feat(chat): CT-B2 — "/r " expands to a tell at whoever last told you

Campaign CT slice B2, and the autocomplete the user asked about directly.

Typing "/r " now rewrites the chat entry to "@tell {LastTeller}, " the moment
the space lands, matching ChatInterface::HandleTextReplacements @0x004F50D0 ->
SetReplyTextInChatBox @0x004F4760.

This is display sugar rather than routing: "/r hello" already SENT correctly
through ChatInputParser's reply aliases. What was missing is that the player
could not SEE who they were about to reply to before pressing enter.

The trigger strings came out of the constant pool, not the decompiled listing —
Binary Ninja renders them as bare data_* references with no preview:

    data_7C4C70 = "r "      data_7C4C68 = "rp "      data_7C4C58 = "reply "

Retail stores them WITHOUT the leading prefix and tests the first character
separately against '/' (0x2F) or '@' (0x40), which is why both prefixes work.
The research summary for this area listed the triggers as "/t ", "/tell " and
"reply " — reading the pool corrected that.

Three boundaries, each pinned by test because each is a way to get this subtly
wrong:

  - The trailing space is PART of the trigger. "/r" alone must be left alone —
    the player may still be typing "/roleplay", and expanding early would
    hijack a different command mid-word.
  - Only on space. Running the replacer per keystroke would rewrite text out
    from under someone mid-word; retail keys on 0x20 specifically.
  - Only with the caret at the end. Otherwise the player is editing existing
    text, and expanding would corrupt a sentence they are part way through
    fixing.

With nobody to reply to, nothing is rewritten — retail leaves the text alone
rather than producing a tell addressed to nobody, and the ordinary submit path
still reports "Someone must @tell you first!".

Solution builds clean; full hermetic gate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/AcDream.App/UI/Layout/ChatWindowController.cs

@@ -363,6 +363,10 @@ public sealed class ChatWindowController : IRetainedWindowStateController, IReta
         // its own authored background sprite (0x0600113A); same reasoning as the
         // transcript above.
         c.Input.SpriteResolve = resolve;
+        // Campaign CT slice B2: expand "/r " to "@tell {LastTeller}, " as the
+        // space lands, so the player sees the target before pressing enter.
+        c.Input.TextReplacer = text =>
+            ChatTextReplacements.Expand(text, vm.LastIncomingTellSender);
         c.Input.OnSubmit = text => ChatCommandRouter.Submit(
             text, vm, busProvider(), c._activeChannel, c._tellTarget);
 

src/AcDream.App/UI/UiField.cs

@@ -156,6 +156,19 @@ public sealed class UiField : UiElement
 
     // ── Editing primitives ──────────────────────────────────────────────
 
+    /// <summary>
+    /// Offered the field's text each time a SPACE is typed at the end of it;
+    /// return a replacement to rewrite the field, or <see langword="null"/> to
+    /// leave it alone.
+    /// </summary>
+    /// <remarks>
+    /// Retail's typed-abbreviation expansion — "/r " becoming
+    /// "@tell {LastTeller}, " — lives here rather than in the submit path
+    /// because the player is meant to SEE who they are about to reply to
+    /// before pressing enter.
+    /// </remarks>
+    public Func<string, string?>? TextReplacer { get; set; }
+
     public void InsertChar(char c)
     {
         if (!Editable) return;
@@ -169,6 +182,19 @@ public sealed class UiField : UiElement
         _text = _text.Insert(_caret, c.ToString());
         _caret++;
         _historyIndex = -1;
+
+        // Retail expands a typed abbreviation the moment the SPACE lands —
+        // ChatInterface::HandleTextReplacements @0x004F50D0 runs off the
+        // character-typed broadcast, keyed on 0x20. Only on space, and only
+        // when the caret is at the end, so it cannot rewrite text a player is
+        // editing in the middle of.
+        if (c == ' '
+            && TextReplacer is { } replace
+            && _caret == _text.Length
+            && replace(_text) is { } replacement)
+        {
+            SetText(replacement);
+        }
     }
 
     public void Backspace()