Recover native trig spatial and VM pointer contracts

docs/FINDINGS.md

@@ -282,3 +282,9 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 **F-071 — Observed crosshair trace arguments:** service 24 receives result/origin/NULL/NULL/endpoint pointers, sender-record field 140 and mask 1. G_TRACE remains a pinned upstream candidate; full shipped structure/service semantics and runtime collision are unverified. [AIM-002](research/CHAT_CROSSHAIR.md).
 
 **F-072 — Observed crosshair result handling:** trace word +4 exactly 1 requests unknown then sender location. Other observed words build a cache-cleared temporary object from result +12/+16/+20; a subsequent comparison return zero triggers sender fallback. Calls/returns remain synthetic placeholders or isolated supplied inputs, so actual endpoint output/failure behavior is open. [AIM-003](research/CHAT_CROSSHAIR.md).
+
+**F-073 — Confirmed Linux trig/spatial destinations:** both ELF64 engines map services 103/104 to sinf/cosf, 24 to SV_Trace, 26 to SV_inPVS and 32 to SV_AreaEntities. Trig returns single-precision integer bit patterns; static transport mappings now corroborate prior QVM candidates. Runtime and other-platform equivalence remain open. [NAT-001](research/NATIVE_SPATIAL.md).
+
+**F-074 — Observed VM pointer branch distinction:** raw zero/currentVM NULL returns NULL; other arguments use direct base addition or signed-extended 32-bit masking followed by addition. A nonzero argument that masks to zero can return the data base. Paired synthetic instruction traces do not establish legal allocation/mask invariants. [NAT-002](research/NATIVE_SPATIAL.md).
+
+**F-075 — Observed native spatial structure:** trace NULL extents reference zero-fill storage and return copies span 56 bytes; PVS combines cluster bits with area connectivity. Area queries write four-byte indices and test equality with capacity before warning. Full fields/geometry/portals/tree ownership and runtime behavior remain open. [NAT-003](research/NATIVE_SPATIAL.md).

docs/PROVISIONAL_TODO.md

@@ -33,7 +33,7 @@ For implementation items, the minimum done condition is a documented contract, a
 
 ### First research batch
 
-Progress: [RE-232–234 / TIME-001–003](research/FRAME_TIMING.md) now cover Linux ELF64 elapsed modification, event sources and pause predicates. The [RE-237–239 follow-up](research/EVENT_QUEUES.md) resolves the pause-field address/bot chain and adds queue/journal evidence. The [RE-241–243 announcement pass](research/AUTH_ANNOUNCEMENTS.md) recovers label tables and recipient paths; The [RE-245–247 cvar pass](research/GAME_CVARS.md) adds all 126 main registration rows and resolves auth_verbosity/callers. The [RE-249–251 change pass](research/CVAR_CHANGES.md) adds cache/notification behavior, four numeric correction branches and direct registration coverage. The [RE-253–255 query pass](research/AUTH_QUERIES.md) adds selector helpers, command-role routing and internal authentication modes. The [RE-257–259 bounds/entry pass](research/SELECTOR_BOUNDS.md) adds integer parsing, selector storage/count evidence and native/QVM/chat route connections. The [RE-261–263 chat pass](research/CHAT_PATHS.md) adds native command metadata/filter evidence and bounded message/recipient paths, including the documented argument-mapping correction. The [RE-265–267 delivery pass](research/CHAT_DELIVERY.md) adds bounded dead-chat predicates, formatter argument routing and echo/fanout calls. The [RE-269–271 expansion pass](research/CHAT_EXPANSION.md) adds marker states, twelve key comparisons and health/momo branches. The [RE-273–275 item/time pass](research/CHAT_ITEMS_TIME.md) adds packed ammunition fields, sampled names and countdown branches. The [RE-277–279 location pass](research/CHAT_LOCATIONS.md) adds leader selection, cache/format boundaries and location-list/spatial evidence. The [RE-281–283 crosshair pass](research/CHAT_CROSSHAIR.md) adds finite geometry fixtures, trace arguments and result routing. PROV-002 remains open for full output/reset coverage. PROV-001 remains open for complete scheduling and platform coverage.
+Progress: [RE-232–234 / TIME-001–003](research/FRAME_TIMING.md) now cover Linux ELF64 elapsed modification, event sources and pause predicates. The [RE-237–239 follow-up](research/EVENT_QUEUES.md) resolves the pause-field address/bot chain and adds queue/journal evidence. The [RE-241–243 announcement pass](research/AUTH_ANNOUNCEMENTS.md) recovers label tables and recipient paths; The [RE-245–247 cvar pass](research/GAME_CVARS.md) adds all 126 main registration rows and resolves auth_verbosity/callers. The [RE-249–251 change pass](research/CVAR_CHANGES.md) adds cache/notification behavior, four numeric correction branches and direct registration coverage. The [RE-253–255 query pass](research/AUTH_QUERIES.md) adds selector helpers, command-role routing and internal authentication modes. The [RE-257–259 bounds/entry pass](research/SELECTOR_BOUNDS.md) adds integer parsing, selector storage/count evidence and native/QVM/chat route connections. The [RE-261–263 chat pass](research/CHAT_PATHS.md) adds native command metadata/filter evidence and bounded message/recipient paths, including the documented argument-mapping correction. The [RE-265–267 delivery pass](research/CHAT_DELIVERY.md) adds bounded dead-chat predicates, formatter argument routing and echo/fanout calls. The [RE-269–271 expansion pass](research/CHAT_EXPANSION.md) adds marker states, twelve key comparisons and health/momo branches. The [RE-273–275 item/time pass](research/CHAT_ITEMS_TIME.md) adds packed ammunition fields, sampled names and countdown branches. The [RE-277–279 location pass](research/CHAT_LOCATIONS.md) adds leader selection, cache/format boundaries and location-list/spatial evidence. The [RE-281–283 crosshair pass](research/CHAT_CROSSHAIR.md) adds finite geometry fixtures, trace arguments and result routing. The [RE-285–287 native spatial pass](research/NATIVE_SPATIAL.md) confirms Linux trig/spatial services, VM pointer branches and collision/query evidence. PROV-002 remains open for full output/reset coverage. PROV-001 remains open for complete scheduling and platform coverage.
 
 Start with the open questions raised by the current binary evidence. These tasks depend on the linked reports, not on a working rewrite.
 

docs/RESEARCH_LEDGER.md

@@ -145,3 +145,7 @@ Completed RE-277–279 bounded/static milestones with `analyze_chat_locations.py
 ## 2026-10-11 — Crosshair geometry and result routing
 
 Completed bounded milestones RE-281–283 with `analyze_chat_crosshair.py`: five dead gates, three origin/height cases, five supplied cardinal basis/endpoint cases, exact trace arguments, three result paths and three isolated comparison-return paths. AIM-001–003/F-070–072 separate finite straight-line binary32 arithmetic from native trig/collision and explicit zero callee-return placeholders. Eight tests check basis/origin/endpoints, seven-word ABI requests, exact-one status and temporary writes, fallback predicates and fail-closed float/memory/opcode/copy bounds. Added a separate restricted arithmetic evaluator without expanding the integer evaluator's domain. RE-272/280 remain open; RE-284 tracks full layout/float/temporary-object/output/runtime/platform contracts. No original process/full QVM or recorded callee executes.
+
+## 2026-10-11 — Native trig/spatial service and pointer evidence
+
+Completed bounded/static RE-285–287 with `analyze_native_spatial.py`: ten complete case paths, twelve helper graphs, eighteen synthetic VM_ArgPtr instruction traces, explicit zero-fill extent origin, file-backed trace constants and capacity warning strings. NAT-001–003/F-073–075 confirm shipped Linux service destinations while retaining all-platform/runtime uncertainty and the distinction between zero-fill initialization and observed runtime contents. Seven tests check mappings/float transport, conversion counts, pointer branches/failure bounds, case boundaries and spatial static gates/copy/index evidence. RE-284 remains open; RE-288 tracks VM allocation, complete collision/PVS/tree/layout and original-runtime/platform requirements. No original process or native callee executes.

docs/REVERSE_ENGINEERING_TODO.md

@@ -337,3 +337,8 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 - [x] RE-282 Recover exact seven-word crosshair trace argument contract and supplied field-140 forwarding ([AIM-002](research/CHAT_CROSSHAIR.md)).
 - [x] RE-283 Recover trace offset-4 exact-one branch, endpoint temporary-object/cache-clear writes and isolated comparison-controlled sender fallback ([AIM-003](research/CHAT_CROSSHAIR.md)).
 - [ ] RE-284 Confirm native trig services, full record/vector/trace layouts, float exceptional/angle domains, temporary-object requirements, location/comparison/default composition, collision masks and original-runtime/platform fixtures.
+
+- [x] RE-285 Confirm both Linux ELF64 trig/spatial native service destinations and exact pointer/scalar/float-bit transport paths ([NAT-001](research/NATIVE_SPATIAL.md)).
+- [x] RE-286 Recover bounded native VM_ArgPtr NULL/direct/mask/signed-extension branches with paired instruction traces ([NAT-002](research/NATIVE_SPATIAL.md)).
+- [x] RE-287 Recover static NULL trace extents, 56-byte result-copy span, PVS/area gates and area-query index/capacity evidence ([NAT-003](research/NATIVE_SPATIAL.md)).
+- [ ] RE-288 Compare other-platform dispatch, libm/float exception semantics, VM mask/allocation lifetime, full trace/collision fields/internals, PVS/portals/tree/index ordering and original map/runtime fixtures.

docs/research/CHAT_CROSSHAIR.md

@@ -55,3 +55,5 @@ The wrapper return is discarded. Next helper **36306** receives the shared buffe
 ## Remaining work and Rust dependencies
 
 RE-281–283 cover bounded geometry, trace arguments and result routing. RE-272/280 remain open; RE-284 tracks native service-103/104 trig identity/accuracy, real record/vector/trace layouts, exceptional float and angle domains, full temporary-object memory requirements, location/comparison/default composition, collision/content masks and original-runtime/platform fixtures. Rust crosshair text needs both sender and endpoint location routes, exact status predicates and validated coordinate/trace contracts before claiming gameplay parity.
+
+The [NAT-001–003 follow-up](NATIVE_SPATIAL.md) confirms the shipped Linux ELF64 sinf/cosf and trace/PVS/area-query destinations and recovers VM-pointer/native spatial evidence. Earlier upstream-candidate limitations are narrowed for those mappings; full layout/geometry/runtime and other-platform parity remain open under RE-284/288.

docs/research/CHAT_LOCATIONS.md

@@ -48,3 +48,5 @@ The [pinned ABI candidate report](qvm/qagame.abi-candidates.json), checked again
 RE-277–279 record these bounded/static milestones; RE-272 remains open for full substitution behavior. RE-280 tracks leader-flag/state writers, count/slot invariants, caller failure/default behavior, cache writers/expiry/reset, raw class tag derivation, linked-field ownership, full floating-point/box/PVS selection, configstring clients and original-runtime/platform fixtures. Rust location lookup needs explicit cache/ordering/tie rules and ownership backed by that evidence; a generic nearest-point search would not reproduce the observed two-stage control flow by itself.
 
 The [AIM-001–003 follow-up](CHAT_CROSSHAIR.md) recovers the crosshair caller's geometry/trace/result routes. Full spatial services, caller output and runtime behavior remain open under RE-280/284.
+
+The [NAT-001–003 follow-up](NATIVE_SPATIAL.md) confirms the shipped Linux ELF64 sinf/cosf and trace/PVS/area-query destinations and recovers VM-pointer/native spatial evidence. Earlier upstream-candidate limitations are narrowed for those mappings; full layout/geometry/runtime and other-platform parity remain open under RE-284/288.

docs/research/NATIVE_SPATIAL.md

@@ -0,0 +1,50 @@
+# Native trigonometry, spatial services and VM pointers
+
+Static pass, 2026-10-11. Reproduce with `python3 scripts/analyze_native_spatial.py`; check with `python3 scripts/test_native_spatial.py`. [Generated evidence](native-spatial.json) verifies both supplied Linux ELF64 original/disassembly hashes, rereads native switch tables, retains complete selected case paths and six helper graphs per image, and evaluates eighteen synthetic VM_ArgPtr paths. No original process or native callee executes. Windows, macOS and Linux i386 parity remain open. These findings extend [crosshair](CHAT_CROSSHAIR.md) and [location](CHAT_LOCATIONS.md) recovery.
+
+## NAT-001: confirmed shipped service destinations and float transport
+
+Both Linux 64-bit engines, client and dedicated, have these actual SV_GameSystemCalls destinations:
+
+| Service | QVM encoded CALL | Native destination | VM_ArgPtr calls |
+| ---: | ---: | --- | ---: |
+| 24 | -25 | SV_Trace | 5 |
+| 26 | -27 | SV_inPVS | 2 |
+| 32 | -33 | SV_AreaEntities | 3 |
+| 103 | -104 | sinf@plt | 0 |
+| 104 | -105 | cosf@plt | 0 |
+
+The collector extends each case beyond the older 24-instruction dispatch snippet to its terminal transfer. Unexpected branches, missing addresses or unbounded case paths fail closed. These mappings are confirmed in shipped Linux code rather than inferred solely from upstream enums; runtime semantics and other images remain separate requirements.
+
+The trig cases load a **single-precision word from native argument-array offset 8** into xmm0, call sinf/cosf, store the float result to a four-byte stack slot and return that slot's integer bit pattern through EAX followed by signed extension (CLTQ). This transports float bits rather than converting the result numerically to an integer. The previous crosshair paired-output sin/cos interpretation is now corroborated for these Linux engines. Actual libm execution, rounding/exception behavior and noncardinal output comparisons remain unverified.
+
+Trace case 24 converts its five pointers (result, start, mins, maxs, end) through VM_ArgPtr, forwards the two scalar words through 32-bit argument registers/stack, appends an additional native argument **zero**, calls SV_Trace and clears EAX for the syscall return. The observed crosshair mask 1 and field-140 scalar are therefore forwarded to the trace layer, not interpreted by this dispatcher. Case 26 converts its two position pointers; case 32 converts mins/maxs/output-list and forwards maximum count through ECX, returning a signed-extended result count.
+
+## NAT-002: actual VM_ArgPtr branches
+
+The full sixteen-instruction helper in each engine has the same observed logic over native currentVM fields:
+
+- Raw argument zero returns NULL immediately.
+- Nonzero argument with currentVM NULL also returns NULL.
+- If currentVM word at **0x58** is nonzero, return **data base at 0x90 + raw argument** using 64-bit addition.
+- Otherwise load the mask at **0x98** as a signed 32-bit word, extend it to 64 bits, AND with the argument, then add data base 0x90.
+
+The collector's restricted interpreter follows these real instruction addresses, supports only the observed register/memory/test/branch/add/mask/return forms, rejects unknown operations/reads and has a step bound. currentVM and its fields are explicitly supplied synthetic inputs. It is not a general native emulator or a proof of valid mask/allocation invariants.
+
+Nine fixtures per image cover NULL argument/currentVM, direct addition, positive mask, all-ones signed mask, negative argument and a nonzero 2^32 argument. That last argument returns base+2^32 in the nonzero-field-0x58 path, but **the data base itself** in the mask-65535 path. Thus “masked offset zero” and “raw argument zero” have distinct results. Legal VM argument widths, field identities, allocation bounds, active-VM lifetime and malformed-pointer dereference behavior remain open.
+
+## NAT-003: trace, PVS and area-query structure
+
+SV_Trace substitutes a shared vector for NULL mins/maxs through conditional moves. The vector lies in **.bss**, not file-backed data; its twelve bytes have a loader zero-fill initial value. The report marks that origin explicitly rather than claiming a file read or verified unchanged runtime contents. The graph calls **CM_BoxTrace** before the possible **SV_ClipMoveToEntities** path. File-backed constants **1.0/-1.0** and native swept-bound instructions are retained. The complete collision algorithm and exceptional float branches are not evaluated.
+
+The trace return path copies **seven eight-byte chunks**, output offsets 0/8/16/24/32/40/48, from its local collision result to the caller. That establishes an observed **56-byte copy span**, not every member's type or a portable C-layout assertion. In particular, the crosshair word at result +4 and endpoint reads +12/+16/+20 still need semantic field corroboration before naming them as final Rust types.
+
+SV_inPVS obtains both point leaf numbers, clusters and areas. It asks **CM_ClusterPVS** for the first point's cluster mask. With a non-NULL mask, it tests the second cluster's byte/bit using signed index shift by 3 and low bits masked by 7; a clear visibility bit returns false. A NULL mask bypasses that bit restriction. The remaining path calls **CM_AreasConnected** and normalizes nonzero to true. This is cluster/area connectivity evidence, not an unobstructed ray test. Cluster bounds, NULL-mask production, portals and real map fixtures remain open.
+
+SV_AreaEntities initializes a stack query record: mins/maxs pointers, output-list pointer, count zero and maximum count. It calls **SV_AreaEntities_r** with the native spatial-tree root, then returns the count. The recursive graph visits linked entities, gets their game objects through SV_GEntityForSvEntity, and checks raw coordinate fields **0x1d0 through 0x1e4** against query bounds. Strict greater/less comparisons imply touching finite bounds are not rejected by those six checks; NaNs are not characterized here.
+
+The capacity test is **count == maximum**, not a recovered >= guard. At equality, the graph tail requests Com_Printf with file-backed **`SV_AreaEntities: MAXCOUNT\n`**. Otherwise it writes an index at `output + count*4` and increments count. This confirms four-byte index elements for the QVM location query, whose supplied maximum is 1024. Exact index derivation, tree ordering, node-boundary recursion, malformed count/maximum inputs, link ownership and clipping remain open; no query fixture is executed against original map geometry.
+
+## Remaining work and Rust dependencies
+
+RE-285–287 record shipped destination/transport, bounded VM-pointer and native spatial-graph milestones. RE-284 remains open for runtime/layout/platform completeness; RE-288 tracks all-platform dispatch comparison, libm/float exception conformance, active-VM allocation/mask invariants, full trace fields and collision internals, PVS/portal/tree/index ordering and original map/runtime fixtures. Rust can now distinguish sine/cosine float-bit services and point/box/visibility interfaces with direct Linux evidence, while full collision parity and cross-platform behavior remain explicit dependencies.

docs/research/README.md

@@ -41,10 +41,11 @@ python3 scripts/test_chat_expansion.py
 python3 scripts/test_chat_items_time.py
 python3 scripts/test_chat_locations.py
 python3 scripts/test_chat_crosshair.py
+python3 scripts/test_native_spatial.py
 python3 scripts/storage_policy.py check --require-setup
 ```
 
-The pipeline runs `fetch_analysis_references.py`, `analyze_qvm.py`, `analyze_native.py`, `analyze_vm_abi.py`, `analyze_native_dispatch.py`, `analyze_vm_extensions.py`, `analyze_native_metadata.py`, `analyze_native_coverage.py`, `analyze_auth_drop.py`, `analyze_deferred_auth.py`, `analyze_engine_control.py`, `analyze_frame_timing.py`, `analyze_event_queues.py`, `analyze_auth_announcements.py`, `analyze_game_cvars.py`, `analyze_cvar_changes.py`, `analyze_auth_queries.py`, `analyze_selector_bounds.py`, `analyze_chat_paths.py`, `analyze_chat_delivery.py`, `analyze_chat_expansion.py`, `analyze_chat_items_time.py`, `analyze_chat_locations.py`, and `analyze_chat_crosshair.py` in that order. Python 3.9+ and **LLVM objdump** with x86 ELF/COFF/Mach-O support are required. This pass used Apple LLVM 17.0.0 on macOS arm64; it disassembled x86 images without running them. Upstream references are downloaded only if absent, checked against the committed SHA-256 manifest, and cached under `.cache/research/upstream/`. A clone also needs `git lfs pull` to obtain the derived artifacts/extracted members.
+The pipeline runs `fetch_analysis_references.py`, `analyze_qvm.py`, `analyze_native.py`, `analyze_vm_abi.py`, `analyze_native_dispatch.py`, `analyze_vm_extensions.py`, `analyze_native_metadata.py`, `analyze_native_coverage.py`, `analyze_auth_drop.py`, `analyze_deferred_auth.py`, `analyze_engine_control.py`, `analyze_frame_timing.py`, `analyze_event_queues.py`, `analyze_auth_announcements.py`, `analyze_game_cvars.py`, `analyze_cvar_changes.py`, `analyze_auth_queries.py`, `analyze_selector_bounds.py`, `analyze_chat_paths.py`, `analyze_chat_delivery.py`, `analyze_chat_expansion.py`, `analyze_chat_items_time.py`, `analyze_chat_locations.py`, `analyze_chat_crosshair.py`, and `analyze_native_spatial.py` in that order. Python 3.9+ and **LLVM objdump** with x86 ELF/COFF/Mach-O support are required. This pass used Apple LLVM 17.0.0 on macOS arm64; it disassembled x86 images without running them. Upstream references are downloaded only if absent, checked against the committed SHA-256 manifest, and cached under `.cache/research/upstream/`. A clone also needs `git lfs pull` to obtain the derived artifacts/extracted members.
 
 Generated JSON/JSONL and compressed evidence are regenerated in place; keep prose notes in Markdown. Rerunning the four analysis stages reproduced every generated report and gzip artifact byte-for-byte on the same toolchain. gzip timestamps and stored filenames are fixed. Different objdump versions can produce different disassembly text, so tool version and uncompressed evidence hashes are recorded. Reports are UTF-8 normal Git text, with individual files below the storage policy's 2 MiB limit.
 
@@ -94,3 +95,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 [Team-leader and location lookup paths](CHAT_LOCATIONS.md) adds RE-277–279: first-match leader scan, strict cache/format boundaries, location registration/list order and retained spatial control flow/constants. Reproduce with `python3 scripts/analyze_chat_locations.py`; check with `python3 scripts/test_chat_locations.py`. Geometry/services, ownership, caller output and runtime/platform contracts remain open.
 
 [Crosshair substitution geometry and results](CHAT_CROSSHAIR.md) adds RE-281–283: bounded origin/basis/endpoint arithmetic, exact trace arguments and status/temp-object/fallback routes. Reproduce with `python3 scripts/analyze_chat_crosshair.py`; check with `python3 scripts/test_chat_crosshair.py`. Engine trig/collision and complete output/runtime/platform conformance remain open.
+
+[Native trig, spatial services and VM pointers](NATIVE_SPATIAL.md) adds RE-285–287: confirmed paired Linux service mappings/float transport, bounded VM_ArgPtr branches and native trace/PVS/area-query graphs. Reproduce with `python3 scripts/analyze_native_spatial.py`; check with `python3 scripts/test_native_spatial.py`. Complete geometry, layout, exceptional arithmetic and all-platform runtime contracts remain open.

scripts/analyze_binaries.py

@@ -14,7 +14,7 @@ def main():
                    'analyze_deferred_auth.py', 'analyze_engine_control.py', 'analyze_frame_timing.py',
                    'analyze_event_queues.py', 'analyze_auth_announcements.py', 'analyze_game_cvars.py',
                    'analyze_cvar_changes.py', 'analyze_auth_queries.py', 'analyze_selector_bounds.py',
-                   'analyze_chat_paths.py', 'analyze_chat_delivery.py', 'analyze_chat_expansion.py', 'analyze_chat_items_time.py', 'analyze_chat_locations.py', 'analyze_chat_crosshair.py'):
+                   'analyze_chat_paths.py', 'analyze_chat_delivery.py', 'analyze_chat_expansion.py', 'analyze_chat_items_time.py', 'analyze_chat_locations.py', 'analyze_chat_crosshair.py', 'analyze_native_spatial.py'):
         subprocess.run([sys.executable, str(Path('scripts')/script)], check=True)
 
 

scripts/analyze_native_spatial.py

@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+"""Recover Linux ELF64 spatial/trig dispatch and bounded VM pointer traces."""
+import gzip
+import json
+from pathlib import Path
+import re
+import struct
+from analyze_chat_paths import native_string
+from analyze_deferred_auth import signed32
+from analyze_engine_control import control_flow
+from analyze_frame_timing import read_address
+from analyze_native import elf
+from analyze_native_dispatch import recover
+from analyze_qvm import write_json
+from analyze_vm_extensions import native_functions,verified
+
+MASK64=2**64-1
+
+
+def case_path(graph,address,limit=128):
+    index=next((i for i,x in enumerate(graph['instructions']) if x['address']==address),None)
+    if index is None:raise ValueError('case address missing')
+    rows=[]
+    for x in graph['instructions'][index:index+limit]:
+        rows.append(x)
+        if x['opcode'] in ['jmp','jmpq','ret','retq']:return rows
+        if x['opcode'].startswith('j'):raise ValueError('branching case needs a full CFG')
+    raise ValueError('case lacks bounded terminal transfer')
+
+
+def pointer_trace(graph,argument,current_vm,flag,data_base,data_mask,limit=64):
+    """Evaluate only the observed VM_ArgPtr integer instructions with synthetic words."""
+    instructions={x['address']:x for x in graph['instructions']}
+    order={x['address']:i for i,x in enumerate(graph['instructions'])};rows=graph['instructions']
+    regs={'%rdi':argument&MASK64};m={current_vm+0x58:flag,current_vm+0x90:data_base,
+                                  current_vm+0x98:data_mask};zero=False;trace=[];pc=graph['entry']
+    def reg(r):
+        if r not in regs:raise ValueError('unknown pointer register')
+        return regs[r]
+    def read(address):
+        if address not in m:raise ValueError('unknown pointer word')
+        return m[address]
+    for _ in range(limit):
+        if pc not in instructions:raise ValueError('pointer trace escaped function')
+        x=instructions[pc];trace.append(pc);op=x['opcode'];args=x['operands'].split('#')[0].strip()
+        nextpc=rows[order[pc]+1]['address'] if order[pc]+1<len(rows) else None
+        if op=='testq':
+            a,b=args.split(', ');zero=(reg(a)&reg(b))==0
+        elif op=='xorl' and args=='%eax, %eax':regs['%rax']=0
+        elif op in ['je','jne']:
+            if zero==(op=='je'):nextpc=int(args.split()[0],16)
+        elif op=='cmpq' and args=='$0x0, 0x58(%rdx)':zero=read(reg('%rdx')+0x58)==0
+        elif op=='movq' and '(%rip), %rdx' in args:
+            if '<currentVM>' not in x['operands']:raise ValueError('pointer global identity changed')
+            regs['%rdx']=current_vm
+        elif op=='movq' and args=='%rdi, %rax':regs['%rax']=reg('%rdi')
+        elif op=='movslq' and args=='0x98(%rdx), %rax':regs['%rax']=signed32(read(reg('%rdx')+0x98))&MASK64
+        elif op=='andq' and args=='%rdi, %rax':regs['%rax']=reg('%rax')&reg('%rdi')
+        elif op=='addq' and args=='0x90(%rdx), %rax':regs['%rax']=(reg('%rax')+read(reg('%rdx')+0x90))&MASK64
+        elif op in ['ret','retq']:return {'trace':trace,'result':reg('%rax')}
+        else:raise ValueError('unsupported pointer instruction '+op+' '+args)
+        pc=nextpc
+    raise ValueError('pointer trace step limit')
+
+
+def main():
+    out={'native':{},'limitations':'Static Linux ELF64 dispatch/graphs and bounded synthetic VM_ArgPtr '
+         'instruction traces. No original process/native callee/collision/trig service executes. Pointer '
+         'fixtures supply currentVM fields; allocation/mask invariants, malformed pointers, exceptional '
+         'floats, geometry/portal behavior and other platforms remain open.'}
+    for label in ['linux--Quake3-UrT-Ded.x86_64','linux--Quake3-UrT.x86_64']:
+        r=json.loads(Path(f'docs/research/native/{label}.json').read_text())
+        data=verified((Path('.cache/UrbanTerror43')/r['source']['path']).read_bytes(),r['source']['sha256'])
+        a=r['artifacts']['disassembly.txt'];text=verified(gzip.open(a['path'],'rb').read(),a['uncompressed_sha256']).decode()
+        metadata,_=elf(data);fs=native_functions(text);dispatch=recover(data,text,'SV_GameSystemCalls')
+        graph=control_flow(fs['SV_GameSystemCalls']);cases={}
+        for n in [24,26,32,103,104]:
+            case=next(c for c in dispatch['cases'] if n in c['numbers_sharing_target'])
+            path=case_path(graph,case['target_address'])
+            calls=[x for x in path if x['opcode'].startswith('call')]
+            cases[str(n)]={'target_address':case['target_address'],'instructions':path,'calls':calls}
+        names=['VM_ArgPtr','SV_Trace','SV_inPVS','SV_AreaEntities','SV_AreaEntities_r','SV_ClipMoveToEntities']
+        graphs={n:control_flow(fs[n]) for n in names}
+        zero_ins=next(x for x in graphs['SV_Trace']['instructions'] if re.match(r'\$0x[0-9a-f]+, %esi',x['operands']))
+        zero_address=int(re.search(r'\$0x([0-9a-f]+)',zero_ins['operands'])[1],16)
+        sections=[s for s in metadata['sections'] if s['address']<=zero_address and zero_address+12<=s['address']+s['bytes']]
+        if len(sections)!=1:raise ValueError('ambiguous extent section')
+        section=sections[0]
+        if section['zero_fill']:raw,offset=bytes(12),None
+        else:raw,offset=read_address(data,metadata['sections'],zero_address,12)
+        constants=[]
+        for x in graphs['SV_Trace']['instructions']:
+            if x['opcode']=='movss' and '(%rip)' in x['operands']:
+                address=int(re.search(r'#\s*0x([0-9a-f]+)',x['operands'])[1],16)
+                value,fileoff=read_address(data,metadata['sections'],address,4)
+                constants.append({'instruction':x['address'],'address':address,'file_offset':fileoff,
+                                  'bits':struct.unpack('<I',value)[0],'float32':struct.unpack('<f',value)[0]})
+        warning_ins=next(x for x in reversed(graphs['SV_AreaEntities_r']['instructions'])
+                         if x['opcode']=='movl' and re.match(r'\$0x[0-9a-f]+, %edi',x['operands']))
+        warning_address=int(re.search(r'\$0x([0-9a-f]+)',warning_ins['operands'])[1],16)
+        warning={'address':warning_address,'text':native_string(data,metadata['sections'],warning_address)}
+        traces=[]
+        for argument,vm,flag,mask in [(0,0,0,65535),(1,0,0,65535),(256,0x20000,1,65535),
+              (0x1234,0x20000,0,255),(511,0x20000,0,255),(-1,0x20000,0,65535),
+              (0x1234,0x20000,0,-1),(2**32,0x20000,1,65535),(2**32,0x20000,0,65535)]:
+            t=pointer_trace(graphs['VM_ArgPtr'],argument,vm,flag,0x100000,mask)
+            traces.append({'argument':argument,'current_vm':vm,'field58':flag,'data_base':0x100000,
+                           'mask_field98':mask,'trace':t})
+        out['native'][label]={'source':r['source'],'disassembly_sha256':a['uncompressed_sha256'],
+             'dispatch_table_address':dispatch['table_address'],'cases':cases,'graphs':graphs,
+             'zero_extent':{'address':zero_address,'file_offset':offset,'section':section['name'],
+                            'zero_fill_initial_value':section['zero_fill'],'raw':raw.hex(),
+                            'float32':list(struct.unpack('<3f',raw))},'trace_float_constants':constants,
+             'pointer_traces':traces,'area_capacity_warning':warning}
+    write_json(Path('docs/research/native-spatial.json'),out)
+    print('Recovered paired Linux trig/spatial dispatch and 18 bounded VM pointer paths')
+
+
+if __name__=='__main__':main()

scripts/test_native_spatial.py

@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Check paired dispatch evidence and fail-closed native pointer evaluation."""
+import copy
+import json
+from pathlib import Path
+import unittest
+from analyze_native_spatial import case_path,pointer_trace
+
+
+class NativeSpatialTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/native-spatial.json').read_text())
+
+    def test_trig_cases_float_input_and_bit_return(self):
+        for n in self.r['native'].values():
+            for number,name in [('103','sinf@plt'),('104','cosf@plt')]:
+                c=n['cases'][number];lines='\n'.join(x['line'] for x in c['instructions'])
+                self.assertIn('<'+name+'>',lines)
+                self.assertIn('movss\t0x8(%rdi), %xmm0',lines)
+                self.assertIn('movss\t%xmm0, 0x3c(%rsp)',lines)
+                self.assertIn('cltq',lines)
+                self.assertEqual(len(c['calls']),1)
+
+    def test_spatial_dispatch_complete_conversion_counts(self):
+        for n in self.r['native'].values():
+            for number,target,count in [('24','SV_Trace',5),('26','SV_inPVS',2),('32','SV_AreaEntities',3)]:
+                calls=n['cases'][number]['calls'];lines='\n'.join(x['line'] for x in calls)
+                self.assertEqual(lines.count('<VM_ArgPtr>'),count)
+                self.assertIn('<'+target+'>',calls[-1]['line'])
+            lines='\n'.join(x['line'] for x in n['cases']['24']['instructions'])
+            self.assertIn('movl\t$0x0, 0x8(%rsp)',lines)
+            self.assertIn('movl\t%eax, (%rsp)',lines)
+
+    def test_pointer_null_direct_mask_and_large_argument(self):
+        expected=[0,0,0x100100,0x100034,0x1000ff,0x10ffff,0x101234,0x100100000,0x100000]
+        for n in self.r['native'].values():
+            self.assertEqual([x['trace']['result'] for x in n['pointer_traces']],expected)
+            graph=n['graphs']['VM_ArgPtr']
+            for x in n['pointer_traces']:
+                result=pointer_trace(graph,x['argument'],x['current_vm'],x['field58'],x['data_base'],x['mask_field98'])
+                self.assertEqual(result,x['trace'])
+            self.assertNotEqual(n['pointer_traces'][-1]['trace']['result'],0)
+
+    def test_pointer_rejects_unsupported_instructions_and_limits(self):
+        for n in self.r['native'].values():
+            graph=n['graphs']['VM_ArgPtr']
+            with self.assertRaises(ValueError):pointer_trace(graph,256,0x20000,0,0x100000,255,limit=1)
+            bad=copy.deepcopy(graph);bad['instructions'][0]['opcode']='nop'
+            with self.assertRaises(ValueError):pointer_trace(bad,1,0,0,0,0)
+
+    def test_case_collector_rejects_unbounded_branching_or_missing(self):
+        graph={'instructions':[{'address':1,'opcode':'movq'},{'address':2,'opcode':'jmp'}]}
+        self.assertEqual(len(case_path(graph,1)),2)
+        with self.assertRaises(ValueError):case_path(graph,3)
+        with self.assertRaises(ValueError):case_path(graph,1,limit=1)
+        with self.assertRaises(ValueError):case_path({'instructions':[{'address':1,'opcode':'je'}]},1)
+
+    def test_null_extents_and_trace_result_copy(self):
+        for n in self.r['native'].values():
+            extent=n['zero_extent'];self.assertEqual(extent['float32'],[0,0,0])
+            self.assertTrue(extent['zero_fill_initial_value']);self.assertIsNone(extent['file_offset'])
+            self.assertEqual({x['float32'] for x in n['trace_float_constants']},{-1.0,1.0})
+            lines='\n'.join(x['line'] for x in n['graphs']['SV_Trace']['instructions'])
+            for marker in ['cmovneq\t%rdx, %r12','cmovneq\t%rcx, %r13','<CM_BoxTrace>',
+                           '<SV_ClipMoveToEntities>','0x30(%rbp)']:
+                self.assertIn(marker,lines)
+
+    def test_pvs_and_area_search_static_gates(self):
+        for n in self.r['native'].values():
+            p=n['graphs']['SV_inPVS'];labels=[c['label'] for c in p['calls']]
+            self.assertEqual(labels,['CM_PointLeafnum','CM_LeafCluster','CM_LeafArea','CM_ClusterPVS',
+                                     'CM_PointLeafnum','CM_LeafCluster','CM_LeafArea','CM_AreasConnected'])
+            lines='\n'.join(x['line'] for x in p['instructions'])
+            for marker in ['$0x7','$0x3','testb\t$0x1','setne\t%dl']:self.assertIn(marker,lines)
+            self.assertEqual(n['area_capacity_warning']['text'],'SV_AreaEntities: MAXCOUNT\n')
+            area='\n'.join(x['line'] for x in n['graphs']['SV_AreaEntities_r']['instructions'])
+            for marker in ['0x1d0(%rax)','0x1e4(%rax)','cmpl\t0x1c(%rbp), %eax',
+                           '(%rax,%rdx,4)','<Com_Printf>']:self.assertIn(marker,area)
+
+
+if __name__=='__main__':unittest.main()