fix(chat): CH2 rework — SpewBox tick-driven visibility + binary-derived error table

Reworks Campaign CH slice CH2 per the REJECT-review findings doc
(docs/research/2026-08-09-ch2-review-findings.md).

BLOCKER 1 — SpewBoxController never rendered a line and leaked its
pending queue. LinesProvider only ran through UiText.OnDraw, which
gates on Visible — and the box started invisible, so the provider (the
sole caller of SpewBoxState.Tick) never ran. Gave the controller an
explicit per-frame Tick(now) driven by UiRoot's global-message-3
broadcast (a zero-size GlobalTimeSink child, the same pattern
VendorUiController.DragOverGlobalTimeSink already uses), matching
retail's gmSpewBoxUI::Update. LinesProvider now only returns the
cache. Tests rewritten to drive root.Tick(...) instead of calling the
provider directly, plus new coverage for visibility-without-a-draw,
queue-drain-without-a-draw, and bounded-queue-across-many-ticks.

BLOCKER 2 — re-derived the HandleFailureEvent routing table from the
PDB-paired binary instead of the pseudo-C's ~33-char string previews.
tools/pdb-extract/sweep_weenie_strings.py sweeps every push imm32 in
VA 0x571990-0x575480, dereferences into .rdata/.data, and decodes the
full UTF-16LE literal. Added the 5 ids dispatched via else-if (missed
by case-label enumeration), resolved 0x4F8 (previously excluded),
fixed 18 wrong strings (16 the review flagged + 2 more — 0x4E9 and
0x518 — an automated diff between every swept literal and the landed
table found). Every changed row cross-checked against ACE's
WeenieError/WeenieErrorWithString enum doc comments; both oracles
agreed on every row, including a case where the review's own proposed
text for the new 0x4E8 row was itself wrong (it was 0x4E9's text) —
corrected via the else-if block's own instruction address plus the ACE
cross-check. Pinned table count: 344 (338 + 5 + 0x4F8).

SHOULD-FIX 1 — RuntimeCommunicationState.ResetSpewBox was dead code;
folded into the ChatIdentity generation-reset stage (same lifetime
boundary), with a reset assertion added to the existing populated-reset
test.

SHOULD-FIX 2 — AddText trimmed only the trailing end and invented an
empty-string early return; retail's AddTextToScroll trims both ends
(trim(&str, 1, 1, ws)) and has no empty guard. Both retired.

SHOULD-FIX 3 — ShowWeenieError bypassed the AddText chokepoint via
ChatLog.OnWeenieError (hardcoded LogTextType 0x00); routed through
Communication.AddText(Resolve(code, param)) instead, and
ChatLog.OnWeenieError is deleted — GameEventWiring's legacy no-router
fallback now resolves + calls OnSystemMessage directly.

SHOULD-FIX 4 — retail's HandleFailureEvent switch has no default case;
an unmapped id now resolves to a null Text (silence toward the
player) instead of the invented "WeenieError 0xNNNN" hex fallback,
with a diagnostics-only console log line for the id.

NITs — AP-TBD placeholders corrected to their real register rows
(AP-178, not the unrelated AP-177 lifetime row); filed AP-180 for the
windowId dual-destination gap and corrected three stale "lands with
CH2" comments; extended SpewBoxLayoutDumpDiagnostic from dats.Portal
to dats.Local and found the SpewBox element for real — LayoutDesc
0x21000011, element 0x10000048, size 450x72, MaxConcurrentItems
(ListBox property 0x10000028) = 4, not retail's code default of 1.
AP-178 narrowed accordingly; SpewBoxState.MaxConcurrentItems and
SpewBoxController's extent/anchor/OneLine are now authored rather than
placeholder (absolute screen position and colour remain open); fixed
the "19 ids... lists 18" miscount by retiring the stale paragraph in
the class doc rewrite; aligned the UseDone handler's silent-status
check with the other two WeenieError handlers.

Full Release suite: 11,914 passed / 4 skipped / 0 failed (build 0
errors).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/plans/2026-08-09-chat-parity-campaign.md

@@ -1,9 +1,10 @@
 # Campaign CH — chat & interface-text retail parity
 
 **Status:** ACTIVE 2026-08-09 — CH1 complete (implementation `172c6f9a` +
-review fixes `34d8a3c0`); CH2 code-complete (`77c8296e`), pending the
+review fixes `34d8a3c0`); CH2 code-complete (`77c8296e`), REJECT-reviewed
-in-client user gate (jump-in-air / jump-loaded refusals showing on-screen,
+(`docs/research/2026-08-09-ch2-review-findings.md`) and reworked
-not in chat).
+(`9a6fee6e`), pending the in-client user gate (jump-in-air / jump-loaded
+refusals showing on-screen, not in chat).
 
 **Why now:** first track of the alpha-release program (chat is the most
 visible daily surface for the friend-alpha). User-directed 2026-08-09.
@@ -102,7 +103,7 @@ implementer per slice against a pinned contract (per
 |---|---|---|---|---|
 | R1–R4 research | `see docs/research/2026-08-09-chat-retail-*` | — | — | — |
 | CH1 colors | `172c6f9a` | 11,835 passed / 4 skipped / 0 failed | APPROVE-WITH-FIXES; fixed `34d8a3c0` | pending |
-| CH2 interface text | `77c8296e` | 11,890 passed / 4 skipped / 0 failed | REJECT (`docs/research/2026-08-09-ch2-review-findings.md`); rework in progress | pending |
+| CH2 interface text | `77c8296e`, reworked `9a6fee6e` | 11,914 passed / 4 skipped / 0 failed | REJECT; reworked `9a6fee6e` (`docs/research/2026-08-09-ch2-review-findings.md`) | pending |
 | CH3 side channels | — | — | — | — |
 | CH4 commands | — | — | — | — |
 | CH5 closeout | — | — | — | — |

src/AcDream.App/Net/LiveSessionRuntimeFactory.cs

@@ -332,13 +332,34 @@ internal sealed class LiveSessionRuntimeFactory
             // Default, NOT 0x1A (corrected 2026-08-09, Opus review of
             // 172c6f9a). Retail types command output like @version/@loc
             // green; 0x1A (bright red) is reserved for genuine refusals.
-            // The refusal-vs-informational split lands with CH2's producer
+            //
-            // rewiring (SpewBox routing) — see
+            // Comment corrected 2026-08-09, CH2 REJECT-review rework
-            // docs/research/2026-08-09-chat-retail-interface-text.md §7.2.
+            // (NIT 2, docs/research/2026-08-09-ch2-review-findings.md):
+            // CH2's SpewBox routing covers WeenieError/WeenieErrorWithString
+            // ids (see ShowWeenieError below), which carry their own
+            // resolved RetailLogTextType — it did NOT reach this sink,
+            // which takes plain pre-formatted text with no error code
+            // attached. Per-call-site refusal-vs-informational
+            // classification of this sink's callers, plus retail's
+            // windowId dual-destination echo (register row AP-180), remain
+            // unstarted — CH4/CH5 scope at the earliest, not CH2.
             ShowSystemMessage:
                 text => _domain.Communication.Chat.OnSystemMessage(text, 0x00u),
+            // SHOULD-FIX 3 (docs/research/2026-08-09-ch2-review-findings.md):
+            // route through the AddText chokepoint instead of the deleted
+            // ChatLog.OnWeenieError, which hardcoded LogTextType 0x00 —
+            // several ShowWeenieError call sites (e.g. 0x0561, the friends-
+            // list-full refusal) resolve to ClientLocal and belong in the
+            // SpewBox, not green in chat. An id WeenieErrorMessages has no
+            // row for resolves to a null Text — retail's switch has no
+            // default case, so it produces no player-facing text.
             ShowWeenieError:
-                code => _domain.Communication.Chat.OnWeenieError(code, null),
+                code =>
+                {
+                    (string? text, RetailLogTextType type) = WeenieErrorMessages.Resolve(code, null);
+                    if (text is not null)
+                        _domain.Communication.AddText(text, type);
+                },
             PlayerPublicWeenieBitfield: () =>
                 _domain.EntityObjects.Objects.Get(_player.Identity.ServerGuid)?
                     .PublicWeenieBitfield,

src/AcDream.App/UI/SpewBoxController.cs

@@ -10,37 +10,98 @@ namespace AcDream.App.UI;
 /// <c>ClickThrough</c> <see cref="UiText"/> block at a high
 /// <see cref="UiElement.ZOrder"/>. Unlike that controller's single
 /// overwrite-only slot, this reads <see cref="SpewBoxVM"/>'s bounded,
-/// newest-on-top, per-entry-expiring queue every frame — the retained UI
+/// newest-on-top, per-entry-expiring queue every frame.
-/// tree has no separate per-frame "Update(dt)" hook, so
-/// <see cref="UiText.LinesProvider"/> (already polled once per render pass)
-/// doubles as this controller's tick source.
 /// </summary>
 /// <remarks>
-/// <b>Position / font / colour / max-items are PLACEHOLDERS.</b> The task
+/// <b>CH2 REJECT-review rework, BLOCKER 1
-/// C.7 LayoutDesc dump (<c>SpewBoxLayoutDumpDiagnostic</c>) was attempted
+/// (<c>docs/research/2026-08-09-ch2-review-findings.md</c>):</b> the
-/// and completed EXHAUSTIVELY against the installed DAT's entire LayoutDesc
+/// original landing drove the queue drain from
-/// id range (<c>0x21000000</c>-<c>0x21000075</c>, 101 of 118 possible ids
+/// <see cref="UiText.LinesProvider"/>, which <c>UiText.OnDraw</c> only
-/// populated, sanity-checked against 3 independently-known ids) and found
+/// calls when the element is ALREADY <c>Visible</c> — and the element
-/// ZERO elements of class <c>0x10000016</c> anywhere — <c>gmSpewBoxUI</c> is
+/// starts invisible, so the provider was never invoked, no line ever drew,
-/// mounted directly from C++ code, not resolved from any authored
+/// and <see cref="SpewBoxState"/>'s pending queue never drained (an
-/// LayoutDesc tree, so its screen position/extent/font/colour and the
+/// unbounded per-session leak). Retail's own <c>gmSpewBoxUI::Update</c>
-/// authored <c>MaxConcurrentItems</c> ListBox property are simply not
+/// drains off the UI tick (global message 3,
-/// recoverable this way. See the divergence register rows this class cites
+/// <c>UIElementManager::UseTime @0x0045CFD0</c>), not off drawing —
-/// for each specific placeholder.
+/// <see cref="GlobalTimeSink"/> reproduces that: it is a zero-size child
+/// mounted alongside <see cref="_text"/> purely so <see cref="UiRoot"/>'s
+/// per-frame <c>BroadcastGlobalUiTime</c> walk reaches it (the same
+/// pattern <c>VendorUiController.DragOverGlobalTimeSink</c> uses for
+/// <c>gmVendorUI::ListenToGlobalMessage</c>). <see cref="Tick"/> pulls
+/// <see cref="SpewBoxVM.Lines"/>, caches the resulting lines, and sets
+/// <see cref="_text"/>'s <c>Visible</c> flag; <see cref="UiText.LinesProvider"/>
+/// now only ever returns the cache — it is polled by drawing, but no
+/// longer double-duties as the tick source, so lines become visible and
+/// the queue drains even across a frame where nothing gets drawn (headless,
+/// a hidden window, or simply before the first render pass).
+/// </remarks>
+/// <remarks>
+/// <b>Position / font / colour are still PLACEHOLDERS; extent and
+/// max-items are now AUTHORED.</b> CH2 REJECT-review rework, NIT 3
+/// (<c>docs/research/2026-08-09-ch2-review-findings.md</c>): the task C.7
+/// LayoutDesc dump (<c>SpewBoxLayoutDumpDiagnostic</c>) originally searched
+/// only <c>dats.Portal</c> — EXHAUSTIVELY, against the entire installed
+/// LayoutDesc id range (<c>0x21000000</c>-<c>0x21000075</c>, 101 of 118
+/// possible ids populated, sanity-checked against 3 independently-known
+/// ids) — and found ZERO elements of class <c>0x10000016</c> there.
+/// Extending the identical sweep to <c>dats.Local</c>
+/// (<c>client_local_English.dat</c>) found it: LayoutDesc
+/// <c>0x21000011</c>, element <c>0x10000048</c> (<c>gmSpewBoxUI</c>),
+/// position <c>(0,0)</c> RELATIVE TO ITS PARENT (edge codes
+/// <c>leftEdge=3/rightEdge=3</c> — <c>ElementReader.ToAnchors</c>'s own doc
+/// comment names 3 as "centered", a mode that projection cannot represent;
+/// <c>topEdge=1</c> — top-anchored per that same helper), size
+/// <c>450×72</c>, one child (ListBox <c>0x10000049</c>, matching
+/// <c>gmSpewBoxUI::PostInit</c>'s <c>GetChildRecursive(0x10000049)</c>
+/// verbatim) carrying <c>MaxConcurrentItems</c> (property
+/// <c>0x10000028</c>) = <c>4</c>, not retail's code-default <c>1</c>. The
+/// PARENT this element mounts under (and therefore the ABSOLUTE screen
+/// position) is still unresolved — <c>(0,0)</c> is parent-relative, and the
+/// parent is presumably assigned by the same C++ code the research doc's
+/// §1.1 describes, not by another LayoutDesc this sweep can walk to. See
+/// the divergence register rows this class cites for each remaining
+/// placeholder.
 /// </remarks>
 internal sealed class SpewBoxController : IDisposable
 {
     /// <summary>
-    /// Register row AP-TBD (position/extent): retail's authored screen
+    /// Register row AP-178 (screen position): retail's authored ABSOLUTE
-    /// position for the SpewBox host is unknown (see class remarks); this
+    /// screen position is still unknown — the LayoutDesc dump (see class
-    /// centered-top placement is acdream's own choice, not a retail value.
+    /// remarks) recovered the element's position as <c>(0,0)</c> relative
+    /// to a PARENT this sweep could not identify, so this centered-top
+    /// placement remains acdream's own choice, not a resolved retail value.
+    /// (The SIBLING row AP-177 — the invented line-lifetime timeout — lives
+    /// in <see cref="SpewBoxState.DefaultLifetime"/>'s own doc comment, not
+    /// here; this controller does not own that concern.)
     /// </summary>
     private const float TopOffset = 60f;
-    private const float BoxHeight = 40f;
 
     /// <summary>
-    /// Register row AP-TBD (colour): the chat colour table's <c>0x1A</c>
+    /// Register row AP-178 (extent): AUTHORED, not a placeholder — the
-    /// entry (<c>colorBrightRed</c>) is explicitly NOT this — retail's own
+    /// LayoutDesc dump (see class remarks) found the SpewBox element sized
+    /// <c>450×72</c> in <c>dats.Local</c>. Retail's own edge codes
+    /// (<c>leftEdge=3</c>/<c>rightEdge=3</c>, "centered" per
+    /// <c>ElementReader.ToAnchors</c>'s doc comment) mean the box is a
+    /// FIXED-width block horizontally centered in its parent, not a
+    /// full-viewport stretch — the constructor below anchors it that way
+    /// (a one-time centered <see cref="UiText.Left"/> computed against
+    /// <see cref="UiRoot.Width"/>, <see cref="AnchorEdges.Top"/> only) since
+    /// <see cref="AnchorEdges"/> has no "centered, fixed-width" flag
+    /// combination to express retail's mode 3 directly.
+    /// </summary>
+    private const float SpewBoxWidth = 450f;
+    private const float SpewBoxHeight = 72f;
+
+    /// <summary>
+    /// Register row AP-178 (colour): retail's authored colour for THIS
+    /// element remains unresolved — the LayoutDesc dump (see class remarks)
+    /// found only two direct-state properties on the SpewBox element/ListBox
+    /// (a bool at <c>0x3B</c> and the <c>MaxConcurrentItems</c> integer at
+    /// <c>0x10000028</c>); no colour property surfaced in that direct-state
+    /// dump, and the per-<c>UIStateId</c> <c>States</c> dictionary (hover/
+    /// pressed/etc. variants, which could carry it) was not walked this
+    /// pass. The chat colour table's <c>0x1A</c> entry
+    /// (<c>colorBrightRed</c>) is explicitly NOT this — retail's own
     /// <c>BuildChatColorLookupTable</c> writes to <c>ChatInterface::m_chatLog</c>,
     /// a completely different element tree the SpewBox never touches
     /// (research doc §3.2.3). This warm-yellow placeholder follows the
@@ -53,6 +114,8 @@ internal sealed class SpewBoxController : IDisposable
     private readonly UiRoot _root;
     private readonly UiText _text;
     private readonly SpewBoxVM _vm;
+    private readonly GlobalTimeSink _timeSink;
+    private UiText.Line[] _lines = Array.Empty<UiText.Line>();
     private bool _disposed;
 
     public SpewBoxController(UiRoot root, SpewBoxVM vm)
@@ -62,43 +125,63 @@ internal sealed class SpewBoxController : IDisposable
         _text = new UiText
         {
             Name = "SpewBox",
-            Left = 0f,
+            // Centered fixed-width block (retail's "mode 3" edge code on
+            // both left and right) — see the AP-178 extent comment above.
+            Left = (root.Width - SpewBoxWidth) / 2f,
             Top = TopOffset,
-            Width = root.Width,
+            Width = SpewBoxWidth,
-            Height = BoxHeight,
+            Height = SpewBoxHeight,
-            Anchors = AnchorEdges.Left | AnchorEdges.Top | AnchorEdges.Right,
+            Anchors = AnchorEdges.Top,
             Centered = true,
-            OneLine = true,
+            // AUTHORED MaxConcurrentItems is 4, not retail's code-default 1
+            // (see SpewBoxState.MaxConcurrentItems) — OneLine=true would
+            // silently collapse the box back down to showing only the
+            // newest of up to 4 concurrent lines.
+            OneLine = false,
             ClickThrough = true,
             ZOrder = int.MaxValue,
             DefaultColor = SpewBoxColor,
             Visible = false,
         };
-        _text.LinesProvider = ComputeLines;
+        _text.LinesProvider = () => _lines;
         _root.AddChild(_text);
+
+        _timeSink = new GlobalTimeSink(Tick);
+        _root.AddChild(_timeSink);
     }
 
     /// <summary>
-    /// Polled once per render pass by <see cref="UiText"/> — this IS the
+    /// The SpewBox's per-frame tick, driven by <see cref="UiRoot"/>'s
-    /// SpewBox's per-frame tick (drains <c>SpewBoxState</c>'s pending queue
+    /// global-message-3 broadcast via <see cref="GlobalTimeSink"/> — the
-    /// and prunes expired entries; see <see cref="SpewBoxVM.Lines"/>).
+    /// direct analogue of <c>gmSpewBoxUI::Update</c>. Drains
-    /// <see cref="SpewBoxVM.Lines"/> returns newest-first, matching retail's
+    /// <see cref="SpewBoxState"/>'s pending queue and prunes expired
-    /// <c>InsertItem(item, 0)</c>; <c>OneLine</c> mode only ever draws
+    /// entries (see <see cref="SpewBoxVM.Lines"/>), caches the resulting
-    /// index 0, so with retail's code-default
+    /// display lines, and sets <see cref="_text"/>'s visibility. Runs
-    /// <c>MaxConcurrentItems == 1</c> this always shows the current line.
+    /// whether or not a draw pass follows.
     /// </summary>
-    private IReadOnlyList<UiText.Line> ComputeLines()
+    /// <param name="nowSeconds">
+    /// <see cref="UiRoot"/>'s own per-frame clock — <b>not</b>
+    /// <c>Environment.TickCount64</c> — matching every other
+    /// <see cref="IUiGlobalTimeListener"/> consumer's time source.
+    /// </param>
+    private void Tick(double nowSeconds)
     {
-        double nowSeconds = Environment.TickCount64 / 1000.0;
+        // SpewBoxVM.Lines returns newest-first, matching retail's
+        // InsertItem(item, 0) — with OneLine now false and the AUTHORED
+        // MaxConcurrentItems == 4 (see SpewBoxState.MaxConcurrentItems),
+        // up to 4 lines render, newest on top.
         IReadOnlyList<SpewBoxLine> lines = _vm.Lines(nowSeconds);
         _text.Visible = lines.Count > 0;
         if (lines.Count == 0)
-            return Array.Empty<UiText.Line>();
+        {
+            _lines = Array.Empty<UiText.Line>();
+            return;
+        }
 
         var result = new UiText.Line[lines.Count];
         for (int i = 0; i < lines.Count; i++)
             result[i] = new UiText.Line(lines[i].Text, SpewBoxColor);
-        return result;
+        _lines = result;
     }
 
     public void Dispose()
@@ -107,6 +190,24 @@ internal sealed class SpewBoxController : IDisposable
             return;
 
         _root.RemoveChild(_text);
+        _root.RemoveChild(_timeSink);
         _disposed = true;
     }
+
+    /// <summary>
+    /// A runtime-only, zero-size, always-invisible-to-hit-testing helper
+    /// that opts this controller into retail's global UI message 3 — see
+    /// the class remarks and <c>VendorUiController.DragOverGlobalTimeSink</c>
+    /// for the identical pattern. <see cref="SpewBoxController"/> is not
+    /// itself a <see cref="UiElement"/> (it wraps one), so it cannot
+    /// directly implement <see cref="IUiGlobalTimeListener"/> the way
+    /// <see cref="UiButton"/> does — <see cref="UiRoot.Tick"/>'s broadcast
+    /// walks the ELEMENT tree, not arbitrary controllers.
+    /// </summary>
+    private sealed class GlobalTimeSink : UiElement, IUiGlobalTimeListener
+    {
+        private readonly Action<double> _onGlobalUiTime;
+        public GlobalTimeSink(Action<double> onGlobalUiTime) => _onGlobalUiTime = onGlobalUiTime;
+        public void OnGlobalUiTime(double nowSeconds) => _onGlobalUiTime(nowSeconds);
+    }
 }

src/AcDream.Core.Net/GameEventWiring.cs

@@ -248,39 +248,53 @@ public static class GameEventWiring
         // Campaign CH slice CH2: retail resolves BOTH the display text and
         // the AddTextToScroll destination type from the SAME per-id switch
         // (ClientCommunicationSystem::HandleFailureEvent @0x00571990 — see
-        // WeenieErrorMessages' full 338-row port). When a router is wired
+        // WeenieErrorMessages' full 344-row port). When a router is wired
         // (the production path), the resolved type decides chat vs SpewBox;
-        // otherwise this falls back to the legacy chat-only path so callers
+        // otherwise this falls back to a direct chat append so callers that
-        // that don't wire the router (older tests) keep their prior shape.
+        // don't wire the router (older tests) keep a working, if
+        // SpewBox-less, path.
+        //
+        // REJECT-review rework (SHOULD-FIX 3/4,
+        // docs/research/2026-08-09-ch2-review-findings.md): the legacy
+        // fallback no longer routes through the deleted ChatLog.OnWeenieError
+        // (SHOULD-FIX 3 — that chokepoint bypass is retired everywhere, not
+        // just at the ShowWeenieError call site) and an unmapped id resolves
+        // to a null Text — retail's switch has no default case, so it
+        // produces NO text toward the player (SHOULD-FIX 4). Both branches
+        // below skip display for a null Text and log the raw id instead, so
+        // an unmapped code stays visible to US without ever reaching chat.
         registrar.Register(GameEventType.WeenieError, e =>
         {
             var code = GameEvents.ParseWeenieError(e.Payload.Span);
             if (code is null) return;
+            if (WeenieErrorMessages.IsSilentClientControlStatus(code.Value)) return;
+            var (text, type) = WeenieErrorMessages.Resolve(code.Value, null);
+            if (text is null)
+            {
+                Console.WriteLine($"[weenie-error] unmapped code=0x{code.Value:X4}");
+                return;
+            }
             if (onInterfaceText is not null)
-            {
-                if (WeenieErrorMessages.IsSilentClientControlStatus(code.Value)) return;
-                var (text, type) = WeenieErrorMessages.Resolve(code.Value, null);
                 onInterfaceText(text, type);
-            }
             else
-            {
+                chat.OnSystemMessage(text, chatType: (uint)type);
-                chat.OnWeenieError(code.Value, param: null);
-            }
         });
         registrar.Register(GameEventType.WeenieErrorWithString, e =>
         {
             var p = GameEvents.ParseWeenieErrorWithString(e.Payload.Span);
             if (p is null) return;
+            if (WeenieErrorMessages.IsSilentClientControlStatus(p.Value.ErrorCode)) return;
+            var (text, type) = WeenieErrorMessages.Resolve(p.Value.ErrorCode, p.Value.Interpolation);
+            if (text is null)
+            {
+                Console.WriteLine(
+                    $"[weenie-error] unmapped code=0x{p.Value.ErrorCode:X4} param={p.Value.Interpolation}");
+                return;
+            }
             if (onInterfaceText is not null)
-            {
-                if (WeenieErrorMessages.IsSilentClientControlStatus(p.Value.ErrorCode)) return;
-                var (text, type) = WeenieErrorMessages.Resolve(p.Value.ErrorCode, p.Value.Interpolation);
                 onInterfaceText(text, type);
-            }
             else
-            {
+                chat.OnSystemMessage(text, chatType: (uint)type);
-                chat.OnWeenieError(p.Value.ErrorCode, p.Value.Interpolation);
-            }
         });
 
         // ── Combat ────────────────────────────────────────────────
@@ -590,11 +604,27 @@ public static class GameEventWiring
                     + $"err={(err is null ? "n/a" : $"0x{err.Value:X4}")}");
             }
             if (err is null) return;
+            // Already the diagnostics-only log line SHOULD-FIX 4 asks for —
+            // it fires unconditionally, so an unmapped code below stays
+            // visible to US even though it produces no player-facing text.
             Console.WriteLine($"[use-done] err=0x{err.Value:X4}");
             onUseDone?.Invoke(err.Value);
             if (err.Value == 0) return;
 
+            // NIT 6 (docs/research/2026-08-09-ch2-review-findings.md):
+            // aligned with the WeenieError/WeenieErrorWithString handlers
+            // above, which check this before resolving. Harmless either
+            // way today — 0x3B/0x3C have no HandleFailureEvent case, so
+            // WeenieErrorMessages.Resolve already returns a null Text for
+            // them — but an explicit early-out here is more direct than
+            // relying on that coincidence, and guards against a future
+            // table addition accidentally making one of these two
+            // resolvable when retail's own switch genuinely has no case
+            // for either.
+            if (WeenieErrorMessages.IsSilentClientControlStatus(err.Value)) return;
+
             var (text, type) = WeenieErrorMessages.Resolve(err.Value, null);
+            if (text is null) return;
             if (onInterfaceText is not null)
                 onInterfaceText(text, type);
             else

src/AcDream.Core/Chat/ChatLog.cs

@@ -183,45 +183,20 @@ public sealed class ChatLog
         });
     }
 
-    /// <summary>WeenieError (0x028A) / WeenieErrorWithString (0x028B).</summary>
+    // WeenieError (0x028A) / WeenieErrorWithString (0x028B) used to have a
-    /// <remarks>
+    // dedicated OnWeenieError entry point here (Phase I.5, hardcoded at
-    /// Phase I.5: previously-orphaned parser. The server fires this when a
+    // LogTextType 0x00 pending register row AP-176). REJECT-review rework
-    /// game-logic action fails (e.g. "you don't have enough mana", "you
+    // (SHOULD-FIX 3, docs/research/2026-08-09-ch2-review-findings.md):
-    /// can't pick that up"). Routed as <see cref="ChatKind.System"/>; the
+    // AP-176 retired at Campaign CH slice CH2 — WeenieErrorMessages.Resolve
-    /// <c>ChannelId</c> field carries the WeenieError code so plugins can
+    // now resolves BOTH the display text AND the real per-code retail
-    /// filter or react. <paramref name="param"/> is the interpolated
+    // RetailLogTextType (chat vs SpewBox) from the full 344-row
-    /// substring (null for plain WeenieError, set for WeenieErrorWithString).
+    // HandleFailureEvent port. Every producer of WeenieError text — the
-    /// </remarks>
+    // inbound GameEventWiring handlers AND the client-command
-    public void OnWeenieError(uint errorId, string? param)
+    // ShowWeenieError sink — now resolves through WeenieErrorMessages and
-    {
+    // calls the AddText chokepoint (RuntimeCommunicationState.AddText /
-        if (WeenieErrorMessages.IsSilentClientControlStatus(errorId))
+    // ChatLog.OnSystemMessage) directly instead of through a dedicated
-            return;
+    // ChatLog method, so the single-fixed-color OnWeenieError entry point
-
+    // is deleted rather than kept as a second, narrower routing path.
-        // Phase I (post-launch fix): translate the wire code into the
-        // retail-faithful template via WeenieErrorMessages. Many codes
-        // are *informational* (e.g. 0x051B "You have entered the X
-        // channel.", 0x051D "Turbine Chat is enabled.") not errors;
-        // the old "WeenieError 0xNNNN" framing was misleading. Unknown
-        // codes still fall back to the raw "WeenieError 0xNNNN[: param]"
-        // form so nothing is silently lost. See
-        // WeenieErrorMessages.Format for the templates + lookup table.
-        string text = WeenieErrorMessages.Format(errorId, param);
-        Append(new ChatEntry(
-            Kind: ChatKind.System,
-            Sender: "",
-            Text: text,
-            SenderGuid: 0,
-            ChannelId: errorId)
-        {
-            // Retail's HandleFailureEvent @0x00571990 dispatches per ERROR
-            // CODE across an ~87-case switch, mostly AddTextToScroll(...,
-            // 0, ...) with a scattered handful at 0x1a (client-local red).
-            // A full per-code port is future work (register row AP-176);
-            // 0x00 (Default) matches the switch's majority behavior and is
-            // the safe baseline.
-            LogTextType = 0x00u,
-        });
-    }
 
     /// <summary>
     /// Channel broadcast — legacy <c>ChatChannel (0x0147)</c> or the

src/AcDream.Core/Chat/SpewBoxState.cs

@@ -35,21 +35,39 @@ public readonly record struct SpewBoxEntry(string Text, double ExpiresAtSeconds)
 /// Retail decouples enqueue (<c>RecvNotice_DisplayFinalStringInfo
 /// @0x004D60A0</c>, type-filtered to <c>0x1A</c> only) from display
 /// (<c>Update @0x004D5DF0</c>, driven once per UI tick by global message
-/// <c>3</c>) by exactly one frame. <see cref="Tick"/> reproduces that: it
+/// <c>3</c>) — NOT by exactly one frame (fixed 2026-08-09, CH2 REJECT-review
-/// drains whatever is pending into the visible list (applying retail's
+/// rework NIT 5: the earlier wording overstated this). A message that
-/// dedupe-against-index-0 and <c>MaxConcurrentItems</c> overflow rules) and
+/// arrives just before the tick fires waits ~0 frames; one that arrives
-/// prunes expired entries, all in the caller's own per-frame cadence.
+/// just after waits nearly a full frame — retail's own gap is 0-1 frames,
+/// bounded by tick cadence, not a fixed one-frame delay. <see cref="Tick"/>
+/// reproduces the SAME-CALL shape: it drains whatever is pending into the
+/// visible list (applying retail's dedupe-against-index-0 and
+/// <c>MaxConcurrentItems</c> overflow rules) and prunes expired entries in
+/// one call, so a caller invoking <see cref="Enqueue"/> then immediately
+/// <see cref="Tick"/> and <see cref="Snapshot"/> in the same frame sees the
+/// line SAME-frame — the decoupling only shows up when the caller's own
+/// tick cadence spans multiple frames, exactly like retail's.
 /// </para>
 /// </summary>
 public sealed class SpewBoxState
 {
     /// <summary>
-    /// Retail's own code default (<c>gmSpewBoxUI::PostInit @0x004D5AB0</c>)
+    /// The shipped LayoutDesc's AUTHORED value — no longer a placeholder.
-    /// when ListBox property <c>0x10000028</c> is absent or unreadable. The
+    /// CH2 REJECT-review rework, NIT 3
-    /// shipped LayoutDesc's authored value was not resolved in this slice —
+    /// (<c>docs/research/2026-08-09-ch2-review-findings.md</c>): the
-    /// see the divergence register.
+    /// original C.7 sweep only searched <c>dats.Portal</c>, which has no
+    /// <c>0x10000016</c> (gmSpewBoxUI) element anywhere; extending the same
+    /// sweep to <c>dats.Local</c> (<c>client_local_English.dat</c>) found
+    /// it — LayoutDesc <c>0x21000011</c>, element <c>0x10000048</c>, whose
+    /// sole child (ListBox <c>0x10000049</c>, matching
+    /// <c>gmSpewBoxUI::PostInit</c>'s <c>GetChildRecursive(0x10000049)</c>
+    /// call verbatim) carries ListBox property <c>0x10000028</c> = the
+    /// integer <c>4</c>. Retail's own code default
+    /// (<c>gmSpewBoxUI::PostInit @0x004D5AB0</c>), used only when this
+    /// property is absent or unreadable, was <c>1</c> — the shipped layout
+    /// overrides it with <c>4</c>.
     /// </summary>
-    public const int MaxConcurrentItems = 1;
+    public const int MaxConcurrentItems = 4;
 
     /// <summary>
     /// Retail's own client never raises the expiry element message

src/AcDream.Core/Chat/WeenieErrorMessages.cs

@@ -13,58 +13,97 @@ namespace AcDream.Core.Chat;
 /// (Sept 2013 EoR build), the 339-case switch that decides BOTH the display
 /// string and the <c>AddTextToScroll</c> type argument for every
 /// <c>WeenieError</c>/<c>WeenieErrorWithString</c> id retail's client knows
-/// about. Transcribed from
+/// about. Originally transcribed from
 /// <c>docs/research/2026-08-09-chat-retail-interface-text.md</c> Appendix A
-/// (itself read off the named retail decomp), with the following
+/// (itself read off the named retail decomp's ~33-char inline string
-/// corrections made directly against
+/// previews).
-/// <c>docs/research/named-retail/acclient_2013_pseudo_c.txt</c> rather than
+/// </para>
-/// trusting the appendix's markdown transcription wholesale:
+///
+/// <para>
+/// <b>REJECT-review rework (2026-08-09, <c>docs/research/2026-08-09-ch2-review-findings.md</c>
+/// BLOCKER 2):</b> the Appendix A transcription — "enumerate <c>case</c>
+/// labels, read the truncated preview" — turned out to be structurally
+/// unsound: it missed 5 ids dispatched via <c>else if (arg2 == N)</c> rather
+/// than a <c>case</c> label, and it silently trusted several truncated
+/// previews whose full text differs materially from the 33-char prefix.
+/// This rework re-derives the table MECHANICALLY: a Python sweep
+/// (<c>tools/pdb-extract/sweep_weenie_strings.py</c>) walks the PE section
+/// table of the PDB-paired binary (<c>C:\Users\erikn\Downloads\acclient.exe</c>,
+/// verified via <c>check_exe_pdb.py</c>) and every <c>push imm32</c>
+/// (opcode <c>0x68</c>) operand in VA <c>0x571990</c>-<c>0x575480</c> that
+/// dereferences into <c>.rdata</c>/<c>.data</c> is read as a UTF-16LE
+/// literal to its NUL terminator — the FULL string, never the pseudo-C's
+/// truncated preview. Every changed row was additionally cross-checked
+/// against ACE's own <c>WeenieError.cs</c>/<c>WeenieErrorWithString.cs</c>
+/// enum doc comments (<c>references/ACE/Source/ACE.Entity/Enum/</c>); the
+/// two independent oracles agreed on every row.
 /// </para>
 ///
 /// <list type="bullet">
-///   <item>7 ids the appendix marked "no literal — shared string global"
+///   <item><b>5 ids added</b> that Appendix A missed entirely because they
+///   dispatch via <c>else if (arg2 == N)</c> chains ABOVE the main switch,
+///   not a <c>case</c> label: <c>0x04F</c> (Magic), <c>0x3EE</c>
+///   (ClientLocal), <c>0x408</c> (ClientLocal), <c>0x48A</c> (Default),
+///   <c>0x4E8</c> (Default). <c>0x43</c> remains correctly absent — its
+///   only retail effect is <c>ClientCombatSystem::AbortAutomaticAttack</c>,
+///   no display text.</item>
+///   <item><b>18 existing rows corrected</b> — the swept binary literal
+///   disagreed with the previously-landed text for
+///   <c>0x051</c>/<c>0x053</c>/<c>0x054</c>/<c>0x466</c>/<c>0x4A3</c>/
+///   <c>0x4B5</c>/<c>0x4E0</c>/<c>0x4E9</c>/<c>0x4F7</c>/<c>0x518</c>/
+///   <c>0x544</c>/<c>0x54E</c>/<c>0x552</c>/<c>0x553</c>/<c>0x554</c>/
+///   <c>0x555</c>/<c>0x57F</c>/<c>0x582</c>. Two of these (<c>0x4E9</c>,
+///   <c>0x518</c>) were NOT in the review's own flagged list — they surfaced
+///   from an automated diff between every swept literal and the landed
+///   table, confirming the review's own "sweep may find more" prediction.
+///   <c>0x4E9</c> is the sharpest case: the review's own findings doc
+///   proposed the wrong text for the NEW <c>0x4E8</c> row (attributing
+///   <c>0x4E9</c>'s genuine text to it) — the corrected mechanical anchor
+///   (the <c>else if (arg2 == 0x4e8)</c> block's OWN instruction address,
+///   not proximity to a neighboring <c>case</c> label in the printed
+///   listing) plus the ACE cross-check together overrule that proposal:
+///   <c>0x4E8</c> = "...and only the owner may open the hook.", <c>0x4E9</c>
+///   = "...use the '@house hooks on' command to make the hook openable." —
+///   the previously-landed table had them reversed (0x4E9 held 0x4E8's
+///   text; 0x4E8 did not exist as a row at all).</item>
+///   <item><c>0x4F8</c> now resolves for real (see below) — no id is
+///   deliberately excluded any more. New pinned count: 344 rows
+///   (338 landed + 5 added + <c>0x4F8</c>).</item>
+///   <item>7 ids Appendix A marked "no literal — shared string global"
 ///   (<c>0x024</c>, <c>0x048</c>, <c>0x049</c>, <c>0x4DE</c>, <c>0x4DF</c>,
-///   <c>0x55A</c>, <c>0x55E</c>) were resolved by reading the case bodies
+///   <c>0x55A</c>, <c>0x55E</c>) remain resolved exactly as the prior pass
-///   directly: <c>0x024</c>/<c>0x048</c>/<c>0x049</c> reuse the same
+///   found: <c>0x024</c>/<c>0x048</c>/<c>0x049</c> reuse the same
 ///   process-lifetime globals as the local jump-refusal family (see
 ///   <see cref="ClientTextRefusals"/>); <c>0x4DE</c>/<c>0x4DF</c> are
 ///   <c>arg3 + "\n"</c>; <c>0x55A</c> is <c>sprintf("%s\n", arg3)</c>;
 ///   <c>0x55E</c> passes <c>arg3</c> straight through with no format string
 ///   at all.</item>
-///   <item>Appendix A's markdown table trims leading whitespace from every
-///   cell, which silently ate the leading <c>" "</c> retail's
-///   <c>arg3 + literal</c> CONCATENATION sites (as opposed to a real
-///   <c>sprintf("%s...")</c> site) depend on. 19 ids
-///   (<c>0x02B</c>, <c>0x3EF</c>, <c>0x46A</c>, <c>0x4CE</c>, <c>0x4CF</c>,
-///   <c>0x4F7</c>, <c>0x4F9</c>, <c>0x4FA</c>, <c>0x4FF</c>, <c>0x509</c>,
-///   <c>0x50B</c>, <c>0x50C</c>, <c>0x50D</c>, <c>0x517</c>, <c>0x518</c>,
-///   <c>0x51E</c>, <c>0x521</c>, <c>0x522</c>) were fixed by re-reading their
-///   case bodies and prepending the <c>%s</c> the concatenation implies.
-///   Several of these (and the <c>%s</c>-prefixed but truncated
-///   <c>0x4F4</c>-<c>0x4F6</c>, <c>0x530</c>, <c>0x534</c>, <c>0x53E</c>,
-///   <c>0x541</c>, <c>0x543</c>, <c>0x54B</c>, <c>0x562</c>, <c>0x56D</c>,
-///   <c>0x57A</c>, <c>0x57B</c>, <c>0x580</c>) were also truncated by the
-///   pseudo-C's ~33-char inline preview; the full text was recovered from a
-///   SECOND, non-truncated <c>data_XXXXXXXX</c> dump elsewhere in the same
-///   oracle file — reading the oracle again, not guessing.</item>
 ///   <item><c>0x4F4</c>'s retail literal is
 ///   <c>"%s fails to affect you because $s cannot affect anyone!"</c> —
 ///   note <c>$s</c>, not <c>%s</c>, for the second placeholder. That is a
 ///   genuine retail typo/bug (only the first <c>%s</c> substitutes; the
 ///   literal <c>$s</c> prints as-is) and is preserved verbatim rather than
-///   corrected, per the "the client is probably right" rule.</item>
+///   corrected, per the "the client is probably right" rule. <c>0x04F</c>
-///   <item><c>0x4F7</c>'s retail string is itself incomplete — it
+///   preserves the same <c>$s</c> typo pattern.</item>
-///   concatenates <c>arg3</c> with a literal that dangles on
+///   <item><c>0x4F7</c>'s retail string is a normal, COMPLETE
-///   <c>"...as "</c> with no closing word. Confirmed via exact byte-count
+///   <c>arg3 + literal</c> concatenation — "%s fails to affect you because
-///   against the declared array size (not a display artifact); preserved
+///   you are not a player killer!" — with no dangling text. The prior
-///   verbatim.</item>
+///   pass's class-doc claim that <c>0x4F7</c>'s literal "dangles" was a
-///   <item><c>0x4F8</c> could not be resolved with confidence — its case
+///   misattribution of <c>0x4F8</c>'s FIRST operand (which does end
-///   body is a tangled multi-<c>operator+</c> concatenation chain full of
+///   mid-clause, on "...as ", by design — see <c>0x4F8</c> below), not a
-///   decompiler self-referential artifacts (see
+///   genuine truncation in <c>0x4F7</c> itself.</item>
-///   <c>claude-memory/feedback_bn_decomp_field_names.md</c>). Deliberately
+///   <item><c>0x4F8</c> resolves cleanly once traced correctly: its case
-///   EXCLUDED from the table rather than guessed; falls back to the generic
+///   body concatenates <c>arg3 + " fails to affect you because you are not
-///   <c>WeenieError 0xNNNN[: param]</c> form like any other unmapped id.
+///   the same sort of player killer as " + arg3 + "!\n"</c> across three
-///   </item>
+///   <c>operator+</c> calls whose decompiled operand names are BN
+///   self-referential artifacts (see
+///   <c>claude-memory/feedback_bn_decomp_field_names.md</c>) — the sweep's
+///   direct dereference of both literal data pointers
+///   (<c>data_7d2ee8</c> = <c>" fails to affect you because you are not the
+///   same sort of player killer as "</c>, <c>data_7d2f80</c> =
+///   <c>"!\n"</c>) resolves the ambiguity without needing to trust the
+///   confusing decompiler naming. Both <c>%s</c> placeholders take the SAME
+///   parameter (retail only has one <c>arg3</c> to substitute twice).</item>
 /// </list>
 ///
 /// <para>
@@ -106,16 +145,31 @@ public static class WeenieErrorMessages
     /// <param name="errorCode">The wire error code.</param>
     /// <param name="param">The interpolated substring (null for plain
     /// <c>WeenieError</c>, set for <c>WeenieErrorWithString</c>).</param>
-    public static string Format(uint errorCode, string? param) => Resolve(errorCode, param).Text;
+    /// <returns>
+    /// The retail display text, or <see langword="null"/> for an id
+    /// <c>HandleFailureEvent</c>'s switch has no case for — see
+    /// <see cref="Resolve"/>.
+    /// </returns>
+    public static string? Format(uint errorCode, string? param) => Resolve(errorCode, param).Text;
 
     /// <summary>
     /// Resolve a WeenieError / WeenieErrorWithString code into its retail
     /// display text AND the retail <see cref="RetailLogTextType"/> it routes
-    /// to. Unmapped codes fall back to the raw
+    /// to.
-    /// <c>WeenieError 0xNNNN[: param]</c> form at
-    /// <see cref="RetailLogTextType.Default"/> so nothing is silently lost.
     /// </summary>
-    public static (string Text, RetailLogTextType Type) Resolve(uint errorCode, string? param)
+    /// <remarks>
+    /// CH2 REJECT-review rework, SHOULD-FIX 4
+    /// (<c>docs/research/2026-08-09-ch2-review-findings.md</c>): retail's
+    /// <c>HandleFailureEvent</c> switch has NO <c>default:</c> case — an id
+    /// it does not recognize produces NO text at all, silently, toward the
+    /// player. The prior pass's <c>WeenieError 0xNNNN[: param]</c> hex
+    /// fallback was acdream's own invention with no retail counterpart (an
+    /// unregistered divergence). Callers must treat a <see langword="null"/>
+    /// <c>Text</c> as "retail shows nothing here" and skip display entirely;
+    /// they should still log the raw id to a diagnostics-only sink so an
+    /// unmapped code is not silently invisible to US, only to the player.
+    /// </remarks>
+    public static (string? Text, RetailLogTextType Type) Resolve(uint errorCode, string? param)
     {
         if (Table.TryGetValue(errorCode, out Entry entry))
         {
@@ -125,17 +179,17 @@ public static class WeenieErrorMessages
             return (text, entry.Type);
         }
 
-        string fallback = string.IsNullOrEmpty(param)
+        return (null, RetailLogTextType.Default);
-            ? $"WeenieError 0x{errorCode:X4}"
-            : $"WeenieError 0x{errorCode:X4}: {param}";
-        return (fallback, RetailLogTextType.Default);
     }
 
     /// <summary>
     /// The full retail routing table, transcribed from
-    /// <c>ClientCommunicationSystem::HandleFailureEvent @0x00571990</c> (338
+    /// <c>ClientCommunicationSystem::HandleFailureEvent @0x00571990</c> — 344
-    /// of its 339 cases — see the class doc comment for the one deliberate
+    /// rows (338 landed at the prior pass + 5 ids the prior pass's
-    /// exclusion and every correction made against the raw decomp).
+    /// case-label enumeration missed + <c>0x4F8</c>, which now resolves for
+    /// real; every id the switch dispatches has a row here). See the class
+    /// doc comment for the binary-sweep + ACE cross-check methodology and
+    /// every correction made against it.
     /// </summary>
     private static readonly Dictionary<uint, Entry> Table = new()
     {
@@ -162,11 +216,20 @@ public static class WeenieErrorMessages
         [0x04Au] = new("Ack! You killed yourself!", RetailLogTextType.Default),
         [0x04Du] = new("Invalid PK status!", RetailLogTextType.ClientLocal),
         [0x04Eu] = new("You fail to affect %s because you cannot affect anyone!", RetailLogTextType.Magic),
+        // 0x04F added — BLOCKER2: else-if dispatch (arg2 == 0x4f), missed by
+        // the prior case-label enumeration. Preserves retail's own $s typo,
+        // same pattern as 0x4F4.
+        [0x04Fu] = new("You fail to affect %s because $s cannot be harmed!", RetailLogTextType.Magic),
         [0x050u] = new("You fail to affect %s because beneficial spells do not affect %s!", RetailLogTextType.Magic),
-        [0x051u] = new("You fail to affect %s because you cannot affect anyone!", RetailLogTextType.Magic),
+        // 0x051/0x053/0x054 corrected — BLOCKER2: the prior pass copied
+        // 0x04E's/0x053's template across all four "You fail to affect"
+        // Magic-family ids; each is in fact a DISTINCT retail literal.
+        [0x051u] = new("You fail to affect %s because you are not a player killer!", RetailLogTextType.Magic),
         [0x052u] = new("You fail to affect %s because %s is not a player killer!", RetailLogTextType.Magic),
-        [0x053u] = new("You fail to affect %s because you cannot affect anyone!", RetailLogTextType.Magic),
+        [0x053u] = new("You fail to affect %s because you are not the same sort of player killer as %s!", RetailLogTextType.Magic),
-        [0x054u] = new("You fail to affect %s because you cannot affect anyone!", RetailLogTextType.Magic),
+        [0x054u] = new("You fail to affect %s because you are acting across a house boundary!", RetailLogTextType.Magic),
+        // 0x3EE added — BLOCKER2: else-if dispatch (arg2 == 0x3ee).
+        [0x3EEu] = new("The container is closed!", RetailLogTextType.ClientLocal),
         [0x3EFu] = new("%s is not accepting gifts right now.", RetailLogTextType.Default),
         [0x3F1u] = new("You failed to go to non-combat mode.", RetailLogTextType.ClientLocal),
         [0x3F7u] = new("You are too fatigued to attack!", RetailLogTextType.ClientLocal),
@@ -181,6 +244,10 @@ public static class WeenieErrorMessages
         [0x403u] = new("Your spell's target is missing!", RetailLogTextType.ClientLocal),
         [0x404u] = new("Your projectile spell mislaunched!", RetailLogTextType.ClientLocal),
         [0x407u] = new("Your spell cannot be cast outside", RetailLogTextType.ClientLocal),
+        // 0x408 added — BLOCKER2: else-if dispatch (arg2 == 0x408), sibling
+        // of 0x407 above (both lack trailing punctuation in retail's own
+        // literal — not a display artifact).
+        [0x408u] = new("Your spell cannot be cast inside", RetailLogTextType.ClientLocal),
         [0x40Au] = new("You are unprepared to cast a spell", RetailLogTextType.ClientLocal),
         [0x40Bu] = new("You've already sworn your Allegiance", RetailLogTextType.ClientLocal),
         [0x40Cu] = new("You don't have enough experience available to swear Allegiance", RetailLogTextType.ClientLocal),
@@ -215,7 +282,10 @@ public static class WeenieErrorMessages
         [0x45Du] = new("Non-player killers may not interact with that portal!", RetailLogTextType.Magic),
         [0x45Eu] = new("You do not own a house!", RetailLogTextType.ClientLocal),
         [0x45Fu] = new("You do not own a house!", RetailLogTextType.ClientLocal),
-        [0x466u] = new("You must purchase Asheron's Call -- Dark Majesty to use this function.", RetailLogTextType.Magic),
+        // 0x466 corrected — BLOCKER2: retail's colon-separated "Asheron's
+        // Call: Dark Majesty..." wording, distinct from the "--"-separated
+        // Throne of Destiny family at 0x552-0x555 below.
+        [0x466u] = new("You must purchase Asheron's Call: Dark Majesty to interact with that portal.", RetailLogTextType.Magic),
         [0x469u] = new("You have used all the hooks you are allowed to use for this house.", RetailLogTextType.Default),
         [0x46Au] = new("%s doesn't know what to do with that.", RetailLogTextType.Default),
         [0x474u] = new("You must complete a quest to interact with that portal.", RetailLogTextType.Magic),
@@ -225,6 +295,8 @@ public static class WeenieErrorMessages
         [0x482u] = new("Your monarch has closed the mansion to the Allegiance.", RetailLogTextType.ClientLocal),
         [0x488u] = new("You must be above level %s to purchase this dwelling.", RetailLogTextType.Default),
         [0x489u] = new("You must be at or below level %s to purchase this dwelling.", RetailLogTextType.Default),
+        // 0x48A added — BLOCKER2: else-if dispatch (arg2 == 0x48a).
+        [0x48Au] = new("You must be a monarch to purchase this dwelling.", RetailLogTextType.Default),
         [0x48Bu] = new("You must be above allegiance rank %s to purchase this dwelling.", RetailLogTextType.Default),
         [0x48Cu] = new("You must be at or below allegiance rank %s to purchase this dwelling.", RetailLogTextType.Default),
         [0x48Eu] = new("Your offer of Allegiance has been ignored.", RetailLogTextType.ClientLocal),
@@ -248,7 +320,9 @@ public static class WeenieErrorMessages
         [0x4A0u] = new("You fail to link with the portal!", RetailLogTextType.Magic),
         [0x4A1u] = new("You successfully link with the portal!", RetailLogTextType.Magic),
         [0x4A2u] = new("You fail to recall to the portal!", RetailLogTextType.Magic),
-        [0x4A3u] = new("You must have linked with a portal in order to summon it!", RetailLogTextType.Magic),
+        // 0x4A3 corrected — BLOCKER2: retail's real text is about RECALL,
+        // not summon (0x4A5 below is the genuine "summon it" sibling).
+        [0x4A3u] = new("You must have linked with a portal in order to recall to it!", RetailLogTextType.Magic),
         [0x4A4u] = new("You fail to summon the portal!", RetailLogTextType.Magic),
         [0x4A5u] = new("You must have linked with a portal in order to summon it!", RetailLogTextType.Magic),
         [0x4A6u] = new("You fail to teleport!", RetailLogTextType.Magic),
@@ -265,7 +339,9 @@ public static class WeenieErrorMessages
         [0x4B2u] = new("The key doesn't fit this lock.", RetailLogTextType.Default),
         [0x4B3u] = new("The lock has been used too recently.", RetailLogTextType.ClientLocal),
         [0x4B4u] = new("You aren't trained in lockpicking!", RetailLogTextType.ClientLocal),
-        [0x4B5u] = new("You must specify a character to boot.", RetailLogTextType.ClientLocal),
+        // 0x4B5 corrected — BLOCKER2: distinct from 0x491's genuine "boot"
+        // wording (0x4B5 is the allegiance-query variant).
+        [0x4B5u] = new("You must specify a character to query.", RetailLogTextType.ClientLocal),
         [0x4B6u] = new("Please use the allegiance panel to view your own information.", RetailLogTextType.ClientLocal),
         [0x4B7u] = new("You have used that command too recently.", RetailLogTextType.ClientLocal),
         [0x4B8u] = new("You do not own that salvage tool!", RetailLogTextType.Default),
@@ -303,7 +379,12 @@ public static class WeenieErrorMessages
         [0x4DDu] = new("You have failed to alter your attributes.", RetailLogTextType.Default),
         [0x4DEu] = new("%s", RetailLogTextType.Default),
         [0x4DFu] = new("%s", RetailLogTextType.Default),
-        [0x4E0u] = new("You are currently wielding items which require a certain level of %s.  Your %s skill cannot be lowered while you are wielding these items.  Please remove these items and try again.", RetailLogTextType.Default),
+        // 0x4E0 corrected — BLOCKER2: the prior pass copied 0x4D5's
+        // "skill cannot be lowered" template; retail's genuine 0x4E0 text is
+        // about ATTRIBUTES not transferring, a distinct sibling to 0x4DD
+        // ("failed to alter your attributes") and 0x4E1 ("succeeded in
+        // transferring your attributes!").
+        [0x4E0u] = new("You are currently wielding items which require a certain level of skill. Your attributes cannot be transferred while you are wielding these items. Please remove these items and try again.", RetailLogTextType.Default),
         [0x4E1u] = new("You have succeeded in transferring your attributes!", RetailLogTextType.Default),
         [0x4E2u] = new("This hook is a duplicated housing object. You may not add items to a duplicated housing object. Please empty the hook and allow it to reset.", RetailLogTextType.Default),
         [0x4E3u] = new("That item is of the wrong type to be placed on this hook.", RetailLogTextType.Default),
@@ -311,7 +392,15 @@ public static class WeenieErrorMessages
         [0x4E5u] = new("This hook was a duplicated housing object. Since it is now empty, it will be deleted momentarily. Once it is gone, it is safe to use the other, non-duplicated hook that is here.", RetailLogTextType.Default),
         [0x4E6u] = new("This chest was a duplicated housing object. Since it is now empty, it will be deleted momentarily. Once it is gone, it is safe to use the other, non-duplicated chest that is here.", RetailLogTextType.Default),
         [0x4E7u] = new("You cannot swear allegiance to anyone because you own a monarch-only house. Please abandon your house and try again.", RetailLogTextType.Default),
-        [0x4E9u] = new("The %s cannot be used while on a hook and only the owner may open the hook.", RetailLogTextType.Default),
+        // 0x4E8 added — BLOCKER2: else-if dispatch (arg2 == 0x4e8), anchored
+        // on that branch's OWN instruction address (not proximity to a
+        // neighboring case label — see the class doc comment's 0x4E9 note).
+        [0x4E8u] = new("The %s cannot be used while on a hook and only the owner may open the hook.", RetailLogTextType.Default),
+        // 0x4E9 corrected — BLOCKER2: the prior pass gave this row 0x4E8's
+        // text (the two are easy to conflate — near-duplicate wording for
+        // adjacent ids). Confirmed against ACE's ItemUnusableOnHook_CanOpen
+        // (0x04E9) doc comment.
+        [0x4E9u] = new("The %s cannot be used while on a hook, use the '@house hooks on' command to make the hook openable.", RetailLogTextType.Default),
         [0x4EAu] = new("The %s can only be used while on a hook.", RetailLogTextType.Default),
         [0x4EBu] = new("You can't do that while in the air!", RetailLogTextType.ClientLocal),
         [0x4ECu] = new("You cannot modify your player killer status while you are recovering from a PK death.", RetailLogTextType.Default),
@@ -325,8 +414,17 @@ public static class WeenieErrorMessages
         [0x4F4u] = new("%s fails to affect you because $s cannot affect anyone!", RetailLogTextType.Magic),
         [0x4F5u] = new("%s fails to affect you because you cannot be harmed!", RetailLogTextType.Magic),
         [0x4F6u] = new("%s fails to affect you because %s is not a player killer!", RetailLogTextType.Magic),
-        [0x4F7u] = new("%s fails to affect you because you are not the same sort of player killer as", RetailLogTextType.Magic),
+        // 0x4F7 corrected — BLOCKER2: this is a COMPLETE, ordinary
-        // 0x4F8 deliberately excluded — see the class doc comment.
+        // concatenation, not the dangling literal the prior pass's class
+        // doc misattributed to it (that "..as " dangle belongs to 0x4F8,
+        // its first operand — see the class doc comment).
+        [0x4F7u] = new("%s fails to affect you because you are not a player killer!", RetailLogTextType.Magic),
+        // 0x4F8 added — BLOCKER2: previously deliberately excluded pending
+        // a confident trace of its 3-operator+ concatenation chain; the
+        // binary sweep's direct dereference of both literal data pointers
+        // (data_7d2ee8 + data_7d2f80) resolves it. Both %s placeholders
+        // substitute the SAME parameter (retail only has one arg3).
+        [0x4F8u] = new("%s fails to affect you because you are not the same sort of player killer as %s!", RetailLogTextType.Magic),
         [0x4F9u] = new("%s fails to affect you across a house boundary!", RetailLogTextType.Magic),
         [0x4FAu] = new("%s is an invalid target.", RetailLogTextType.Magic),
         [0x4FBu] = new("You are an invalid target for the spell of %s.", RetailLogTextType.Magic),
@@ -357,7 +455,14 @@ public static class WeenieErrorMessages
         [0x515u] = new("You no longer have the maximum number of %s hooked.  You may hook additional %s.", RetailLogTextType.Default),
         [0x516u] = new("You are not permitted to use that hook.", RetailLogTextType.Default),
         [0x517u] = new("%s is not close enough to your level.", RetailLogTextType.Default),
-        [0x518u] = new("%s cannot be recruited into the fellowship.", RetailLogTextType.Default),
+        // 0x518 corrected — BLOCKER2: not in the review's flagged list;
+        // surfaced from an automated diff between the swept binary
+        // literals and the landed table. Retail's real text is a 3-part
+        // concatenation ("This fellowship is locked; " + arg3 + " cannot be
+        // recruited into the fellowship."), not the arg3-only fragment
+        // previously landed. Confirmed against ACE's
+        // LockedFellowshipCannotRecruit_ (0x0518) doc comment.
+        [0x518u] = new("This fellowship is locked; %s cannot be recruited into the fellowship.", RetailLogTextType.Default),
         [0x519u] = new("The fellowship is locked, you were not added to the fellowship.", RetailLogTextType.Default),
         [0x51Au] = new("Only the original owner may use that item's magic.", RetailLogTextType.ClientLocal),
         [0x51Bu] = new("You have entered the %s channel.", RetailLogTextType.Default),
@@ -398,7 +503,10 @@ public static class WeenieErrorMessages
         [0x541u] = new("%s is now an allegiance officer.", RetailLogTextType.Default),
         [0x542u] = new("An unspecified error occurred while attempting to set %s as an allegiance officer.", RetailLogTextType.Default),
         [0x543u] = new("%s is no longer an allegiance officer.", RetailLogTextType.Default),
-        [0x544u] = new("An unspecified error occurred while attempting to set %s as an allegiance officer.", RetailLogTextType.Default),
+        // 0x544 corrected — BLOCKER2: retail's genuine text says REMOVE, not
+        // SET (0x542 above is the genuine "set" sibling); the prior pass
+        // duplicated 0x542's template here.
+        [0x544u] = new("An unspecified error occurred while attempting to remove %s as an allegiance officer.", RetailLogTextType.Default),
         [0x545u] = new("You already have the maximum number of allegiance officers. You must remove some before you add any more.", RetailLogTextType.Default),
         [0x546u] = new("Your allegiance officers have been cleared.", RetailLogTextType.Default),
         [0x547u] = new("You must wait %s before communicating again!", RetailLogTextType.Default),
@@ -408,14 +516,24 @@ public static class WeenieErrorMessages
         [0x54Bu] = new("%s is already an allegiance officer of that level.", RetailLogTextType.Default),
         [0x54Cu] = new("Your allegiance does not have a hometown.", RetailLogTextType.Default),
         [0x54Du] = new("The %s is currently in use.", RetailLogTextType.ClientLocal),
-        [0x54Eu] = new("The hook does not contain a usable item. Use the '@house hooks on'command to make the hook openable.", RetailLogTextType.Default),
+        // 0x54E corrected — BLOCKER2: retail's genuine 0x54E text is the
+        // "you do not own the house" variant, distinct from 0x54F's
+        // "@house hooks on" variant the prior pass duplicated onto both ids.
+        [0x54Eu] = new("The hook does not contain a usable item. You cannot open the hook because you do not own the house to which it belongs.", RetailLogTextType.Default),
         [0x54Fu] = new("The hook does not contain a usable item. Use the '@house hooks on'command to make the hook openable.", RetailLogTextType.Default),
         [0x550u] = new("Out of Range!", RetailLogTextType.ClientLocal),
         [0x551u] = new("You are not listening to the %s channel!", RetailLogTextType.Default),
-        [0x552u] = new("You must purchase Asheron's Call -- Dark Majesty to use this function.", RetailLogTextType.ClientLocal),
+        // 0x552-0x555 corrected — BLOCKER2: the prior pass copied 0x49A's
-        [0x553u] = new("You must purchase Asheron's Call -- Dark Majesty to use this function.", RetailLogTextType.ClientLocal),
+        // "Dark Majesty...to use this function." template across all four
-        [0x554u] = new("You must purchase Asheron's Call -- Dark Majesty to use this function.", RetailLogTextType.ClientLocal),
+        // ids. Retail's genuine family is the "--"-separated Throne of
-        [0x555u] = new("You must purchase Asheron's Call -- Dark Majesty to use this function.", RetailLogTextType.ClientLocal),
+        // Destiny expansion, each with its OWN distinct ending
+        // (function/item/portal/quest) — not four identical strings.
+        // Confirmed against ACE's MustPurchaseThroneOfDestinyToUseFunction/
+        // ToUseItem/ToUsePortal/ToAccessQuest (0x0552-0x0555) doc comments.
+        [0x552u] = new("You must purchase Asheron's Call -- Throne of Destiny to use this function.", RetailLogTextType.ClientLocal),
+        [0x553u] = new("You must purchase Asheron's Call -- Throne of Destiny to use this item.", RetailLogTextType.ClientLocal),
+        [0x554u] = new("You must purchase Asheron's Call -- Throne of Destiny to use this portal.", RetailLogTextType.ClientLocal),
+        [0x555u] = new("You must purchase Asheron's Call -- Throne of Destiny to access this quest.", RetailLogTextType.ClientLocal),
         [0x556u] = new("You have failed to complete the augmentation.", RetailLogTextType.Default),
         [0x557u] = new("You have used this augmentation too many times already.", RetailLogTextType.Default),
         [0x558u] = new("You have used augmentations of this type too many times already.", RetailLogTextType.Default),
@@ -457,10 +575,16 @@ public static class WeenieErrorMessages
         [0x57Cu] = new("You have cleared the pre-approved vassal for your allegiance.", RetailLogTextType.Default),
         [0x57Du] = new("That character is already gagged!", RetailLogTextType.Default),
         [0x57Eu] = new("That character is not currently gagged!", RetailLogTextType.Default),
-        [0x57Fu] = new("Your allegiance chat privileges have been restored.", RetailLogTextType.Default),
+        // 0x57F corrected — BLOCKER2: 0x581's "restored" text was
+        // incorrectly duplicated here; 0x57F is the "removed" notice, the
+        // sibling that fires when privileges are taken away, not restored.
+        [0x57Fu] = new("Your allegiance chat privileges have been temporarily removed by %s. Until they are restored, you may not view or speak in the allegiance chat channel.", RetailLogTextType.Default),
         [0x580u] = new("%s is now temporarily unable to view or speak in allegiance chat. The gag will run out in 5 minutes, or %s may be explicitly ungagged before then.", RetailLogTextType.Default),
         [0x581u] = new("Your allegiance chat privileges have been restored.", RetailLogTextType.Default),
-        [0x582u] = new("Your allegiance chat privileges have been restored.", RetailLogTextType.Default),
+        // 0x582 corrected — BLOCKER2: 0x581's unparameterized text was
+        // incorrectly duplicated here; 0x582 is the %s-parameterized
+        // sibling ("...restored BY %s.").
+        [0x582u] = new("Your allegiance chat privileges have been restored by %s.", RetailLogTextType.Default),
         [0x583u] = new("You have restored allegiance chat privileges to %s.", RetailLogTextType.Default),
         [0x584u] = new("You cannot pick up more of that item!", RetailLogTextType.ClientLocal),
         [0x585u] = new("You are restricted to clothes and armor created for your race.", RetailLogTextType.ClientLocal),

src/AcDream.Headless/Hosting/HeadlessGameplayOperations.cs

@@ -227,9 +227,17 @@ internal sealed class HeadlessGameplayOperations
     // Opus review of 172c6f9a). Same ClientCommandController-output
     // category as ChatVM.ShowSystemMessage; retail types the great
     // majority of that output green, reserving 0x1A (bright red) for
-    // genuine refusals. The refusal-vs-informational split lands with
+    // genuine refusals.
-    // CH2's producer rewiring (SpewBox routing) — see
+    //
-    // docs/research/2026-08-09-chat-retail-interface-text.md §7.2.
+    // Comment corrected 2026-08-09, CH2 REJECT-review rework (NIT 2,
+    // docs/research/2026-08-09-ch2-review-findings.md): CH2's SpewBox
+    // routing covers WeenieError/WeenieErrorWithString ids, which carry
+    // their own resolved RetailLogTextType — it did NOT reach this sink,
+    // which takes plain pre-formatted text with no error code attached.
+    // Per-call-site refusal-vs-informational classification of this
+    // sink's callers, plus retail's windowId dual-destination echo
+    // (register row AP-180), remain unstarted — CH4/CH5 scope at the
+    // earliest, not CH2.
     public void DisplayMessage(string message) =>
         RequireRuntime().CommunicationOwner.Chat.OnSystemMessage(
             message,

src/AcDream.Runtime/Gameplay/RuntimeCommunicationState.cs

@@ -158,20 +158,31 @@ public sealed class RuntimeCommunicationState : IDisposable
     ///   with <paramref name="type"/> exactly as before.</item>
     /// </list>
     /// <paramref name="windowId"/> is accepted for future parity with
-    /// retail's per-window echo (a non-zero window ID lands in both the
+    /// retail's per-window echo (a non-zero window ID lands in BOTH the
-    /// SpewBox AND that specific chat window — research doc §2.3) but is
+    /// SpewBox AND that specific chat window, ~40 slash-command-output
-    /// not yet consumed; every current production caller passes the
+    /// sites — research doc §2.3) but is not yet consumed; every current
-    /// default <c>0</c>.
+    /// production caller passes the default <c>0</c>. This dual-destination
+    /// gap is filed as register row AP-180 — implementing it is CH4/CH5
+    /// scope at the earliest.
     /// </remarks>
     public void AddText(string text, RetailLogTextType type, uint windowId = 0)
     {
         ArgumentNullException.ThrowIfNull(text);
 
-        // Retail's own first step (0x00563C50): trim trailing whitespace
+        // CH2 REJECT-review rework (SHOULD-FIX 2,
-        // before anything else, regardless of destination.
+        // docs/research/2026-08-09-ch2-review-findings.md): retail's own
-        text = text.TrimEnd();
+        // first step (ClientSystem::AddTextToScroll @0x00563C50) is
-        if (text.Length == 0)
+        // trim(&str, 1, 1, ws) — BOTH ends, not trailing-only (the
-            return;
+        // trailing-only trim in research doc §3.1 belongs to
+        // gmSpewBoxUI::Update, a SEPARATE later call on the SpewBox's own
+        // display path, not this chokepoint). Retail also has no empty-
+        // string guard here — AddTextToScroll broadcasts empty strings
+        // deliberately (the type-7/Magic s_NullBuffer sites reuse a shared
+        // buffer that can legitimately be empty between calls); inventing
+        // an early-return for empty text was an unregistered acdream-only
+        // divergence, now retired rather than kept as a guessed
+        // approximation.
+        text = text.Trim();
 
         if (type == RetailLogTextType.ClientLocal)
         {

src/AcDream.Runtime/RuntimeGenerationReset.cs

@@ -315,7 +315,24 @@ public sealed class RuntimeGenerationReset
                     state.Stage = RuntimeGenerationResetStage.ChatIdentity;
                     break;
                 case RuntimeGenerationResetStage.ChatIdentity:
-                    Advance(state, _communication.ResetChatIdentity);
+                    // CH2 REJECT-review rework (SHOULD-FIX 1,
+                    // docs/research/2026-08-09-ch2-review-findings.md):
+                    // RuntimeCommunicationState.ResetSpewBox was dead code —
+                    // no caller reset the transient SpewBox queue at
+                    // generation boundaries even though ResetChatIdentity
+                    // (the chat transcript's identity/dedup reset) already
+                    // ran here every generation. They share this stage
+                    // because they're the same lifetime boundary — a fresh
+                    // generation must not resurrect a stale refusal line —
+                    // even though they differ in WHAT they reset:
+                    // ResetChatIdentity preserves the visible transcript,
+                    // ResetSpewBox clears it (see RuntimeCommunicationState's
+                    // own doc comments on each).
+                    Advance(state, () =>
+                    {
+                        _communication.ResetChatIdentity();
+                        _communication.ResetSpewBox();
+                    });
                     break;
                 case RuntimeGenerationResetStage.PlayerSnapshots:
                     Advance(state, _inventory.ResetPlayerSnapshots);

src/AcDream.UI.Abstractions/Panels/Chat/ChatVM.cs

@@ -118,9 +118,24 @@ public sealed class ChatVM : IDisposable
     /// general-purpose output — @version, /loc, friends list, usage lines —
     /// and retail types the great majority of that informational command
     /// output <c>0x00</c>, reserving <c>0x1A</c> (bright red) for genuine
-    /// refusals/errors. The refusal-vs-informational split lands with CH2's
+    /// refusals/errors.
-    /// producer rewiring (SpewBox routing) — see
+    /// </remarks>
-    /// <c>docs/research/2026-08-09-chat-retail-interface-text.md</c> §7.2.
+    /// <remarks>
+    /// <b>Comment corrected 2026-08-09, CH2 REJECT-review rework (NIT 2,
+    /// docs/research/2026-08-09-ch2-review-findings.md):</b> the earlier
+    /// wording claimed the refusal-vs-informational split "lands with CH2's
+    /// producer rewiring" — it did not. CH2's SpewBox routing covers
+    /// <c>WeenieError</c>/<c>WeenieErrorWithString</c> ids, which carry their
+    /// own resolved <c>RetailLogTextType</c>; this sink takes plain
+    /// pre-formatted TEXT with no error code attached, so
+    /// <c>WeenieErrorMessages</c> has nothing to classify here. Per-call-site
+    /// classification of THIS sink's callers (which specific
+    /// <c>ClientCommandController</c> lines are genuine refusals retail
+    /// would type <c>0x1A</c>) remains unstarted, and even a classified
+    /// caller would still need retail's <c>windowId</c> dual-destination
+    /// echo (see register row AP-180) to land in both the SpewBox and the
+    /// command's originating chat window — out of scope for CH4/CH5, not
+    /// CH2.
     /// </remarks>
     public void ShowSystemMessage(string text) => _log.OnSystemMessage(text, chatType: 0x00u);
 

tests/AcDream.App.Tests/UI/SpewBoxControllerTests.cs

@@ -4,6 +4,17 @@ using AcDream.UI.Abstractions.Panels.SpewBox;
 
 namespace AcDream.App.Tests.UI;
 
+/// <summary>
+/// CH2 REJECT-review rework, BLOCKER 1
+/// (<c>docs/research/2026-08-09-ch2-review-findings.md</c>): these tests
+/// drive the controller's frame hook (<c>UiRoot.Tick</c>, the global-message-3
+/// broadcast) rather than calling <c>UiText.LinesProvider</c> directly. The
+/// original tests invoked the provider straight through, bypassing the
+/// <c>Visible</c> gate that <c>UiText.OnDraw</c> checks before ever polling
+/// it — that is exactly why the original bug (start-invisible → provider
+/// never called by drawing → no line ever visible, pending queue never
+/// drains) was invisible to the original test suite.
+/// </summary>
 public sealed class SpewBoxControllerTests
 {
     [Fact]
@@ -18,13 +29,18 @@ public sealed class SpewBoxControllerTests
 
         using (var controller = new SpewBoxController(root, new SpewBoxVM(state)))
         {
-            UiText text = Assert.IsType<UiText>(Assert.Single(root.Children));
+            UiText text = Assert.IsType<UiText>(root.Children.OfType<UiText>().Single());
             Assert.False(text.Visible);
             Assert.True(text.ClickThrough);
             Assert.Equal(int.MaxValue, text.ZOrder);
 
             state.Enqueue("You can't jump while in the air");
 
+            // Drive the frame hook, NOT the provider — this is the tick
+            // that drains the pending queue in production, wired through
+            // UiRoot.Tick's IUiGlobalTimeListener broadcast.
+            root.Tick(dt: 0d, nowMs: 1000L);
+
             UiText.Line line = Assert.Single(text.LinesProvider!());
             Assert.Equal("You can't jump while in the air", line.Text);
             Assert.True(text.Visible);
@@ -39,8 +55,92 @@ public sealed class SpewBoxControllerTests
         var root = new UiRoot { Width = 1280f, Height = 720f };
         using var controller = new SpewBoxController(root, new SpewBoxVM(new SpewBoxState()));
 
-        UiText text = Assert.IsType<UiText>(Assert.Single(root.Children));
+        root.Tick(dt: 0d, nowMs: 1000L);
+
+        UiText text = Assert.IsType<UiText>(root.Children.OfType<UiText>().Single());
         Assert.Empty(text.LinesProvider!());
         Assert.False(text.Visible);
     }
+
+    [Fact]
+    public void Controller_BecomesVisible_WithoutAnyDrawHavingHappenedFirst()
+    {
+        // BLOCKER 1 acceptance (a): the original bug was start-invisible →
+        // LinesProvider only reachable through UiElement.DrawSelfAndChildren
+        // (which returns early on !Visible) → provider never called → never
+        // visible. This test never calls anything draw-shaped — no OnDraw,
+        // no DrawSelfAndChildren, no UiRenderContext — only the tick.
+        var root = new UiRoot { Width = 1280f, Height = 720f };
+        var state = new SpewBoxState();
+        using var controller = new SpewBoxController(root, new SpewBoxVM(state));
+
+        UiText text = Assert.IsType<UiText>(root.Children.OfType<UiText>().Single());
+        Assert.False(text.Visible);
+
+        state.Enqueue("Out of Range!");
+        root.Tick(dt: 0d, nowMs: 500L);
+
+        Assert.True(text.Visible);
+        Assert.Equal("Out of Range!", Assert.Single(text.LinesProvider!()).Text);
+    }
+
+    [Fact]
+    public void Controller_PendingQueueDrains_WithoutAnyDrawPass()
+    {
+        // BLOCKER 1 acceptance (b): SpewBoxState.Tick is the only caller
+        // that drains _pending (SpewBoxState.cs's Queue<string>). Before the
+        // fix, that call only happened inside LinesProvider, which drawing
+        // gated behind Visible — so the pending queue was an unbounded
+        // per-session leak. Enqueue, tick the frame hook, and assert the
+        // underlying state actually drained (Count reflects the visible
+        // set, not the still-pending queue) — never touching drawing.
+        var root = new UiRoot { Width = 1280f, Height = 720f };
+        var state = new SpewBoxState();
+        using var controller = new SpewBoxController(root, new SpewBoxVM(state));
+
+        state.Enqueue("first");
+        Assert.Equal(0, state.Count); // still pending, not yet drained
+
+        root.Tick(dt: 0d, nowMs: 100L);
+
+        Assert.Equal(1, state.Count); // drained into the visible list
+        Assert.Equal("first", state.Snapshot()[0].Text);
+    }
+
+    [Fact]
+    public void Controller_QueueStaysBounded_AcrossManyTicksWithoutADrawPass()
+    {
+        // BLOCKER 1 acceptance (c): repeated enqueue+tick cycles must never
+        // let the visible set grow past SpewBoxState.MaxConcurrentItems
+        // (retail's code default, 1) — this is what "unbounded per-session
+        // leak" would have looked like if the drain never ran at all.
+        var root = new UiRoot { Width = 1280f, Height = 720f };
+        var state = new SpewBoxState();
+        using var controller = new SpewBoxController(root, new SpewBoxVM(state));
+
+        for (int i = 0; i < 50; i++)
+        {
+            state.Enqueue($"line {i}");
+            root.Tick(dt: 0d, nowMs: 1000L + i);
+            Assert.True(state.Count <= SpewBoxState.MaxConcurrentItems);
+        }
+
+        UiText text = Assert.IsType<UiText>(root.Children.OfType<UiText>().Single());
+        Assert.True(text.LinesProvider!().Count <= SpewBoxState.MaxConcurrentItems);
+        // Newest-at-top, matching retail's InsertItem(item, 0).
+        Assert.Equal("line 49", text.LinesProvider!()[0].Text);
+    }
+
+    [Fact]
+    public void Dispose_RemovesBothTheTextAndTheGlobalTimeSinkFromTheRoot()
+    {
+        var root = new UiRoot { Width = 1280f, Height = 720f };
+        var controller = new SpewBoxController(root, new SpewBoxVM(new SpewBoxState()));
+
+        Assert.Equal(2, root.Children.Count); // UiText + the tick sink
+
+        controller.Dispose();
+
+        Assert.Empty(root.Children);
+    }
 }

tests/AcDream.App.Tests/UI/SpewBoxLayoutDumpDiagnostic.cs

@@ -33,14 +33,32 @@ namespace AcDream.App.Tests.UI;
 /// appears to reference — exists but has zero top-level elements (it is
 /// not the per-line template catalog; that id must resolve through a
 /// different mechanism than a direct <c>dats.Get&lt;LayoutDesc&gt;</c> hit,
-/// which this slice did not crack). Conclusion: <c>gmSpewBoxUI</c> is
+/// which this slice did not crack).
-/// mounted directly from C++ code in <c>gmClient</c>'s HUD registration
+/// </para>
-/// block (research doc §1.1) rather than resolved from any authored
+///
-/// LayoutDesc tree — its position/extent/font/color/max-items are NOT
+/// <para>
-/// recoverable via this dump technique. Every value the SpewBox
+/// <b>RESULT 2, CH2 REJECT-review rework NIT 3
-/// presentation uses below is therefore an invented placeholder with its
+/// (2026-08-09, docs/research/2026-08-09-ch2-review-findings.md):</b> the
-/// own divergence-register row, exactly as the research doc's §3.2
+/// FIRST result above only ever swept <c>dats.Portal</c>. Extending the
-/// PRESENTATION-UNKNOWN section predicted.
+/// IDENTICAL sweep to <c>dats.Local</c> (<c>client_local_English.dat</c>)
+/// FINDS it: LayoutDesc <c>0x21000011</c>, element <c>0x10000048</c>
+/// (class <c>0x10000016</c>), position <c>(0,0)</c> relative to its parent,
+/// size <c>450×72</c>, one child — ListBox <c>0x10000049</c> (matching
+/// <c>gmSpewBoxUI::PostInit</c>'s <c>GetChildRecursive(0x10000049)</c> call
+/// verbatim, though its own widget-class <c>Type</c> is <c>0x00000005</c>,
+/// NOT the id <c>0x10000049</c> — <c>GetChildRecursive</c> searches by
+/// <c>ElementId</c>, not <c>Type</c>) — carrying <c>MaxConcurrentItems</c>
+/// (property <c>0x10000028</c>) = <c>4</c>. <c>gmSpewBoxUI</c> IS
+/// dat-authored after all; the earlier "mounted directly from C++ code...
+/// not resolved from any authored LayoutDesc tree" conclusion was an
+/// artifact of only having checked one of the two locale-bearing dats.
+/// Extent and <c>MaxConcurrentItems</c> are now AUTHORED, not invented —
+/// see <see cref="AcDream.Core.Chat.SpewBoxState.MaxConcurrentItems"/> and
+/// <c>SpewBoxController</c>'s own doc comments, and register row AP-178.
+/// Absolute screen position (the element's parent, hence its true screen
+/// offset, is still unidentified) and colour (no colour property surfaced
+/// in this element's direct-state dump; the per-<c>UIStateId</c>
+/// <c>States</c> dictionary was not walked) remain open.
 /// </para>
 /// </summary>
 public sealed class SpewBoxLayoutDumpDiagnostic
@@ -118,7 +136,7 @@ public sealed class SpewBoxLayoutDumpDiagnostic
                 _out.WriteLine(
                     $"    ListBox child 0x{listBox.ElementId:X8} "
                     + $"pos=({listBox.X},{listBox.Y}) size=({listBox.Width}x{listBox.Height})");
-                DumpProperties(listBox, "      ");
+                DumpProperties(listBox, "      ", _out.WriteLine);
             }
             else
             {
@@ -139,7 +157,7 @@ public sealed class SpewBoxLayoutDumpDiagnostic
                 _out.WriteLine(
                     $"  Line template 0x{LineTemplateElementId:X8}: type=0x{lineTemplate.Type:X8} "
                     + $"pos=({lineTemplate.X},{lineTemplate.Y}) size=({lineTemplate.Width}x{lineTemplate.Height})");
-                DumpProperties(lineTemplate, "    ");
+                DumpProperties(lineTemplate, "    ", _out.WriteLine);
             }
             else
             {
@@ -151,6 +169,95 @@ public sealed class SpewBoxLayoutDumpDiagnostic
             _out.WriteLine($"LayoutDesc 0x{LineTemplateLayoutEnum:X8} does not exist in the installed DAT.");
         }
 
+        // CH2 REJECT-review rework, NIT 3
+        // (docs/research/2026-08-09-ch2-review-findings.md): the original
+        // sweep above never consulted dats.Local (client_local_English.dat
+        // — research doc §8.1 names this file, not client_portal.dat, as
+        // the one that might carry locale-specific UI text/layout
+        // resources). Repeat the exact same class-0x10000016 sweep against
+        // Local's own LayoutDesc id space before trusting AP-178's
+        // "not dat-authored, no LayoutDesc dump can recover this" wording.
+        var localHits = new List<(uint LayoutId, ElementDesc Element)>();
+        int localScanned = 0;
+        List<uint> localIds = dats.Local.GetAllIdsOfType<LayoutDesc>().ToList();
+        _out.WriteLine($"Local.GetAllIdsOfType<LayoutDesc> count: {localIds.Count}");
+        if (localIds.Count > 0)
+            _out.WriteLine($"Local min id: 0x{localIds.Min():X8}  Local max id: 0x{localIds.Max():X8}");
+
+        foreach (uint layoutId in localIds)
+        {
+            localScanned++;
+            if (!dats.Local.TryGet<LayoutDesc>(layoutId, out LayoutDesc? ld) || ld is null)
+                continue;
+
+            foreach (var kv in ld.Elements)
+            {
+                var found = FindByType(kv.Value, SpewBoxElementClass);
+                if (found is not null)
+                    localHits.Add((layoutId, found));
+            }
+        }
+
+        _out.WriteLine($"Scanned {localScanned} dats.Local LayoutDescs.");
+        _out.WriteLine(
+            $"dats.Local elements of class 0x{SpewBoxElementClass:X8} (gmSpewBoxUI): {localHits.Count}");
+
+        foreach (var (layoutId, element) in localHits)
+        {
+            _out.WriteLine(
+                $"  [Local] LayoutDesc 0x{layoutId:X8} -> element 0x{element.ElementId:X8} "
+                + $"pos=({element.X},{element.Y}) size=({element.Width}x{element.Height}) "
+                + $"zLevel={element.ZLevel} readOrder={element.ReadOrder} "
+                + $"leftEdge={element.LeftEdge} topEdge={element.TopEdge} "
+                + $"rightEdge={element.RightEdge} bottomEdge={element.BottomEdge} "
+                + $"baseElement=0x{element.BaseElement:X8} baseLayoutId=0x{element.BaseLayoutId:X8} "
+                + $"children={element.Children.Count}");
+            DumpProperties(element, "    ", _out.WriteLine);
+            foreach (var (childId, child) in element.Children)
+            {
+                _out.WriteLine(
+                    $"    child 0x{childId:X8}: type=0x{child.Type:X8} "
+                    + $"pos=({child.X},{child.Y}) size=({child.Width}x{child.Height})");
+                DumpProperties(child, "      ", _out.WriteLine);
+            }
+
+            // NIT 3 finding: gmSpewBoxUI::PostInit's GetChildRecursive(0x10000049)
+            // searches by ELEMENT ID, not by the widget CLASS (Type) —
+            // ListBoxElementClass below was the wrong axis to search on
+            // (it collided with the decomp's 0x10000049 constant, which is
+            // actually this instance's authored ElementId; the ListBox
+            // widget's own Type turned out to be 0x00000005). Look the
+            // child up directly by the ElementId the decomp names.
+            if (element.Children.TryGetValue(ListBoxElementClass, out ElementDesc? listBoxById))
+            {
+                _out.WriteLine(
+                    $"    [Local] ListBox-by-ElementId 0x{listBoxById.ElementId:X8} "
+                    + $"(Type=0x{listBoxById.Type:X8}) "
+                    + $"pos=({listBoxById.X},{listBoxById.Y}) size=({listBoxById.Width}x{listBoxById.Height})");
+            }
+
+            var listBox = FindByType(element, ListBoxElementClass);
+            if (listBox is not null)
+            {
+                _out.WriteLine(
+                    $"    [Local] ListBox-by-Type child 0x{listBox.ElementId:X8} "
+                    + $"pos=({listBox.X},{listBox.Y}) size=({listBox.Width}x{listBox.Height})");
+                DumpProperties(listBox, "      ", _out.WriteLine);
+            }
+        }
+
+        if (dats.Local.TryGet<LayoutDesc>(LineTemplateLayoutEnum, out LayoutDesc? localTemplateLd)
+            && localTemplateLd is not null)
+        {
+            _out.WriteLine(
+                $"[Local] LayoutDesc 0x{LineTemplateLayoutEnum:X8} exists "
+                + $"({localTemplateLd.Elements.Count} top-level elements).");
+        }
+        else
+        {
+            _out.WriteLine($"[Local] LayoutDesc 0x{LineTemplateLayoutEnum:X8} does not exist.");
+        }
+
         // Informational only — this is a discovery sweep, not a pass/fail gate.
         // The findings are transcribed into WeenieErrorMessages/SpewBoxController
         // doc comments and the divergence register by hand after reading this
@@ -170,17 +277,24 @@ public sealed class SpewBoxLayoutDumpDiagnostic
         return null;
     }
 
-    private static void DumpProperties(ElementDesc d, string indent)
+    private static void DumpProperties(ElementDesc d, string indent, Action<string> write)
     {
+        // NIT 3 fix (docs/research/2026-08-09-ch2-review-findings.md): this
+        // used to write to Console.WriteLine unconditionally, which xUnit's
+        // "Standard Output Messages" capture does NOT show — a latent bug
+        // that only mattered once a hit with an actual property to dump
+        // existed (the original Portal-only sweep found none). Routed
+        // through the caller's ITestOutputHelper.WriteLine so a future run
+        // actually surfaces this.
         if (d.StateDesc?.Properties is null)
         {
-            System.Console.WriteLine($"{indent}(no direct-state properties)");
+            write($"{indent}(no direct-state properties)");
             return;
         }
 
         foreach (var (propertyId, property) in d.StateDesc.Properties)
         {
-            System.Console.WriteLine($"{indent}property 0x{propertyId:X8} = {Describe(property)}"
+            write($"{indent}property 0x{propertyId:X8} = {Describe(property)}"
                 + (propertyId == ListBoxMaxItemsProperty ? "  <-- MaxConcurrentItems" : ""));
         }
     }
@@ -190,6 +304,12 @@ public sealed class SpewBoxLayoutDumpDiagnostic
         DatReaderWriter.Types.EnumBaseProperty e => $"Enum({e.Value})",
         DatReaderWriter.Types.DataIdBaseProperty did => $"DataId(0x{did.Value:X8})",
         DatReaderWriter.Types.ArrayBaseProperty arr => $"Array[{arr.Value.Count}]({string.Join(", ", arr.Value.Select(Describe))})",
+        // NIT 3 fix: the original switch had no case for these two —
+        // Integer is exactly the type MaxConcurrentItems (property
+        // 0x10000028) uses, so without this case the diagnostic could
+        // find the property but never print its actual authored value.
+        DatReaderWriter.Types.IntegerBaseProperty i => $"Integer({i.Value})",
+        DatReaderWriter.Types.BoolBaseProperty b => $"Bool({b.Value})",
         _ => property.ToString() ?? "?",
     };
 }

tests/AcDream.Core.Net.Tests/GameEventWiringTests.cs

@@ -704,11 +704,15 @@ public sealed class GameEventWiringTests
         // Phase I.5: 0x028A previously had a parser
         // (GameEvents.ParseWeenieError) but no dispatcher registration. The
         // server fires this for plain game-logic failures (e.g. "you can't
-        // pick that up"). Now wired → ChatLog.OnWeenieError.
+        // pick that up"). Now wired → WeenieErrorMessages.Resolve +
+        // ChatLog.OnSystemMessage (the legacy no-router fallback;
+        // REJECT-review rework SHOULD-FIX 3 deleted the dedicated
+        // ChatLog.OnWeenieError chokepoint-bypass — see
+        // docs/research/2026-08-09-ch2-review-findings.md).
         var (d, _, _, _, chat) = MakeAll();
 
         byte[] payload = new byte[4];
-        BinaryPrimitives.WriteUInt32LittleEndian(payload, 0x9C);  // arbitrary error code
+        BinaryPrimitives.WriteUInt32LittleEndian(payload, 0x04Au);  // Ack! You killed yourself! (Default)
 
         var env = GameEventEnvelope.TryParse(WrapEnvelope(GameEventType.WeenieError, payload));
         d.Dispatch(env!.Value);
@@ -716,8 +720,29 @@ public sealed class GameEventWiringTests
         Assert.Equal(1, chat.Count);
         var e = chat.Snapshot()[0];
         Assert.Equal(ChatKind.System, e.Kind);
-        Assert.Equal(0x9Cu, e.ChannelId);
+        Assert.Equal("Ack! You killed yourself!", e.Text);
-        Assert.Contains("0x009C", e.Text);
+        Assert.Equal(0x00u, e.LogTextType);
+    }
+
+    [Fact]
+    public void WireAll_WeenieError_UnmappedCode_DoesNotReachChat()
+    {
+        // REJECT-review rework (SHOULD-FIX 4,
+        // docs/research/2026-08-09-ch2-review-findings.md): retail's
+        // HandleFailureEvent switch has no default case — an id it does not
+        // recognize produces NO text at all, silently, toward the player.
+        // The prior "WeenieError 0xNNNN" hex-fallback framing this test
+        // used to pin was acdream's own invention with no retail
+        // counterpart — an unregistered divergence, now retired.
+        var (d, _, _, _, chat) = MakeAll();
+
+        byte[] payload = new byte[4];
+        BinaryPrimitives.WriteUInt32LittleEndian(payload, 0x9C);  // arbitrary unmapped error code
+
+        var env = GameEventEnvelope.TryParse(WrapEnvelope(GameEventType.WeenieError, payload));
+        d.Dispatch(env!.Value);
+
+        Assert.Equal(0, chat.Count);
     }
 
     [Theory]
@@ -739,8 +764,29 @@ public sealed class GameEventWiringTests
     public void WireAll_WeenieErrorWithString_RoutesToChatLogWithInterpolation()
     {
         // Phase I.5: 0x028B carries an interpolated substring (e.g. the
-        // target's name in "you can't pick up the {Mana Stone}"). Now
+        // target's name). Now wired → WeenieErrorMessages.Resolve +
-        // wired → ChatLog.OnWeenieError with the param.
+        // ChatLog.OnSystemMessage (the legacy no-router fallback).
+        var (d, _, _, _, chat) = MakeAll();
+
+        byte[] interpBytes = MakeString16L("Caith");
+        byte[] payload = new byte[4 + interpBytes.Length];
+        BinaryPrimitives.WriteUInt32LittleEndian(payload, 0x0521u); // "%s has been added to the list of people you can hear."
+        Array.Copy(interpBytes, 0, payload, 4, interpBytes.Length);
+
+        var env = GameEventEnvelope.TryParse(WrapEnvelope(GameEventType.WeenieErrorWithString, payload));
+        d.Dispatch(env!.Value);
+
+        Assert.Equal(1, chat.Count);
+        var e = chat.Snapshot()[0];
+        Assert.Equal(ChatKind.System, e.Kind);
+        Assert.Equal("Caith has been added to the list of people you can hear.", e.Text);
+    }
+
+    [Fact]
+    public void WireAll_WeenieErrorWithString_UnmappedCode_DoesNotReachChat()
+    {
+        // REJECT-review rework (SHOULD-FIX 4): same retail-faithful silence
+        // as the plain WeenieError case above.
         var (d, _, _, _, chat) = MakeAll();
 
         byte[] interpBytes = MakeString16L("Mana Stone");
@@ -751,11 +797,7 @@ public sealed class GameEventWiringTests
         var env = GameEventEnvelope.TryParse(WrapEnvelope(GameEventType.WeenieErrorWithString, payload));
         d.Dispatch(env!.Value);
 
-        Assert.Equal(1, chat.Count);
+        Assert.Equal(0, chat.Count);
-        var e = chat.Snapshot()[0];
-        Assert.Equal(ChatKind.System, e.Kind);
-        Assert.Equal(0x42u, e.ChannelId);
-        Assert.Contains("Mana Stone", e.Text);
     }
 
     // ── Campaign CH slice CH2: onInterfaceText routing ───────────────────

tests/AcDream.Core.Tests/Chat/ChatLogTests.cs

@@ -131,38 +131,14 @@ public sealed class ChatLogTests
         Assert.Equal(0x90ABCDEFu, e.ChannelId);   // killer guid stashed here
     }
 
-    [Fact]
+    // OnWeenieError-specific tests (plain code, interpolation, silent
-    public void OnWeenieError_PlainCode_AppendsSystemEntry()
+    // client-control statuses) were removed here — REJECT-review rework
-    {
+    // (SHOULD-FIX 3, docs/research/2026-08-09-ch2-review-findings.md)
-        var log = new ChatLog();
+    // deletes ChatLog.OnWeenieError itself; every producer now resolves via
-        log.OnWeenieError(errorId: 0x1234, param: null);
+    // WeenieErrorMessages and calls the AddText chokepoint / OnSystemMessage
-        var e = log.Snapshot()[0];
+    // directly. Equivalent coverage lives in GameEventWiringTests.cs (the
-        Assert.Equal(ChatKind.System, e.Kind);
+    // inbound wire path) and WeenieErrorMessagesTests.cs (the resolve
-        Assert.Contains("0x1234", e.Text);
+    // table), including the silent-client-control-status behavior.
-        Assert.Equal(0x1234u, e.ChannelId);
-    }
-
-    [Fact]
-    public void OnWeenieError_WithString_AppendsInterpolation()
-    {
-        var log = new ChatLog();
-        log.OnWeenieError(errorId: 0x5678, param: "Mana Stone");
-        var e = log.Snapshot()[0];
-        Assert.Equal(ChatKind.System, e.Kind);
-        Assert.Contains("Mana Stone", e.Text);
-    }
-
-    [Theory]
-    [InlineData(0x003Bu)] // ILeftTheWorld
-    [InlineData(0x003Cu)] // ITeleported
-    public void OnWeenieError_RetailSilentClientControlStatus_DoesNotAppend(uint code)
-    {
-        var log = new ChatLog();
-
-        log.OnWeenieError(code, param: null);
-
-        Assert.Empty(log.Snapshot());
-    }
 
     [Fact]
     public void OnLocalSpeech_EmptySender_SubstitutesYou()
@@ -256,14 +232,6 @@ public sealed class ChatLogTests
         Assert.Equal(0x00u, log.Snapshot()[0].LogTextType);
     }
 
-    [Fact]
-    public void OnWeenieError_LogTextType_IsDefault()
-    {
-        var log = new ChatLog();
-        log.OnWeenieError(errorId: 0x1234, param: null);
-        Assert.Equal(0x00u, log.Snapshot()[0].LogTextType);
-    }
-
     [Fact]
     public void OnPopup_LogTextType_IsDefault()
     {

tests/AcDream.Core.Tests/Chat/SpewBoxStateTests.cs

@@ -37,23 +37,22 @@ public sealed class SpewBoxStateTests
     [Fact]
     public void Tick_InsertsNewestAtIndexZero()
     {
-        // Retail: InsertItem(item, 0) — with MaxConcurrentItems raised past
+        // Retail: InsertItem(item, 0) — CH2 REJECT-review rework NIT 3
-        // the code default of 1, newer entries must lead the visible list.
+        // raised MaxConcurrentItems from the code default (1) to the
+        // AUTHORED LayoutDesc value (4, see SpewBoxState.MaxConcurrentItems's
+        // own doc comment), so two entries now comfortably coexist without
+        // triggering the overflow rule — this test can assert the ordering
+        // guarantee directly instead of relying on eviction as a side effect.
         var state = new SpewBoxState();
         state.Enqueue("first");
         state.Tick(0d);
         state.Enqueue("second");
         state.Tick(0d);
 
-        // MaxConcurrentItems == 1 (retail code default) means "first" was
+        Assert.Equal(2, state.Count);
-        // already evicted by the overflow rule — assert directly on the
+        SpewBoxEntry[] snapshot = state.Snapshot();
-        // ordering guarantee instead by forcing a raised cap via reflection
+        Assert.Equal("second", snapshot[0].Text);
-        // is out of scope; the dedupe/overflow tests below cover that
+        Assert.Equal("first", snapshot[1].Text);
-        // interaction precisely. Here we only need the single surviving
-        // entry to be "second" (the newest), proving insert-at-front beat
-        // whatever eviction order a stack (insert-at-back) would produce.
-        SpewBoxEntry entry = Assert.Single(state.Snapshot());
-        Assert.Equal("second", entry.Text);
     }
 
     [Fact]
@@ -78,33 +77,43 @@ public sealed class SpewBoxStateTests
     [Fact]
     public void Tick_DifferentText_DoesNotDedupe()
     {
+        // CH2 REJECT-review rework NIT 3: with the AUTHORED
+        // MaxConcurrentItems == 4, two distinct messages both fit without
+        // any eviction — dedupe (index-0-only) is the only thing that could
+        // collapse them, and it correctly does not apply to different text.
         var state = new SpewBoxState();
         state.Enqueue("first message");
         state.Tick(0d);
         state.Enqueue("second message");
         state.Tick(0d);
 
-        // With MaxConcurrentItems == 1, "second message" evicts "first
+        Assert.Equal(2, state.Count);
-        // message" via overflow, not dedupe — either way only one survives,
+        SpewBoxEntry[] snapshot = state.Snapshot();
-        // and it must be the newest.
+        Assert.Equal("second message", snapshot[0].Text);
-        SpewBoxEntry entry = Assert.Single(state.Snapshot());
+        Assert.Equal("first message", snapshot[1].Text);
-        Assert.Equal("second message", entry.Text);
     }
 
     [Fact]
     public void Tick_Overflow_DropsOldest_RespectingMaxConcurrentItems()
     {
+        // CH2 REJECT-review rework NIT 3: MaxConcurrentItems is the
+        // AUTHORED LayoutDesc value (4), not retail's code default (1) —
+        // enqueue past the cap to actually exercise the overflow rule.
         var state = new SpewBoxState();
-        Assert.Equal(1, SpewBoxState.MaxConcurrentItems);
+        Assert.Equal(4, SpewBoxState.MaxConcurrentItems);
 
-        state.Enqueue("oldest");
+        for (int i = 0; i < SpewBoxState.MaxConcurrentItems + 1; i++)
-        state.Tick(0d);
+        {
-        state.Enqueue("newer");
+            state.Enqueue($"line {i}");
-        state.Tick(0d);
+            state.Tick(0d);
+        }
 
         Assert.Equal(SpewBoxState.MaxConcurrentItems, state.Count);
-        SpewBoxEntry entry = Assert.Single(state.Snapshot());
+        SpewBoxEntry[] snapshot = state.Snapshot();
-        Assert.Equal("newer", entry.Text);
+        // Newest at index 0; "line 0" (the oldest) dropped by overflow.
+        Assert.Equal("line 4", snapshot[0].Text);
+        Assert.Equal("line 1", snapshot[3].Text);
+        Assert.DoesNotContain(snapshot, e => e.Text == "line 0");
     }
 
     [Fact]

tests/AcDream.Core.Tests/Chat/WeenieErrorMessagesTests.cs

@@ -42,18 +42,22 @@ public sealed class WeenieErrorMessagesTests
     // ── known codes — informational, no parameter ────────────────────
 
     [Fact]
-    public void Format_0x051D_FallsBackToHex_NoRetailCaseExists()
+    public void Format_0x051D_ReturnsNull_NoRetailCaseExists()
     {
         // Campaign CH slice CH2: the pre-CH2 "Turbine Chat is enabled."
         // text for 0x051D was an ACE-derived guess, never decomp-confirmed.
         // The full HandleFailureEvent port found NO case for 0x51D anywhere
         // in the switch (only 0x51C has one — case 0x51c: at raw line
         // 383115-383118 of acclient_2013_pseudo_c.txt) — retail's own
-        // client simply has no display text for this id. Falling back to
+        // client simply has no display text for this id.
-        // the generic form is now the retail-faithful answer, not a gap.
+        //
-        Assert.Equal(
+        // REJECT-review rework (SHOULD-FIX 4,
-            "WeenieError 0x051D",
+        // docs/research/2026-08-09-ch2-review-findings.md): retail's switch
-            WeenieErrorMessages.Format(0x051D, param: null));
+        // has no default case — an unhandled id produces NO text, silently,
+        // toward the player. Format now returns null rather than inventing
+        // a "WeenieError 0xNNNN" hex fallback that has no retail
+        // counterpart.
+        Assert.Null(WeenieErrorMessages.Format(0x051D, param: null));
     }
 
     // ── known codes — error-level ────────────────────────────────────
@@ -167,27 +171,31 @@ public sealed class WeenieErrorMessagesTests
             WeenieErrorMessages.Format(0x04EE, null));
     }
 
-    // ── unknown codes — graceful fallback preserves debug info ───────
+    // ── unknown codes — retail-faithful silence (SHOULD-FIX 4) ───────
+    //
+    // docs/research/2026-08-09-ch2-review-findings.md SHOULD-FIX 4: retail's
+    // HandleFailureEvent switch has no default case — an id it does not
+    // recognize produces NO text at all, toward the player. The prior
+    // "WeenieError 0xNNNN[: param]" hex fallback was acdream's own
+    // invention with no retail counterpart. These three tests are flipped
+    // (not deleted) to pin the new null-means-silence contract.
 
     [Fact]
-    public void Format_UnknownCode_NoParam_FallsBackToHexForm()
+    public void Format_UnknownCode_NoParam_ReturnsNull()
     {
-        Assert.Equal("WeenieError 0xABCD", WeenieErrorMessages.Format(0xABCD, null));
+        Assert.Null(WeenieErrorMessages.Format(0xABCD, null));
     }
 
     [Fact]
-    public void Format_UnknownCode_WithParam_FallsBackToColonForm()
+    public void Format_UnknownCode_WithParam_ReturnsNull()
     {
-        Assert.Equal(
+        Assert.Null(WeenieErrorMessages.Format(0xDEAD, "Mana Stone"));
-            "WeenieError 0xDEAD: Mana Stone",
-            WeenieErrorMessages.Format(0xDEAD, "Mana Stone"));
     }
 
     [Fact]
-    public void Format_UnknownCode_EmptyParam_StaysAsHexOnly()
+    public void Format_UnknownCode_EmptyParam_ReturnsNull()
     {
-        // Empty string param shouldn't add a stray colon.
+        Assert.Null(WeenieErrorMessages.Format(0xCAFE, ""));
-        Assert.Equal("WeenieError 0xCAFE", WeenieErrorMessages.Format(0xCAFE, ""));
     }
 
     // ── parameterised templates with non-trivial params ──────────────
@@ -201,17 +209,18 @@ public sealed class WeenieErrorMessagesTests
     }
 
     [Fact]
-    public void Format_0x004F_FallsBackToHex_NoRetailCaseExists()
+    public void Format_0x004F_ResolvesToRetailText()
     {
-        // Campaign CH slice CH2: the pre-CH2 "You fail to affect _ because
+        // REJECT-review rework (BLOCKER 2,
-        // they cannot be harmed!" text for 0x004F was an ACE-derived guess.
+        // docs/research/2026-08-09-ch2-review-findings.md): the prior
-        // Direct decomp verification (grepping every "case 0x4f:" in
+        // "grep for a case label" transcription missed 0x04F because it
-        // ClientCommunicationSystem::HandleFailureEvent's whole body) found
+        // dispatches via `else if (arg2 == 0x4f)`, not a switch case label.
-        // NONE — only 0x4E, 0x50, 0x51, 0x52, 0x53, 0x54 have cases; 0x4F is
+        // The binary sweep found its sprintf format string directly
-        // skipped entirely, same as the many other gaps in that switch's
+        // (VA 0x00571e23, in ClientCommunicationSystem::HandleFailureEvent's
-        // sparse jump table. Retail has no display text for this id.
+        // else-if chain). Retail preserves its own $s typo (only the first
+        // %s substitutes), same pattern as 0x4F4.
         Assert.Equal(
-            "WeenieError 0x004F: Drudge",
+            "You fail to affect Drudge because $s cannot be harmed!",
             WeenieErrorMessages.Format(0x004F, "Drudge"));
     }
 
@@ -226,34 +235,87 @@ public sealed class WeenieErrorMessagesTests
     // ── Campaign CH slice CH2: the full HandleFailureEvent table port ────
 
     /// <summary>
-    /// Pins the table's size: 338 rows (Appendix A's 339 minus the one
+    /// Pins the table's size: 344 rows. REJECT-review rework (BLOCKER 2,
-    /// deliberately-excluded 0x4F8, see the class doc comment on
+    /// docs/research/2026-08-09-ch2-review-findings.md) added the 5 ids the
-    /// <see cref="WeenieErrorMessages"/>). A change to this number without
+    /// prior pass's case-label enumeration missed (dispatched via
-    /// a matching research/commit citation is a red flag, not a routine
+    /// <c>else if</c> chains, not switch cases) plus <c>0x4F8</c>, which now
-    /// edit.
+    /// resolves for real instead of being deliberately excluded: 338 + 5 + 1
+    /// = 344. A change to this number without a matching research/commit
+    /// citation is a red flag, not a routine edit.
     /// </summary>
     [Fact]
-    public void Resolve_FullTable_HasExactly338Rows()
+    public void Resolve_FullTable_HasExactly344Rows()
     {
         int count = 0;
         for (uint id = 0; id <= 0x600u; id++)
         {
             var (text, _) = WeenieErrorMessages.Resolve(id, null);
-            if (!text.StartsWith("WeenieError 0x", StringComparison.Ordinal))
+            if (text is not null)
                 count++;
         }
-        Assert.Equal(338, count);
+        Assert.Equal(344, count);
     }
 
     [Fact]
-    public void Resolve_0x4F8_IsDeliberatelyExcluded_FallsBackToHex()
+    public void Resolve_0x4F8_NowResolvesForReal()
     {
-        // See the class doc comment: 0x4F8's case body is a tangled
+        // REJECT-review rework (BLOCKER 2): the prior pass excluded 0x4F8
-        // multi-operator+ decompiler artifact that could not be resolved
+        // because its case body's 3-operator+ concatenation chain has
-        // with confidence — excluded rather than guessed.
+        // confusing BN-generated self-referential operand names. The binary
+        // sweep dereferenced both literal data pointers directly
+        // (data_7d2ee8, data_7d2f80), sidestepping the naming confusion.
+        // Both %s placeholders substitute the SAME parameter (retail only
+        // has one arg3 to concatenate twice).
         var (text, type) = WeenieErrorMessages.Resolve(0x4F8, "Someone");
-        Assert.Equal("WeenieError 0x04F8: Someone", text);
+        Assert.Equal(
-        Assert.Equal(RetailLogTextType.Default, type);
+            "Someone fails to affect you because you are not the same sort of player killer as Someone!",
+            text);
+        Assert.Equal(RetailLogTextType.Magic, type);
+    }
+
+    // ── REJECT-review rework (BLOCKER 2): every corrected/added row ──────
+    //
+    // docs/research/2026-08-09-ch2-review-findings.md — pins the exact text
+    // for every id the binary sweep + ACE cross-check corrected or added
+    // this pass, so a future regression to the wrong (previously-landed)
+    // text fails loudly instead of silently.
+
+    [Theory]
+    // 5 ids added — missed by the prior case-label enumeration because
+    // they dispatch via `else if (arg2 == N)`, not a switch case.
+    [InlineData(0x04Fu, "You fail to affect %s because $s cannot be harmed!", RetailLogTextType.Magic)]
+    [InlineData(0x3EEu, "The container is closed!", RetailLogTextType.ClientLocal)]
+    [InlineData(0x408u, "Your spell cannot be cast inside", RetailLogTextType.ClientLocal)]
+    [InlineData(0x48Au, "You must be a monarch to purchase this dwelling.", RetailLogTextType.Default)]
+    [InlineData(0x4E8u, "The %s cannot be used while on a hook and only the owner may open the hook.", RetailLogTextType.Default)]
+    // 16 ids corrected per the review's own flagged list.
+    [InlineData(0x051u, "You fail to affect %s because you are not a player killer!", RetailLogTextType.Magic)]
+    [InlineData(0x053u, "You fail to affect %s because you are not the same sort of player killer as %s!", RetailLogTextType.Magic)]
+    [InlineData(0x054u, "You fail to affect %s because you are acting across a house boundary!", RetailLogTextType.Magic)]
+    [InlineData(0x466u, "You must purchase Asheron's Call: Dark Majesty to interact with that portal.", RetailLogTextType.Magic)]
+    [InlineData(0x4A3u, "You must have linked with a portal in order to recall to it!", RetailLogTextType.Magic)]
+    [InlineData(0x4B5u, "You must specify a character to query.", RetailLogTextType.ClientLocal)]
+    [InlineData(0x4E0u, "You are currently wielding items which require a certain level of skill. Your attributes cannot be transferred while you are wielding these items. Please remove these items and try again.", RetailLogTextType.Default)]
+    [InlineData(0x4F7u, "%s fails to affect you because you are not a player killer!", RetailLogTextType.Magic)]
+    [InlineData(0x544u, "An unspecified error occurred while attempting to remove %s as an allegiance officer.", RetailLogTextType.Default)]
+    [InlineData(0x54Eu, "The hook does not contain a usable item. You cannot open the hook because you do not own the house to which it belongs.", RetailLogTextType.Default)]
+    [InlineData(0x552u, "You must purchase Asheron's Call -- Throne of Destiny to use this function.", RetailLogTextType.ClientLocal)]
+    [InlineData(0x553u, "You must purchase Asheron's Call -- Throne of Destiny to use this item.", RetailLogTextType.ClientLocal)]
+    [InlineData(0x554u, "You must purchase Asheron's Call -- Throne of Destiny to use this portal.", RetailLogTextType.ClientLocal)]
+    [InlineData(0x555u, "You must purchase Asheron's Call -- Throne of Destiny to access this quest.", RetailLogTextType.ClientLocal)]
+    [InlineData(0x57Fu, "Your allegiance chat privileges have been temporarily removed by %s. Until they are restored, you may not view or speak in the allegiance chat channel.", RetailLogTextType.Default)]
+    [InlineData(0x582u, "Your allegiance chat privileges have been restored by %s.", RetailLogTextType.Default)]
+    // 2 ids corrected that were NOT in the review's flagged list — found by
+    // an automated diff between the swept binary literals and the landed
+    // table (the review's own "sweep may find more" prediction).
+    [InlineData(0x4E9u, "The %s cannot be used while on a hook, use the '@house hooks on' command to make the hook openable.", RetailLogTextType.Default)]
+    [InlineData(0x518u, "This fellowship is locked; %s cannot be recruited into the fellowship.", RetailLogTextType.Default)]
+    public void Resolve_Blocker2CorrectedRows_MatchTheSweptBinaryLiteral(
+        uint id, string expectedTemplate, RetailLogTextType expectedType)
+    {
+        var (text, type) = WeenieErrorMessages.Resolve(id, param: null);
+        Assert.Equal(expectedTemplate, text);
+        Assert.Equal(expectedType, type);
     }
 
     // ── spot pins across all three retail routing destinations ──────────

tests/AcDream.Runtime.Tests/Gameplay/RuntimeCommunicationStateTests.cs

@@ -207,27 +207,38 @@ public sealed class RuntimeCommunicationStateTests
     }
 
     [Fact]
-    public void AddText_TrimsTrailingWhitespace_LikeRetailAddTextToScroll()
+    public void AddText_TrimsBothEnds_LikeRetailAddTextToScroll()
     {
+        // CH2 REJECT-review rework (SHOULD-FIX 2,
+        // docs/research/2026-08-09-ch2-review-findings.md): retail's
+        // AddTextToScroll @0x00563C50 calls trim(&str, 1, 1, ws) — BOTH
+        // ends, not trailing-only.
         using var state = new RuntimeCommunicationState();
 
-        state.AddText("Out of Range!   ", RetailLogTextType.ClientLocal);
+        state.AddText("   Out of Range!   ", RetailLogTextType.ClientLocal);
 
         state.SpewBox.Tick(0d);
         Assert.Equal("Out of Range!", state.SpewBox.Snapshot()[0].Text);
     }
 
     [Fact]
-    public void AddText_EmptyAfterTrim_IsDropped()
+    public void AddText_EmptyAfterTrim_StillBroadcasts_LikeRetail()
     {
+        // CH2 REJECT-review rework (SHOULD-FIX 2): retail's
+        // AddTextToScroll has no empty-string guard — the previous
+        // early-return was an unregistered acdream-only divergence, now
+        // retired. An all-whitespace message still reaches its destination
+        // as an empty string.
         using var state = new RuntimeCommunicationState();
 
         state.AddText("   ", RetailLogTextType.ClientLocal);
         state.AddText("   ", RetailLogTextType.Default);
 
         state.SpewBox.Tick(0d);
-        Assert.Equal(0, state.SpewBox.Count);
+        Assert.Equal(1, state.SpewBox.Count);
-        Assert.Equal(0, state.Chat.Count);
+        Assert.Equal("", state.SpewBox.Snapshot()[0].Text);
+        Assert.Equal(1, state.Chat.Count);
+        Assert.Equal("", state.Chat.Snapshot()[0].Text);
     }
 
     [Fact]

tests/AcDream.Runtime.Tests/RuntimeGenerationResetTests.cs

@@ -46,6 +46,7 @@ public sealed class RuntimeGenerationResetTests
         runtime.ActionOwner.Combat.SetCombatMode(CombatMode.Missile);
         runtime.CommunicationOwner.Chat.SetLocalPlayerGuid(player);
         runtime.CommunicationOwner.Chat.OnSystemMessage("retained", 1u);
+        runtime.CommunicationOwner.SpewBox.Enqueue("about to be torn down");
         _ = runtime.MovementOwner.Execute(
             RuntimeMovementCommand.ToggleRunLock);
         var observer = new RecordingObserver();
@@ -81,6 +82,13 @@ public sealed class RuntimeGenerationResetTests
         Assert.Equal(CombatMode.NonCombat, runtime.Actions.Snapshot.CombatMode);
         Assert.False(runtime.MovementOwner.AutoRunActive);
         Assert.Equal(1, runtime.CommunicationOwner.Chat.Count);
+        // SHOULD-FIX 1 (docs/research/2026-08-09-ch2-review-findings.md):
+        // ResetSpewBox was dead code — a fresh generation must not
+        // resurrect a stale refusal line. Assert BOTH that the pending
+        // enqueue never surfaces (no leftover Tick drains it into
+        // visibility) and that Reset itself converges Count to zero.
+        runtime.CommunicationOwner.SpewBox.Tick(0d);
+        Assert.Equal(0, runtime.CommunicationOwner.SpewBox.Count);
         Assert.Null(
             runtime.CommunicationOwner.CommandTargets.LastIncomingTellSender);
         Assert.False(runtime.GenerationReset.CaptureSnapshot().IsActive);

tests/AcDream.UI.Abstractions.Tests/Panels/SpewBox/SpewBoxVMTests.cs

@@ -48,6 +48,10 @@ public sealed class SpewBoxVMTests
     [Fact]
     public void Lines_NewestFirst_MatchesRetailInsertAtZero()
     {
+        // CH2 REJECT-review rework NIT 3: MaxConcurrentItems is the
+        // AUTHORED LayoutDesc value (4, see SpewBoxState.MaxConcurrentItems's
+        // own doc comment), not retail's code default (1) — both entries
+        // now survive, so assert the ordering directly.
         var state = new SpewBoxState();
         var vm = new SpewBoxVM(state);
         state.Enqueue("older");
@@ -56,11 +60,9 @@ public sealed class SpewBoxVMTests
 
         IReadOnlyList<SpewBoxLine> lines = vm.Lines(0d);
 
-        // MaxConcurrentItems == 1 means only the newest survives, which is
+        Assert.Equal(2, lines.Count);
-        // itself proof insertion happens at the front (retail's overflow
+        Assert.Equal("newer", lines[0].Text);
-        // rule drops the OLDEST / highest index, not the newest).
+        Assert.Equal("older", lines[1].Text);
-        SpewBoxLine line = Assert.Single(lines);
-        Assert.Equal("newer", line.Text);
     }
 
     [Fact]

tools/pdb-extract/sweep_weenie_strings.py

@@ -0,0 +1,184 @@
+"""Sweep `push imm32` (0x68) operands inside a VA range of a PE binary,
+dereference each into a data section (.rdata/.data), and decode any that
+resolve to a printable UTF-16LE literal.
+
+Built for the CH2 REJECT-review rework (BLOCKER 2,
+docs/research/2026-08-09-ch2-review-findings.md) to re-derive
+ClientCommunicationSystem::HandleFailureEvent (@0x00571990)'s 344-row
+display-string table from ground truth instead of the Binary Ninja
+pseudo-C's ~33-char inline preview -- the same class of problem
+check_exe_pdb.py and dump_pdb_info.py solve for PDB metadata, applied to
+wide-string literal recovery. Not tied to WeenieError specifically: any VA
+range in any PDB-paired PE binary works.
+
+ALWAYS run check_exe_pdb.py first to confirm the candidate .exe pairs with
+the PDB you're cross-referencing addresses against -- a mismatched binary
+will produce confident-looking garbage.
+
+Usage:
+    py tools/pdb-extract/sweep_weenie_strings.py <exe_path> --range 0x571990 0x575480 [--min-len 4]
+    py tools/pdb-extract/sweep_weenie_strings.py <exe_path> --anchor 0x005750a5 [--window 64]
+    py tools/pdb-extract/sweep_weenie_strings.py <exe_path> --deref 0x007d2ee8
+
+--range LO HI   sweep every string-valued push imm32 in [LO, HI)
+--anchor VA     search backward `--window` bytes from a case-body/call-site
+                VA (taken from the pseudo-C) for the nearest string-valued
+                push -- use when you already know roughly where a specific
+                case lives and just need its untruncated literal
+--deref VA      dereference one known data pointer directly (e.g. a
+                `data_XXXXXXXX` symbol name from the pseudo-C, which
+                directly encodes its own VA in hex)
+--min-len N     minimum decoded string length to report (default 3);
+                raise this to cut noise from short accidental hits
+"""
+import argparse
+import struct
+
+
+class PeImage:
+    def __init__(self, path):
+        with open(path, "rb") as f:
+            self.data = f.read()
+        if self.data[0:2] != b"MZ":
+            raise ValueError("not a PE file (no MZ)")
+        e_lfanew = struct.unpack_from("<I", self.data, 0x3C)[0]
+        if self.data[e_lfanew:e_lfanew + 4] != b"PE\0\0":
+            raise ValueError("no PE signature")
+        coff_off = e_lfanew + 4
+        machine, num_sections, ts, symtab, numsym, opt_hdr_size, characteristics = \
+            struct.unpack_from("<HHIIIHH", self.data, coff_off)
+        opt_off = coff_off + 20
+        magic = struct.unpack_from("<H", self.data, opt_off)[0]
+        if magic != 0x10B:
+            raise ValueError(f"unexpected optional header magic 0x{magic:04x} (want PE32)")
+        self.image_base = struct.unpack_from("<I", self.data, opt_off + 28)[0]
+        sec_off = opt_off + opt_hdr_size
+        self.sections = []
+        for i in range(num_sections):
+            rec = self.data[sec_off + i * 40: sec_off + (i + 1) * 40]
+            name = rec[0:8].rstrip(b"\0").decode("ascii", "replace")
+            virt_size, virt_addr, raw_size, raw_ptr = struct.unpack_from("<IIII", rec, 8)
+            self.sections.append({
+                "name": name,
+                "va": self.image_base + virt_addr,
+                "vsize": virt_size,
+                "raw_ptr": raw_ptr,
+                "raw_size": raw_size,
+            })
+
+    def section_for_va(self, va):
+        for s in self.sections:
+            if s["va"] <= va < s["va"] + max(s["vsize"], s["raw_size"]):
+                return s
+        return None
+
+    def va_to_off(self, va):
+        s = self.section_for_va(va)
+        if s is None:
+            return None
+        off = s["raw_ptr"] + (va - s["va"])
+        if off < 0 or off >= len(self.data):
+            return None
+        return off
+
+    def read_bytes(self, va, n):
+        off = self.va_to_off(va)
+        if off is None:
+            return None
+        return self.data[off:off + n]
+
+    def read_utf16_cstr(self, va, max_chars=400):
+        off = self.va_to_off(va)
+        if off is None:
+            return None
+        out = []
+        for i in range(max_chars):
+            chunk = self.data[off + i * 2: off + i * 2 + 2]
+            if len(chunk) < 2:
+                break
+            code = struct.unpack("<H", chunk)[0]
+            if code == 0:
+                return "".join(out)
+            # Reject control chars other than the ones AC strings legitimately
+            # use (\n, \t) -- anything else means we've wandered off a real
+            # string into unrelated data and should not report a hit.
+            if code < 0x20 and code not in (0x0A, 0x09):
+                return None
+            if code > 0x2FFF:
+                return None
+            out.append(chr(code))
+        return None  # ran off the end without a NUL -- not a bounded literal
+
+    def is_data_section(self, va):
+        s = self.section_for_va(va)
+        return s is not None and s["name"] in (".rdata", ".data")
+
+    def sweep_push_imm32(self, lo, hi, min_len=3):
+        """Scan [lo, hi) for `push imm32` (opcode 0x68) whose operand VA
+        dereferences to a UTF-16LE string in .rdata/.data. Returns a list
+        of (instr_va, target_va, text)."""
+        hits = []
+        off_lo = self.va_to_off(lo)
+        off_hi = self.va_to_off(hi)
+        if off_lo is None or off_hi is None:
+            raise ValueError("range not mapped")
+        i = off_lo
+        while i < off_hi - 4:
+            if self.data[i] == 0x68:
+                operand = struct.unpack_from("<I", self.data, i + 1)[0]
+                if self.is_data_section(operand):
+                    text = self.read_utf16_cstr(operand)
+                    if text is not None and len(text) >= min_len:
+                        instr_va = lo + (i - off_lo)
+                        hits.append((instr_va, operand, text))
+            i += 1
+        return hits
+
+    def find_push_before(self, anchor_va, window=64, min_len=3):
+        """Search backward from anchor_va (a call-site VA taken from the
+        pseudo-C) for the nearest preceding `push imm32` whose operand
+        dereferences to a printable UTF-16LE string."""
+        lo = anchor_va - window
+        return self.sweep_push_imm32(lo, anchor_va + 2, min_len=min_len)
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("exe")
+    ap.add_argument("--range", nargs=2, metavar=("LO", "HI"))
+    ap.add_argument("--anchor", action="append", default=[])
+    ap.add_argument("--window", type=int, default=64)
+    ap.add_argument("--deref", action="append", default=[])
+    ap.add_argument("--min-len", type=int, default=3)
+    args = ap.parse_args()
+
+    pe = PeImage(args.exe)
+    print(f"ImageBase=0x{pe.image_base:08x}  sections:")
+    for s in pe.sections:
+        print(f"  {s['name']:<9} VA=0x{s['va']:08x} vsize=0x{s['vsize']:06x} "
+              f"rawptr=0x{s['raw_ptr']:08x} rawsize=0x{s['raw_size']:06x}")
+    print()
+
+    if args.range:
+        lo = int(args.range[0], 16)
+        hi = int(args.range[1], 16)
+        hits = pe.sweep_push_imm32(lo, hi, min_len=args.min_len)
+        print(f"# sweep 0x{lo:08x}-0x{hi:08x}: {len(hits)} string-valued push imm32 sites")
+        for instr_va, target_va, text in hits:
+            print(f"0x{instr_va:08x}  -> data_0x{target_va:08x}  {text!r}")
+
+    for a in args.anchor:
+        anchor = int(a, 16)
+        hits = pe.find_push_before(anchor, window=args.window, min_len=args.min_len)
+        print(f"\n# anchor 0x{anchor:08x} (window={args.window}): {len(hits)} hits")
+        for instr_va, target_va, text in hits:
+            print(f"0x{instr_va:08x}  -> data_0x{target_va:08x}  {text!r}")
+
+    for d in args.deref:
+        target = int(d, 16)
+        text = pe.read_utf16_cstr(target)
+        print(f"\n# deref 0x{target:08x}: {text!r}")
+
+
+if __name__ == "__main__":
+    main()