qvm: posture

docs/ASSET_PIPELINE_TODO.md

@@ -262,3 +262,5 @@ Research progress: [QVM command scale/acceleration](research/QVM_ACCELERATION.md
 Research progress: [QVM friction policies](research/QVM_FRICTION.md) completes bounded RE-433–435. RE-432/436 retain live coefficients/producers/native sqrt/full mode-state/collision/runtime/platform work; broad game/rendering milestones remain open.
 
 Research progress: [QVM content/ground producers](research/QVM_GROUND.md) completes bounded RE-437–439. RE-436/440 retain native callbacks/helper effects/full collision-state composition/live policy/runtime/platform work; broad game/rendering milestones remain open.
+
+Research progress: [QVM posture bounds and transitions](research/QVM_POSTURE.md) completes bounded RE-441–443. RE-440/444 retain native collision/callee effects/resource and semantic producers/full state composition/runtime/platform work; broad game/rendering milestones remain open.

docs/FINDINGS.md

@@ -516,3 +516,9 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 **F-188 — Ground/surface producers:** helper46773 copies a supplied56-byte trace to global35023944; offset44 supplies friction surface word35023988. Ordered recovery/fraction/kick/slope/level branches set walk/plane/ground/flag/timer fields and record helpers. External effects and native collision/runtime remain omitted. [GROUND-002](research/QVM_GROUND.md).
 
 **F-189 — Producer/friction connection:** sixteen scalar bridges pass recovered level/walk/surface/PS flags into earlier friction arithmetic with verified initialized coefficients and supplied velocity. Full callback/frame/state/collision composition remains unverified. [GROUND-003](research/QVM_GROUND.md).
+
+**F-190 — Posture bounds and height:** helper47422 initializes min(-15,-15,-24)/max(15,15,45); early modes select height-16, bit1 selects maxZ24/height20, and masked animation25 selects maxZ10/height-5. Semantic names remain provisional. [POSTURE-001](research/QVM_POSTURE.md).
+
+**F-191 — Posture transitions:** guarded entry can deduct3000 from a converted resource word, request39525(36) and set timer200; exit requests a standing overlap trace, then clears bit1/field92 and requests39525(37) only for supplied zero allsolid. Final entity bit1 depends on horizontal speed>=300 and signed up<=-10. Native/callee effects remain omitted. [POSTURE-002](research/QVM_POSTURE.md).
+
+**F-192 — Posture consumer connection:**48 fixtures propagate evaluated height/bounds/flags/resource into earlier content/ground/scale slices. Resource deduction can change the prior220/340 policy under matched supplied inputs; full state/collision/runtime composition remains open. [POSTURE-003](research/QVM_POSTURE.md).

docs/PROVISIONAL_TODO.md

@@ -574,3 +574,5 @@ Research progress: [QVM command scale/acceleration](research/QVM_ACCELERATION.md
 Research progress: [QVM friction policies](research/QVM_FRICTION.md) completes bounded RE-433–435. RE-432/436 retain live coefficients/producers/native sqrt/full mode-state/collision/runtime/platform work; broad game/rendering milestones remain open.
 
 Research progress: [QVM content/ground producers](research/QVM_GROUND.md) completes bounded RE-437–439. RE-436/440 retain native callbacks/helper effects/full collision-state composition/live policy/runtime/platform work; broad game/rendering milestones remain open.
+
+Research progress: [QVM posture bounds and transitions](research/QVM_POSTURE.md) completes bounded RE-441–443. RE-440/444 retain native collision/callee effects/resource and semantic producers/full state composition/runtime/platform work; broad game/rendering milestones remain open.

docs/RESEARCH_LEDGER.md

@@ -323,3 +323,7 @@ Validation: all preceding composition reports regenerated byte-identically, incl
 ## 2026-10-15 — Game-QVM content levels, ground trace and friction-input producers
 
 Completed bounded RE-437–439 with `analyze_qvm_ground.py`: verified shipped qagame helpers47217/46773, 28 point-content probes, 168 trace/classification probes and sixteen scalar friction bridges. GROUND-001–003/F-187–189 recover content-mask56 short-circuit/sample coordinates/raw-first contents/level producer, trace callback shape/downward endpoint/full56-byte copy and ordered recovery/fraction/kick/slope/level/landing caller stores/requests. Trace offset44 supplies surface word35023988, and level/walk/surface/PS flags feed the earlier friction arithmetic in scalar bridges. Supplied callback/trace records, recovery returns and omitted landing/touch/ground-lost effects remain explicit; normals/contact legality and native collision/runtime are unverified. Source coefficient bytes are checked. No full QVM/original executable/native callback/collision executes. Eight independent tests verify points/masks/short circuits/arguments, full trace copy/classification/thresholds/helper ordering, scalar propagation/friction results, provenance and scope. All 487 tests pass; the direct friction dependency regenerates unchanged and the new ground report reproduces twice byte-identically. Storage/filter setup, documentation links and whitespace checks pass. No existing analyzer/evaluator code changes. RE-436 remains open; RE-440 tracks native point/trace ABI/collision outputs, content/surface/bounds/height producers, recovery/ground-lost/landing/touch effects, scratch/prior state/full frame/PS/collision-to-friction composition, coefficient writers and gameplay/macOS/Linux/Rust/Bevy/Solari compatibility; packet/entity/player/snapshot/rendering milestones remain open.
+
+## 2026-10-15 — Game-QVM posture bounds, transitions and consumer inputs
+
+Completed bounded RE-441–443 with `analyze_qvm_posture.py`: verified shipped qagame helper47422, 420 posture probes and48 scalar/bounds bridges. POSTURE-001–003/F-190–192 recover initialized bounds, early-mode height, final flag/animation-dependent height; entry/exit guards, converted resource deduction/clamp, timer stores, tentative standing overlap query and recorded animation requests; and horizontal speed/up-byte entity-bit policy. Evaluated bounds/height/flags/resource transfer into earlier supplied-content/ground-trace/command-scale fixtures. Native trace and sqrt returns are supplied, helper39525 effects omitted, and no complete QVM/original executable/native collision/physics executes. Semantic names, legal domains, resource producers and full state composition remain open. Ground analyzer adds optional explicit bounds with unchanged default report. Eight independent tests verify all transitions, query bounds/arguments, early exclusions, resource/animation policy, equality boundaries, consumer handoffs with prior ground/scale oracles, provenance and scope. All495 tests pass. The direct ground report regenerates byte-identically; the posture report reproduces twice byte-identically (749071 bytes). Storage/filter setup, documentation links and whitespace checks pass. RE-440 remains open; RE-444 tracks overlap-trace ABI/results, animation-helper effects, resource/semantic producers and complete frame/PS/content/ground/friction/gameplay/macOS/Linux/Rust/Bevy/Solari validation; packet/entity/player/snapshot/rendering milestones remain open.

docs/REVERSE_ENGINEERING_TODO.md

@@ -532,3 +532,8 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 - [x] RE-438 Recover bounded helper46773 trace request/full56-byte copy, ground classification/thresholds/caller stores and recorded recovery/landing/touch requests with supplied trace effects. [GROUND-002](research/QVM_GROUND.md).
 - [x] RE-439 Bridge evaluated content level/ground walk/trace surface/PS flags into prior friction fixtures with independent scalar/arithmetic checks. [GROUND-003](research/QVM_GROUND.md).
 - [ ] RE-440 Recover native point/trace ABI/collision outputs, contents/surface enums and height/bounds producers, recovery/ground-lost/landing/touch effects, scratch/prior state, full frame/PS/collision-to-friction composition and coefficient writers; validate gameplay/macOS/Linux before Rust/Bevy/Solari claims. Continue packet/entity/player/snapshot/rendering work.
+
+- [x] RE-441 Recover bounded helper47422 initialized bounds, early-mode height and final flag/animation height selection ([POSTURE-001](research/QVM_POSTURE.md)).
+- [x] RE-442 Recover crouch entry/exit guards, resource/timer stores, tentative stand-up query and horizontal-speed/up-bit policy with supplied callback returns ([POSTURE-002](research/QVM_POSTURE.md)).
+- [x] RE-443 Bridge evaluated bounds/height/flags/resource into prior content/ground/command-scale fixtures with independent consumer oracles ([POSTURE-003](research/QVM_POSTURE.md)).
+- [ ] RE-444 Recover native overlap-trace ABI/results, helper39525 effects, resource producers/reset/ranges and posture/type/animation/flag/height meanings; compose complete frame/PS/content/ground/friction state and validate gameplay/macOS/Linux before Rust/Bevy/Solari claims. Continue packet/entity/player/snapshot/rendering work.

docs/research/QVM_GROUND.md

@@ -65,3 +65,5 @@ Tests use the independent friction arithmetic oracle to verify the resulting dro
 Eight tests independently verify sampling/masks/points/requests, trace arguments/endpoints/full copy, classification/stores/helper ordering, strict thresholds, scalar friction propagation, source/coefficient bytes and explicit scope. The full suite runs; the direct friction dependency and new ground report are regenerated, with the new report checked twice for identical bytes. No existing analyzer/evaluator code changes in this batch.
 
 RE-436 remains open for complete policy/producers/runtime work. RE-440 must recover native point/trace callback ABI and collision results, content/surface bit meanings and bounds/height producers, recovery/ground-lost/landing/touch helper effects, actual scratch reset and prior state, full frame/PS/collision-to-friction composition, coefficient writers and gameplay/macOS/Linux before Rust/Bevy/Solari compatibility claims. Packet/entity/player/snapshot/rendering milestones remain open.
+
+Follow-up: [posture recovery](QVM_POSTURE.md) identifies helper47422 bounds/height producers and transfers selected outputs into content and ground fixtures (RE-441–443). Optional explicit bounds in the ground analyzer preserve default report bytes. Actual native collision and complete state composition remain open under RE-440/444.

docs/research/QVM_POSTURE.md

@@ -0,0 +1,43 @@
+# Game-QVM posture bounds, transitions and consumers
+
+RE-441–443 / F-190–192. [qvm-posture.json](qvm-posture.json) retains the complete shipped qagame helper47422 instruction partition, 420 bounded posture probes and 48 scalar/bounds bridges. Reproduce with `python3 scripts/analyze_qvm_posture.py`; check with `python3 scripts/test_qvm_posture.py`.
+
+This follows [content and ground recovery](QVM_GROUND.md). Synthetic instruction evaluation starts after ENTER and ends before the return epilogue. No full QVM, original executable, native trace or collision executes. The trace's first output word and square-root return are supplied; helper39525 requests are recorded without effects. Posture, animation, resource and flag semantic names remain provisional. Tested finite values do not establish all legal gameplay domains or native floating-point behavior.
+
+## POSTURE-001 — Bounds and height selection (RE-441)
+
+Helper47422 initializes frame bounds at +184 through +204 to min(-15,-15,-24), max(15,15,45), as binary32 words. Player-state type word+4 equal3 or nonzero frame+240 selects an early return: player-state+164 becomes -16, the initialized bounds remain, and transition/sqrt/final entity-flag work is skipped.
+
+Otherwise final player-state+12 bit1 selects maxZ24 and height word+164=20. With that bit clear, animation word+76 after clearing bit128 equal25 selects maxZ10 and height-5; animation153 therefore selects the same path. All other sampled animations select maxZ45 and height38. Horizontal bounds and minZ remain unchanged in every evaluated path.
+
+These are concrete bounds and height policies; physical posture/type/animation meanings require producer and runtime confirmation. The content sampler consumes the height word, while the ground trace consumes the two bounds pointers.
+
+## POSTURE-002 — Transition guards, resource and callbacks (RE-442)
+
+Entry is eligible when signed command up byte is negative or PS flags include bit2, flags exclude mask12, frame level+212 is at most1, and PS timer+72 is zero. Eligible entry sets bit1. If bit1 was initially clear, it also records helper39525(36) and writes timer200. With ground word+68 other than1023, this first entry converts integer resource word+184 to binary32, subtracts3000, converts back with truncation and clamps a negative result to zero. Existing bit1 bypasses this charge/request/timer assignment. Airborne-sentinel1023 bypasses the resource deduction.
+
+When entry is ineligible, exit is considered only with bit1 set, timer zero, and either ground word other than1023 or level greater than1. The helper requests the callback stored at frame+224 (supplied target-25) with:
+
+| Slot | Request |
+| --- | --- |
+| 8 | Local trace destination at local-base+44 |
+| 12/24 | Same PS position pointer, PS+20 |
+| 16/20 | Frame+184 / frame+196 bounds pointers |
+| 28 | PS+140 word, supplied7 |
+| 32 | Frame+28 mask, supplied0x2010001 |
+
+At this request, maxZ is the tentative standing45. A supplied nonzero first trace word keeps bit1 and ultimately selects maxZ24. A zero first word clears bit1, clears PS+92, records helper39525(37), and writes timer200. Other trace fields are zero-seeded but not consumed by this helper. The actual callback, contact legality and animation-helper mutations remain unknown.
+
+Finally, excluding the early return, the helper requests sqrt of rounded VX²+VY² through encoded target-107. PS+104 bit1 survives only when the supplied horizontal speed is at least300 and signed up is at most-10; otherwise it is cleared. Other bits survive. Fixtures include299/300, -11/-10/-9, a180/240 vector and vertical-only velocity400. Native sqrt execution is omitted; supplied finite square roots match these exact-square inputs.
+
+## POSTURE-003 — Bounds, content, ground and scale bridges (RE-443)
+
+Eight posture variants combine with three supplied content patterns and two supplied ground normals for48 bridges. Evaluated height feeds helper47217 content sample coordinates; resulting content level and posture flags feed helper46773 classification; evaluated six-word bounds are retained at its trace request; evaluated resource feeds helper40397 command scaling. Ground's analyzer now accepts optional bounds while its default report remains byte-identical.
+
+A grounded first entry with resource2999 yields zero and the prior scale helper's normal220 speed policy; the otherwise matching ground-sentinel1023 entry retains2999 and permits its340 policy under supplied forward81/right0/button256. Command scale itself includes the recovered127 normalization and strict resource>10 gate. This establishes selected producer/consumer arithmetic, not full physical simulation. The fixtures seed separate states and transfer selected values rather than preserving all PS/frame/callee effects.
+
+## Validation and next tasks
+
+Eight tests check all420 transitions against an independent branch/arithmetic oracle, tentative trace bounds and arguments, early-return exclusions, resource clamping and animation toggles, horizontal speed/up equality boundaries,48 consumer handoffs and prior ground/scale oracles, source hash/instruction partition and explicit limitations. The direct ground dependency is regenerated unchanged and the new posture report reproduces twice byte-identically. Full suite and storage/link/whitespace checks are recorded in the research ledger.
+
+RE-440 remains open for native collision and full state composition. RE-444 tracks actual overlap-trace ABI/results, helper39525 effects, resource producers/reset/ranges, animation/type/flag/height meanings, complete frame/PS/content/ground/friction composition and gameplay/macOS/Linux validation before Rust/Bevy/Solari compatibility claims. Packet/entity/player/snapshot and rendering milestones remain open.

docs/research/README.md

@@ -175,3 +175,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 [QVM friction and velocity composition](QVM_FRICTION.md) adds RE-433–435. Reproduce with `python3 scripts/analyze_qvm_friction.py`; check with `python3 scripts/test_qvm_friction.py`. Constants are initialized-image snapshots; native sqrt, live policy and full state/collision/runtime effects remain open.
 
 [QVM content sampling, ground classification and friction inputs](QVM_GROUND.md) adds RE-437–439. Reproduce with `python3 scripts/analyze_qvm_ground.py`; check with `python3 scripts/test_qvm_ground.py`. Callback results are supplied and only scalar states bridge into friction; full collision/runtime work remains open.
+
+[QVM posture bounds, transitions and consumer bridges](QVM_POSTURE.md) adds RE-441–443. Reproduce with `python3 scripts/analyze_qvm_posture.py`; check with `python3 scripts/test_qvm_posture.py`. Trace/sqrt results are supplied and only selected state transfers into consumers; native collision/callees/full runtime remain open.

scripts/analyze_qvm_ground.py

@@ -25,12 +25,16 @@ def contents_probe(ins,height,returns):
     return {'height_word':height,'supplied_contents_words':returns,'sample_point_float_words':points,'calls':calls,'result_contents_word':m[FRAME+208]&0xffffffff,'result_level_word':m[FRAME+212],**trace_fields({'trace':trace},False)}
 
 
-def ground_probe(ins,allsolid=0,recovered=1,fraction=.5,normal_z=1,velocity_z=0,level=0,oldground=7,psflags=0,surface=0,previous_z=0,forward=1):
+def ground_probe(ins,allsolid=0,recovered=1,fraction=.5,normal_z=1,velocity_z=0,level=0,oldground=7,psflags=0,surface=0,previous_z=0,forward=1,bounds=None):
     record=[allsolid,0,word(fraction),word(100),word(200),word(299.75),0,0,word(normal_z),0,0,surface,0,8];m={35024032:FRAME,FRAME:PS,PS+20:word(100),PS+24:word(200),PS+28:word(300),PS+32:0,PS+36:0,PS+40:word(velocity_z),PS+140:7,PS+68:oldground,PS+12:psflags,PS+16:99,FRAME+28:0x2010001,FRAME+224:-25,FRAME+32:0,FRAME+212:level,35023940:11,35023936:22,35024024:word(previous_z)}
     for i,w in enumerate(record):m[GROUND_LOCAL+36+i*4]=w
+    if bounds is not None:
+        for i,w in enumerate(bounds):m[FRAME+184+i*4]=w
     # Trace output words are supplied before the callback boundary; its actual
     # implementation/pointer conversion/physics effects are not evaluated.
-    pre=trace_slice(ins,46774,47215,m,{},stop_targets=[46847],local_base=GROUND_LOCAL,limit=512);m=pre['memory'];point=[m[GROUND_LOCAL+92+i*4]&0xffffffff for i in range(3)];post=trace_slice(ins,46774,47215,m,{},resume_at=46847,call_results={46858:recovered},byte_memory={FRAME+25:forward&255},local_base=GROUND_LOCAL,limit=1024);m=post['memory'];p={'allsolid_word':allsolid,'supplied_recovery_word':recovered,'fraction_float_word':word(fraction),'normal_z_float_word':word(normal_z),'velocity_z_float_word':word(velocity_z),'level_word':level,'old_ground_word':oldground,'initial_ps_flags_word':psflags,'surface_word':surface,'previous_z_float_word':word(previous_z),'forward_word':forward,'trace_record_words':record,'trace_request':pre['calls'],'trace_end_float_words':point,'copied_trace_words':[m[35023944+i*4]&0xffffffff for i in range(14)],'classification_calls':post['calls'],'result_plane_word':m[35023940],'result_walk_word':m[35023936],'result_surface_word':m[35023988],'result_ground_word':m[PS+68],'result_ps_flags_word':m[PS+12]&0xffffffff,'result_timer_word':m[PS+16],**trace_fields({'trace':pre['trace']+post['trace']},False)};return p
+    pre=trace_slice(ins,46774,47215,m,{},stop_targets=[46847],local_base=GROUND_LOCAL,limit=512);m=pre['memory'];point=[m[GROUND_LOCAL+92+i*4]&0xffffffff for i in range(3)];post=trace_slice(ins,46774,47215,m,{},resume_at=46847,call_results={46858:recovered},byte_memory={FRAME+25:forward&255},local_base=GROUND_LOCAL,limit=1024);m=post['memory'];p={'allsolid_word':allsolid,'supplied_recovery_word':recovered,'fraction_float_word':word(fraction),'normal_z_float_word':word(normal_z),'velocity_z_float_word':word(velocity_z),'level_word':level,'old_ground_word':oldground,'initial_ps_flags_word':psflags,'surface_word':surface,'previous_z_float_word':word(previous_z),'forward_word':forward,'trace_record_words':record,'trace_request':pre['calls'],'trace_end_float_words':point,'copied_trace_words':[m[35023944+i*4]&0xffffffff for i in range(14)],'classification_calls':post['calls'],'result_plane_word':m[35023940],'result_walk_word':m[35023936],'result_surface_word':m[35023988],'result_ground_word':m[PS+68],'result_ps_flags_word':m[PS+12]&0xffffffff,'result_timer_word':m[PS+16],**trace_fields({'trace':pre['trace']+post['trace']},False)}
+    if bounds is not None:p['trace_bounds_float_words']=[pre['memory'][FRAME+184+i*4]&0xffffffff for i in range(6)]
+    return p
 
 
 def bridge_probe(ins,constants,returns,slope,surface):

scripts/analyze_qvm_posture.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+"""Bounded posture bounds/transitions and scalar consumer bridges."""
+import itertools
+import json
+import math
+from pathlib import Path
+from analyze_bsp_references import trace_fields
+from analyze_deferred_auth import trace_slice
+from analyze_qvm import decode,write_json
+from analyze_qvm_acceleration import FRAME,PS,word,number,scale_probe
+from analyze_qvm_ground import contents_probe,ground_probe
+from analyze_vm_extensions import verified
+
+LOCAL=0x47000000
+
+
+def posture_probe(ins,kind=0,special=0,up=0,flags=0,level=0,timer=0,ground=7,allsolid=0,animation=0,meter=4000,velocity=(0,0,0)):
+    m={35024032:FRAME,FRAME:PS,PS+4:kind,FRAME+240:special,PS+12:flags,FRAME+212:level,PS+72:timer,PS+68:ground,PS+184:meter,PS+76:animation,PS+92:123,PS+164:123,PS+104:0x1235,PS+140:7,FRAME+28:0x2010001,FRAME+224:-25,PS+20:word(100),PS+24:word(200),PS+28:word(300)}
+    for i,v in enumerate(velocity):m[PS+32+i*4]=word(v)
+    for o in range(44,100,4):m[LOCAL+o]=0
+    m[LOCAL+44]=allsolid;root=word(math.sqrt(velocity[0]**2+velocity[1]**2));pre=trace_slice(ins,47423,47882,m,{},byte_memory={FRAME+27:up&255},stop_targets=[47717],call_results={47849:root},local_base=LOCAL,limit=1024);t=pre;trace_bounds=None
+    if pre['stop']==47717:
+        trace_bounds=[pre['memory'][FRAME+184+i*4]&0xffffffff for i in range(6)];post=trace_slice(ins,47423,47882,pre['memory'],{},resume_at=47717,byte_memory=pre['byte_memory'],call_results={47849:root},local_base=LOCAL,limit=1024);t=post;calls=pre['calls']+post['calls'];trace=pre['trace']+post['trace']
+    else:calls=pre['calls'];trace=pre['trace']
+    mem=t['memory'];return {'type_word':kind,'special_word':special,'up_byte':up&255,'initial_ps_flags_word':flags,'level_word':level,'initial_timer_word':timer,'ground_word':ground,'supplied_allsolid_word':allsolid,'animation_word':animation,'initial_meter_word':meter,'velocity_float_words':[word(v) for v in velocity],'supplied_sqrt_word':root,'bounds_float_words':[mem[FRAME+184+i*4]&0xffffffff for i in range(6)],'result_viewheight_word':mem[PS+164],'result_ps_flags_word':mem[PS+12]&0xffffffff,'result_timer_word':mem[PS+72],'result_meter_word':mem[PS+184],'result_field92_word':mem[PS+92],'result_entity_flags_word':mem[PS+104]&0xffffffff,'stand_trace_bounds_float_words':trace_bounds,'calls':calls,**trace_fields({'trace':trace},False)}
+
+
+def bridge_probe(ins,kwargs,returns,slope):
+    posture=posture_probe(ins,**kwargs);contents=contents_probe(ins,posture['result_viewheight_word'],returns);ground=ground_probe(ins,level=contents['result_level_word'],normal_z=slope,psflags=posture['result_ps_flags_word'],bounds=posture['bounds_float_words']);scale=scale_probe(ins,81,0,0,256,posture['result_meter_word']);return {'posture_probe':posture,'contents_probe':contents,'ground_probe':ground,'scale_probe':scale}
+
+
+def main():
+    r=json.loads(Path('docs/research/qvm/qagame.json').read_text());data=verified(Path(r['source']['member']['output']).read_bytes(),r['sha256']);_,ins=decode(data);probes=[posture_probe(ins,*v) for v in itertools.product([0,3],[0,1],[-1,0],[0,1,2,5,12],[0,2],[0,1],[7,1023])]
+    probes += [posture_probe(ins,flags=1,level=l,ground=g,timer=t,allsolid=s,animation=a) for l,g,t,s,a in itertools.product([0,2],[7,1023],[0,1],[0,1],[0,25,153])];probes += [posture_probe(ins,up=-1,meter=m) for m in [0,2999,3000,4000]];probes += [posture_probe(ins,up=u,flags=flags,timer=1,velocity=v) for v,u,flags in itertools.product([(0,0,0),(299,0,0),(300,0,0),(0,300,0),(180,240,0),(0,0,400)],[-11,-10,-9,0],[0,1])]
+    variants=[{}, {'kind':3}, {'up':-1}, {'animation':25}, {'flags':1,'allsolid':1}, {'flags':1,'allsolid':0}, {'up':-1,'meter':2999}, {'up':-1,'meter':2999,'ground':1023}];out={'source':r['source'],'sha256':r['sha256'],'instructions':ins[47422:47884],'posture_probes':probes,'bridge_probes':[bridge_probe(ins,*v) for v in itertools.product(variants,[(0,8,8),(8,0,8),(8,8,8)],[.5,1])],'limitations':'Bounded synthetic shipped-QVM slices only; no full QVM/original process/native trace/collision executes. Stand-up trace record word0 and sqrt return supplied; other trace fields zero-seeded but not consumed. Helper39525 requests recorded with omitted effects. Bridges transfer bounds/viewheight/PS flags/resource scalars into prior supplied-content/ground-trace/scale probes; callbacks/callee effects/full frame/state/physics omitted. Numeric posture/type/animation/resource/flag meanings and legal domains, native ABI and runtime/platform compatibility remain open.'};write_json(Path('docs/research/qvm-posture.json'),out);print('Recovered bounded posture bounds transitions and scalar consumer bridges')
+
+
+if __name__=='__main__':main()

scripts/test_qvm_posture.py

@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Independent posture transition and scalar handoff checks."""
+import hashlib
+import json
+from pathlib import Path
+import math
+import unittest
+from test_qvm_ground import word,n,f,ground_oracle
+from test_qvm_acceleration import scale_oracle
+
+
+def oracle(p):
+    flags=p['initial_ps_flags_word'];timer=p['initial_timer_word'];meter=p['initial_meter_word'];field92=123;ef=0x1235;top=45;height=-16;calls=[];query=False
+    if p['type_word']==3 or p['special_word']:
+        return flags,timer,meter,field92,ef,top,height,calls,query
+    up=p['up_byte'] if p['up_byte']<128 else p['up_byte']-256
+    enter=(up<0 or flags&2) and not flags&12 and p['level_word']<=1 and timer==0
+    if enter:
+        if not flags&1:
+            if p['ground_word']!=1023:meter=max(0,int(f(f(meter)-3000)))
+            calls.append((39525,{'8':36}));timer=200
+        flags|=1
+    elif flags&1 and (p['ground_word']!=1023 or p['level_word']>1) and timer==0:
+        query=True;calls.append((-25,{'8':0x4700002c,'12':0x10014,'16':0x300b8,'20':0x300c4,'24':0x10014,'28':7,'32':0x2010001}))
+        if not p['supplied_allsolid_word']:
+            flags&=~1;field92=0;calls.append((39525,{'8':37}));timer=200
+    if flags&1:top,height=24,20
+    elif p['animation_word']&~128==25:top,height=10,-5
+    else:top,height=45,38
+    x,y,_=map(n,p['velocity_float_words']);square=f(f(x*x)+f(y*y));root=f(math.sqrt(square));calls.append((-107,{'8':word(square)}))
+    if root<300 or up>-10:ef&=~1
+    return flags,timer,meter,field92,ef,top,height,calls,query
+
+
+class QvmPostureTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-posture.json').read_text())
+
+    def test_every_transition_against_independent_oracle(self):
+        self.assertEqual(len(self.r['posture_probes']),420)
+        for p in self.r['posture_probes']:
+            flags,timer,meter,v92,ef,top,height,calls,query=oracle(p)
+            self.assertEqual([p['result_ps_flags_word'],p['result_timer_word'],p['result_meter_word'],p['result_field92_word'],p['result_entity_flags_word'],p['result_viewheight_word']],[flags,timer,meter,v92,ef,height]);self.assertEqual(p['bounds_float_words'],list(map(word,[-15,-15,-24,15,15,top])));self.assertEqual([(c['target'],c['args']) for c in p['calls']],calls)
+
+    def test_standing_query_uses_tentative_full_height(self):
+        queries=[p for p in self.r['posture_probes'] if oracle(p)[-1]];self.assertTrue(queries)
+        for p in self.r['posture_probes']:
+            self.assertEqual(p['stand_trace_bounds_float_words'],list(map(word,[-15,-15,-24,15,15,45])) if oracle(p)[-1] else None)
+        self.assertTrue(any(p['supplied_allsolid_word'] and p['bounds_float_words'][-1]==word(24) for p in queries))
+
+    def test_early_modes_skip_calls_and_final_flag_policy(self):
+        rows=[p for p in self.r['posture_probes'] if p['type_word']==3 or p['special_word']];self.assertTrue(rows)
+        for p in rows:self.assertEqual(p['calls'],[]);self.assertEqual(p['result_viewheight_word'],-16);self.assertEqual(p['result_entity_flags_word'],0x1235)
+
+    def test_resource_charge_clamp_and_animation_toggle(self):
+        rows=self.r['posture_probes']
+        for meter,result in [(0,0),(2999,0),(3000,0),(4000,1000)]:
+            self.assertTrue(any(p['initial_meter_word']==meter and p['result_meter_word']==result and p['result_timer_word']==200 and not p['initial_ps_flags_word']&1 and p['up_byte']==255 for p in rows))
+        for animation in [25,153]:self.assertTrue(any(p['animation_word']==animation and p['result_viewheight_word']==-5 and p['bounds_float_words'][-1]==word(10) for p in rows))
+
+    def test_horizontal_speed_and_signed_up_boundaries(self):
+        rows=[p for p in self.r['posture_probes'] if p['initial_timer_word']==1 and not p['type_word'] and not p['special_word']]
+        for p in rows:
+            x,y,_=map(n,p['velocity_float_words']);self.assertEqual(p['supplied_sqrt_word'],word(math.sqrt(x*x+y*y)));self.assertEqual(p['result_entity_flags_word'],oracle(p)[4])
+        for speed,up,retained in [(299,-10,False),(300,-10,True),(300,-9,False)]:self.assertTrue(any(n(p['velocity_float_words'][0])==speed and p['up_byte']==up&255 and bool(p['result_entity_flags_word']&1)==retained for p in rows))
+
+    def test_bounds_height_flags_and_resource_consumer_handoffs(self):
+        self.assertEqual(len(self.r['bridge_probes']),48)
+        for b in self.r['bridge_probes']:
+            p,c,g,s=[b[k] for k in ['posture_probe','contents_probe','ground_probe','scale_probe']];self.assertEqual(c['height_word'],p['result_viewheight_word']);self.assertEqual(g['trace_bounds_float_words'],p['bounds_float_words']);self.assertEqual(g['initial_ps_flags_word'],p['result_ps_flags_word']);self.assertEqual(g['level_word'],c['result_level_word']);self.assertEqual(s['meter_word'],p['result_meter_word']);self.assertEqual(g['result_walk_word'],ground_oracle(g)[1]);self.assertEqual(s['result_scale_float_word'],scale_oracle(s))
+
+    def test_source_hash_and_complete_helper_partition(self):
+        q=json.loads(Path('docs/research/qvm/qagame.json').read_text());self.assertEqual(self.r['source'],q['source']);self.assertEqual(hashlib.sha256(Path(q['source']['member']['output']).read_bytes()).hexdigest(),self.r['sha256']);self.assertEqual(self.r['instructions'][0]['index'],47422);self.assertEqual(self.r['instructions'][-1]['index'],47883)
+
+    def test_external_effects_and_partial_scope_are_explicit(self):
+        for text in ['no full QVM/original process/native trace/collision executes','sqrt return supplied','Helper39525 requests recorded with omitted effects','full frame/state/physics omitted']:self.assertIn(text,self.r['limitations'])
+
+
+if __name__=='__main__':unittest.main()