qvm: recover temporary event constructor

docs/FINDINGS.md

@@ -1553,3 +1553,6 @@ RE-813–822 replaces the scoreboard decimal assumption with actual37914 executi
 
 
 **RE-851:** Rust matches 48 original normal-reset cases with separate pre-map score reset and post-map connection transition APIs. The adapter captures a no-op map child; production callers can apply its real mutations between stages. Safe count errors preserve state, and pending/phase/series data remain unchanged. [Evidence](research/RUST_NEXTMAP_RESET.md).
+
+
+**RE-852:** 144 original 277695/278138 cases recover tempEntity metadata, wrapped event kind+19, CVFI/CVIF origin snapping, trajectory/current-origin writes and link order. Five invalid float domains reject. Allocator flags424 and caller-owned84/140 are preserved; allocation277165 and native linking remain supplied/captured. [Evidence](research/QVM_EVENT_CONSTRUCT.md).

docs/PROVISIONAL_TODO.md

@@ -1572,3 +1572,6 @@ RE-850: 48 original 6939 suffix cases recover round/blocked/global score clears,
 
 
 RE-851: Rust matches 48 original normal-reset cases with separate pre-map score reset and post-map connection transition APIs. The adapter captures a no-op map child; production callers can apply its real mutations between stages. Safe count errors preserve state, and pending/phase/series data remain unchanged. Full runtime completion remains open. [Evidence](research/RUST_NEXTMAP_RESET.md).
+
+
+RE-852: 144 original 277695/278138 cases recover tempEntity metadata, wrapped event kind+19, CVFI/CVIF origin snapping, trajectory/current-origin writes and link order. Five invalid float domains reject. Allocator flags424 and caller-owned84/140 are preserved; allocation277165 and native linking remain supplied/captured. Full runtime completion remains open. [Evidence](research/QVM_EVENT_CONSTRUCT.md).

docs/RESEARCH_LEDGER.md

@@ -1933,3 +1933,8 @@ Rust matches 300 original series-branch cases, reusing the verified mode classif
 ## 2026-10-27 — RE-851 Rust staged normal map reset policy
 
 Rust matches 48 original normal-reset cases with separate pre-map score reset and post-map connection transition APIs. The adapter captures a no-op map child; production callers can apply its real mutations between stages. Safe count errors preserve state, and pending/phase/series data remain unchanged. Focused `cargo xtask test-group rust-nextmap-reset` passes (9 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.
+
+
+## 2026-10-27 — RE-852 Original temporary event construction and origin snapping
+
+144 original 277695/278138 cases recover tempEntity metadata, wrapped event kind+19, CVFI/CVIF origin snapping, trajectory/current-origin writes and link order. Five invalid float domains reject. Allocator flags424 and caller-owned84/140 are preserved; allocation277165 and native linking remain supplied/captured. Focused `cargo xtask test-group event-construct` passes (5 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1609,3 +1609,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-851 Rust staged normal map reset policy ([evidence](research/RUST_NEXTMAP_RESET.md)).
+
+
+- [x] RE-852 Original temporary event construction and origin snapping ([evidence](research/QVM_EVENT_CONSTRUCT.md)).

docs/research/QVM_EVENT_CONSTRUCT.md

@@ -0,0 +1,7 @@
+# Original temporary event construction and origin snapping
+
+RE-852. Reproduce with `python3 scripts/analyze_qvm_event_construct.py`; focused validation: `cargo xtask test-group event-construct`. [Machine report](qvm-event-construct.json).
+
+144 original 277695/278138 cases recover tempEntity metadata, wrapped event kind+19, CVFI/CVIF origin snapping, trajectory/current-origin writes and link order. Five invalid float domains reject. Allocator flags424 and caller-owned84/140 are preserved; allocation277165 and native linking remain supplied/captured.
+
+Original executable/native runtime and complete Linux/macOS Rust/Bevy/Solari acceptance remain unverified.

docs/research/README.md

@@ -1147,3 +1147,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-851: Rust staged normal map reset policy](RUST_NEXTMAP_RESET.md).
+
+
+[RE-852: Original temporary event construction and origin snapping](QVM_EVENT_CONSTRUCT.md).

scripts/analyze_qvm_event_construct.py

@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+import itertools
+from pathlib import Path
+from qvm_research_support import source
+from qvm_transition_support import run,vector,ENTITY,T
+from analyze_qvm_acceleration import word
+from analyze_qvm import write_json
+FIELDS=[4,12,16,20,24,28,32,36,40,44,84,140,400,424,488,492,496,536,540,568,572]
+S=T+0x7000
+VECTORS=[[word(v) for v in row] for row in [[1.9,-1.9,-0.0],[0,0,0],[-2147483648,2147483520,16777215],[123.999,-.001,-1024.75]]]
+
+def construct(ins,origin,kind,now,flags):
+ m={ENTITY+o:0x13579bdf for o in range(0,880,4)};m[ENTITY+424]=flags;m[34992532]=now;vector(m,S,origin);requests=[];child=None
+ def allocate(i,m,a):requests.append({'target':277165,'arguments':a});return m,ENTITY,{'allocation_supplied':True}
+ def set_origin(i,m,a):
+  nonlocal child
+  requests.append({'target':278138,'arguments':a});m,child=run(i,m,278138,278199,16,a,base=T+0x2000);return m,0,{'actual_source_child':278138,'execution':child['execution']}
+ def link(i,m,a):requests.append({'target':-31,'arguments':a});return m,0,{'link_captured':True}
+ m,p=run(ins,m,277695,277777,36,{8:S,12:kind},handlers={277165:allocate,278138:set_origin,-31:link});p.update(input=dict(origin=origin,kind=kind,now=now,flags=flags),fields={str(o):m[ENTITY+o]&0xffffffff for o in FIELDS},requests=requests,child_execution=child['execution']);return p
+
+def main():
+ q,raw,h,ins=source();rows=[construct(ins,v,k,n,f) for v,k,n,f in itertools.product(VECTORS,[-1,0,69,2147483647],[-2147483648,0,2147483647],[0,16,0xffffffff])];rejected=[]
+ for bits in [0x7fc00000,0x7f800000,0xff800000,0x4f000000,0xcf000001]:
+  try:construct(ins,[bits,0,0],69,1000,16)
+  except ValueError as e:rejected.append({'origin':[bits,0,0],'error':str(e)})
+  else:raise AssertionError('unsupported CVFI domain accepted')
+ start=h['data_offset']+97191;name=raw[start:raw.index(b'\0',start)].decode('ascii')
+ write_json(Path('docs/research/qvm-event-construct.json'),{'source':q['source'],'sha256':q['sha256'],'classname':name,'probes':rows,'rejections':rejected,'limits':'Actual277695 and actual278138 over144 coherent cases plus5 rejected CVFI domains. Allocator277165 pointer supplied; syscall-31 linking captured. Constructor preserves allocator flags424 and caller-owned84/140. Origin snaps by CVFI/CVIF, metadata writes568 clock and572 one. Allocation/native linking and runtime ownership remain open.'})
+if __name__=='__main__':main()

scripts/test_qvm_event_construct.py

@@ -0,0 +1,15 @@
+import json,math,unittest
+from pathlib import Path
+from analyze_qvm_acceleration import word,number
+from qvm_transition_support import ENTITY,T
+class EventTests(unittest.TestCase):
+ def test_exact_constructor_metadata_and_snapped_words(self):
+  r=json.loads(Path('docs/research/qvm-event-construct.json').read_text());self.assertEqual(len(r['probes']),144);self.assertEqual(r['classname'],'tempEntity')
+  for p in r['probes']:
+   a=p['input'];f={str(o):0 for o in [12,16,20,36,40,44]};snap=[word(math.trunc(number(v))) for v in a['origin']];f.update({str(o+4*j):v for o in [24,488] for j,v in enumerate(snap)});f.update({'4':(a['kind']+19)&0xffffffff,'536':97191,'540':662184166,'568':a['now']&0xffffffff,'572':1,'424':a['flags'],'84':0x13579bdf,'140':0x13579bdf,'400':0x13579bdf});self.assertEqual(p['fields'],f);self.assertEqual(p['return'],ENTITY)
+ def test_source_child_abi_write_scope_and_invalid_domains(self):
+  r=json.loads(Path('docs/research/qvm-event-construct.json').read_text());self.assertEqual(len(r['rejections']),5);allowed={4,12,16,20,24,28,32,36,40,44,488,492,496,536,540,568,572}
+  for v in r['rejections']:self.assertIn('conversion outside bounded float domain',v['error'])
+  for p in r['probes']:
+   self.assertEqual(p['requests'],[{'target':277165,'arguments':{}},{'target':278138,'arguments':{'8':ENTITY,'12':T+20}},{'target':-31,'arguments':{'8':ENTITY}}]);self.assertTrue(all(v['address']-ENTITY in allowed for v in p['changes']));self.assertEqual(p['child_execution']['stop'],278199)
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -2316,3 +2316,7 @@ report	scripts/analyze_rust_nextmap_reset.py	docs/research/rust-nextmap-reset.js
 edge	docs/research/rust-nextmap-reset.json	scripts/test_rust_nextmap_reset.py
 group	rust-nextmap-reset	scripts/analyze_rust_nextmap_reset.py
 edge	scripts/analyze_rust_nextmap_reset.py	scripts/analyze_qvm_resumer_audit.py
+report	scripts/analyze_qvm_event_construct.py	docs/research/qvm-event-construct.json
+edge	docs/research/qvm-event-construct.json	scripts/test_qvm_event_construct.py
+group	event-construct	scripts/analyze_qvm_event_construct.py
+edge	scripts/analyze_qvm_event_construct.py	scripts/analyze_qvm_resumer_audit.py