Blame for docs/research/QVM_ALLOCATION_SPREAD_BATCH.md

# Entity allocation and shot preparation: RE-604–613

Ten separately checked and committed tasks extend the [server firing batch](QVM_SERVER_FIRE_BATCH.md). They recover entity allocation and more of the shared hitscan and shot preparation paths. This remains bounded reverse engineering; the Rust game does not gain playable behavior from these reports alone.

| Task | Scope | Evidence |
| --- | --- | --- |
| RE-604 |277125 initializer, identity and preserved fields | [Entity initializer](QVM_ENTITY_INIT.md) |
| RE-605 |277165 first-fit scan and recent-free timing guard | [Reuse](QVM_ENTITY_REUSE.md) |
| RE-606 | Full-capacity retry, extension, error boundaries and native−16 request | [Allocator](QVM_ENTITY_ALLOCATE.md) |
| RE-607 |277695 tempEntity with actual allocator/initializer and278138 | [Allocated event](QVM_ALLOCATED_EVENT.md) |
| RE-608 |285971 grenade with actual allocator/initializer | [Allocated grenade](QVM_ALLOCATED_GRENADE.md) |
| RE-609 |290493 table selection and spread scalar prefix | [Parameters](QVM_SPREAD_PARAMETERS.md) |
| RE-610 | Movement normalization, airborne floor and converted-speed split | [Speed](QVM_SPREAD_SPEED.md) |
| RE-611 | Four-draw rejection sampler and explicit attempt limit | [Sampling](QVM_SPREAD_SAMPLING.md) |
| RE-612 |295018 table copies, lookup, normalization and direction frame | [Shot frame](QVM_SHOT_FRAME.md) |
| RE-613 |293732 local basis/muzzle preparation and full static child inventory | [Shared handler basis](QVM_SHARED_SHOT_BASIS.md) |

## Implications for the port

The initializer changes five words of an880-byte record. It does not clear position, client pointers, callbacks or other payload. Allocation starts at slot64 in the literal source pool, preserves record contents beyond those initializer writes, and delays recent frees only under the strict two-condition guard. At full capacity its retry relaxes that delay. The count1022 diagnostic path differs from the1023→1024 extension path; retain the evidence until a native/reference run explains intended limits.

The temp-event and grenade compositions now execute actual allocation. Native−16 registration and−31 linking are captured requests, and the grenade world query is still supplied. No engine collision/lifetime/physics effects are established. The earlier broad server-chain report retains its original supplied-pointer contract and has not silently gained this narrower composition.

Shared spread parameters depend on the packed current slot, while293732 first locates entity weaponID in the first16 slots. These are different reads; they must not be collapsed into an assumed single configuration source. IDs14/23 have an airborne speed floor strictly below224.4, followed by a340 cap. Later200 splitting happens after radians conversion, leaving excess zero in the tested finite domain.

Spread rejection consumes four global RNG draws per candidate. Acceptance is inside radius1 and strictly outside a counter-derived lower radius. Seed zero remains zero and rejects forever in these source operations; the harness stops after32 attempts. This is neither an original QVM return nor evidence that zero is a legal live seed.

Shot295018 chooses the first minimum-absolute axis, preserves a squared reciprocal in the projection arithmetic, normalizes the perpendicular and computes a cross vector. Zero direction is reported before division by zero. Shared293732 writes local forward/up and global right, then uses the alternate muzzle helper without14×forward. Its pending290493 output remains an untouched canary.

## Validation and limits

The919-test baseline gains33 independent checks, ending at952 tests. Each task includes source identity, bounded execution evidence, independent arithmetic/record/control-flow expectations, deterministic regeneration and a report below2MiB. Storage/filter policy and documentation links pass. No original assets, Rust implementation or shared VM evaluator change in this batch. No original executable or native library runs, and no complete shot/hit/damage, native trace, full VM, macOS/Linux runtime or Solari rendering parity is claimed.

## Next ten concrete tasks

1. Recover290969–290994 and291081–291314: airborne local44 adjustment, stance flags and trigonometric offset terms, with exact native argument order and f32 responses.
2. Recover291315–291475 extra offset rules for IDs10/14/23, flags8192/16384, future field6304 and recent field4404, preserving every additional RNG draw.
3. Recover291476–291640 endpoint writes, then compose complete290493 with actual sampling, math and explicit rejection budget. Check arbitrary finite basis and origin handoffs.
4. Compose293732 through actual290493, then recover291641's first trace request/record ABI. Stop at unknown world effects and preserve all caller output pointers.
5. Continue295018 after its frame:295495 muzzle, sine/cosine width, rotation61092 and the argument-local signed-right-shift seed path. Do not substitute the global36717 unsigned RNG without checking equivalence.
6. Recover295018's first per-pellet endpoint, initialized table consumption and actual trace-loop boundaries, keeping all variants and RNG updates visible.
7. Recover292545 contact/material consumers and279820 bookkeeping, following211239 damage only once reached child contracts are explicit.
8. Recover276433 entity query and native−31 linking contracts; apply recovered allocation to288903 after289113 and retain its base-selection assumptions.
9. Recover grenade223156 expiry/explosion and reached trajectory/contact/bounce consumers; establish which routine clears/spawns/frees source records and validates allocator timing/capacity.
10. Capture original reference traces and connect one validated firing path to the Rust runtime. Continue the wider native/DLL/network/content inventory and macOS/Linux Bevy/Solari gameplay/rendering work; static QVM fixtures do not establish platform support.


Follow-up: the [RE-615–624 aim/trace batch](QVM_AIM_TRACE_BATCH.md) completes the bounded aim function and extends pellet preparation to the first trace boundary. Use its next ten tasks for current unresolved work.