docs/FINDINGS.md

Initial reverse engineering findings

Snapshot date: 2026-10-10. Inspection was static. The detailed inventories live in inventory/. “Observed” describes this installation; “inferred” and “upstream reference” explicitly require further confirmation.

Installation and executable identity

F-001 — Observed: minimal repository. Before this work the checkout contained .git, an untracked .gitignore excluding /.cache/, and the cached installation. There was no Rust workspace, source tree, build pipeline, existing documentation, or applicable AGENTS.md found in the repository/ancestor locations inspected. The supplied installation contains 39 files, including 23 archives. Existing .gitignore was left unchanged.

F-002 — Observed: version 4.3.4. Linux client/server executable strings and the macOS bundle identify ioQ3 1.35 urt 4.3.4. q3ut4/readme43.txt includes the 4.3.4 changelog dated 2018-06-21. The qagame.qvm literal region also contains version: 4.3.4. This pins the reference more precisely than the UrbanTerror43 directory name.

F-003 — Observed: multiple platform binaries. The installation provides Linux ELF clients and dedicated servers for i386 and x86_64; Windows PE32 clients and dedicated servers; and a macOS x86_64 app. file identifies the Linux binaries as dynamically linked and not stripped. Printable symbol names include VM_Call, VM_CallInterpreted, VM_CallCompiled, VM_Compile, CM_BoxTrace, SV_SendClientSnapshot, and MSG_WriteDeltaPlayerstate. Symbols offer useful analysis anchors; debug type information and exact source correspondence have not been established.

F-004 — Observed: legacy macOS dependency stack. otool -L reports Cocoa, IOKit, OpenGL, and @executable_path/libSDL-1.2.0.dylib among the app's dependencies. The SDL dylib is bundled and x86_64. There is no native Apple Silicon binary in this cache. Availability of legacy execution through current macOS or translation has not been tested.

The other bundle files are Info.plist, PkgInfo (bytes APPLIOURT followed by a newline), and Resources/quake3-urt.icns (167,703 bytes, identified as ICNS with an is32 type). No standalone or PK3 member path ending in .dll appears in the initial inventory. Windows imports, dynamically loaded external DLLs, and any embedded library payloads still require analysis. The bundled dylib is part of the exhaustive scope, as are all auxiliary files.

Direct import-table inspection identifies Linux client dependencies on SDL 1.2, pthread, X11, Xxf86vm, dl, math, and libc; Linux dedicated binaries directly import dl, math, and libc. Windows binaries directly import ADVAPI32, GDI32, KERNEL32, msvcrt, USER32, WINMM, and WSOCK32; the client additionally imports ole32. These are external dependencies, not bundled DLL files. Native import metadata records exact names and inspected targets. Runtime dynamic loads, transitive dependencies, embedded implementations, and library behavior remain research tasks.

Executable sizes and full SHA-256 hashes are recorded in inventory/snapshot.json. The table below groups the executable targets; it excludes the SDL library and metadata.

Path relative to installation	Bytes	Format / role
Quake3-UrT-Ded.exe	1,082,800	Windows PE32 dedicated server
Quake3-UrT-Ded.i386	816,002	Linux ELF i386 dedicated server
Quake3-UrT-Ded.x86_64	961,958	Linux ELF x86_64 dedicated server
Quake3-UrT.app/Contents/MacOS/Quake3-UrT.x86_64	1,713,680	macOS Mach-O x86_64 client
Quake3-UrT.exe	2,634,689	Windows PE32 client
Quake3-UrT.i386	1,702,624	Linux ELF i386 client
Quake3-UrT.x86_64	1,940,280	Linux ELF x86_64 client

Archives, formats, and loading hazards

F-005 — Observed: PK3 archives are readable ZIP containers. All 23 archives opened successfully using Python zipfile, and CRC/decompression checks passed for every member. They contain 9,835 non-directory members, totaling 3,125,455,778 uncompressed bytes (about 2.91 GiB), in 1,476,022,665 bytes of archives (about 1.37 GiB). Do not budget disk only for the compressed source: extracted, intermediate, converted, and reference captures need additional space.

Archive	Members	Compressed bytes	Expanded bytes	BSP occurrences
ut4_jumpents.pk3	7	128,107	1,666,557	1
zUrT43_001.pk3	710	77,799,633	215,233,472	0
zUrT43_002.pk3	98	73,378,053	257,879,005	16
zUrT43_003.pk3	52	67,657,413	240,202,610	14
zUrT43_004.pk3	443	79,753,661	218,260,155	4
zUrT43_005.pk3	756	81,670,979	168,585,944	0
zUrT43_006.pk3	548	66,957,810	138,570,159	0
zUrT43_007.pk3	365	79,245,011	168,672,526	0
zUrT43_008.pk3	898	70,888,281	173,153,240	0
zUrT43_009.pk3	429	79,055,075	104,681,786	0
zUrT43_010.pk3	1,320	78,055,708	119,475,016	0
zUrT43_011.pk3	454	83,375,098	176,985,923	0
zUrT43_012.pk3	252	81,522,127	181,429,550	0
zUrT43_013.pk3	345	77,745,672	116,378,042	0
zUrT43_014.pk3	499	87,697,729	162,905,568	0
zUrT43_015.pk3	57	79,575,542	129,993,325	0
zUrT43_016.pk3	455	95,695,538	162,520,234	0
zUrT43_017.pk3	695	81,088,755	150,711,787	0
zUrT43_018.pk3	775	76,060,663	122,948,669	0
zUrT43_019.pk3	328	46,012,128	78,911,406	0
zUrT43_020.pk3	278	4,587,832	14,289,349	0
zUrT43_021.pk3	68	7,506,845	19,770,763	1
zUrT43_qvm.pk3	3	565,005	2,230,692	0

F-006 — Observed: overrides and case collisions. There are 9,721 distinct exact-case member paths, 9,718 casefold-distinct paths, and 114 exact-case repeat events under ascending archive-name indexing. zUrT43_021.pk3 contains another maps/ut4_paris.bsp and associated AAS, arena, and shader paths, following earlier versions. The newest-numbered archive is a patch candidate, but the exact supplied engine's search order still requires confirmation.

Three sound collision groups differ only by FRF1 versus frf1: frf1-inside.wav, frf1-outside.wav, and frf1-shelldrop.wav. Inside/outside variants differ in size and CRC; shell-drop variants match size/CRC. A naive extraction onto default case-insensitive macOS storage can destroy provenance or select different sound data. Preserve archive/path identity until lookup behavior is specified.

F-007 — Observed: full format census. Counts below distinguish member occurrences from exact-case distinct paths under the provisional selection rule. There are 619 distinct MD3 paths, 208 shader files, 51 menu files, 437 skins, 870 WAV files, six binary font .dat files, and several authoring/support formats. Extensions alone are insufficient to decide what is loaded at runtime.

Extension	Member occurrences	Distinct exact-case paths
(none)	2	2
.aas	36	34
.arena	66	33
.ase	4	4
.bot	14	14
.bsp	36	35
.c	166	132
.cfg	52	51
.crosshair	1	1
.dat	6	6
.db	4	4
.def	1	1
.gif	1	1
.h	9	8
.jpeg	1	1
.jpg	3,314	3,314
.map	1	1
.md3	619	619
.menu	51	51
.mp3	1	1
.png	14	14
.prt	1	1
.qvm	3	3
.rad	10	10
.roq	1	1
.shader	209	208
.skin	437	437
.srf	1	1
.tga	3,749	3,746
.txt	117	116
.voice	1	1
.wav	907	870

The .c and .h members largely comprise bot definitions and headers. Outside botfiles/, the selected C/header paths are models/animdef.h and ui/menudef.h. This installation does not contain a complete native or QVM gameplay source tree. Four ASE files describe grass models. There is one .map, .prt, and .srf, associated with the jump-entity example; they are not source material for every map. Auxiliary Thumbs.db and Adobe Bridge files also occur.

F-008 — Observed: legacy material complexity. A line-token survey of shader text sees stage textures/blends, RGB/alpha generation, scrolling/rotation/turbulence, environment/lightmap coordinates, autosprites, wave/move deformation, sky, fog, compiler lighting hints, and material/content markers such as ladder, slick, water, glass, playerclip, nodamage, and nodrop. This survey includes potentially commented or inactive directives and misspellings; it is not a validated shader grammar or proof that the renderer supports every token. Direct conversion to a single generic PBR material cannot be assumed to preserve these effects or gameplay flags.

Maps, geometry, and entities

F-009 — Observed: BSP46 and AAS5. All 36 BSP member occurrences have IBSP magic and version 46. There are 35 distinct BSP paths, including the jump demonstration, and all 17 lump ranges in each selected candidate fit within its file. All 34 selected AAS files have EAAS magic and version 5. Every distinct BSP has a matching AAS path except ut4_jumpents.

Selected BSP face records contain 363,564 type-1, 7,275 type-2, and 18,814 type-3 surfaces; type 4 was not found in this snapshot. Standard Quake III definitions label these planar, patch, triangle-soup, and flare types respectively; that interpretation is an upstream reference to verify against the supplied engine. The inventory sees 131 surface-flag combinations and 20 contents combinations. See id Software's format declarations.

F-010 — Observed: 47 entity class names. A survey of the 35 selected BSP entity lumps finds 11,836 classname occurrences across 47 class names. Common classes include 4,506 info_ut_spawn, 2,175 target_location, 751 target_speaker, 427 func_breakable, 363 func_wall, 128 func_rotating_door, and 107 func_door occurrences. Also present are bomb sites, CTF flags, CAH points, ladders represented through materials/content rather than a presumed class, movers, buttons, portals, location triggers, jump timers/hints, ut_mrsentry, func_ut_train, path_ut_stop, func_keyboard_interface, and cubemap_probe. A class being present does not establish that it is spawned or active in every mode.

scripts/urbanterror.def documents 16 entity declarations, including keys and spawnflags for several UrT-specific entities. This is valuable evidence, but not complete documentation of all 47 classes. The class matrix and per-map entity/lump data enumerate the actual scope.

F-011 — Observed: a supplied map-authoring example. ut4_jumpents.pk3 has seven members, including a BSP, .map, .prt, .srf, .rad, image, and readme. Its readme explicitly describes it as a demonstration of Jump start/stop/cancel timers rather than a map designed for normal play. It is a useful compact test fixture. The example mapcycle contains 32 names, all of which resolve to distinct BSP paths in the inventory.

Models, animation, sound, and UI

F-012 — Observed: vertex animation and attachments. All 619 MD3 paths have IDP3 version 15. Of these, 537 have one frame and 82 have multiple frames. Athena's lower.md3 has 836 frames; upper.md3 has 979. Tags surveyed in first frames include torso/head, weapon, muzzle, eject, laser, clip, bolt, pin, and camera attachments. Player directories are athena, orion, gear, and funstuff. They require vertex-frame and tag-transform semantics, not an assumed skeletal rig.

models/animdef.h names weapon and player animation states, including wall jump, ledge climb, death, climbing, and weapon-specific transitions. The AK103 animation file has named states with Start/Count/FPS/Loop fields; its sound file binds reload sounds to frame numbers and defines inside/outside/water/silenced shot sounds. These observed examples establish the need to inspect all corresponding configurations, not just mesh geometry.

The 29 subdirectories under models/weapons2/ include weapons and supporting categories: 44magnum, ak103, benellim9, beretta, bombbag, colt1911, deserteagle, flash, frf1, g36, glock, grenade, handskins, hk69, knife, m4, mac11, machinegun, misc, mp5k, negev, p90, psg1, shells, spas12, sr8, tod50, ump45, and zm300. A directory is not proof of an active selectable weapon. Bot inventory labels also mention LR, multiple grenade categories, and bomb; their constants are hints, not recovered authoritative weapon IDs.

F-013 — Observed: audio variety. All 870 selected WAV files inspected identify PCM codec 1 in their RIFF format chunk. They include 8/16-bit audio, mono/stereo, and numerous rates, from 8 kHz to 96 kHz, including unusual rates such as 10,989 and 16,574 Hz. There is also a single MP3 (sound/weapons/FRF1/frf1-shot-outside.mp3), menu music stored as WAV, and an RoQ video (video/idlogo.roq). File headers alone do not establish gain, looping, spatialization, or which files are actually used.

F-014 — Observed: menus, fonts, and configuration. The installation includes .menu definitions, ui/menudef.h, shaders/images for UI, six font metrics files with TGA atlas pages, .crosshair, .voice, .arena, .bot, and configuration data. default.cfg defines input bindings, gear-related commands, console, radio, demo recording, and presentation settings. Example/default values include snaps 20, com_maxfps 125, gravity 800, and a 16-client example server setting; these are configuration evidence, not measured timing or runtime limits. The readme says the 4.3.2 engine locked sv_fps/snaps back to 20; verify it experimentally before setting simulation contracts.

gameinfo.txt and server_example.cfg list 11 gametypes, plus modifiers such as Instagib. The latter exposes matchmode, auth, votes, restrictions, respawn/wave behavior, friendly fire, bomb timing, Jump settings, Freeze Tag timing, Gun Game ordering, and log settings. The example config sometimes assigns a value different from its comment's claimed default. Recover registered runtime defaults rather than trusting either blindly.

Rights and service dependencies

F-015 — Observed: supplied reuse restrictions and attribution material. q3ut4/readme43.txt says the game/mod files are copyrighted by FrozenSand and community contributors and asks anyone wishing to reuse official media to obtain permission. The installation includes QIIIA_Game_Source_License.doc, an old Word compound document that has not been fully extracted or interpreted in this pass. Numerous per-map/model readmes and fonts/ROBOTO_LICENSE.txt provide additional material to audit. Record rights per asset family and choose a distribution model before bundling original/converted media. This is evidence from supplied files, not a completed legal assessment or a reason to halt the requested documentation.

F-016 — Observed: external services and integrity controls. Example configuration refers to master servers, account/group/tag authentication, bans, content downloads, sv_pure, rcon, and historical PunkBuster use when hosted by Quake III. Executable strings include auth functions and pure/network error messages. Service availability, account interoperability, pure-checksum details, actual protocol numbers, and legacy anti-cheat compatibility have not been tested.

QVM modules and engine boundary

F-017 — Observed: three original-format QVMs. zUrT43_qvm.pk3 contains vm/cgame.qvm, vm/qagame.qvm, and vm/ui.qvm. Their first 32 bytes decode to magic 0x12721444 and eight little-endian words matching the original Quake III VM header layout. The module split and field interpretation are supported by upstream QVM declarations and VM loading code; exact syscall/ABI extensions remain research work.

Module	File bytes	Instruction count	Code bytes	Data bytes	Literal bytes	BSS bytes
vm/cgame.qvm	880,264	258,563	759,988	62,940	57,304	37,935,304
vm/qagame.qvm	983,300	298,900	885,716	33,364	64,188	36,445,748
vm/ui.qvm	367,128	101,585	303,832	31,072	32,192	9,099,016

All three headers have code offset 32; the declared code, data, and literal sections account for their file lengths. Declared zero-initialized/BSS lengths are much larger than file contents. Do not assume code length equals instruction count, native pointers match VM words, or the memory layout matches unmodified Quake III. Printable literal-region strings can anchor analysis, but no instruction decoding, call graph, data structure layout, or gameplay algorithm has been recovered yet.

F-018 — Inferred: strong research route. Start with unstripped Linux native engines for service/VM boundaries, QVMs for UrT game rules, and static configuration/entity/animation text for data-driven behavior. Use corresponding open engine code as a reference only after establishing version differences. Quake III source is available from id Software and ioquake3 from its upstream repository; availability does not prove the shipped fork matches it.

External primary-source checks

F-019 — Upstream reference, checked 2026-10-10: Bevy 0.20 release notes report release on 2026-10-08 and Solari support on macOS through Metal. They also report no included macOS denoiser and lighting support limits. Treat 0.20 as a candidate to validate and pin, not an already selected dependency. Hardware and frame-quality results remain unknown.

F-020 — Upstream reference: the inspected Solari plugin source requests experimental ray queries, resource binding arrays, and nonuniform indexing. The official example configures raytracing meshes, StandardMaterial, camera storage usage, disabled MSAA, compatible mesh attributes/indices, and optional DLSS ray reconstruction. These are moving main references; capture an exact release/commit before implementation. They do not establish support for converted MD3 animation, legacy shader effects, or the user's GPU.

F-021 — Upstream reference: ioquake3 filesystem code documents layered home/base/game search paths, patch archive precedence, and server-dependent pure handling. This motivates reproducing the supplied fork's resolver before selecting assets, rather than simply expanding all ZIPs into one directory.

Unanswered questions driving the plan

Exact native fork/source revision, runtime resource lookup, legacy launch environment, protocol and structure layouts, QVM linkage checks/extensions, movement constants, collision/hitboxes, weapon IDs and timings, gametype edge cases, bots, actual shader interpretation, animation behavior, remote service dependencies, denoising, GPU support, and release-content permissions remain open. The subsequent TODO documents cover each explicitly.

First binary analysis update — 2026-10-11

F-022 — Observed: full static QVM decoding. All three supplied modules decode to 659,048 instructions, with valid immediate branch indices and exactly one zero code-padding byte each. A revision-pinned upstream opcode/width comparison and synthetic/shipped fixtures validate structure and exact byte reconstruction. VM-001 records section/memory details and limitations.

F-023 — Observed dispatch, inferred command labels. Entry-prologue tables cover cgame commands 0–8, qagame 0–13 and UI 0–11. qagame commands 11–13 and UI command 11 have no name in the pinned upstream export enums. Full traces, table reads and case addresses are recorded; names/arguments/results need further recovery. VM-002.

F-024 — Observed static ABI bridges. Four native Linux x86_64 syscall tables connect observed QVM numbers to native case addresses. Game 601 calls packet-sending routines and game 603 calls SV_Auth_DropClient; UI 88/90 include address/packet functions. Number meanings are module-specific, including differing math helper slot 111. Signatures, protocols and runtime behavior remain unverified. NAT-004.

F-025 — Observed: all eight native images retain symbols. Reusable parsing/disassembly now covers every engine and the bundled dylib, with imports, section/symbol records, strings, build metadata, debug-status evidence and address anchors. The supplied SDL reports 1.2.15 through a static version object/accessor and retains 4,719 STABS records; the app retains 34. Lack of DWARF sections does not mean lack of debug information. NAT-001/003.

F-026 — Observed absence within a bounded scan. No packaged DLL or native-image prefix occurs in the extracted members. External Windows DLL imports and additional dynamic-library string candidates exist. Interior native-magic candidates fail the supported plain-image parsers; compressed/encrypted/headerless embedded implementations are not ruled out. NAT-001/002.

F-027 — Unknown: remaining binary semantics. The reports retain 519 unresolved QVM call sites and provisional function/string/control-flow candidates. Most native functions remain unreviewed; extra entry commands, argument structures, library patches, loader behavior, resources and cross-platform ABI parity remain explicit tasks. Static decoding has not established gameplay rules or Rust replacement behavior. Completion and next steps.

F-028 — Observed/inferred: four extension entry roles. Matching QVM bodies, string references and Linux ELF64 native callers identify qagame 11 as heartbeat, 12 as shutdown, 13 as server authentication message handling, and UI 11 as authentication response handling. These are descriptive roles, not recovered source names or complete protocol specifications. All four QVM entry cases discard the callee result and return zero. ABI-001 evidence and limits.

F-029 — Observed: Linux ELF64 network/auth extension boundaries. Game 600/UI 88 parse a string into a VM address buffer; game 601/UI 90 pass socket, length, packet buffer and resolved destination to NET_SendPacket, then return zero without checking the parser result in the dispatch case. Game 603 converts two pointers and checks the client index before calling SV_Auth_DropClient. The parser/send boundary uses a 12-byte native address, with IPv4 at offset 4 and port at offset 8. Other platform contracts and full error/packet semantics remain unresolved. ABI-002/003.

F-030 — Observed: SDL/client Mach-O debug-map ranges. Raw STABS yield 1,012 nonoverlapping SDL function ranges associated with 78 source/object entries, plus six client SDLMain launcher ranges. No local/parameter/type-description classes were observed. Source paths suggest SDL 1.2.15 build provenance, not a verified upstream implementation match. SDL text still contains 524 bytes outside these ranges. META-001.

F-031 — Observed: Windows resource contents and icon discrepancy. The client PE has nine leaves: seven icon images, one string block and one icon group, all language 1033; the dedicated PE has no resource directory. A reconstructed ICO preserves every image byte. Four 32-bit image payloads exceed their standard DIB pixel/mask extent; their surplus remains preserved and unclassified. META-002/003.

F-032 — Observed: bounded native byte regions reconciled. The SDL text bytes outside debug-map function ranges are 70 NOP runs totaling 524 bytes. Windows client resource bytes partition into 353,268 payload bytes and 520 tree-structure bytes, with no unreferenced gaps. This resolves the previously unclassified bytes in these two regions, not whole-binary semantics. COV-001/002.

F-033 — Observed/inferred: authentication drop boundary and deferred QVM branch. Linux ELF64 trap 603 receives index/broadcast text/disconnect reason; valid completion and invalid-index guards both return zero. The QVM caller validates slot and states 1/2; state 1 calls a helper with record buffers and limits 128/256, then sets a flag, while state 2 invokes the native service. Deferred-consumer behavior, state names, pointer errors and other platforms remain open. AUTH-001/002.

F-034 — Observed: bounded copy and error-service chain. QVM helper 69338 calls trap 102 with capacity minus one and explicitly NUL-terminates the final destination byte. Null source/nonpositive capacity route through wrappers to game trap 1 and native Com_Error mode 1, not a print-only service. The native handler's full exit/escalation behavior remains open. DEF-001.

F-035 — Observed: deferred-drop sentinel/timestamp and strict delay. Eight direct constant-offset references show field 3588 changing from sentinel 1 to current time in the begin callback, then being consumed by the frame callback only for state 2, positive pending value and signed elapsed > 100. Synthetic instruction-slice tests verify 100/101 boundaries and wrap; actual runtime timing, aliases, state names and reentrancy remain open. DEF-002/003.

F-036 — Observed/inferred: simulation milliseconds and restart guard. Both Linux ELF64 server loops derive ticks from 1000/sv_fps, adjust by timescale and pass accumulated game time to VM command 8. This establishes simulation milliseconds for the deferred-drop > 100 comparison. A native time guard branches to shutdown/map command construction above 0x70000000; synthetic wrap cases are not evidence of normal runtime reachability. CTL-001.

F-037 — Observed: error frame-abort versus process-exit paths. Linux mode-1 Com_Error ordinarily shuts down/disconnects and longjmps to the frame boundary. Build-script, close-spaced repeated errors and recursion can select process-exit paths through Sys_Error/_exit(1). Complete cleanup/platform parity remain open. CTL-002.

F-038 — Observed: authentication announcement helper. The begin callback's field-3200 gate sets a one-shot value before invoking helper 165352, whose formats and trap-17 calls announce authentication/account status through print/chat commands. Recipient/mode/state-update semantics and permission rules are not yet specified. CTL-003.

Frame timing and event-source update — 2026-10-11

F-039 — Observed static branches, synthetic instruction traces: both Linux ELF64 helpers apply nonzero fixed time before nonzero-timescale float multiplication, use a separate camera/zero-timescale branch, and cap intervals at 200 or 5000 ms according to dedicated/server cvars. Dedicated running-server candidates strictly greater than 500 ms trigger a diagnostic. Zero timescale alone does not force zero elapsed; finite bounded fixtures distinguish the branches. TIME-001.

F-040 — Observed event-source and dispatch bytes: Sys_GetEvent emits a zero-type record with a host timestamp when no event is queued; journal modes can replace or record those events. Both seven-entry native switch tables map key/character/mouse/joystick/console/packet paths. Com_Frame derives raw elapsed from the event-loop return before applying its inlined modifier. Complete scheduling and runtime wrap behavior remain open. TIME-002.

F-041 — Observed native pause predicates: cl_paused gates a native record count using state > 1 and unsigned field 0x24ee4 >= 1; count <= 1 selects sv_paused=1, larger counts select zero. SV_Frame inlines the gate before simulation steps. The counted field’s semantic name, game timeout interactions and runtime/platform parity remain unknown. TIME-003.

Native queue and pause-field update — 2026-10-11

F-042 — Observed Linux ELF64 address-type chain: client field 0x24ee4 is netchannel address type, with bot zero, loopback two and an IPv4-format path at four. Bot allocation writes zero and drop cleanup uses the corresponding bot-free path. This resolves F-041’s unnamed count field: the pause predicate excludes bots. Complete lifecycle and runtime behavior remain open. EVT-001.

F-043 — Observed native ring/clock paths, synthetic journal validation: platform/common queues retain 256/1024 records of 32 bytes; ordinary full insertion frees the overwritten nonnull payload and advances tail. Common overflow warnings are throttled until a nonfull insertion. Com_Milliseconds preserves nonzero real events in the common queue before returning a zero-type event timestamp, including journal-derived time. A bounded Linux ELF64 journal inspector preserves pointer/padding metadata without dereferencing it. No original capture or runtime conformance is claimed. EVT-002/003.

Authentication announcement update — 2026-10-11

F-044 — Observed table and branch evidence: qagame helper 165352 chooses signed status values -1..2 or role values -1..8 according to the byte-count helper result for record+3624. Negative one produces an empty suffix; out-of-range values produce ERROR. The role table contains Disabled through Frozen Sand Developer labels. These are presentation values, not a recovered permission policy. ANN-001.

F-045 — Observed recipient paths, bounded synthetic fixtures: mode one targets record+140 with print; mode two selects diagnostics for a zero third argument or targeted detailed chat via a client-pointer/6336 calculation. Other modes consult global 35002972 for broadcast print/chat or no output. Linux trap 17 maps recipient -1 to NULL broadcast selection; native command forwarding rejects length greater than 1022. Only two direct CONST-3200 references are found, both begin read/set; bulk reset and alias behavior remain unknown. ANN-002/003.

Game cvar and announcement caller update — 2026-10-11

F-046 — Observed main registry: qagame initializes a 126-row, 28-byte cvar table at VM address 4, ending at count word 3532. All unique names, supplied defaults, raw flags and mirror pointers are now extracted and registration arguments verified through bounded decoded-instruction traces. Other registrations and effective runtime policy remain open. CVAR-001.

F-047 — Observed verbosity identity and caller paths: announcer global 35002972 is auth_verbosity’s mirror integer at base 35002960+12, with supplied default 1. Both Linux ELF64 updates use a 256-byte mirror string bound and mode-1 errors for invalid handles/long values. Three direct callers select query mode 2, response mode 0 and begin mode 1; response calls for any positive verbosity, while the fallback outputs only for exactly 1/2. Positive gate 35017616 is a distinct unresolved field. CVAR-002/003.

F-048 — Cvar notifications and empty change helper

The main qagame update loop skips null mirrors/unchanged modification counts and updates its cached count before per-row behavior. Row word 20 enables notifications in 64 initialized rows; gear has a special branch, while raw flag bit 32 selects next-map wording. Row word 24 marks a call to entry 2589, which is empty in this build; every supplied main row initializes that word to zero. Bounded fixtures do not enter the native update or formatter callees (CHG-001).

F-049 — Setting corrections and additional registration sites

Bounded qagame paths recover bomb-plant/inactivity correction requests, direct funstuff/strategy mirror edits and configstring indices 1007/1010. Requesting a cvar change does not prove an immediate mirror update. The direct trap-3 scan finds 28 sites in eight partitions; 23 constant-argument slices are evaluated exactly, including sv_master1=master.urbanterror.info and g_modversion=4.3.4. Dynamic/table/stack-mirror and native merge/flag policies remain incomplete (CHG-002/003).

F-050 — Observed selector/helper behavior: qagame selector 253561 classifies digit-only strings for numeric parsing; signed slot bounds and state-zero rejection precede success slot assignment. Name scanning cleans copied names, prefers the first exact match over partial matches, and rejects ambiguous partial results. Bounded byte fixtures establish color/caret/control-byte cleanup and ASCII case-insensitive substring behavior; full selector/parser/copy limits remain open. QUERY-001.

F-051 — Observed query command policy/routes: role checker 167097 requires mode-positive, a caller, nonempty command, state exactly 2 and roles 2–8. Friend/Member/Referee search their configured command strings as substrings; roles 5–8 reject exact public and accept other compared text. Two direct auth-whois routes forward client/tokenized-selector or zero/argv-1; only the visible client route invokes the role checker. Native entry/access controls and end-to-end permission behavior remain open. QUERY-002.

F-052 — Observed internal authentication mode: gate 35017616 is separate from the registered auth mirror. Eight literal stores in entry 171 select zero/public/private/notoriety paths after engine, dedicated and feature prerequisites. Nonempty groups take precedence over notoriety. Address-resolution failure clears the gate and requests Off (no authserver) without a visible auth=0 request in that tail. Scheduling, alias writes and native configuration lifecycle remain open. QUERY-003.

F-053 — Observed parser instructions and bounded wrap: qagame integer helper 37159 skips signed bytes at most 32, consumes one sign, and accumulates digits until a nondigit without a visible overflow guard. Bounded 32-bit traces produce 0/3 from 4294967296/4294967299, and composed digit/parser/bounds slices accept those results with count four. Original interpreter/JIT behavior remains unverified. BND-001.

F-054 — Observed selector storage/count invariants: name copy passes capacity 64, yielding trap copy count 63 and an explicit NUL at offset 63. Match pointers occupy the inferred 64-entry local region; a synthetic 65th insertion reaches local 352. QVM count 34992524 comes from sv_maxclients's integer mirror and record storage clears 64*6336 bytes. Both Linux ELF64 startup graphs request native correction into 1–64, but complete cvar/restart/mutation invariants remain open. BND-002.

F-055 — Observed dispatcher/chat mode separation: native VM commands 0/6/9 connect to qagame initialization/client/console routes. The client dispatcher calls chat entry 187911 for say/say_team/me with modes 0/1/4; all three callers pass third argument zero and take the path toward slash/auth checks. The earlier third-argument/channel-mode mapping is corrected in BND-003. Native SV_GameCommand requires server state 2 before command nine. Full native filtering, console/rcon access and nonzero chat behavior remain open. BND-003.

F-056 — Observed native command metadata/filter paths: both Linux ELF64 engines contain the same eight built-in client-command pairs. Unmatched game forwarding requires its native flag plus server/client states 2/4; sanitation replaces argument CR/LF. Graphs establish weighted budgets 256 for say/say_team/tell and 122 for ut_radio, with extra dollar weighting and a six-dollar guard. Full caller/flood/tokenizer behavior remains open. CHAT-001.

F-057 — Observed bounded chat assembly/gates: helper 180858 checks used+token_length strictly below 1023, appends nonfinal separators and writes NUL; helper 186721 has mute deadline, g_allowChat, ignore-word, recipient-state and team/self gates. Later formatting/dead-chat/queue/lifecycle behavior remains open. The earlier BND-003 third-argument/channel-mode mapping is corrected: all three observed chat callers pass zero third argument and can reach slash/auth checks. CHAT-002/003 and correction.

F-058 — Observed dead-chat predicates: raw sender/recipient fields derive five flags with unequal spectator comparisons and two death alternatives. 512 synthetic instruction paths distinguish policy 1's spectator restriction/team exception, policy 2 and default policy; game-type 9 bypasses these policy restrictions. Earlier recipient gates and field/global lifecycle remain open. DEL-001.

F-059 — Observed chat formatter arguments: a guarded five-entry mode table and bounded delivery paths select cchat/tcchat/me, SUB-over-DEAD and independent SPEC labels, private direction markers and byte-25 prefixes. Aligned synthetic objects produce trap-17 slots 3/2. Recorded formatter returns are placeholders, so escaping, formatted commands and rendered output remain unverified. DEL-002.

F-060 — Observed delivery call topology: explicit-target paths suppress redundant self echo and skip sender echo for object flag bit 8; fanout constructs stride-880 slot objects and can invoke cleanup per iteration. Recorded calls do not establish accepted recipients or actual cleanup results. DEL-003.

F-061 — Observed marker parser states: dollar/hash markers collect ASCII letters and query each growing prefix; nonzero lookup clears the marker, while unmatched delimiter/end routes preserve literal arguments. Source length >150 rejects, but acceptance at 150 still requests capacity 150. Copy/append/lookup composition and actual output bounds remain open. EXP-001.

F-062 — Observed substitution keys: twelve exact supplied keys use comparator 69386 with bound 99999. Bounded byte traces confirm ASCII case-insensitive terminated equality and reject shortened/extended keys. All bodies are retained; weapon/timer/location/leader/crosshair behavior remains incomplete. EXP-002.

F-063 — Observed health and momo differences: health labels split at 25/50/75; health/hp dead override tests offset 4 >=3, whereas delivery's dead flag uses ==3. The momo branch clears the shared buffer, optionally writes now+3500 and 2 through record pointer 6168, and returns zero. Field ownership, formatted output and runtime wrap remain unverified. EXP-003.

F-064 — Observed ammunition extraction: clips/bullets read the high byte and bits 8–15 of a selected packed record word; weapon uses the low byte. Post-format replacement uses offset-4 >=3 or offset-4324 nonzero. Inventory/reload producer semantics and selector bounds remain open. ITEM-001.

F-065 — Observed sampled item names: weapon-name words use 4020+432*low_byte; sampled indices 0–29 include duplicate None strings and a NULL pointer at 18. This does not establish legal IDs or complete table extent. Game-item types 7/8 select flag/bomb; other paths branch on helper-36717's least-significant bit with RNG semantics unresolved. ITEM-002.

F-066 — Observed countdown predicates: gametime uses registered timelimit integer times 60000 minus elapsed; nonpositive results request no timelimit even at expiry. Roundtime requires positive remaining and types 4/5/8/10. Boundary/wrap traces are synthetic; timer writers, active cvar bounds, output and original-runtime conformance remain open. ITEM-003.

F-067 — Observed leader selection: helper 169397 returns the first nonzero-state record with matching team and nonzero leader flag, or -1. The leader substitution uses a stride-880 record-pointer/name address chain on success; isolated failure skips its formatter. Role/state lifecycle, caller default composition and runtime output remain open. LOC-001.

F-068 — Observed cached location contract: nonzero object field 848 returns only when signed now < pointed-field 596; equality misses. Wrapper 268637 returns zero without formatting on NULL, otherwise formats pointed-field 592 and returns one. Cache writers, source validity, caller failure handling and signed-wrap conformance remain open. LOC-002.

F-069 — Observed location list/search structure: guarded registration publishes unknown at configstring 640, numbers qualifying objects and inserts reverse-order links through *(object+524)+24. Static lookup retains first trigger_location in a 40/40/52 query box, then distance <= best plus visibility fallback. Geometry/engine services, raw tag identity, list lifecycle and runtime/platform parity remain unverified. LOC-003.

F-070 — Observed crosshair arithmetic: offset-4 >=3/override bypasses geometry; other paths use paired angle-service outputs, object-position plus integer height, and forward times 30000. Finite cardinal instruction fixtures verify basis/endpoint routing while native trig and coordinate conventions remain open. AIM-001.

F-071 — Observed crosshair trace arguments: service 24 receives result/origin/NULL/NULL/endpoint pointers, sender-record field 140 and mask 1. G_TRACE remains a pinned upstream candidate; full shipped structure/service semantics and runtime collision are unverified. AIM-002.

F-072 — Observed crosshair result handling: trace word +4 exactly 1 requests unknown then sender location. Other observed words build a cache-cleared temporary object from result +12/+16/+20; a subsequent comparison return zero triggers sender fallback. Calls/returns remain synthetic placeholders or isolated supplied inputs, so actual endpoint output/failure behavior is open. AIM-003.

F-073 — Confirmed Linux trig/spatial destinations: both ELF64 engines map services 103/104 to sinf/cosf, 24 to SV_Trace, 26 to SV_inPVS and 32 to SV_AreaEntities. Trig returns single-precision integer bit patterns; static transport mappings now corroborate prior QVM candidates. Runtime and other-platform equivalence remain open. NAT-001.

F-074 — Observed VM pointer branch distinction: raw zero/currentVM NULL returns NULL; other arguments use direct base addition or signed-extended 32-bit masking followed by addition. A nonzero argument that masks to zero can return the data base. Paired synthetic instruction traces do not establish legal allocation/mask invariants. NAT-002.

F-075 — Observed native spatial structure: trace NULL extents reference zero-fill storage and return copies span 56 bytes; PVS combines cluster bits with area connectivity. Area queries write four-byte indices and test equality with capacity before warning. Full fields/geometry/portals/tree ownership and runtime behavior remain open. NAT-003.

F-076 — Observed native candidate exclusions: pass sentinel 1023 bypasses candidate/pass/related-word exclusions but not content-mask overlap. Paired first-lane instruction probes distinguish nonzero contents from actual mask overlap; complete owner/layout/producer/lane behavior remains open. HIT-001.

F-077 — Observed trace decision separation: candidate status updates precede finite strict candidate-float < current-float replacement; equal floats skip copy. Static copy paths preserve prior offset-4 status with OR and write candidate identity at result +52. Complete status/copy/world/lane/runtime composition remains open. HIT-002.

F-078 — Observed model/transform routes: inline model selection uses candidate field 0x1b0 and index 0xa0; temporary models use bounds and byte-flag selection. Transformed trace routes preserve origin/orientation pointers. Full flags, ownership and brush/patch/capsule/runtime geometry remain unverified. HIT-003.

F-079 — Observed merge-lane agreement: all three native clip result lanes give identical words across tested statuses, finite fractions and prior offset-4 bits. Equality/farther candidates retain the old payload/identifier despite possible status updates. Complete loop scheduling and geometry remain open. MIX-001.

F-080 — Observed byte-copy/status composition: closer-hit paths copy 56 bytes, overwrite the candidate identifier from object word zero, and OR saved prior/intermediate status into result +4. Byte-addressed fixtures preserve copy boundaries and distinguish status from payload selection. Canonical field values and runtime conformance remain open. MIX-002.

F-081 — Observed world-result decisions: fraction exactly one assigns identifier 1023; other tested finite values assign 1022. Positive/negative zero skips entity clipping toward result copying. These are supplied-result instruction slices, not executed world collisions or complete sentinel semantics. MIX-003.

F-082 — Observed clip entry gates: signed count <=0 or nonzero current status0 stops processing; positive odd counts start ordinary lane 0 and positive even counts start peeled lane 2. Paired synthetic instruction slices establish parity routing, not area-query counts/order or runtime reachability. LOOP-001.

F-083 — Observed clipping scheduling invariant: only lane 0 checks incremented counter == count; the paired and peeled continuations rely on parity and stop on nonzero status0. Supplied compositions visit consecutive four-byte array entries through counts 1023/1024. Count ownership, candidate bodies/callees and runtime safety remain open. LOOP-002.

F-084 — Observed related sentinel normalization: pass 1023 skips entity lookup and writes 0xffffffff; other passes request lookup, whose supplied object +0x200 word is independently normalized from 1023 to 0xffffffff. Complete entity bounds, ownership semantics and runtime validity remain unverified. LOOP-003.

F-085 — Observed registered entity arithmetic: SV_GentityNum multiplies index/registered stride in 32 bits, sign-extends the product and adds the base without a local bounds check. Exact server-record fixtures corroborate stride 312 and modular inverse index recovery. Registered ABI/lifetime/validity and runtime/platform behavior remain open. AREA-001.

F-086 — Observed area overlap/capacity boundaries: finite candidate-box comparisons include touching faces/edges/corners. Accepted entries test count == capacity before a four-byte index write and count increment; deliberately invalid counts expose the guard's equality-only nature. Count/array ownership and runtime safety remain unverified. AREA-002.

F-087 — Observed area ordering and split rules: local linked records precede children; maximum > split requests child 0 before minimum < split tail-selects child 1. Axis -1 returns. Plane equality excludes each corresponding child, so completeness depends on node placement; full trees/callees/runtime remain open. AREA-003.

F-088 — Observed sector construction: depth ==4 ends construction; X extent > Y selects X, otherwise Y, ignoring Z. Explicit depth-zero compositions yield 31 preorder nodes. Synthetic count 64 aliases the adjacent counter, so valid reset/count ownership remains essential and unverified at runtime. LINK-001.

F-089 — Observed placement and list order: strictly one-sided bounds descend; touching/crossing bounds stay at the parent. Link tails prepend the server record and set owner/linked words; repeated distinct-record insertions reverse insertion order. Full bounds/metadata/relink/query/runtime composition remains open. LINK-002.

F-090 — Observed unlink state: NULL owner skips removal; nonzero owner clears before head/predecessor search. Missing/empty cases select a warning, and removed-record next remains unchanged. Lifecycle/list validity and full runtime/platform behavior remain open. LINK-003.

F-091 — Observed padded entity bounds: ordinary bounds add origin/local extents; nonzero model plus tested nonzero orientation uses an origin ± radius cube. Radius clears component sign bits and combines maximum absolute extents; both paths expand by verified 1.0. Full transformed geometry and float/runtime conformance remain open. BOUNDS-001.

F-092 — Observed leaf-query gates: metadata resets precede a capacity-128 bound query request. Supplied zero count exits, positive counts request first leaf area, and negative count requests fallback cluster from the extra output. Actual BSP returns and full area/cluster behavior remain unverified. BOUNDS-002.

F-093 — Observed inline removal precondition: owned-record fixtures agree with standalone unlink on repairs/clears/stale next/warnings. A NULL-owner inline precheck skips the linked-word clear that standalone unlink performs. Membership/reset/ABI consistency and full relink/runtime behavior remain open. BOUNDS-003.

F-094 — Observed area accumulation: -1 is skipped; the first area persists while later distinct areas can replace the second. A third distinct area requests a diagnostic only for raw sv state word one. All area lanes are exercised with supplied returns; actual map ordering/state/consumers remain open. META-001.

F-095 — Observed cluster capacity: qualifying IDs append without deduplication; new count exactly sixteen requests the retained-leaf fallback and preserves all sixteen entries. Area visitation completes first, and remaining cluster calls stop. Real geometry, output ownership and runtime behavior remain unverified. META-002.

F-096 — Observed leaf/query outputs: guarded native leaf access uses stride 24 with cluster +0 and area +4. The store callback updates the latest leaf with cluster != -1 before capacity checking; the wrapper returns stored count and publishes that leaf separately, rather than returning overflow as a negative count. Traversal/layout/loading/runtime invariants remain open. META-003.

F-097 — Observed axial plane boundaries: type 0–2 returns 1 for distance <= minimum, otherwise 2 for distance >= maximum, otherwise 3. This records finite instruction behavior and equality precedence, not complete geometry/runtime conformance. PLANE-001.

F-098 — Observed general plane boundaries: eight verified sign dispatches classify corner projections with front >= distance and back < distance. Maximum-face equality can differ from axial classification. Native arithmetic order is retained; arbitrary rounding, exceptional inputs and platform behavior remain open. PLANE-002.

F-099 — Observed native BSP entry/order: 16-byte native node records hold plane pointer +0 and children +8/+12; negative children encode complemented leaf IDs. Bounded one-node compositions visit child 0 before child 1 when crossing. Full unrolled/recursive traversal, callback effects, allocation validity and runtime behavior remain open. PLANE-003.

F-100 — Observed native plane production: 16-byte disk payloads become 20-byte records; type chooses the first component exactly +1, otherwise 3, and strict negative comparisons produce signbits. Negative zero is copied without setting a bit. Tested allocation reserves twelve spare records; their initialization/use and runtime behavior remain open. LOAD-001.

F-101 — Observed node reconstruction: 36-byte disk records become 16-byte native nodes containing plane_base + 20 * signed index and unchanged child words. Sampled conversion performs no local plane-index guard and omits the six trailing disk words. Complete file validation and native ownership/runtime behavior remain open. LOAD-002.

F-102 — Observed leaf projection/state: 48-byte disk records become 24-byte native leaves in word order 0,1,10,11,8,9. Zero-seeded running cluster/area words track tested maximum nonnegative IDs plus one; leaf storage reserves two spare records and later requests area-related storage. Reference semantics, initialization, count overflow and runtime conformance remain open. LOAD-003.

F-103 — Observed leaf reference consumers: reference helpers preserve ordered four-byte IDs, reserving one spare brush word but no spare surface word. Bounded leaf address slices select 56-byte native brush records and surface pointer-table entries from signed IDs. Inline map loading, valid ranges and full collision bodies remain open. REF-001.

F-104 — Observed connectivity priority: nonzero cm_noAreas returns true before index checks; either negative index returns false before upper bounds; valid areas compare labels in eight-byte records. Supplied labels establish local outcomes, not proven flood generation or runtime connectivity. REF-002.

F-105 — Observed portal references: nonzero open increments both directed counters and zero decrements both; self-pairs mutate twice. Close-underflow is checked after writes, and successful updates increment the epoch before requesting flooding. Full flood/lifecycle/query composition and runtime safety remain open. REF-003.

F-106 — Observed flood compositions: positive portal counters generate component labels with ascending root labels and current epoch stamps across sampled symmetric graphs, including recursive 32-area cases. Mutable duplicate-open/close sequences rebuild expected labels. ABI, arbitrary graphs and original-runtime behavior remain open. FLOOD-001.

F-107 — Observed revisit/epoch behavior: matching stamps retain matching labels and request a reflood error on an entry-label mismatch. Native epoch addition wraps modulo 2^32; supplied matching stamps can skip relabeling after wrap. Legal runtime reachability/lifetime and every unrolled mismatch path remain open. FLOOD-002.

F-108 — Observed area-bit output: ordinary matching-label bits OR into existing bytes; area -1 or nonzero cm_noAreas requests all-ones fill. Tested lengths round area count up to bytes, and canaries are preserved. Caller initialization/union/inversion, index/buffer validity and snapshot/runtime behavior remain open. FLOOD-003.

F-109 — Observed snapshot mask reset: sequence low five bits select a stride-524 native record; its 32-byte mask and entity-count word clear, while the sampled length word retains its prior value. Whole-frame initialization/bypass/lifetime and runtime behavior remain open. SNAP-001.

F-110 — Observed snapshot mask union/complement: supplied viewpoint area calls OR into the same frame buffer, store returned length and forward the cluster to PVS. Eight native word inversions complement all 32 bytes; a recursive call forwards the same frame/list pointers. Actual viewpoint/entity/portal/PVS selection and renderer/runtime semantics remain open. SNAP-002.

F-111 — Observed mask serialization requests: a length-byte writer request precedes a data writer request for exactly frame.length bytes at frame +4. Unused tail bytes are excluded from that requested span; no encoded packet or original message writer executes. Full codec/client/snapshot protocol conformance remains open. SNAP-003.

F-112 — Observed client mask guard: the Linux parser requests a 540-byte temporary reset, accepts unsigned mask lengths 0–32 on both sampled paths and forwards temporary +24 to MSG_ReadData; EOF length rejects with an invalid-areamask error request. Complete parsing/publication and other platforms remain open. CLIENT-001.

F-113 — Observed byte-reader boundary: signed post-readcount <= cursize returns the supplied result's zero-extended low byte; larger readcounts return 0xffffffff. Malformed signed fixtures are local comparison probes, not valid runtime messages; actual bit/cursor updates remain open. CLIENT-002.

F-114 — Observed data-copy behavior: positive lengths request one eight-bit read per byte even after overflow, storing 0xff past supplied cursize; signed nonpositive lengths exit. Supplied snapshot reset leaves unused mask bytes zero. This is bounded native instruction composition, not encoded-packet or original-runtime conformance. CLIENT-003.

F-115 — Observed read-mode resets: both Linux ELF64 engines clear readcount +32 and bit +36; ordinary/OOB entry sets mode +8 to zero/one, retaining other sampled bytes. Whole message initialization and mode lifecycle remain open. BITS-001.

F-116 — Observed OOB bit reads: sampled nonzero mode reads only absolute widths 8/16/32 with little-endian loads and direct cursor increments, without consulting cursize locally; unsupported widths request an error. The -32 top-bit-set tail yields all ones through x86 shift masking. Actual legal caller/memory/runtime/platform behavior remains open. BITS-002.

F-117 — Observed compressed reader assembly: raw low remainder bits precede supplied Huffman symbol bytes; readcount becomes signed bit/8 +1. Signed tails use the remaining byte-multiple width after remainder subtraction. Huff_getBit instructions update cursor and bloc; real tree decoding, packets and original-runtime conformance remain open. BITS-003.

F-118 — Observed raw bit mutation: byte-boundary writes clear a byte, other writes retain prior bits and OR the shifted input without local Boolean normalization. Both cursors advance modulo 2^32; supplied zero-buffer raw round trips recover input bits. Real symbol/network encoding remains open. HUFF-001.

F-119 — Observed supplied-tree receive: internal symbol 257 consumes LSB-first bits, zero left/one right; successful leaves publish cursor and arbitrary supplied symbol words. Null children output zero and leave the caller cursor unchanged while the global advances. Real tree invariants and failure handling remain open. HUFF-002.

F-120 — Observed transmit request: signed index selects the node pointer at object +32 +8*index; its +16 parent controls a send request with parent/node/buffer arguments. The sampled null-parent path retains cursor. send, real codebooks, valid symbol bounds and runtime/platform conformance remain open. HUFF-003.

F-121 — Observed bounded send: parent walks emit root-to-leaf branch bits, right one/left zero in supplied consistent trees. Byte starts clear, partial bytes retain zero bits, and nine-edge unrolling yields four virtual frames for a 32-edge path. Full ABI/tree/capacity/runtime behavior remains open. ENC-001.

F-122 — Observed supplied-codebook round trips: composed transmit/send/receive returns symbol 42 with matching bytes and cursors for sampled paths up to 32 edges, including a synthetic root-leaf zero-length code. Actual initialized trees and game packet compatibility remain open. ENC-002.

F-123 — Observed shared symbol streams: supplied depth-three codebooks encode/decode repeated and mixed symbols across byte boundaries with three-bit cursor increments. No tree updates occur inside these sampled helpers; actual adaptive initialization/update ownership and complete message codecs remain open. ENC-003.

F-124 — Observed native frequencies: both Linux images contain the same verified 256-count table, totaling 1,053,340 repetitions per tree. A generated conceptual paired schedule is retained separately from native execution; trained trees and codewords remain open. INIT-001.

F-125 — Observed empty-tree initialization: two 51,248-byte clear requests precede initial symbol-256 nodes at object +2,096, count one and lookup/root aliases. Pointer slot +24 differs between objects. Supplied clear effects and complete sparse layouts do not establish later allocation/list/adaptive behavior. INIT-002.

F-126 — Observed training requests: entry sets msgInit before requesting Huff_Init; bounded count fixtures schedule symbols ascending with first-object then second-object addRef requests per repetition, ending at symbol 256. addRef effects and actual full seeded training remain unexecuted. INIT-003.

F-127 — Observed addRef insertion: input normalizes to its low byte; existing lookup forwards directly to increment. New symbols add a stride-56 leaf/internal pair around NYT and repair lookup/parent/list links. Sampled all-byte insertion reaches 513 nodes. Legal aliases/capacity and every insertion/tie path remain open. UPDATE-001.

F-128 — Observed adaptive count compositions: repeated/new sequences retain occurrence-count leaf weights, root total and child-weight sums across recursive increment and reorder instructions. Null updates preserve memory; sampled recursion reaches depth eight. Real seeded training/codewords and complete runtime/ABI/platform behavior remain open. UPDATE-002.

F-129 — Observed rank/block reuse: sampled rank lists cover all nodes with nondecreasing weights and reverse-link consistency; weight blocks share last-rank leader cells. Allocated cells partition into live heads and an acyclic free chain, with fifteen cells in the full-alphabet fixture. Complete swaps, second-object behavior and capacities remain open. UPDATE-003.

F-130 — Observed sampled differential equivalence: compact adaptive recoding matches complete prior and fresh native-instruction tree/list/head/freelist states, exercising tie and swap event classes. This supports the sampled valid-tree contract, not branch-complete/native-runtime conformance. CODE-001.

F-131 — Observed paired-object update samples: first/second initialized halves match their respective recoding states after every fresh update, with the +24 pointer-slot asymmetry retained. Full initialization/training lifetime and runtime/platform equivalence remain open. CODE-002.

F-132 — Model-derived seeded codebook: exact native counts produce a provisional 513-node tree, 2–11-bit prefix-free codewords and compatible bounded native-helper symbol round trips against supplied modeled memory. Full native seeded training/codeword/packet conformance remains unverified. CODE-003.

F-133 — Observed writer guard priority: requested width updates oldsize before capacity/width validation; signed remaining space <=3 sets message overflow and returns first. With enough space, zero and widths outside -31..32 request an error. Full buffer/lifecycle/wrap/runtime behavior remains open. BYTE-001.

F-134 — Observed value diagnostics: range failures increment a separate global counter without stopping the sampled path. Compressed width eight masks to low byte; selected negative-width bounds use pre-normalization x86 shift counts. General signed/OOB/wrapper and legal-caller behavior remain open. BYTE-002.

F-135 — Observed modeled-tree message byte composition: native writer/reader/helper instructions agree on exact compressed bytes and per-symbol cursors using supplied model-derived trees. Size/readcount use bit/8 +1, including an extra byte at exact boundaries. Native trained-codebook, real packet/padding/overflow/runtime/platform conformance remains open. BYTE-003.

F-136 — Observed message record lifecycle: warm initialization clears the 40-byte ELF64 record, installs data/maxsize and sets OOB mode when requested. Cold initialization sets msgInit before requesting Huff_Init. Clear retains readcount/mode/data/maxsize while zeroing overflow/size/bit. Full training/lifecycle/platform behavior remains open. WIDTH-001.

F-137 — Observed OOB composition: accepted 8/16/32-bit writes store low bytes little-endian and advance size/bit directly; selected negative widths normalize, while -32 is rejected by writer validation. Matching reads retain byte order and signed tails. Capacity/EOF/real-header/runtime coverage remains open. WIDTH-002.

F-138 — Observed mixed-width composition: compressed writes emit raw low-bit remainder then modeled-tree Huffman bytes. Independent packing and native reader compositions agree for every positive width 1–32 and selected negative widths; negative sign tails use the mutated remaining byte width. Native seed/codeword, legal-caller, buffer and real-packet/platform conformance remain open. WIDTH-003.

F-139 — Observed scalar forwarding: Byte/Char/Short/Long wrappers request positive widths 8/8/16/32 without separate local validation. Bounded OOB writer/read compositions verify little-endian low-byte results, guarded write failures and post-read EOF. Compressed wrappers/real-packet/runtime/platform coverage remains open. WRAP-001.

F-140 — Observed scalar reader tails: Byte zero extends, Char/Short sign extend and Long preserves the word, gated by signed post-read count <= size. EOF returns 0xffffffff after reading; valid signed -1 values can share that word. Legal cursors, caller interpretation and access safety remain open. WRAP-002.

F-141 — Observed data overflow continuation: bounded WriteData compositions request every positive-length source byte even after child capacity failure. Only the permitted prefix is stored; oldsize counts all requests. A pre-set overflow flag is retained but does not itself block ample-capacity stores. Compressed/allowoverflow/lifecycle/alias/real-packet coverage remains open. WRAP-003.

F-142 — Observed OOB ReadData EOF continuation: actual OOB read instructions advance cursors for every positive-length request; ReadData stores valid prefix bytes then 0xff after post-read size failure. Requests continue and destination tail/canaries retain supplied contents. Truncated backing safety, compressed/alias/lifecycle/runtime behavior remains open. TEXT-001.

F-143 — Observed string readers: ordinary/line/big readers terminate on consumed NUL/EOF, with line also consuming newline; capacities store at most 1023/1023/8191 bytes. They return recovered static buffers and replace percent/high bytes with periods. Caller lifetime/compressed/malformed/platform coverage remains open. TEXT-002.

F-144 — Observed string writers: signed low-word length guards use limits 1024/8192; null/over-limit paths request an empty byte. Small supplied-copy fixtures sanitize high bytes, retain percent and request every byte plus NUL even after child space failure. Native library-copy/strlen, complete maximum emission and real compressed/caller/runtime behavior remain open. TEXT-003.

F-145 — Observed float transport: raw low scalar bits forward as a 32-bit word; bounded OOB compositions retain even supplied nonfinite payload words without arithmetic. ReadFloat's signed post-read size failure substitutes 0xbf800000 (-1.0). Hardware nonfinite semantics/caller/compressed/runtime contracts remain open. NUM-001.

F-146 — Observed finite angle encoding: file-backed binary32 scales, rounded multiplication, truncation and low 8/16-bit masks determine sampled OOB words. Nonfinite/conversion/control-state and caller/platform behavior remain open; absent parsed ReadAngle symbols do not prove absent decoding. NUM-002.

F-147 — Observed signed angle16 decoding: accepted low words sign extend, scale through binary64 by 360/65536 and return binary32. Post-read EOF directly returns -360/65536, sharing a valid signed -1 angle word. Finite OOB compositions verify quantized results; full caller/compressed/runtime behavior remains open. NUM-003.

F-148 — Observed integer delta boundaries: full-word equality requests only a zero flag and preserves the complete baseline; changed values request a one flag and supplied-width payload. Local readers treat any supplied nonzero flag as changed and add no scalar wrapper EOF sentinel check. Legal width/flag/truncation/caller behavior remains open. DELTA-001.

F-149 — Observed finite float delta: finite numeric equality controls payload omission, including opposite signed zeros; unchanged reads retain baseline bits. Changed payloads forward raw 32-bit words. Nonfinite/control-state/caller/runtime behavior remains open. DELTA-002.

F-150 — Observed compressed scalar delta composition: native wrapper/bit/Huffman instruction slices agree with independent flag/remainder/modeled-codeword packing and cursor/accounting checks. Seed trees remain model-derived; actual packet/overflow/EOF/full-native-training/platform contracts remain open. DELTA-003.

F-151 — Observed keyed integer mask indexing: writer compares before full-word XOR; reader directly indexes a 32-word kbitmask by width. Sampled widths below 32 retain one extra key bit; width 32 reads the adjacent entityStateFields low word, differing between the Linux images. Caller width/key/narrowing/legal-index/runtime effects remain open. KEY-001.

F-152 — Observed keyed finite float delta: numeric equality omits payload and preserves baseline bits; changed words XOR the full key before/after 32-bit transport, without the integer mask table. Nonfinite/control-state/caller/platform behavior remains open. KEY-002.

F-153 — Observed keyed compressed composition: independent modeled-codeword packing agrees with native wrapper/bit/Huffman slices and paired bytes/cursors. Integer width-32 decode returns can differ for identical bytes due to actual adjacent file words; legal game-level reachability remains unverified. Native training/packet/overflow/EOF/runtime/platform contracts remain open. KEY-003.

F-154 — Usercmd time and key dispatch: signed modulo-32 delta <=255 selects low-eight-bit timestamp encoding; larger positive deltas use a full time word. Field keys XOR writer new time / reader decoded time; synthetic negative deltas can separate these values. Legal caller behavior remains open. CMD-001.

F-155 — Usercmd masks and stores: eight fields in a 24-byte record use widths 16/8; movement sign-extends before XOR. Mask16's extra key bit survives full-word stores, while mask8's extra bit is discarded by byte stores. Unchanged aggregate copies the remaining 20 bytes; no keyed mask32 field appears in these graphs. Semantic names and legal high keys remain unverified. CMD-002.

F-156 — Usercmd composition and accounting: 204 synthetic modeled-tree streams agree with independent request/packing/full-record/cursor/diagnostic/canary oracles in both engines. Unchanged commands add seven to oldsize beyond requested widths. No original process/native callee, runtime traffic or full native training executes. CMD-003.

F-157 — Usercmd hash/key callers: both hash graphs weight signed bytes by 119+index, then XOR signed shifts by 10/20. Both callers hash a 32-byte prefix in 128-slot, 1024-byte reliable-string rings and XOR two state words; corresponding supplied state gives matching full-word keys. Producer semantics/legal key bits remain open. CALL-001.

F-158 — Client usercmd bundles: native selection caps signed command count at 32, omits commands for count <=0 and gates opcodes 2/3. The 64-record, 24-byte command ring starts from a zero baseline and chains previous commands. Every count 1–32 and ring-wrap fixtures match independent stopped-call formulas. CALL-002.

F-159 — Server usercmd count and baselines: signed counts outside 1–32 stop before hash/codec calls; accepted requests use a zero 24-byte baseline then contiguous previous output records. Synthetic supplied codec effects verify the native chain in both engines; timestamp/VM/purity/actual packet behavior remains open. CALL-003.

F-160 — Post-decode server gates: supplied purity/client flags and states select stopped game-state, drop-client, enter-world, timestamp-loop or return boundaries. Remaining nonactive paths set client +0x20d28 to 0xffffffff. External effects and field producer semantics remain open. ACCEPT-001.

F-161 — Sequential signed command acceptance: accepted time must be <= the bundle's final command time and > the stored previous command time; accepted records update all 24 bytes before dispatch. The cap is the final entry, not a computed maximum. Supplied negative/wrap behavior does not establish legal traffic or downstream time clamping. ACCEPT-002.

F-162 — Native command copy and VM boundary: standalone SV_ClientThink copies 24 bytes in all tested states and requests VM_Call(gvm,7,index) only in state4. Inlined accepted paths agree. Reciprocal arithmetic supports candidate client stride0x2df40 on aligned supplied addresses; allocation and actual callback effects remain unverified. ACCEPT-003.

F-163 — Native usercmd retrieval: file-backed trap36 converts destination before signed index guards; valid paths copy 24 bytes at explicit client stride0x2df40 and return zero. Standalone SV_GetUsercmd agrees. Error calls stop; allocation/pointer/runtime contracts remain open. QCMD-001.

F-164 — Game selector7 bridge: qagame case65 calls155718, which requests trap36(index, entity[+520]+472), stores game time at client+4044 and gates helper154089 on entity bit8/global34084868. Native copy results are mapped into synthetic QVM word memory; flag meanings/full runtime bridge remain open. QCMD-002.

F-165 — Game-side command time prefix: helper154089 preserves raw time, sequentially clamps command time to signed game-time bounds -1000/+200, computes/caps elapsed independently and optionally adjusts timestamp in eight-unit steps afterward. Early returns retain preceding mutations; signed-boundary fixtures do not establish legal gameplay. QCMD-003.

F-166 — QVM think routing/suppression: post-time branches record special helpers or normal processing; independent gates restore saved angles versus capturing current angles, and clear movement/buttons. Bit0-only angle lock differs from the inactivity helper's nonzero special-time gate. Global/field semantics remain provisional. THINK-001.

F-167 — Inactivity decisions: helper150382 counts signed nonzero movement or button bit0, refreshes timer/warning, handles disable/exemption/health-like branches and uses strict expiry/ten-second-warning comparisons. File-backed strings identify inactivity action requests; recorded traps/helpers do not establish actual drop/team-change effects. THINK-002.

F-168 — Think continuation/mode word: zero inactivity result exits before client+4 mutation; nonzero result selects1 for +4040, else3 for +208<=0, else0. Matching-state helper/caller compositions verify precedence, with external action effects omitted. Mode physics and producer semantics remain open. THINK-003.

F-169 — Movement setup arithmetic: bit0 of global35000452 zeroes candidate gravity/speed words; otherwise finite binary32 gravity optionally multiplies through a one-use pointer, truncates and sets speed220. Packed-word slices use raw shift/OR without byte masks. Semantic producers and exceptional arithmetic remain open. FRAME-001.

F-170 — Command and mask gates: a separate three-condition gate clears forward/right bytes and only signed-positive up bytes. Type/linked-helper/bit8/game-mode branches select four observed masks, with zero helper result clearing two link words. Physics and helper/bit meanings remain unverified. FRAME-002.

F-171 — Movement frame assembly: 160 bounded fixtures match every byte of a supplied-zero 268-byte frame containing pointer/command/mask/callback/flag inputs, plus vector copies and recorded helper54475 requests. No movement helper executes; consumer layout, callback/native collision effects and runtime parity remain open. FRAME-003.

F-172 — Movement scheduler: helper54475 rejects backward time, caps excessive gap at1000, increments/masks a counter and resets output words even for equal timestamps. Step caps8/66 and post-step bit8192 up-byte edits are verified under a supplied child clock-update model; actual physics/termination domains remain open. LOOP-001.

F-173 — Single-step input prefix: child53418 stores a global frame pointer, increments another counter, clears outputs, removes button bit16 when signed forward/right magnitude exceeds64, then applies bit2 button/movement and player-state flag precedence. Semantic bit names and later action/physics behavior remain unverified. LOOP-002.

F-174 — Post-loop outputs: a separate suffix computes signed-direction/button/flag bits in player-state+240 for positive +208, caches buttons and records ordered helper29913 event93/21/31 requests. The third path also extracts two packed bytes without a visible selector bounds check. Event effects/full composition/runtime remain open. LOOP-003.

F-175 — Child flag ordering: packed second-byte/button/type/initial-bit256 predicates select player-state+104 bit512; a later health-like/buttons&5 predicate can clear bit256. The earlier predicate sees its original value. Semantic attack/weapon meanings and selector bounds remain open. STEP-001.

F-176 — Child clock prefix: requested timestamp copies directly to player-state time while elapsed is separately clamped1–200, snapshotted vectors are copied and fractional binary32 time is computed. Selected schedulers now compose these actual prefix instructions, omitting all other child work and runtime effects. STEP-002.

F-177 — Early mode dispatch: signed direction updates a player-state bit before input suppression; frame/type/bit predicates choose three early call sequences, a call-free return or the main path. Callee effects/physics and semantic type names remain unverified. STEP-003.

F-178 — View-angle consumer: helper53186 gates by type/flag/health-like fields, truncates command+delta to signed16, clamps pitch to[-18000,14000] before bias2000 and scale360/65536, and rewrites delta only on clamp. Extra keyed angle bit16 is discarded here; other consumers/legal domains remain open. VIEW-001.

F-179 — Conditional basis algebra: child angle/trig requests and rounded nine-word basis construction match independent rotation/orthogonality oracles under supplied source angles/trig returns. Native trig/return ABI, view/helper50525 effects and real physics composition remain unverified. VIEW-002.

F-180 — Mode position tails: helper42486 integrates supplied velocity only if any component magnitude exceeds1; helper45461's tail integrates unconditionally. Exact rounded position words and velocity retention match independent fixtures; complete modes/friction/acceleration/collision/runtime remain open. VIEW-003.

F-181 — Command scale: helper40397 uses literal speeds220/340, with button256/right-zero/forward>80/player-state+184>10 gates for340. Signed-byte max magnitude and supplied sqrt feed the exact normalized scale; legal movement/meter/button domains and native sqrt remain open. ACCEL-001.

F-182 — Acceleration policy: helper40275 computes projection gap, returns unchanged for gap<=0 and otherwise adds a direction-scaled coefficient/timestep/wish-speed amount capped to the gap. It does not clamp total speed; full surrounding friction/collision/runtime policy remains open. ACCEL-002.

F-183 — Partial mode composition: 48 supplied-basis/post-friction fixtures compose decoded command-scale, caller normalization, acceleration and position-tail instructions with exact word/request oracles and disjoint synthetic local frames. Earlier mode/native sqrt/collision/full-runtime effects remain omitted. ACCEL-003.

F-184 — Shared friction: helper39988 optionally measures planar speed, retains Z on low-speed X/Y clear, adds gated drop terms and then conditionally replaces total drop before scaling the original XYZ velocity. File-backed initial coefficients are verified; live writers and semantic fields remain open. FRIC-001.

F-185 — Mode friction differs: helper45461's prefix measures full XYZ, clears all velocity below1, uses1.5 times the source friction word and writes player-state+164=38. This is a separate policy from helper39988; configuration/type meanings and runtime remain unverified. FRIC-002.

F-186 — Staged velocity composition: eighteen fixtures pass evaluated friction velocity into prior scale/acceleration/position slices with the source-image acceleration word8. Earlier example coefficient10/default output remains unchanged. Only velocity is bridged; full state/callee/collision/runtime effects remain omitted. FRIC-003.

F-187 — Content-level producer: helper47217 samples up to three points through frame+228, short-circuits on mask56 misses, retains the first successful raw content word and writes level0–3 at frame+212. Callback/content/height semantics and legal domains remain open. GROUND-001.

F-188 — Ground/surface producers: helper46773 copies a supplied56-byte trace to global35023944; offset44 supplies friction surface word35023988. Ordered recovery/fraction/kick/slope/level branches set walk/plane/ground/flag/timer fields and record helpers. External effects and native collision/runtime remain omitted. GROUND-002.

F-189 — Producer/friction connection: sixteen scalar bridges pass recovered level/walk/surface/PS flags into earlier friction arithmetic with verified initialized coefficients and supplied velocity. Full callback/frame/state/collision composition remains unverified. GROUND-003.

F-190 — Posture bounds and height: helper47422 initializes min(-15,-15,-24)/max(15,15,45); early modes select height-16, bit1 selects maxZ24/height20, and masked animation25 selects maxZ10/height-5. Semantic names remain provisional. POSTURE-001.

F-191 — Posture transitions: guarded entry can deduct3000 from a converted resource word, request39525(36) and set timer200; exit requests a standing overlap trace, then clears bit1/field92 and requests39525(37) only for supplied zero allsolid. Final entity bit1 depends on horizontal speed>=300 and signed up<=-10. Native/callee effects remain omitted. POSTURE-002.

**F-192 — Posture consumer connection:**48 fixtures propagate evaluated height/bounds/flags/resource into earlier content/ground/scale slices. Resource deduction can change the prior220/340 policy under matched supplied inputs; full state/collision/runtime composition remains open. POSTURE-003.

F-193 — Animation setters and continuation: direct helpers39338/39383 toggle bit128 and OR the raw request behind signed type/timer guards; only the leg setter rejects raw equality. Continuation wrappers also reject masked-old equality. Child effects are evaluated; semantic/legal/runtime domains remain open. ANIM-001.

**F-194 — Forced and timed animation ordering:*39525 clears the leg timer before its guarded child unless raw animation equals the request;39552 clears torso timer, calls its child, then assigns a supplied table word at base35018540+selector2560+request*32+28 even when the child rejects. Ten posture bridges apply selected child effects and caller timer200 stores. Actual tables/playback/full state remain open. ANIM-002.

**F-195 — Contact registration:**39253 ignores entity1022 and count==32, scans for duplicates, then appends and increments the frame count. Bounded fixtures preserve every untouched slot and accept1023/synthetic-1 on the append path; real contact generation, invalid counts and list consumers remain open. CONTACT-001.

F-196 — Shipped animation symbol/model mapping: two separately retained byte-identical76-row configs include one verified header; QVM registration maps Athena to selector0 and Orion to1. Definitions name IDs25/36/37 as LEGS_SWIM/LEGS_STANDCR/LEGS_CRSTAND. IDs1/77/78/79 are absent from both configs; runtime initialization remains open. TABLE-001.

**F-197 — Animation loader records and partial success:**20297 writes32-byte records, integer1000/FPS intervals and duration interval×(count+1), leaves+24 untouched, and consumes three other values without storing. Supplied EOF retains partial writes and closes with return1; failed open returns0. Native preprocessing and malformed-input behavior remain unverified. TABLE-002.

**F-198 — Source-derived duration consumers:**152 bridges transfer verified asset-derived duration words at actual model table selectors into39552 and its evaluated child. Stand/crouch transition rows derive480/360, but the earlier posture caller separately writes200; complete playback/state/runtime remains open. TABLE-003.

**F-199 — Resource reset and drain:**39595 gives configuration>=2 reset precedence over bypass; normal negative input clamps before frame+244 bypass. Guarded speed>221 drain caps its local speed to340, scans16 low bytes for17 and applies0.9/0.5 factors before subtraction/truncation/zero floor. Semantic domains remain provisional. RESOURCE-001.

F-200 — Recovery/counter asymmetry: fallback resource change can be replaced by a negative change above105, applies only the health-derived upper cap and can remain negative. Drain instead applies a zero floor without that upper cap. Normal zero-speed clears PS+224; nonzero adds dt capped1700, while early paths leave it alone. Runtime/legal domains remain open. RESOURCE-002.

F-201 — Resource arguments and consumers: selected helper55465 tail requests a full3D norm for39595; helper43626 slice passes a retained scalar after velocity rescaling. Fourteen caller probes and16 scalar bridges connect resource results to earlier posture and scale arithmetic without claiming full movement ordering/state/collision equivalence. RESOURCE-003.

**F-202 — Timer expiry asymmetry:**53048 expires nonzero PS+16 at dt>=timer and clears flag mask192, but already-zero preserves flags. PS+72/+80 age only when positive and floor at0; negative animation timers remain untouched. Semantic/legal domains remain open. TIMER-001.

F-203 — Main mode priority: child53418 requests content/posture/ground before timer aging and54981(0); saved/current state220 bit1024 and a supplied56639 result control flag2/event23. Flag128, mask12, level>1, current bit1024 and walk word select one of six helpers before a common suffix. Other callee effects remain omitted. ROUTE-001.

**F-204 — Clock/posture timer connection:**36 selected bridges pass actual clock elapsed and recovered posture animation/timer results into53048, then direct animation guards. New timer200 can age to184 in the same selected16-unit step, conditional on omitted intervening effects; complete state and actual animation-request policy remain open. TIMER-002.

**F-205 — Query direction/release:**56214 projects supplied forward XY with Z0 and normalizes using a supplied root.56639 gates on state220 bit1024 or PS flag32; active release can add25 times a normalized vector with inverted XY and Z=-0.2, clear anchor/bit1024, floor field44 at300 and return0; upper-height release returns1. Native/semantic domains remain open. QUERY-001.

**F-206 — Short hull transition policy:**56639 uses min/max Z-4/+4 and literal mask65537 for traces with direction multipliers4/8. Supplied first/second fractions and56335 result control state retention/acquisition, truncated origin-Z anchor, vertical velocity zero and evaluated torso requests54/55. Native collision/clearance callee effects remain omitted. QUERY-002.

**F-207 — Actual query-to-caller decisions:**16 bridges show evaluated acquisition setting bit1024 while returning0, causing caller event23; some releases clear that bit while returning1, causing caller flag2 from the saved old bit. Full query velocity/anchor/animation/main state and runtime remain uncomposed. QUERY-003.

**F-208 — Side-helper acceptance:**56335 projects/normalizes a supplied right basis, probes opposite offsets with hull±4 and forward multiplier20, and returns1 only when both supplied fractions differ from1. All150 fixtures preserve the seeded PS snapshot; native side effects/physical legality remain open. SIDE-001.

**F-209 — Derived acquisition Boolean:**20 chains evaluate56335 at matching origin/basis, substitute its result only when query56639 requests it, and pass resulting query return/state into main routing. This closes the selected Boolean producer under supplied traces; broader PS/native state remains uncomposed. SIDE-002.

**F-210 — Conditional mode gravity:**41768 clears flag32 before60091(1), then applies gravity to supplied post-callback Z. Strictly negative Z clears mask192/timer; zero retains them.364 tail probes and18 selected main-mode handoffs verify policy while60091 collision/state effects remain omitted. MODE-001.

**F-211 — Step trace policy:**59710 lowers maxZ/raises origin by literal18, requests supplied slide, traces down, clips finite velocity with sign-dependent biased dot, restores bounds and overlap-tests copied trace end position. Failure can leave changed origin/velocity; native records/slide effects remain supplied. STEPTRACE-001.

**F-212 — Step wrapper fallback:**60091 bypasses stepping on zero first-slide return, otherwise evaluates59710 and restores the saved first-attempt position/velocity plus flag32 on failure. DeltaZ>2 writes truncated frame+48; all sampled branches return1. Full slide/state semantics remain open. STEPWRAP-001.

**F-213 — Concrete flag restoration path:**14 mode compositions apply evaluated60091/59710 effects before41768 gravity. Conditional step/wrapper stores can restore flag32 after its prefix clear, and a negative gravity-tail Z clears192/timer while preserving32. Triggering slide/native effects and full simulation remain open. STEPCHAIN-001.

**F-214 — Slide gravity/plane preparation:**57714 uses midpoint Z for tracing, retains end Z in both end/saved vectors, conditionally clips working velocity against a supplied ground normal and seeds ground/current-direction planes. Native sqrt and legal plane/configuration inputs remain supplied. SLIDE-001.

F-215 — First trace split: first-clear exits with0 through end/saved-velocity and flag2048 cleanup; allsolid returns1 after zeroing only Z and bypasses that cleanup. Partial contacts set2048/normal XY behind strict normal/gravity/surface/contents gates, evaluate touch registration and shrink remaining time; probes stop before plane solving. SLIDE-002.

**F-216 — Actual clear-slide caller chain:**20 chains replace supplied slide return/position/velocity with evaluated57714 clear results inside60091 bypass and41768 tail. Contact/step/native/main effects and full gameplay remain open. SLIDECHAIN-001.

**F-217 — Plane gate:**count>=5 zeros velocity and returns before dedup; otherwise the first dot>binary32 0.99 nudges velocity by the raw incoming normal without appending. No match appends the normal/count. Synthetic standalone counts/normals do not establish runtime legality. PLANE-001.

**F-218 — Candidate scan:**the first plane with current velocity dot<binary32 0.1 updates a supplied impact maximum and independently clips working/end vectors into locals. Exact0.1 skips; candidate vectors are not yet committed to PS. Secondary-plane/crease acceptance remains open. PLANE-002.

**F-219 — Contact-to-plane connection:**40 chains continue evaluated first-contact/touch/gravity state into actual plane insertion/dedup and first candidate selection. Plane order and end-vector flow are verified; duplicate/scan/candidate boundaries remain partial with no claimed complete slide return. PLANECHAIN-001.

**F-220 — Secondary-plane commit:**57714 reclips working/end candidates independently when a secondary dot is below binary32 0.1. A nonnegative reclip dot against the primary continues scanning; successful scan commits both vectors. No qualifying primary leaves vectors unchanged. SOLVER-001.

**F-221 — Crease and rejection:**negative reclip/primary dot projects original working/end vectors onto a cross-product crease, recomputing normalization with two supplied native roots. A third-plane working dot<binary32 0.1 zeros PS velocity and returns1 without committing end velocity. Signed zeros survive successful projection. Legal contacts/native services remain unverified. SOLVER-002.

**F-222 — Contact solver connection:**40 chains carry actual evaluated prefix/gate state into the solver. Three complete57714 via third-plane return; the remaining37 stop before bump advance. Full repeated collisions and caller/mode/main composition remain open. SOLVERCHAIN-001.

**F-223 — Bump cap:**57714 initializes cap4/counter0, increments after normal contact and loops only for signed counter<cap. The counter gate has no time/velocity test. Nondefault isolated caps do not establish runtime producers. LOOP-001.

**F-224 — Common-exit precedence:**gravity copies end velocity, then nonzero movement timer overrides it with saved velocity. Local248 zero clears2048. Return reflects nonzero bump counter, so second-trace clear can return1. Early solid/capacity/third-plane returns bypass this policy. EXIT-001.

**F-225 — Actual second request/exit:**48 chains carry evaluated first-contact/solver state into source-computed reduced-time endpoint/callback and complete supplied clear/allsolid exits. Clear copies endpoint and applies common exit; allsolid zeros only Z before copying/cleanup. Native trace consistency/repeated contacts/full caller simulation remain open. LOOPCHAIN-001.

**F-226 — Repeated-contact state:**continuous57714 retains actual planes/working/end vectors, reduces already reduced remaining time and deduplicates touch entities across four callbacks. Zero time alone does not stop these supplied-response fixtures. Native/legal contact domains remain unverified. REPEAT-001.

**F-227 — Accumulated impact/returns:**a once-supplied impact maximum persists and only increases across contacts; caller reset/consumers remain open.76 probes reach common, third-plane, allsolid and capacity exits; two return on the first contact without consuming later prepared records. REPEAT-002.

**F-228 — Actual exhaustion:**four normal contacts reach counter4/common exit; fourth-clear reaches counter3/common exit. Both return1 and apply end/saved vector precedence. Fourth allsolid/capacity/third-plane returns bypass that suffix and leave counter3. Continuous synthetic state is verified; native collision/full callers/platform gameplay remain open. REPEAT-003.

**F-229 — Both slide children evaluated:**22 mode/wrapper fixtures evaluate38 actual57714 invocations. First-clear bypasses stepping; nonzero first returns launch59710 from original entry snapshots with raised origin/shrunk bounds. Actual child returns and shared state feed caller continuation. Native records remain supplied. CALLSLIDE-001.

**F-230 — Contact-capable fallback:**actual raised-slide output feeds down/overlap step traces. Failure restores first-attempt position/velocity and sets32 while retaining child touch/impact and other unrolled state. Success keeps step output; deltaZ>2 precedes height truncation. CALLSTEP-001.

**F-231 — Contact-to-mode chain:**actual60091 output now feeds41768 tail with both contact-capable slide children evaluated. Gravity updates current Z; negative results clear192/timer. Native collision/main environment and complete gameplay/platform behavior remain open. CALLMODE-001.

**F-232 — Clock/timer shared state:**source clock clamps elapsed1–200, retains requested PS time and actual vector snapshots, and drives real53048 timer state plus movement fractional time in48 main fixtures. Intervening prefix-to-main producers remain omitted. MAINCONTACT-001.

**F-233 — Actual timer routing:**36 fixtures select41768; exact-expiry controls route six to43626 and six to55465. Alternative requests receive no41768 effects. Other environment/action/query/mode effects remain omitted. MAINCONTACT-002.

**F-234 — Selected main-to-contact chain:**actual aged main state flows into41768/60091/59710 and54 evaluated slide children, then back to bounded main suffix requests. Native responses remain supplied; full53418/scheduler/suffix/environment/native gameplay is unverified. MAINCONTACT-003.

**F-235 — Actual main content producers:**96 evaluated47217 invocations sample current pre/post movement positions and produce real shared contents/level words from supplied native responses. Main retains the first level separately while the final level is resampled. MAINENV-001.

**F-236 — Main ground producers:**96 evaluated46773 classifications copy actual supplied trace records, derive plane/walk/normal/surface/ground/flag/timer state and execute terminal touch registration. Pre-ground and real timer outputs drive source routing across four selected mode families; non41768 modes remain omitted. MAINENV-002.

**F-237 — Environment-to-motion-to-environment:**derived ground normals feed27 actual slide children in18 reached41768 fixtures. Post-movement ground classification runs before content resampling and therefore consumes the first level; its state changes survive into final output. Native collision/full main/platform runtime remain unverified. MAINENV-003.

**F-238 — Actual main posture:**28 fixtures evaluate47422 after initial content sampling and before ground/timer aging, deriving posture flags/resource/leg timer/bounds/viewheight. A leg timer1 blocks a stand query before later aging to0. Native stand/root responses remain supplied. MAINPOSTURE-001.

**F-239 — Stand animation changes final height:**actual39525/39383 changes starting animation25 to37 before successful stand's final bounds selection, producing height38/maxZ45. The caller writes timer200 after the child; actual main aging yields184. MAINPOSTURE-002.

**F-240 — Derived posture consumers:**ground uses actual bounds, selected step restores derived maxZ rather than assumed45, and final contents uses actual viewheight. Fourteen reached41768 fixtures evaluate28 slide children; other modes/native collision/full runtime remain omitted or unverified. MAINPOSTURE-003.

**F-241 — Ground-loss policy:**46527 gates flags&12, old-ground sentinel and a supplied64-unit deep trace; fraction1 toggles4096 and evaluates direction-selected animation, while a short trace retains old ground/walk within the helper. Action/native collision effects remain omitted. GROUNDLOST-001.

**F-242 — Landing prefix/timer ordering:**45912 always initializes PS+440/state220, then derives a discriminant/root/time/impact estimate. Impact<−200 with flag1 clear writes leg timer130 before39525(27); unequal raw animation resets it to0, equality retains130. Severity/event/damage/suffix remains unevaluated. LANDPREFIX-001.

**F-243 — Caller overrides ground-loss walk:**actual46773 clears walk/plane after46527 even when the deep fraction0.5 helper retained old ground/walk. Sixteen main chains carry those actual effects through timer and selected clear-slide mode; full landing/native/main runtime remains open. GROUNDCHAIN-001.

**F-244 — Numeric event queue:**29913 stores event/parameter in sequence&1 of two slots and increments the int32 sequence.39238 forwards parameter0;45887 can suppress or sign-shift a surface parameter. The recovered body is not an external damage call; downstream event/field meanings remain open. LANDEVENT-001.

**F-245 — Landing severity and suffix:**45912 scales squared impact by level, gates events on score/health/surface/argument, writes numeric queue/PS216 or Z300 branches, clears PS8 only after score>=1, and conditionally sets an entity bit for horizontal norm>300. Strict event thresholds are7/30/45. LAND-001.

**F-246 — Actual landing caller:**complete bounded45912 effects precede46773's movement timer250 and touch stores; actual main aging yields234. Level3 skips landing entirely, and a reached child need not emit an event. Native collisions/other main callees/full runtime remain supplied, omitted or unverified. LANDCHAIN-001.

**F-247 — Recovery search:**46296 enumerates27 offsets in X/Y/Z order and tests candidate allsolid. Full failure returns0, clears ground/plane/walk and preserves PS position/velocity; local last-record output and global trace remain distinct. RECOVER-001.

**F-248 — Free candidate is not committed:**first clear triggers a new original-origin Z−0.25 trace, full56-byte copy and return1 without retesting follow-up allsolid. Actual46773 classifies that updated record or exits on evaluated return0. Native physical consistency remains unverified. RECOVER-002.

**F-249 — Recovery-to-main connection:**16 actual caller fixtures derive plane/normal/touch inputs, select ten evaluated41768 chains and six omitted43626 requests, then continue post environment. Full native/main/runtime gameplay remains open. RECOVERCHAIN-001.

**F-250 — Unified reached ground children:**18 main fixtures combine actual posture with36 ground invocations and reached recovery/lost/landing/animation/touch children in source order, preserving shared state and conditional skips. Native responses/action/other mode effects remain supplied or omitted. COMBGROUND-001.

**F-251 — Cross-helper temporal state:**ground-loss animation can reset posture's new leg timer200 before main aging; later landing/kick animation changes do not recompute earlier posture bounds/viewheight. Numeric queue/resource effects remain live into final content sampling. COMBGROUND-002.

**F-252 — Unified ground-to-motion-to-ground:**15 reached41768 fixtures evaluate30 slide children, then evaluate newly reached post-ground callees before final content sampling. Full recorded ground state and parent stores match independent formulas; native collision/full main/runtime remain open. COMBGROUND-003.

**F-253 — Forward contact-bit producer:**54981 clears flags12 behind an existing12/32 gate, normalizes planar forward input, probes viewpoint/feet and can retry excluding a returned entity. Supplied trace surface8 can set PS8/4; roots/native contacts/legal domains remain unverified. ACTIONPROBE-001.

**F-254 — Recursive origin policy:**argument1 can rebase to supplied trace end Z+24, recursively evaluate argument0 and invoke actual landing with the parent entity if flags12 remain. Clear child suppresses landing while preserving the rebase. ACTIONPROBE-002.

**F-255 — Actual main54981 routing:**16 post-timer action chains select eight evaluated41768, six omitted55465 and two omitted43626 requests from actual produced flags. Ground-loss's nested54981 request, query/other modes/native/full runtime remain open. ACTIONPROBE-003.

**F-256 — Actual nested action priority:**46527 runs54981(1) before checking old-ground1023 then updated flags12. New flags can suppress the deep trace and preserve an existing plane; the sentinel path clears it first. Initial flags&12 still skip the prepared action. LOSTACTION-001.

**F-257 — Deep trace consumes rebase:**clear recursive action can leave origin[101,202,304] for the later64-unit query; flag-producing recursion skips that query/ground-loss animation. Outer46773 still clears plane/walk after helper return. LOSTACTION-002.

**F-258 — Two actual action call sites:**nested54981(1) runs before main timer, then main54981(0) clears/rebuilds flags and query gating. Twelve reached41768 chains retain actual post-ground landing/timer/event/resource state; native/full main/runtime remain open. LOSTACTION-003.

**F-259 — Live side-clearance child:**56639 now evaluates reached56335 with current origin/entity/basis and disjoint frames; first fraction1 skips the second side trace, and both fractions must differ from1 to acquire. All256 PS words are independently checked in30 shared-state query fixtures. Native trace legality/side effects remain supplied or unverified. MAINQUERY-001.

**F-260 — Full query/main state:**20 actual main chains preserve query velocity/anchor/field44/torso and old-state-dependent flags2, replacing isolated return/state-only transfer. Main action suppresses ten queries; routing selects ten evaluated41768, five omitted55465, four omitted43626 and one omitted57312. MAINQUERY-002.

**F-261 — Acquisition event queue:**exactly two new-acquisition main fixtures execute39238(23)/29913 before routing, storing numeric event23/parameter0 and advancing the two-slot queue. Existing-active/exit/failed/gated controls do not emit; event meaning and consumers remain open. MAINQUERY-003.

**F-262 — Active-state wish overwrite:**57312 evaluates friction/command scale, replaces the initial up-inclusive wish through its plane branch, forces Z±70 for nonzero forward, then zeros wish and PS velocity X/Y before actual40275 acceleration. Zero-forward basis Z and indirect up-through-scale effects remain observable. ACTIVEMODE-001.

**F-263 — Stationary query then gravity-off slide:**57312 traces current origin against itself with current hull; fraction<1 requests logging5123, then both branches request57714(0).66 finite fixtures check actual acceleration/slide outputs; native consistency/logging effects remain unverified. ACTIVEMODE-002.

**F-264 — Query-to-active-mode state:**12 main chains yield four actual57312, six higher-priority41768 and two omitted55465 paths. Four acquisitions execute event23 before movement; full query/queue state persists. Other environment/modes/native/runtime scope remains open. ACTIVEMODE-003.

**F-265 — Entry impulse precedes bit16 decision:**55465 first evaluates40966; relevant flags12/up10 branches clear plane/walk, set ground1023/flags8192, apply normalized planar direction×−50 and set16. Existing/new16 bypasses the ordinary movement/resource path. Existing8192 instead clears the up byte before later scale. FLAGGEDMODE-001.

**F-266 — Flagged wish and inline projection:**55465 uses fixed Z±150 for nonzero forward, quarters Z when absolute forward<100, caps normalized wish speed by PS52×file-backed0.5 and accelerates with coefficient3000. Negative velocity/normal dot triggers overbounce projection and normalization back to pre-projection speed before57714(0). Native geometry consistency remains unverified. FLAGGEDMODE-002.

**F-267 — Measured resource and main branch:**50 standalone/8 main fixtures carry actual slide outputs into reached39595, updating current meter/counter. Four main cases evaluate55465, including two entry16 bypasses; four128-priority controls evaluate41768 without55465 effects. All are query-gated; no acquisition event occurs. FLAGGEDMODE-003.

**F-268 — Full40966 launch ordering:**resource<1500 or state128 selects half X/Y and Z202.5; otherwise Z270. Numeric event99 and directional forced animation precede conditional inventory-dependent1800/3600 cost; slot16 is excluded and configuration>=2 skips cost. JUMPENTRY-001.

**F-269 — Walking entry routing:**43626 deep level>2 plus positive forward/normal dot bypasses40966 for41848. Otherwise actual entry return1 selects41848 above level1 or42838, while return0 continues43683 with any updated up byte. Main timer/resource/event state is retained. WALKENTRY-001.

**F-270 — Ordinary air continuation:**42838 normalizes live planar basis, accelerates with file-backed coefficient1, optionally clips and calls gravity-on60091 without41768 tail. Four actual walking launches carry event99/animation/resource state into this movement;1499/1500 resource controls distinguish pre-cost launch202.5/270 from post-cost command scaling. Wall-specific and ordinary walking paths remain open. AIRMODE-001.

RE-549 — Recover40679 movement direction classification: Signed forward/right input selects all eight direction values; idle rewrites old2 to1 and6 to7, preserving other prior values. Evidence.

RE-550 — Recover162-vector direction codec60317 and60408: Encoder uses strict-greater positive dot search initialized to score0/index0, so earliest ties survive and null/zero choose0. Decoder copies table entries0..161 or the initialized zero fallback. Evidence.

RE-551 — Recover42838 wall guard and trace hull restoration: Wall probe requires2048, a strict negative-Z interval and count below configuration. It shifts the endpoint five units opposite stored XY normal, temporarily sets hull min-Z10, restores min-Z, and sets count10 on fraction>=1. PS440 aliases inventory slot16 in the captured17-slot view. Evidence.

RE-552 — Compose wall success entry events and air continuation: Successful40966 is followed by counter increment, a second resource check after entry cost, a100/200 horizontal wall impulse, event86 with actual direction-codec parameter and forced animation26 before ordinary air movement. Evidence.

RE-553 — Recover41486 water-entry queries and launch state: With timer0 and level2,41486 probes30 units along normalized planar basis at Z+4 then+20; first contents must contain bit1 and second must equal0. Success uses raw basis times200 for XY, forces Z350, sets128 and timer2000. Evidence.

RE-554 — Connect41848 entry guard to actual41768 fallback: Actual41486 return determines whether41848 enters ordinary swimming at41862 or executes41768 with the newly written velocity,128 flag and2000 movement timer before its gravity tail. Evidence.

RE-555 — Recover complete ordinary41848 swimming and main handoff: Ordinary swimming uses idle Z−60 or scaled three-axis wish, caps speed by PS52 times source21172, accelerates with21196, projects only into-plane velocity while restoring speed, then uses gravity-off57714 return to set or clear32. Evidence.

RE-556 — Recover ordinary walking direction and slope wish producer: Walking friction and copied-command scaling precede actual40679, flattening and clipping each live basis vector against the ground normal, normalizing them and building a three-axis slope-aligned wish. Evidence.

RE-557 — Recover walking speed policy acceleration projection and resource: Walking applies flag/state/resource/water caps then a timed state128 override, selects acceleration from surface/flags/speed, performs two normalized plane projections and passes saved pre-projection speed into39595. Evidence.

RE-558 — Complete bounded walking wrapper and combined main handoffs: Complete43626 routes actual entry to air/water or normal policy, clears32 and runs60091(0) only when horizontal velocity is nonzero; actual main posture/contents/ground/timer/action/query and post-ground share the resulting state. Evidence.

RE-560 — Complete bounded freeflight movement: 42486 composes friction, command scale multiplied by1.5, a three-axis wish, normalization and coefficient8 acceleration, then integrates position only if any resulting absolute velocity component exceeds1. Evidence.

RE-561 — Water transition event matrix and queue composition: 48716 independently emits entry100/101, exit6, full-submersion7 and resurfacing8. Entry101 requires vertical velocity strictly below−500;0→3 and3→0 each enqueue two ordered events. Evidence.

RE-562 — Torso selector priority and weapon class dispatch: 49117 first rejects nonzero weapon state, then prioritizes legs25 over button8192/16384, then selects torso requests from a file-backed class jump table and tag22/25 exceptions. Evidence.

RE-563 — Reload request gates and timer animation event effects: 49652 gates reload on button32, packed magazine/reserve bytes and state flags, sets state bit8 and a configured timer, requests torso56/57 and emits event3 without transferring ammunition. Evidence.

RE-564 — Interaction trace and direct action consumers: 49918 chooses a contents-bit33554432 trace action or direct state128/256 action, applies ordered timers/events/animations, and uses a health-gated first16-slot item19 search to select750 versus1500. Evidence.

RE-565 — Packed mode availability edge latch and resource countdown: 50250 edge-latches button128 into state32768/event15;50309 permits availability on mode flag4 or nonzero magazine;50397 drains with the full dt when its countdown reaches zero. Evidence.

RE-566 — Mode switch and ordered weapon prefix: 49327 cycles packed mode with release latch16 and ID-specific exceptions;50746 orders button latch, weapon timer decrement, resource countdown and mode switch before weapon selection. Evidence.

RE-567 — Airborne locomotion animation and bob cycle: 47884 caches horizontal speed in FRAME216, then airborne animation priority combines water/crouch, traversal flags and state1024; traversal bob advances only for absolute forward input strictly above100. Evidence.

RE-568 — Complete locomotion gait bob and footstep consumer: Complete47884 selects grounded stance/gait requests, advances a masked bob cycle at.3 or.4 rates, and emits surface39, shallow32 or water41 events only on cycle crossings with route-specific suppression. Evidence.

RE-569 — Main request and independently bounded animation consumer chains: Actual54444 reload/interaction order exposes timer interference before the weapon prefix; a separate54455 torso/locomotion/water segment verifies animation and queue overwrite order without bridging the unrecovered weapon body. Evidence.

RE-571 — Weapon slot lookup and numeric return contract: 31691 searches the first16 packed weapon slots, compares their low bytes to the full requested integer and returns the first index or−1 without changing game state. Evidence.

RE-572 — Weapon selection request gates and transition effects: 48798 validates requested IDs1..27 and actual slot presence, emits30/parameter0, sets state2/timer0-or300 and timed torso54, then resets counters/resources and clears bits64/8/512 without switching slots. Evidence.

RE-573 — Weapon transition completion and fallback contract: 49028 looks up command weapon byte then fallbackID1, writes the returned slot without checking a second−1, sets state1, adds250 to timer, requests torso55 and emits30/parameter1. Evidence.

RE-574 — Helper50525 native trace gates and event contract: 50525 clears PS12 bit8192 on low up input or, after ordered gates, traces30 units ahead from originZ+30; contents33554432 sets state4096 and queues14 with native record+52 as parameter. Evidence.

RE-575 — Weapon prefix to actual selection handoff: 50746 re-decodes the current ID after mode processing, requests48798 only when it differs from command byte24, and suppresses that request for currentID27 while its decremented timer is positive. Evidence.

RE-576 — Weapon continuation guards timer floors and cancellation: 50923..51206 applies ordered traversal/action guards, floors timers at300, conditionally cancels state512 and returns while timer is positive; two ID checks literally assign localID12 on their fallback paths. Evidence.

RE-577 — Ready weapon refill cadence and interaction re-entry: 51207..51364 refills ID27 magazine from configured capacity, handles mode-flag1/counter cadence, then clears state1 before optional button64 interaction re-entry and exits. Evidence.

RE-578 — Reload completion packed ammo transfer and re-entry: 51365..51632 increments the magazine byte when record flags16 is set, otherwise replaces it with capacity; both decrement reserve modulo256, reset counter204, clear state8 and call49652(argument0). Evidence.

RE-579 — Weapon lowering raising and frame gates: 51633..51801 completes state2 via49028, resets state1 to0 and selects a separate class-based torso table, then gates other states on FRAME232 and FRAME36 before firing entry51802. Evidence.

RE-580 — Pre-firing weapon return chains and actual main suffix handoff: Recovered50746 branches now compose through51801, preserving the pre-switch mode local; actual53046 returns resume main torso/locomotion/water calls while51802 paths keep the caller suspended. Evidence.

RE-582 — Firing charge hold release and ordinary input gate: 51802..52084 uses mode flag8 to availability-gate a state32/64 charge latch and event1, handles requested-ID exceptions11/12, and otherwise lets nonzero burst counters bypass absent button1. Evidence.

RE-583 — Availability failure event and timer exception: 52085..52153 exits state1 before querying availability; unavailable ID27 returns unchanged, while other unavailable weapons zero counter204, queue29 and add500 to the timer. Evidence.

RE-584 — Firing magazine debit and preserved mode flag: 52154..52252 decrements only a nonzero selected magazine byte unless preserved local-mode flags4 suppress it; ID/mode/reserve and other slots remain unchanged. Evidence.

RE-585 — Firing animation priority before class dispatch: 52253..52411 prioritizes masked legs25 over weaponIDs4/24, then action buttons8192/16384; resolved routes select conditional53/64/49 or timed61/51 and skip the class continuation. Evidence.

RE-586 — Complete firing animation class tag and gait dispatch: 52253..52729 completes firing pose selection: the class jump table combines running-leg membership with tag22/tag25 exceptions, after the recovered earlier priority routes. Evidence.

RE-587 — Firing request publication burst counter and selected delay: 52730..52872 publishes FRAME260=1/264=0 and weapon state3, reloads a zero counter from mode+48, selects mode+44 burst delay while counter>1 and otherwise mode+8 delay, then decrements positive counters. Evidence.

RE-588 — Firing resource snapshot capacity arithmetic and reset: 52873..52988 snapshots resource188 into PS216, adds truncated30000/capacity with only an upper30000 clamp and sets a mode cooldown; mode flag16 instead zeros all three fields. Evidence.

RE-589 — Final firing delay and last-round exception: 52989..53045 adds the retained selected delay to PS44 only if the post-debit magazine is nonzero or selectedID27; other empty magazines return without adding it. Evidence.

RE-590 — Complete bounded weapon body and actual main consumer suffix: The entire50746 QVM body now executes with recovered children and agrees with independent staged oracles; actual main54444..54463 resumes through firing and non-firing returns with live state handoffs. Evidence.

RE-591 — Timer-coupled firing sequences and actual outer publication: Actual outer reset/timer/main-suffix/publication segments connect complete weapon effects to event31; three burst substeps retain one request and publish once, with independently checked selection/reload/last-round sequences. Evidence.

RE-593 — Server event queue window and firing branch routing: 151254 consumes at most the latest two ring events using a signed old-sequence clamp; event31 routes to151634, while other recognized consumers are stopped explicitly. Evidence.

RE-594 — Published firing event to server pre-call reset: Actual outer31 publication reaches server151634, which writes client4140=0 and4328=1 before pending289235(entity); this prelude does not read the queued parameter. Evidence.

RE-595 — Server firing suppression statistic and angle basis: 289235 first rejects client6164!=0, otherwise increments statistic4116 unless entity weaponID1, then builds global forward/right/up from client angles using native sin/cos requests. Evidence.

RE-596 — Server muzzle origins and actual firing handoff: 288779 uses entity+24 plus integer client viewheight and14×forward;288871 omits the forward offset. The actual289485 caller passes global basis/output pointers without native snapping. Evidence.

RE-597 — Entity weapon dispatcher and unresolved handler inventory: 289499 dispatches entity+192 through initialized table32688; IDs12/18 return here,18 IDs share293732, and other entries select distinct opaque handlers including285840/285971/288903. Evidence.

RE-598 — Temporary event record construction and position setter: 277695 builds a tempEntity with event type+19, time and flags, truncates the position before actual278138 sets trajectory/base/live origin, then issues native link−31. Evidence.

RE-599 — Event57 firing setup quantization and actual PRNG: 285840 builds event57, stores trunc(forward×4096) as float direction, derives a seed byte from actual36717 xorshift, records shooter/weapon IDs and prepares295018 arguments. Evidence.

RE-600 — Grenade record construction and inherited velocity: 285971 looks up weapon7 mode, biases forwardZ by.2 and normalizes, builds a grenade descriptor, quantizes mode-scaled launch velocity, then adds owner and optionally matching-ground velocity. Evidence.

RE-601 — Base-dependent firing gate scan and distance contract: 288903 requires mode8 and active!=1, scans type18 bases, then checks64-unit distance/ground and chooses nearest point with ties selecting the second; invalid base cardinalities are explicit stop boundaries. Evidence.

RE-602 — Published firing event to bounded server handler chains: Actual31 publication now chains through server reset/basis/muzzle/dispatch into selected setup; event-loop continuation resumes only recovered returns and stays suspended at opaque shot/allocation/handler boundaries. Evidence.

RE-604 — Entity initializer and preserved record fields: 277125 writes only identity, in-use, noclass pointer/tag and owner sentinel; all other 215 words survive. Evidence.

RE-605 — Entity allocator reuse and recent-free guard: The allocator scans from slot64, skips in-use records and delays recent frees only when freeTime>start+2000 and now−freeTime<1000. Evidence.

RE-606 — Allocator capacity retry and native registration request: Full-pool retry relaxes the recent-free guard; source count1022 enters diagnostics while1023 may extend to1024. Native−16 publishes entity/client layout. Evidence.

RE-607 — Temporary event with actual entity allocation: 277695 now composes actual277165/277125 and278138, returning fixed pool slot64 through both reuse and extension paths. Evidence.

RE-608 — Grenade constructor with actual entity allocation: 285971 now composes recovered277165/277125 before grenade descriptor and inherited velocity writes, preserving slot identity and in-use fields. Evidence.

RE-609 — Shared hitscan spread parameter calculation: 290493 reads current packed slot/mode and weapon table stride432/mode stride52 to calculate base, counter-scaled and modifier-adjusted spread terms. Evidence.

RE-610 — Hitscan movement speed normalization and airborne floor: 290493 normalizes velocity, applies an airborne ID14/23 floor below224.4, caps at340, then converts speed before its200 split. Evidence.

RE-611 — Hitscan rejection sampling and RNG consumption: Each spread candidate consumes four actual36717 draws; acceptance requires radius²<1 and radius²>local40×0.15. Zero RNG state never escapes its rejection loop. Evidence.

RE-612 — Shot body table copies and direction frame construction: 295018 copies four initialized tables, resolves the first matching weapon slot, normalizes input direction and builds a minimum-axis perpendicular/cross frame. Evidence.

RE-613 — Shared shot handler basis muzzle and pending aim handoff: 293732 resolves entity weaponID in16 slots, creates local forward/up and global right, computes the alternate muzzle and stops before290493 aim. Evidence.

RE-615 — Aim airborne adjustment and trigonometric offsets: The airborne44 multiplier precedes sampling; three sin/cos pairs create horizontal and vertical offsets, then future field6304 can clear flag84. Evidence.

RE-616 — Conditional aim jitter and additional RNG draws: IDs10/14/23 may add two RNG offsets; flag84 and the strict150-time boundary control the branch, with a distinct ID23 scale. Evidence.

RE-617 — Aim endpoint construction and selected alias behavior: The endpoint adds origin+16384×forward, then horizontal×global right and vertical×global up in distinct f32 write phases. Evidence.

RE-618 — Complete bounded shared aim function control flow: A single bounded source interpreter now follows every branch and call through290493, including rejection loops, added jitter and final endpoint writes. Evidence.

RE-619 — Shared firing handler through complete aim and trace handoff: Actual293732 now calls recovered290493 with its local forward/global muzzle, then prepares291641 without fabricating a trace result. Evidence.

RE-620 — Shot trace prelude candidate bounds and native request: 291641 unlinks the shooter, may request unrecovered rewind/setup helpers, widens eligible candidate bounds and issues native−25 with mask100663297. Evidence.

RE-621 — Complete point rotation helper and alias write ordering: 61092 constructs a rotation matrix using a minimum-axis basis and native trig; point/output alias changes results because final component stores reread input. Evidence.

RE-622 — Pellet muzzle width and indexed point rotation: 295018 computes width=16384×sin(degrees×radians)/cos(...), then rotates unitY around the initialized unitZ axis in18-degree pellet steps. Evidence.

RE-623 — Signed pellet seed perturbation and endpoint construction: 295018 mutates its argument seed using signed>>27, scales rotated offsets by an absolute sine and constructs the pellet endpoint without touching global RNG. Evidence.

RE-624 — Allocated event57 to first pellet native trace boundary: Actual285840 now composes source allocation/event57/quantized direction/global RNG with295018 first-pellet preparation and the reached291641 trace boundary. Evidence.

RE-626 — Trace entity classification and suspended hit consumers: 291641 classifies sentinel/entity traces using688/client4324/health and a literal tag, suspending before model-hit validation or damage rather than assuming a hit. Evidence.

RE-627 — Trace retry unlink stack and ten-attempt boundary: Each retry captures unlink−32, appends the target pointer and increments count; the tenth target exits to restoration instead of issuing another trace. Evidence.

RE-628 — Skipped target relink ordering and duplicate entries: The skipped-target cleanup issues native−31 in insertion order and preserves duplicate entries; empty lists issue no relink request. Evidence.

RE-629 — Candidate bound restoration and f32 round-trip limits: The restoration suffix repeats eligibility gates, reverses bound arithmetic and writes fixed ±15 dimensions rather than restoring a saved record. Evidence.

RE-630 — Shooter restoration gate final link and trace return: The trace suffix requests144413 only for client shooters without424 bit8 and mode exactly1; otherwise it links the shooter and returns local96. Evidence.

RE-631 — Complete trace retry cleanup flow under supplied response sequences: Whole291641 now follows supplied world/entity traces through retry, ordered relinking, bound restoration and numeric return, or suspends before unrecovered consumers. Evidence.

RE-632 — Rewind snapshot prefix and packed animation bytes: 143100 saves entity vectors and selected client state, sets client4408 and packs low animation bytes before history selection. Evidence.

RE-633 — Complete rewind record restoration and byte widening: 144165 restores saved vectors/client fields, zero-extends the two animation bytes, clears4408 and links once; a second call is inactive. Evidence.

RE-634 — Fixed player rewind selection and actual restore enumeration: 144082 and144413 scan exactly64 source slots using matching client/in-use/state/exclusion gates; the restore selector now executes recovered144165. Evidence.

RE-635 — Configured player_bb construction with recovered allocation: 144493 constructs file-named player_bb records with actual allocation/origin setup, using fewer selector gates; the position setter overwrites the earlier trajectory time. Evidence.

RE-637 — Rewind history bracketing and unclamped fraction: 143100 scans timestamp entries1..19 for the first≤target; exhaustion selects0/0 and still computes an unclamped fallback fraction. Evidence.

RE-638 — Exact weighted history vector interpolation and aliases: 143031 computes(1−fraction)×a+fraction×b in source f32 order, with no clamp; generic subtract/add lerp can differ. Evidence.

RE-639 — History angle interpolation and strict half-turn correction: 63746 corrects differences strictly beyond±180 by one360 step, then interpolates without normalizing the result or weight. Evidence.

RE-640 — History application vector angle and discrete state map: 143100 blends velocity/position and angles but copies animations and six client fields directly from the lower selected history row. Evidence.

RE-641 — Complete bounded rewind and snapshot restoration round trip: Whole143100 now executes snapshot, history selection, actual interpolation and link request; recovered144165 restores original live fields with animation byte truncation. Evidence.

RE-642 — Complete player rewind and restore selector composition: Actual144082 now dispatches complete143100 for each eligible player, followed by actual144413/144165 restoration; excluded records remain unchanged. Evidence.

RE-643 — Trace composition with actual rewind configured construction and restoration: Whole291641 now executes recovered rewind/configured/restore children before and after explicit supplied collision responses, retaining model-hit suspension. Evidence.

RE-644 — Twenty pellet source loop signed seed carry and no-target handoff: 295018 now executes all20 pellet iterations with actual rotation, signed seed carry and recovered trace return0, then reaches no-target bookkeeping. Evidence.

RE-645 — Statistic category maps and complete no-target bookkeeping: 279820 maps weapon/location categories, increments attempts/misses for no-target IDs, and recomputes percentage; zero total after wrap resets percentage without division. Evidence.

RE-646 — Allocated event57 twenty-world-pellet bookkeeping and caller continuation: Direct285840 now composes actual allocation, event57, quantized direction/global RNG, all20 supplied-world pellets, real no-target bookkeeping and void caller continuation. Evidence.

RE-648 — History reset writer and preserved row fields: 142502 resets all20 history rows from live state/time and clears4408, but does not initialize row72/76 or header words. Evidence.

RE-649 — History append shift and complete newest row writer: 142773 copies1600 history bytes to a temporary then shifts1520 bytes to rows1..19, writing a complete newest row including72/76. Evidence.

RE-650 — Source-produced twenty-row history through rewind and restoration: Reset plus25 actual append calls produce newest-first retained history consumed by complete143100 and restored by144165. Evidence.

RE-651 — Victim team and hit statistic bookkeeping: Complete279820 updates attacker/victim hit/location/value counters;33715 enables same-team accounting for modes≥3 except9/11. Evidence.

RE-652 — Model hit target ray normalization and pending pose ABI: 144766 selects the trace entity, normalizes end−start and requests32254 with target pose fields and shooter6176−client0 timing. Evidence.

RE-653 — Pose animation masks and controller preparation: 32254 masks both animation IDs, halves pitch, quantizes yaw and seeds controller flags before requesting33391. Evidence.

RE-654 — Complete finite angle swing controller: 33391 applies wrapped deltas, tolerance-scaled speed,16-bit quantization and asymmetric one-degree clamp margins. Evidence.

RE-655 — Hit-record ordering and trace publication: 25835 stably sorts five-word records by float key then prioritizes type3 over a leading5/6;146582 publishes context vectors and target ID only for nonzero count. Evidence.

RE-656 — Model-hit transform record construction: 144985 constructs four88-byte records from three supplied pose triplets, client fields and one target translation before requesting25341. Evidence.

RE-657 — Complete entity tag query and continuation: 276433 scans880-byte entity records using nonzero532/536 and exact integer540 tag equality; continuation starts after the prior record. Evidence.

RE-659 — History producer caller and literal-reference inventory: One direct append caller156173 and three direct reset callers174399/203011/219630 are present; no aligned initialized-data matches were found. Evidence.

RE-660 — Pose prefix with both actual swing controllers: 32254 executes two33391 calls through caller-owned angle/flag pointers, then reloads both changed angles before animation branching. Evidence.

RE-661 — Complete vector-to-angle helper and alias behavior: 62944 converts vectors through explicit quadrant/vertical branches and finite atan2/sqrt responses; the zero vector yields pitch−270 and yaw0. Evidence.

RE-662 — Animation-dispatched movement yaw and speed scaling: 32254 dispatches forward/reverse/default yaw branches, clamps integer horizontal speed to200 and yaw delta to±60, and preserves an integer reciprocal scratch calculation. Evidence.

RE-663 — Pose pitch publication and lateral scratch arithmetic: 32254 publishes animation-biased pitch, normalizes full velocity with a floating reciprocal and computes an unconsumed lateral scratch scalar. Evidence.

RE-664 — Relative pose angle publication and numeric flag sum: 32254 wraps head−body and body−legs independently into inclusive±180, publishes unchanged legs and writes a shifted numeric flag sum through an optional pointer. Evidence.

RE-665 — Complete finite pose routine with recovered source children: Complete32254 now reaches its void output boundary with actual swing, vector-angle and interpolation children across stationary/movement/animation-mask cases. Evidence.

RE-666 — Entity free control flow and conditional record reset: 277400 unlinks, requests ordered resource releases and clears nine pointer fields before deciding whether548 suppresses the whole880-byte reset. Evidence.

RE-667 — Grenade constructor with actual entity query and allocation: Grenade construction now runs actual276433 over an explicit pool and inherits the selected entity velocity only when its ID equals the owner ground ID. Evidence.

RE-668 — Model-child traversal and frame-sample interpolation: 25341 skips null child entries, selects112-byte frame/child samples and interpolates twelve words as B+(A−B)×fraction before requesting22009. Evidence.

RE-670 — Model ray through actual pose and transform construction: 144766 now executes complete32254 with live target/client pointers and consumes its actual nine angle outputs in all four transform records. Evidence.

RE-671 — Child sample origin through parent-chain rotations: 22009 copies sample64..72 into child origin, rotates through every parent basis, then adds only the immediate parent origin; null parent exits before basis composition. Evidence.

RE-672 — Complete child transform with exact fourth-row arithmetic: Complete22009 composes the sample basis only with nonnull parents and uses local40/60/48/68 for its fourth product row, preserving unusual source arithmetic. Evidence.

RE-673 — Complete hierarchy traversal through actual child transforms: 25341 now executes actual22009, skips null children, recurses into child tables and visits parent leaves after children; leaf geometry remains captured. Evidence.

RE-674 — Leaf ancestry matrix accumulation: 23092 accumulates matrices through the node parent chain and repeats the unusual fourth-row source indexing; identity ancestors therefore alter row four. Evidence.

RE-675 — Packed-word string length for resource release: Complete36038 tests each byte of packed words and returns the first NUL offset, including high-bit data and cross-word boundaries. Evidence.

RE-676 — String resource list detach and bounded byte wipe: 249639 searches the resource list, detaches a matching header, runs actual36038, wipes length+8 bytes and requests16934 heap release; missing pointers do nothing. Evidence.

RE-677 — Actual entity free through allocator reuse timing: Actual277400 free-time and used state now feed277165 reuse policy; age1000 is eligible, and start+2000 can permit immediate reuse. Evidence.

RE-678 — Basic source trajectory position branches: 27168 types0/1 copy base,2 advances linearly,3 clamps time to duration and nonnegative elapsed, and5 subtracts400×elapsed² from z. Evidence.

RE-679 — Constructed grenade through trajectory and event prelude: Actual queried/allocated grenade enters223156, evaluates source trajectory, truncates/rebases origin and emits event55 through actual direction encoding/event writes before damage branching. Evidence.

RE-681 — Packed frame vertices through world triangle construction: 23092 addresses eight-byte packed vertices by frame/count/index, sign-extends xyz16, interpolates B+(A−B)×fraction and scales1/64 before ancestry transform/origin. Evidence.

RE-682 — Leaf ray triangle determinant and barycentric tests: 23092 rejects an open determinant epsilon interval and out-of-triangle barycentrics but retains either winding and negative/unbounded ray parameters. Evidence.

RE-683 — Accepted candidate normal and exact source point construction: 23092 normalizes cross(a−b,b−c) and both edges, then builds point=a+unit(a−b)×u+unit(b−c)×v in source addition order. Evidence.

RE-684 — File-backed surface name classifier and exact string children: 21493 recognizes fourteen case-sensitive names/categories1..14 through actual21458 perfect hashing and36306 packed comparison. Evidence.

RE-685 — Nearest farthest context updates and bounded hit append: 23092 updates nearest/farthest point-normal-part independently of category/capacity, then appends nonzero category five-word records only below count10. Evidence.

RE-686 — Complete packed-model leaf geometry and source-produced hit records: Complete23092 now produces actual geometry-derived context records through packed vertices, ancestry, barycentrics, source normals/points and actual metadata lookup. Evidence.

RE-687 — Recursive model traversal with actual leaf geometry: 25341 now composes actual22009 and23092 through recursive hierarchies, producing hit records from packed geometry rather than supplied leaf replies. Evidence.

RE-688 — Complete model-hit helper through geometry and publication: Complete144766 now executes actual pose/hierarchy/leaf geometry/classification/sorting and returns geometric hit0/1 with exact trace publication. Evidence.

RE-689 — Complete multi-part model hits and priority ordering: Actual star/nested model hierarchies generate categories1/3/5/6, then source sorting can prioritize torso3 over a nearer arm5/6 without changing context nearest vectors. Evidence.

RE-690 — Rewound trace through actual model geometry and complete cleanup: 291641 now reaches complete returns through actual geometric model hits or model misses followed by a supplied world retry, including actual rewind/restoration and cleanup. Evidence.

RE-692 — Bounds-checked original MD3 reader and QVM layout contract: Original MD3 version15 headers/surfaces match recovered model offsets; all eight selected LOD3 files parse, including case-mismatched orion/lower_3.MD3. Evidence.

RE-693 — Exhaustive extracted MD3 variant inventory: All619 case-insensitively discovered MD3 occurrences validate, totaling152772340 bytes; case-sensitive suffix searches would miss originals. Evidence.

RE-694 — Source model bindings and original tag attachment evidence: Actual21581 initialization requests Athena/Orion LOD3 lower→upper→head→helmet chains; all six requested tags exist in the original parent models. Evidence.

RE-695 — Original MD3 bytes through QVM vertex decoder: Verbatim original MD3 headers/surfaces/indices/frame bytes execute through23929 and match independent signed-coordinate interpolation for all eight selected models. Evidence.

RE-696 — Complete QVM leaf geometry on original player models: Complete23092 processes all eight original selected MD3 models; aimed rays produce real source hit records and distant rays miss across first/last animation frames. Evidence.

RE-697 — Original tag attachment through complete hierarchy geometry: Actual21770 attaches original tag_torso/tag_head chains and25341 processes all four original model parts for both characters and first/last frame fixtures. Evidence.

RE-698 — Complete pose-driven model hits on original MD3 hierarchies: Complete144766 now uses original Athena/Orion lower/upper/head/helmet buffers, actual tag attachment, pose, geometry and sorting to publish source-derived hits/misses. Evidence.

RE-699 — Original-asset numerical geometry comparison audit: Original-asset runs retain measurable source-point differences from conventional ray points and localized fourth-row differences; native/reference validation remains necessary. Evidence.

RE-700 — Contact eligibility gates with original-model hit contexts: 292545 gates client contact on damageable/special mode, nonempty hit context and team/friendly-fire rules before reached damage calculation. Evidence.

RE-701 — Rust original-byte MD3 asset core and cross-language validation: A dependency-free Rust asset crate parses all619 originals with Python parity for headers, surfaces, sampled packed geometry, frame/tag float bits, UVs, triangles and shaders. Evidence.

RE-703 — Damage protection and armor location selection: 289594 rejects mode9 and strictly active spawn protection before location output; actual32155/32117 reclassifies head/torso using live inventory low bytes and health, excluding slot16. Evidence.

RE-704 — Damage descriptor and cubic range term: 289762 selects two words at4068+432×weapon+8×location and independently computes weapon4 ratio clamp and cubic complement using context84. Evidence.

RE-705 — Weapon24 distance attenuation: Weapon24 preserves the factor below half range, linearly falls to float32 0.1 by full range, and stays at that floor thereafter; zero range takes the floor without division. Evidence.

RE-706 — Damage saturation and weapon4 accumulation: Positive damage factors cap at1 and weapon4 additionally caps at float32 0.35; its optional accumulator adds that capped factor without a total clamp. Nonpositive factors return zero immediately. Evidence.

RE-707 — Wound eligibility and client meter increments: Mode9, entity flag16 or protection suppress the wound word. Active client wounds set leg flag128 at locations11–14 and increment client4312 with source-specific threshold rules. Evidence.

RE-708 — Active wound attribution and counter cap: Active wounds record attacker pointer at target836 and weapon at client4300; counter4304 increments only below4 and resets4316 there, while client220 bit256 is always set. Evidence.

RE-709 — Damage location jump table and client flags: The original32796 jump table ORs client192 bit4 for locations1/2, bit1 for3/4/7/8, and bit2 for5/6/9–14; signed out-of-range locations bypass it. Evidence.

RE-710 — Held-item deadline and final factor override: Held item low-byte14 at factor≥0.2 or23 at factor≥0.5 writes client6304=time+200 for nonleg locations; global34066516 returns1 after side effects. Evidence.

RE-711 — Complete damage factor on original-model contacts: Complete289594 now runs original-model hit contexts through actual inventory, factor selection, wound bookkeeping and every numeric return. Its weapon4 cubic local is computed but never used to scale the return. Evidence.

RE-712 — Contact direction basis and health-damage dispatch: Contact293373 recomputes global forward/right/up from attacker angles, calls211239 only for nonzero scalar and nonspecial contact, truncates scalar to integer damage, and returns the original float scalar. Evidence.

RE-703–712 batch complete: damage factor and contact dispatch. Complete289594 handles original-model contact factors and wound bookkeeping;211239 is still captured. RE-702 is partially advanced and RE-713 tracks contact/event/health composition, native parity and Rust/Bevy/Solari platform work. No playable-game milestone is claimed.

RE-714 — Ordinary contact factor composition: Ordinary292545 now calls complete289594, multiplies its returned float factor by100 and suppresses the scalar when the output location is zero. Evidence.

RE-715 — Special weapon4 contact classification: The special contact path fixes scalar1, reads the first context category and reclassifies head/torso through actual inventory, without invoking289594 or changing its accumulator. Evidence.

RE-716 — Contact event and announcement gates: Events require nonzero caller flag and scalar; announcement7259 additionally requires34081316 and clear victim client220 bit16384/entity552 bit16. Evidence.

RE-717 — Contact event header and health prediction: Contact allocates event62 through actual277695, encodes the normal through60317, publishes IDs/location/part and predicts lethality using float32 health−scalar≤0 without applying damage. Evidence.

RE-718 — Contact event scalar and direction payload: Event204 truncates ordinary scalar or weapon4 accumulator×100 with upper cap100 only; exact trace point replaces the snapped trajectory base, and event36 stores normalized attacker-minus-target separation. Evidence.

RE-719 — Contact event vector and actual feedback ledger: Contact event104 receives truncated global forward×500 or exact muzzle for weapon27; positive encoded feedback calls actual285142, which requires enabled mode, attacker client and target ID0–64. Evidence.

RE-720 — Complete impact-only contact branch: Impact-only contacts return0 and emit event109 for weapon30 or63 otherwise only with nonzero flag and clear trace surface bit32; weapon27 copies exact muzzle. Evidence.

RE-721 — Complete contact on original-model contexts: Complete292545 now composes eligibility, ordinary/special factors, event/impact branches, actual feedback, direction basis, health request and return using original-model contexts. Evidence.

RE-722 — Health damage entry gates and client marker: 211239 applies damageable/mode/method/protection/global gates before marking client4328 and optionally first cross-team tracking34999664; health is unchanged in the prefix. Evidence.

RE-723 — Health normalization and knockback selection: 211239 normalizes the supplied direction, selects knockback from30 original descriptors or method-specific integer damage, caps only above200, and applies flag/team rejection gates before later effects. Evidence.

RE-714–723 batch complete: complete contact and health prefixes. Complete292545 now uses original-model contexts through actual factor/event/feedback children;211239 entry gates and knockback selection are bounded recoveries. Full health mutations/callbacks, native parity and playable Rust/Bevy/Solari work remain open. RE-713 is partially advanced and RE-724 tracks the next work.

RE-725 — Health pointer fallback and target routing: Null inflictor/attacker become world34990728; target kind4 with a nonmagic checksum diverts to a guarded callback and exits before normal health logic. Evidence.

RE-726 — Health attacker credit and client damage records: Health bookkeeping adjusts attacker client252, clamps incoming integer damage to at least1 and publishes per-client damage, direction/origin, attacker and method fields before health subtraction. Evidence.

RE-727 — Special target health classes and actual RNG: The magic checksum routes method34 directly to health−999; class0–4 can choose1/2/3 damage through actual36717, while classes5–10 filter methods22/25 and selected classes halve method25 damage. Evidence.

RE-728 — Lethal mode interception and method24 override: Mode10 can divert distinct live-client lethal damage to206128, while method24/global34066516 zeros direction z and requests impulse without ordinary health subtraction. Evidence.

RE-729 — Ordinary health subtraction and protected publication: Ordinary damage subtracts selected damage, optionally floors protected health at5 while clearing client flags, publishes attacker/location and mirrors health to client208; actual211197 drains client184 by300×damage with floor0. Evidence.

RE-730 — Terminal health callbacks and packed meter cap: Terminal processing caps client228 low16 values above500 (except method26), clamps dead health at−999, records killer pointer and issues pain/death/impulse requests with distinct ABIs and ordering. Evidence.

RE-731 — Complete velocity impulse and movement timer: Complete213009 adds direction×(global scale×knockback/200) in source float32 order, and only a zero existing timer gets clamp(trunc(knockback×2),50,200) plus movement flag64. Evidence.

RE-732 — Complete health function with actual velocity impulses: Complete211239 now composes gates, routing, normalization, bookkeeping, special targets, health publication and terminal branches with actual RNG/meter/impulse children. Late health−999 clamp can leave client208 below the entity clamp. Evidence.

RE-733 — Complete original-model contact to actual health: Original-model contact now executes actual211239 health/impulse effects while preserving contact return, event payload and special-weapon4 bypass behavior; default captured-health reports remain unchanged. Evidence.

RE-734 — Rust source-order health impulse primitive: Dependency-free urt-gameplay ports213009 velocity/timer rules; exact word comparisons match all96 source fixtures, with active nonfinite/unsupported integer-conversion domains rejected explicitly. Evidence.

RE-725–734 batch: health, contact and Rust impulse findings. Complete finite211239/213009 and original-context contact composition now execute with explicit unresolved callback/native boundaries. The Rust impulse primitive matches96 fixtures; full Bevy/Solari/platform gameplay remains open. RE-724 is partially advanced and RE-735 tracks subsequent work.

RE-736 — Complete protected accumulator and completion callbacks: 152386 consumes float32 accumulated heat, clamps negative progress, completes at32000 and copies resulting progress to a nonnull attacker. Evidence.

RE-737 — Mode10 interception gates and protected state publication: 206128 exits outside mode10, state3 or blocked rounds; active entry publishes health50, meter15000 and protected bits with event106. Evidence.

RE-738 — Mode10 descriptor and stance animation dispatch: Original weapon descriptor classes select animation65/66/67/72/78; class4 method22 special-cases66 and stance bit1 selects41/42. Evidence.

RE-739 — Mode10 inventory reset and obituary publication: Interception clears ten inventory/timer fields and emits obituary28 with bounded method-name lookup and conditional attacker-health disclosure. Evidence.

RE-740 — Mode10 team scoring penalties and lifecycle notifications: Interception increments victim/team counters, requests score+1 and same-team -2, and applies a strict greater-than2000ms repeat-penalty gate before notifications. Evidence.

RE-741 — Complete mode10 interception source composition: Complete206128 now composes entry gates, protected publication, descriptor dispatch, cleanup, obituary, counters and penalty requests across56 fixtures. Evidence.

RE-742 — Actual lethal health suffix to complete mode10 interception: The health lethal-decision suffix now executes actual206128; a blocked round still consumes the lethal intercept without ordinary subtraction. Evidence.

RE-743 — Rust protected progress and completion primitive: Rust now reproduces protected progress accumulation, threshold completion, flag cleanup and event selection against all recovered finite152386 fixtures. Evidence.

RE-744 — Rust mode10 gate and protected-state entry primitive: Rust now preserves every entry-gated word and reproduces mode10 protected-state publication across36 source fixtures. Evidence.

RE-745 — Rust interception animation dispatch and lifecycle batch handoff: Rust numeric animation/stance dispatch matches140 source fixtures; this batch adds protected progress and mode10 entry/animation primitives while native callback and engine integration remain open. Evidence.

RE-747 — Complete score update gates wrapping and rank refresh: 205260 updates client248 with wrapping addition, optionally updates a mode3 team score, and requests ranking5864 only after active mutations. Evidence.

RE-748 — Reset and pair notification gates and connected recipients: 6369 and6439 dispatch only to client state2, after pointer/in-use/client gates; their recipient callbacks remain explicit. Evidence.

RE-749 — Complete method to statistic slot classification: 278733 maps19 selected methods into statistic slots0..18 using the original jump table; all other tested methods return-1. Evidence.

RE-750 — Complete method counter mutation aliases and notifications: 278834 updates per-method or fallback counters with wrapping increments, distinct self cases, and ordered aggregate/report requests. Evidence.

RE-751 — Complete cross client record clearing and inclusive index64: 285486 clears two words across nonnull client records in64 entity slots; its source gate accepts index64 inclusively. Evidence.

RE-752 — Protected completion with actual scoring and recipient dispatch: 152386 completion now executes actual205260 score mutation and6369 connected-recipient dispatch while retaining explicit rank/callback/event boundaries. Evidence.

RE-753 — Complete interception with actual score statistics and record clearing: 206128 now composes actual scoring, recipient dispatch, method counters and cross-client clearing for valid pool ID aliases. Evidence.

RE-754 — Rust wrapping score primitive and ranking request contract: Rust player/team score updates and ranking-request decisions match67 source fixtures, with explicit active team-index rejection. Evidence.

RE-755 — Rust method classification wrapping counters and reporting intent: Rust classification and method-counter mutation now match53 mapping and205 counter fixtures, including self aliases and wrapping increments. Evidence.

RE-756 — Rust cross client clearing and score statistics batch handoff: Rust cross-client clearing preserves the source inclusive index64 and exact logical changed-word footprint across40 sparse/dense fixtures. Evidence.

RE-758 — Complete statistic totals field inclusion and wrapping: 283085/283166 sum20 per-slot counters plus selected legacy fields with signed wrapping and distinct exclusions. Evidence.

RE-759 — Complete divisor normalized totals and ratio publication: 279586 publishes reduced integer totals and a source-order float32 ratio using actual totals and283488 divisor behavior. Evidence.

RE-760 — Complete same team aggregate counters and participant gates: 279720 increments first-client2444 and second-client2516 only for distinct same-team clients in supported modes. Evidence.

RE-761 — Complete recent record awards timestamp gates and index64 alias: 285227 awards distinct enemy recipients when record count is at least40 and wrapped signed age is at most30000; index64 aliases the award word. Evidence.

RE-762 — Single recipient numeric payload cached ping and send requests: 179736 numeric payload preserves cached follow ping, applies entity-flag publication override, and emits source status/time/packed-field arguments. Evidence.

RE-763 — Pair recipient numeric payload gates and cache aliases: 180087 numeric body projects two participants into one formatter request with independent status/ping fields and source-order cache alias handling. Evidence.

RE-764 — Ranking setup counts active slots and sort boundary: 5864 setup builds a scan-order connected list, distinguishes non-spectator/active/human counts and records the first two active slots before sorting. Evidence.

RE-765 — Rust counter totals divisor and normalized ratio primitives: Rust totals and normalized ratios match80 total,28 ratio and38 signed-divisor source fixtures while retaining20 slots. Evidence.

RE-766 — Rust recent record awards timestamp gates and alias storage: Rust recent-record awards match68 source fixtures, preserving future ages, wrapped clocks, ID gates and index64 award/count aliasing. Evidence.

RE-767 — Rust recipient numeric projection and reporting batch handoff: Rust recipient participant gates, numeric fields and cache effects match72 single and73 pair source fixtures, including self aliases. Evidence.

RE-769 — Complete ranking comparator gates ties and mode priorities: 5441 preserves mode-specific score/time/class priorities and returns non-ordering results for some deferred/connecting pairs. Evidence.

RE-770 — Actual aligned small rank sorting with dynamic comparator: 35095 aligned four-byte insertion sorting now executes actual5441 callbacks for fewer than7 entries. Evidence.

RE-771 — Complete finite ranking sort tie flags and publication requests: 5864 now executes actual aligned small sorting and publishes team/individual rank words with tie bit16384 before explicit publication requests. Evidence.

RE-772 — Leaderboard slot mapping sparse layout and sentinels: 278587 maps20 weapon-like identifiers to slots0..19;284555 initializes nine metric fields and preserves record holes. Evidence.

RE-773 — Complete leaderboard joint thresholds sentinel updates and ties: 284610 requires every candidate metric to strictly exceed its threshold, then updates only nonsentinel fields and records the candidate entity. Evidence.

RE-774 — Actual first four leaderboard category selections: 283622 first four categories now execute actual initialization/mapping/selection with their original key groups and thresholds. Evidence.

RE-775 — Original recipient command templates and bounded byte serialization model: Original scoress/scoresd templates carry12 numeric fields plus a name per participant;69338 requests31-byte strncpy then forces the32nd byte to zero. Evidence.

RE-776 — Rust raw comparator and eligible rank publication primitives: Rust raw comparator and rank words match232 comparator and48 eligible complete-ranking source fixtures without imposing Ord on non-ordering prefilters. Evidence.

RE-777 — Rust leaderboard mapping sentinels and joint metric selector: Rust leaderboard mapping and joint threshold selection match33 mapping and77 corrected-reentry source cases. Evidence.

RE-778 — Rust modeled recipient byte serialization and ranking batch handoff: Rust serializer matches the explicit original-template/native-copy byte model while preserving signed values, raw names and terminal NUL. Evidence.

RE-780 — Bounded resumer call-site and return-placement audit inventory: Both bounded resumers have legacy consumers; static inventory exposes literal ranges, computed-range review gaps, loop markers and dynamic STORE4 return sites. Evidence.

RE-781 — Fail-closed CALL return placement and coherent result bytes: Synthetic dynamic callbacks now require explicit return offsets, preserving the callback pointer; following byte loads see the real callback word rather than placeholder zero. Evidence.

RE-782 — Repeated CALL timing counterexamples and empty-stack guards: Legacy resumption demonstrably exits a three-step countdown early; corrected tracing supplies every return and memory effect before the next loop branch. Evidence.

RE-783 — Corrected movement resumption with persistent byte and command state: The movement resumer also loses non-command STORE1 writes across calls in legacy mode; corrected opt-in preserves bytes and applies handler-returned commands before the next segment. Evidence.

RE-784 — Audited notification reentry and 64-slot recipient dispatch: 6369 and6439 now use corrected reentry; scaled recipient order/gates and full legacy/corrected tuples agree for captured callback fixtures through64 slots. Evidence.

RE-785 — Audited dense recent-award scans timestamps and index64 alias: 285227 uses corrected reentry;32 dense65-record fixtures preserve source scan order, signed timestamp/count gates and index64 award/count aliasing. Evidence.

RE-786 — Audited method counters team pairs and dense record clearing: 278834,279720 and285486 now use corrected reentry; independent counter/alias/address oracles and full legacy tuple comparisons cover160 expanded fixtures. Evidence.

RE-787 — Audited water-entry dynamic returns and locomotion source consumers: 41486 and selected47884 prefix/ground paths use corrected movement execution, with full returned-memory differential checks and independent water/gait/event expectations. Evidence.

RE-788 — Actual aligned sort swaps and dynamic median-of-three helper: Recovered34829 aligned swaps and34964 median-of-three with five reviewed return destinations; tests cover overlap, guards, permutations and ties. Evidence.

RE-789 — Actual aligned ranking partitions recursion and 64-client sorting: 35095 partitioned sorting is now source-executed through64 eligible clients with actual swaps, median/ninther selection, recursion and insertion fallback. Evidence.

RE-780–789 exposes and bounds legacy resumer timing/byte-state flaws, migrates selected consumers with independent checks, and recovers original partitioned sorting. Unmigrated reports remain unaudited. Batch evidence.

RE-791: Both resumers can synchronize new and changed child words into byte lanes without erasing unchanged parent byte overlays. Evidence.

RE-792: 5864 now composes actual35095 sorting and rank writes over80 larger eligible populations with explicit publication captures. Evidence.

RE-793: Ranking count globals follow connection/team/bot gates, but deferred records can move active clients out of the positional prefix that receives rank words. Evidence.

RE-794: Rust now executes the recovered insertion/partition/median/ninther sort without assuming comparator Ord; source parity includes unstable tie permutations. Evidence.

RE-795: Rust composes recovered source sorting and rank writes, matching exact order and tied/team rank words for128 full caller fixtures. Evidence.

RE-796: Rust reproduces source collection, first-playing identifiers and bot/team counters across185 setup and complete caller fixtures. Evidence.

RE-797: Rust matches exact order, rank words and count globals for144 complete mixed/eligible caller fixtures, without reinterpreting asymmetric prefilters as Ord. Evidence.

RE-798: 278834 now optionally composes actual team counters and both ratio refreshes;64 fixtures verify counter aliases, totals, divisor and float32 publication together. Evidence.

RE-799: 6328 dispatches179363 to every state2 client in scan order, including spectators, and now executes inside48 complete ranking caller fixtures. Evidence.

RE-800: Rust reproduces all6328 recipient requests and exact rank-plan outputs across69 source fixtures, including connected spectators and both broadcast gates. Evidence.

RE-791–800 adds exact Rust source-sort/ranking parity, mixed count/prefix semantics, composed stat ratios and source/Rust scoreboard dispatch. Batch evidence.

RE-802: Bounded tracing can now preserve byte/word coherence and execute unaligned byte copies without changing legacy observations. Evidence.

RE-803: Both bounded resumers now support validated child byte writes, coherent word mirroring and explicit word/byte/return precedence. Evidence.

RE-804: Actual strlen36038 and strcpy36185 execute against coherent bytes, preserving destination guards; bounded copy69338 retains an explicit native strncpy model. Evidence.

RE-805: 179363 differs from single-recipient payloads: raw class is preserved, only connecting state1 forces999 ping, and overflow candidates mutate cache before rejection. Evidence.

RE-806: 179363 now executes its real string and format wrappers, admission loop and rotating final buffer; exact byte output is checked under explicit formatter/native-copy models. Evidence.

RE-807: Rust reproduces every attempted source scoreboard row and cache update while preserving the differences from existing single/pair recipient projections. Evidence.

RE-808: Rust matches exact modeled scoreboard bytes, accepted/attempted counts, rejected-row cache mutations and output-ring wrap for18 source compositions. Evidence.

RE-809: 6328 now composes actual scoreboard bodies for successive recipients, preserving cache mutations, refreshed frame arguments and alternating output pointers. Evidence.

RE-810: Rust now matches successive source scoreboard packets with shared cache and ring state, rather than producing isolated per-recipient projections. Evidence.

RE-811: 278834 now composes actual recent-award scanning after actual team/ratio children in canonical actor/victim storage across64 mode/count/time/self fixtures. Evidence.

RE-802–811 adds opt-in coherent memory, original string/scoreboard control flow, Rust stateful packet/broadcast contracts and actual stat-award composition. Batch evidence.

RE-813: 37768 truncates non-null strings by precision, always pads on the right, and ignores supplied precision for null strings by using its source fallback literal. Evidence.

RE-814: 37279 pads zeroes before a negative sign and renders wrapping INT_MIN remainder bytes noncanonically; narrow left-padding domains fail bounded execution. Evidence.

RE-815: 37914 now executes original dispatch tables and integer/string children; pointer conversion is decimal, unknown conversions consume one low-byte word, and source padding/minimum quirks propagate. Evidence.

RE-816: Replacing the standard-decimal boundary with actual37914 exposes signed-minimum byte differences; prior modeled results remain explicitly separate. Evidence.

RE-817: Rust now matches actual37914 rather than host printf for decimal/string/character dispatch, including signed-minimum, null precision and padding quirks. Evidence.

RE-818: Rust scoreboard construction now uses recovered decimal/format semantics, replacing the earlier host-decimal assumption and matching actual source formatter packets. Evidence.

RE-819: 70386 warns at count>=capacity, returns the clipped count and copies a guaranteed terminal NUL; embedded NUL separates reported count from visible string length. Evidence.

RE-820: Rust matches original clipping counts, visible bytes, warning thresholds and alternating buffer counters across56 wrapper cases. Evidence.

RE-821: 7805 first handles blocked state, then a pending1000/5000 transition using signed wrapped elapsed time; only a ready transition clears the pending global. Evidence.

RE-822: Rust matches source7805 blocked/pending prefix behavior over144 cases, preserving pending time on blocked/wait paths and clearing only ready transitions. Evidence.

RE-813–822 replaces the scoreboard decimal assumption with actual37914 execution and corrected Rust byte parity, adds formatter wrapper contracts and recovers the exit-rule prefix. Batch evidence.

RE-824: 37498 pads only the signed integer portion, ignores formatting flags and iteratively truncates fractional f32 digits without rounding; negative zero has no sign. Evidence.

RE-825: Rust now reproduces original37498 fractional truncation and integer-only width padding, including negative-zero and ignored flag behavior. Evidence.

RE-826: Mode11 exits on the first state2/team0 client whose signed class exceeds20, using the configured max-client count rather than the collected client count. Evidence.

RE-827: Rust reproduces the original first-offender mode11 guard and keeps the configured scan bound explicit and safe. Evidence.

RE-828: The exit suffix requires at least two playing clients, selects limits across the raw mode5 boundary, and checks first/second global scores before a low-mode client scan. Evidence.

RE-829: Rust matches all125 source suffix decisions, including nonzero negative limits, playing-count gates and configured low-mode scans. Evidence.

RE-830: The active round gate bypasses time-limit evaluation; expired mode9 time limits reset qualifying clients and populate supplied event records before exit requests. Evidence.

RE-831: Rust matches116 original timer cases, including active-round bypass, signed multiply/clock wrap and exact mode9 client resets. Evidence.

RE-832: Complete7805 execution now composes prefix, class, supplied predicate, round/time and limit policies with shared mutations across438 finite fixtures. Evidence.

RE-833: Rust now composes the full recovered7805 priority and matches438 continuous source cases, including pending clears and mode9 reset/event intentions. Evidence.

RE-834: Actual 7662 and child 33715 execute across 168 cases. Playing count and the enabled global gate ties; team-classified modes compare global scores, mode9 uses ranked field308, mode11 field696, and other modes field248. Raw numeric names remain conservative; ranked pointer legality and native execution remain open. Evidence.

RE-835: Rust matches all 168 source cases with typed signed mode classification, global-score and ranked-field selection, early gate handling and safe rank rejection. A separate scoped intermission adapter avoids rebuilding unrelated lifecycle fixtures; original runtime remains open. Evidence.

RE-836: 131 original 7525 cases recover connected/entity-flag8 exclusion, nonzero readiness, first16-slot mask and independent counts. Signed wrapped timestamp additions gate a five-second minimum and ten-second wait; all-ready includes an empty eligible set. Actual 6939 next-map transition remains captured. Evidence.

RE-837: Rust matches 131 original readiness cases, including slot16 mask exclusion, empty eligible sets, nonzero ready/wait flags, signed wrap and exact timeout boundaries. Safe scan rejection preserves state; next-map execution remains an explicit exit intention. Evidence.

RE-838: 39 original 6825 cases recover the once-only blocked guard, clock assignment, optional slow setup, connected-client fallback ID, entity-client field4324 clear and ordered preparation/respawn/move/publication requests. Child effects remain captured; the zero clock case exposes the raw timestamp-as-guard behavior. Evidence.

RE-839: Rust matches 39 original begin-transition cases, preserving timestamp guard semantics, fallback IDs, entity-client field clear and preparation/slow/respawn/move/publication order. Native work stays typed effects; invalid counts reject before mutation. Evidence.

RE-840: 83 original 7367 cases recover Exit header, pending now−50, publication/configstring22 ordering, team score log, signed ping clamp and at most32 ranked connected nonspectator rows. Verified original format strings are recorded. Logging, publication and syscall effects remain captured. Evidence.

RE-841: Rust matches 83 original exit-log cases with signed ping clamp, negative/zero/over32 rank counts, ranked filters, optional team score projection and wrapping pending timestamp. Rendering and ordered publication/configstring/log effects remain caller-owned; invalid ranks reject before mutation. Evidence.

RE-842: 150 continuous 7805 fixtures now execute actual tie, readiness, begin-transition and exit-log children on shared world memory with separate child frames. Independent policy and nested ABI checks cover conflicting gates, client mutations and publication intentions. Lower-level next-map/respawn/camera/I/O and allocation still remain captured. Evidence.

RE-843: Rust composes recovered tie, readiness, begin and exit-log policies with prior exit timers/limits across150 continuous source fixtures. Atomic staged updates preserve shared pending/client state; reset and lower-level world/I/O effects remain explicit intentions. Source branch labels are independently classified by the tested composition oracle; captured requests and actual final source state supply effect parity. Evidence.

RE-844: 72 original 6575 fixtures recover entity/player origin and view-angle copies, velocity clear, movement type5 and cleared entity/client fields. Coherent byte copies preserve arbitrary float words, including NaN payloads; two entity-to-client targets prove indirection. Mode/field4324 gates converge without extra effects. Native renderer/camera integration remains open. Evidence.

RE-845: Rust matches all 72 original camera fixtures, copying raw float words exactly and clearing the verified fields. The parity adapter resolves either entity-to-client target; the library accepts an already-resolved mutable client. Native camera/rendering and unrestricted pointer alias behavior remain open. Evidence.

RE-846: 36 original 6717 cases recover fallback/selected view copies, optional target lookup and f32 target-minus-origin direction. Exact search/fallback/angle-conversion request ABI is checked. Search results and fallback writes are supplied; 62944 angle conversion and native selection/rendering remain open. Evidence.

RE-847: Rust matches 36 original view-selection cases: supplied fallback/search results, copied angles and exact finite f32 direction subtraction, with typed ordered search/fallback/aim effects. Nonfinite arithmetic rejects; raw copies retain words. Angle conversion62944 and native selection remain open. Evidence.

RE-848: 300 original 6939 cases recover the positive-phase/team-classified gate, option/flag2+4 restart priority, saved score order, flag clearing and configstring1005/2 requests. Normal reset stops at its boundary. Actual33715 executes; text formatting and downstream map/native effects remain supplied or captured. Evidence.

RE-849: Rust matches 300 original series-branch cases, reusing the verified mode classifier and preserving restart priority, saved score order, raw flags and pending/blocked clearing. Formatting/configstring/map calls remain ordered intentions; the normal branch is left for its own policy. Evidence.

RE-850: 48 original 6939 suffix cases recover round/blocked/global score clears, connected-client score resets, extra mode9 field304/308 resets, then connection2→1 after captured249007. A mid-call snapshot proves ordering; pending, phase, series flags and saved scores remain unchanged. Actual map/command children remain captured. Evidence.

RE-851: Rust matches 48 original normal-reset cases with separate pre-map score reset and post-map connection transition APIs. The adapter captures a no-op map child; production callers can apply its real mutations between stages. Safe count errors preserve state, and pending/phase/series data remain unchanged. Evidence.

RE-852: 144 original 277695/278138 cases recover tempEntity metadata, wrapped event kind+19, CVFI/CVIF origin snapping, trajectory/current-origin writes and link order. Five invalid float domains reject. Allocator flags424 and caller-owned84/140 are preserved; allocation277165 and native linking remain supplied/captured. Evidence.

RE-853: Rust matches 144 original temporary-event cases, including exact snap words, event-kind wrapping, metadata and preservation of allocator/caller fields. Five invalid source domains reject atomically in Rust. Allocation and native linking remain caller-owned; source class tokens require runtime metadata resolution. Evidence.

RE-854: 80 original 276433 cases recover nonzero active/class-pointer filtering, first match after cursor, scan limits and raw hash equality. Class text is never compared, so collisions return the first eligible hash match. Read-only world behavior is verified; unsafe pointers and native/runtime behavior remain open. Evidence.

RE-855: Rust matches 80 original class-hash search cases, including inactive/null class filtering, collisions, nonzero signed active values and cursors beyond the scan count. Bounded safe entity slices reject invalid cursors/counts; class text is intentionally not compared because the source does not compare it. Evidence.

RE-856: 150 original 276505 searches and 256 actual 69386 comparisons recover cursor/active/null-field filtering, ASCII folding, signed high-byte ordering, embedded NUL, nullable pointer order and zero-count behavior. Source calls the comparator with99999. Safe finite strings only; raw invalid pointers and runtime integration remain open. Evidence.

RE-857: Rust matches 150 original field searches and 256 comparator cases, preserving nullable ordering, signed high bytes, ASCII folding, embedded NUL and count gates. The API receives resolved logical fields with bounded entity/string sizes; raw pointer/offset ABI remains outside this safe contract. Evidence.

RE-858: 168 original 276586 cases compose actual 276505/69386 matching and actual36717 random state updates. At most32 matches are collected; random state advances exactly once only when matches exist, then selects by modulo. Five six-step RNG sequences and null/missing diagnostic paths are verified. Native initialization/world ownership remain open. Evidence.

RE-859: Rust matches 168 original target selections and five six-step RNG sequences. It preserves first32-match collection, actual xorshift word transitions, single conditional draw, modulo selection and null/missing diagnostic intentions. Native initialization, message rendering and live world ownership remain open. Evidence.

RE-860: 96 actual 62944 cases use corrected repeated child reentry and coherent full/partial alias memory, preserving staged f32 arithmetic and exact output words. All24 older fixtures are compared explicitly. atan2/sqrt remain supplied finite f32 math models; original native library bit parity is not established. Evidence.

RE-861: Rust matches 96 corrected source angle cases exactly through checked math transcripts. A separate host-math path is compared within four f32 ULPs, preserving source staging and signed-zero behavior. Safe nonfinite domains and stale math transcripts reject; original native atan2/sqrt bit parity remains unverified. Evidence.

RE-862: 96 continuous setup→placement cases now execute class-hash, field/string, capped random target, RNG and angle bodies on shared coherent world state, including collision/fallback/missing/self/capped target and client-indirection cases. Only fallback168114 and finite math responses remain supplied. Runtime/respawn integration and native math parity remain open. Evidence.

RE-863: Rust matches all96 composed source setup/placement fixtures across searches, actual RNG state transitions, checked angle-math transcripts and resolved player indirection. Fallible resolution stages RNG before committing it and performs placement only after success. Fallback selection and native math parity remain explicit boundaries; intermission/respawn/runtime integration is still open. Evidence.

RE-864: 112 original168114 cases execute actual class-hash search and RNG, recovering stable farthest-first insertion,64-entry cap, far-half draw at8+, first-class fallback when blocked, +9 Z and a no-spawn fatal boundary. Telefrag answers and finite sqrt remain supplied; collision/native/runtime parity is open. Evidence.

RE-865: Rust matches112 original fallback cases with checked distance-math responses, stable64-candidate cap, far-half random selection at8+, blocked first-class fallback and +9 Z. Safe no-spawn/domain errors preserve random state. Actual telefrag/collision tests, native math and runtime spawn ownership remain open. Evidence.

RE-866: 128 coherent setup→placement cases replace supplied fallback view writes with actual168114 selection, composing searches, capped distance ranking, RNG and angle execution. Existing intermission-camera paths and two player indirections are checked together. Telefrag answers and finite native math remain supplied; respawn/runtime integration is open. Evidence.

RE-867: Rust matches128 continuous source camera/fallback/placement cases with shared RNG state and checked native-math transcripts. The supplied fallback view has been replaced by recovered spawn ranking and +9 Z. Telefrag answers stay caller-owned; no-spawn errors preserve placement state. Native collision/math and runtime integration remain open. Evidence.

RE-868: 192 original122230 cases execute actual strlen and recover signed counter wrapping, threshold priority and refresh→optional filename callback/clear→reset order. Engine-5 refresh writes are supplied explicitly, including empty, NUL and high-byte filenames. Actual122143/121987 callbacks and native runtime ownership remain open. Evidence.

RE-869: Rust matches192 original rotation cases, preserving signed cursor wrap, enable/threshold gating, refreshed filename C-string handling and ordered refresh/write/clear/reset intentions. Engine refresh input is explicit; invalid refreshed data rejects before boundary mutations. Native callbacks remain unimplemented. Evidence.

RE-870: 90 original7188 cases compose actual strlen, bounded-copy wrapper and original formatter. A nonempty override mirror records current engine mapname in g_nextCycleMap, copies the override into a128-byte local map-name buffer (127-byte payload), requests engine g_NextMap clear and emits mode2 map command. VM mirror bytes remain unchanged; engine/native-copy and lower effects remain supplied/captured. Evidence.

RE-871: Rust matches90 original map-selection cases with empty/NUL mirror gates,127-byte engine-mapname truncation, raw non-UTF8 bytes, unchanged VM mirror and exact truncated-override mode2 map command text. The typed effect order matches source cvar/read/command requests. Engine callbacks, native copy and actual command dispatch remain outside the port. Evidence.

RE-872: 192 actual6939 normal-path cases compose recovered rotation, map selection, mode classification, copy and formatter bodies on shared state. Optional supplied249007 connection changes prove the final scan sees child mutations. Cvar/engine bytes, native copy and lower callback/runtime effects remain explicit boundaries. Evidence.

RE-873: Rust matches192 original normal6939 cases, staging rotation, override map-command intentions, global/client resets and post-callback connection changes atomically. The API refuses team-series inputs and invalid callback indices. VM mirrors/pending/series data remain source-faithful; native callbacks, engine refresh and runtime integration remain open. Evidence.

RE-874: 64 actual122143 cases recover a 64-slot bot population scan, wrapping (wins<<1)-loss converted to f32, strict positive best score and first-wins ties. Only the winner handle and unchanged filename pointer reach captured native -546. Zero/negative fitness means no write. Extreme counters exercise signed wrap and f32 precision. Native botlib serialization remains open. Evidence.

RE-875: Rust matches all64 original bot winner cases, with wrapping fitness arithmetic before f32 conversion, strict first-wins comparison and typed rejection of incomplete populations. Native botlib genome writes are returned as intentions, without assuming file serialization or runtime integration. Evidence.

RE-876: 64 actual121987 cases recover all64 native fitness words, supplied native -565 parent/child selection, ordered -566 interbreed and -567 mutation(handle,1.0), then zeroing both counters of currently active slots. A supplied selection callback activates slot63 to prove reset rereads live state after native calls. Selection algorithm and native genetic/file behavior remain open; invalid native indices are excluded. Evidence.

RE-877: Rust matches all64 actual121987 fitness/selection/interbreed/mutation/reset transcripts, including callback activation before the counter reset. API validates supplied indices before mutation and retains inactive counters. Native bot selection and genetic mutation are explicit answer/effect boundaries, not Rust implementations of botlib. Evidence.

RE-878: 72 actual249007 cases recover signed live client-count iteration and connected-state2 gating. Each accepted client calls246746 then246963 unconditionally; a supplied first-child disconnect does not suppress its second child, and activation of a later slot affects subsequent dispatch. This uses level count34992524, not max-clients cvar34089604. Child bodies, native effects and callback changes to count/base pointer remain open. Evidence.

RE-879: Rust matches all72 original249007 schedules and state snapshots, including disconnect-before-second-child and activation-before-later-scan cases. The bounded API accepts typed callbacks and validates the count before invoking them. Count/base remain stable; actual246746/246963 child bodies and engine integration remain open. Evidence.

RE-880: 32 actual167638 cases recover f32 origin-plus-six-source-bounds construction, native -33 box query with capacity1024 and returned-index iteration. Any entity with nonzero client pointer at offset520 blocks the spawn; other activity/health/team flags are not tested here. Covers duplicate indices, negative/zero query counts, signed/nonzero client words, f32 rounding and a client at result1024. Engine spatial query answers remain supplied; invalid engine counts/indices and nonfinite bounds are excluded. Evidence.

RE-881: Rust matches all32 original167638 box/query/filter cases, including the full1024-result scan and f32 rounding. The API separates box construction from supplied engine indices, rejects nonfinite/overflow bounds and malformed positive counts/indices, and tests client-pointer nonzero alone. Actual collision broadphase and integration into fallback selection remain open. Evidence.

RE-882: 96 actual122230 compositions execute actual122143/121987/36038 with shared population/cvar state. Engine refresh bytes and native genetic selection are supplied, while writes/interbreed/mutation are captured. Nonempty refreshed filename requests best-genome write before breeding; an empty filename still breeds and resets. Disabled/below-threshold paths preserve population. A supplied selection callback activates slot63 before reset. Native algorithm/file/engine/runtime parity remains open. Evidence.

RE-883: Rust matches all96 original122230/122143/121987 compositions, with staged counter/cvar changes and write-before-breed ordering. Winner selection uses pre-reset fitness; supplied activity changes affect reset only at the native selection boundary. Disabled/below-threshold paths preserve bot state. Invalid callback indices reject atomically. Native botlib algorithms, files and engine dispatch remain open. Evidence.

RE-884: 64 actual168114/167638 compositions replace supplied telefrag booleans with original query/filter execution. Native -33 spatial result lists are supplied, including empty/nonclient/blocked/mixed/duplicate results. Class filtering determines query order; accepted candidates then consume modeled sqrt before RNG, preserving64-cap and all-blocked/no-spawn behavior. Native broadphase, math and runtime ownership remain open. Evidence.

RE-885: Rust matches64 original168114/167638 compositions and their ordered box query transcripts. The typed spatial-query callback runs only after class filtering and before each candidate distance. Existing boolean-based callers retain behavior. Query/domain errors preserve RNG; native broadphase/math and external callback effects remain open. Evidence.

RE-886: 128 coherent6717/168114/167638/6575 cases execute box construction and client filtering inside camera fallback. Existing primary cameras issue no spatial queries; fallback class matches issue ordered native -33 requests. Result/view/player fields and checked math match the prior boolean-boundary fixtures. Native broadphase and math remain supplied; respawn and complete intermission/runtime remain open. Evidence.

RE-887: Rust matches128 original continuous camera/queried-fallback/placement cases, including exact query order and primary-camera bypass. Spatial callbacks use the same recovered box/filter policy as standalone fallback. Existing camera/spawn APIs retain their contracts; native broadphase/math and complete respawn/intermission remain open. Evidence.

RE-888: 60 actual246963 cases execute original70458/37914 integer formatting and70031/36038/69338 bounded concatenation. Five raw integers and four normalized booleans populate sessionN; sessIgnoreN follows entity client-pointer indirection, accepts flag exactly1, keeps duplicates, caps scan64 and truncates to127 bytes. Includes negative/oversized counts, two slots, INT_MIN formatter behavior and saturation. Native memset/strncpy are modeled and engine cvar writes captured; restore/engine persistence remain open. Evidence.

RE-889: Rust matches60 actual246963 byte-for-byte cvar fixtures, preserving recovered integer formatting, booleans, pointer-indirected duplicates,64-entry scan cap,127-byte saturation and original formatter-ring advance. Checked typed indices reject malformed inputs. Native cvar storage, session restore and runtime ownership remain open. Evidence.

RE-890: 64 continuous249007/246963 compositions execute session cvar serialization after the captured246746 child. Supplied first-child disconnection still allows persistence; later activation affects dispatch, and changed session fields are serialized immediately. Source formatter ring carries between clients. Native first-child behavior, engine cvars and count/base changes remain open. Evidence.

RE-891: Rust matches64 original249007/246963 compositions, including first-child disconnect/activation/field updates, exact cvar bytes and carried formatter-ring advance. Client changes stage atomically on typed callback errors. The first child and engine storage remain caller-owned; native effects and count/base mutation are outside this contract. Evidence.

RE-892: 64 actual6939 normal-path compositions execute122230/7188/249007/246963 and recovered formatter/string bodies on shared state. Distinct max-clients and level counts prove reset, persistence dispatch and final state2-to1 scan use their own bounds. First-child disconnect/activation/session-field effects are supplied and observed before persistence and final scan. Bot children, map-list fallback221662, first client child246746 and engine behavior remain explicit boundaries. Evidence.

RE-893: Rust matches64 continuous original6939/249007/246963 compositions. Independent max-clients/live-level bounds preserve score-reset, session-write and final connection-scan ordering; supplied first-child field/connection changes are staged with global/cvar intentions. Invalid counts reject without partial state commits. Native first child, bot/map-list callbacks and engine persistence remain open. Evidence.

RE-894: 96 actual70503 cases execute actual36038/69386, recovering optional leading separator, case-insensitive first-match keys, incomplete-pair rejection, empty values, embedded NUL and null-pointer early exits. Non-null calls XOR the two-buffer selector even on misses; null arguments preserve it. Oversized info fatal/aliasing/native userinfo retrieval remain open. Evidence.

RE-895: Rust matches96 original70503 key/value and selector cases, preserving first-match case folding, incomplete-pair rejection, empty values, embedded NUL and null early exits. Oversized logical inputs reject without changing the selector. Native userinfo retrieval, raw pointer aliases and fatal semantics remain open. Evidence.

RE-896: 72 actual38326/38355/37159/36779 cases recover comma-template numeric scanning with partial writes. Integer conversions accept leading digits only, including wrapping overflow; signs/leading spaces write0 without assignment. Floats use staged f32 accumulation, sign/whitespace and decimal scaling; lowercase e terminates the number. Literal mismatch returns-1 even after assignments. Empty/unparsed final fields still write0. Uppercase exponent, other scanf conversions and unsafe destinations remain open. Evidence.

RE-897: Rust matches72 actual38326/38355/37159/36779 cases, preserving digits-only integer entry, wrapping overflow, staged f32 decimal arithmetic, partial destination writes and literal-mismatch return-1. Caller supplies untouched destination words. Uppercase exponent, non-ASCII input and other scanf conversions reject; native ABI and complete scanner semantics remain open. Evidence.

RE-898: 96 actual246746 cases execute70503/69386/36038,70458/37914,70386 and float formatting. Mode9, enabled>=1, nonempty cl_guid and nonzero position gate file writes; angles alone do not. Mapname truncates63 bytes and GUID bytes pass into positions/map/GUID.pos without sanitization in this body. Open return is ignored; a nonzero supplied handle leads to exact float/name bytes, write then close. Engine buffers, native strncpy and file effects remain supplied/modeled/captured. Evidence.

RE-899: Rust matches96 original246746 cases with recovered userinfo, path construction and floating formatter bytes. Mode/enabled/position gates,63-byte map truncation, unsanitized GUID path bytes, ignored open return and write/close ordering are preserved. Typed unsupported format errors preserve the selector. Engine userinfo, native files and unsafe paths/ABI ownership remain open. Evidence.

RE-900: 96 actual246554 cases execute70503,70458/37914 and38326/38355/36779. A nonzero handle and signed length>0 with unsigned length<1023 permit reading. Exactly6 scanner assignments replace all position/angle words; malformed or truncated input preserves the original six words. Successful read paths close even after scan failure; zero/negative/oversized lengths return without a close in this body. Native file buffers/handles and real engine ownership remain supplied/captured. Evidence.

RE-901: Rust matches96 original246554 read cases, preserving mode/enabled/userinfo gating, strict1..1022 byte lengths, exact scan-result gating, all-six position updates and read/close order. Invalid-length exits retain the observed absence of close. Native file ownership and unsupported scanner domains remain open; this API returns intentions and supplied answers rather than performing file IO. Evidence.

RE-902: 144 actual247219 compositions execute original scanner, signed atoi, comma search, mode classifier and246554 load. Session scan result is ignored: partial fields and explicitly supplied caller-scratch words determine subsequent values; restored booleans use>0, with the final one also requiring team mode and flag1. Ignore tokens set in-range entries to1 without clearing old entries; invalid text maps to0. Actual saved-position load follows cvar restoration. Engine cvars/file bytes and initial scratch are supplied, not assumed initialized; native ownership and full reload integration remain open. Evidence.

RE-903: Rust matches144 actual247219/scanner/atoi/mode/position-load compositions, preserving ignored parse result, explicit caller scratch, positive-only booleans and final team/flag gate. Ignore entries accumulate without clearing and invalid numeric text addresses slot0. State and selector stage atomically on unsupported domains. Native cvars/files, real scratch provenance and full map reload remain open. Evidence.

RE-904: 96 actual247520 compositions execute team classification, userinfo lookup, bounded copy, saved-position load and session serialization. Team/default/capacity policy, wrapping timeout arithmetic, native tick snapshot, byte-only versus word clears,36-byte text initialization and64 ignored-client clears are recovered. Existing position fields persist unless the recovered load succeeds. Diagnostic7259 and engine/file operations remain captured/supplied; caller authentication and post-initialization behavior remain open. Evidence.

RE-905: Rust matches96 original247520 initialization/load/write cases, preserving raw byte/word clears, timeout wrapping, team/capacity selection,64 ignore clears and immediate session cvar bytes. Existing coordinates survive failed/suppressed loads. Engine clock/userinfo/files and diagnostic logging remain supplied/intended; caller behavior and native lifecycle remain open. Evidence.

RE-906: 48 actual249007/246746/246963 compositions execute both post-map children on shared state. Ordered native file intentions precede each client session/ignore cvar pair; mode/enabled/zero-position/open-handle gates, pointer-indirected ignore lists and shared formatter/userinfo selectors are verified. Connected-state filtering remains original. Engine userinfo/files/cvars and native copy remain supplied/modeled/captured. Evidence.

RE-907: Rust matches48 original249007 compositions with both actual saved-file and session-cvar children. Typed file/cvar actions preserve per-client order and shared selector/ring advances, and invalid domains preserve selector state. Native open answers remain supplied; no actual engine file/cvar dispatch or map reload is claimed. Evidence.

RE-908: 64 actual6939 normal transitions compose122230/7188/249007/246746/246963. File actions and per-client session writes occur between score/global resets and the final connection2-to1 scan; reset maximum and level count vary independently. Engine-map bytes are coherent across map-command and saved-file paths. Bot children, map-list fallback221662, native IO and actual command dispatch remain supplied/captured boundaries. Evidence.

RE-909: Rust matches64 original normal transitions with actual saved-file and cvar child policies. Shared client counts, score/reset ordering, native file intentions, command bytes and formatter/selector carry are preserved. Existing standalone persistence uses the same action assembly. Native engine dispatch, bot internals and map-list parsing remain open. Evidence.

RE-910: 144 finite original246746/246963/247219/246554 compositions feed actual captured cvar/file bytes into a fresh destination snapshot. Negative and INT_MIN integer formatting is deliberately not assumed invertible; original partial scanner writes and supplied scratch are preserved. Ignore entries accumulate over the destination table, and six-float file prefixes survive appended names. The engine is a supplied in-memory transcript, not a native filesystem or real map reload. Evidence.

RE-911: Rust matches144 original save/session-write/restore/read compositions using owned in-memory cvar/file bytes. Partial integer parsing and caller scratch preserve the observed non-invertibility of negative/INT_MIN session text; file prefixes and ignore accumulation remain exact. Engine/destination/selector changes stage atomically on errors. This adapter does not own native handles or perform OS file IO. Evidence.

RE-912: 96 bounded173979 caller-path executions cover174081..174173 after userinfo/authentication: entity-client linking, actual6336-byte clear via modeled native memset, connecting-state/client-slot writes and the first-time OR new-session choice between actual247520 initialization and247219 restore. Both children execute recovered load/format/scanner policies. Uppercase team S below capacity is not the lowercase s shortcut. Authentication before the slice, post-branch normalization and native engine integration remain open. Evidence.

RE-913: Rust matches96 bounded173979 caller paths, including client/entity initialization, first-time OR new-session dispatch, actual initialization/restore policies and saved-position loading. Client memory clear does not erase supplied caller scratch. Errors stage client/entity/selector changes. Authentication and later caller normalization, native IO and full client-connect acceptance remain open. Evidence.

RE-914: 256 actual36306 cases recover the word-at-a-time comparison used by admission/password filtering. Result is the exact unsigned-byte difference at the first mismatch, with NUL termination, case sensitivity, high bytes and all four synthetic pointer alignments checked. Guard bytes are explicit fixture memory; native pointer validity and aliases remain open. Evidence.

RE-915: Rust matches256 original36306 fixtures across alignment/case/NUL/high-byte domains, preserving the exact byte difference rather than only its sign. Typed logical strings reject oversized inputs. Raw word lookahead, invalid pointers and aliases remain outside the portable contract. Evidence.

RE-916: 270 actual252643/36306 cases recover exact localhost bypass, byte-wrapping components, permissive single-byte separators, colon termination and little-endian mask matching. Short/empty inputs preserve explicit prior scratch bytes; nonzero filter mode rejects matches and zero mode rejects misses. Signed negative table count skips scanning. This is the observed policy, not strict IP validation; parser scratch provenance, table writers and native network acceptance remain open. Evidence.

RE-917: Rust matches270 original252643 parser/filter cases, retaining byte wrapping, permissive separators, colon/localhost rules, supplied scratch bytes, signed table-count behavior and mode inversion. Malformed positive counts reject. Table population, native network behavior and actual scratch provenance remain open. Evidence.

RE-918: 160 actual173979 prefix cases execute userinfo70503, address252643, unsigned36306 and case-folded69386. Native userinfo is fetched first; nonzero bot flag bypasses address/password checks. Banned rejection precedes password lookup. Empty server password or case-insensitive none disables the final case-sensitive check. Rejections occur before client clear; exact messages, lookup order and selector carry are verified. Filter scratch, engine userinfo/password and native admission remain explicit boundaries. Evidence.

RE-919: Rust matches160 original173979 admission prefixes, preserving bot bypass, address-before-password rejection, none/empty server password behavior, exact case-sensitive password results, messages and userinfo selector order. Typed invalid domains preserve selector state. Native userinfo/filter population and complete caller acceptance remain open. Evidence.

RE-920: 144 actual173979 suffix cases execute original mode classification and broadcast formatting with explicit bot/userinfo answers. Team normalization precedes bot flags/admission; failed bots return after those mutations. First-time paths clear selected ranges and overwrite timeout without the initializer60-second default. Updated userinfo/name precedes broadcast and a second team decision; ranking is requested last. Bot, userinfo, join, ranking, logs/network and native memset remain supplied/captured/modeled boundaries. Evidence.

RE-921: Rust matches144 original173979 suffix cases with ordered bot admission, first-time clears, timeout wrapping, supplied userinfo changes, original broadcast bytes, team callback and ranking intentions. Bot rejection retains prior team/flag mutations. Native callbacks/logging/network/ranking and real caller acceptance remain open. Evidence.

RE-922: 96 complete173979 executions compose actual userinfo/address/password admission, native client-clear boundary,247520 initialization or247219 restore, team normalization and bot/callback completion. Ordinary authentication rejection preserves client/entity state; bot rejection occurs after lifecycle side effects. Initializer-persisted timeout can precede a first-time overwrite. Client-wide checksums, watched bytes, exact messages, cvar order and selector/formatter carry are verified. Native admission/userinfo/team/ranking/IO/network callbacks remain supplied/captured; this is not native multiplayer acceptance. Evidence.

RE-923: Rust matches96 complete173979 executions across admission, client clear, initialization/restore, bot admission and callback completion. Auth denial preserves client/entity state; bot denial retains lifecycle effects. Source messages, cvar timing, full-client checksums, raw watched bytes and selector/formatter carry match. Native callback bodies, actual network/IO acceptance and runtime integration remain open. Evidence.

RE-924: 288 actual161744 cases execute original userinfo lookup, bounded copy and37144/36779 float conversion. The292-byte setup record contains144-byte characterfile, raw f32 skill and144-byte team fields; logical strings truncate143 bytes and pad with NUL. Three lookups alternate the userinfo buffer selector. Supplied125185 setup result is normalized to0/1; zero requests native client drop with exact text. Actual bot setup125185, engine userinfo/drop and native strncpy remain supplied/captured/modeled boundaries. Evidence.

RE-925: Rust matches288 original161744 fixed-record and effect cases, preserving143-byte logical string caps, raw f32 skill, userinfo lookup order, restart forwarding and nonzero-result normalization. Typed unsupported skills preserve selector state. Actual125185 bot setup and engine userinfo/drop remain open. Evidence.

RE-926: 162 actual182896 cases execute original70458/37914 integer/string formatting and capture broadcast-18. Teams0/1/2 emit ccprint payloads with code5 and team number; team3 emits spectator text only when the previous team differs from3. Other values do nothing. The body does not mutate team selection. Raw name bytes, exact quote/newline framing and wrapping formatter counter are verified; native network delivery and other team-switch callbacks remain open. Evidence.

RE-927: Rust matches162 original182896 payload/counter cases, retaining exact ccprint/spectator framing, raw name bytes, previous-team suppression and wrapping formatter counter. It does not select or mutate teams. Native broadcast delivery and additional team-switch logic remain open. Evidence.

RE-928: 144 original173979 suffix cases execute actual161744 settings/drop wrapper and182896 announcement body instead of supplied bot booleans and captured team callback. Parent control/state remains source-identical; extra userinfo selector toggles, setup records, drops, exact announcement bytes and formatter carry are verified. Native125185 setup,171668 userinfo mutation, ranking/network/logging remain supplied/captured. Evidence.

RE-929: Rust matches144 original suffix compositions with actual161744/182896 policies, retaining caller mutations/messages while adding precise bot records, drop requests, announcement bytes and selector/counter carry. The wrapper stages typed errors and preserves ordinary rejection mutations. Native bot setup/userinfo/ranking/network/logging remain open. Evidence.

RE-930: 96 complete173979 executions replace supplied161744 booleans and captured182896 with actual bot settings/drop and announcement bodies. Parent decisions, client/entity bytes and persistence timing are preserved; setup records, exact broadcasts and extra selector/formatter carry are verified. Native125185 setup,171668 mutation, ranking/logging/network/IO remain supplied/captured. Evidence.

RE-931: Rust matches96 complete source173979/161744/182896 compositions, including settings/drop records, extra selector toggles and announcement/counter carry while preserving prior caller state, cvar timing and return decisions. Typed errors stage all caller state. Native setup/userinfo/ranking/network/IO remain explicit boundaries. Evidence.

RE-932: 132 actual252829/252304/37159 cases recover first-hole reuse, append/count growth,4096 capacity, wildcard/numeric masks, modulo-byte values and permissive separators. Parsing failure still returns outer success1, marks comparison-1 and preserves other fields; count growth is not rolled back. Successful insert sets metadata-1. Optional252500 export is requested even after parse failure; full-capacity refusal skips it. Full-table scans execute with a bounded262144-instruction budget. Table/export/network provenance and malformed counts remain open. Evidence.

RE-933: Rust matches132 original252829/252304 table cases including4096-capacity scans, first-hole reuse, wildcard/numeric masks and comparison-1 sentinel behavior. Parser failure retains count growth and requests optional export, matching the source. Typed malformed counts/token-overflow domains reject atomically. Export body252500, live table writers and native network acceptance remain open. Evidence.

RE-934: Actual252500 exports comparison bytes and signed metadata while ignoring masks. It skips comparison-1 rows, performs no IO for count zero, but truncates/writes an empty file for a nonempty all-hole table. Supplied zero/negative handles still reach write and close. The INT_MIN metadata case retains the original formatter wrapping-negation punctuation instead of host decimal output. Eighteen fixtures execute actual70386/37914/69338; native memory operations are modeled and file operations captured. Aggregate overflow and actual filesystem acceptance remain open. Evidence.

RE-935: Rust matches all18 original export cases, including mask loss, all-hole truncation, invalid handles and original INT_MIN formatter bytes. Empty tables produce no plan; other tables produce ordered print/open/write/close effects. A4096-row table is bounded by28 bytes per row, below the131072-byte source buffer; unit tests check that maximum and reject4097 rows. Native IO remains an adapter boundary. Evidence.

RE-936: Thirty actual253296 cases execute parser252304/37159, scan exact mask/comparison pairs and remove only the first duplicate by storing comparison-1. Mask/metadata/count remain unchanged. Parse failure and no match return0; successful removal prints Removed and requests export. A preexisting comparison-1 record can match255.255.255.255 and report successful removal again. Export is captured in this stage. Evidence.

RE-937: Rust matches all30 original removal cases, retaining first-match ordering, unchanged mask/metadata/count, repeated sentinel matches, parser diagnostics and conditional export requests. Unsupported token domains fail atomically. Unit tests cover duplicate preservation and unsupported input without mutation; native export remains captured at this stage. Evidence.

RE-938: Across180 actual252127 fixtures, parser252304/37159 precedes an exact mask/comparison scan; only the first match receives the supplied raw metadata word. Comparison/mask/count remain unchanged. Export is requested only after a successful match with a nonzero save argument. Invalid parse and missing match return0 with diagnostics. A comparison-1 sentinel can match and receive metadata without becoming active; timestamp interpretation and native callers remain open. Evidence.

RE-939: Rust matches180 original metadata-update cases, retaining the first exact pair, every unaffected row, raw metadata bits, parser/missing-match diagnostics and save gating. Unit tests verify negative save requests, duplicate preservation, sentinel matching and atomic rejection of unsupported tokens. Metadata is deliberately a raw word; native time/expiry interpretation remains open. Evidence.

RE-940: Twenty-four original252829/252304/252500 compositions verify table checksums plus exact export records and file-operation order. Parse failure still retains count growth and exports, including an empty write through a supplied zero handle. Valid broadcast sentinel values are skipped by export, and wildcard masks are lost in serialized output. Native file IO remains captured; insertion table/caller provenance remains open. Evidence.

RE-941: Rust matches24 source insertion/export compositions, including all table checksums, optional export payloads, sentinel omission, mask loss and zero-handle empty writes after parser failure. The staged API preserves ordinary source mutation semantics and rejects unsupported domains atomically. Unit tests also cover4096-capacity refusal without export and unsupported-token rollback. Native filesystem operations remain plans for a future adapter. Evidence.

RE-942: Thirty original253296/252304/252500 compositions verify first-match removal, retained row metadata/masks/count, diagnostics and exact survivor export bytes. A sole removed record leaves a nonzero count and therefore causes an empty file write. Duplicate survivors remain serialized in original order. Parse failures and misses never invoke export. Native console/file operations are captured; actual filesystem errors and reload semantics remain open. Evidence.

RE-943: Rust matches30 original removal/export compositions, retaining first-match mutation, duplicate survivor order, unchanged count and metadata, diagnostics, sentinel omission and empty writes after sole removal. A typed four-effect sequence exposes print/open/write/close in source order and retains raw supplied handles. Unit tests cover zero handles, duplicate survivor bytes, misses without IO and atomic unsupported-domain rejection. Native execution, reload and time/expiry semantics remain open. Evidence.

RE-944: Eighty-four actual251995/252024 conversion pairs recover wrapping day-of-year/hour/minute arithmetic, signed division and unchanged structure fields. The inverse stores computed hour modulo60 into the minute field, so normal minute values do not round trip. INT_MIN/MAX and negative fields are covered; calendar/year/native clock interpretation remains open. Evidence.

RE-945: Rust matches84 original conversion pairs using wrapping arithmetic and truncating signed division, retaining the inverse minute-field quirk and all unrelated structure words. Unit tests cover signed extremes, arithmetic wrap and unchanged sentinel fields. Native clock acquisition and calendar interpretation remain supplied boundaries. Evidence.

RE-946: Twelve actual252067 scans execute all4096 slots with actual251995 and supplied native time. Metadata other than-1 expires only when unsigned-less-than current minutes; equality is retained. Expiry changes comparison only, ignores and preserves active count, and never exports. Fixtures verify the last slot mutates even at count zero, permanent markers and high-bit timestamps. Calendar rollover and invocation cadence remain open. Evidence.

RE-947: Rust matches12 full4096-slot original scans and table-wide checksums. The API requires exactly4096 records and has no active-count parameter, preserving expiry beyond active rows. It retains masks/metadata, strict unsigned comparisons, permanent-1 and no-export behavior. Unit tests cover high-bit/equality/permanent gates, last-slot mutation and atomic rejection of incomplete storage. Evidence.

RE-948: Thirty-two original252933 fixtures compose actual insertion/metadata/parser/search/integer children. Loading retains the old count, splits on LF, skips zero/one-byte lines, accepts a final unterminated line and truncates callback text at NUL. It reads/closes even supplied zero or missing-file handles. Partial reads expose explicit initial bytes. Metadata updates the first matching prior row rather than a newly inserted duplicate. Native filesystem, long lines and arbitrary negative lengths remain open. Evidence.

RE-949: Rust matches32 original loader compositions, preserving active count, first-prior-match metadata routing, short-read buffer provenance, NUL/line handling and unconditional read/close effects. The staged API accepts explicit declared length, delivered bytes, initial buffer and raw handle. It rejects unsafe negative lengths, overlong lines/tokens and insufficient table storage atomically. Unit tests cover duplicates, missing-file replies, stale partial reads and rollback after an unsupported later line. Evidence.

RE-950: Eighty actual252213 fixtures compose integer/time/metadata children, preserving wrapping duration-plus-current-minute arithmetic, exact first-match metadata writes and save requests. Empty arguments emit exact console or client usage without clock/update calls; client formatting advances and wraps the ring. Negative/overflowing duration prefixes are retained. Native clock/calendar semantics, sends and export execution remain explicit boundaries. Evidence.

RE-951: Rust matches80 original duration/usage command fixtures, preserving wrapping numeric prefixes, first-match metadata save requests, exact client/console text and formatter-counter wrap. Typed effects preserve time-before-update order; usage skips both. Unit tests cover client-only ring changes, negative duration producing permanent-1 metadata, duplicate preservation and atomic unsupported-address rejection. Native replies remain supplied or captured. Evidence.

RE-952: Twenty-four actual export/reload compositions transfer captured file bytes through explicit native replies. Empty-table export leaves the prior file intact, whereas all-hole export truncates. Reload loses masks, converts the original INT_MIN formatter punctuation to metadata0, routes duplicate updates to the first match and grows retained tables. Source formatter/parser/load bodies execute; actual filesystem acceptance and unlimited reload/capacity remain open. Evidence.

RE-953: Rust matches24 original export/reload compositions, retaining stale prior files when export is absent, all-hole truncation, wildcard-mask loss, INT_MIN metadata reload as0, duplicate routing and retained-table growth. The staged loader rejects unsupported domains without mutation. Unit tests cover these losses, duplicate growth and atomic unsupported prior-file rejection. Captured write bytes are supplied as read replies; actual filesystem acceptance remains open. Evidence.

RE-954: Ninety-six actual253100 wrappers recover length-under3 client-number routing, active-slot gating, supplied1024-byte userinfo and actual70503 ip lookup, insertion and exact usage/kick formatting. Non-numeric short input can select slot0. A clientkick command is queued even after missing-ip insertion failure. Selector and formatter wraps, invalid slots and direct masks are verified; exports and native effects remain captured. Evidence.

RE-955: Rust matches96 original add-filter command cases, retaining short-input numeric routing, active-slot/userinfo gates, selector toggles, exact usage/kick text and formatter wrap. Missing IP insertion failures still queue clientkick; an extra unit test verifies full-table refusal also queues a kick. Unsupported domains reject atomically. Native userinfo, queued commands, network and export remain captured plans. Evidence.

RE-956: Twenty-four actual253245 wrappers compose actual253296 removal and source client-usage formatting. Empty input emits exact console/client usage and skips mutation; client usage wraps the formatter ring. Nonempty input retains first-match duplicate/sentinel behavior, count, diagnostics and conditional export requests. Userinfo selector remains untouched. Native sends/console and export requests are captured. Evidence.

RE-957: Rust matches24 original removal-wrapper cases, preserving exact client/console usage, formatter wrap, first-match duplicate/sentinel mutations, child diagnostics and conditional export. The API leaves caller table length and userinfo selector ownership untouched. Unit tests cover empty-input child suppression, duplicate metadata retention, ordinary parser failure and atomic unsupported-token rejection. Native effects remain captured plans. Evidence.

RE-958: Eighty actual252213/252127/252500 compositions resolve the prior captured export request into source-generated bytes and ordered print/open/write/close effects. Duplicate metadata updates only the first row, then export serializes both rows in order. Usage, invalid parsing and absent matches skip export. Supplied zero handles still reach write/close; time/network/file execution remains captured or supplied. Evidence.

RE-959: Rust matches80 original duration/update/export compositions, deriving exact file payloads and typed effects from a successful metadata save request. Duplicate order, zero handles, usage/miss export suppression and formatter counters are retained. Unit tests cover first-row update with two-row export and atomic unsupported-domain rejection. Native time/file/network execution remains supplied or captured. Evidence.

RE-960: Forty-eight original252067/252643 compositions cover4096-slot expiry and address scans through the last entry, mode inversion, localhost bypass and explicit scratch. After the first match expires, a live last-slot match still rejects in blacklist mode. Comparison-1 holes remain eligible for mask matching and can reject broadcast addresses. Active count and all table checksums are verified; native time and live network acceptance remain supplied/open. Evidence.

RE-961: Rust matches48 original full-table expiry/admission cases and all table checksums. The address helper now accepts the actual4096-entry capacity, including last-slot matches, and rejects4097. Expiry writes persist on ordinary rejection; typed errors remain atomic. Unit tests cover last-slot survival, broadcast matching an expired hole, capacity bounds and unsupported-address rollback. Native time/network acceptance remains supplied/open. Evidence.

RE-962: Forty actual150692 prefix executions through150791 compose source65613 squared horizontal motion and252067 full-table expiry. Strict elapsed>3000 and square>100 gate activity, z is discarded, entity bit64 copies to the client flag, and the timer wraps. Every prefix invocation reaches expiry regardless of movement gates/count. Direct sites place loader252933 at3924 inside3877 and expiry252067 at150789 inside150692. Whole callback/cadence and native runtime remain open. Evidence.

RE-963: Rust matches40 original frame-prefix cases, retaining squared horizontal motion, strict elapsed/square gates, ignored z, source bit64 copy, wrapping accumulation and unconditional full-table expiry. Unit tests cover ignored NaN z, equality, tick wrap and atomic rejection of unsupported horizontal values/incomplete storage. This ports only150692..150791; full callback/caller cadence and native runtime remain open. Evidence.

RE-964: A144-case source contract executes disjoint150791..150810 and151085..151131 fragments. Entity cooldown multiplication/addition wraps before signed comparison; exact equality preserves flags. Client bit2 clears only after a strict deadline, unrelated bits and deadline/stamp words survive, and elapsed-total accumulation wraps. Intervening loop and native scheduling remain outside this fragment contract. Evidence.

RE-965: Rust matches144 original terminal-fragment cases, preserving wrapping cooldown arithmetic before signed comparisons, strict equality behavior, unrelated flag bits and elapsed-total wrap. Separate pre-loop and post-loop APIs allow later composition in original order. Unit tests cover equal/expired deadlines and signed overflow; this contract does not execute the intervening timer loop or native scheduling. Evidence.

RE-966: A288-case source loop contract covers signed residual thresholds, wrapping phase increments and signed remainder with rates0/1/2/5. Rate0 reads preceding word1120403456 instead of a zero divisor. Flag256 plus positive supplied health and phase0 request damage1, means23 and caller weapon/owner pointers. Damage effects remain captured and flag512 is disabled in this stage; health mutation and other branches remain open. Evidence.

RE-967: Rust matches288 original tick-loop cases with signed residual/remainder and wrapping phase behavior. Rate0 retains the preceding-word divisor1120403456. Typed damage requests retain all source arguments without mutating supplied health. Unit tests cover alias behavior, signed wrap, exact request ABI and atomic invalid-rate rejection. Flag512 is deliberately outside this first loop subset; the residual budget bounds execution. Evidence.

RE-968: A216-case source contract extends the tick loop through flags512/256/128 and f32 subtraction of0.1. Crossing zero resets flag256/rate/timer but delays secondary flag128/status cleanup until a later tick; initially nonpositive timers can clear immediately. Reset rate0 changes later modulo through the preceding-word alias. Damage stays captured and health supplied; nonfinite/unsafe table domains remain open. Evidence.

RE-969: Rust matches216 original full-loop cases with repeated f32 subtraction, delayed secondary cleanup, raw flag/status preservation and rate0 divisor switching. The existing tick API now supports flag512 through these recovered branches. Unit tests cover countdown crossing versus initial nonpositive cleanup and atomic nonfinite rejection; damage effects remain requests against supplied health. Evidence.

RE-970: Sixteen original150692 executions compose the previously separate motion/expiry prefix, entity cooldown, full100ms loop and terminal counters through the void-return boundary. The same residual word receives msec before loop consumption; native time precedes captured damage requests. All persistent fields and4096-row checksums agree with independent composition. Source math/expiry children execute, but native clock and health mutation remain supplied/captured; full caller154089 remains open. Evidence.

RE-971: Rust matches16 whole original timer cases, composing the shared residual, source prefix/expiry, cooldown, full float/phase loop and terminal counters in order. Typed time/damage records preserve source event order; all persistent fields and4096-row checksums match. Unit tests cover combined wrap/cleanup/expiry and rollback of prefix/table writes after unsupported loop input. Native time/health execution and full caller remain outside this supplied/captured contract. Evidence.

RE-972: Ninety-six original154089-prefix cases recover connection-word gating, original command timestamp copies, command-time bounds, signed delta calculation/cap and the word3108==2 exception for nonpositive deltas. Optional8ms rounding occurs after the delta and does not recompute it. Execution stops at154210 or the verified early-return boundary155716; intervening caller processing and dispatch155714 are not skipped or claimed recovered. Evidence.

RE-973: Rust matches96 original caller-prefix cases, preserving connection-word gating, pre-clamp timestamp copies, signed wrapping bounds, the nonpositive-delta exception,200ms cap and post-delta8ms rounding. Unit tests cover unchanged disconnected state, retained pre-round delta, negative exception deltas and sequential bounds at signed wrap. The remaining caller body and actual timer dispatch are explicitly unrecovered. Evidence.

RE-974: Sixteen source154210-prefix paths recover intermission precedence, team3/follow gates and spectator-word3 callback suppression. Normal paths stop at154256; routed paths stop at the original early return155716. Callback151133/149671 effects remain captured, with their client/command inputs recorded. Later command and movement processing are outside this first contract. Evidence.

RE-975: Rust matches16 source routing cases, preserving intermission precedence and spectator callback suppression. Typed effects carry source slot/command-time inputs and keep actual callback bodies outside this contract. Unit tests cover outer-gate precedence and spectator-word suppression without conflating normal clients with routed ones. Evidence.

RE-976: Forty-eight source command-rewrite cases recover pause-mask1 and mode10/client-mask16 locking, saved-angle restore versus update, and independent server override. Clearing bytes493..495 preserves the low byte492 and command timestamp; buttons clear separately. Other pause bits alone do not trigger this lock. Native later movement execution remains outside this fragment. Evidence.

RE-977: Rust matches48 source command rewrites, retaining pause-mask1 selection, mode10/client-mask16 locking, saved-angle direction and independent server masking. The low adjacent command byte survives clearing movement bytes, and command time is not modified by this API. Unit tests cover non-locking pause bits, angle restore/save order and low-byte preservation. Evidence.

RE-978: A120-case source contract executes actual150382 through all bounded policy branches: protected entities, disabled config, pause anchoring, signed movement bytes/attack, dead-client deadline extension, exemptions, warnings and timeout. Word arithmetic wraps before signed comparisons. Mode1 requests callback183102 with team string s, then a message; other modes request a drop. Native effects remain captured; source deadline/warning fields and supplied health are verified. Evidence.

RE-979: Rust matches120 original inactivity cases, including signed wrap, pause anchoring, negative movement bytes, warning suppression, strict deadlines and mode-specific effect order. Dead-client extension precedes exemption, and activity clears warning state without shortening a later deadline. Unit tests cover warning equality/repetition, team-before-message ordering, pause bits and wrapped extension. Native callbacks remain captured plans. Evidence.

RE-980: Ninety-six source setup cases recover movement-type precedence, pause-mask1 handling, finite gravity multiplication/truncation and unpaused speed220. A present controller is consumed only on unpaused paths. Packed words use raw shift/OR without byte masking, and the old event sequence is saved. Execution stops at154544 before scratch initialization and later callbacks; actual movement remains open. Evidence.

RE-981: Rust matches96 original movement-setup cases, preserving type precedence, pause-mask1 behavior, f32 multiplication/truncation, controller consumption and unmasked packed words. Unsupported unpaused float/conversion domains reject atomically; the paused path ignores unused float inputs. Unit tests cover negative truncation, high-bit packing, controller retention and rollback. Actual movement callbacks remain open. Evidence.

RE-982: Forty-eight source154089 executions compose preparation, routing, rewritten inputs, actual inactivity and movement setup through154544. Blocking movement can turn an otherwise active command into a timeout; early exits retain preceding timestamp/command mutations. Inactivity receives the pre-round delta, including the allowed negative exception. Native routing/team/send/drop effects remain captured; scratch setup and actual movement are beyond the boundary. Evidence.

RE-983: Rust matches48 original pre-movement executions, composing shared timing/spectator state, command masking, actual inactivity policy and finite movement setup. Ordinary early exits commit preceding writes; unsupported typed domains stage all state and effects atomically. Unit tests verify blocked-activity timeout, pre-round delta forwarding, timestamp persistence on routing and rollback after a late float error. Captured callbacks and later physics remain open. Evidence.

RE-984: Twelve original-QVM probes recover a 268-byte zero fill at frame+56, preserving four-byte guards on both sides. Mode10 requests152792 then152673; mode8 requests153419; other modes request neither. Zeroing precedes callbacks. Native memset is modeled with coherent byte writes; callback bodies and their state feedback remain unresolved. Evidence.

RE-985: Rust owns an exact268-byte scratch slice and returns ordered zero/mode-callback plans. Twelve source/Rust fixtures compare every scratch word, guards and callback order. Invalid client slots reject before mutation; slice ownership prevents overwriting neighboring frame words. Callback execution and feedback are deliberately left to a future native adapter. Evidence.

RE-986: 90 original-QVM fixtures recover live/non-following client mask2 suppression. Forward/right command bytes clear; positive signed up input clears, while zero and negative up values survive. Buttons, angles, timestamp and adjacent low byte survive. The rewritten24-byte command is then copied into scratch and the client pointer bound. Dead clients, followers and absent mask2 bypass suppression. Evidence.

RE-987: Rust snapshots six raw command words after source-backed suppression, retaining negative up bytes and all unrelated command words. Ninety source/Rust fixtures compare both the mutated command and scratch copy. Unit cases cover signed byte boundaries, neighboring button preservation and dead/follow/other-mask bypasses. The typed return represents binding to the supplied client rather than a raw address. Evidence.

RE-988: Forty source probes recover mask precedence and execute actual151954 overlap checks. Movement-type3 bypasses links and selects65537; overlapping live type0 linked entities select the same mask. Failed overlap clears both link words and selects33619969. Unlinked entity mask8 selects37814273 before mode9/nonzero client3704 selects67174401. The helper uses strict lower-X versus upper-X overlap, inclusive remaining comparisons, positive entity health and movement-type0 on both clients; boundary fixtures expose this asymmetry. Evidence.

RE-989: Rust ports the actual linked overlap conditions and mask precedence across forty source/Rust cases. Failed overlap clears both supplied link states before returning the default mask; movement-type3 bypasses overlap entirely. Finite f32 bounds/sums are validated before mutation. Unit tests cover asymmetric touching faces, flag precedence, reciprocal cleanup, nonfinite rollback and bypassing unused invalid geometry. Native collision traces remain outside this policy. Evidence.

RE-990: 108 original-QVM cases recover callback words -25/-26, raw debug/quantize/option fields, boolean bot/entity-mask8 flags and pause-mask1 selection. Two exact12-byte copies preserve origin into client4072 and client152 into frame336. High-bit and NaN payload words are copied unchanged; no float arithmetic is performed. Four neighboring sentinels survive. Stop154867 precedes movement54475, so native collision callbacks and physics are not executed. Evidence.

RE-991: Rust constructs a typed movement context with original callback ABI identifiers, boolean bot/entity/pause fields and unnormalized configuration words. Raw origin/vector snapshots retain sign bits and NaN payloads without conversion.108 source/Rust fixtures compare every field and copy; typed arrays own copy boundaries. Native trace/contents adapters and movement54475 execution remain open. Evidence.

RE-992: Thirty coherent original-QVM probes compose scratch clearing, ordered mode callbacks, input suppression, command snapshot, actual linked overlap/mask selection and native context/vector assembly. Supplied callback feedback changes client health/follow/mask/type before later consumers; it is applied only when the corresponding mode callback runs. Failed overlap clears links before physics. Modes0/8/10, signed up input, callback feedback, paused state and failed links are covered. Callback bodies remain captured and supplied feedback is not evidence of their actual behavior. Execution stops before54475. Evidence.

RE-993: Rust stages the complete movement-setup plan, applies pure supplied callback feedback in original order, then suppresses/snapshots commands, resolves linked masks and assembles context/vectors. Thirty source/Rust cases compare all projected state and ordered effects. Unit tests verify feedback changes later decisions, no callback runs in mode0, failed geometry or feedback rejects without committing state, and prior snapshots update on success. No native IO or actual physics executes. Evidence.

RE-984–993 batch validation passed:1,918 Python tests,289 Rust tests,116 deterministic affected producers and568 documentation files. All ten tasks have individual focused validation and commits. Batch scope and remaining runtime work.

RE-994: 90 original-QVM fixtures execute152386: signed integer meter converts to f32, adds carry, truncates and clamps below zero; carry clears. At32000 or greater the meter resets, client mask16384 and flag104 mask16 clear, and movement type becomes0. Melt completion requests event107 then log; assisted completion requests score/recipient reset, event108 then log. The supplied event receives owner168 and mask32. Optional receiver meter mirroring runs after completion. Nested score/recipient reset effects remain captured. Evidence.

RE-995: Rust ports meter f32 conversion, truncation, clamping, completion masks, event ownership and optional receiver mirroring across ninety source cases. Completion effects preserve source ordering. Nonfinite/out-of-range conversion, invalid client indices and assisted completion without a receiver reject before state mutation. Teleport/reset/log/event allocation remain effect plans and supplied event state rather than native execution. Evidence.

RE-996: Thirty-six original-QVM cases execute152673 with actual meter child152386. Entity/client existence, mode10, connection2, positive signed health, zero follow and client mask16384 gate processing. Progress uses staged f32 operations32000/(seconds*1000)*signed wrapped elapsed, adds carry, advances clock6324, then runs self-melt completion. Negative elapsed/duration, wrapped ticks, fractional carry and all admission exits are covered. Early exits preserve clock and carry; event/log effects remain captured. Evidence.

RE-997: Rust ports actual self-recovery gates, wrapped signed elapsed time, staged f32 progress and the meter child across36 source cases. Admission exits preserve state without reading unused float configuration. Active invalid duration, nonfinite progress or unsupported conversion reject without advancing clock or committing meter/event changes. Unit tests cover wrapped elapsed time, inactive NaN preservation and late-error rollback. Evidence.

RE-998: Twenty-eight original-QVM fixtures recover152792 admission and its first entity-pool scan through152994. Protected self mask16384 clears own assistance mask8192, active6316 and target6320, then returns. Otherwise active helpers lose those fields when their target disconnects, dies or follows; healthy targets retain assistance. Loop order, zero/64 counts, absent entity/client, high-bit preservation and all self admission exits are covered. The subsequent distance/assistance search remains outside this boundary. Evidence.

RE-999: Rust ports152792 admission and first scan across28 original cases, including full64-slot and zero-count pools. Typed indices replace supplied entity/client pointers; inactive targets are not dereferenced. Protected self returns before scanning, preserving other helpers. Dead/disconnected/following targets clear only assistance mask8192, active state and target. Invalid active indices/counts reject atomically; unit tests cover high-bit preservation, early bypass and rollback after a prior planned cleanup. Evidence.

RE-1000: Sixty-six original-QVM cases recover153419 admission through153596. Both global enables, strict signed wrapped elapsed greater than delay*1000, incomplete state, connected/live/non-following self and selected team are required. Selector exactly1 chooses team2; other values choose team1. A live connected non-following teammate with nonzero6164 blocks entry, while self is excluded. All fields remain unchanged. Exact/negative/wrapped times, three selectors, zero/64 pools and teammate bypasses are covered; flag search and objective effects remain open. Evidence.

RE-1001: Rust ports the read-only mode8 eligibility boundary across66 original cases. Time comparisons wrap as signed words; selector exactly1 chooses team2. Typed teammate scanning excludes self and requires connected/live/non-following same-team busy state before blocking. Counts and indices reject explicitly when used. Unit tests cover strict timing, selector2, self exclusion, inactive teammates and input immutability. Objective search and mutation remain unimplemented. Evidence.

RE-1002: Twenty-four coherent source probes replace supplied mode10 feedback with actual152792,152673 and152386 while executing movement setup through154867 and actual overlap151954. Assistance pool count is zero, so the unresolved proximity search does not execute. Protected self clears assistance before timed recovery; thaw completion changes movement type/masks before command suppression and collision-mask selection. Clock/carry, command snapshots, links, native context and vector copies are checked together. Nested native effects remain captured; no mode8 objective or actual physics executes. Evidence.

RE-1003: Rust replaces supplied mode10 feedback with recovered assistance cleanup and timed self-recovery before movement setup. Twenty-four source/Rust cases compare meter/clock, assistance, masks, commands, links, context, vectors and captured effects. The assistance pool is explicitly empty. Shared flags/movement views must agree; all state and effect plans stage atomically, including late geometry errors after completion. Native nested effects, nonempty proximity search and physics remain open. Evidence.

RE-994–1003 batch validation passed:1,938 Python tests,299 Rust tests,121 deterministic affected report producers and579 documentation files. All ten tasks have separate commits and focused checks. Batch evidence and remaining callback/runtime work.

RE-1004: Thirty-six original-QVM cases recover assistance acquisition after near/protected-target routing. A helper already holding mask8192 and nonzero active6316 cannot switch away from a different target6320. Otherwise acquisition sets mask8192, active1, target and clock6328, then requests event104 with target entity word0 followed by the source thaw-start log. Raw high bits and wrapped tick values survive; event/log bodies and preceding distance/admission gates are excluded. Evidence.

RE-1005: Rust ports the conditional assistance ownership lock across36 source cases. Typed target indices preserve stale-state behavior, raw flag bits and wrapped clocks. Event104 precedes the original source log; both remain plans. Unit tests cover locked switching, inactive stale-target replacement, event ordering and atomic invalid-target rejection. Caller admission and proximity selection remain separate. Evidence.

RE-1006: Seventy-two source cases recover both cancellation branches. Only a helper with mask8192, nonzero active state and matching target loses assistance: mask8192 clears, active becomes0 and target becomes null. Clock6328 and unrelated bits survive. Both far and no-longer-protected paths request event105 with parameter0xffffffff; unmatched or incomplete ownership is untouched. Native event publication remains captured. Evidence.

RE-1007: Rust matches both original cancellation branches across72 source cases. Matching flagged active ownership clears only assistance state and emits event105; repeated cancellation is silent. Clocks and high bits survive, mismatched targets remain intact, and invalid indices reject before mutation. Native publication remains an explicit effect plan. Evidence.

RE-1008: Twenty-four original-QVM cases execute staged f32 progress using34062368 and helper clock6328, then actual152386 on the target with helper meter mirroring. Negative/wrapped elapsed time, signed duration, fractional carry, precision and threshold completion are covered. Assisted completion orders score/recipient reset/event108/log and mirrors zero to the helper. Helper clock advances after the target child; ownership remains until later cancellation. Native nested effects remain captured or supplied. Evidence.

RE-1009: Rust matches24 assisted progress cases, including f32 rounding, negative/wrapped elapsed time and completion. Target meter completion mirrors its result to the helper and preserves original nested effect order. Clock and target updates stage together, so invalid duration or late conversion errors leave both unchanged. Unit cases verify wrapped416-unit progress, zero mirroring at completion and rollback. Evidence.

RE-1010: Sixty coherent original-QVM cases execute complete152792 with actual distance65655 and target-meter152386. Admission, cleanup, ascending candidate order, same-team/live/follow filtering, strict distance below75, ownership, acquisition/progress/cancellation and target completion are checked together. Fixtures include two competing targets, exact radius, 64-slot pools, early exits, negative/wrapped progress and stale state. Distance sqrt is modeled; publication/native completion effects remain captured or supplied. Evidence.

RE-1011: Rust composes recovered admission/cleanup, finite f32 distance, acquisition/cancellation and actual target meter policies across60 complete source cases. Candidate order and strict radius75 are preserved; typed identity and shared flags are validated. All clients and effects stage atomically, including a late invalid distance after an earlier acquisition. Tests cover radius/order, ownership retention and rollback. Native completion/publication effects remain plans. Evidence.

RE-1012: Twenty five-call source scenarios preserve one coherent memory state across acquisition, progress, thaw completion and later cancellation/reacquisition. Competing target order, wrapped ticks, positive/negative duration and64-slot traversal are checked across100 complete callback executions. Reports compare every client word, distance, event request and allocated event state at each call. Native score/recipient reset/publication/log effects remain captured; the broader frame scheduler and self-recovery callback are excluded. Evidence.

RE-1013: Rust replays five recovered callback calls across20 source scenarios, comparing all100 state/effect snapshots. Acquisition, progress, completion, cancellation and target reacquisition preserve source order and clocks. Replay stores immutable snapshots and stages the batch on typed errors; unit tests verify exactly-on-transition requests and rollback when invalid duration becomes active only on a later call. Native IO and frame scheduling remain excluded. Evidence.

RE-1004–1013 batch validation passed:1,958 Python tests,309 Rust tests,126 deterministic affected producers and590 documentation files. All ten tasks have separate commits and focused checks. Assistance evidence and next work.

RE-1014: Seventy-two original-QVM probes recover defuse start after near/eligible routing. Mask32 clears masks32/64 and stores animation148=2; different low-byte weapon kinds do not change this projected outcome. Begin stores shared clock35000484, busy6164=1, client mask4 and flag104 mask16, then allocates event83 with configured duration and mask32 before requesting sound7. Weapon word and neighboring event fields remain unchanged. Native allocation/sound and caller gates are excluded. Evidence.

RE-1015: Rust ports start-state masks, animation selection, shared clock, duration payload and event83-before-sound7 ordering across72 source cases. Raw weapon/duration/tick words remain bit-exact. Typed weapon/client indices reject before mutation; unit tests distinguish flag32 from flag64-only behavior and preserve neighboring fields by ownership. Native allocation and sound remain effect plans. Evidence.

RE-1016: Forty-eight original-QVM cases compare far-target and unflagged cancellation. Any nonzero busy6164 clears busy, shared clock35000484, client mask4 and flag104 mask16, then allocates event84 with payload0 and event mask32. Zero busy leaves all fields unchanged, even stale flags or clock. Weapon/animation and unrelated bits survive. Both branches match; native event allocation and caller routing remain excluded. Evidence.

RE-1017: Rust matches48 far/unflagged cancellation cases. Any nonzero busy state clears the shared clock and owned flags and emits event84 payload0; inactive stale state remains untouched. Weapon/animation words and unrelated bits survive. Unit tests verify idempotence, nonzero high-bit busy values, inactive unused-index preservation and active error atomicity. Native allocation remains a plan. Evidence.

RE-1018: Thirty-two source cases recover active completion when signed wrapped elapsed reaches duration*1000, including equality, negative duration and overflow. Waiting preserves every field. Completion logs first, latches35000396=1, clears clock/busy and owned flags, allocates event84 payload1 with mask32, then requests score update205260 and counter283463 index5. Weapon/animation and neighboring event fields survive. Native nested effects remain captured or supplied. Evidence.

RE-1019: Rust matches32 active source completion cases with signed wrapped elapsed/duration arithmetic and equality completion. The original log/event84/score/counter order is preserved as plans. Inactive selected state reuses start policy; waiting avoids unused index evaluation, while ready invalid client indices reject before mutation. Unit cases cover exact and wrapped completion, high-bit preservation and waiting/error atomicity. Evidence.

RE-1020: Ninety-six source scenarios connect original admission/teammate scan to actual276433 bomb hash lookup and65655 distance, then start/wait/cancel/complete transitions. Three selectors, radius75 equality, zero/64 teammate counts, inactive/classless/hash-mismatched decoys, wrapped time, completed latch and missing bomb are covered. Missing lookup stops before original2319 fatal handler. Native sqrt is modeled; event/native effect feedback is captured or supplied, not executed. Evidence.

RE-1021: Rust composes verified eligibility, first eligible bomb hash lookup, finite f32 distance and start/cancel/finish across96 source cases. Missing bomb returns the source fatal boundary diagnostic without inventing subsequent behavior. Radius equality does not start defusing; decoy identity and selector semantics match source. State and effect plans stage before commit, with missing/invalid geometry unit tests preserving prior state. Native effects remain captured plans. Evidence.

RE-1022: Thirty coherent source scenarios replay up to five complete callbacks, producing138 snapshots. Scripted motion, held-button changes and teammate release test cancellation/restart; shared state persists through waiting and exact completion. Completed latch prevents repeated allocation/log/award. Missing-bomb boundary stops after one call. Actual lookup/distance bodies execute, while native effect feedback and scheduling remain modeled/captured inputs. Evidence.

RE-1023: Rust matches138 source snapshots across30 scripted sequences. Motion/button/teammate inputs apply before each call, while clock/flags/event state persist. Completion latch suppresses duplicate reward requests and missing-bomb diagnostic ends replay. Bounded typed replay stages all updates and snapshots on errors; tests verify exactly one reward, fatal-boundary stop and rollback after a prior successful start. Native effects and frame scheduling remain outside scope. Evidence.

RE-1014–1023 batch validation passed:1,978 Python tests,319 Rust tests,131 deterministic affected producers and601 documentation files. All ten tasks have separate commits and focused checks. Defuse evidence and next work.

RE-1024: Twelve original-QVM cases prove283463 increments exactly client3036+4*index by1 with word wrapping; the supplied5 is a counter index, not a five-point score delta. Source205260 was already recovered as score update, and193620 emits team radio commands. Earlier defuse/assistance capture labels score/counter/sound were misleading historical names. Counter guards and unrelated words survive. New findings use numeric IDs and corrected semantics; historical report schemas remain compatible. Evidence.

RE-1025: Rust implements caller-indexed wrapping counter increments across12 source cases. Index5 increases one word by1, not five score points; invalid indices preserve the supplied window. Historical enum/report tags remain compatible but now carry explicit score/radio/counter semantic corrections. True counter-enum ownership and larger state lifecycle remain open. Evidence.

RE-1026: Thirty-four original-QVM scenarios recover193620 with actual mode classifier33715. Live non-following non-spectator sender obtains supplied location text, then sends rsay sender/-1/type/text to connected same-team recipients in team modes or mode9. Mode11 and signed negative modes do not route. Sender marker84 becomes tick+3500 and marker204 becomes1 only when a command is sent. Empty/quoted payloads, failed text lookup, zero/64 counts and wrap are covered. Native sending and location lookup remain boundaries; fixed formatter is modeled. Evidence.

RE-1027: Rust matches34 source team-radio scenarios, including the mode9 exception, mode11/signed exclusions, failed location text, raw quote preservation and64-recipient tables. Only actual sends update an existing marker; empty routing leaves it unchanged. Tests cover connected same-team routing, wrapped marker deadlines and invalid payload atomicity. Text location and native network sends remain boundaries. Evidence.

RE-1028: Sixty-four source probes execute defuse completion with actual205260 and283463. Ready completion adds one player score point and requests ranking unless paused, then increments counter index5 by1 regardless of pause. Both score and counter wrap independently. Waiting does neither. Corrected ordered requests are log, allocate, score, optional rank, counter; allocation/log/ranking remain boundaries. This replaces the earlier misleading teleport/five-point labels with actual state feedback. Evidence.

RE-1029: Rust executes the existing score policy and indexed counter update for defuse completion across64 source cases. Paused score remains unchanged without a ranking request, while counter index5 wraps independently. Correct semantic trace tags replace historical aliases in these new reports. Whole completion and feedback state stage atomically; unit tests cover paused behavior and late counter failure after a planned score update. Ranking/log/allocation remain boundaries. Evidence.

RE-1030: Sixteen source cases execute defuse start with actual277695/278138 event construction and193620/33715 team radio. Event83 type/class/hash/time and snapped origin are materialized before caller payload/flags and radio routing. Marker state and commands reflect supplied/failed location text. Negative fractional origins snap toward zero. Allocation, native linking and sends remain supplied/captured; this is not direct sound playback. Evidence.

RE-1031: Rust composes the recovered event constructor and team-radio policies across16 source cases. Metadata, snapped origins, caller event flags and radio commands/marker state match actual source bodies. Explicit allocate/link/radio order replaces the historical sound tag. Tests verify origin snapping and unchanged score/counters, plus rollback of prior start writes on an unsupported origin. Base allocation, linking, location and sending remain boundaries. Evidence.

RE-1032: Forty-eight coherent source cases execute full defuse gates/lookup/distance with actual constructor, team-radio, score and counter bodies. Reports compare event records, command plans, marker deadlines, player/team scores and counters alongside defuse state. Paused scoring, inactive gates, decoy bombs and missing-bomb boundary are covered. Base allocation, location/formatting and native link/send/ranking/log remain supplied/modeled/captured. No teleport or five-point award is inferred. Evidence.

RE-1033: Rust matches48 full-source scenarios with actual constructor/radio/score/counter policies. Selected bomb origin and live teammate table feed the resolved effects rather than fixed synthetic responses. Missing-bomb and paused-score boundaries are preserved; world and feedback stage together on late errors. Tests materialize event84, wrapped score/counter changes and missing/error preservation. Native allocation/link/send/ranking/log and location/formatter boundaries remain explicit. Evidence.

RE-1024–1033 batch validation passed:1,998 Python tests,329 Rust tests,141 deterministic affected producers and612 documentation files. Source205260 is score update,283463 is indexed counter increment and193620 is team radio; old capture names remain compatibility labels. Resolved feedback and next work.

RE-1034: Sixteen original-QVM cases recover268248. A cached pointer returns only before its signed expiry. Otherwise a supplied box query over origin±40/40/52 chooses the first case-insensitive trigger_location candidate, or a linked-list fallback selects visible squared-distance≤best, so later equal-distance entries win. PVS is queried only for candidates within the current bound201326592. Cache fields are not written. Native box/PVS replies and linked identity remain supplied. Evidence.

RE-1035: Rust matches16 original location-selection cases with signed cache expiry, supplied query order, trigger precedence, PVS filtering and later-wins distance ties. Typed indices and finite math reject unsupported domains. Cache values remain unchanged; tests show live cache bypasses unused invalid geometry and trigger selection bypasses the fallback list. Engine query/PVS and identity remain supplied inputs. Evidence.

RE-1036: Twenty-four source cases execute268637 with actual70386/37914 formatting and bounded-copy helpers. Missing location returns0 without clearing the destination. Found location returns1 even for empty or clipped text; capacity clipping emits the original warning and preserves neighboring bytes. Empty/quoted text and capacities1/4/16/150 are covered. The selected location pointer remains supplied in this wrapper contract. Evidence.

RE-1037: Rust composes one location lookup with the recovered bounded formatter across24 source cases. Missing location preserves destination bytes; found empty/clipped text returns true with matching warning behavior and zero padding. Typed slices preserve guards. Unit cases cover one lookup, quoted bytes, capacity1, missing zero-capacity bypass and unsupported found-capacity rejection. Evidence.

RE-1038: Thirty-five source scenarios execute radio with actual location selection/text and bounded/ring formatter bodies. Commands now derive from cache/trigger/PVS results rather than supplied text responses. Missing locations become empty text through the original caller path. Ring state advances per recipient, quoted bytes remain unchanged, and a160-byte label clips to149 with a warning. Engine box/PVS and native send remain explicit boundaries. Evidence.

RE-1039: Rust composes nearest selection, bounded location text, team routing and the recovered ring formatter across35 source scenarios. Ring state wraps per recipient and149-byte clipping matches source warnings. Sender admission bypasses unused geometry; radio/marker/ring updates stage atomically. Tests cover long text, per-recipient ring advancement and inactive/error preservation. Engine box/PVS and sending remain external. Evidence.

RE-1040: Sixteen source cases execute allocator277165 and initializer277125. First-pass reuse respects signed start+2000 and age1000 gates; a full pool retries without that age gate. Extension increments count before registration/init. Count1022 stops at diagnostics; a fully occupied1024 pool reaches fatal boundary with count1025. Initialization writes only index/in-use/class/hash/field512 sentinel and preserves other words, including free time. Native registration and terminal effects remain captured/stopped. Evidence.

RE-1041: Rust matches16 actual allocator cases, including recent-free retry, count extension/registration, signed time gates and partial initialization. Terminal diagnostic/fatal outcomes preserve the source count and scan state, including count1025 before fatal handling. The supplied pool retains unrelated words. Unit tests cover retry without zeroing, terminal count behavior and rejection of subsequent allocation from invalid terminal count. Native registration/fatal handling remain plans/boundaries. Evidence.

RE-1042: Twenty-four source scenarios execute defuse start with actual allocator277165, initializer277125, constructor277695 and origin setter278138. Reuse, extension, recent-free extension and full-pool retry feed real selected records into caller payload/flag writes. Snapped origins, retained canary/free-time fields, registration counts and link targets are compared. Execution stops153917 before radio. Allocation terminals remain covered separately; native registration/linking are captured. Evidence.

RE-1043: Rust matches24 source scenarios composing real fixed-pool selection/init, event construction and caller defuse writes through the pre-radio boundary. Initial record flags and timestamps are retained rather than fabricated or zeroed. Source allocation/registration/link metadata and snapped event records match. Unsupported constructor/allocation outcomes reject atomically in this successful-allocation adapter; generic allocator terminal states remain separately exposed. Tests cover real payload flags and rollback after allocation. Evidence.

RE-1034–1043 batch validation passed:2,018 Python tests,339 Rust tests,146 deterministic affected producers and623 documentation files. All ten tasks have individual commits and focused checks. Location/allocation evidence and next work.