Crosshair substitution geometry and result routing
Static pass, 2026-10-11. Reproduce with python3 scripts/analyze_chat_crosshair.py; check with python3 scripts/test_chat_crosshair.py. Generated evidence includes verified qagame partitions, raw constants, bounded gate/argument/result traces and a separate finite binary32 arithmetic evaluator. No original process, complete QVM, native trig/collision service or recorded callee executes. Trig outputs, trace words/endpoints and isolated comparison returns are supplied fixture inputs. This extends the location lookup findings.
AIM-001: precondition, origin and direction arithmetic
The crosshair key's branch in lookup 185212 first tests sender-record offset 4324 !=0 or offset 4 >=3. Either condition calls location wrapper 268637 with sender/shared buffer/capacity 150 and returns the buffer pointer without computing a crosshair ray. The wrapper return is discarded. Synthetic state 0/2 reaches geometry; 3/4 or override reaches fallback. Failure/default output composition remains open.
For the other path, record fields 152/156/160 are multiplied by raw float bits 1016003125, value 0.01745329238474369, before six encoded service calls, alternating -104/-105 (service numbers 103/104). The supplied syscall candidate report does not identify these two names. The conventional sine/cosine interpretation of their paired outputs is used only to label the synthetic direction fixtures; the native service bodies and their accuracy remain unverified here.
The subsequent instruction arithmetic forms three vectors. With supplied variables sp/cp at locals 1092/1108, sy/cy at 1096/1104 and sr/cr at 1088/1100, the recovered expressions are:
forward = (cp*cy, cp*sy, -sp)
right = (-sr*sp*cy + cr*sy, -sr*sp*sy - cr*cy, -sr*cp)
up = (cr*sp*cy + sr*sy, cr*sp*sy - sr*cy, cr*cp)
Only forward feeds this endpoint. Five supplied cardinal-output fixtures cover forward, yaw 90, pitch 90, yaw 180 and roll 90. The actual MULF/ADDF/NEGF sequence is evaluated with a binary32 pack after each operation. Those fixtures produce orthogonal unit bases, expected cardinal forward vectors and a roll-independent endpoint. They do not establish angle conventions against camera coordinates or all-angle/native trigonometric conformance.
Origin helper 288871 copies three words from object offsets 24/28/32 into the caller vector, then adds signed integer sender-record field 164, converted by CVIF, to its third component. Three synthetic position/height cases evaluate that BLOCK_COPY/CVIF/ADDF sequence. The endpoint then evaluates:
endpoint = origin + forward * 30000.0
Distance bits 1189765120 decode to 30000.0. The finite evaluator supports only straight-line CONST/LOCAL/word load/store/address add, finite MULF/ADDF/NEGF/CVIF and aligned 12-byte fixture copies. Unknown memory, unsupported operations, stack underflow, nonfinite inputs/results, overflow and slice limits fail closed. It is separate from the existing integer evaluator and does not model byte aliasing, native rounding modes, exceptional floats or full VM frame unwinding. Tests include binary32 integer-rounding and signed zero.
AIM-002: trace argument contract
The ray call uses encoded target -25, service 24, labeled G_TRACE by the pinned ABI candidate report. The collector checks that report's qagame hash. Its exact seven argument words are:
| Argument offset | Value |
|---|---|
| 8 | result structure pointer, local 144 |
| 12 | origin pointer, local 120 |
| 16 | zero |
| 20 | zero |
| 24 | endpoint pointer, local 132 |
| 28 | sender-record word 140 |
| 32 | integer 1 |
The fixture supplies field 140 as 7 and records it without interpreting its complete identity. Null extents and mask 1 are raw call evidence; point-ray/content/pass-entity semantics still require native structure/service confirmation across targets. The origin-helper and trace callees are not entered in this argument slice. The ray result structure layout is only partly observed by subsequent word reads.
AIM-003: trace status, temporary object and comparison fallback
After the trace call, local 148, the word at result base +4, is compared to exactly 1. This is the second result word; its full status-field identity is not assigned here.
When that word equals 1, the code requests copy helper 36185 to set the shared output to literal unknown, then calls 268637 for the sender and reaches the buffer-return tail. Neither helper executes in the fixture, so failure of the second call does not prove its actual final output.
For other tested words 0 and 2, it copies result words at offsets +12/+16/+20 into a temporary object beginning at local 200, specifically object-relative offsets 488/492/496. It clears temporary offset 848, then requests location wrapper 268637 with that temporary object, output buffer 35738436 and capacity 150. Clearing offset 848 ensures this temporary lookup cannot take the observed nonzero-cache fast path; the rest of the object's initialization/lifetime remains open.
The wrapper return is discarded. Next helper 36306 receives the shared buffer and literal unknown. A comparison return zero invokes sender location fallback; supplied returns 1/-1 skip it. Full comparison-string execution is retained in the helper partition but not evaluated by this pass. Whole bounded result fixtures have zero CALL return placeholders and therefore take this fallback; those traces must not be mistaken for evidence that the real endpoint lookup always fails or yields unknown.
Remaining work and Rust dependencies
RE-281–283 cover bounded geometry, trace arguments and result routing. RE-272/280 remain open; RE-284 tracks native service-103/104 trig identity/accuracy, real record/vector/trace layouts, exceptional float and angle domains, full temporary-object memory requirements, location/comparison/default composition, collision/content masks and original-runtime/platform fixtures. Rust crosshair text needs both sender and endpoint location routes, exact status predicates and validated coordinate/trace contracts before claiming gameplay parity.
The NAT-001–003 follow-up confirms the shipped Linux ELF64 sinf/cosf and trace/PVS/area-query destinations and recovers VM-pointer/native spatial evidence. Earlier upstream-candidate limitations are narrowed for those mappings; full layout/geometry/runtime and other-platform parity remain open under RE-284/288.