qvm: aim endpoint construction

docs/ASSET_PIPELINE_TODO.md

@@ -529,3 +529,6 @@ Research progress: RE-615 [report](research/QVM_AIM_TRIG.md); remaining native/c
 
 
 Research progress: RE-616 [report](research/QVM_AIM_EXTRA_OFFSETS.md); remaining native/content/runtime/platform scope stays open.
+
+
+Research progress: RE-617 [report](research/QVM_AIM_ENDPOINT.md); remaining native/content/runtime/platform scope stays open.

docs/FINDINGS.md

@@ -884,3 +884,6 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 
 
 **RE-616 — Conditional aim jitter and additional RNG draws:** IDs10/14/23 may add two RNG offsets; flag84 and the strict150-time boundary control the branch, with a distinct ID23 scale. [Evidence](research/QVM_AIM_EXTRA_OFFSETS.md).
+
+
+**RE-617 — Aim endpoint construction and selected alias behavior:** The endpoint adds origin+16384×forward, then horizontal×global right and vertical×global up in distinct f32 write phases. [Evidence](research/QVM_AIM_ENDPOINT.md).

docs/PROVISIONAL_TODO.md

@@ -849,3 +849,6 @@ Research progress: RE-615 [report](research/QVM_AIM_TRIG.md); remaining native/c
 
 
 Research progress: RE-616 [report](research/QVM_AIM_EXTRA_OFFSETS.md); remaining native/content/runtime/platform scope stays open.
+
+
+Research progress: RE-617 [report](research/QVM_AIM_ENDPOINT.md); remaining native/content/runtime/platform scope stays open.

docs/RESEARCH_LEDGER.md

@@ -762,3 +762,8 @@ The airborne44 multiplier precedes sampling; three sin/cos pairs create horizont
 ## 2026-10-20 — RE-616 Conditional aim jitter and additional RNG draws (separate task commit)
 
 IDs10/14/23 may add two RNG offsets; flag84 and the strict150-time boundary control the branch, with a distinct ID23 scale. 72 ID/flag/time/future-field fixtures independently check every added draw, offsets and final seed. Full suite: 958 tests pass. Report regenerates byte-identically (958589 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.
+
+
+## 2026-10-20 — RE-617 Aim endpoint construction and selected alias behavior (separate task commit)
+
+The endpoint adds origin+16384×forward, then horizontal×global right and vertical×global up in distinct f32 write phases. 27 independent endpoint fixtures cover nonunit vectors and output aliases to origin/forward, retaining actual source effects. Full suite: 961 tests pass. Report regenerates byte-identically (417024 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.

docs/REVERSE_ENGINEERING_TODO.md

@@ -892,3 +892,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-616 Conditional aim jitter and additional RNG draws ([report](research/QVM_AIM_EXTRA_OFFSETS.md)).
+
+
+- [x] RE-617 Aim endpoint construction and selected alias behavior ([report](research/QVM_AIM_ENDPOINT.md)).

docs/research/QVM_AIM_ENDPOINT.md

@@ -0,0 +1,7 @@
+# Aim endpoint construction and selected alias behavior
+
+RE-617. Reproduce with `python3 scripts/analyze_qvm_aim_endpoint.py`; check with `python3 scripts/test_qvm_aim_endpoint.py`. The [machine report](qvm-aim-endpoint.json) retains source identity and bounded fixtures.
+
+Actual291476–291638 follows recovered parameters, sampling, trig and extra jitter. It first writes all three origin+forward×16384 components, then adds right×local76, then up×local52. Direction and basis vectors are used as supplied; no normalization is introduced. Output aliases to origin or forward match separate output for the tested records, while aliases involving global right/up or overlapping partial vectors remain unverified. Independent source-order f32 vector expressions check all27 fixtures, including nonunit/oblique inputs. Endpoint construction consumes no additional RNG and stops before the void PUSH/LEAVE epilogue. No engine trace or hit is inferred from the computed point.
+
+No original executable/full QVM/native collision/physics/rendering executes. Native responses and legal input domains are supplied or unverified where stated; full runtime/macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/README.md

@@ -450,3 +450,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-616: Conditional aim jitter and additional RNG draws](QVM_AIM_EXTRA_OFFSETS.md). Reproduce with `python3 scripts/analyze_qvm_aim_extra_offsets.py`; check with `python3 scripts/test_qvm_aim_extra_offsets.py`.
+
+
+[RE-617: Aim endpoint construction and selected alias behavior](QVM_AIM_ENDPOINT.md). Reproduce with `python3 scripts/analyze_qvm_aim_endpoint.py`; check with `python3 scripts/test_qvm_aim_endpoint.py`.

scripts/analyze_qvm_aim_endpoint.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+"""Actual endpoint writes after aim offsets, including selected alias domains."""
+import itertools
+from pathlib import Path
+from qvm_research_support import source,execute
+from qvm_server_fire_support import seed,RIGHT,UP
+from analyze_qvm_aim_extra_offsets import extra_offsets
+from analyze_qvm_spread_parameters import LOCAL
+from analyze_qvm_acceleration import PS,word
+from analyze_qvm_slide_prefix import vec
+from analyze_qvm import write_json
+ORIGIN=LOCAL+0x1000
+DIRECTION=LOCAL+0x1100
+OUTPUT=LOCAL+0x1200
+
+def endpoint(ins,m,origin=ORIGIN,direction=DIRECTION,output=OUTPUT):
+    initial={'origin':vec(m,origin),'forward':vec(m,direction),'right':vec(m,RIGHT),'up':vec(m,UP),'output':vec(m,output),'output_address':output};m,p=extra_offsets(ins,m);r={'initial':initial,'offsets_stage':p,'execution':None,'status':p['status']}
+    if p['status']!='endpoint-pending':return m,r
+    m[LOCAL+220]=origin;m[LOCAL+224]=direction;m[LOCAL+228]=output;m,_,e=execute(ins,291476,291639,m,(0,0,0),LOCAL);r.update({'execution':e,'output':vec(m,output),'final_seed':m[21044]&0xffffffff,'status':'void-epilogue'})
+    return m,r
+
+def inputs(m,origin=(1.9,-2.9,3.1),direction=(1,0,0),basis=((0,-1,0),(0,0,1))):
+    m=dict(m)
+    for p,v in [(ORIGIN,origin),(DIRECTION,direction),(RIGHT,basis[0]),(UP,basis[1]),(OUTPUT,(91,92,93))]:
+        for j,x in enumerate(v):m[p+4*j]=word(x)
+    return m
+
+def main():
+    q,raw,h,ins=source();rows=[]
+    for ident,direction,alias in itertools.product([2,14,23],[(1,0,0),(.6,-.25,.8),(-2,3,.5)],['none','origin','forward']):
+        m=seed(raw,h,ident);m[PS+144]=0;m[PS+312]=ident;m[21044]=1;m=inputs(m,direction=direction,basis=((.5,-1,.25),(-.25,.5,1)));_,r=endpoint(ins,m,output={'none':OUTPUT,'origin':ORIGIN,'forward':DIRECTION}[alias]);r['alias']=alias;rows.append(r)
+    write_json(Path('docs/research/qvm-aim-endpoint.json'),{'source':q['source'],'sha256':q['sha256'],'probes':rows,'limits':'Actual291476–291638 after actual recovered aim stages, stops before void PUSH/LEAVE. Output aliases origin or forward tested; aliases global basis or other memory unverified. No trace/contact/native world effect.'})
+if __name__=='__main__':main()

scripts/test_qvm_aim_endpoint.py

@@ -0,0 +1,17 @@
+import json,unittest
+from pathlib import Path
+from test_qvm_ground import word,n,f
+
+def expected(p):
+    a=p['initial'];offsets=p['offsets_stage']['offsets'];return [word(f(f(f(n(o)+f(n(d)*16384))+f(n(right)*n(offsets['76'])))+f(n(up)*n(offsets['52'])))) for o,d,right,up in zip(a['origin'],a['forward'],a['right'],a['up'])]
+class AimEndpointTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-aim-endpoint.json').read_text())
+    def test_independent_f32_endpoint(self):
+        self.assertEqual(len(self.r['probes']),27)
+        for p in self.r['probes']:self.assertEqual(p['output'],expected(p));self.assertEqual(p['execution']['calls'],[]);self.assertEqual(p['status'],'void-epilogue')
+    def test_aliases_match_separate_output(self):
+        for j in range(0,27,3):self.assertEqual(self.r['probes'][j]['output'],self.r['probes'][j+1]['output']);self.assertEqual(self.r['probes'][j]['output'],self.r['probes'][j+2]['output'])
+    def test_endpoint_preserves_rng(self):
+        for p in self.r['probes']:self.assertEqual(p['final_seed'],p['offsets_stage']['final_seed'])
+if __name__=='__main__':unittest.main()