docs/research/QVM_SERVER_FIRE_BATCH.md

Server firing research batch: RE-593–602

Ten separately committed tasks follow the firing producer batch into server-side event consumption, firing basis/muzzle preparation and selected handler setup. Recovered QVM effects are distinguished from supplied allocator/query replies, captured native requests and suspended opaque children.

Task	Recovered scope	Evidence
RE-593	151254 two-slot event window and recognized-consumer routing	Event route
RE-594	Actual31 publication→server prelude and pending289235 ABI	Firing event
RE-595	289235 suppression/statistic and finite angle basis before muzzle	Basis
RE-596	Complete288779/288871 muzzle helpers and actual firing caller	Muzzle
RE-597	Entity weapon dispatch table and pending handler sequences	Dispatcher
RE-598	277695 tempEntity/278138 position setup with explicit engine boundaries	Temporary event
RE-599	285840 event57, quantized direction and actual36717 PRNG before295018	Shot setup
RE-600	285971 grenade descriptor, launch quantization and inherited velocity	Grenade setup
RE-601	288903 mode/base/range/ground gates before allocation	Base gate
RE-602	Published31→server→selected setup, with event-loop resume only on recovered returns	Server chain

Findings for the Rust port

• The server consumes only the latest two events from an ordinary signed sequence window. Event31 first writes client4140=0 and4328=1, then calls289235(entity); its prelude does not read the event parameter.
• Client6164 suppresses the firing function before statistic or basis effects. Otherwise client4116 increments unless entity weaponID1, including IDs subsequently rejected by dispatch.
• Forward/right/up are derived from client angles with native sin/cos requests. Finite ordinary-math float32 responses model those natives here; platform libm/reference bit parity is unverified.
• The muzzle uses entity+24 plus viewheight and14×forward. It does not use entity+488 or PS origin, normalize the vector, trace or snap. The alternate helper omits14×forward.
• Dispatch uses entity+192, independent of the selected packed slot. The initialized table has direct returns for12/18, an18-ID shared293732 handler and distinct handlers for the remaining groups. This is not proof that IDs12/18 never fire elsewhere.
• tempEntity construction truncates coordinates before its actual position setter, issues a link request, then returns the allocation pointer. The selected285840 caller patches quantized direction, seed, shooter and weapon fields after that link request.
• Actual36717 mutates a32-bit seed using xor shifts5/21/27 and returns low15 bits;285840 stores low8 before pending295018 shot processing.
• The file-named grenade constructor biases forwardZ by.2, normalizes, scales by a mode speed, truncates, then adds owner velocity and matching-ground velocity. Its descriptor is constructed, not simulated through physics/explosion/damage.
• The base-dependent handler requires mode8/active!=1 and two type18 bases. Both farther than64 or ground1023 reject; otherwise the nearer point is chosen, with ties selecting the second. Invalid cardinalities stop at the source assumptions/error boundary rather than inventing valid pointers.

Integration and limits

RE-602 has twelve source-order chains. It resumes the actual event-loop continuation after suppressed firing, table returns, the bounded grenade constructor and recovered base-handler returns. It stays suspended at295018, base allocation277165 or other opaque handlers. Three publications demonstrate the two-event retained window and actual re-entry for returning paths. Full record, vector, queue and field handoffs have independent oracles.

Allocation277165 and world-query276433 replies are explicitly supplied; native link−31 is captured without engine effects. These contracts permit finite QVM data-flow checks, not a claim that an entity was actually allocated, linked, collided or damaged. A complete bounded constructor return is not a successful gameplay action. Other native/game callbacks and legal input domains remain open.

The879-test baseline gains40 independent checks. Reports regenerate deterministically and stay below the2MiB normal-Git cap. No original assets enter these commits; normal code/docs and filtered assets remain separated. No original executable/native library, full VM, native physics/rendering or macOS/Linux Rust runtime executes.

Next ten concrete tasks

1. Partition shared handler293732 by call/return boundaries; decode its weapon-slot/configuration inputs and every unresolved child.
2. Recover295018's direction/seed/spread setup and first trace requests, retaining exact finite arithmetic and table provenance.
3. Follow reached trace/contact/material consumers into damage211239 only after their actual contracts are recovered; do not assume a hit from a supplied trace.
4. Recover allocator277165 and record initializer277125, including free-slot reuse, timing, capacity and failure/error paths.
5. Recover query276433 and native link−31 contracts so grenade/base construction can be tested against an actual entity list/world.
6. Recover grenade callback223156, trajectory integration, contact/bounce, expiry and reached explosion/damage paths.
7. Continue288903 after allocator289113 through its temp_bomb descriptor, linking, state and round callbacks, preserving the two-base assumptions.
8. Recover remaining dispatcher handlers298842/293732/294171/286473/287330 and event consumers21/12/14/15/49/50/87, with explicit asset/animation/audio mappings.
9. Complete native vector snap and movement/scheduler composition, then capture original reference execution and legal multi-step event/weapon outcomes.
10. Continue the native/DLL/network/rendering/content inventory and first Rust/Bevy/Solari gameplay slice on macOS/Linux with measured parity. Bounded server data flow is not whole-game completion.

Follow-up: the RE-604–613 allocation/spread batch recovers277165/277125 and constructor compositions, plus parts of293732/295018. Earlier supplied-pointer reports remain historical bounded contracts. Use the newer batch for current next tasks.