feat(chat): CT-B2 — "/r " expands to a tell at whoever last told you

Campaign CT slice B2, and the autocomplete the user asked about directly.

Typing "/r " now rewrites the chat entry to "@tell {LastTeller}, " the moment
the space lands, matching ChatInterface::HandleTextReplacements @0x004F50D0 ->
SetReplyTextInChatBox @0x004F4760.

This is display sugar rather than routing: "/r hello" already SENT correctly
through ChatInputParser's reply aliases. What was missing is that the player
could not SEE who they were about to reply to before pressing enter.

The trigger strings came out of the constant pool, not the decompiled listing —
Binary Ninja renders them as bare data_* references with no preview:

    data_7C4C70 = "r "      data_7C4C68 = "rp "      data_7C4C58 = "reply "

Retail stores them WITHOUT the leading prefix and tests the first character
separately against '/' (0x2F) or '@' (0x40), which is why both prefixes work.
The research summary for this area listed the triggers as "/t ", "/tell " and
"reply " — reading the pool corrected that.

Three boundaries, each pinned by test because each is a way to get this subtly
wrong:

  - The trailing space is PART of the trigger. "/r" alone must be left alone —
    the player may still be typing "/roleplay", and expanding early would
    hijack a different command mid-word.
  - Only on space. Running the replacer per keystroke would rewrite text out
    from under someone mid-word; retail keys on 0x20 specifically.
  - Only with the caret at the end. Otherwise the player is editing existing
    text, and expanding would corrupt a sentence they are part way through
    fixing.

With nobody to reply to, nothing is rewritten — retail leaves the text alone
rather than producing a tell addressed to nobody, and the ordinary submit path
still reports "Someone must @tell you first!".

Solution builds clean; full hermetic gate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.App/UI/Layout/ChatWindowController.cs

@@ -363,6 +363,10 @@ public sealed class ChatWindowController : IRetainedWindowStateController, IReta
         // its own authored background sprite (0x0600113A); same reasoning as the
         // transcript above.
         c.Input.SpriteResolve = resolve;
+        // Campaign CT slice B2: expand "/r " to "@tell {LastTeller}, " as the
+        // space lands, so the player sees the target before pressing enter.
+        c.Input.TextReplacer = text =>
+            ChatTextReplacements.Expand(text, vm.LastIncomingTellSender);
         c.Input.OnSubmit = text => ChatCommandRouter.Submit(
             text, vm, busProvider(), c._activeChannel, c._tellTarget);
 

src/AcDream.App/UI/UiField.cs

@@ -156,6 +156,19 @@ public sealed class UiField : UiElement
 
     // ── Editing primitives ──────────────────────────────────────────────
 
+    /// <summary>
+    /// Offered the field's text each time a SPACE is typed at the end of it;
+    /// return a replacement to rewrite the field, or <see langword="null"/> to
+    /// leave it alone.
+    /// </summary>
+    /// <remarks>
+    /// Retail's typed-abbreviation expansion — "/r " becoming
+    /// "@tell {LastTeller}, " — lives here rather than in the submit path
+    /// because the player is meant to SEE who they are about to reply to
+    /// before pressing enter.
+    /// </remarks>
+    public Func<string, string?>? TextReplacer { get; set; }
+
     public void InsertChar(char c)
     {
         if (!Editable) return;
@@ -169,6 +182,19 @@ public sealed class UiField : UiElement
         _text = _text.Insert(_caret, c.ToString());
         _caret++;
         _historyIndex = -1;
+
+        // Retail expands a typed abbreviation the moment the SPACE lands —
+        // ChatInterface::HandleTextReplacements @0x004F50D0 runs off the
+        // character-typed broadcast, keyed on 0x20. Only on space, and only
+        // when the caret is at the end, so it cannot rewrite text a player is
+        // editing in the middle of.
+        if (c == ' '
+            && TextReplacer is { } replace
+            && _caret == _text.Length
+            && replace(_text) is { } replacement)
+        {
+            SetText(replacement);
+        }
     }
 
     public void Backspace()

src/AcDream.Runtime/Chat/ChatTextReplacements.cs

@@ -0,0 +1,76 @@
+namespace AcDream.Runtime.Chat;
+
+/// <summary>
+/// Retail's typed-abbreviation expansion in the chat entry.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Typing <c>/r </c> rewrites the entry to <c>@tell {LastTeller}, </c> the
+/// moment the space lands, so the player SEES who they are replying to before
+/// pressing enter. <c>ChatInterface::HandleTextReplacements @0x004F50D0</c>
+/// runs off the character-typed broadcast and delegates to
+/// <c>SetReplyTextInChatBox @0x004F4760</c>.
+/// </para>
+/// <para>
+/// This is display sugar, not routing: <c>/r hello</c> already SENT correctly
+/// without it (<c>ChatInputParser</c>'s reply aliases). What was missing is
+/// that the player could not see the target.
+/// </para>
+/// </remarks>
+public static class ChatTextReplacements
+{
+    /// <summary>
+    /// The reply abbreviations, recovered from the constant pool rather than
+    /// the decompiled listing — Binary Ninja renders these as bare
+    /// <c>data_*</c> references.
+    /// </summary>
+    /// <remarks>
+    /// <c>data_7C4C70</c> = <c>"r "</c>, <c>data_7C4C68</c> = <c>"rp "</c>,
+    /// <c>data_7C4C58</c> = <c>"reply "</c>. Retail stores them WITHOUT the
+    /// leading prefix character and checks that separately, which is why both
+    /// prefixes work.
+    /// </remarks>
+    private static readonly string[] ReplyVerbs = ["r", "rp", "reply"];
+
+    /// <summary>
+    /// Retail accepts either command prefix here —
+    /// <c>SetReplyTextInChatBox</c> tests the first character against
+    /// <c>0x2F</c> ('/') OR <c>0x40</c> ('@') before comparing the verb.
+    /// </summary>
+    private const string CommandPrefixes = "/@";
+
+    /// <summary>
+    /// The expansion for <paramref name="text"/>, or <see langword="null"/>
+    /// when it is not a reply abbreviation.
+    /// </summary>
+    /// <param name="lastTeller">
+    /// The last person to tell us. When absent, retail performs NO expansion —
+    /// it leaves the text alone rather than producing a tell addressed to
+    /// nobody, and the ordinary submit path is what reports
+    /// "Someone must @tell you first!".
+    /// </param>
+    public static string? Expand(string? text, string? lastTeller)
+    {
+        if (string.IsNullOrEmpty(text) || string.IsNullOrEmpty(lastTeller))
+            return null;
+        if (CommandPrefixes.IndexOf(text[0]) < 0)
+            return null;
+
+        // The trailing space is part of the trigger: retail expands ON the
+        // space, so "/r" alone must be left alone — the player may still be
+        // typing "/roleplay".
+        foreach (string verb in ReplyVerbs)
+        {
+            if (text.Length == verb.Length + 2
+                && text[^1] == ' '
+                && string.Compare(
+                        text, 1, verb, 0, verb.Length,
+                        StringComparison.OrdinalIgnoreCase) == 0)
+            {
+                return $"@tell {lastTeller}, ";
+            }
+        }
+
+        return null;
+    }
+}