qvm: grenade record construction

docs/ASSET_PIPELINE_TODO.md

@@ -481,3 +481,6 @@ Research progress: RE-598 [report](research/QVM_TEMP_EVENT.md); remaining native
 
 
 Research progress: RE-599 [report](research/QVM_SERVER_SHOT_SETUP.md); remaining native/content/runtime/platform scope stays open.
+
+
+Research progress: RE-600 [report](research/QVM_GRENADE_SETUP.md); remaining native/content/runtime/platform scope stays open.

docs/FINDINGS.md

@@ -839,3 +839,6 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 
 
 **RE-599 — Event57 firing setup quantization and actual PRNG:** 285840 builds event57, stores trunc(forward×4096) as float direction, derives a seed byte from actual36717 xorshift, records shooter/weapon IDs and prepares295018 arguments. [Evidence](research/QVM_SERVER_SHOT_SETUP.md).
+
+
+**RE-600 — Grenade record construction and inherited velocity:** 285971 looks up weapon7 mode, biases forwardZ by.2 and normalizes, builds a grenade descriptor, quantizes mode-scaled launch velocity, then adds owner and optionally matching-ground velocity. [Evidence](research/QVM_GRENADE_SETUP.md).

docs/PROVISIONAL_TODO.md

@@ -799,3 +799,6 @@ Research progress: RE-598 [report](research/QVM_TEMP_EVENT.md); remaining native
 
 
 Research progress: RE-599 [report](research/QVM_SERVER_SHOT_SETUP.md); remaining native/content/runtime/platform scope stays open.
+
+
+Research progress: RE-600 [report](research/QVM_GRENADE_SETUP.md); remaining native/content/runtime/platform scope stays open.

docs/RESEARCH_LEDGER.md

@@ -685,3 +685,8 @@ Actual outer31 publication reaches server151634, which writes client4140=0 and43
 ## 2026-10-20 — RE-599 Event57 firing setup quantization and actual PRNG (separate task commit)
 
 285840 builds event57, stores trunc(forward×4096) as float direction, derives a seed byte from actual36717 xorshift, records shooter/weapon IDs and prepares295018 arguments. 24 independent full-record/PRNG fixtures check fractional/negative quantization, seed0/1/hex/unsigned−1, tempEntity handoff, link-time ordering and exact opaque-call ABI. Full suite: 907 tests pass. Report regenerates byte-identically (1527580 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.
+
+
+## 2026-10-20 — RE-600 Grenade record construction and inherited velocity (separate task commit)
+
+285971 looks up weapon7 mode, biases forwardZ by.2 and normalizes, builds a grenade descriptor, quantizes mode-scaled launch velocity, then adds owner and optionally matching-ground velocity. 37 independent full-record fixtures check slot0/15/missing lookup, two source speeds, zero after bias, allocation/query ABI and all position/trajectory/ownership/think fields. Full suite: 911 tests pass. Report regenerates byte-identically (649857 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.

docs/REVERSE_ENGINEERING_TODO.md

@@ -841,3 +841,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-599 Event57 firing setup quantization and actual PRNG ([report](research/QVM_SERVER_SHOT_SETUP.md)).
+
+
+- [x] RE-600 Grenade record construction and inherited velocity ([report](research/QVM_GRENADE_SETUP.md)).

docs/research/QVM_GRENADE_SETUP.md

@@ -0,0 +1,11 @@
+# Grenade record construction and inherited velocity
+
+RE-600. Reproduce with `python3 scripts/analyze_qvm_grenade_setup.py`; check with `python3 scripts/test_qvm_grenade_setup.py`. The [machine report](qvm-grenade-setup.json) retains source identity and bounded fixtures.
+
+File-backed classname97541 is grenade. Actual31691 finds weapon7's first slot and decodes its mode; a missing−1 slot reads the explicitly supplied adjacent PS308 fixture rather than inventing a valid slot. Global forwardZ adds source.2, then actual float operations use a supplied finite sqrt to normalize unless zero.
+
+With a supplied277165 record, the body initializes type/trajectory/owner/flags/mask/timing and numeric scalar fields and copies global muzzle to base/live origin. Direction×source speed7304+52×mode is truncated to integer then converted back to float, after which owner PS velocity is added. A supplied276433 query result contributes its velocity only when its entity ID matches PS ground.
+
+37 fixtures reconstruct every record word and transformed forward vector independently. The exact query hash/arguments and supplied record pointer are retained. Allocator/query engine effects, entity linking, trajectory integration, explosion and damage are not executed. Construction alone does not prove a working projectile or native outcome.
+
+No original executable/full QVM/native collision/physics/rendering executes. Native responses and legal input domains are supplied or unverified where stated; full runtime/macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/README.md

@@ -400,3 +400,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-599: Event57 firing setup quantization and actual PRNG](QVM_SERVER_SHOT_SETUP.md). Reproduce with `python3 scripts/analyze_qvm_server_shot_setup.py`; check with `python3 scripts/test_qvm_server_shot_setup.py`.
+
+
+[RE-600: Grenade record construction and inherited velocity](QVM_GRENADE_SETUP.md). Reproduce with `python3 scripts/analyze_qvm_grenade_setup.py`; check with `python3 scripts/test_qvm_grenade_setup.py`.

scripts/analyze_qvm_grenade_setup.py

@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+"""285971 construction: lookup, biased normalized direction, record and inherited velocity."""
+import itertools
+from pathlib import Path
+from qvm_research_support import source,execute
+from qvm_server_fire_support import seed,state,ENTITY,PROJECTILE,BASES,FORWARD,MUZZLE
+from analyze_qvm_temp_event import record
+from analyze_qvm_weapon_lookup import lookup
+from analyze_qvm_acceleration import PS,word
+from analyze_qvm_slide_prefix import vec
+from analyze_qvm import write_json
+LOCAL=0x7f000000
+
+def grenade(ins,m,query_pointer=0):
+    initial=state(m);before=record(m);weapons=[m[PS+312+4*j]&0xffffffff for j in range(16)];minus=m[PS+308]&0xffffffff;m[LOCAL+84]=ENTITY;query=[];speeds={str(mode):m[7304+52*mode]&0xffffffff for mode in [0,1]};velocity=vec(m,PS+32);ground_velocity=vec(m,BASES+36)
+    def allocated(i,m,a,c):return m,c,PROJECTILE,{'supplied_record_pointer':PROJECTILE,'allocator_not_executed':True}
+    def find(i,m,a,c):r={'arguments':a,'supplied_pointer':query_pointer,'entity_id':m.get(query_pointer),'query_not_executed':True};query.append(r);return m,c,query_pointer,r
+    m,c,r=execute(ins,285972,286471,m,(0,0,0),LOCAL,{31691:lookup,277165:allocated,276433:find});slot=r['children'][0]['effect']['execution']['return'];mode=m[LOCAL+24]
+    return m,{'initial':initial,'initial_record':before,'weapon_slots':weapons,'slot_minus1_word':minus,'lookup_slot':slot,'mode':mode,'speeds':speeds,'word7224':m[7224]&0xffffffff,'time':m[34992532],'owner_velocity':velocity,'ground_velocity':ground_velocity,'query':query,'execution':r,'final_record':record(m),'final':state(m)}
+
+def main():
+    q,raw,h,ins=source();rows=[]
+    for fw,slot,mode,query_kind in itertools.product([(1,0,0),(.6,-.25,.8),(0,0,-.2)],[0,15],[0,1],['none','match','other']):
+        m=seed(raw,h,7)
+        for j in range(16):m[PS+312+4*j]=22
+        m[PS+312+4*slot]=7|(mode<<16);m[PS+308]=7
+        for o in range(0,880,4):m[BASES+o]=0
+        m[BASES]=8 if query_kind=='match' else 9;m[PS+68]=8
+        for p,v in [(FORWARD,fw),(BASES+36,(.5,-.25,2))]:
+            for j,x in enumerate(v):m[p+4*j]=word(x)
+        rows.append(grenade(ins,m,0 if query_kind=='none' else BASES)[1])
+    m=seed(raw,h,7);m[PS+312]=22;m[PS+308]=7|(1<<16)
+    for o in range(0,880,4):m[BASES+o]=0
+    rows.append(grenade(ins,m)[1])
+    classname=raw[h['data_offset']+97541:].split(b'\0',1)[0].decode()
+    write_json(Path('docs/research/qvm-grenade-setup.json'),{'source':q['source'],'sha256':q['sha256'],'classname':{'address':97541,'text':classname},'probes':rows,'limits':'Complete finite285971 with actual31691/supplied sqrt, explicit allocator and276433 query responses. Missing lookup−1 uses supplied PS308 fixture, not asserted legal. No entity allocation/link/trajectory physics/explosion or damage executes.'})
+if __name__=='__main__':main()

scripts/test_qvm_grenade_setup.py

@@ -0,0 +1,30 @@
+import json,unittest,copy,math
+from pathlib import Path
+from test_qvm_ground import word,n,f
+
+def normalized(p):
+    v=list(map(n,p['initial']['forward']));v[2]=f(v[2]+n(1045220557));length=f(math.sqrt(f(f(f(v[0]*v[0])+f(v[1]*v[1]))+f(v[2]*v[2]))))
+    return [f(x*f(1/length)) for x in v] if length else v
+
+def projectile(p):
+    r=copy.deepcopy(p['initial_record']);r.update({str(k):v&0xffffffff for k,v in {536:97541,540:513611514,644:p['time']+2500,648:223156,4:3,424:160,192:7,8:256,512:p['initial']['entity_id'],516:589824,692:90,696:180,700:300,704:p['word7224'],708:p['word7224'],588:100663297,624:0,12:5,16:p['time']-50}.items()})
+    direction=normalized(p);velocity=[f(float(int(f(x*n(p['speeds'][str(p['mode'])]))))) for x in direction];velocity=[f(x+n(y)) for x,y in zip(velocity,p['owner_velocity'])]
+    if p['query'][0]['supplied_pointer'] and p['query'][0]['entity_id']==p['initial']['ground']:velocity=[f(x+n(y)) for x,y in zip(velocity,p['ground_velocity'])]
+    for base in [24,488]:
+        for j,v in enumerate(p['initial']['muzzle']):r[str(base+4*j)]=v
+    for j,v in enumerate(velocity):r[str(36+4*j)]=word(v)
+    return r
+class GrenadeSetupTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-grenade-setup.json').read_text())
+    def test_exact_projectile_descriptor_and_velocity(self):
+        self.assertEqual(len(self.r['probes']),37)
+        for p in self.r['probes']:self.assertEqual(p['final_record'],projectile(p));a=copy.deepcopy(p['initial']);a['forward']=list(map(word,normalized(p)));self.assertEqual(p['final'],a)
+    def test_actual_first16_lookup_and_mode_source(self):
+        for p in self.r['probes']:
+            slot=next((j for j,v in enumerate(p['weapon_slots']) if v&255==7),-1);packed=p['weapon_slots'][slot] if slot>=0 else p['slot_minus1_word'];self.assertEqual((p['lookup_slot'],p['mode']),(slot,packed>>16&255))
+    def test_actual_child_order_and_supplied_engine_contracts(self):
+        for p in self.r['probes']:self.assertEqual([c['target'] for c in p['execution']['calls']],[31691,-107,277165,276433]);self.assertEqual(p['query'][0]['arguments'],{'8':0,'12':-913528516});self.assertTrue(p['query'][0]['query_not_executed'])
+    def test_file_classname_zero_direction_and_missing_slot_fixture(self):
+        self.assertEqual(self.r['classname'],{'address':97541,'text':'grenade'});self.assertTrue(any(all(v==0 for v in normalized(p)) for p in self.r['probes']));self.assertEqual(self.r['probes'][-1]['lookup_slot'],-1)
+if __name__=='__main__':unittest.main()