qvm: recover recipient wire contracts

docs/ASSET_PIPELINE_TODO.md

@@ -979,3 +979,6 @@ Research progress: RE-773 [report](research/QVM_LEADERBOARD_SELECTOR.md); origin
 
 
 Research progress: RE-774 [report](research/QVM_LEADERBOARD_CATEGORIES.md); original assets unchanged.
+
+
+Research progress: RE-775 [report](research/QVM_RECIPIENT_WIRE.md); original assets unchanged.

docs/FINDINGS.md

@@ -1325,3 +1325,6 @@ RE-725–734 batch: [health, contact and Rust impulse findings](research/QVM_HEA
 
 
 **RE-774 — Actual first four leaderboard category selections:** 283622 first four categories now execute actual initialization/mapping/selection with their original key groups and thresholds. [Evidence](research/QVM_LEADERBOARD_CATEGORIES.md).
+
+
+**RE-775 — Original recipient command templates and bounded byte serialization model:** Original scoress/scoresd templates carry12 numeric fields plus a name per participant;69338 requests31-byte strncpy then forces the32nd byte to zero. [Evidence](research/QVM_RECIPIENT_WIRE.md).

docs/PROVISIONAL_TODO.md

@@ -1323,3 +1323,6 @@ Research progress: RE-773 [report](research/QVM_LEADERBOARD_SELECTOR.md); full n
 
 
 Research progress: RE-774 [report](research/QVM_LEADERBOARD_CATEGORIES.md); full native/platform/game scope remains open.
+
+
+Research progress: RE-775 [report](research/QVM_RECIPIENT_WIRE.md); full native/platform/game scope remains open.

docs/RESEARCH_LEDGER.md

@@ -1528,3 +1528,8 @@ Exactly ten task commits follow baseline `27a7f96f`. Every completed task passed
 ## 2026-10-21 — RE-774 Actual first four leaderboard category selections
 
 283622 first four categories now execute actual initialization/mapping/selection with their original key groups and thresholds. Focused `cargo xtask test-group leaderboard-categories` passes (3 Python tests); selected reports regenerate twice byte-identically, with storage, links and whitespace guards. New report: 1002192 bytes. Full-suite validation is deferred to the tenth batch commit. No original assets, Rust runtime or shared VM evaluator changed.
+
+
+## 2026-10-21 — RE-775 Original recipient command templates and bounded byte serialization model
+
+Original scoress/scoresd templates carry12 numeric fields plus a name per participant;69338 requests31-byte strncpy then forces the32nd byte to zero. Focused `cargo xtask test-group recipient-wire` passes (3 Python tests); selected reports regenerate twice byte-identically, with storage, links and whitespace guards. New report: 120583 bytes. Full-suite validation is deferred to the tenth batch commit. No original assets, Rust runtime or shared VM evaluator changed.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1369,3 +1369,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-774 Actual first four leaderboard category selections ([report](research/QVM_LEADERBOARD_CATEGORIES.md)).
+
+
+- [x] RE-775 Original recipient command templates and bounded byte serialization model ([report](research/QVM_RECIPIENT_WIRE.md)).

docs/research/QVM_RECIPIENT_WIRE.md

@@ -0,0 +1,7 @@
+# Original recipient command templates and bounded byte serialization model
+
+RE-775. Reproduce with `python3 scripts/analyze_qvm_recipient_wire.py`; validate with `cargo xtask test-group recipient-wire`. See the [machine report](qvm-recipient-wire.json).
+
+Read verified original templates and--- fallback literals, execute valid69338 wrapper instructions with an explicit native-103 copy model, and derive modeled C strings from source numeric reports. Name edges cover NUL,31/32-byte limits, spaces, percent signs, invalid UTF8 and multibyte bytes.37914 formatting, real strlen and server send are not executed, so native wire parity remains open.
+
+No original executable/full VM/native world collision or rendering runs. Supplied callback/native responses and fixture domains remain explicit; complete macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/README.md

@@ -915,3 +915,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-774: Actual first four leaderboard category selections](QVM_LEADERBOARD_CATEGORIES.md).
+
+
+[RE-775: Original recipient command templates and bounded byte serialization model](QVM_RECIPIENT_WIRE.md).

scripts/analyze_qvm_recipient_wire.py

@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+"""Original score command templates, actual copy wrapper and explicit text model."""
+import hashlib,json,re
+from pathlib import Path
+from qvm_research_support import source
+from qvm_health_effects_support import H
+from qvm_trace_support import resume,captured
+from test_qvm_stat_totals import signed
+from analyze_qvm import write_json
+C=H+0x600000
+DEST=C+0x1000
+SRC=C+0x2000
+
+def choose(raw):
+    raw=raw.split(b'\0')[0];return raw if len(raw)>=2 else b'---'
+
+def copy_model(raw):return choose(raw)[:31].ljust(32,b'\0')
+
+def render(template,blocks,names):
+    args=[]
+    for block,name in zip(blocks,names):args += [str(signed(v)).encode('ascii') for v in block]+[copy_model(name).split(b'\0')[0]]
+    args=iter(args);result=re.sub(rb'%[is]',lambda _:next(args),template);assert next(args,None) is None
+    return result+b'\0'
+
+def main():
+    q,raw,h,ins=source();templates={}
+    for a in [79177,79263,69354,69358]:
+        b=raw[h['data_offset']+a:];templates[str(a)]=b[:b.index(0)].decode('ascii')
+    rows=[];sources={};paths=[Path('docs/research/qvm-recipient-single.json'),Path('docs/research/qvm-recipient-pair.json')]
+    for pair,path in enumerate(paths):
+        data=path.read_bytes();sources[str(path)]=hashlib.sha256(data).hexdigest()
+        for index,p in enumerate(json.loads(data)['probes']):
+            formats=[r for r in p['requests'] if r['target']==70458]
+            if not formats:continue
+            a=p['input'];args=formats[0]['arguments'];blocks=[[args[str(o)] for o in range(start,start+48,4)] for start in ([12,64] if pair else [12])];names=[b'A'*a.get('name_length',0)]
+            if pair:names.append(names[0] if a.get('self') else b'B'*a.get('second_name_length',0))
+            address=79177 if pair else 79263;rows.append({'origin':{'report':str(path),'probe':index},'pair':bool(pair),'blocks':blocks,'names_hex':[n.hex() for n in names],'cstring_hex':render(templates[str(address)].encode(),blocks,names).hex()})
+    edge_names=[b'',b'A',b'AB',b'x'*31,b'x'*32,b'a\0suffix',b'^1 two words %s',bytes([255,254,253]),'éé / 名'.encode()]
+    copies=[]
+    for name in edge_names:
+        m={C+28:DEST,C+32:SRC,C+36:32};requests=[];m,e1=resume(ins,69339,69375,m,C,handlers={-103:captured(-103,requests)},repeated_calls=True);modeled=copy_model(name);before=modeled[:31]+b'X';bs={DEST+j:v for j,v in enumerate(before)};_,e2=resume(ins,69375,69384,m,C,byte_inputs=bs);out=bytearray(before)
+        for w in e2['byte_writes']:out[w['address']-DEST]=w['value']
+        copies.append({'source_hex':name.hex(),'native_strncpy_model_hex':before.hex(),'final_hex':bytes(out).hex(),'requests':requests,'executions':[e1,e2]})
+        for pair in [False,True]:
+            blocks=[[1,-2147483648,2147483647,-1,0,1,2,3,255,-8388607,4,20]]*(2 if pair else 1);names=[name]*(2 if pair else 1);address=79177 if pair else 79263;rows.append({'origin':{'edge':True},'pair':pair,'blocks':blocks,'names_hex':[n.hex() for n in names],'cstring_hex':render(templates[str(address)].encode(),blocks,names).hex()})
+    write_json(Path('docs/research/qvm-recipient-wire.json'),{'source':q['source'],'sha256':q['sha256'],'source_reports':sources,'templates':templates,'copy_probes':copies,'probes':rows,'limits':'Original verified%i/%s templates and--- literals; actual69338 valid32-byte wrapper around explicitly modeled native-103 strncpy, including actual terminal STORE1. Numeric input comes from source body reports plus byte-name edges.37914 formatter/36038 strlen/-18 network not executed; serialization is a documented byte model, not native wire parity.'})
+if __name__=='__main__':main()

scripts/test_qvm_recipient_wire.py

@@ -0,0 +1,21 @@
+import hashlib,json,unittest
+from pathlib import Path
+from qvm_health_effects_support import H
+class RecipientWireTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-recipient-wire.json').read_text())
+    def test_independent_original_percent_formatter(self):
+        self.assertGreater(len(self.r['probes']),100)
+        for p in self.r['probes']:
+            args=[]
+            for block,name in zip(p['blocks'],p['names_hex']):
+                b=bytes.fromhex(name).split(b'\0')[0];b=(b if len(b)>=2 else b'---')[:31];args+=block+[b.decode('latin1')]
+            template=self.r['templates']['79177' if p['pair'] else '79263'];expected=(template%tuple(args)).encode('latin1')+b'\0';self.assertEqual(bytes.fromhex(p['cstring_hex']),expected)
+    def test_actual_wrapper_and_native_boundary(self):
+        self.assertEqual(len(self.r['copy_probes']),9)
+        for p in self.r['copy_probes']:
+            b=bytes.fromhex(p['source_hex']).split(b'\0')[0];b=(b if len(b)>=2 else b'---')[:31];self.assertEqual(bytes.fromhex(p['final_hex']),b.ljust(32,b'\0'));self.assertEqual(p['requests'][0]['arguments'],{'8':H+0x601000,'12':H+0x602000,'16':31});self.assertEqual(p['executions'][1]['byte_writes'],[{'address':H+0x60101f,'value':0}])
+    def test_template_shape_and_source_identity(self):
+        self.assertEqual(self.r['templates']['69354'],'---');self.assertEqual(self.r['templates']['69358'],'---');self.assertEqual(self.r['templates']['79263'].count('%i'),12);self.assertEqual(self.r['templates']['79177'].count('%i'),24)
+        for path,sha in self.r['source_reports'].items():self.assertEqual(hashlib.sha256(Path(path).read_bytes()).hexdigest(),sha)
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -1341,3 +1341,6 @@ group	leaderboard-selector	scripts/analyze_qvm_leaderboard_selector.py
 report	scripts/analyze_qvm_leaderboard_categories.py	docs/research/qvm-leaderboard-categories.json
 edge	docs/research/qvm-leaderboard-categories.json	scripts/test_qvm_leaderboard_categories.py
 group	leaderboard-categories	scripts/analyze_qvm_leaderboard_categories.py
+report	scripts/analyze_qvm_recipient_wire.py	docs/research/qvm-recipient-wire.json
+edge	docs/research/qvm-recipient-wire.json	scripts/test_qvm_recipient_wire.py
+group	recipient-wire	scripts/analyze_qvm_recipient_wire.py