qvm: recover session and ignore-list serialization

docs/FINDINGS.md

@@ -1661,3 +1661,6 @@ RE-813–822 replaces the scoreboard decimal assumption with actual37914 executi
 
 
 **RE-887:** Rust matches128 original continuous camera/queried-fallback/placement cases, including exact query order and primary-camera bypass. Spatial callbacks use the same recovered box/filter policy as standalone fallback. Existing camera/spawn APIs retain their contracts; native broadphase/math and complete respawn/intermission remain open. [Evidence](research/RUST_QUERIED_CAMERA.md).
+
+
+**RE-888:** 60 actual246963 cases execute original70458/37914 integer formatting and70031/36038/69338 bounded concatenation. Five raw integers and four normalized booleans populate sessionN; sessIgnoreN follows entity client-pointer indirection, accepts flag exactly1, keeps duplicates, caps scan64 and truncates to127 bytes. Includes negative/oversized counts, two slots, INT_MIN formatter behavior and saturation. Native memset/strncpy are modeled and engine cvar writes captured; restore/engine persistence remain open. [Evidence](research/QVM_SESSION_WRITE.md).

docs/PROVISIONAL_TODO.md

@@ -1692,3 +1692,6 @@ RE-886: 128 coherent6717/168114/167638/6575 cases execute box construction and c
 
 
 RE-887: Rust matches128 original continuous camera/queried-fallback/placement cases, including exact query order and primary-camera bypass. Spatial callbacks use the same recovered box/filter policy as standalone fallback. Existing camera/spawn APIs retain their contracts; native broadphase/math and complete respawn/intermission remain open. Full runtime completion remains open. [Evidence](research/RUST_QUERIED_CAMERA.md).
+
+
+RE-888: 60 actual246963 cases execute original70458/37914 integer formatting and70031/36038/69338 bounded concatenation. Five raw integers and four normalized booleans populate sessionN; sessIgnoreN follows entity client-pointer indirection, accepts flag exactly1, keeps duplicates, caps scan64 and truncates to127 bytes. Includes negative/oversized counts, two slots, INT_MIN formatter behavior and saturation. Native memset/strncpy are modeled and engine cvar writes captured; restore/engine persistence remain open. Full runtime completion remains open. [Evidence](research/QVM_SESSION_WRITE.md).

docs/RESEARCH_LEDGER.md

@@ -2145,3 +2145,8 @@ Rust matches64 original168114/167638 compositions and their ordered box query tr
 ## 2026-10-28 — RE-887 Rust camera with lazy spatial queries
 
 Rust matches128 original continuous camera/queried-fallback/placement cases, including exact query order and primary-camera bypass. Spatial callbacks use the same recovered box/filter policy as standalone fallback. Existing camera/spawn APIs retain their contracts; native broadphase/math and complete respawn/intermission remain open. Focused `cargo xtask test-group rust-queried-camera` passes (13 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.
+
+
+## 2026-10-28 — RE-888 Original session and ignore-list cvar serialization
+
+60 actual246963 cases execute original70458/37914 integer formatting and70031/36038/69338 bounded concatenation. Five raw integers and four normalized booleans populate sessionN; sessIgnoreN follows entity client-pointer indirection, accepts flag exactly1, keeps duplicates, caps scan64 and truncates to127 bytes. Includes negative/oversized counts, two slots, INT_MIN formatter behavior and saturation. Native memset/strncpy are modeled and engine cvar writes captured; restore/engine persistence remain open. Focused `cargo xtask test-group qvm-session-write` passes (4 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1729,3 +1729,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-887 Rust camera with lazy spatial queries ([evidence](research/RUST_QUERIED_CAMERA.md)).
+
+
+- [x] RE-888 Original session and ignore-list cvar serialization ([evidence](research/QVM_SESSION_WRITE.md)).

docs/research/QVM_SESSION_WRITE.md

@@ -0,0 +1,7 @@
+# Original session and ignore-list cvar serialization
+
+RE-888. Reproduce with `python3 scripts/analyze_qvm_session_write.py`; focused validation: `cargo xtask test-group qvm-session-write`. [Machine report](qvm-session-write.json).
+
+60 actual246963 cases execute original70458/37914 integer formatting and70031/36038/69338 bounded concatenation. Five raw integers and four normalized booleans populate sessionN; sessIgnoreN follows entity client-pointer indirection, accepts flag exactly1, keeps duplicates, caps scan64 and truncates to127 bytes. Includes negative/oversized counts, two slots, INT_MIN formatter behavior and saturation. Native memset/strncpy are modeled and engine cvar writes captured; restore/engine persistence remain open.
+
+Original executable/native runtime and complete Linux/macOS Rust/Bevy/Solari acceptance remain unverified.

docs/research/README.md

@@ -1264,3 +1264,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-887: Rust camera with lazy spatial queries](RUST_QUERIED_CAMERA.md).
+
+
+[RE-888: Original session and ignore-list cvar serialization](QVM_SESSION_WRITE.md).

scripts/analyze_qvm_session_write.py

@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+"""Execute the verified original QVM body; native effects are supplied or captured."""
+import itertools
+from pathlib import Path
+from qvm_research_support import source,constants
+from qvm_camera_world_support import B,run
+from qvm_exit_rules_support import POOL,CPOOL
+from analyze_qvm_acceleration import word,number
+from analyze_qvm import write_json
+
+def main():
+ q,raw,h,ins=source();rows=[]
+ from qvm_session_support import environment,records,session
+ for count,slot,profile,mapping in itertools.product([-1,0,8,64,80],[0,3],range(3),range(2)):
+  m,b=environment(raw,h);values,indices,flags=records(m,slot,count,profile,mapping);m,p,b=session(ins,m,b,CPOOL+6336*slot);p.update(input=dict(count=count,slot=slot,profile=profile,mapping=mapping,values=values,indices=indices,flags=flags),ring=m[23708]&0xffffffff);rows.append(p)
+
+ write_json(Path('docs/research/qvm-session-write.json'),{'source':q['source'],'sha256':q['sha256'],'root':246963,'probes':rows,'limits':'60 actual246963 cases execute original70458/37914 integer formatting and70031/36038/69338 bounded concatenation. Five raw integers and four normalized booleans populate sessionN; sessIgnoreN follows entity client-pointer indirection, accepts flag exactly1, keeps duplicates, caps scan64 and truncates to127 bytes. Includes negative/oversized counts, two slots, INT_MIN formatter behavior and saturation. Native memset/strncpy are modeled and engine cvar writes captured; restore/engine persistence remain open.'})
+if __name__=='__main__':main()

scripts/qvm_session_support.py

@@ -0,0 +1,32 @@
+"""Actual246963 session cvars, formatter and bounded ignore-list concatenation."""
+from qvm_camera_world_support import B,POOL,run
+from qvm_exit_rules_support import CPOOL
+from qvm_formatter_support import formatter_env,formatter,image_bytes
+from qvm_scoreboard_wire_support import final_format
+from qvm_string_memory_support import cstring,strlen,copy_bounded
+from qvm_map_commands_support import put_string
+FIELDS=[3096,3156,3144,3140,3148,3152,3708,3712,3740]
+BASE=B+0x18000
+def environment(raw,h):
+ m,b=formatter_env(raw,h);m[23708]=0
+ from qvm_byte_memory_support import write_bytes
+ write_bytes(m,b,{a:raw[h['data_offset']+a] for a in range(83632,83728)})
+ return m,b
+def records(m,slot,count,profile,mapping):
+ values=[[0]*9,[-2147483648,2147483647,-1,17,-21,-1,0,2,-2147483648],[3,-7,99,101,-103,0,1,-1,4]][profile];p=CPOOL+6336*slot;m.update({34992496:CPOOL,34992524:count})
+ for o,v in zip(FIELDS,values):m[p+o]=v
+ indices=[j if mapping==0 else j%3 for j in range(64)];flags=[1 if profile==0 else [0,1,2,-1][j%4] for j in range(64)]
+ for j in range(64):m[POOL+880*j+520]=CPOOL+6336*indices[j];m[p+3780+4*j]=flags[j]
+ return values,indices,flags
+def session(ins,m,b,pointer):
+ sets=[];formats=[];warnings=[]
+ def fmt(i,m,a,bs):
+  m,v,p=final_format(i,m,a,dict(bs),formatter);formats.append(p['wrapper_trace_sha256']);return m,v,p
+ def set_cvar(i,m,a,bs):sets.append([cstring(m,bs,a[8]).hex(),cstring(m,bs,a[12]).hex()]);return m,0,{'engine_cvar_set_captured':True}
+ def zero(i,m,a,bs):
+  assert a[12]==0 and a[16]==128
+  return m,a[8],{'native_memset_modeled':True,'child_memory_bytes':{a[8]+j:0 for j in range(a[16])}}
+ def warning(i,m,a,bs):warnings.append(a);return m,0,{'diagnostic_captured':True}
+ def append(i,m,a,bs):
+  m,v,p,b=run(i,m,70031,70073,32,a,dict(bs),{36038:strlen,69338:copy_bounded,5096:warning},base=B+0x1a000);return m,0,{'actual_source_child':70031}
+ m,v,p,b=run(ins,m,246963,247217,224,{8:pointer},b,{70458:fmt,-6:set_cvar,-101:zero,70031:append},base=BASE);p.update(sets=sets,formats=formats,warnings=warnings);return m,p,b

scripts/test_qvm_session_write.py

@@ -0,0 +1,14 @@
+import json,unittest
+from pathlib import Path
+class OriginalTests(unittest.TestCase):
+ def test_instruction_results(self):
+  rows=json.loads(Path('docs/research/qvm-session-write.json').read_text())['probes']
+  self.assertEqual(len(rows),60)
+  def dec(v):
+   if v!=-2147483648:return str(v).encode()
+   return b'-./,),(-*,('
+  for p in rows:
+   a=p['input'];fields=a['values'][:5]+[int(v!=0) for v in a['values'][5:]];value=b','.join(dec(v) for v in fields);ignored=[j for j in a['indices'][:max(0,min(a['count'],64))] if a['flags'][j]==1];text=b''.join(str(j).encode()+b',' for j in ignored)[:127];self.assertEqual(p['sets'],[[f"session{a['slot']}".encode().hex(),value.hex()],[f"sessIgnore{a['slot']}".encode().hex(),text.hex()]]);self.assertEqual(p['ring'],3+len(ignored));self.assertEqual(len(p['formats']),p['ring']);self.assertFalse(p['warnings'])
+  self.assertTrue(any(len(bytes.fromhex(p['sets'][1][1]))==127 for p in rows))
+
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -2648,3 +2648,8 @@ report	scripts/analyze_rust_queried_camera.py	docs/research/rust-queried-camera.
 edge	docs/research/rust-queried-camera.json	scripts/test_rust_queried_camera.py
 group	rust-queried-camera	scripts/analyze_rust_queried_camera.py
 edge	scripts/analyze_rust_queried_camera.py	scripts/analyze_qvm_resumer_audit.py
+report	scripts/analyze_qvm_session_write.py	docs/research/qvm-session-write.json
+edge	docs/research/qvm-session-write.json	scripts/test_qvm_session_write.py
+group	qvm-session-write	scripts/analyze_qvm_session_write.py
+edge	scripts/analyze_qvm_session_write.py	scripts/analyze_qvm_resumer_audit.py
+edge	scripts/qvm_session_support.py	scripts/analyze_qvm_resumer_audit.py