87-case switch, mostly AddTextToScroll(...,
// 0, ...) with a scattered handful at 0x1a (client-local red).
// A full per-code port is future work (register row AP-176);
// 0x00 (Default) matches the switch's majority behavior and is
// the safe baseline.
LogTextType = 0x00u,
});
}
// WeenieError (0x028A) / WeenieErrorWithString (0x028B) used to have a
// dedicated OnWeenieError entry point here (Phase I.5, hardcoded at
// LogTextType 0x00 pending register row AP-176). REJECT-review rework
// (SHOULD-FIX 3, docs/research/2026-08-09-ch2-review-findings.md):
// AP-176 retired at Campaign CH slice CH2 — WeenieErrorMessages.Resolve
// now resolves BOTH the display text AND the real per-code retail
// RetailLogTextType (chat vs SpewBox) from the full 344-row
// HandleFailureEvent port. Every producer of WeenieError text — the
// inbound GameEventWiring handlers AND the client-command
// ShowWeenieError sink — now resolves through WeenieErrorMessages and
// calls the AddText chokepoint (RuntimeCommunicationState.AddText /
// ChatLog.OnSystemMessage) directly instead of through a dedicated
// ChatLog method, so the single-fixed-color OnWeenieError entry point
// is deleted rather than kept as a second, narrower routing path.
/// <summary>
/// Channel broadcast — legacy <c>ChatChannel (0x0147)</c> or the

36
src/AcDream.Core/Chat/SpewBoxState.cs
View file

@ -35,21 +35,39 @@ public readonly record struct SpewBoxEntry(string Text, double ExpiresAtSeconds)
/// Retail decouples enqueue (<c>RecvNotice_DisplayFinalStringInfo
/// @0x004D60A0</c>, type-filtered to <c>0x1A</c> only) from display
/// (<c>Update @0x004D5DF0</c>, driven once per UI tick by global message
/// <c>3</c>) by exactly one frame. <see cref="Tick"/> reproduces that: it
/// drains whatever is pending into the visible list (applying retail's
/// dedupe-against-index-0 and <c>MaxConcurrentItems</c> overflow rules) and
/// prunes expired entries, all in the caller's own per-frame cadence.
/// <c>3</c>) — NOT by exactly one frame (fixed 2026-08-09, CH2 REJECT-review
/// rework NIT 5: the earlier wording overstated this). A message that
/// arrives just before the tick fires waits ~0 frames; one that arrives
/// just after waits nearly a full frame — retail's own gap is 0-1 frames,
/// bounded by tick cadence, not a fixed one-frame delay. <see cref="Tick"/>
/// reproduces the SAME-CALL shape: it drains whatever is pending into the
/// visible list (applying retail's dedupe-against-index-0 and
/// <c>MaxConcurrentItems</c> overflow rules) and prunes expired entries in
/// one call, so a caller invoking <see cref="Enqueue"/> then immediately
/// <see cref="Tick"/> and <see cref="Snapshot"/> in the same frame sees the
/// line SAME-frame — the decoupling only shows up when the caller's own
/// tick cadence spans multiple frames, exactly like retail's.
/// </para>
/// </summary>
public sealed class SpewBoxState
{
/// <summary>
/// Retail's own code default (<c>gmSpewBoxUI::PostInit @0x004D5AB0</c>)
/// when ListBox property <c>0x10000028</c> is absent or unreadable. The
/// shipped LayoutDesc's authored value was not resolved in this slice —
/// see the divergence register.
/// The shipped LayoutDesc's AUTHORED value — no longer a placeholder.
/// CH2 REJECT-review rework, NIT 3
/// (<c>docs/research/2026-08-09-ch2-review-findings.md</c>): the
/// original C.7 sweep only searched <c>dats.Portal</c>, which has no
/// <c>0x10000016</c> (gmSpewBoxUI) element anywhere; extending the same
/// sweep to <c>dats.Local</c> (<c>client_local_English.dat</c>) found
/// it — LayoutDesc <c>0x21000011</c>, element <c>0x10000048</c>, whose
/// sole child (ListBox <c>0x10000049</c>, matching
/// <c>gmSpewBoxUI::PostInit</c>'s <c>GetChildRecursive(0x10000049)</c>
/// call verbatim) carries ListBox property <c>0x10000028</c> = the
/// integer <c>4</c>. Retail's own code default
/// (<c>gmSpewBoxUI::PostInit @0x004D5AB0</c>), used only when this
/// property is absent or unreadable, was <c>1</c> — the shipped layout
/// overrides it with <c>4</c>.
/// </summary>
public const int MaxConcurrentItems = 1;
public const int MaxConcurrentItems = 4;
/// <summary>
/// Retail's own client never raises the expiry element message

260
src/AcDream.Core/Chat/WeenieErrorMessages.cs
View file

@ -13,58 +13,97 @@ namespace AcDream.Core.Chat;
/// (Sept 2013 EoR build), the 339-case switch that decides BOTH the display
/// string and the <c>AddTextToScroll</c> type argument for every
/// <c>WeenieError</c>/<c>WeenieErrorWithString</c> id retail's client knows
/// about. Transcribed from
/// about. Originally transcribed from
/// <c>docs/research/2026-08-09-chat-retail-interface-text.md</c> Appendix A
/// (itself read off the named retail decomp), with the following
/// corrections made directly against
/// <c>docs/research/named-retail/acclient_2013_pseudo_c.txt</c> rather than
/// trusting the appendix's markdown transcription wholesale:
/// (itself read off the named retail decomp's ~33-char inline string
/// previews).
/// </para>
///
/// <para>
/// <b>REJECT-review rework (2026-08-09, <c>docs/research/2026-08-09-ch2-review-findings.md</c>
/// BLOCKER 2):</b> the Appendix A transcription — "enumerate <c>case</c>
/// labels, read the truncated preview" — turned out to be structurally
/// unsound: it missed 5 ids dispatched via <c>else if (arg2 == N)</c> rather
/// than a <c>case</c> label, and it silently trusted several truncated
/// previews whose full text differs materially from the 33-char prefix.
/// This rework re-derives the table MECHANICALLY: a Python sweep
/// (<c>tools/pdb-extract/sweep_weenie_strings.py</c>) walks the PE section
/// table of the PDB-paired binary (<c>C:\Users\erikn\Downloads\acclient.exe</c>,
/// verified via <c>check_exe_pdb.py</c>) and every <c>push imm32</c>
/// (opcode <c>0x68</c>) operand in VA <c>0x571990</c>-<c>0x575480</c> that
/// dereferences into <c>.rdata</c>/<c>.data</c> is read as a UTF-16LE
/// literal to its NUL terminator — the FULL string, never the pseudo-C's
/// truncated preview. Every changed row was additionally cross-checked
/// against ACE's own <c>WeenieError.cs</c>/<c>WeenieErrorWithString.cs</c>
/// enum doc comments (<c>references/ACE/Source/ACE.Entity/Enum/</c>); the
/// two independent oracles agreed on every row.
/// </para>
///
/// <list type="bullet">
/// <item>7 ids the appendix marked "no literal — shared string global"
/// <item><b>5 ids added</b> that Appendix A missed entirely because they
/// dispatch via <c>else if (arg2 == N)</c> chains ABOVE the main switch,
/// not a <c>case</c> label: <c>0x04F</c> (Magic), <c>0x3EE</c>
/// (ClientLocal), <c>0x408</c> (ClientLocal), <c>0x48A</c> (Default),
/// <c>0x4E8</c> (Default). <c>0x43</c> remains correctly absent — its
/// only retail effect is <c>ClientCombatSystem::AbortAutomaticAttack</c>,
/// no display text.</item>
/// <item><b>18 existing rows corrected</b> — the swept binary literal
/// disagreed with the previously-landed text for
/// <c>0x051</c>/<c>0x053</c>/<c>0x054</c>/<c>0x466</c>/<c>0x4A3</c>/
/// <c>0x4B5</c>/<c>0x4E0</c>/<c>0x4E9</c>/<c>0x4F7</c>/<c>0x518</c>/
/// <c>0x544</c>/<c>0x54E</c>/<c>0x552</c>/<c>0x553</c>/<c>0x554</c>/
/// <c>0x555</c>/<c>0x57F</c>/<c>0x582</c>. Two of these (<c>0x4E9</c>,
/// <c>0x518</c>) were NOT in the review's own flagged list — they surfaced
/// from an automated diff between every swept literal and the landed
/// table, confirming the review's own "sweep may find more" prediction.
/// <c>0x4E9</c> is the sharpest case: the review's own findings doc
/// proposed the wrong text for the NEW <c>0x4E8</c> row (attributing
/// <c>0x4E9</c>'s genuine text to it) — the corrected mechanical anchor
/// (the <c>else if (arg2 == 0x4e8)</c> block's OWN instruction address,
/// not proximity to a neighboring <c>case</c> label in the printed
/// listing) plus the ACE cross-check together overrule that proposal:
/// <c>0x4E8</c> = "...and only the owner may open the hook.", <c>0x4E9</c>
/// = "...use the '@house hooks on' command to make the hook openable." —
/// the previously-landed table had them reversed (0x4E9 held 0x4E8's
/// text; 0x4E8 did not exist as a row at all).</item>
/// <item><c>0x4F8</c> now resolves for real (see below) — no id is
/// deliberately excluded any more. New pinned count: 344 rows
/// (338 landed + 5 added + <c>0x4F8</c>).</item>
/// <item>7 ids Appendix A marked "no literal — shared string global"
/// (<c>0x024</c>, <c>0x048</c>, <c>0x049</c>, <c>0x4DE</c>, <c>0x4DF</c>,
/// <c>0x55A</c>, <c>0x55E</c>) were resolved by reading the case bodies
/// directly: <c>0x024</c>/<c>0x048</c>/<c>0x049</c> reuse the same
/// <c>0x55A</c>, <c>0x55E</c>) remain resolved exactly as the prior pass
/// found: <c>0x024</c>/<c>0x048</c>/<c>0x049</c> reuse the same
/// process-lifetime globals as the local jump-refusal family (see
/// <see cref="ClientTextRefusals"/>); <c>0x4DE</c>/<c>0x4DF</c> are
/// <c>arg3 + "\n"</c>; <c>0x55A</c> is <c>sprintf("%s\n", arg3)</c>;
/// <c>0x55E</c> passes <c>arg3</c> straight through with no format string
/// at all.</item>
/// <item>Appendix A's markdown table trims leading whitespace from every
/// cell, which silently ate the leading <c>" "</c> retail's
/// <c>arg3 + literal</c> CONCATENATION sites (as opposed to a real
/// <c>sprintf("%s...")</c> site) depend on. 19 ids
/// (<c>0x02B</c>, <c>0x3EF</c>, <c>0x46A</c>, <c>0x4CE</c>, <c>0x4CF</c>,
/// <c>0x4F7</c>, <c>0x4F9</c>, <c>0x4FA</c>, <c>0x4FF</c>, <c>0x509</c>,
/// <c>0x50B</c>, <c>0x50C</c>, <c>0x50D</c>, <c>0x517</c>, <c>0x518</c>,
/// <c>0x51E</c>, <c>0x521</c>, <c>0x522</c>) were fixed by re-reading their
/// case bodies and prepending the <c>%s</c> the concatenation implies.
/// Several of these (and the <c>%s</c>-prefixed but truncated
/// <c>0x4F4</c>-<c>0x4F6</c>, <c>0x530</c>, <c>0x534</c>, <c>0x53E</c>,
/// <c>0x541</c>, <c>0x543</c>, <c>0x54B</c>, <c>0x562</c>, <c>0x56D</c>,
/// <c>0x57A</c>, <c>0x57B</c>, <c>0x580</c>) were also truncated by the
/// pseudo-C's ~33-char inline preview; the full text was recovered from a
/// SECOND, non-truncated <c>data_XXXXXXXX</c> dump elsewhere in the same
/// oracle file — reading the oracle again, not guessing.</item>
/// <item><c>0x4F4</c>'s retail literal is
/// <c>"%s fails to affect you because $s cannot affect anyone!"</c> —
/// note <c>$s</c>, not <c>%s</c>, for the second placeholder. That is a
/// genuine retail typo/bug (only the first <c>%s</c> substitutes; the
/// literal <c>$s</c> prints as-is) and is preserved verbatim rather than
/// corrected, per the "the client is probably right" rule.</item>
/// <item><c>0x4F7</c>'s retail string is itself incomplete — it
/// concatenates <c>arg3</c> with a literal that dangles on
/// <c>"...as "</c> with no closing word. Confirmed via exact byte-count
/// against the declared array size (not a display artifact); preserved
/// verbatim.</item>
/// <item><c>0x4F8</c> could not be resolved with confidence — its case
/// body is a tangled multi-<c>operator+</c> concatenation chain full of
/// decompiler self-referential artifacts (see
/// <c>claude-memory/feedback_bn_decomp_field_names.md</c>). Deliberately
/// EXCLUDED from the table rather than guessed; falls back to the generic
/// <c>WeenieError 0xNNNN[: param]</c> form like any other unmapped id.
/// </item>
/// corrected, per the "the client is probably right" rule. <c>0x04F</c>
/// preserves the same <c>$s</c> typo pattern.</item>
/// <item><c>0x4F7</c>'s retail string is a normal, COMPLETE
/// <c>arg3 + literal</c> concatenation — "%s fails to affect you because
/// you are not a player killer!" — with no dangling text. The prior
/// pass's class-doc claim that <c>0x4F7</c>'s literal "dangles" was a
/// misattribution of <c>0x4F8</c>'s FIRST operand (which does end
/// mid-clause, on "...as ", by design — see <c>0x4F8</c> below), not a
/// genuine truncation in <c>0x4F7</c> itself.</item>
/// <item><c>0x4F8</c> resolves cleanly once traced correctly: its case
/// body concatenates <c>arg3 + " fails to affect you because you are not
/// the same sort of player killer as " + arg3 + "!\n"</c> across three
/// <c>operator+</c> calls whose decompiled operand names are BN
/// self-referential artifacts (see
/// <c>claude-memory/feedback_bn_decomp_field_names.md</c>) — the sweep's
/// direct dereference of both literal data pointers
/// (<c>data_7d2ee8</c> = <c>" fails to affect you because you are not the
/// same sort of player killer as "</c>, <c>data_7d2f80</c> =
/// <c>"!\n"</c>) resolves the ambiguity without needing to trust the
/// confusing decompiler naming. Both <c>%s</c> placeholders take the SAME
/// parameter (retail only has one <c>arg3</c> to substitute twice).</item>
/// </list>
///
/// <para>
@ -106,16 +145,31 @@ public static class WeenieErrorMessages
/// <param name="errorCode">The wire error code.</param>
/// <param name="param">The interpolated substring (null for plain
/// <c>WeenieError</c>, set for <c>WeenieErrorWithString</c>).</param>
public static string Format(uint errorCode, string? param) => Resolve(errorCode, param).Text;
/// <returns>
/// The retail display text, or <see langword="null"/> for an id
/// <c>HandleFailureEvent</c>'s switch has no case for — see
/// <see cref="Resolve"/>.
/// </returns>
public static string? Format(uint errorCode, string? param) => Resolve(errorCode, param).Text;
/// <summary>
/// Resolve a WeenieError / WeenieErrorWithString code into its retail
/// display text AND the retail <see cref="RetailLogTextType"/> it routes
/// to. Unmapped codes fall back to the raw
/// <c>WeenieError 0xNNNN[: param]</c> form at
/// <see cref="RetailLogTextType.Default"/> so nothing is silently lost.
/// to.
/// </summary>
public static (string Text, RetailLogTextType Type) Resolve(uint errorCode, string? param)
/// <remarks>
/// CH2 REJECT-review rework, SHOULD-FIX 4
/// (<c>docs/research/2026-08-09-ch2-review-findings.md</c>): retail's
/// <c>HandleFailureEvent</c> switch has NO <c>default:</c> case — an id
/// it does not recognize produces NO text at all, silently, toward the
/// player. The prior pass's <c>WeenieError 0xNNNN[: param]</c> hex
/// fallback was acdream's own invention with no retail counterpart (an
/// unregistered divergence). Callers must treat a <see langword="null"/>
/// <c>Text</c> as "retail shows nothing here" and skip display entirely;
/// they should still log the raw id to a diagnostics-only sink so an
/// unmapped code is not silently invisible to US, only to the player.
/// </remarks>
public static (string? Text, RetailLogTextType Type) Resolve(uint errorCode, string? param)
{
if (Table.TryGetValue(errorCode, out Entry entry))
{
@ -125,17 +179,17 @@ public static class WeenieErrorMessages
return (text, entry.Type);
}
string fallback = string.IsNullOrEmpty(param)
? $"WeenieError 0x{errorCode:X4}"
: $"WeenieError 0x{errorCode:X4}: {param}";
return (fallback, RetailLogTextType.Default);
return (null, RetailLogTextType.Default);
}
/// <summary>
/// The full retail routing table, transcribed from
/// <c>ClientCommunicationSystem::HandleFailureEvent @0x00571990</c> (338
/// of its 339 cases — see the class doc comment for the one deliberate
/// exclusion and every correction made against the raw decomp).
/// <c>ClientCommunicationSystem::HandleFailureEvent @0x00571990</c> — 344
/// rows (338 landed at the prior pass + 5 ids the prior pass's
/// case-label enumeration missed + <c>0x4F8</c>, which now resolves for
/// real; every id the switch dispatches has a row here). See the class
/// doc comment for the binary-sweep + ACE cross-check methodology and
/// every correction made against it.
/// </summary>
private static readonly Dictionary<uint, Entry> Table = new()
{
@ -162,11 +216,20 @@ public static class WeenieErrorMessages
[0x04Au] = new("Ack! You killed yourself!", RetailLogTextType.Default),
[0x04Du] = new("Invalid PK status!", RetailLogTextType.ClientLocal),
[0x04Eu] = new("You fail to affect %s because you cannot affect anyone!", RetailLogTextType.Magic),
// 0x04F added — BLOCKER2: else-if dispatch (arg2 == 0x4f), missed by
// the prior case-label enumeration. Preserves retail's own $s typo,
// same pattern as 0x4F4.
[0x04Fu] = new("You fail to affect %s because $s cannot be harmed!", RetailLogTextType.Magic),
[0x050u] = new("You fail to affect %s because beneficial spells do not affect %s!", RetailLogTextType.Magic),
[0x051u] = new("You fail to affect %s because you cannot affect anyone!", RetailLogTextType.Magic),
// 0x051/0x053/0x054 corrected — BLOCKER2: the prior pass copied
// 0x04E's/0x053's template across all four "You fail to affect"
// Magic-family ids; each is in fact a DISTINCT retail literal.
[0x051u] = new("You fail to affect %s because you are not a player killer!", RetailLogTextType.Magic),
[0x052u] = new("You fail to affect %s because %s is not a player killer!", RetailLogTextType.Magic),
[0x053u] = new("You fail to affect %s because you cannot affect anyone!", RetailLogTextType.Magic),
[0x054u] = new("You fail to affect %s because you cannot affect anyone!", RetailLogTextType.Magic),
[0x053u] = new("You fail to affect %s because you are not the same sort of player killer as %s!", RetailLogTextType.Magic),
[0x054u] = new("You fail to affect %s because you are acting across a house boundary!", RetailLogTextType.Magic),
// 0x3EE added — BLOCKER2: else-if dispatch (arg2 == 0x3ee).
[0x3EEu] = new("The container is closed!", RetailLogTextType.ClientLocal),
[0x3EFu] = new("%s is not accepting gifts right now.", RetailLogTextType.Default),
[0x3F1u] = new("You failed to go to non-combat mode.", RetailLogTextType.ClientLocal),
[0x3F7u] = new("You are too fatigued to attack!", RetailLogTextType.ClientLocal),
@ -181,6 +244,10 @@ public static class WeenieErrorMessages
[0x403u] = new("Your spell's target is missing!", RetailLogTextType.ClientLocal),
[0x404u] = new("Your projectile spell mislaunched!", RetailLogTextType.ClientLocal),
[0x407u] = new("Your spell cannot be cast outside", RetailLogTextType.ClientLocal),
// 0x408 added — BLOCKER2: else-if dispatch (arg2 == 0x408), sibling
// of 0x407 above (both lack trailing punctuation in retail's own
// literal — not a display artifact).
[0x408u] = new("Your spell cannot be cast inside", RetailLogTextType.ClientLocal),
[0x40Au] = new("You are unprepared to cast a spell", RetailLogTextType.ClientLocal),
[0x40Bu] = new("You've already sworn your Allegiance", RetailLogTextType.ClientLocal),
[0x40Cu] = new("You don't have enough experience available to swear Allegiance", RetailLogTextType.ClientLocal),
@ -215,7 +282,10 @@ public static class WeenieErrorMessages
[0x45Du] = new("Non-player killers may not interact with that portal!", RetailLogTextType.Magic),
[0x45Eu] = new("You do not own a house!", RetailLogTextType.ClientLocal),
[0x45Fu] = new("You do not own a house!", RetailLogTextType.ClientLocal),
[0x466u] = new("You must purchase Asheron's Call -- Dark Majesty to use this function.", RetailLogTextType.Magic),
// 0x466 corrected — BLOCKER2: retail's colon-separated "Asheron's
// Call: Dark Majesty..." wording, distinct from the "--"-separated
// Throne of Destiny family at 0x552-0x555 below.
[0x466u] = new("You must purchase Asheron's Call: Dark Majesty to interact with that portal.", RetailLogTextType.Magic),
[0x469u] = new("You have used all the hooks you are allowed to use for this house.", RetailLogTextType.Default),
[0x46Au] = new("%s doesn't know what to do with that.", RetailLogTextType.Default),
[0x474u] = new("You must complete a quest to interact with that portal.", RetailLogTextType.Magic),
@ -225,6 +295,8 @@ public static class WeenieErrorMessages
[0x482u] = new("Your monarch has closed the mansion to the Allegiance.", RetailLogTextType.ClientLocal),
[0x488u] = new("You must be above level %s to purchase this dwelling.", RetailLogTextType.Default),
[0x489u] = new("You must be at or below level %s to purchase this dwelling.", RetailLogTextType.Default),
// 0x48A added — BLOCKER2: else-if dispatch (arg2 == 0x48a).
[0x48Au] = new("You must be a monarch to purchase this dwelling.", RetailLogTextType.Default),
[0x48Bu] = new("You must be above allegiance rank %s to purchase this dwelling.", RetailLogTextType.Default),
[0x48Cu] = new("You must be at or below allegiance rank %s to purchase this dwelling.", RetailLogTextType.Default),
[0x48Eu] = new("Your offer of Allegiance has been ignored.", RetailLogTextType.ClientLocal),
@ -248,7 +320,9 @@ public static class WeenieErrorMessages
[0x4A0u] = new("You fail to link with the portal!", RetailLogTextType.Magic),
[0x4A1u] = new("You successfully link with the portal!", RetailLogTextType.Magic),
[0x4A2u] = new("You fail to recall to the portal!", RetailLogTextType.Magic),
[0x4A3u] = new("You must have linked with a portal in order to summon it!", RetailLogTextType.Magic),
// 0x4A3 corrected — BLOCKER2: retail's real text is about RECALL,
// not summon (0x4A5 below is the genuine "summon it" sibling).
[0x4A3u] = new("You must have linked with a portal in order to recall to it!", RetailLogTextType.Magic),
[0x4A4u] = new("You fail to summon the portal!", RetailLogTextType.Magic),
[0x4A5u] = new("You must have linked with a portal in order to summon it!", RetailLogTextType.Magic),
[0x4A6u] = new("You fail to teleport!", RetailLogTextType.Magic),
@ -265,7 +339,9 @@ public static class WeenieErrorMessages
[0x4B2u] = new("The key doesn't fit this lock.", RetailLogTextType.Default),
[0x4B3u] = new("The lock has been used too recently.", RetailLogTextType.ClientLocal),
[0x4B4u] = new("You aren't trained in lockpicking!", RetailLogTextType.ClientLocal),
[0x4B5u] = new("You must specify a character to boot.", RetailLogTextType.ClientLocal),
// 0x4B5 corrected — BLOCKER2: distinct from 0x491's genuine "boot"
// wording (0x4B5 is the allegiance-query variant).
[0x4B5u] = new("You must specify a character to query.", RetailLogTextType.ClientLocal),
[0x4B6u] = new("Please use the allegiance panel to view your own information.", RetailLogTextType.ClientLocal),
[0x4B7u] = new("You have used that command too recently.", RetailLogTextType.ClientLocal),
[0x4B8u] = new("You do not own that salvage tool!", RetailLogTextType.Default),
@ -303,7 +379,12 @@ public static class WeenieErrorMessages
[0x4DDu] = new("You have failed to alter your attributes.", RetailLogTextType.Default),
[0x4DEu] = new("%s", RetailLogTextType.Default),
[0x4DFu] = new("%s", RetailLogTextType.Default),
[0x4E0u] = new("You are currently wielding items which require a certain level of %s. Your %s skill cannot be lowered while you are wielding these items. Please remove these items and try again.", RetailLogTextType.Default),
// 0x4E0 corrected — BLOCKER2: the prior pass copied 0x4D5's
// "skill cannot be lowered" template; retail's genuine 0x4E0 text is
// about ATTRIBUTES not transferring, a distinct sibling to 0x4DD
// ("failed to alter your attributes") and 0x4E1 ("succeeded in
// transferring your attributes!").
[0x4E0u] = new("You are currently wielding items which require a certain level of skill. Your attributes cannot be transferred while you are wielding these items. Please remove these items and try again.", RetailLogTextType.Default),
[0x4E1u] = new("You have succeeded in transferring your attributes!", RetailLogTextType.Default),
[0x4E2u] = new("This hook is a duplicated housing object. You may not add items to a duplicated housing object. Please empty the hook and allow it to reset.", RetailLogTextType.Default),
[0x4E3u] = new("That item is of the wrong type to be placed on this hook.", RetailLogTextType.Default),
@ -311,7 +392,15 @@ public static class WeenieErrorMessages
[0x4E5u] = new("This hook was a duplicated housing object. Since it is now empty, it will be deleted momentarily. Once it is gone, it is safe to use the other, non-duplicated hook that is here.", RetailLogTextType.Default),
[0x4E6u] = new("This chest was a duplicated housing object. Since it is now empty, it will be deleted momentarily. Once it is gone, it is safe to use the other, non-duplicated chest that is here.", RetailLogTextType.Default),
[0x4E7u] = new("You cannot swear allegiance to anyone because you own a monarch-only house. Please abandon your house and try again.", RetailLogTextType.Default),
[0x4E9u] = new("The %s cannot be used while on a hook and only the owner may open the hook.", RetailLogTextType.Default),
// 0x4E8 added — BLOCKER2: else-if dispatch (arg2 == 0x4e8), anchored
// on that branch's OWN instruction address (not proximity to a
// neighboring case label — see the class doc comment's 0x4E9 note).
[0x4E8u] = new("The %s cannot be used while on a hook and only the owner may open the hook.", RetailLogTextType.Default),
// 0x4E9 corrected — BLOCKER2: the prior pass gave this row 0x4E8's
// text (the two are easy to conflate — near-duplicate wording for
// adjacent ids). Confirmed against ACE's ItemUnusableOnHook_CanOpen
// (0x04E9) doc comment.
[0x4E9u] = new("The %s cannot be used while on a hook, use the '@house hooks on' command to make the hook openable.", RetailLogTextType.Default),
[0x4EAu] = new("The %s can only be used while on a hook.", RetailLogTextType.Default),
[0x4EBu] = new("You can't do that while in the air!", RetailLogTextType.ClientLocal),
[0x4ECu] = new("You cannot modify your player killer status while you are recovering from a PK death.", RetailLogTextType.Default),
@ -325,8 +414,17 @@ public static class WeenieErrorMessages
[0x4F4u] = new("%s fails to affect you because $s cannot affect anyone!", RetailLogTextType.Magic),
[0x4F5u] = new("%s fails to affect you because you cannot be harmed!", RetailLogTextType.Magic),
[0x4F6u] = new("%s fails to affect you because %s is not a player killer!", RetailLogTextType.Magic),
[0x4F7u] = new("%s fails to affect you because you are not the same sort of player killer as", RetailLogTextType.Magic),
// 0x4F8 deliberately excluded — see the class doc comment.
// 0x4F7 corrected — BLOCKER2: this is a COMPLETE, ordinary
// concatenation, not the dangling literal the prior pass's class
// doc misattributed to it (that "..as " dangle belongs to 0x4F8,
// its first operand — see the class doc comment).
[0x4F7u] = new("%s fails to affect you because you are not a player killer!", RetailLogTextType.Magic),
// 0x4F8 added — BLOCKER2: previously deliberately excluded pending
// a confident trace of its 3-operator+ concatenation chain; the
// binary sweep's direct dereference of both literal data pointers
// (data_7d2ee8 + data_7d2f80) resolves it. Both %s placeholders
// substitute the SAME parameter (retail only has one arg3).
[0x4F8u] = new("%s fails to affect you because you are not the same sort of player killer as %s!", RetailLogTextType.Magic),
[0x4F9u] = new("%s fails to affect you across a house boundary!", RetailLogTextType.Magic),
[0x4FAu] = new("%s is an invalid target.", RetailLogTextType.Magic),
[0x4FBu] = new("You are an invalid target for the spell of %s.", RetailLogTextType.Magic),
@ -357,7 +455,14 @@ public static class WeenieErrorMessages
[0x515u] = new("You no longer have the maximum number of %s hooked. You may hook additional %s.", RetailLogTextType.Default),
[0x516u] = new("You are not permitted to use that hook.", RetailLogTextType.Default),
[0x517u] = new("%s is not close enough to your level.", RetailLogTextType.Default),
[0x518u] = new("%s cannot be recruited into the fellowship.", RetailLogTextType.Default),
// 0x518 corrected — BLOCKER2: not in the review's flagged list;
// surfaced from an automated diff between the swept binary
// literals and the landed table. Retail's real text is a 3-part
// concatenation ("This fellowship is locked; " + arg3 + " cannot be
// recruited into the fellowship."), not the arg3-only fragment
// previously landed. Confirmed against ACE's
// LockedFellowshipCannotRecruit_ (0x0518) doc comment.
[0x518u] = new("This fellowship is locked; %s cannot be recruited into the fellowship.", RetailLogTextType.Default),
[0x519u] = new("The fellowship is locked, you were not added to the fellowship.", RetailLogTextType.Default),
[0x51Au] = new("Only the original owner may use that item's magic.", RetailLogTextType.ClientLocal),
[0x51Bu] = new("You have entered the %s channel.", RetailLogTextType.Default),
@ -398,7 +503,10 @@ public static class WeenieErrorMessages
[0x541u] = new("%s is now an allegiance officer.", RetailLogTextType.Default),
[0x542u] = new("An unspecified error occurred while attempting to set %s as an allegiance officer.", RetailLogTextType.Default),
[0x543u] = new("%s is no longer an allegiance officer.", RetailLogTextType.Default),
[0x544u] = new("An unspecified error occurred while attempting to set %s as an allegiance officer.", RetailLogTextType.Default),
// 0x544 corrected — BLOCKER2: retail's genuine text says REMOVE, not
// SET (0x542 above is the genuine "set" sibling); the prior pass
// duplicated 0x542's template here.
[0x544u] = new("An unspecified error occurred while attempting to remove %s as an allegiance officer.", RetailLogTextType.Default),
[0x545u] = new("You already have the maximum number of allegiance officers. You must remove some before you add any more.", RetailLogTextType.Default),
[0x546u] = new("Your allegiance officers have been cleared.", RetailLogTextType.Default),
[0x547u] = new("You must wait %s before communicating again!", RetailLogTextType.Default),
@ -408,14 +516,24 @@ public static class WeenieErrorMessages
[0x54Bu] = new("%s is already an allegiance officer of that level.", RetailLogTextType.Default),
[0x54Cu] = new("Your allegiance does not have a hometown.", RetailLogTextType.Default),
[0x54Du] = new("The %s is currently in use.", RetailLogTextType.ClientLocal),
[0x54Eu] = new("The hook does not contain a usable item. Use the '@house hooks on'command to make the hook openable.", RetailLogTextType.Default),
// 0x54E corrected — BLOCKER2: retail's genuine 0x54E text is the
// "you do not own the house" variant, distinct from 0x54F's
// "@house hooks on" variant the prior pass duplicated onto both ids.
[0x54Eu] = new("The hook does not contain a usable item. You cannot open the hook because you do not own the house to which it belongs.", RetailLogTextType.Default),
[0x54Fu] = new("The hook does not contain a usable item. Use the '@house hooks on'command to make the hook openable.", RetailLogTextType.Default),
[0x550u] = new("Out of Range!", RetailLogTextType.ClientLocal),
[0x551u] = new("You are not listening to the %s channel!", RetailLogTextType.Default),
[0x552u] = new("You must purchase Asheron's Call -- Dark Majesty to use this function.", RetailLogTextType.ClientLocal),
[0x553u] = new("You must purchase Asheron's Call -- Dark Majesty to use this function.", RetailLogTextType.ClientLocal),
[0x554u] = new("You must purchase Asheron's Call -- Dark Majesty to use this function.", RetailLogTextType.ClientLocal),
[0x555u] = new("You must purchase Asheron's Call -- Dark Majesty to use this function.", RetailLogTextType.ClientLocal),
// 0x552-0x555 corrected — BLOCKER2: the prior pass copied 0x49A's
// "Dark Majesty...to use this function." template across all four
// ids. Retail's genuine family is the "--"-separated Throne of
// Destiny expansion, each with its OWN distinct ending
// (function/item/portal/quest) — not four identical strings.
// Confirmed against ACE's MustPurchaseThroneOfDestinyToUseFunction/
// ToUseItem/ToUsePortal/ToAccessQuest (0x0552-0x0555) doc comments.
[0x552u] = new("You must purchase Asheron's Call -- Throne of Destiny to use this function.", RetailLogTextType.ClientLocal),
[0x553u] = new("You must purchase Asheron's Call -- Throne of Destiny to use this item.", RetailLogTextType.ClientLocal),
[0x554u] = new("You must purchase Asheron's Call -- Throne of Destiny to use this portal.", RetailLogTextType.ClientLocal),
[0x555u] = new("You must purchase Asheron's Call -- Throne of Destiny to access this quest.", RetailLogTextType.ClientLocal),
[0x556u] = new("You have failed to complete the augmentation.", RetailLogTextType.Default),
[0x557u] = new("You have used this augmentation too many times already.", RetailLogTextType.Default),
[0x558u] = new("You have used augmentations of this type too many times already.", RetailLogTextType.Default),
@ -457,10 +575,16 @@ public static class WeenieErrorMessages
[0x57Cu] = new("You have cleared the pre-approved vassal for your allegiance.", RetailLogTextType.Default),
[0x57Du] = new("That character is already gagged!", RetailLogTextType.Default),
[0x57Eu] = new("That character is not currently gagged!", RetailLogTextType.Default),
[0x57Fu] = new("Your allegiance chat privileges have been restored.", RetailLogTextType.Default),
// 0x57F corrected — BLOCKER2: 0x581's "restored" text was
// incorrectly duplicated here; 0x57F is the "removed" notice, the
// sibling that fires when privileges are taken away, not restored.
[0x57Fu] = new("Your allegiance chat privileges have been temporarily removed by %s. Until they are restored, you may not view or speak in the allegiance chat channel.", RetailLogTextType.Default),
[0x580u] = new("%s is now temporarily unable to view or speak in allegiance chat. The gag will run out in 5 minutes, or %s may be explicitly ungagged before then.", RetailLogTextType.Default),
[0x581u] = new("Your allegiance chat privileges have been restored.", RetailLogTextType.Default),
[0x582u] = new("Your allegiance chat privileges have been restored.", RetailLogTextType.Default),
// 0x582 corrected — BLOCKER2: 0x581's unparameterized text was
// incorrectly duplicated here; 0x582 is the %s-parameterized
// sibling ("...restored BY %s.").
[0x582u] = new("Your allegiance chat privileges have been restored by %s.", RetailLogTextType.Default),
[0x583u] = new("You have restored allegiance chat privileges to %s.", RetailLogTextType.Default),
[0x584u] = new("You cannot pick up more of that item!", RetailLogTextType.ClientLocal),
[0x585u] = new("You are restricted to clothes and armor created for your race.", RetailLogTextType.ClientLocal),

14
src/AcDream.Headless/Hosting/HeadlessGameplayOperations.cs
View file

@ -227,9 +227,17 @@ internal sealed class HeadlessGameplayOperations
// Opus review of 172c6f9a). Same ClientCommandController-output
// category as ChatVM.ShowSystemMessage; retail types the great
// majority of that output green, reserving 0x1A (bright red) for
// genuine refusals. The refusal-vs-informational split lands with
// CH2's producer rewiring (SpewBox routing) — see
// docs/research/2026-08-09-chat-retail-interface-text.md §7.2.
// genuine refusals.
//
// Comment corrected 2026-08-09, CH2 REJECT-review rework (NIT 2,
// docs/research/2026-08-09-ch2-review-findings.md): CH2's SpewBox
// routing covers WeenieError/WeenieErrorWithString ids, which carry
// their own resolved RetailLogTextType — it did NOT reach this sink,
// which takes plain pre-formatted text with no error code attached.
// Per-call-site refusal-vs-informational classification of this
// sink's callers, plus retail's windowId dual-destination echo
// (register row AP-180), remain unstarted — CH4/CH5 scope at the
// earliest, not CH2.
public void DisplayMessage(string message) =>
RequireRuntime().CommunicationOwner.Chat.OnSystemMessage(
message,

29
src/AcDream.Runtime/Gameplay/RuntimeCommunicationState.cs
View file

@ -158,20 +158,31 @@ public sealed class RuntimeCommunicationState : IDisposable
/// with <paramref name="type"/> exactly as before.</item>
/// </list>
/// <paramref name="windowId"/> is accepted for future parity with
/// retail's per-window echo (a non-zero window ID lands in both the
/// SpewBox AND that specific chat window — research doc §2.3) but is
/// not yet consumed; every current production caller passes the
/// default <c>0</c>.
/// retail's per-window echo (a non-zero window ID lands in BOTH the
/// SpewBox AND that specific chat window, ~40 slash-command-output
/// sites — research doc §2.3) but is not yet consumed; every current
/// production caller passes the default <c>0</c>. This dual-destination
/// gap is filed as register row AP-180 — implementing it is CH4/CH5
/// scope at the earliest.
/// </remarks>
public void AddText(string text, RetailLogTextType type, uint windowId = 0)
{
ArgumentNullException.ThrowIfNull(text);
// Retail's own first step (0x00563C50): trim trailing whitespace
// before anything else, regardless of destination.
text = text.TrimEnd();
if (text.Length == 0)
return;
// CH2 REJECT-review rework (SHOULD-FIX 2,
// docs/research/2026-08-09-ch2-review-findings.md): retail's own
// first step (ClientSystem::AddTextToScroll @0x00563C50) is
// trim(&str, 1, 1, ws) — BOTH ends, not trailing-only (the
// trailing-only trim in research doc §3.1 belongs to
// gmSpewBoxUI::Update, a SEPARATE later call on the SpewBox's own
// display path, not this chokepoint). Retail also has no empty-
// string guard here — AddTextToScroll broadcasts empty strings
// deliberately (the type-7/Magic s_NullBuffer sites reuse a shared
// buffer that can legitimately be empty between calls); inventing
// an early-return for empty text was an unregistered acdream-only
// divergence, now retired rather than kept as a guessed
// approximation.
text = text.Trim();
if (type == RetailLogTextType.ClientLocal)
{

19
src/AcDream.Runtime/RuntimeGenerationReset.cs
View file

@ -315,7 +315,24 @@ public sealed class RuntimeGenerationReset
state.Stage = RuntimeGenerationResetStage.ChatIdentity;
break;
case RuntimeGenerationResetStage.ChatIdentity:
Advance(state, _communication.ResetChatIdentity);
// CH2 REJECT-review rework (SHOULD-FIX 1,
// docs/research/2026-08-09-ch2-review-findings.md):
// RuntimeCommunicationState.ResetSpewBox was dead code —
// no caller reset the transient SpewBox queue at
// generation boundaries even though ResetChatIdentity
// (the chat transcript's identity/dedup reset) already
// ran here every generation. They share this stage
// because they're the same lifetime boundary — a fresh
// generation must not resurrect a stale refusal line —
// even though they differ in WHAT they reset:
// ResetChatIdentity preserves the visible transcript,
// ResetSpewBox clears it (see RuntimeCommunicationState's
// own doc comments on each).
Advance(state, () =>
{
_communication.ResetChatIdentity();
_communication.ResetSpewBox();
});
break;
case RuntimeGenerationResetStage.PlayerSnapshots:
Advance(state, _inventory.ResetPlayerSnapshots);

21
src/AcDream.UI.Abstractions/Panels/Chat/ChatVM.cs
View file

@ -118,9 +118,24 @@ public sealed class ChatVM : IDisposable
/// general-purpose output — @version, /loc, friends list, usage lines —
/// and retail types the great majority of that informational command
/// output <c>0x00</c>, reserving <c>0x1A</c> (bright red) for genuine
/// refusals/errors. The refusal-vs-informational split lands with CH2's
/// producer rewiring (SpewBox routing) — see
/// <c>docs/research/2026-08-09-chat-retail-interface-text.md</c> §7.2.
/// refusals/errors.
/// </remarks>
/// <remarks>
/// <b>Comment corrected 2026-08-09, CH2 REJECT-review rework (NIT 2,
/// docs/research/2026-08-09-ch2-review-findings.md):</b> the earlier
/// wording claimed the refusal-vs-informational split "lands with CH2's
/// producer rewiring" — it did not. CH2's SpewBox routing covers
/// <c>WeenieError</c>/<c>WeenieErrorWithString</c> ids, which carry their
/// own resolved <c>RetailLogTextType</c>; this sink takes plain
/// pre-formatted TEXT with no error code attached, so
/// <c>WeenieErrorMessages</c> has nothing to classify here. Per-call-site
/// classification of THIS sink's callers (which specific
/// <c>ClientCommandController</c> lines are genuine refusals retail
/// would type <c>0x1A</c>) remains unstarted, and even a classified
/// caller would still need retail's <c>windowId</c> dual-destination
/// echo (see register row AP-180) to land in both the SpewBox and the
/// command's originating chat window — out of scope for CH4/CH5, not
/// CH2.
/// </remarks>
public void ShowSystemMessage(string text) => _log.OnSystemMessage(text, chatType: 0x00u);

104
tests/AcDream.App.Tests/UI/SpewBoxControllerTests.cs
View file

@ -4,6 +4,17 @@ using AcDream.UI.Abstractions.Panels.SpewBox;
namespace AcDream.App.Tests.UI;
/// <summary>
/// CH2 REJECT-review rework, BLOCKER 1
/// (<c>docs/research/2026-08-09-ch2-review-findings.md</c>): these tests
/// drive the controller's frame hook (<c>UiRoot.Tick</c>, the global-message-3
/// broadcast) rather than calling <c>UiText.LinesProvider</c> directly. The
/// original tests invoked the provider straight through, bypassing the
/// <c>Visible</c> gate that <c>UiText.OnDraw</c> checks before ever polling
/// it — that is exactly why the original bug (start-invisible → provider
/// never called by drawing → no line ever visible, pending queue never
/// drains) was invisible to the original test suite.
/// </summary>
public sealed class SpewBoxControllerTests
{
[Fact]
@ -18,13 +29,18 @@ public sealed class SpewBoxControllerTests
using (var controller = new SpewBoxController(root, new SpewBoxVM(state)))
{
UiText text = Assert.IsType<UiText>(Assert.Single(root.Children));
UiText text = Assert.IsType<UiText>(root.Children.OfType<UiText>().Single());
Assert.False(text.Visible);
Assert.True(text.ClickThrough);
Assert.Equal(int.MaxValue, text.ZOrder);
state.Enqueue("You can't jump while in the air");
// Drive the frame hook, NOT the provider — this is the tick
// that drains the pending queue in production, wired through
// UiRoot.Tick's IUiGlobalTimeListener broadcast.
root.Tick(dt: 0d, nowMs: 1000L);
UiText.Line line = Assert.Single(text.LinesProvider!());
Assert.Equal("You can't jump while in the air", line.Text);
Assert.True(text.Visible);
@ -39,8 +55,92 @@ public sealed class SpewBoxControllerTests
var root = new UiRoot { Width = 1280f, Height = 720f };
using var controller = new SpewBoxController(root, new SpewBoxVM(new SpewBoxState()));
UiText text = Assert.IsType<UiText>(Assert.Single(root.Children));
root.Tick(dt: 0d, nowMs: 1000L);
UiText text = Assert.IsType<UiText>(root.Children.OfType<UiText>().Single());
Assert.Empty(text.LinesProvider!());
Assert.False(text.Visible);
}
[Fact]
public void Controller_BecomesVisible_WithoutAnyDrawHavingHappenedFirst()
{
// BLOCKER 1 acceptance (a): the original bug was start-invisible →
// LinesProvider only reachable through UiElement.DrawSelfAndChildren
// (which returns early on !Visible) → provider never called → never
// visible. This test never calls anything draw-shaped — no OnDraw,
// no DrawSelfAndChildren, no UiRenderContext — only the tick.
var root = new UiRoot { Width = 1280f, Height = 720f };
var state = new SpewBoxState();
using var controller = new SpewBoxController(root, new SpewBoxVM(state));
UiText text = Assert.IsType<UiText>(root.Children.OfType<UiText>().Single());
Assert.False(text.Visible);
state.Enqueue("Out of Range!");
root.Tick(dt: 0d, nowMs: 500L);
Assert.True(text.Visible);
Assert.Equal("Out of Range!", Assert.Single(text.LinesProvider!()).Text);
}
[Fact]
public void Controller_PendingQueueDrains_WithoutAnyDrawPass()
{
// BLOCKER 1 acceptance (b): SpewBoxState.Tick is the only caller
// that drains _pending (SpewBoxState.cs's Queue<string>). Before the
// fix, that call only happened inside LinesProvider, which drawing
// gated behind Visible — so the pending queue was an unbounded
// per-session leak. Enqueue, tick the frame hook, and assert the
// underlying state actually drained (Count reflects the visible
// set, not the still-pending queue) — never touching drawing.
var root = new UiRoot { Width = 1280f, Height = 720f };
var state = new SpewBoxState();
using var controller = new SpewBoxController(root, new SpewBoxVM(state));
state.Enqueue("first");
Assert.Equal(0, state.Count); // still pending, not yet drained
root.Tick(dt: 0d, nowMs: 100L);
Assert.Equal(1, state.Count); // drained into the visible list
Assert.Equal("first", state.Snapshot()[0].Text);
}
[Fact]
public void Controller_QueueStaysBounded_AcrossManyTicksWithoutADrawPass()
{
// BLOCKER 1 acceptance (c): repeated enqueue+tick cycles must never
// let the visible set grow past SpewBoxState.MaxConcurrentItems
// (retail's code default, 1) — this is what "unbounded per-session
// leak" would have looked like if the drain never ran at all.
var root = new UiRoot { Width = 1280f, Height = 720f };
var state = new SpewBoxState();
using var controller = new SpewBoxController(root, new SpewBoxVM(state));
for (int i = 0; i < 50; i++)
{
state.Enqueue($"line {i}");
root.Tick(dt: 0d, nowMs: 1000L + i);
Assert.True(state.Count <= SpewBoxState.MaxConcurrentItems);
}
UiText text = Assert.IsType<UiText>(root.Children.OfType<UiText>().Single());
Assert.True(text.LinesProvider!().Count <= SpewBoxState.MaxConcurrentItems);
// Newest-at-top, matching retail's InsertItem(item, 0).
Assert.Equal("line 49", text.LinesProvider!()[0].Text);
}
[Fact]
public void Dispose_RemovesBothTheTextAndTheGlobalTimeSinkFromTheRoot()
{
var root = new UiRoot { Width = 1280f, Height = 720f };
var controller = new SpewBoxController(root, new SpewBoxVM(new SpewBoxState()));
Assert.Equal(2, root.Children.Count); // UiText + the tick sink
controller.Dispose();
Assert.Empty(root.Children);
}
}

146
tests/AcDream.App.Tests/UI/SpewBoxLayoutDumpDiagnostic.cs
View file

@ -33,14 +33,32 @@ namespace AcDream.App.Tests.UI;
/// appears to reference — exists but has zero top-level elements (it is
/// not the per-line template catalog; that id must resolve through a
/// different mechanism than a direct <c>dats.Get&lt;LayoutDesc&gt;</c> hit,
/// which this slice did not crack). Conclusion: <c>gmSpewBoxUI</c> is
/// mounted directly from C++ code in <c>gmClient</c>'s HUD registration
/// block (research doc §1.1) rather than resolved from any authored
/// LayoutDesc tree — its position/extent/font/color/max-items are NOT
/// recoverable via this dump technique. Every value the SpewBox
/// presentation uses below is therefore an invented placeholder with its
/// own divergence-register row, exactly as the research doc's §3.2
/// PRESENTATION-UNKNOWN section predicted.
/// which this slice did not crack).
/// </para>
///
/// <para>
/// <b>RESULT 2, CH2 REJECT-review rework NIT 3
/// (2026-08-09, docs/research/2026-08-09-ch2-review-findings.md):</b> the
/// FIRST result above only ever swept <c>dats.Portal</c>. Extending the
/// IDENTICAL sweep to <c>dats.Local</c> (<c>client_local_English.dat</c>)
/// FINDS it: LayoutDesc <c>0x21000011</c>, element <c>0x10000048</c>
/// (class <c>0x10000016</c>), position <c>(0,0)</c> relative to its parent,
/// size <c>450×72</c>, one child — ListBox <c>0x10000049</c> (matching
/// <c>gmSpewBoxUI::PostInit</c>'s <c>GetChildRecursive(0x10000049)</c> call
/// verbatim, though its own widget-class <c>Type</c> is <c>0x00000005</c>,
/// NOT the id <c>0x10000049</c> — <c>GetChildRecursive</c> searches by
/// <c>ElementId</c>, not <c>Type</c>) — carrying <c>MaxConcurrentItems</c>
/// (property <c>0x10000028</c>) = <c>4</c>. <c>gmSpewBoxUI</c> IS
/// dat-authored after all; the earlier "mounted directly from C++ code...
/// not resolved from any authored LayoutDesc tree" conclusion was an
/// artifact of only having checked one of the two locale-bearing dats.
/// Extent and <c>MaxConcurrentItems</c> are now AUTHORED, not invented —
/// see <see cref="AcDream.Core.Chat.SpewBoxState.MaxConcurrentItems"/> and
/// <c>SpewBoxController</c>'s own doc comments, and register row AP-178.
/// Absolute screen position (the element's parent, hence its true screen
/// offset, is still unidentified) and colour (no colour property surfaced
/// in this element's direct-state dump; the per-<c>UIStateId</c>
/// <c>States</c> dictionary was not walked) remain open.
/// </para>
/// </summary>
public sealed class SpewBoxLayoutDumpDiagnostic
@ -118,7 +136,7 @@ public sealed class SpewBoxLayoutDumpDiagnostic
_out.WriteLine(
$" ListBox child 0x{listBox.ElementId:X8} "
+ $"pos=({listBox.X},{listBox.Y}) size=({listBox.Width}x{listBox.Height})");
DumpProperties(listBox, " ");
DumpProperties(listBox, " ", _out.WriteLine);
}
else
{
@ -139,7 +157,7 @@ public sealed class SpewBoxLayoutDumpDiagnostic
_out.WriteLine(
$" Line template 0x{LineTemplateElementId:X8}: type=0x{lineTemplate.Type:X8} "
+ $"pos=({lineTemplate.X},{lineTemplate.Y}) size=({lineTemplate.Width}x{lineTemplate.Height})");
DumpProperties(lineTemplate, " ");
DumpProperties(lineTemplate, " ", _out.WriteLine);
}
else
{
@ -151,6 +169,95 @@ public sealed class SpewBoxLayoutDumpDiagnostic
_out.WriteLine($"LayoutDesc 0x{LineTemplateLayoutEnum:X8} does not exist in the installed DAT.");
}
// CH2 REJECT-review rework, NIT 3
// (docs/research/2026-08-09-ch2-review-findings.md): the original
// sweep above never consulted dats.Local (client_local_English.dat
// — research doc §8.1 names this file, not client_portal.dat, as
// the one that might carry locale-specific UI text/layout
// resources). Repeat the exact same class-0x10000016 sweep against
// Local's own LayoutDesc id space before trusting AP-178's
// "not dat-authored, no LayoutDesc dump can recover this" wording.
var localHits = new List<(uint LayoutId, ElementDesc Element)>();
int localScanned = 0;
List<uint> localIds = dats.Local.GetAllIdsOfType<LayoutDesc>().ToList();
_out.WriteLine($"Local.GetAllIdsOfType<LayoutDesc> count: {localIds.Count}");
if (localIds.Count > 0)
_out.WriteLine($"Local min id: 0x{localIds.Min():X8} Local max id: 0x{localIds.Max():X8}");
foreach (uint layoutId in localIds)
{
localScanned++;
if (!dats.Local.TryGet<LayoutDesc>(layoutId, out LayoutDesc? ld) || ld is null)
continue;
foreach (var kv in ld.Elements)
{
var found = FindByType(kv.Value, SpewBoxElementClass);
if (found is not null)
localHits.Add((layoutId, found));
}
}
_out.WriteLine($"Scanned {localScanned} dats.Local LayoutDescs.");
_out.WriteLine(
$"dats.Local elements of class 0x{SpewBoxElementClass:X8} (gmSpewBoxUI): {localHits.Count}");
foreach (var (layoutId, element) in localHits)
{
_out.WriteLine(
$" [Local] LayoutDesc 0x{layoutId:X8} -> element 0x{element.ElementId:X8} "
+ $"pos=({element.X},{element.Y}) size=({element.Width}x{element.Height}) "
+ $"zLevel={element.ZLevel} readOrder={element.ReadOrder} "
+ $"leftEdge={element.LeftEdge} topEdge={element.TopEdge} "
+ $"rightEdge={element.RightEdge} bottomEdge={element.BottomEdge} "
+ $"baseElement=0x{element.BaseElement:X8} baseLayoutId=0x{element.BaseLayoutId:X8} "
+ $"children={element.Children.Count}");
DumpProperties(element, " ", _out.WriteLine);
foreach (var (childId, child) in element.Children)
{
_out.WriteLine(
$" child 0x{childId:X8}: type=0x{child.Type:X8} "
+ $"pos=({child.X},{child.Y}) size=({child.Width}x{child.Height})");
DumpProperties(child, " ", _out.WriteLine);
}
// NIT 3 finding: gmSpewBoxUI::PostInit's GetChildRecursive(0x10000049)
// searches by ELEMENT ID, not by the widget CLASS (Type) —
// ListBoxElementClass below was the wrong axis to search on
// (it collided with the decomp's 0x10000049 constant, which is
// actually this instance's authored ElementId; the ListBox
// widget's own Type turned out to be 0x00000005). Look the
// child up directly by the ElementId the decomp names.
if (element.Children.TryGetValue(ListBoxElementClass, out ElementDesc? listBoxById))
{
_out.WriteLine(
$" [Local] ListBox-by-ElementId 0x{listBoxById.ElementId:X8} "
+ $"(Type=0x{listBoxById.Type:X8}) "
+ $"pos=({listBoxById.X},{listBoxById.Y}) size=({listBoxById.Width}x{listBoxById.Height})");
}
var listBox = FindByType(element, ListBoxElementClass);
if (listBox is not null)
{
_out.WriteLine(
$" [Local] ListBox-by-Type child 0x{listBox.ElementId:X8} "
+ $"pos=({listBox.X},{listBox.Y}) size=({listBox.Width}x{listBox.Height})");
DumpProperties(listBox, " ", _out.WriteLine);
}
}
if (dats.Local.TryGet<LayoutDesc>(LineTemplateLayoutEnum, out LayoutDesc? localTemplateLd)
&& localTemplateLd is not null)
{
_out.WriteLine(
$"[Local] LayoutDesc 0x{LineTemplateLayoutEnum:X8} exists "
+ $"({localTemplateLd.Elements.Count} top-level elements).");
}
else
{
_out.WriteLine($"[Local] LayoutDesc 0x{LineTemplateLayoutEnum:X8} does not exist.");
}
// Informational only — this is a discovery sweep, not a pass/fail gate.
// The findings are transcribed into WeenieErrorMessages/SpewBoxController
// doc comments and the divergence register by hand after reading this
@ -170,17 +277,24 @@ public sealed class SpewBoxLayoutDumpDiagnostic
return null;
}
private static void DumpProperties(ElementDesc d, string indent)
private static void DumpProperties(ElementDesc d, string indent, Action<string> write)
{
// NIT 3 fix (docs/research/2026-08-09-ch2-review-findings.md): this
// used to write to Console.WriteLine unconditionally, which xUnit's
// "Standard Output Messages" capture does NOT show — a latent bug
// that only mattered once a hit with an actual property to dump
// existed (the original Portal-only sweep found none). Routed
// through the caller's ITestOutputHelper.WriteLine so a future run
// actually surfaces this.
if (d.StateDesc?.Properties is null)
{
System.Console.WriteLine($"{indent}(no direct-state properties)");
write($"{indent}(no direct-state properties)");
return;
}
foreach (var (propertyId, property) in d.StateDesc.Properties)
{
System.Console.WriteLine($"{indent}property 0x{propertyId:X8} = {Describe(property)}"
write($"{indent}property 0x{propertyId:X8} = {Describe(property)}"
+ (propertyId == ListBoxMaxItemsProperty ? " <-- MaxConcurrentItems" : ""));
}
}
@ -190,6 +304,12 @@ public sealed class SpewBoxLayoutDumpDiagnostic
DatReaderWriter.Types.EnumBaseProperty e => $"Enum({e.Value})",
DatReaderWriter.Types.DataIdBaseProperty did => $"DataId(0x{did.Value:X8})",
DatReaderWriter.Types.ArrayBaseProperty arr => $"Array[{arr.Value.Count}]({string.Join(", ", arr.Value.Select(Describe))})",
// NIT 3 fix: the original switch had no case for these two —
// Integer is exactly the type MaxConcurrentItems (property
// 0x10000028) uses, so without this case the diagnostic could
// find the property but never print its actual authored value.
DatReaderWriter.Types.IntegerBaseProperty i => $"Integer({i.Value})",
DatReaderWriter.Types.BoolBaseProperty b => $"Bool({b.Value})",
_ => property.ToString() ?? "?",
};
}

64
tests/AcDream.Core.Net.Tests/GameEventWiringTests.cs
View file

@ -704,11 +704,15 @@ public sealed class GameEventWiringTests
// Phase I.5: 0x028A previously had a parser
// (GameEvents.ParseWeenieError) but no dispatcher registration. The
// server fires this for plain game-logic failures (e.g. "you can't
// pick that up"). Now wired → ChatLog.OnWeenieError.
// pick that up"). Now wired → WeenieErrorMessages.Resolve +
// ChatLog.OnSystemMessage (the legacy no-router fallback;
// REJECT-review rework SHOULD-FIX 3 deleted the dedicated
// ChatLog.OnWeenieError chokepoint-bypass — see
// docs/research/2026-08-09-ch2-review-findings.md).
var (d, _, _, _, chat) = MakeAll();
byte[] payload = new byte[4];
BinaryPrimitives.WriteUInt32LittleEndian(payload, 0x9C); // arbitrary error code
BinaryPrimitives.WriteUInt32LittleEndian(payload, 0x04Au); // Ack! You killed yourself! (Default)
var env = GameEventEnvelope.TryParse(WrapEnvelope(GameEventType.WeenieError, payload));
d.Dispatch(env!.Value);
@ -716,8 +720,29 @@ public sealed class GameEventWiringTests
Assert.Equal(1, chat.Count);
var e = chat.Snapshot()[0];
Assert.Equal(ChatKind.System, e.Kind);
Assert.Equal(0x9Cu, e.ChannelId);
Assert.Contains("0x009C", e.Text);
Assert.Equal("Ack! You killed yourself!", e.Text);
Assert.Equal(0x00u, e.LogTextType);
}
[Fact]
public void WireAll_WeenieError_UnmappedCode_DoesNotReachChat()
{
// REJECT-review rework (SHOULD-FIX 4,
// docs/research/2026-08-09-ch2-review-findings.md): retail's
// HandleFailureEvent switch has no default case — an id it does not
// recognize produces NO text at all, silently, toward the player.
// The prior "WeenieError 0xNNNN" hex-fallback framing this test
// used to pin was acdream's own invention with no retail
// counterpart — an unregistered divergence, now retired.
var (d, _, _, _, chat) = MakeAll();
byte[] payload = new byte[4];
BinaryPrimitives.WriteUInt32LittleEndian(payload, 0x9C); // arbitrary unmapped error code
var env = GameEventEnvelope.TryParse(WrapEnvelope(GameEventType.WeenieError, payload));
d.Dispatch(env!.Value);
Assert.Equal(0, chat.Count);
}
[Theory]
@ -739,8 +764,29 @@ public sealed class GameEventWiringTests
public void WireAll_WeenieErrorWithString_RoutesToChatLogWithInterpolation()
{
// Phase I.5: 0x028B carries an interpolated substring (e.g. the
// target's name in "you can't pick up the {Mana Stone}"). Now
// wired → ChatLog.OnWeenieError with the param.
// target's name). Now wired → WeenieErrorMessages.Resolve +
// ChatLog.OnSystemMessage (the legacy no-router fallback).
var (d, _, _, _, chat) = MakeAll();
byte[] interpBytes = MakeString16L("Caith");
byte[] payload = new byte[4 + interpBytes.Length];
BinaryPrimitives.WriteUInt32LittleEndian(payload, 0x0521u); // "%s has been added to the list of people you can hear."
Array.Copy(interpBytes, 0, payload, 4, interpBytes.Length);
var env = GameEventEnvelope.TryParse(WrapEnvelope(GameEventType.WeenieErrorWithString, payload));
d.Dispatch(env!.Value);
Assert.Equal(1, chat.Count);
var e = chat.Snapshot()[0];
Assert.Equal(ChatKind.System, e.Kind);
Assert.Equal("Caith has been added to the list of people you can hear.", e.Text);
}
[Fact]
public void WireAll_WeenieErrorWithString_UnmappedCode_DoesNotReachChat()
{
// REJECT-review rework (SHOULD-FIX 4): same retail-faithful silence
// as the plain WeenieError case above.
var (d, _, _, _, chat) = MakeAll();
byte[] interpBytes = MakeString16L("Mana Stone");
@ -751,11 +797,7 @@ public sealed class GameEventWiringTests
var env = GameEventEnvelope.TryParse(WrapEnvelope(GameEventType.WeenieErrorWithString, payload));
d.Dispatch(env!.Value);
Assert.Equal(1, chat.Count);
var e = chat.Snapshot()[0];
Assert.Equal(ChatKind.System, e.Kind);
Assert.Equal(0x42u, e.ChannelId);
Assert.Contains("Mana Stone", e.Text);
Assert.Equal(0, chat.Count);
}
// ── Campaign CH slice CH2: onInterfaceText routing ───────────────────

48
tests/AcDream.Core.Tests/Chat/ChatLogTests.cs
View file

@ -131,38 +131,14 @@ public sealed class ChatLogTests
Assert.Equal(0x90ABCDEFu, e.ChannelId); // killer guid stashed here
}
[Fact]
public void OnWeenieError_PlainCode_AppendsSystemEntry()
{
var log = new ChatLog();
log.OnWeenieError(errorId: 0x1234, param: null);
var e = log.Snapshot()[0];
Assert.Equal(ChatKind.System, e.Kind);
Assert.Contains("0x1234", e.Text);
Assert.Equal(0x1234u, e.ChannelId);
}
[Fact]
public void OnWeenieError_WithString_AppendsInterpolation()
{
var log = new ChatLog();
log.OnWeenieError(errorId: 0x5678, param: "Mana Stone");
var e = log.Snapshot()[0];
Assert.Equal(ChatKind.System, e.Kind);
Assert.Contains("Mana Stone", e.Text);
}
[Theory]
[InlineData(0x003Bu)] // ILeftTheWorld
[InlineData(0x003Cu)] // ITeleported
public void OnWeenieError_RetailSilentClientControlStatus_DoesNotAppend(uint code)
{
var log = new ChatLog();
log.OnWeenieError(code, param: null);
Assert.Empty(log.Snapshot());
}
// OnWeenieError-specific tests (plain code, interpolation, silent
// client-control statuses) were removed here — REJECT-review rework
// (SHOULD-FIX 3, docs/research/2026-08-09-ch2-review-findings.md)
// deletes ChatLog.OnWeenieError itself; every producer now resolves via
// WeenieErrorMessages and calls the AddText chokepoint / OnSystemMessage
// directly. Equivalent coverage lives in GameEventWiringTests.cs (the
// inbound wire path) and WeenieErrorMessagesTests.cs (the resolve
// table), including the silent-client-control-status behavior.
[Fact]
public void OnLocalSpeech_EmptySender_SubstitutesYou()
@ -256,14 +232,6 @@ public sealed class ChatLogTests
Assert.Equal(0x00u, log.Snapshot()[0].LogTextType);
}
[Fact]
public void OnWeenieError_LogTextType_IsDefault()
{
var log = new ChatLog();
log.OnWeenieError(errorId: 0x1234, param: null);
Assert.Equal(0x00u, log.Snapshot()[0].LogTextType);
}
[Fact]
public void OnPopup_LogTextType_IsDefault()
{

55
tests/AcDream.Core.Tests/Chat/SpewBoxStateTests.cs
View file

@ -37,23 +37,22 @@ public sealed class SpewBoxStateTests
[Fact]
public void Tick_InsertsNewestAtIndexZero()
{
// Retail: InsertItem(item, 0) — with MaxConcurrentItems raised past
// the code default of 1, newer entries must lead the visible list.
// Retail: InsertItem(item, 0) — CH2 REJECT-review rework NIT 3
// raised MaxConcurrentItems from the code default (1) to the
// AUTHORED LayoutDesc value (4, see SpewBoxState.MaxConcurrentItems's
// own doc comment), so two entries now comfortably coexist without
// triggering the overflow rule — this test can assert the ordering
// guarantee directly instead of relying on eviction as a side effect.
var state = new SpewBoxState();
state.Enqueue("first");
state.Tick(0d);
state.Enqueue("second");
state.Tick(0d);
// MaxConcurrentItems == 1 (retail code default) means "first" was
// already evicted by the overflow rule — assert directly on the
// ordering guarantee instead by forcing a raised cap via reflection
// is out of scope; the dedupe/overflow tests below cover that
// interaction precisely. Here we only need the single surviving
// entry to be "second" (the newest), proving insert-at-front beat
// whatever eviction order a stack (insert-at-back) would produce.
SpewBoxEntry entry = Assert.Single(state.Snapshot());
Assert.Equal("second", entry.Text);
Assert.Equal(2, state.Count);
SpewBoxEntry[] snapshot = state.Snapshot();
Assert.Equal("second", snapshot[0].Text);
Assert.Equal("first", snapshot[1].Text);
}
[Fact]
@ -78,33 +77,43 @@ public sealed class SpewBoxStateTests
[Fact]
public void Tick_DifferentText_DoesNotDedupe()
{
// CH2 REJECT-review rework NIT 3: with the AUTHORED
// MaxConcurrentItems == 4, two distinct messages both fit without
// any eviction — dedupe (index-0-only) is the only thing that could
// collapse them, and it correctly does not apply to different text.
var state = new SpewBoxState();
state.Enqueue("first message");
state.Tick(0d);
state.Enqueue("second message");
state.Tick(0d);
// With MaxConcurrentItems == 1, "second message" evicts "first
// message" via overflow, not dedupe — either way only one survives,
// and it must be the newest.
SpewBoxEntry entry = Assert.Single(state.Snapshot());
Assert.Equal("second message", entry.Text);
Assert.Equal(2, state.Count);
SpewBoxEntry[] snapshot = state.Snapshot();
Assert.Equal("second message", snapshot[0].Text);
Assert.Equal("first message", snapshot[1].Text);
}
[Fact]
public void Tick_Overflow_DropsOldest_RespectingMaxConcurrentItems()
{
// CH2 REJECT-review rework NIT 3: MaxConcurrentItems is the
// AUTHORED LayoutDesc value (4), not retail's code default (1) —
// enqueue past the cap to actually exercise the overflow rule.
var state = new SpewBoxState();
Assert.Equal(1, SpewBoxState.MaxConcurrentItems);
Assert.Equal(4, SpewBoxState.MaxConcurrentItems);
state.Enqueue("oldest");
state.Tick(0d);
state.Enqueue("newer");
state.Tick(0d);
for (int i = 0; i < SpewBoxState.MaxConcurrentItems + 1; i++)
{
state.Enqueue($"line {i}");
state.Tick(0d);
}
Assert.Equal(SpewBoxState.MaxConcurrentItems, state.Count);
SpewBoxEntry entry = Assert.Single(state.Snapshot());
Assert.Equal("newer", entry.Text);
SpewBoxEntry[] snapshot = state.Snapshot();
// Newest at index 0; "line 0" (the oldest) dropped by overflow.
Assert.Equal("line 4", snapshot[0].Text);
Assert.Equal("line 1", snapshot[3].Text);
Assert.DoesNotContain(snapshot, e => e.Text == "line 0");
}
[Fact]

140
tests/AcDream.Core.Tests/Chat/WeenieErrorMessagesTests.cs
View file

@ -42,18 +42,22 @@ public sealed class WeenieErrorMessagesTests
// ── known codes — informational, no parameter ────────────────────
[Fact]
public void Format_0x051D_FallsBackToHex_NoRetailCaseExists()
public void Format_0x051D_ReturnsNull_NoRetailCaseExists()
{
// Campaign CH slice CH2: the pre-CH2 "Turbine Chat is enabled."
// text for 0x051D was an ACE-derived guess, never decomp-confirmed.
// The full HandleFailureEvent port found NO case for 0x51D anywhere
// in the switch (only 0x51C has one — case 0x51c: at raw line
// 383115-383118 of acclient_2013_pseudo_c.txt) — retail's own
// client simply has no display text for this id. Falling back to
// the generic form is now the retail-faithful answer, not a gap.
Assert.Equal(
"WeenieError 0x051D",
WeenieErrorMessages.Format(0x051D, param: null));
// client simply has no display text for this id.
//
// REJECT-review rework (SHOULD-FIX 4,
// docs/research/2026-08-09-ch2-review-findings.md): retail's switch
// has no default case — an unhandled id produces NO text, silently,
// toward the player. Format now returns null rather than inventing
// a "WeenieError 0xNNNN" hex fallback that has no retail
// counterpart.
Assert.Null(WeenieErrorMessages.Format(0x051D, param: null));
}
// ── known codes — error-level ────────────────────────────────────
@ -167,27 +171,31 @@ public sealed class WeenieErrorMessagesTests
WeenieErrorMessages.Format(0x04EE, null));
}
// ── unknown codes — graceful fallback preserves debug info ───────
// ── unknown codes — retail-faithful silence (SHOULD-FIX 4) ───────
//
// docs/research/2026-08-09-ch2-review-findings.md SHOULD-FIX 4: retail's
// HandleFailureEvent switch has no default case — an id it does not
// recognize produces NO text at all, toward the player. The prior
// "WeenieError 0xNNNN[: param]" hex fallback was acdream's own
// invention with no retail counterpart. These three tests are flipped
// (not deleted) to pin the new null-means-silence contract.
[Fact]
public void Format_UnknownCode_NoParam_FallsBackToHexForm()
public void Format_UnknownCode_NoParam_ReturnsNull()
{
Assert.Equal("WeenieError 0xABCD", WeenieErrorMessages.Format(0xABCD, null));
Assert.Null(WeenieErrorMessages.Format(0xABCD, null));
}
[Fact]
public void Format_UnknownCode_WithParam_FallsBackToColonForm()
public void Format_UnknownCode_WithParam_ReturnsNull()
{
Assert.Equal(
"WeenieError 0xDEAD: Mana Stone",
WeenieErrorMessages.Format(0xDEAD, "Mana Stone"));
Assert.Null(WeenieErrorMessages.Format(0xDEAD, "Mana Stone"));
}
[Fact]
public void Format_UnknownCode_EmptyParam_StaysAsHexOnly()
public void Format_UnknownCode_EmptyParam_ReturnsNull()
{
// Empty string param shouldn't add a stray colon.
Assert.Equal("WeenieError 0xCAFE", WeenieErrorMessages.Format(0xCAFE, ""));
Assert.Null(WeenieErrorMessages.Format(0xCAFE, ""));
}
// ── parameterised templates with non-trivial params ──────────────
@ -201,17 +209,18 @@ public sealed class WeenieErrorMessagesTests
}
[Fact]
public void Format_0x004F_FallsBackToHex_NoRetailCaseExists()
public void Format_0x004F_ResolvesToRetailText()
{
// Campaign CH slice CH2: the pre-CH2 "You fail to affect _ because
// they cannot be harmed!" text for 0x004F was an ACE-derived guess.
// Direct decomp verification (grepping every "case 0x4f:" in
// ClientCommunicationSystem::HandleFailureEvent's whole body) found
// NONE — only 0x4E, 0x50, 0x51, 0x52, 0x53, 0x54 have cases; 0x4F is
// skipped entirely, same as the many other gaps in that switch's
// sparse jump table. Retail has no display text for this id.
// REJECT-review rework (BLOCKER 2,
// docs/research/2026-08-09-ch2-review-findings.md): the prior
// "grep for a case label" transcription missed 0x04F because it
// dispatches via `else if (arg2 == 0x4f)`, not a switch case label.
// The binary sweep found its sprintf format string directly
// (VA 0x00571e23, in ClientCommunicationSystem::HandleFailureEvent's
// else-if chain). Retail preserves its own $s typo (only the first
// %s substitutes), same pattern as 0x4F4.
Assert.Equal(
"WeenieError 0x004F: Drudge",
"You fail to affect Drudge because $s cannot be harmed!",
WeenieErrorMessages.Format(0x004F, "Drudge"));
}
@ -226,34 +235,87 @@ public sealed class WeenieErrorMessagesTests
// ── Campaign CH slice CH2: the full HandleFailureEvent table port ────
/// <summary>
/// Pins the table's size: 338 rows (Appendix A's 339 minus the one
/// deliberately-excluded 0x4F8, see the class doc comment on
/// <see cref="WeenieErrorMessages"/>). A change to this number without
/// a matching research/commit citation is a red flag, not a routine
/// edit.
/// Pins the table's size: 344 rows. REJECT-review rework (BLOCKER 2,
/// docs/research/2026-08-09-ch2-review-findings.md) added the 5 ids the
/// prior pass's case-label enumeration missed (dispatched via
/// <c>else if</c> chains, not switch cases) plus <c>0x4F8</c>, which now
/// resolves for real instead of being deliberately excluded: 338 + 5 + 1
/// = 344. A change to this number without a matching research/commit
/// citation is a red flag, not a routine edit.
/// </summary>
[Fact]
public void Resolve_FullTable_HasExactly338Rows()
public void Resolve_FullTable_HasExactly344Rows()
{
int count = 0;
for (uint id = 0; id <= 0x600u; id++)
{
var (text, _) = WeenieErrorMessages.Resolve(id, null);
if (!text.StartsWith("WeenieError 0x", StringComparison.Ordinal))
if (text is not null)
count++;
}
Assert.Equal(338, count);
Assert.Equal(344, count);
}
[Fact]
public void Resolve_0x4F8_IsDeliberatelyExcluded_FallsBackToHex()
public void Resolve_0x4F8_NowResolvesForReal()
{
// See the class doc comment: 0x4F8's case body is a tangled
// multi-operator+ decompiler artifact that could not be resolved
// with confidence — excluded rather than guessed.
// REJECT-review rework (BLOCKER 2): the prior pass excluded 0x4F8
// because its case body's 3-operator+ concatenation chain has
// confusing BN-generated self-referential operand names. The binary
// sweep dereferenced both literal data pointers directly
// (data_7d2ee8, data_7d2f80), sidestepping the naming confusion.
// Both %s placeholders substitute the SAME parameter (retail only
// has one arg3 to concatenate twice).
var (text, type) = WeenieErrorMessages.Resolve(0x4F8, "Someone");
Assert.Equal("WeenieError 0x04F8: Someone", text);
Assert.Equal(RetailLogTextType.Default, type);
Assert.Equal(
"Someone fails to affect you because you are not the same sort of player killer as Someone!",
text);
Assert.Equal(RetailLogTextType.Magic, type);
}
// ── REJECT-review rework (BLOCKER 2): every corrected/added row ──────
//
// docs/research/2026-08-09-ch2-review-findings.md — pins the exact text
// for every id the binary sweep + ACE cross-check corrected or added
// this pass, so a future regression to the wrong (previously-landed)
// text fails loudly instead of silently.
[Theory]
// 5 ids added — missed by the prior case-label enumeration because
// they dispatch via `else if (arg2 == N)`, not a switch case.
[InlineData(0x04Fu, "You fail to affect %s because $s cannot be harmed!", RetailLogTextType.Magic)]
[InlineData(0x3EEu, "The container is closed!", RetailLogTextType.ClientLocal)]
[InlineData(0x408u, "Your spell cannot be cast inside", RetailLogTextType.ClientLocal)]
[InlineData(0x48Au, "You must be a monarch to purchase this dwelling.", RetailLogTextType.Default)]
[InlineData(0x4E8u, "The %s cannot be used while on a hook and only the owner may open the hook.", RetailLogTextType.Default)]
// 16 ids corrected per the review's own flagged list.
[InlineData(0x051u, "You fail to affect %s because you are not a player killer!", RetailLogTextType.Magic)]
[InlineData(0x053u, "You fail to affect %s because you are not the same sort of player killer as %s!", RetailLogTextType.Magic)]
[InlineData(0x054u, "You fail to affect %s because you are acting across a house boundary!", RetailLogTextType.Magic)]
[InlineData(0x466u, "You must purchase Asheron's Call: Dark Majesty to interact with that portal.", RetailLogTextType.Magic)]
[InlineData(0x4A3u, "You must have linked with a portal in order to recall to it!", RetailLogTextType.Magic)]
[InlineData(0x4B5u, "You must specify a character to query.", RetailLogTextType.ClientLocal)]
[InlineData(0x4E0u, "You are currently wielding items which require a certain level of skill. Your attributes cannot be transferred while you are wielding these items. Please remove these items and try again.", RetailLogTextType.Default)]
[InlineData(0x4F7u, "%s fails to affect you because you are not a player killer!", RetailLogTextType.Magic)]
[InlineData(0x544u, "An unspecified error occurred while attempting to remove %s as an allegiance officer.", RetailLogTextType.Default)]
[InlineData(0x54Eu, "The hook does not contain a usable item. You cannot open the hook because you do not own the house to which it belongs.", RetailLogTextType.Default)]
[InlineData(0x552u, "You must purchase Asheron's Call -- Throne of Destiny to use this function.", RetailLogTextType.ClientLocal)]
[InlineData(0x553u, "You must purchase Asheron's Call -- Throne of Destiny to use this item.", RetailLogTextType.ClientLocal)]
[InlineData(0x554u, "You must purchase Asheron's Call -- Throne of Destiny to use this portal.", RetailLogTextType.ClientLocal)]
[InlineData(0x555u, "You must purchase Asheron's Call -- Throne of Destiny to access this quest.", RetailLogTextType.ClientLocal)]
[InlineData(0x57Fu, "Your allegiance chat privileges have been temporarily removed by %s. Until they are restored, you may not view or speak in the allegiance chat channel.", RetailLogTextType.Default)]
[InlineData(0x582u, "Your allegiance chat privileges have been restored by %s.", RetailLogTextType.Default)]
// 2 ids corrected that were NOT in the review's flagged list — found by
// an automated diff between the swept binary literals and the landed
// table (the review's own "sweep may find more" prediction).
[InlineData(0x4E9u, "The %s cannot be used while on a hook, use the '@house hooks on' command to make the hook openable.", RetailLogTextType.Default)]
[InlineData(0x518u, "This fellowship is locked; %s cannot be recruited into the fellowship.", RetailLogTextType.Default)]
public void Resolve_Blocker2CorrectedRows_MatchTheSweptBinaryLiteral(
uint id, string expectedTemplate, RetailLogTextType expectedType)
{
var (text, type) = WeenieErrorMessages.Resolve(id, param: null);
Assert.Equal(expectedTemplate, text);
Assert.Equal(expectedType, type);
}
// ── spot pins across all three retail routing destinations ──────────

21
tests/AcDream.Runtime.Tests/Gameplay/RuntimeCommunicationStateTests.cs
View file

@ -207,27 +207,38 @@ public sealed class RuntimeCommunicationStateTests
}
[Fact]
public void AddText_TrimsTrailingWhitespace_LikeRetailAddTextToScroll()
public void AddText_TrimsBothEnds_LikeRetailAddTextToScroll()
{
// CH2 REJECT-review rework (SHOULD-FIX 2,
// docs/research/2026-08-09-ch2-review-findings.md): retail's
// AddTextToScroll @0x00563C50 calls trim(&str, 1, 1, ws) — BOTH
// ends, not trailing-only.
using var state = new RuntimeCommunicationState();
state.AddText("Out of Range! ", RetailLogTextType.ClientLocal);
state.AddText(" Out of Range! ", RetailLogTextType.ClientLocal);
state.SpewBox.Tick(0d);
Assert.Equal("Out of Range!", state.SpewBox.Snapshot()[0].Text);
}
[Fact]
public void AddText_EmptyAfterTrim_IsDropped()
public void AddText_EmptyAfterTrim_StillBroadcasts_LikeRetail()
{
// CH2 REJECT-review rework (SHOULD-FIX 2): retail's
// AddTextToScroll has no empty-string guard — the previous
// early-return was an unregistered acdream-only divergence, now
// retired. An all-whitespace message still reaches its destination
// as an empty string.
using var state = new RuntimeCommunicationState();
state.AddText(" ", RetailLogTextType.ClientLocal);
state.AddText(" ", RetailLogTextType.Default);
state.SpewBox.Tick(0d);
Assert.Equal(0, state.SpewBox.Count);
Assert.Equal(0, state.Chat.Count);
Assert.Equal(1, state.SpewBox.Count);
Assert.Equal("", state.SpewBox.Snapshot()[0].Text);
Assert.Equal(1, state.Chat.Count);
Assert.Equal("", state.Chat.Snapshot()[0].Text);
}
[Fact]

8
tests/AcDream.Runtime.Tests/RuntimeGenerationResetTests.cs
View file

@ -46,6 +46,7 @@ public sealed class RuntimeGenerationResetTests
runtime.ActionOwner.Combat.SetCombatMode(CombatMode.Missile);
runtime.CommunicationOwner.Chat.SetLocalPlayerGuid(player);
runtime.CommunicationOwner.Chat.OnSystemMessage("retained", 1u);
runtime.CommunicationOwner.SpewBox.Enqueue("about to be torn down");
_ = runtime.MovementOwner.Execute(
RuntimeMovementCommand.ToggleRunLock);
var observer = new RecordingObserver();
@ -81,6 +82,13 @@ public sealed class RuntimeGenerationResetTests
Assert.Equal(CombatMode.NonCombat, runtime.Actions.Snapshot.CombatMode);
Assert.False(runtime.MovementOwner.AutoRunActive);
Assert.Equal(1, runtime.CommunicationOwner.Chat.Count);
// SHOULD-FIX 1 (docs/research/2026-08-09-ch2-review-findings.md):
// ResetSpewBox was dead code — a fresh generation must not
// resurrect a stale refusal line. Assert BOTH that the pending
// enqueue never surfaces (no leftover Tick drains it into
// visibility) and that Reset itself converges Count to zero.
runtime.CommunicationOwner.SpewBox.Tick(0d);
Assert.Equal(0, runtime.CommunicationOwner.SpewBox.Count);
Assert.Null(
runtime.CommunicationOwner.CommandTargets.LastIncomingTellSender);
Assert.False(runtime.GenerationReset.CaptureSnapshot().IsActive);

12
tests/AcDream.UI.Abstractions.Tests/Panels/SpewBox/SpewBoxVMTests.cs
View file

@ -48,6 +48,10 @@ public sealed class SpewBoxVMTests
[Fact]
public void Lines_NewestFirst_MatchesRetailInsertAtZero()
{
// CH2 REJECT-review rework NIT 3: MaxConcurrentItems is the
// AUTHORED LayoutDesc value (4, see SpewBoxState.MaxConcurrentItems's
// own doc comment), not retail's code default (1) — both entries
// now survive, so assert the ordering directly.
var state = new SpewBoxState();
var vm = new SpewBoxVM(state);
state.Enqueue("older");
@ -56,11 +60,9 @@ public sealed class SpewBoxVMTests
IReadOnlyList<SpewBoxLine> lines = vm.Lines(0d);
// MaxConcurrentItems == 1 means only the newest survives, which is
// itself proof insertion happens at the front (retail's overflow
// rule drops the OLDEST / highest index, not the newest).
SpewBoxLine line = Assert.Single(lines);
Assert.Equal("newer", line.Text);
Assert.Equal(2, lines.Count);
Assert.Equal("newer", lines[0].Text);
Assert.Equal("older", lines[1].Text);
}
[Fact]

184
tools/pdb-extract/sweep_weenie_strings.py Normal file
View file

@ -0,0 +1,184 @@
"""Sweep `push imm32` (0x68) operands inside a VA range of a PE binary,
dereference each into a data section (.rdata/.data), and decode any that
resolve to a printable UTF-16LE literal.
Built for the CH2 REJECT-review rework (BLOCKER 2,
docs/research/2026-08-09-ch2-review-findings.md) to re-derive
ClientCommunicationSystem::HandleFailureEvent (@0x00571990)'s 344-row
display-string table from ground truth instead of the Binary Ninja
pseudo-C's ~33-char inline preview -- the same class of problem
check_exe_pdb.py and dump_pdb_info.py solve for PDB metadata, applied to
wide-string literal recovery. Not tied to WeenieError specifically: any VA
range in any PDB-paired PE binary works.
ALWAYS run check_exe_pdb.py first to confirm the candidate .exe pairs with
the PDB you're cross-referencing addresses against -- a mismatched binary
will produce confident-looking garbage.
Usage:
py tools/pdb-extract/sweep_weenie_strings.py <exe_path> --range 0x571990 0x575480 [--min-len 4]
py tools/pdb-extract/sweep_weenie_strings.py <exe_path> --anchor 0x005750a5 [--window 64]
py tools/pdb-extract/sweep_weenie_strings.py <exe_path> --deref 0x007d2ee8
--range LO HI sweep every string-valued push imm32 in [LO, HI)
--anchor VA search backward `--window` bytes from a case-body/call-site
VA (taken from the pseudo-C) for the nearest string-valued
push -- use when you already know roughly where a specific
case lives and just need its untruncated literal
--deref VA dereference one known data pointer directly (e.g. a
`data_XXXXXXXX` symbol name from the pseudo-C, which
directly encodes its own VA in hex)
--min-len N minimum decoded string length to report (default 3);
raise this to cut noise from short accidental hits
"""
import argparse
import struct
class PeImage:
def __init__(self, path):
with open(path, "rb") as f:
self.data = f.read()
if self.data[0:2] != b"MZ":
raise ValueError("not a PE file (no MZ)")
e_lfanew = struct.unpack_from("<I", self.data, 0x3C)[0]
if self.data[e_lfanew:e_lfanew + 4] != b"PE\0\0":
raise ValueError("no PE signature")
coff_off = e_lfanew + 4
machine, num_sections, ts, symtab, numsym, opt_hdr_size, characteristics = \
struct.unpack_from("<HHIIIHH", self.data, coff_off)
opt_off = coff_off + 20
magic = struct.unpack_from("<H", self.data, opt_off)[0]
if magic != 0x10B:
raise ValueError(f"unexpected optional header magic 0x{magic:04x} (want PE32)")
self.image_base = struct.unpack_from("<I", self.data, opt_off + 28)[0]
sec_off = opt_off + opt_hdr_size
self.sections = []
for i in range(num_sections):
rec = self.data[sec_off + i * 40: sec_off + (i + 1) * 40]
name = rec[0:8].rstrip(b"\0").decode("ascii", "replace")
virt_size, virt_addr, raw_size, raw_ptr = struct.unpack_from("<IIII", rec, 8)
self.sections.append({
"name": name,
"va": self.image_base + virt_addr,
"vsize": virt_size,
"raw_ptr": raw_ptr,
"raw_size": raw_size,
})
def section_for_va(self, va):
for s in self.sections:
if s["va"] <= va < s["va"] + max(s["vsize"], s["raw_size"]):
return s
return None
def va_to_off(self, va):
s = self.section_for_va(va)
if s is None:
return None
off = s["raw_ptr"] + (va - s["va"])
if off < 0 or off >= len(self.data):
return None
return off
def read_bytes(self, va, n):
off = self.va_to_off(va)
if off is None:
return None
return self.data[off:off + n]
def read_utf16_cstr(self, va, max_chars=400):
off = self.va_to_off(va)
if off is None:
return None
out = []
for i in range(max_chars):
chunk = self.data[off + i * 2: off + i * 2 + 2]
if len(chunk) < 2:
break
code = struct.unpack("<H", chunk)[0]
if code == 0:
return "".join(out)
# Reject control chars other than the ones AC strings legitimately
# use (\n, \t) -- anything else means we've wandered off a real
# string into unrelated data and should not report a hit.
if code < 0x20 and code not in (0x0A, 0x09):
return None
if code > 0x2FFF:
return None
out.append(chr(code))
return None # ran off the end without a NUL -- not a bounded literal
def is_data_section(self, va):
s = self.section_for_va(va)
return s is not None and s["name"] in (".rdata", ".data")
def sweep_push_imm32(self, lo, hi, min_len=3):
"""Scan [lo, hi) for `push imm32` (opcode 0x68) whose operand VA
dereferences to a UTF-16LE string in .rdata/.data. Returns a list
of (instr_va, target_va, text)."""
hits = []
off_lo = self.va_to_off(lo)
off_hi = self.va_to_off(hi)
if off_lo is None or off_hi is None:
raise ValueError("range not mapped")
i = off_lo
while i < off_hi - 4:
if self.data[i] == 0x68:
operand = struct.unpack_from("<I", self.data, i + 1)[0]
if self.is_data_section(operand):
text = self.read_utf16_cstr(operand)
if text is not None and len(text) >= min_len:
instr_va = lo + (i - off_lo)
hits.append((instr_va, operand, text))
i += 1
return hits
def find_push_before(self, anchor_va, window=64, min_len=3):
"""Search backward from anchor_va (a call-site VA taken from the
pseudo-C) for the nearest preceding `push imm32` whose operand
dereferences to a printable UTF-16LE string."""
lo = anchor_va - window
return self.sweep_push_imm32(lo, anchor_va + 2, min_len=min_len)
def main():
ap = argparse.ArgumentParser()
ap.add_argument("exe")
ap.add_argument("--range", nargs=2, metavar=("LO", "HI"))
ap.add_argument("--anchor", action="append", default=[])
ap.add_argument("--window", type=int, default=64)
ap.add_argument("--deref", action="append", default=[])
ap.add_argument("--min-len", type=int, default=3)
args = ap.parse_args()
pe = PeImage(args.exe)
print(f"ImageBase=0x{pe.image_base:08x} sections:")
for s in pe.sections:
print(f" {s['name']:<9} VA=0x{s['va']:08x} vsize=0x{s['vsize']:06x} "
f"rawptr=0x{s['raw_ptr']:08x} rawsize=0x{s['raw_size']:06x}")
print()
if args.range:
lo = int(args.range[0], 16)
hi = int(args.range[1], 16)
hits = pe.sweep_push_imm32(lo, hi, min_len=args.min_len)
print(f"# sweep 0x{lo:08x}-0x{hi:08x}: {len(hits)} string-valued push imm32 sites")
for instr_va, target_va, text in hits:
print(f"0x{instr_va:08x} -> data_0x{target_va:08x} {text!r}")
for a in args.anchor:
anchor = int(a, 16)
hits = pe.find_push_before(anchor, window=args.window, min_len=args.min_len)
print(f"\n# anchor 0x{anchor:08x} (window={args.window}): {len(hits)} hits")
for instr_va, target_va, text in hits:
print(f"0x{instr_va:08x} -> data_0x{target_va:08x} {text!r}")
for d in args.deref:
target = int(d, 16)
text = pe.read_utf16_cstr(target)
print(f"\n# deref 0x{target:08x}: {text!r}")
if __name__ == "__main__":
main()