docs/research/QVM_HEALTH_ROUTING.md

Health pointer fallback and target routing

RE-725. Reproduce with python3 scripts/analyze_qvm_health_routing.py; validate with cargo xtask test-group health. See the machine report.

Actual211437–211509 supplies world pointers for null inflictor/attacker. Kind4 with checksum different from signed−1514181943 checks target656 and the first word through target524: a nonzero callback and zero object state issue a three-argument target/inflictor/attacker request. The branch always exits, even when the callback is suppressed. Other kinds and the magic checksum continue at211510. Synthetic callback addresses are captured without execution; 64 pointer/kind/checksum/callback/state fixtures independently check the ABI and unchanged health/client state.

No original executable/full VM/native world collision or rendering runs. Supplied callback/native responses and fixture domains remain explicit; complete macOS/Linux Rust/Bevy/Solari gameplay remains open.