Recover scalar delta flags and compressed message composition

docs/ASSET_PIPELINE_TODO.md

@@ -234,3 +234,5 @@ Research progress: [message wrappers](research/MESSAGE_WRAPPERS.md) adds scalar
 Research progress: [message strings and data reads](research/MESSAGE_STRINGS.md) adds OOB reader/cursor/string contracts (RE-377–379). RE-380 retains compressed/library/caller/higher-level packet/runtime/platform work; no broad network conversion milestone is complete.
 
 Research progress: [numeric message codecs](research/MESSAGE_NUMERIC.md) adds raw float and finite angle contracts (RE-381–383). RE-384 retains compressed/delta/caller/numeric-control/packet/runtime/platform validation; broad codec conversion milestones remain open.
+
+Research progress: [scalar message deltas](research/MESSAGE_DELTA.md) adds integer/finite-float and modeled-tree compressed contracts (RE-385–387). RE-388 retains keyed/higher-level/caller/actual-packet/runtime/platform work; broad network conversion remains open.

docs/FINDINGS.md

@@ -432,3 +432,9 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 **F-146 — Observed finite angle encoding:** file-backed binary32 scales, rounded multiplication, truncation and low 8/16-bit masks determine sampled OOB words. Nonfinite/conversion/control-state and caller/platform behavior remain open; absent parsed ReadAngle symbols do not prove absent decoding. [NUM-002](research/MESSAGE_NUMERIC.md).
 
 **F-147 — Observed signed angle16 decoding:** accepted low words sign extend, scale through binary64 by 360/65536 and return binary32. Post-read EOF directly returns -360/65536, sharing a valid signed -1 angle word. Finite OOB compositions verify quantized results; full caller/compressed/runtime behavior remains open. [NUM-003](research/MESSAGE_NUMERIC.md).
+
+**F-148 — Observed integer delta boundaries:** full-word equality requests only a zero flag and preserves the complete baseline; changed values request a one flag and supplied-width payload. Local readers treat any supplied nonzero flag as changed and add no scalar wrapper EOF sentinel check. Legal width/flag/truncation/caller behavior remains open. [DELTA-001](research/MESSAGE_DELTA.md).
+
+**F-149 — Observed finite float delta:** finite numeric equality controls payload omission, including opposite signed zeros; unchanged reads retain baseline bits. Changed payloads forward raw 32-bit words. Nonfinite/control-state/caller/runtime behavior remains open. [DELTA-002](research/MESSAGE_DELTA.md).
+
+**F-150 — Observed compressed scalar delta composition:** native wrapper/bit/Huffman instruction slices agree with independent flag/remainder/modeled-codeword packing and cursor/accounting checks. Seed trees remain model-derived; actual packet/overflow/EOF/full-native-training/platform contracts remain open. [DELTA-003](research/MESSAGE_DELTA.md).

docs/PROVISIONAL_TODO.md

@@ -546,3 +546,5 @@ Research progress: [message wrappers](research/MESSAGE_WRAPPERS.md) completes bo
 Research progress: [message strings and data reads](research/MESSAGE_STRINGS.md) completes bounded RE-377–379. RE-380 leaves compressed/library/caller-lifetime/alias/lifecycle and higher-level packet/platform contracts open.
 
 Research progress: [numeric message codecs](research/MESSAGE_NUMERIC.md) completes bounded RE-381–383. RE-384 leaves delta/snapshot/angle callers and complete compressed/numeric-control/runtime/platform contracts open.
+
+Research progress: [scalar message deltas](research/MESSAGE_DELTA.md) completes bounded RE-385–387. RE-388 leaves keyed/usercmd/entity/player/snapshot and complete caller/overflow/EOF/floating/runtime/platform contracts open.

docs/RESEARCH_LEDGER.md

@@ -245,3 +245,7 @@ Completed bounded RE-377–379 with `analyze_message_strings.py`: sixteen verifi
 ## 2026-10-11 — Float word transport and finite angle codecs
 
 Completed bounded RE-381–383 with `analyze_message_numeric.py`: fourteen verified graphs across the Linux ELF64 engines, 48 raw float OOB compositions, 360 supplied float-reader tails, sixty finite angle-writer compositions and 210 supplied angle16-reader tails. Thirty angle16 compositions also decode exact writer bytes through OOB ReadBits and angle16 instructions. NUM-001–003/F-145–147 distinguish raw float bit transport (including supplied nonfinite payload words, without arithmetic) from numerical conversion, the float EOF word -1.0 from angle16's -360/65536 fallback, and finite scaled/truncated/masked angle output from unrestricted numeric/runtime behavior. Four file-backed constants per engine retain exact bytes/offsets; signed low-word angle decoding uses binary64 scaling before binary32 return, yielding a signed quantized domain. Scalar evaluator extensions are restricted to DX and finite/int32 conversion and low-double operations; exceptional/unsupported conversions fail closed. Frame-save/restore/PUSH/POP omissions, stopped helper/tail boundaries and explicit caller retention are documented; no original process or native callee executes. Eight independent tests verify raw payload/EOF transport, signed cursor guards, constants, struct-rounded finite encoding, signed decoding/fallback, exact angle16 OOB compositions, paired outcomes and restricted conversion/fail-closed behavior. All 374 tests pass; new and preceding reports regenerate byte-identically, and storage/link/whitespace checks pass. RE-380 remains open; RE-384 tracks delta/key/float/usercmd/entity/player/snapshot codecs, angle callers/inlined byte decoding, compressed/nonfinite/out-of-range/MXCSR/FTZ/DAZ/caller/lifecycle/truncation/cursor contracts, native seeded codewords and actual packet/runtime/all-platform/renderer conformance.
+
+## 2026-10-11 — Scalar deltas and modeled-tree compressed composition
+
+Completed bounded RE-385–387 with `analyze_message_delta.py`: 22 verified graphs across the Linux ELF64 engines, 296 compressed scalar delta streams and 48 supplied-reader control probes. DELTA-001–003/F-148–150 distinguish full-word integer equality/baseline retention from changed-width masking, finite float equality (including opposite signed zeros) from raw word equality, and local nonzero flag dispatch from legal one-bit decoder output. Changed float payloads retain raw words; unchanged reads retain baseline bits. Native delta/bit/raw/Huffman instruction slices compose exact bytes against MODEL-DERIVED seeded trees, with independent flag/remainder/codeword packing, decoded value, cursor, oldsize/range diagnostic and canary oracles. Source/disassembly identities and codebook/initialization report hashes are retained and verified. Frame saves/restores/PUSH/POP are omitted; stopped helper/tail boundaries, disjoint virtual frames and caller-register restoration are explicit. No original process or native callee executes, and finite comparison rejection does not specify native nonfinite behavior. Eight tests verify integer/float requests and equality, independent packing, changed signed tails, cursor/accounting/diagnostics/canaries, supplied nonzero flags, dependency hashes/paired outcomes and finite comparison model boundaries. All 382 tests pass; new and preceding reports regenerate byte-identically, with storage/link/whitespace checks passing. RE-384 remains open; RE-388 tracks keyed masks/XOR/table bounds, usercmd/entity/player/snapshot/caller contracts, remaining widths/aliases, compressed capacity/overflow/reset/truncation/EOF/padding/nonfinite control behavior, native seeded codewords and actual packet/runtime/all-platform/renderer conformance.

docs/REVERSE_ENGINEERING_TODO.md

@@ -462,3 +462,8 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 - [x] RE-382 Recover file-backed angle scales and bounded finite rounding/truncation/masking with OOB output ([NUM-002](research/MESSAGE_NUMERIC.md)).
 - [x] RE-383 Recover signed angle16 conversion/EOF fallback and compose finite OOB writer/reader paths ([NUM-003](research/MESSAGE_NUMERIC.md)).
 - [ ] RE-384 Recover delta/key/float/usercmd/entity/player/snapshot codecs and angle callers/inlined byte-angle decoding; validate compressed numeric/nonfinite/out-of-range/MXCSR/FTZ/DAZ/caller-sentinel/lifecycle/truncation/cursor contracts, native seeded codewords and actual packet/runtime/all-platform/renderer conformance.
+
+- [x] RE-385 Recover integer delta full-word change decisions, baseline retention and supplied-width request boundaries ([DELTA-001](research/MESSAGE_DELTA.md)).
+- [x] RE-386 Recover finite float delta comparisons, signed-zero baseline retention and raw changed payloads ([DELTA-002](research/MESSAGE_DELTA.md)).
+- [x] RE-387 Compose bounded scalar delta compressed writes/reads against modeled trees with independent payload/cursor/accounting oracles ([DELTA-003](research/MESSAGE_DELTA.md)).
+- [ ] RE-388 Recover keyed integer/float delta masks/XOR/table bounds, usercmd/entity/player/snapshot codecs and callers; validate remaining widths/value aliases, compressed capacity/overflow/reset/truncation/EOF/padding/nonfinite-control contracts, native seeded codewords and actual packet/runtime/all-platform/renderer conformance.

docs/research/MESSAGE_DELTA.md

@@ -0,0 +1,39 @@
+# Scalar delta flags and compressed compositions
+
+Reproduce with `python3 scripts/analyze_message_delta.py`; validate with `python3 scripts/test_message_delta.py`. [message-delta.json](message-delta.json) retains 22 source/disassembly-hash-verified graphs across the Linux ELF64 engines, 296 compressed scalar delta streams and 48 supplied-reader control probes. It hashes both the [model-derived codebook](HUFFMAN_CODEBOOK.md) and [initialization report](HUFFMAN_INITIALIZATION.md), checking their native source/disassembly identities before using their trees/addresses.
+
+Original processes and native callees never execute. All results are synthetic instruction compositions over supplied memory/registers; native helper CALLs and external tail jumps stop and compose explicitly with caller-register restoration and disjoint virtual frames. Save/restore/PUSH/POP instructions are omitted. Compressed trees are MODEL-DERIVED, not full native training/runtime captures. Float writer comparisons are finite only; NaN/infinity/control-state behavior remains unmodeled. Supplied-reader control probes do not evaluate actual bits or cursor effects. No real packet, truncation/overflow, key/usercmd/entity/player/snapshot or all-platform conformance is established.
+
+## DELTA-001 — Integer change flag and payload (RE-385)
+
+MSG_WriteDelta compares the complete baseline and new 32-bit words before requesting payload encoding. Equal words tail-forward a zero with width one, without a payload. Unequal words first request value one with width one, then tail-forward the unchanged new word with the supplied width. Width validity, range diagnostics and masking occur in the underlying WriteBits path; the delta wrapper does not validate or normalize that width locally.
+
+MSG_ReadDelta first requests width one. A returned zero produces the complete baseline word unchanged, even when the supplied payload width would mask it. Any nonzero returned flag tail-forwards the supplied payload width to ReadBits and returns that helper result. These scalar delta paths do not add the scalar Byte/Float wrappers' post-read size/sentinel checks. This does not prove truncated inputs are safe or that callers lack higher-level validation.
+
+The composed streams include widths 1/7/8/9/16/24/31/32/-8/-9/-31, six baseline/new pairs and initial bit positions zero/seven: 132 integer cases per engine. Equal baseline/new word 0x1234 with width one returns the full 0x1234 baseline; a changed payload is instead subject to the underlying width mask and reader signed tail. The earlier [mutated-width negative read behavior](MESSAGE_WIDTHS.md) therefore remains visible through the delta wrapper. Legal use of these sampled negative widths remains unverified.
+
+## DELTA-002 — Finite float comparison and raw payload (RE-386)
+
+MSG_WriteDeltaFloat compares its finite scalar baseline/new values through COMISS. Equal values request only a zero change bit. Unequal values request a one change bit and then the raw new scalar word with positive width thirty-two. The payload is copied through stack/integer moves rather than numerically converted.
+
+Positive and negative zero compare equal in the finite model. With baseline +0 and new -0, the writer omits the payload and ReadDeltaFloat returns baseline +0. With baseline -0 and new +0, it retains baseline -0. This delta behavior differs from always writing a raw Float word, which preserves the supplied zero sign directly. It is a recovered comparison/transport distinction, not proof of every floating control state or caller invariant.
+
+The float stream fixtures cover equal zeros, both signed-zero directions, equal one, one to 1.5, -1 to one, one to zero, and equal largest-finite words at both initial bit positions: sixteen cases per engine. Changed finite payloads retain the complete new word; unchanged cases retain baseline bits. The reader's payload transport itself uses raw moves, without a finite comparison or the separate ReadFloat EOF fallback.
+
+NaN/unordered comparison, infinity, signaling/exception/MXCSR/FTZ/DAZ behavior and nonfinite writer inputs remain open. The existing restricted evaluator rejects nonfinite COMISS inputs; that rejection is a model boundary, not the game's behavior.
+
+## DELTA-003 — Modeled-tree compressed writer/reader contracts (RE-387)
+
+Every stream composes delta wrapper requests with actual WriteBits/Huff_putBit/Huff_offsetTransmit/send instruction slices. The reader then resets the supplied bit/read cursor and composes delta wrapper requests with actual ReadBits/Huff_getBit/Huff_offsetReceive slices against those exact bytes. No Huffman payload symbol or code length is supplied at the individual call boundary: the supplied modeled tree determines them.
+
+Independent packing begins with one raw flag bit. Changed payloads then use the underlying writer's raw low-bit remainder followed by modeled Huffman byte codes. Equal cases emit only the flag. Exact payload bytes, decoded results, helper arguments and final cursors agree with those oracles across both native images.
+
+Writer size and reader count use `(signed_bit >> 3) + 1`; all sampled bit cursors are nonnegative. Oldsize counts the requested flag width plus the original signed payload width when changed, modulo 2^32. Diagnostic value-range counters remain separate from message overflow and are verified against the underlying writer's observed range rules. Buffers are explicitly zero initialized and oversized to 256 bytes, with outside canaries. Dirty prefix/padding contents, compressed expansion near capacity, overflow continuation and truncated/EOF messages remain unverified.
+
+Twenty-four additional reader probes per engine supply flag words 0/1/2/0xffffffff and baseline words zero/0x80000000/0x1234. Zero retains the baseline; every supplied nonzero word requests a payload and returns its supplied full word. Integer payload requests use width thirteen; float requests use width thirty-two. These are local control-boundary probes, not evidence that noncanonical flag words can be produced by a legal one-bit ReadBits call or that the supplied payload was decoded from a packet.
+
+## Validation and next work
+
+Eight independent tests verify integer full-word/request behavior, finite float comparisons/signed-zero retention, independent flag/remainder/codeword packing, changed integer masking/signed tails, cursor/accounting/diagnostic/canary effects, nonzero supplied reader flags, report dependencies/paired results and the finite comparison model boundary. No evaluator extension was needed.
+
+RE-388: recover integer/float keyed delta masks/XOR/table bounds, usercmd/entity/player/snapshot codecs and actual callers; validate remaining scalar widths/value aliases, compressed capacity/overflow/reset/truncation/EOF/padding, nonfinite floating control behavior, native seeded codewords and actual packet/runtime/all-platform/renderer contracts.

docs/research/MESSAGE_NUMERIC.md

@@ -46,3 +46,5 @@ The shared restricted evaluator adds DX, finite in-range CVTTSS2SI, signed-int32
 Eight independent tests verify raw float words/OOB payloads, float signed EOF tails, exact file-backed constants, finite angle scale/round/truncate/mask, signed angle16 decoding/fallback, angle16 OOB compositions, paired engine outcomes and the restricted evaluator extension. The report retains compact composed instruction trace hashes.
 
 RE-384: recover delta/key/float/usercmd/entity/player/snapshot codecs and angle callers/inlined byte-angle decoding; validate compressed numeric wrappers, nonfinite/out-of-range/MXCSR/FTZ/DAZ conversion behavior, caller sentinel/lifecycle/truncation/cursor contracts, native seeded codewords and actual packet/runtime/all-platform/renderer conformance.
+
+Follow-up: [scalar message deltas](MESSAGE_DELTA.md) recovers bounded integer and finite float change flags and modeled-tree compressed compositions. Broader RE-384 remains open; RE-388 tracks keyed/higher-level and complete packet/platform contracts.

docs/research/README.md

@@ -147,3 +147,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 [OOB data reads and message strings](MESSAGE_STRINGS.md) adds RE-377–379: actual ReadData cursor/EOF composition, ordinary/big/line string read limits/sanitation, and bounded supplied-copy string writing. Reproduce with `python3 scripts/analyze_message_strings.py`; check with `python3 scripts/test_message_strings.py`. Compressed/library/caller/higher-level and real packet/runtime/platform contracts remain open.
 
 [Raw float transport and finite angle codecs](MESSAGE_NUMERIC.md) adds RE-381–383: raw float OOB/EOF behavior, finite angle encoding and signed angle16 reads. Reproduce with `python3 scripts/analyze_message_numeric.py`; check with `python3 scripts/test_message_numeric.py`. Delta/caller/control-state/compressed and actual packet/runtime/platform contracts remain open.
+
+[Scalar delta flags and compressed compositions](MESSAGE_DELTA.md) adds RE-385–387: integer changes, finite float equality/signed zeros and modeled-tree byte/cursor composition. Reproduce with `python3 scripts/analyze_message_delta.py`; check with `python3 scripts/test_message_delta.py`. Keyed/higher-level/overflow/EOF/nonfinite and actual packet/runtime/platform contracts remain open.

scripts/analyze_message_delta.py

@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+"""Scalar delta boundaries and modeled-tree compressed compositions."""
+import gzip
+import hashlib
+import itertools
+import json
+from pathlib import Path
+from analyze_bsp_references import global_address, trace_fields
+from analyze_collision_composition import get_word, put_word
+from analyze_engine_control import control_flow
+from analyze_message_byte_codec import MSG, DATA, install_tree
+from analyze_message_numeric import frame_graph
+from analyze_message_widths import reader, run, writer
+from analyze_message_wrappers import WRAPPER_STACK
+from analyze_qvm import write_json
+from analyze_vm_extensions import native_functions, verified
+
+
+INTEGER_PAIRS=[(0,0),(0,1),(1,0),(0x1234,0x1234),(0x1234,0xffffffff),(0xffffffff,0)]
+FLOAT_PAIRS=[(0,0),(0,0x80000000),(0x80000000,0),(0x3f800000,0x3f800000),(0x3f800000,0x3fc00000),(0xbf800000,0x3f800000),(0x3f800000,0),(0x7f7fffff,0x7f7fffff)]
+
+
+def write_delta(graphs,m,kind,baseline,value,width):
+    name='MSG_WriteDeltaFloat' if kind=='float' else 'MSG_WriteDelta';g,omitted=frame_graph(graphs[name]);rows=g['instructions'];calls={x['address']:i for i,x in enumerate(rows) if x['opcode']=='callq'};tails={x['address'] for x in rows if x['opcode']=='jmp' and '<MSG_WriteBits>' in x['operands']};ends={x['address'] for x in rows if x['opcode']=='retq'}
+    regs={'%rdi':MSG,'%rsi':baseline,'%rdx':value,'%rcx':width&0xffffffff,'%xmm0':baseline,'%xmm1':value,'%rsp':WRAPPER_STACK};pc=rows[0]['address'];requests=[];trace=[]
+    while True:
+        t=run(g,pc,list(calls)+list(tails)+list(ends),m,regs);m=t['memory'];regs=t['registers'];trace+=t['trace']
+        if t['stop'] in ends:break
+        request=[regs[k] for k in ['rdi','rsi','rdx']];requests.append(request)
+        if request[0]!=MSG:raise ValueError('delta writer pointer')
+        word_width=request[2];signed_width=word_width if word_width<2**31 else word_width-2**32
+        m,_,error,child=writer(graphs,m,signed_width,request[1]);trace+=child
+        if error:raise ValueError('delta writer fixture error')
+        if t['stop'] in tails:break
+        pc=rows[calls[t['stop']]+1]['address']
+        if len(requests)>2:raise ValueError('delta writer bound')
+    return m,requests,trace,omitted
+
+
+def read_delta(graphs,m,kind,baseline,width,supplied=None):
+    name='MSG_ReadDeltaFloat' if kind=='float' else 'MSG_ReadDelta';g,omitted=frame_graph(graphs[name]);rows=g['instructions'];calls={x['address']:i for i,x in enumerate(rows) if x['opcode']=='callq'};tails={x['address'] for x in rows if x['opcode']=='jmp' and '<MSG_ReadBits>' in x['operands']};ends={x['address'] for x in rows if x['opcode']=='retq'}
+    regs={'%rdi':MSG,'%rsi':baseline,'%rdx':width&0xffffffff,'%xmm0':baseline,'%rsp':WRAPPER_STACK};pc=rows[0]['address'];requests=[];trace=[]
+    while True:
+        t=run(g,pc,list(calls)+list(tails)+list(ends),m,regs);m=t['memory'];regs=t['registers'];trace+=t['trace']
+        if t['stop'] in ends:break
+        request=[regs[k] for k in ['rdi','rsi']];requests.append(request)
+        if request[0]!=MSG:raise ValueError('delta reader pointer')
+        word_width=request[1];signed_width=word_width if word_width<2**31 else word_width-2**32
+        if supplied is None:
+            m,value,error,child=reader(graphs,m,signed_width);trace+=child
+            if error:raise ValueError('delta reader fixture error')
+        else:value=supplied[len(requests)-1]
+        regs['rax']=value
+        if t['stop'] in tails:break
+        pc=rows[calls[t['stop']]+1]['address']
+        if len(requests)>2:raise ValueError('delta reader bound')
+    return m,regs['xmm0' if kind=='float' else 'rax']&0xffffffff,requests,trace,omitted
+
+
+def main():
+    cp=Path('docs/research/huffman-codebook.json');ip=Path('docs/research/huffman-initialization.json');code=json.loads(cp.read_text());initial=json.loads(ip.read_text())
+    out={'native':{},'codebook_report_sha256':hashlib.sha256(cp.read_bytes()).hexdigest(),'initialization_report_sha256':hashlib.sha256(ip.read_bytes()).hexdigest(),'limitations':'Synthetic Linux ELF64 instruction compositions only; original processes/native callees never execute. Compressed tree is MODEL-DERIVED, not complete native training/runtime capture. Save/restore/PUSH/POP omitted; disjoint virtual frames and caller-register restoration explicit. Float writer comparisons are finite only; signed zeros compare equal. Separate supplied-reader flag/return probes do not compose actual bits or cursor effects. Ample zero-initialized buffers, sampled integer widths and pairs only. No overflow/truncation/key/usercmd/entity/player/snapshot/real-packet/all-platform conformance.'}
+    for label in ['linux--Quake3-UrT-Ded.x86_64','linux--Quake3-UrT.x86_64']:
+        r=json.loads(Path(f'docs/research/native/{label}.json').read_text());verified((Path('.cache/UrbanTerror43')/r['source']['path']).read_bytes(),r['source']['sha256']);a=r['artifacts']['disassembly.txt'];fs=native_functions(verified(gzip.open(a['path'],'rb').read(),a['uncompressed_sha256']).decode());names=['MSG_WriteDelta','MSG_ReadDelta','MSG_WriteDeltaFloat','MSG_ReadDeltaFloat','MSG_WriteBits','MSG_ReadBits','Huff_putBit','Huff_getBit','Huff_offsetTransmit','Huff_offsetReceive','send'];graphs={n:control_flow(fs[n]) for n in names}
+        if code['native'][label]['source']!=r['source'] or code['native'][label]['disassembly_sha256']!=a['uncompressed_sha256']:raise ValueError('codebook provenance')
+        if initial['native'][label]['source']!=r['source'] or initial['native'][label]['disassembly_sha256']!=a['uncompressed_sha256']:raise ValueError('initialization provenance')
+        template={};base=initial['native'][label]['entry_request']['huff_init_pointer'];state=code['model_derived_seed_training']['final_state'];install_tree(template,state,base);root=install_tree(template,state,base+0xc830)
+        for x in graphs['MSG_ReadBits']['instructions']:
+            if x['opcode']=='movq' and '(%rip)' in x['operands']:put_word(template,global_address(x),root,8)
+        g=graphs['MSG_WriteBits'];old=global_address(next(x for x in g['instructions'] if x['opcode']=='addl' and '(%rip)' in x['operands']));over=global_address(next(x for x in g['instructions'] if x['opcode']=='addl' and '$0x1,' in x['operands'] and '(%rip)' in x['operands']))
+        streams=[]
+        fixtures=[('integer',w,b,v,bit) for w,(b,v),bit in itertools.product([1,7,8,9,16,24,31,32,-8,-9,-31],INTEGER_PAIRS,[0,7])]+[('float',32,b,v,bit) for (b,v),bit in itertools.product(FLOAT_PAIRS,[0,7])]
+        for kind,width,baseline,value,bit in fixtures:
+            m=dict(template)
+            for i in range(256):m[DATA+i]=0
+            m[DATA-1]=m[DATA+256]=0x7b
+            for offset,v in [(4,0),(8,0),(16,DATA),(24,256),(28,bit//8+1),(32,0),(36,bit)]:put_word(m,MSG+offset,v,8 if offset==16 else 4)
+            put_word(m,old,0);put_word(m,over,0)
+            m,wrequests,trace,womitted=write_delta(graphs,m,kind,baseline,value,width);write_bit=get_word(m,MSG+36);size=get_word(m,MSG+28);payload=bytes(m[DATA+i] for i in range(size)).hex();account=get_word(m,old);counter=get_word(m,over)
+            put_word(m,MSG+36,bit);put_word(m,MSG+32,0);m,result,rrequests,child,romitted=read_delta(graphs,m,kind,baseline,width);trace+=child
+            streams.append({'kind':kind,'width':width,'baseline_word':baseline,'value_word':value,'initial_bit':bit,'write_requests':wrequests,'read_requests':rrequests,'payload_hex':payload,'write_bit':write_bit,'write_size':size,'read_bit':get_word(m,MSG+36),'read_count':get_word(m,MSG+32),'result_word':result,'oldsize_word':account,'range_counter':counter,'overflow_flag':get_word(m,MSG+4),'canaries':[m[DATA-1],m[DATA+256]],'writer_omitted':womitted,'reader_omitted':romitted,**trace_fields({'trace':trace},False)})
+        probes=[]
+        for kind,flag,baseline,payload in itertools.product(['integer','float'],[0,1,2,0xffffffff],[0,0x80000000,0x1234],[0x8196a5ff]):
+            _,result,requests,trace,omitted=read_delta(graphs,{},kind,baseline,13,[flag,payload]);probes.append({'kind':kind,'supplied_flag_word':flag,'baseline_word':baseline,'supplied_payload_word':payload,'width':13,'result_word':result,'requests':requests,'omitted':omitted,**trace_fields({'trace':trace},False)})
+        out['native'][label]={'source':r['source'],'disassembly_sha256':a['uncompressed_sha256'],'graphs':graphs,'compressed_streams':streams,'supplied_reader_probes':probes}
+    write_json(Path('docs/research/message-delta.json'),out)
+    print('Recovered scalar delta flag/payload boundaries and modeled-tree streams')
+
+
+if __name__=='__main__':main()

scripts/test_message_delta.py

@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+"""Independent delta flags, bit packing, signed tails and accounting oracles."""
+import hashlib
+import json
+from pathlib import Path
+import struct
+import unittest
+from analyze_collision_composition import evaluate
+from test_bsp_planes import graph
+
+
+def f32(word):return struct.unpack('<f',struct.pack('<I',word))[0]
+def signed(word):return (word^0x80000000)-0x80000000
+
+def changed(p):return f32(p['baseline_word'])!=f32(p['value_word']) if p['kind']=='float' else p['baseline_word']!=p['value_word']
+
+
+class MessageDeltaTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.r=json.loads(Path('docs/research/message-delta.json').read_text());cls.words={x['symbol']:x['bits'] for x in json.loads(Path('docs/research/huffman-codebook.json').read_text())['model_derived_seed_training']['codebook']}
+
+    def test_integer_full_word_comparison_and_request_widths(self):
+        for n in self.r['native'].values():
+            rows=[p for p in n['compressed_streams'] if p['kind']=='integer'];self.assertEqual(len(rows),132)
+            for p in rows:
+                c=changed(p);expected=[[0x90000,int(c),1]]+([[0x90000,p['value_word'],p['width']&0xffffffff]] if c else [])
+                self.assertEqual(p['write_requests'],expected);self.assertEqual(p['read_requests'],[[0x90000,1]]+([[0x90000,p['width']&0xffffffff]] if c else []))
+                if not c:self.assertEqual(p['result_word'],p['baseline_word'])
+
+    def test_finite_float_comparison_and_baseline_signed_zero(self):
+        for n in self.r['native'].values():
+            rows=[p for p in n['compressed_streams'] if p['kind']=='float'];self.assertEqual(len(rows),16)
+            for p in rows:
+                c=changed(p);self.assertEqual(p['write_requests'],[[0x90000,int(c),1]]+([[0x90000,p['value_word'],32]] if c else []));self.assertEqual(p['read_requests'],[[0x90000,1]]+([[0x90000,32]] if c else []));self.assertEqual(p['result_word'],p['value_word'] if c else p['baseline_word'])
+                if {p['baseline_word'],p['value_word']}=={0,0x80000000}:self.assertEqual(p['result_word'],p['baseline_word']);self.assertEqual(len(p['write_requests']),1)
+
+    def test_independent_change_bit_raw_remainder_and_codeword_payload(self):
+        for n in self.r['native'].values():
+            self.assertEqual(len(n['compressed_streams']),148)
+            for p in n['compressed_streams']:
+                c=changed(p);bits=[int(c)]
+                if c:
+                    width=abs(p['width']);rem=width%8;value=p['value_word']&((1<<width)-1);bits += [(value>>i)&1 for i in range(rem)]
+                    for i in range(width//8):bits+=self.words[(value>>(rem+8*i))&255]
+                final=p['initial_bit']+len(bits);payload=bytearray(final//8+1)
+                for i,bit in enumerate(bits):position=p['initial_bit']+i;payload[position//8]|=bit<<(position%8)
+                self.assertEqual(p['payload_hex'],payload.hex());self.assertEqual(p['write_bit'],final)
+
+    def test_changed_integer_mask_and_mutated_signed_tail(self):
+        for n in self.r['native'].values():
+            for p in n['compressed_streams']:
+                if p['kind']!='integer' or not changed(p):continue
+                width=abs(p['width']);value=p['value_word']&((1<<width)-1);remaining=width-width%8
+                if p['width']<0 and remaining and value&(1<<(remaining-1)):value|=(0xffffffff<<(remaining&31))&0xffffffff
+                self.assertEqual(p['result_word'],value)
+
+    def test_cursors_accounting_diagnostics_and_canaries(self):
+        for n in self.r['native'].values():
+            for p in n['compressed_streams']:
+                self.assertEqual(p['write_bit'],p['read_bit']);self.assertEqual(p['write_size'],p['write_bit']//8+1);self.assertEqual(p['read_count'],p['write_size']);self.assertEqual(p['oldsize_word'],(1+(p['width'] if changed(p) else 0))&0xffffffff);self.assertEqual(p['overflow_flag'],0);self.assertEqual(p['canaries'],[0x7b]*2)
+                width=p['width'];value=signed(p['value_word']);overflow=False
+                if changed(p) and width!=32:
+                    if width>0:overflow=value<0 or value>(1<<width)-1
+                    else:
+                        bound=1<<((width-1)&31);overflow=value < -bound or value > bound-1
+                self.assertEqual(p['range_counter'],int(overflow))
+
+    def test_supplied_reader_any_nonzero_flag_takes_payload(self):
+        for n in self.r['native'].values():
+            self.assertEqual(len(n['supplied_reader_probes']),24)
+            for p in n['supplied_reader_probes']:
+                c=p['supplied_flag_word']!=0;self.assertEqual(p['result_word'],p['supplied_payload_word'] if c else p['baseline_word']);width=32 if p['kind']=='float' else 13;self.assertEqual(p['requests'],[[0x90000,1]]+([[0x90000,width]] if c else []))
+
+    def test_report_dependencies_and_paired_results(self):
+        for key,name in [('codebook_report_sha256','huffman-codebook.json'),('initialization_report_sha256','huffman-initialization.json')]:self.assertEqual(self.r[key],hashlib.sha256((Path('docs/research')/name).read_bytes()).hexdigest())
+        a,b=self.r['native'].values()
+        for key in ['compressed_streams','supplied_reader_probes']:
+            def clean(rows):return [{k:v for k,v in p.items() if k not in ['trace','trace_sha256','writer_omitted','reader_omitted','omitted']} for p in rows]
+            self.assertEqual(clean(a[key]),clean(b[key]))
+
+    def test_finite_comparison_equal_zeros_and_nonfinite_rejection(self):
+        g=graph([('comiss','%xmm1, %xmm0'),('jne','0x4'),('movl','$0x0, %eax'),('jmp','0x5'),('movl','$0x1, %eax'),('nop','')])
+        t=evaluate(g,0,[5],{}, {'%xmm0':0,'%xmm1':0x80000000},capture_registers=True);self.assertEqual(t['registers']['rax'],0)
+        for word in [0x7f800000,0x7fc01234]:
+            with self.assertRaises(ValueError):evaluate(g,0,[5],{}, {'%xmm0':0,'%xmm1':word},capture_registers=True)
+
+
+if __name__=='__main__':unittest.main()