qvm: recover override map command bytes

docs/FINDINGS.md

@@ -1607,3 +1607,6 @@ RE-813–822 replaces the scoreboard decimal assumption with actual37914 executi
 
 
 **RE-869:** Rust matches192 original rotation cases, preserving signed cursor wrap, enable/threshold gating, refreshed filename C-string handling and ordered refresh/write/clear/reset intentions. Engine refresh input is explicit; invalid refreshed data rejects before boundary mutations. Native callbacks remain unimplemented. [Evidence](research/RUST_ROTATION_ADVANCE.md).
+
+
+**RE-870:** 90 original7188 cases compose actual strlen, bounded-copy wrapper and original formatter. A nonempty override mirror records current engine mapname in g_nextCycleMap, copies the override into a127-byte local command buffer, requests engine g_NextMap clear and emits mode2 map command. VM mirror bytes remain unchanged; engine/native-copy and lower effects remain supplied/captured. [Evidence](research/QVM_MAP_SELECT.md).

docs/PROVISIONAL_TODO.md

@@ -1632,3 +1632,6 @@ RE-868: 192 original122230 cases execute actual strlen and recover signed counte
 
 
 RE-869: Rust matches192 original rotation cases, preserving signed cursor wrap, enable/threshold gating, refreshed filename C-string handling and ordered refresh/write/clear/reset intentions. Engine refresh input is explicit; invalid refreshed data rejects before boundary mutations. Native callbacks remain unimplemented. Full runtime completion remains open. [Evidence](research/RUST_ROTATION_ADVANCE.md).
+
+
+RE-870: 90 original7188 cases compose actual strlen, bounded-copy wrapper and original formatter. A nonempty override mirror records current engine mapname in g_nextCycleMap, copies the override into a127-byte local command buffer, requests engine g_NextMap clear and emits mode2 map command. VM mirror bytes remain unchanged; engine/native-copy and lower effects remain supplied/captured. Full runtime completion remains open. [Evidence](research/QVM_MAP_SELECT.md).

docs/RESEARCH_LEDGER.md

@@ -2046,3 +2046,8 @@ Rust matches128 continuous source camera/fallback/placement cases with shared RN
 ## 2026-10-27 — RE-869 Rust refreshed rotation callback policy
 
 Rust matches192 original rotation cases, preserving signed cursor wrap, enable/threshold gating, refreshed filename C-string handling and ordered refresh/write/clear/reset intentions. Engine refresh input is explicit; invalid refreshed data rejects before boundary mutations. Native callbacks remain unimplemented. Focused `cargo xtask test-group rust-rotation-advance` passes (9 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.
+
+
+## 2026-10-27 — RE-870 Original map command branch with recovered copy and formatter
+
+90 original7188 cases compose actual strlen, bounded-copy wrapper and original formatter. A nonempty override mirror records current engine mapname in g_nextCycleMap, copies the override into a127-byte local command buffer, requests engine g_NextMap clear and emits mode2 map command. VM mirror bytes remain unchanged; engine/native-copy and lower effects remain supplied/captured. Focused `cargo xtask test-group map-select` passes (5 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1669,3 +1669,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-869 Rust refreshed rotation callback policy ([evidence](research/RUST_ROTATION_ADVANCE.md)).
+
+
+- [x] RE-870 Original map command branch with recovered copy and formatter ([evidence](research/QVM_MAP_SELECT.md)).

docs/research/QVM_MAP_SELECT.md

@@ -0,0 +1,7 @@
+# Original map command branch with recovered copy and formatter
+
+RE-870. Reproduce with `python3 scripts/analyze_qvm_map_select.py`; focused validation: `cargo xtask test-group map-select`. [Machine report](qvm-map-select.json).
+
+90 original7188 cases compose actual strlen, bounded-copy wrapper and original formatter. A nonempty override mirror records current engine mapname in g_nextCycleMap, copies the override into a127-byte local command buffer, requests engine g_NextMap clear and emits mode2 map command. VM mirror bytes remain unchanged; engine/native-copy and lower effects remain supplied/captured.
+
+Original executable/native runtime and complete Linux/macOS Rust/Bevy/Solari acceptance remain unverified.

docs/research/README.md

@@ -1205,3 +1205,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-869: Rust refreshed rotation callback policy](RUST_ROTATION_ADVANCE.md).
+
+
+[RE-870: Original map command branch with recovered copy and formatter](QVM_MAP_SELECT.md).

scripts/analyze_qvm_map_select.py

@@ -0,0 +1,15 @@
+#!/usr/bin/env python3
+import itertools
+from pathlib import Path
+from qvm_research_support import source
+from qvm_map_commands_support import map_seed,select_map,MIRROR,D
+from qvm_byte_memory_support import read_bytes
+from qvm_string_memory_support import cstring
+from analyze_qvm import write_json
+
+def main():
+ q,raw,h,ins=source();rows=[]
+ for mirror,current,fallback in itertools.product([b'',b'cycle',b'\0tail',b'\xff',b'A'*129],[b'',b'abbey',b'x\0tail',b'\xff',b'z'*127,b'z'*128],[-1,0,1]):
+  m,b=map_seed(raw,h,mirror);guard=read_bytes(m,b,MIRROR+128,16);before=read_bytes(m,b,MIRROR,128);m,p,b=select_map(ins,m,b,current,fallback);commands=[v['text'] for v in p['operations'] if v['op']=='command'];p.update(input=dict(mirror=mirror.hex(),current=current.hex(),fallback=fallback),mirror=cstring(m,b,MIRROR).hex(),command=commands[0] if commands else None,buffer=read_bytes(m,b,MIRROR,128).hex(),buffer_before=before.hex(),local_buffer=read_bytes(m,b,D+0x2000+24,128).hex() if commands else None,guard_before=guard.hex(),guard_after=read_bytes(m,b,MIRROR+128,16).hex(),ring=m[23708]&0xffffffff);rows.append(p)
+ write_json(Path('docs/research/qvm-map-select.json'),{'source':q['source'],'sha256':q['sha256'],'probes':rows,'limits':'Actual7188 with actual36038/69338/70458/37914 over90 cases.128-byte engine buffer and native-103 strncpy remain supplied/modeled. Captured cvar sets and mode2 command;221662 return supplied. Override mirror gate, source-to-local copy and requested mapname/cvar strings verified; no native execution/runtime claim.'})
+if __name__=='__main__':main()

scripts/qvm_map_commands_support.py

@@ -28,3 +28,19 @@ def rotation(ins,m,b,updated):
             return m,0,{'external_effect_captured':True}
         return call
     m,v,p,b=run(ins,m,122230,122286,24,b=b,handlers={-5:refresh,36038:strlen,122143:capture(122143),-6:capture(-6),121987:capture(121987)},base=D);p.update(requests=requests,operations=operations);return m,p,b
+
+def map_seed(raw,h,mirror):
+    m,b=formatter_env(raw,h);m[23708]=0;put_string(m,b,34728,image_bytes(raw,h,34728).split(b'\0')[0]);put_string(m,b,MIRROR,mirror,256);return m,b
+
+def select_map(ins,m,b,current,fallback=0):
+    requests=[];operations=[];formatted=[]
+    def read(i,m,a,bs):
+        data=current.split(b'\0')[0][:127];cells={a[12]+j:v for j,v in enumerate((data+b'\0').ljust(128,b'\0'))};requests.append({'target':-8,'arguments':a});operations.append({'op':'read-map','text':data.hex()});return m,0,{'engine_buffer_supplied':True,'child_memory_bytes':cells}
+    def set_cvar(i,m,a,bs):
+        requests.append({'target':-6,'arguments':a});operations.append({'op':'set-cycle','value':cstring(m,bs,a[12]).hex()} if a[8]==34736 else {'op':'clear-next'});return m,0,{'cvar_set_captured':True}
+    def copy(i,m,a,bs):requests.append({'target':69338,'arguments':a});return copy_bounded(i,m,a,dict(bs))
+    def format(i,m,a,bs):
+        requests.append({'target':70458,'arguments':a});m,v,p=final_format(i,m,a,dict(bs),formatter);formatted.append(p['wrapper_trace_sha256']);return m,v,p
+    def command(i,m,a,bs):requests.append({'target':-15,'arguments':a});operations.append({'op':'command','mode':a[8],'text':cstring(m,bs,a[12]).hex()});return m,0,{'command_captured':True}
+    def choose(i,m,a,bs):requests.append({'target':221662,'arguments':a});operations.append({'op':'fallback'});return m,fallback,{'selection_return_supplied':True}
+    m,v,p,b=run(ins,m,7188,7257,156,b=b,handlers={36038:strlen,-8:read,-6:set_cvar,69338:copy,70458:format,-15:command,221662:choose},base=D+0x2000);p.update(requests=requests,operations=operations,format_traces=formatted);return m,p,b

scripts/test_qvm_map_select.py

@@ -0,0 +1,14 @@
+import json,unittest
+from pathlib import Path
+class MapSelectTests(unittest.TestCase):
+ def test_mirror_gate_engine_truncation_and_actual_command_bytes(self):
+  rows=json.loads(Path('docs/research/qvm-map-select.json').read_text())['probes'];self.assertEqual(len(rows),90)
+  for p in rows:
+   a=p['input'];before=bytes.fromhex(a['mirror']).split(b'\0')[0];current=bytes.fromhex(a['current']).split(b'\0')[0][:127];command=b'map '+before[:127]+b'\n' if before else None;ops=[{'op':'read-map','text':current.hex()},{'op':'set-cycle','value':current.hex()},{'op':'clear-next'},{'op':'command','mode':2,'text':command.hex()}] if before else [{'op':'fallback'}];self.assertEqual(p['operations'],ops);self.assertEqual(p['mirror'],before.hex());self.assertEqual(p['command'],command.hex() if command is not None else None);self.assertEqual(p['ring'],int(bool(before)))
+ def test_buffer_guard_formatter_and_internal_abi_order(self):
+  for p in json.loads(Path('docs/research/qvm-map-select.json').read_text())['probes']:
+   active=bool(bytes.fromhex(p['input']['mirror']).split(b'\0')[0]);self.assertEqual(p['guard_before'],p['guard_after']);self.assertEqual([r['target'] for r in p['requests']],[-8,-6,69338,-6,70458,-15] if active else [221662]);self.assertEqual(len(p['format_traces']),int(active))
+   self.assertEqual(p['buffer'],p['buffer_before'])
+   if active:
+    self.assertEqual(bytes.fromhex(p['local_buffer']),(bytes.fromhex(p['mirror'])[:127]+b'\0').ljust(128,b'\0'));self.assertEqual(p['requests'][2]['arguments'],{'8':p['requests'][0]['arguments']['12'],'12':34067112,'16':128})
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -2480,3 +2480,7 @@ edge	docs/research/rust-rotation-advance.json	scripts/test_rust_rotation_advance
 group	rust-rotation-advance	scripts/analyze_rust_rotation_advance.py
 edge	scripts/analyze_rust_rotation_advance.py	scripts/analyze_qvm_resumer_audit.py
 edge	scripts/rust_map_commands_support.py	scripts/analyze_qvm_resumer_audit.py
+report	scripts/analyze_qvm_map_select.py	docs/research/qvm-map-select.json
+edge	docs/research/qvm-map-select.json	scripts/test_qvm_map_select.py
+group	map-select	scripts/analyze_qvm_map_select.py
+edge	scripts/analyze_qvm_map_select.py	scripts/analyze_qvm_resumer_audit.py