docs/research/QVM_HISTORY_HIT_BATCH.md

History production and model-hit preparation: RE-648–657

Ten separately tested tasks extend the rewind and pellet batch. History reset and append now feed the recovered rewind/restore path. Model-hit research reaches pose/controller preparation, transform records and postprocessing of supplied geometry records. Complete successful model intersection and damage remain open.

Task	Recovered scope	Evidence
RE-648	Twenty-row reset, preserved fields and animation byte packing	Reset writer
RE-649	Append, shift, head fields and null-client exit	Append producer
RE-650	Reset plus 25 appends through actual rewind and restoration	Produced history
RE-651	Complete victim/team statistics and actual mode predicate	Victim statistics
RE-652	Target selection, ray normalization and pending pose request	Model ray prefix
RE-653	Animation masks, angle quantization and controller arguments	Pose prefix
RE-654	Complete finite angle swing controller	Swing controller
RE-655	Whole-record stable sorting, type priority and trace publication	Hit publication
RE-656	Four whole 88-byte transform records before intersection	Transform preparation
RE-657	Complete integer-tag entity scan and continuation	Entity query

Findings for the rewrite

Reset fills twenty 80-byte history rows but preserves row words 0/4/8 and 72/76. Append shifts nineteen old rows through an explicit temporary copy and writes a new head, including 72/76; it preserves the snapshot flag that reset clears. Producer/consumer composition checks reset at time 1000 and 25 appends at ten-unit intervals, retaining timestamps 1250 through 1060. Rewind then consumes those produced rows at equality, interpolation and fallback/extrapolation targets. These times are harness inputs: live reset triggers and scheduling remain unrecovered.

Victim statistics now execute both category mappings and mode predicate33715. The enabled mode condition is signed mode at least3 except9 and11. Independent full-counter oracles cover hit/miss categories, victim counters, same-team accumulation, fractional truncation, negative supplied values and client aliasing. Supplied location/value inputs are bookkeeping fixtures and establish no health damage or successful geometry.

Model helper144766 normalizes end-minus-start, selects the target from the fixed entity pool and forwards shooter client6176 minus client0 into pose helper32254. This differs from the earlier trace prelude's6176 minus716. The pose prefix masks animation bit128, halves pitch, quantizes yaw and seeds controller flags. Complete33391 wraps deltas repeatedly, chooses speed factors0.5/1/2, quantizes movement and clamps with a one-degree margin. Idle in-tolerance angles stay bit-identical; an active zero-time controller can still clamp.

Transform preparation consumes three explicitly supplied pose angle triplets and constructs four88-byte records through four modeled zero fills and18 finite trig responses. The third basis is duplicated in the last two records. Translation appears only in the first record, while selected client words populate the first two records. No inferred skeleton identity or full32254 response is substituted for source recovery.

Postprocessing25835 sorts20-byte records stably by a float key, then swaps a later type3 to the front if the first type is5 or6. That priority swap can break numeric order. Trace publication copies two context vectors and a target ID only when the supplied record count is nonzero. The intersection producer25341 has not run, so these positive publication fixtures cannot count as successful model-hit verification.

Query276433 performs an integer-tag scan with nonzero in-use/name fields and supports repeated continuation after a prior record. It does not compare strings or perform a spatial/native query. Distinct nonnull name pointers with the same tag both match. Only the reached unsigned LTU instruction was added to the bounded evaluator; high-bit and equality fixtures distinguish it from signed comparison.

Validation and limits

The1059-test baseline gains38 checks, ending at1097 passing tests. Each task report regenerates byte-identically and stays below2MiB. Whole-record, byte-packing, independent float32, source-call order, producer/consumer and repeated-scan oracles cover the bounded fixtures. Storage/filter, documentation-link and whitespace checks pass. No assets or Rust runtime change.

Native copying/zero fills and finite math are explicit models; original library bit parity remains unverified. Native linking requests remain captured without engine effects. No original executable/full VM, live collision, completed model intersection, contact/damage, server tick, networking/rendering or macOS/Linux Bevy/Solari gameplay runs here. These ten tasks advance reverse engineering, not ten playable features.

Next ten concrete tasks

1. Recover actual reset/append callers, reset triggers and server-frame ordering; validate target time calculations against source scheduling rather than harness times.
2. Compose both reached33391 calls into32254 and recover its remaining movement/animation-specific pose branches with independent whole-output checks.
3. Partition25341 into matrix/model lookup, pose sampling and intersection stages. Establish pointer ownership, table bounds and asset identities from evidence.
4. Recover the producer of hit-context vectors and five-word records, including type codes, keys, count limits and no-hit behavior; compose actual output with sorting/publication.
5. Resume the rewound trace through a recovered model-hit return and every cleanup path, retaining exact caller memory and native link/unlink requests.
6. Recover contact292545 and its callers293732/295018 with source flag/pointer contracts; validate four-target/fifteen-slot aggregation on recovered hits.
7. Recover reached damage211239, penetration/retry and event64 normal encoding. Check health/armor/team rules against original reference traces.
8. Recover player_bb expiry277400 and free/reset transitions; connect actual allocation, time and capacity behavior through complete lifecycle fixtures.
9. Compose actual276433 into grenade/base construction, then recover223156 trajectory, contact, bounce and explosion stages without supplied successful outcomes.
10. Capture original native/DLL reference behavior and implement a verified Rust gameplay slice. Continue maps/models/textures/shaders/audio/network contracts and macOS/Linux Bevy/Solari runtime validation.