Public Variable Channel Index

Public Variable Channel Index

Claude-owned, source-cited (2026-06-02). The single canonical inventory of every publicVariable channel in the mission: the registered PVF commands (routed through the dispatcher) and the direct channels (their own addPublicVariableEventHandlers). This is the design surface for any BattlEye publicvariable.txt filter and for the server-authority redesign. Supersedes the old ad-hoc inventory tables in Networking and the duplicate in SQF atlas; those pages now route here for command/channel inventory. Paths relative to Missions/[55-2hc]warfarev2_073v48co.chernarus/. Arma 2 OA 1.64.

Trust legend

• PVF (registered): travels as WFBE_PVF_<Name>; the dispatcher Spawns WFBE_SE_FNC_HandlePVF / WFBE_CL_FNC_HandlePVF. Current origin/master@f8a76de34 / B74.1, B69 origin/claude/b69@8d465fce and adjacent B74 origin/claude/b74-aicom-spend@b23f557f resolve the sender-chosen handler name with missionNamespace getVariable plus a CODE guard, while older docs/Miksuu/perf refs still Call Compile the command string. Payload fields are trusted (no server re-derivation) unless a specific handler validates them, and DR-55 confirms the server path does not pass authenticated sender context to those handlers.
• Direct: a bare publicVariable/publicVariableServer/publicVariableClient with its own event handler -- not behind the dispatcher, so the DR-1 dispatcher fix does not cover it; each must be hardened individually. DR-41/DR-44 prove authority forgery on direct channels. DR-46 proved direct-channel RCE through SEND_MESSAGE on old-shape refs; current target origin/claude/build84-cmdcon36@6f2fc4bd10c8339fd13be087d327717ff58c85e8 now resolves SEND_MESSAGE localization payloads as data with localize + format.
• BattlEye: none of these are filtered except the kickAFK feature rule (DR-30); ATTACK_WAVE_INIT and all others are unfiltered.

1. Registered PVF commands

Registration: Common/Init/Init_PublicVariables.sqf builds one server-bound list and one client-bound list, then registers WFBE_PVF_<Name> event handlers for each entry. Each name X -> channel WFBE_PVF_X -> pre-compiled SRVFNC X / CLTFNC X (built in the two registration loops). Current stable/B69/B74 dispatch via missionNamespace getVariable plus CODE guards (Server_HandlePVF.sqf:14-15; Client_HandlePVF.sqf:32-33), but still have no explicit registered-handler allowlist. Dispatcher hardening branch matrix: PVF dispatch implementation.

Current branch registry matrix

Scope checked	Registered server PVFs	Registered client PVFs	Practical meaning
Docs checkout 40c97e74 Chernarus + maintained Vanilla	13 commands at Init_PublicVariables.sqf:9-21, _serverCommandPV at :23.	15 commands at :25-40, HandleParatrooperMarkerCreation at :39, _clientCommandPV at :42, dispatch wiring at :44-52.	This is the docs/source registry shape. Keep the SQF atlas as an orientation page and use this index for command inventory.
Current stable/B74.1 origin/master@f8a76de34 / origin/claude/b74.1-aicom@f8a76de34, B69 origin/claude/b69@8d465fce and adjacent B74 origin/claude/b74-aicom-spend@b23f557f, both maintained roots (2026-06-23)	19 commands at Init_PublicVariables.sqf:9-27, _serverCommandPV at :29. The docs/source 13 plus RequestEnqueue, RequestDequeue, CounterBatteryFired, RequestSiteClearance, RequestAIComDonate and HCStat.	19 active commands across :31-50 (DatabaseDebug at :36 is registered-commented), _clientCommandPV at :52. The docs/source client set plus CounterBatteryContact, BankPayout, RestartAnnounce and DashboardAnnounce. Dispatch wiring is :55-61.	Current stable/B74.1/B69/B74 have the expanded registry and namespace-lookup dispatch in Chernarus plus maintained Vanilla; allowlist/logging and Arma smoke remain open. The checked B69..B74 and B74..B74.1 generic PVF dispatcher/init deltas are empty. Current origin exposes no release/*, *pvf*, *network*, *auth* or *public* heads on 2026-06-23; older a96fdda2 release evidence is historical target-commit evidence only.
Release a96fdda2 historical check, both maintained roots	15 commands: the docs/source 13 plus RequestEnqueue and RequestDequeue at :22-23, _serverCommandPV at :25.	15 commands; HandleParatrooperMarkerCreation at :34, _clientCommandPV at :44, dispatch wiring at :46-54.	Queue PVFs are release branch-present in the 2026-06-13 check; recheck release before importing current-stable registry or dispatcher status.
Miksuu b8389e74 and origin/feat/ai-commander c20ce153, both maintained roots	13 commands through RequestAutoWallConstructinChange at :21, _serverCommandPV at :23.	14 commands; _clientCommandPV at :41; no HandleParatrooperMarkerCreation registration found in checked maintained roots.	Do not import docs/stable paratrooper or queue PVF status into these refs.
origin/perf/quick-wins 0076040f	13 server commands in both maintained roots.	Chernarus adds HandleParatrooperMarkerCreation at :40; maintained Vanilla keeps the 14-command old shape with _clientCommandPV at :41.	Perf is Chernarus-only for paratrooper registration and lacks the stable/release queue PVFs.

Sender-authentication caveat: the server registration callback forwards only the value tuple, not the publisher identity, into WFBE_SE_FNC_HandlePVF (docs/source Init_PublicVariables.sqf:51; current stable/B74.1/B69/B74 :61), and Server_HandlePVF.sqf only passes the handler parameters onward after dispatcher lookup. The current B69 0a1ccb4d..8d465fce PVF-path delta adds only the client HandleSpecial default-off aicom-team-merge tag, not server requester context, and the checked B69..B74 plus B74..B74.1 generic PVF dispatcher/init deltas are empty. Use Server authority migration map and agent-hardening-backlog.jsonl#pvf-handler-sender-authentication for DR-55 fixes that must authenticate the requester and re-derive side/role/funds per handler.

1a. Server-bound (client -> server) - 13 in docs/Miksuu/perf/AI-commander, 15 in release check, 20 on current stable

For implementation work after PVF dispatch allowlisting, use the registered server PVF handler authority matrix. This index owns channel inventory; the authority map owns per-handler validation shape.

Command (WFBE_PVF_*)	Purpose / notable finding
RequestVehicleLock	lock/unlock a payload-selected vehicle; owner/side/range validation is not visible in the handler
RequestOnUnitKilled	report a kill for scoring
RequestChangeScore	score mutation; accepts payload score and applies addScore, unlike safer server-derived award helpers
RequestCommanderVote	commander vote; DR-47 server/UI semantics mismatch and restart smoke route through Commander vote/reassignment
RequestNewCommander	assign new commander; DR-15 is branch-split. Current stable/B74-shaped maintained roots unpack the helper payload correctly, while docs/source and full modded forks still carry old helper copies; duplicate notification ownership, row-identity selection and requester authority remain open. Flow map in Commander/HQ lifecycle, patch/smoke route in Commander vote/reassignment and Commander reassignment call shape.
RequestStructure	build a structure — DR-6 (no commander/funds/placement check)
RequestDefense	build a defense — DR-6
RequestJoin	join handshake (robust 30s-retry, DR-37)
RequestMHQRepair	MHQ repair — DR-6-class (_side from payload); lifecycle/risk map in Commander/HQ lifecycle
RequestSpecial	multiplexer → Server_HandleSpecial.sqf (ICBM/paradrop/uav/HC/…) — DR-27 (forged ["ICBM",…] = map-wide kill)
RequestTeamUpdate	team/group property update; mutates behavior/combat/formation/speed from payload-selected team/side
RequestUpgrade	side upgrade purchase — DR-23 (client-authoritative)
RequestAutoWallConstructinChange	auto-wall construction toggle; writes one global setting consumed by later SmallSite/MediumSite construction
RequestEnqueue / RequestDequeue	current stable/B74.1 origin/master@f8a76de34 / origin/claude/b74.1-aicom@f8a76de34 upgrade-queue PVFs in both maintained roots; absent from docs checkout 40c97e74, Miksuu b8389e74, perf 0076040f and feat/ai-commander c20ce153 checks. Older a96fdda2 release evidence is historical target-commit evidence. Use PR8 and drone upstream lesson match for the forged/JIP queue smoke route.
CounterBatteryFired	current stable server-side counter-battery request handler; CounterBatteryFired.sqf:1-15 exits when WFBE_C_STRUCTURES_COUNTERBATTERY is disabled, unpacks firing unit and position, then delegates to WFBE_SE_FNC_CounterBatteryCheck. Registered in both maintained roots.
RequestSiteClearance	current stable commander site-clearance PVF; RequestSiteClearance.sqf:1-20 documents the client-supplied placer object and intended commander gate. Treat as a construction/CoIn authority surface until smoke and server-side validation are reviewed.
RequestAIComDonate	current stable AI-commander donation PVF; RequestAIComDonate.sqf:1-20 documents server-side amount, donor-team funds and AI-commander checks. Route any economy/funds claims through AI/economy owner pages before changing status.
HCStat	current stable headless-client telemetry sink; HCStat.sqf:1-20 type-checks payload shape and writes machine-parseable HCSTAT diagnostics. It is status telemetry, not gameplay authority, but still belongs in BattlEye/PVF inventory.

Scout refinement 2026-06-04, sharpened by DR-55: the thinner registered handlers above are still live hardening surfaces after a future PVF dispatcher fix. In particular, RequestChangeScore, RequestVehicleLock, RequestTeamUpdate, RequestAutoWallConstructinChange, RequestStructure, RequestDefense and RequestUpgrade need authenticated requester/side/object/funds validation at the handler/effect layer, not only dispatcher allowlisting.

1b. Client-bound (server -> client) - 19 active in current stable (DatabaseDebug at :36 registered-commented), fewer on older branch roots

For runtime/JIP behavior after these messages arrive, use the registered client PVF runtime matrix. This page owns channel inventory; Networking owns client-side effect and replay notes.

Command (WFBE_PVF_*)	Purpose / notable finding
AllCampsCaptured	all-camps event
AwardBounty / AwardBountyPlayer	bounty award to side / player
CampCaptured	camp capture event
ChangeScore	push score change to clients
HandleSpecial	multiplexer → Client_FNC_Special.sqf (endgame/group/icbm-display/hq-status/delegate-*/…)
LocalizeMessage	localized message multiplexer
SetTask	task assignment
SetVehicleLock / SetMHQLock	lock-state push; HQ/MHQ context in Commander/HQ lifecycle
TownCaptured	town capture event
Available	availability push
RequestBaseArea	base-area (client-bound despite the name); moves an object, stamps avail/side and appends to wfbe_basearea with no local validation in the client callback; multiplayer-sensitive HQ deploy edge in Commander/HQ lifecycle
HandleParatrooperMarkerCreation	paratrooper-drop unit marker creation; docs checkout 40c97e74, current stable/B74.1 origin/master@f8a76de34 / origin/claude/b74.1-aicom@f8a76de34 and historical release a96fdda2 register it in both maintained roots, perf 0076040f registers Chernarus only, and Miksuu b8389e74 / feat/ai-commander c20ce153 omit it in checked maintained roots. Arma smoke pending in Paratrooper marker revival.
NukeIncoming	nuke-incoming broadcast name in the PVF list; current launch flow evidence still routes through NukeIncoming script, RequestSpecial ["ICBM", ...] and HandleSpecial "icbm-display" rather than the stale ICBM_launched direct channel
CounterBatteryContact	current stable side-targeted client marker for detected enemy artillery positions; CounterBatteryContact.sqf:1-20 creates a timed local marker from position and time string.
BankPayout	current stable client payout handler for bank dividends; BankPayout.sqf:1-19 pays the local player and announces the payout. Treat payout authority/smoke separately from this inventory row.
RestartAnnounce	current stable global restart-countdown announcement; RestartAnnounce.sqf:1-17 exits on non-interface machines and shows server-formatted text.
DashboardAnnounce	current stable global live-dashboard link announcement; DashboardAnnounce.sqf:1-20 exits on non-interface machines and prints the server-formatted message through systemChat.

Commander-tag note: HandleSpecial also carries commander/HQ message tags such as commander-vote-start, new-commander-assigned, hq-setstatus and set-hq-killed-eh through the client-side special router. Use Commander vote/reassignment for the vote/reassignment semantics and Commander/HQ lifecycle for the broader HQ-status chain before changing those tags.

DatabaseDebug is registered-commented (:36).

2. Direct publicVariable channels (own event handlers)

Each has its own addPublicVariableEventHandler; not behind the dispatcher.

Channel	Direction	Purpose / notable finding	Source
ATTACK_WAVE_INIT	client -> server	activate heavy attack-wave; DR-41 / 2026-06-24 B74.2 refresh - docs/source HEAD@426de4570993 is unchanged from a764d51107de, while current stable origin/master@f8a76de34 equals origin/claude/b74.1-aicom@f8a76de34 and current B74.2 origin/claude/b74.2-aicom@21b62b04 still trusts client _supply/_side in both maintained roots. Current B69 and adjacent B74 keep the same request/detail/client-price trust. Scoped origin/master..origin/claude/b74.2-aicom touches only source-Chernarus GUI_Menu_BuyUnits.sqf and Init_CommonConstants.sqf, scoped d472da6a..21b62b04 is empty, and earlier stable/B74/B74.1 deltas only touch constants. No live release/*, attack-wave or support rescue head is exposed, and repo-root BattlEyeFilter/publicvariable.txt:2 still only filters kickAFK.	Common/Functions/Common_AttackWaveActivate.sqf:6-8, Server/Functions/Server_AttackWave.sqf:5-6,15,23,27; Attack-wave authority
ATTACK_WAVE_DETAILS	server self-loop via publicVariableServer	DR-41 detail payload; intended sender is Server_AttackWave.sqf, which publishes the packet back to the server-side PVEH rather than directly to clients. Client-visible effects happen later through HandleSpecial and LocalizeMessage sends from AttackWave.sqf. Current stable/B74.1 origin/master@f8a76de34, current B74.2 origin/claude/b74.2-aicom@21b62b04, current B69 and adjacent B74 still trust payload _side, _priceModifier and _attackLength, store active-side state, drain side supply and replay active modifiers to JIP clients in both maintained roots; B74.2 only line-drifts source-Chernarus buy-menu/constants paths among checked attack-wave files. Treat this as a forgeable direct-PV authority surface unless BattlEye/handler validation prevents clients from publishing it.	Server/Functions/Server_AttackWave.sqf:23-27,36-38, Server/PVFunctions/AttackWave.sqf:19-25,32-46,58-62; Attack-wave authority
WFBE_CL_MASH_MARKER_CREATED	(intended) client -> server	DR-34 / 2026-06-24 B74.2 current-head refresh - repo docs branch HEAD@f938b0c0b7ea is unchanged from 443055cf, 2b5139219faa and db3015f18ea3 for checked MASH paths; docs/source, Miksuu b8389e748243 and perf 0076040f8a5e keep the server relay, but maintained deploy paths do not send this channel. Current stable/B74.1 origin/master@f8a76de34 / origin/claude/b74.1-aicom@f8a76de34, current B74.2 origin/claude/b74.2-aicom@21b62b04, current B69 origin/claude/b69@8d465fce, adjacent B74 origin/claude/b74-aicom-spend@b23f557f and historical a96fdda2 remove the maintained-root deploy/module path. Checked old-stable..current-stable, current-stable..B74.2, previous-B74.2..current-B74.2 and B69..B74 MASH deltas are empty. Modded eden/lingor still emit it, which is sender-only drift rather than proof maintained markers work. Canonical lifecycle matrix: Respawn and death lifecycle.	Old-shape roots: Server/Module/MASH/MASHMarker.sqf:1, Client/Module/Skill/Skill_Officer.sqf:8,26,29; current-stable/B74 removal cue: Skill_Apply.sqf:43; modded Skill_Officer.sqf:38-40
WFBE_SE_MASH_MARKER_SENT	(intended) server -> clients	DR-34 / 2026-06-24 B74.2 current-head refresh - old-shape server relay can rebroadcast, but maintained clients keep the receiver compile commented; current-stable/B74-shaped maintained roots, including current B74.2, no longer carry the MASH module path. Checked 0139a3468609..origin/master, origin/master..origin/claude/b74.2-aicom, d472da6a..21b62b04 and B69..B74 MASH path deltas are empty. Local MASH respawn is separate and source-supported only on old-shape roots; the shared marker relay needs server-held marker state, delete resend and explicit JIP resend or retirement.	Old-shape roots: Server/Module/MASH/MASHMarker.sqf:9-11, Client/Module/MASH/receiverMASHmarker.sqf:1, Client/Init/Init_Client.sqf:132; current-stable/B74 removal cue: Skill_Apply.sqf:43
WFBE_Client_PV_IsSupplyMissionActiveInTown	client → server	supply-cooldown query (pull-based; JIP-correct, DR-39)	Server/Module/supplyMission/isSupplyMissionActiveInTown.sqf:1
WFBE_Server_PV_IsSupplyMissionActiveInTown	server → clients	cooldown answer (broadcast not targeted)	Client/Module/supplyMission/townSupplyStatus.sqf:1
WFBE_Client_PV_SupplyMissionStarted	client → server	start supply mission; live handler is supplyMissionStarted.sqf, while compiled supplyMissionActive.sqf is a dead twin	Client/Module/supplyMission/supplyMissionStart.sqf:39, Server/Module/supplyMission/supplyMissionStarted.sqf:1, Server/Init/Init_Server.sqf:81
WFBE_Server_PV_SupplyMissionCompleted	server module -> server handler	supply completion event; still consumes vehicle object vars that are stamped during client start	Server/Module/supplyMission/supplyMissionStarted.sqf:64-65, Server/Module/supplyMission/supplyMissionCompleted.sqf:2,9-12
WFBE_Server_PV_SupplyMissionCompletedMessage	server -> clients	supply completion message and client-side player cash/score side effects; exact channel matters for BattlEye filters and should not be hidden behind ...CompletedMessage shorthand. The handler grants funds locally and sends RequestChangeScore when the payload player equals the local player.	Server/Module/supplyMission/supplyMissionCompleted.sqf:24,34, Client/Module/supplyMission/supplyMissionCompletedMessage.sqf:2,11-23
wfbe_supply_temp_west / wfbe_supply_temp_east / current-Chernarus wfbe_supply_temp_resistance	client -> server	side-supply mutation — DR-44 direct-PV forgery class plus DR-22 floor risk. Current stable/B74.1/B74.2 Chernarus floors server negatives to 0 and adds the resistance temp handler, but all checked temp handlers still trust payload _side / _amount; maintained Vanilla remains west/east old-shape. Validation must check side/channel consistency, amount shape and requester authority.	Current Chernarus Common/Functions/Common_ChangeSideSupply.sqf:24,26, Server/Functions/Server_ChangeSideSupply.sqf:1-21,25-45,49-69; Vanilla/old-shape Common_ChangeSideSupply.sqf:28-30, Server_ChangeSideSupply.sqf:1-21,25-45
wfbe_supply_WEST / wfbe_supply_EAST	server -> clients / JIP state mirror	side-supply balance mirror after a server-side change. This is not the temp mutation channel above; clients wait for wfbe_supply_<sideJoinedText> on join and GetSideSupply reads the same namespace key.	Server/Functions/Server_ChangeSideSupply.sqf:19-21,43-45, Client/Init/Init_Client.sqf:369-371, Common/Functions/Common_GetSideSupply.sqf:11-18
ICBM_launched	legacy/unclear server -> clients	Branch check 2026-06-05: receiver-only legacy handler in source/Vanilla, origin/master, miksuu/master and origin/release/2026-06-feature-bundle. Client/FSM/updateclient.sqf:20 registers the PVEH and OnEventHandler_ICBM_Launch.sqf documents the intended payload, but fixed-string branch searches found no active assignment or publicVariable "ICBM_launched" sender. Current tactical nuke flow uses GUI_Menu_Tactical.sqf:499 (release Chernarus :500) -> Client/Module/Nuke/nukeincoming.sqf:23,27 -> RequestSpecial ["ICBM", ...] and HandleSpecial "icbm-display". Retire or revive deliberately; do not delete ICBM itself.	Client/FSM/updateclient.sqf:20, Client/Module/Nuke/OnEventHandler_ICBM_Launch.sqf:5-9, Client/Module/Nuke/nukeincoming.sqf:23,27, Client/PVFunctions/HandleSpecial.sqf:22, Server/Functions/Server_HandleSpecial.sqf:97-111
PLAYER_RADIATED	client -> clients	nuke radiation effect. radzone.sqf publishes the event from the client-side radiation check, and clients install the receiver in updateclient.sqf; do not treat this as server-authoritative damage logic.	Client/Module/Nuke/radzone.sqf:103-104, Client/FSM/updateclient.sqf:24, Client/Module/Nuke/OnEventHandler_player_radiated.sqf
AFKthresholdExceededName / kickAFK	client → server/BattlEye	Dual AFK paths. The older module publishes AFKthresholdExceededName and calls failMission "END1" after its local threshold; the server handler only logs the reported name. The newer FSM path publishes kickAFK, covered by the repo BattlEye filter rule.	Client/Init/Init_Client.sqf:256-264, Client/Module/AFKkick/monitorAFK.sqf:24-30, Server/Module/afkKick/initAFKkickHandler.sqf:9-12, Client/FSM/updateclient.sqf:153-160, BattlEyeFilter/publicvariable.txt:1-2
WFBE_DAYNIGHT_DATE	server → clients	day/night drift sync (reviewed clean, Round 17)	Server/Functions/Server_DayNightCycle.sqf
SERVER_FPS_GUI / WFBE_VAR_SERVER_FPS	server -> clients	server FPS GUI/HUD publication. Current source Chernarus player UI reads SERVER_FPS_GUI; WFBE_VAR_SERVER_FPS is a second dedicated publisher with no source Chernarus player-UI reader found. Modded/stale folders still contain WFBE_VAR_SERVER_FPS consumers, so future ops cleanup should either preserve it as compatibility or retire it deliberately with modded drift cleanup.	Server/GUI/serverFpsGUI.sqf:6-7, Server/Module/serverFPS/monitorServerFPS.sqf:5-6, Client/Client_UpdateRHUD.sqf:113, Server/Init/Init_Server.sqf:578,595
IS_WEST_HQ_ALIVE / IS_EAST_HQ_ALIVE	server → clients	HQ alive-state broadcast; see Commander/HQ lifecycle	Server/Functions/Server_MHQRepair.sqf, Server/Functions/Server_OnHQKilled.sqf
HQ_WEST_MARKER_INFOS / HQ_EAST_MARKER_INFOS	server → clients	HQ marker payload broadcast; see Commander/HQ lifecycle	Server/Functions/Server_MHQRepair.sqf, Server/Functions/Server_OnHQKilled.sqf
SUPPLY_COMPENSATION_AMOUNT_EAST / SUPPLY_COMPENSATION_AMOUNT_WEST	server → clients	AntiStack skill-difference supply compensation	Server/Module/AntiStack/skillDiffCompensation.sqf
TEAM_WEST_TICKS_NO_PLAYERS / TEAM_EAST_TICKS_NO_PLAYERS	common/server → clients	no-player supply-income stagnation counters	Common/Functions/Common_StagnateSupplyIncomeNoPlayers.sqf
MARKER_CREATION	mixed caller -> clients	Side-scoped map-marker relay outside PVF. Common_CreateMarker.sqf creates the marker globally, stores payload [name, position, type, text, color, side, optional ellipse/radius] in missionNamespace and broadcasts MARKER_CREATION; clients register the PVEH and apply type/text/color/ellipse locally only when playerSide matches the payload side. Current source/Vanilla, stable, Miksuu, perf and release keep the same sender/receiver wiring. Source callers include fire mission, nuke/radiation and tactical ICBM marker paths, so future hardening should define sender/side/schema validation plus delete/JIP/replay smoke before treating marker relay as only cosmetic.	Common/Functions/Common_CreateMarker.sqf:51-53,80-83, Client/FSM/updateclient.sqf:14-16, Client/Functions/Client_onEventHandler_MARKER_CREATION.sqf:15-32,36-49, Client/Functions/Client_RequestFireMission.sqf:30, Client/Module/Nuke/radzone.sqf:73,85, Client/GUI/GUI_Menu_Tactical.sqf:483
SEND_MESSAGE	mixed	Current target fixed for DR-46. origin/claude/build84-cmdcon36@6f2fc4bd10c8339fd13be087d327717ff58c85e8 keeps the direct channel, but the receiver/helper no longer execute message text. Both maintained roots treat multi-language payloads as structured [stringtableKey, formatArgs], validate array shape, resolve with localize + format, and render malformed forged payloads as empty/data. This is still outside PVF dispatcher hardening, so sender/value-shape smoke remains relevant, and old-shape refs below still need the no-compile backport before release wording.	Current target anchors: Chernarus and Vanilla Client/Functions/Client_onEventHandler_SEND_MESSAGE.sqf:29-42, Common/Functions/Common_SendMessage.sqf:5-8,28-42; old-shape inventory: Client/FSM/updateclient.sqf:12; Deep review DR-46
REQUEST_SUPPLY_VALUE / SUPPLY_VALUE_REQUESTED	client <-> server	supply-value request/response; the server derives the response value, but clients store it as mutable local wfbe_supply_%side cache and Common_GetSideSupply waits without a timeout before UI/economy gates consume it	Common/Functions/Common_GetSideSupply.sqf:13-18,26-31,39-44, Server/Functions/Server_PV_RequestSupplyValue.sqf:1,8, Client/Functions/Client_ReceiveSupplyValue.sqf:1,7
WFBE_CLIENT_HAS_CONNECTED_AT_LAUNCH / WFBE_P_HAS_CONNECTED_AT_LAUNCH_ACK	client ↔ server	launch-connect handshake (DR-37). The server stores side from a client-published player object and publishes boolean true back to the owner, but the client receiver stores the whole PVEH tuple in WFBE_P_HAS_CONNECTED_AT_LAUNCH_ACK; treat it as tuple-shaped truthiness until normalized.	Client/Init/Init_Client.sqf:442-456, Server/Module/AntiStack/clientHasConnectedAtLaunch.sqf:1-16, Client/Module/AntiStack/hasConnectedAtLaunchACK.sqf:1-7
CLIENT_INIT_READY	client → server	client-init-ready signal. Attack-wave code uses this as an explicit replay hook for current active wave details, separate from generic replicated waits and join ACK retry behavior.	Client/Init/Init_Client.sqf:960-962, Server/PVFunctions/AttackWave.sqf:1-15
WFBE_C_PLAYER_OBJECT	client → server	player-object publication for WFBE_SE_PLAYERLIST; source indexing is patched, but sender/UID validation and disconnect pruning/stale row cleanup remain open. The handler accepts [playerObject, uid] and supply mission player lookup later depends on this list.	Client/Init/Init_Client.sqf:759-760, Server/Module/supplyMission/playerObjectsList.sqf:1-40, Server/Module/supplyMission/supplyMissionStarted.sqf:31-65
CBA_display_ingame_warnings	global bootstrap broadcast	disables CBA in-game warnings during mission bootstrap. Low gameplay risk, but it is still a public variable and belongs in the BattlEye/publicVariable inventory.	initJIPCompatible.sqf:24-25

SEND_MESSAGE Direct Compile Branch Matrix

This is the branch/root route for DR-46. It is intentionally separate from the PVF dispatcher matrix because SEND_MESSAGE is a bare direct publicVariable channel with its own event handler.

BIKI command semantics for old-shape risk: compile turns string text into code, call executes code in the current stack, publicVariable broadcasts a missionNamespace value to other machines and addPublicVariableEventHandler runs when that broadcast arrives. In old-shape refs, the network value contains the string later compiled by the receiver/helper; current build84-cmdcon36 treats that value as localization data instead.

Scope checked	Receiver route	Helper / broadcast route	Practical meaning
Current target origin/claude/build84-cmdcon36@6f2fc4bd10c8339fd13be087d327717ff58c85e8 Chernarus plus maintained Vanilla Takistan (2026-07-02 recheck)	Both roots still register the direct receiver, but Client_onEventHandler_SEND_MESSAGE.sqf:29-42 documents the RCE fix, requires array payloads for multi-language messages, resolves _key with localize, appends _args, and calls format on data. No executable _messageText compile path remains in the receiver.	Common_SendMessage.sqf:5-8 documents structured [stringtableKey, formatArgs] payloads and :28-42 mirrors the same data-only localize + format helper path before broadcast.	Current source task is stale/resolved for both maintained roots. Keep forged-payload-as-data and localized artillery/ICBM/side-message smoke before release claims, but do not reopen a source patch on this target.
Older docs/source HEAD@c27388b4146b and pre-cmdcon B74/B69/B74.1/B74.2 refs documented on 2026-06-24	All checked old-shape roots registered "SEND_MESSAGE" addPublicVariableEventHandler in Client/FSM/updateclient.sqf:12, unpacked payload indexes 0-3, and ran _messageText = call compile _messageText when the multi-language flag was true.	Old-shape helpers ran _messageText = call compile _messageText, then published SEND_MESSAGE via missionNamespace setVariable / publicVariable.	Treat those refs as historical/backport targets only. Recheck exact branch heads before applying current-target wording.
Current Miksuu upstream master@b8389e748243	Same receiver registration at updateclient.sqf:12 and receiver compile at Client_onEventHandler_SEND_MESSAGE.sqf:27 in both maintained roots.	Same helper compile at Common_SendMessage.sqf:26 and broadcast at :38 in both maintained roots.	No upstream rescue exists for the current source shape.
origin/perf/quick-wins 0076040f	Same receiver registration at updateclient.sqf:12 and receiver compile at Client_onEventHandler_SEND_MESSAGE.sqf:27 in Chernarus and maintained Vanilla.	Same helper compile at Common_SendMessage.sqf:26 and broadcast at :38 in both roots.	Perf branch fixes do not cover this security lane.
Historical origin/release/2026-06-feature-bundle@a96fdda2; current origin advertises no release/* heads on 2026-06-23	The historical release Chernarus and release maintained Vanilla roots had the same receiver registration at updateclient.sqf:12 and receiver compile at Client_onEventHandler_SEND_MESSAGE.sqf:27.	Same helper compile at Common_SendMessage.sqf:26 and broadcast at :38 in both historical release roots.	Keep this as prior release evidence only until a release head is restored or a new release ref is checked.

The 89ae9dad..cf2a6d6a and 2026-06-24 B74/B69 matrices remain provenance for old-shape refs. They are superseded for the current target by b3cb26fd5 (b765 bughunt) in origin/claude/build84-cmdcon36, which rewrote the receiver/helper to structured localization data in both maintained roots. If an older docs/Miksuu/perf/release branch is revived, recheck that branch before importing the current-target fixed status.

Hardening note

For a real BattlEye publicvariable.txt, the default-deny whitelist must cover both tables -- registered WFBE_PVF_* names and these direct channels -- keeping kickAFK. But BattlEye is defense-in-depth only; the durable fix is allowlisted PVF handler lookup (DR-1/DR-38), authenticated requester/context validation for legitimate handlers (DR-55), direct handler validation for authority channels (DR-41/DR-44) and preserving the current no-compile SEND_MESSAGE payload contract. See Pending owner decisions.

Dead-code scan note: Dead/stale code register owns cleanup classification for receiver-only or comment-only channels. Treat wfbe_supply_temp_east/west and the current-Chernarus wfbe_supply_temp_resistance as dynamic format channels, not receiver-only dead code; treat old commented WFBE_Request* / WFBE_LocalizeMessage / WFBE_ChangeScore lines as migration residue unless a target branch proves otherwise.

Continue Reading

Conventions: Variable and naming conventions | Dispatch internals: Networking | Findings: Deep-review findings