Recover collision copy status and world-result composition

docs/FINDINGS.md

@@ -294,3 +294,9 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 **F-077 — Observed trace decision separation:** candidate status updates precede finite strict candidate-float < current-float replacement; equal floats skip copy. Static copy paths preserve prior offset-4 status with OR and write candidate identity at result +52. Complete status/copy/world/lane/runtime composition remains open. [HIT-002](research/NATIVE_COLLISION.md).
 
 **F-078 — Observed model/transform routes:** inline model selection uses candidate field 0x1b0 and index 0xa0; temporary models use bounds and byte-flag selection. Transformed trace routes preserve origin/orientation pointers. Full flags, ownership and brush/patch/capsule/runtime geometry remain unverified. [HIT-003](research/NATIVE_COLLISION.md).
+
+**F-079 — Observed merge-lane agreement:** all three native clip result lanes give identical words across tested statuses, finite fractions and prior offset-4 bits. Equality/farther candidates retain the old payload/identifier despite possible status updates. Complete loop scheduling and geometry remain open. [MIX-001](research/COLLISION_COMPOSITION.md).
+
+**F-080 — Observed byte-copy/status composition:** closer-hit paths copy 56 bytes, overwrite the candidate identifier from object word zero, and OR saved prior/intermediate status into result +4. Byte-addressed fixtures preserve copy boundaries and distinguish status from payload selection. Canonical field values and runtime conformance remain open. [MIX-002](research/COLLISION_COMPOSITION.md).
+
+**F-081 — Observed world-result decisions:** fraction exactly one assigns identifier 1023; other tested finite values assign 1022. Positive/negative zero skips entity clipping toward result copying. These are supplied-result instruction slices, not executed world collisions or complete sentinel semantics. [MIX-003](research/COLLISION_COMPOSITION.md).

docs/PROVISIONAL_TODO.md

@@ -33,7 +33,7 @@ For implementation items, the minimum done condition is a documented contract, a
 
 ### First research batch
 
-Progress: [RE-232–234 / TIME-001–003](research/FRAME_TIMING.md) now cover Linux ELF64 elapsed modification, event sources and pause predicates. The [RE-237–239 follow-up](research/EVENT_QUEUES.md) resolves the pause-field address/bot chain and adds queue/journal evidence. The [RE-241–243 announcement pass](research/AUTH_ANNOUNCEMENTS.md) recovers label tables and recipient paths; The [RE-245–247 cvar pass](research/GAME_CVARS.md) adds all 126 main registration rows and resolves auth_verbosity/callers. The [RE-249–251 change pass](research/CVAR_CHANGES.md) adds cache/notification behavior, four numeric correction branches and direct registration coverage. The [RE-253–255 query pass](research/AUTH_QUERIES.md) adds selector helpers, command-role routing and internal authentication modes. The [RE-257–259 bounds/entry pass](research/SELECTOR_BOUNDS.md) adds integer parsing, selector storage/count evidence and native/QVM/chat route connections. The [RE-261–263 chat pass](research/CHAT_PATHS.md) adds native command metadata/filter evidence and bounded message/recipient paths, including the documented argument-mapping correction. The [RE-265–267 delivery pass](research/CHAT_DELIVERY.md) adds bounded dead-chat predicates, formatter argument routing and echo/fanout calls. The [RE-269–271 expansion pass](research/CHAT_EXPANSION.md) adds marker states, twelve key comparisons and health/momo branches. The [RE-273–275 item/time pass](research/CHAT_ITEMS_TIME.md) adds packed ammunition fields, sampled names and countdown branches. The [RE-277–279 location pass](research/CHAT_LOCATIONS.md) adds leader selection, cache/format boundaries and location-list/spatial evidence. The [RE-281–283 crosshair pass](research/CHAT_CROSSHAIR.md) adds finite geometry fixtures, trace arguments and result routing. The [RE-285–287 native spatial pass](research/NATIVE_SPATIAL.md) confirms Linux trig/spatial services, VM pointer branches and collision/query evidence. The [RE-289–291 collision pass](research/NATIVE_COLLISION.md) adds native candidate filters, result decisions and model/field evidence. PROV-002 remains open for full output/reset coverage. PROV-001 remains open for complete scheduling and platform coverage.
+Progress: [RE-232–234 / TIME-001–003](research/FRAME_TIMING.md) now cover Linux ELF64 elapsed modification, event sources and pause predicates. The [RE-237–239 follow-up](research/EVENT_QUEUES.md) resolves the pause-field address/bot chain and adds queue/journal evidence. The [RE-241–243 announcement pass](research/AUTH_ANNOUNCEMENTS.md) recovers label tables and recipient paths; The [RE-245–247 cvar pass](research/GAME_CVARS.md) adds all 126 main registration rows and resolves auth_verbosity/callers. The [RE-249–251 change pass](research/CVAR_CHANGES.md) adds cache/notification behavior, four numeric correction branches and direct registration coverage. The [RE-253–255 query pass](research/AUTH_QUERIES.md) adds selector helpers, command-role routing and internal authentication modes. The [RE-257–259 bounds/entry pass](research/SELECTOR_BOUNDS.md) adds integer parsing, selector storage/count evidence and native/QVM/chat route connections. The [RE-261–263 chat pass](research/CHAT_PATHS.md) adds native command metadata/filter evidence and bounded message/recipient paths, including the documented argument-mapping correction. The [RE-265–267 delivery pass](research/CHAT_DELIVERY.md) adds bounded dead-chat predicates, formatter argument routing and echo/fanout calls. The [RE-269–271 expansion pass](research/CHAT_EXPANSION.md) adds marker states, twelve key comparisons and health/momo branches. The [RE-273–275 item/time pass](research/CHAT_ITEMS_TIME.md) adds packed ammunition fields, sampled names and countdown branches. The [RE-277–279 location pass](research/CHAT_LOCATIONS.md) adds leader selection, cache/format boundaries and location-list/spatial evidence. The [RE-281–283 crosshair pass](research/CHAT_CROSSHAIR.md) adds finite geometry fixtures, trace arguments and result routing. The [RE-285–287 native spatial pass](research/NATIVE_SPATIAL.md) confirms Linux trig/spatial services, VM pointer branches and collision/query evidence. The [RE-289–291 collision pass](research/NATIVE_COLLISION.md) adds native candidate filters, result decisions and model/field evidence. The [RE-293–295 composition pass](research/COLLISION_COMPOSITION.md) adds three-lane byte-copy/status agreement and world-result routing. PROV-002 remains open for full output/reset coverage. PROV-001 remains open for complete scheduling and platform coverage.
 
 Start with the open questions raised by the current binary evidence. These tasks depend on the linked reports, not on a working rewrite.
 

docs/RESEARCH_LEDGER.md

@@ -153,3 +153,7 @@ Completed bounded/static RE-285–287 with `analyze_native_spatial.py`: ten comp
 ## 2026-10-11 — Native collision candidate and result decisions
 
 Completed bounded/static RE-289–291 with `analyze_native_collision.py`: ten native graphs, CM_Trace windows, 256 first-lane filter and 64 result-decision instruction probes. HIT-001–003/F-076–078 distinguish content overlap from nonzero contents, status updates from strict hit replacement and static copy/model routes from executed geometry. Seven tests check paired raw predicates, sentinel/contents behavior, finite fraction ties/status effects, retained model/producer/copy evidence and probe failure domains. RE-288 remains open; RE-292 tracks all lanes, copy/status composition, layout/producers/geometry/runtime/platform requirements. No original process or native collision callee executes.
+
+## 2026-10-11 — Collision copy/status and world-result composition
+
+Completed bounded RE-293–295 with `analyze_collision_composition.py`: paired clip/trace graphs, 216 complete merge/copy slices spanning three lanes and twelve world-result decisions. MIX-001–003/F-079–081 retain supplied geometry results, raw noncanonical prior-bit fixtures and exceptional/runtime limits. Added a separate restricted byte-addressed evaluator for overlapping native 32/64-bit copies, OR/status branches and register alias behavior. Eight tests check final words, lane agreement, tie retention, copy canaries, world sentinels/zero decisions, register/byte aliasing and failure domains. RE-292 remains open; RE-296 tracks full loop scheduling, producer/layout/sentinel/geometry/runtime/platform behavior. No original process or collision callee executes.

docs/REVERSE_ENGINEERING_TODO.md

@@ -347,3 +347,8 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 - [x] RE-290 Recover finite first-lane status updates and strict closer-hit replacement decisions; retain copy/OR/result-field relationships ([HIT-002](research/NATIVE_COLLISION.md)).
 - [x] RE-291 Recover static inline/temporary model selection and transformed-trace argument routes in both Linux ELF64 engines ([HIT-003](research/NATIVE_COLLISION.md)).
 - [ ] RE-292 Validate every unrolled lane, existing-status/copy/OR composition, trace/entity layouts, owner/count producers, model/flag transforms, full geometry/order and original-runtime/all-platform fixtures.
+
+- [x] RE-293 Recover paired bounded result composition through all three unrolled lanes and test identical finite-input outcomes ([MIX-001](research/COLLISION_COMPOSITION.md)).
+- [x] RE-294 Recover complete 56-byte copy, prior status OR, identifier/payload retention and register/byte-alias fixture semantics ([MIX-002](research/COLLISION_COMPOSITION.md)).
+- [x] RE-295 Recover native world-result sentinel assignment and positive/negative-zero branch skipping entity clipping ([MIX-003](research/COLLISION_COMPOSITION.md)).
+- [ ] RE-296 Validate whole multi-candidate/world/entity loops, prior status reachability and early exits, canonical result producers/layout/sentinels, exceptional floats and original-runtime/all-platform fixtures.

docs/research/COLLISION_COMPOSITION.md

@@ -0,0 +1,51 @@
+# Collision copy/status composition and world-result decisions
+
+Static pass, 2026-10-11. Reproduce with `python3 scripts/analyze_collision_composition.py`; check with `python3 scripts/test_collision_composition.py`. [Generated evidence](collision-composition.json) verifies original/disassembly hashes for both Linux ELF64 engines, retains clip/trace graphs, and records **216 complete bounded merge/copy slices plus twelve world-result decisions**. No original process, intersection generator or collision callee executes. This extends the [first-lane decision findings](NATIVE_COLLISION.md).
+
+## MIX-001: three unrolled result lanes
+
+SV_ClipMoveToEntities has three post-CM_TransformedBoxTrace lanes. The collector identifies each candidate status read and finite fraction comparison, then evaluates the original instructions through the lane's common continuation address. Lane 1 uses candidate register r12; lanes 0/2 use rbp. Register renaming and out-of-line branches are followed rather than treated as separate algorithms.
+
+Each engine has 108 slices: all three lanes, candidate status words 0/1 at result offsets 0/4, candidate fraction **0.25/0.5/0.75**, prior current fraction **0.5**, and prior offset-4 word **0/1/4**. The input's other result words contain distinct old/new payload markers; old identifier is 42 and candidate object word zero is 7. Initial current offset-0 status is zero. Prior status value 4 is a synthetic raw-bit case, not a claim that normal engine status values include 4.
+
+All three lanes produce the same final words for every tested input. They replace only when candidate fraction is **strictly smaller**. Equal and farther fractions preserve current fraction, payload and identifier. Candidate flags may still update the current status words before that comparison. These probes establish bounded lane agreement, not the entire unrolled loop's entry, scheduling or early-exit behavior.
+
+## MIX-002: byte-addressed copies and accumulated status
+
+The new restricted evaluator uses a byte-addressed memory map, so four-byte OR/store operations and overlapping eight-byte loads/stores share actual fixture bytes. It handles only the observed moves, register aliases, selected integer/finite SSE comparisons, status writes and branches. Unknown reads/operations, nonfinite comparisons and step limits fail closed. It models 32-bit register writes clearing upper bits, and AL writes preserving the remaining RAX bits; tests cover both.
+
+Let C0/C4 denote candidate status words, P4 the prior current offset-4 word, and F the candidate fraction. In the tested domain, the status update before deciding on replacement is:
+
+```
+intermediate4 = P4                 if C0 != 0
+                1                 if C0 == 0 and C4 != 0
+                P4                otherwise
+```
+
+Candidate C0 nonzero separately sets current offset 0 to 1. It skips the candidate C4 test in that lane. Then:
+
+- **F < current fraction:** candidate object word zero is written into candidate result offset **52**; seven eight-byte chunks copy the **56-byte** candidate into current. The saved intermediate4 is ORed into copied candidate offset 4. Final status4 is therefore **C4 OR intermediate4**, with payload and identifier from the candidate.
+- **F >= current fraction:** no full copy occurs. The current payload/identifier remain unchanged; status updates made before the comparison survive.
+
+A raw prior status4 of 4 plus candidate C4=1 can produce 5 after a closer hit. A zero candidate C4 does not erase a prior status4 on replacement. When C0 is nonzero, the candidate C4 contribution can enter through copying even though its separate pre-copy test was skipped. These differences matter when separating hit selection from status accumulation.
+
+Distinct marker words verify complete payload transfer and retention. Canaries directly before/after the current result span stay unchanged in all slices, and each closer-hit path makes seven eight-byte writes totaling 56 bytes plus its status/identifier operations. This is an observed copy span, not proof of ABI member names, all object memory bounds or atomicity.
+
+## MIX-003: world identifier and entity-clipping gate
+
+A separate slice in SV_Trace begins after CM_BoxTrace and its file-backed 1.0 load, supplying the returned fraction and xmm2 constant explicitly. It follows the original single-precision compare, SETE low-byte write, integer add and subsequent zero comparison.
+
+The world-result identifier at relative result offset **52** becomes:
+
+```
+1023 if returned fraction == 1.0
+1022 otherwise
+```
+
+The fraction is then compared with zero. **+0.0 and -0.0** take the branch directly toward result copying, skipping the later entity-clipping path. Other tested finite values continue into swept-bound/entity clipping. Inputs 0.25/1.0/1.5/-1.0 exercise identifier and continuation distinctions; 1.5/-1.0 are synthetic out-of-normal-range cases, not evidence that CM_BoxTrace produces them in gameplay.
+
+The graph labels and constants establish identifier assignment and continuation, without executing world collision or assigning every sentinel's complete lifecycle. The zero branch is separate from the clip helper's status-driven early exits. COMISS exceptional flags, NaN behavior, native libm/rounding domains and collision producer constraints remain unmodeled.
+
+## Remaining work and Rust dependencies
+
+RE-293–295 record three-lane composition, byte-copy/status behavior and world-result decisions. RE-292 remains open for complete clipping loops and geometry; RE-296 tracks full multi-candidate/world/entity composition, prior nonzero offset-0 reachability, every early-exit/count path, canonical status/fraction producers, final trace field/sentinel identities, exceptional floating-point behavior and original-runtime/all-platform fixtures. Rust collision results need independent payload selection and status accumulation, followed by the recovered world/entity scheduling rules; the tested slices alone are not a complete collision implementation.

docs/research/NATIVE_COLLISION.md

@@ -58,3 +58,5 @@ Three unrolled call sites and their related out-of-line branches are retained in
 ## Remaining work and Rust dependencies
 
 RE-289–291 record first-lane filters, bounded result decisions and static model/result-field evidence. RE-288 remains open; RE-292 tracks every unrolled lane, existing-status and copy/OR composition, complete trace/entity fields, owner/count producers, model/flag/transform identities, collision internals/ordering and original-runtime/all-platform fixtures. A Rust collision contract must preserve exclusion relations, content overlap, status accumulation and strict hit replacement independently; a single nearest-hit operation would not capture the recovered status behavior.
+
+The [MIX-001–003 follow-up](COLLISION_COMPOSITION.md) evaluates full copy/status composition in all three result lanes and world sentinel/zero-fraction decisions. Full candidate-loop/geometry/runtime behavior remains open under RE-292/296.

docs/research/README.md

@@ -43,10 +43,11 @@ python3 scripts/test_chat_locations.py
 python3 scripts/test_chat_crosshair.py
 python3 scripts/test_native_spatial.py
 python3 scripts/test_native_collision.py
+python3 scripts/test_collision_composition.py
 python3 scripts/storage_policy.py check --require-setup
 ```
 
-The pipeline runs `fetch_analysis_references.py`, `analyze_qvm.py`, `analyze_native.py`, `analyze_vm_abi.py`, `analyze_native_dispatch.py`, `analyze_vm_extensions.py`, `analyze_native_metadata.py`, `analyze_native_coverage.py`, `analyze_auth_drop.py`, `analyze_deferred_auth.py`, `analyze_engine_control.py`, `analyze_frame_timing.py`, `analyze_event_queues.py`, `analyze_auth_announcements.py`, `analyze_game_cvars.py`, `analyze_cvar_changes.py`, `analyze_auth_queries.py`, `analyze_selector_bounds.py`, `analyze_chat_paths.py`, `analyze_chat_delivery.py`, `analyze_chat_expansion.py`, `analyze_chat_items_time.py`, `analyze_chat_locations.py`, `analyze_chat_crosshair.py`, `analyze_native_spatial.py`, and `analyze_native_collision.py` in that order. Python 3.9+ and **LLVM objdump** with x86 ELF/COFF/Mach-O support are required. This pass used Apple LLVM 17.0.0 on macOS arm64; it disassembled x86 images without running them. Upstream references are downloaded only if absent, checked against the committed SHA-256 manifest, and cached under `.cache/research/upstream/`. A clone also needs `git lfs pull` to obtain the derived artifacts/extracted members.
+The pipeline runs `fetch_analysis_references.py`, `analyze_qvm.py`, `analyze_native.py`, `analyze_vm_abi.py`, `analyze_native_dispatch.py`, `analyze_vm_extensions.py`, `analyze_native_metadata.py`, `analyze_native_coverage.py`, `analyze_auth_drop.py`, `analyze_deferred_auth.py`, `analyze_engine_control.py`, `analyze_frame_timing.py`, `analyze_event_queues.py`, `analyze_auth_announcements.py`, `analyze_game_cvars.py`, `analyze_cvar_changes.py`, `analyze_auth_queries.py`, `analyze_selector_bounds.py`, `analyze_chat_paths.py`, `analyze_chat_delivery.py`, `analyze_chat_expansion.py`, `analyze_chat_items_time.py`, `analyze_chat_locations.py`, `analyze_chat_crosshair.py`, `analyze_native_spatial.py`, `analyze_native_collision.py`, and `analyze_collision_composition.py` in that order. Python 3.9+ and **LLVM objdump** with x86 ELF/COFF/Mach-O support are required. This pass used Apple LLVM 17.0.0 on macOS arm64; it disassembled x86 images without running them. Upstream references are downloaded only if absent, checked against the committed SHA-256 manifest, and cached under `.cache/research/upstream/`. A clone also needs `git lfs pull` to obtain the derived artifacts/extracted members.
 
 Generated JSON/JSONL and compressed evidence are regenerated in place; keep prose notes in Markdown. Rerunning the four analysis stages reproduced every generated report and gzip artifact byte-for-byte on the same toolchain. gzip timestamps and stored filenames are fixed. Different objdump versions can produce different disassembly text, so tool version and uncompressed evidence hashes are recorded. Reports are UTF-8 normal Git text, with individual files below the storage policy's 2 MiB limit.
 
@@ -100,3 +101,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 [Native trig, spatial services and VM pointers](NATIVE_SPATIAL.md) adds RE-285–287: confirmed paired Linux service mappings/float transport, bounded VM_ArgPtr branches and native trace/PVS/area-query graphs. Reproduce with `python3 scripts/analyze_native_spatial.py`; check with `python3 scripts/test_native_spatial.py`. Complete geometry, layout, exceptional arithmetic and all-platform runtime contracts remain open.
 
 [Native entity collision filters and decisions](NATIVE_COLLISION.md) adds RE-289–291: paired first-lane filter/result probes, result-field relationships and model/transform paths. Reproduce with `python3 scripts/analyze_native_collision.py`; check with `python3 scripts/test_native_collision.py`. Full collision geometry/lane composition/runtime/platform behavior remains open.
+
+[Collision copy/status composition and world decisions](COLLISION_COMPOSITION.md) adds RE-293–295: all three bounded merge/copy lanes, byte-addressed payload/status preservation and world sentinel/zero-fraction routing. Reproduce with `python3 scripts/analyze_collision_composition.py`; check with `python3 scripts/test_collision_composition.py`. Whole-loop/geometry/exception/runtime/platform behavior remains open.

scripts/analyze_binaries.py

@@ -14,7 +14,7 @@ def main():
                    'analyze_deferred_auth.py', 'analyze_engine_control.py', 'analyze_frame_timing.py',
                    'analyze_event_queues.py', 'analyze_auth_announcements.py', 'analyze_game_cvars.py',
                    'analyze_cvar_changes.py', 'analyze_auth_queries.py', 'analyze_selector_bounds.py',
-                   'analyze_chat_paths.py', 'analyze_chat_delivery.py', 'analyze_chat_expansion.py', 'analyze_chat_items_time.py', 'analyze_chat_locations.py', 'analyze_chat_crosshair.py', 'analyze_native_spatial.py', 'analyze_native_collision.py'):
+                   'analyze_chat_paths.py', 'analyze_chat_delivery.py', 'analyze_chat_expansion.py', 'analyze_chat_items_time.py', 'analyze_chat_locations.py', 'analyze_chat_crosshair.py', 'analyze_native_spatial.py', 'analyze_native_collision.py', 'analyze_collision_composition.py'):
         subprocess.run([sys.executable, str(Path('scripts')/script)], check=True)
 
 

scripts/analyze_collision_composition.py

@@ -0,0 +1,133 @@
+#!/usr/bin/env python3
+"""Bounded byte-addressed collision copies and world-result decisions."""
+import gzip
+import itertools
+import json
+from pathlib import Path
+import re
+from analyze_chat_crosshair import bits,number
+from analyze_engine_control import control_flow
+from analyze_qvm import write_json
+from analyze_vm_extensions import native_functions,verified
+
+
+def register(r):
+    aliases={'eax':('rax',32),'edi':('rdi',32),'esi':('rsi',32),'edx':('rdx',32),
+             'ecx':('rcx',32),'ebp':('rbp',32),'ebx':('rbx',32),'al':('rax',8)}
+    r=r.lstrip('%')
+    if r in aliases:return aliases[r]
+    if re.fullmatch(r'r\d+d',r):return r[:-1],32
+    if re.fullmatch(r'r(?:ax|di|si|dx|cx|bp|bx|sp|\d+)',r):return r,64
+    if re.fullmatch(r'xmm\d+',r):return r,32
+    raise ValueError('unsupported register '+r)
+
+
+def put_word(m,address,value,width=4):
+    for i in range(width):m[address+i]=(value>>(8*i))&255
+
+
+def get_word(m,address,width=4):
+    if any(address+i not in m for i in range(width)):raise ValueError('unknown byte-addressed read')
+    return sum(m[address+i]<<(8*i) for i in range(width))
+
+
+def evaluate(graph,start,stops,memory,registers,limit=128):
+    rows=graph['instructions'];indices={x['address']:i for i,x in enumerate(rows)}
+    regs={register(k)[0]:v for k,v in registers.items()};m=dict(memory);equal=ge=False;pc=start;trace=[];writes=[]
+    def read_reg(name):
+        key,size=register(name)
+        if key not in regs:raise ValueError('unknown register')
+        return regs[key]&((1<<size)-1)
+    def address(arg):
+        match=re.fullmatch(r'(0x[0-9a-f]+)?\((%\w+)\)',arg)
+        if not match:raise ValueError('unsupported memory operand')
+        return read_reg(match[2])+int(match[1] or '0',0)
+    def read(arg,width):
+        if arg.startswith('$'):return int(arg[1:],0)&((1<<(width*8))-1)
+        if arg.startswith('%'):return read_reg(arg)
+        return get_word(m,address(arg),width)
+    def write(arg,val,width):
+        val&=(1<<(width*8))-1
+        if arg.startswith('%'):
+            key,size=register(arg)
+            if size==8:regs[key]=(regs.get(key,0)&~255)|val
+            else:regs[key]=val  # 32-bit writes clear high bits.
+        else:
+            a=address(arg);put_word(m,a,val,width);writes.append({'address':a,'bytes':width})
+    while pc not in stops:
+        if pc not in indices or len(trace)>=limit:raise ValueError('composition slice escaped bound')
+        x=rows[indices[pc]];trace.append(pc);op=x['opcode'];args=x['operands'].split('#')[0].strip()
+        i=indices[pc];pc=rows[i+1]['address'] if i+1<len(rows) else None
+        if op=='nop':pass
+        elif op in ['movl','movq','movss']:
+            a,b=args.split(', ');width=8 if op=='movq' else 4;write(b,read(a,width),width)
+        elif op in ['testl','cmpl']:
+            a,b=args.split(', ');v,w=read(a,4),read(b,4);equal=v==w if op=='cmpl' else (v&w)==0
+        elif op in ['xorl','orl','addl']:
+            a,b=args.split(', ');v,w=read(a,4),read(b,4)
+            result=v^w if op=='xorl' else v|w if op=='orl' else v+w
+            write(b,result,4);equal=(result&0xffffffff)==0
+        elif op=='xorps':
+            a,b=args.split(', ')
+            if a!=b:raise ValueError('unsupported SIMD xor')
+            write(b,0,4)  # Does not change integer flags.
+        elif op=='comiss':
+            a,b=args.split(', ');v,w=number(read(a,4)),number(read(b,4));equal=v==w;ge=w>=v
+        elif op=='sete':write(args,int(equal),1)
+        elif op in ['je','jne','jae','jmp']:
+            taken=op=='jmp' or (equal if op=='je' else not equal if op=='jne' else ge)
+            if taken:pc=int(args.split()[0],16)
+        else:raise ValueError('unsupported composition opcode '+op)
+    return {'trace':trace,'stop':pc,'memory':m,'writes':writes}
+
+
+def lane_sites(graph):
+    rows=graph['instructions'];starts=[x['address'] for x in rows if x['opcode']=='movl' and x['operands']=='0x1030(%rsp), %r10d']
+    comparisons=[i for i,x in enumerate(rows) if x['opcode']=='comiss' and x['operands'].startswith('0x44(%rbx),')]
+    if len(starts)!=3 or len(comparisons)!=3:raise ValueError('lane count changed')
+    return [{'lane':lane,'start':start,'stop':int(rows[i+1]['operands'].split()[0],16),
+             'candidate_register':'%r12' if lane==1 else '%rbp'}
+            for lane,(start,i) in enumerate(zip(starts,comparisons))]
+
+
+def main():
+    out={'native':{},'limitations':'Bounded byte-addressed synthetic instruction evaluation, not original '
+         'native/runtime/callee execution. Supplied statuses/fractions/payloads omit collision generation. '
+         'Only finite comparisons and selected operations are modeled. Full entity-loop scheduling, '
+         'geometry, malformed/exceptional inputs and other-platform conformance remain open.'}
+    for label in ['linux--Quake3-UrT-Ded.x86_64','linux--Quake3-UrT.x86_64']:
+        r=json.loads(Path(f'docs/research/native/{label}.json').read_text())
+        verified((Path('.cache/UrbanTerror43')/r['source']['path']).read_bytes(),r['source']['sha256'])
+        a=r['artifacts']['disassembly.txt'];fs=native_functions(verified(gzip.open(a['path'],'rb').read(),a['uncompressed_sha256']).decode())
+        graphs={n:control_flow(fs[n]) for n in ['SV_ClipMoveToEntities','SV_Trace']};lanes=lane_sites(graphs['SV_ClipMoveToEntities'])
+        clip,entity,stack=0x10000,0x20000,0x40000;current=clip+0x3c;candidate=stack+0x1030
+        merges=[]
+        for lane,status0,status4,fraction,prior4 in itertools.product(lanes,[0,1],[0,1],[.25,.5,.75],[0,1,4]):
+            old=[0,prior4,bits(.5)]+[0x100+i for i in range(3,13)]+[42]
+            new=[status0,status4,bits(fraction)]+[0x200+i for i in range(3,13)]+[999]
+            m={current-1:0xab,current+56:0xcd};put_word(m,entity,7)
+            for i,(v,w) in enumerate(zip(old,new)):put_word(m,current+4*i,v);put_word(m,candidate+4*i,w)
+            t=evaluate(graphs['SV_ClipMoveToEntities'],lane['start'],[lane['stop']],m,
+                       {'%rbx':clip,'%rsp':stack,lane['candidate_register']:entity})
+            merges.append({'lane':lane['lane'],'candidate_status0':status0,'candidate_status4':status4,
+                'candidate_fraction':fraction,'prior_status4':prior4,'old_words':old,'input_candidate_words':new,
+                'final_words':[get_word(t['memory'],current+4*i) for i in range(14)],
+                'canaries':[t['memory'][current-1],t['memory'][current+56]],'trace':t['trace'],'writes':t['writes']})
+        g=graphs['SV_Trace'];rows=g['instructions']
+        call=next(i for i,x in enumerate(rows) if '<CM_BoxTrace>' in x['operands'])
+        start=rows[call+2]['address']  # Start after file-backed 1.0 load; supply xmm2 explicitly.
+        branch=next(i for i in range(call,len(rows)) if rows[i]['opcode']=='je')
+        stop_yes=int(rows[branch]['operands'].split()[0],16);stop_no=rows[branch+1]['address']
+        world=[]
+        for fraction in [0.0,-0.0,.25,1.0,1.5,-1.0]:
+            m={};put_word(m,stack+0x64,bits(fraction))
+            t=evaluate(g,start,[stop_yes,stop_no],m,{'%rsp':stack,'%xmm2':bits(1), '%rax':0})
+            world.append({'fraction':fraction,'identifier_word':get_word(t['memory'],stack+0x90),
+                          'skips_entity_clip_path':t['stop']==stop_yes,'trace':t['trace']})
+        out['native'][label]={'source':r['source'],'disassembly_sha256':a['uncompressed_sha256'],
+            'graphs':graphs,'lane_sites':lanes,'composition_traces':merges,'world_decision_traces':world}
+    write_json(Path('docs/research/collision-composition.json'),out)
+    print('Recovered 216 complete three-lane merge/copy slices and 12 world-result decisions')
+
+
+if __name__=='__main__':main()

scripts/test_collision_composition.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""Byte-copy, status accumulation, lane agreement and world-decision fixtures."""
+import json
+from pathlib import Path
+import unittest
+from analyze_collision_composition import evaluate,get_word,put_word
+
+
+def graph(*ops):
+    return {'instructions':[{'address':i+1,'opcode':op,'operands':args} for i,(op,args) in enumerate(ops+(('nop',''),))]}
+
+
+class CollisionCompositionTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/collision-composition.json').read_text())
+
+    def test_complete_copy_and_status_or(self):
+        for n in self.r['native'].values():
+            self.assertEqual(len(n['composition_traces']),108)
+            for x in n['composition_traces']:
+                pre=x['prior_status4'] if x['candidate_status0'] else 1 if x['candidate_status4'] else x['prior_status4']
+                if x['candidate_fraction']<.5:
+                    expected=list(x['input_candidate_words']);expected[1]|=pre;expected[13]=7
+                else:
+                    expected=list(x['old_words']);expected[0]=int(bool(x['candidate_status0']));expected[1]=pre
+                self.assertEqual(x['final_words'],expected)
+
+    def test_all_three_lanes_have_identical_outcomes(self):
+        for n in self.r['native'].values():
+            by_input={}
+            for x in n['composition_traces']:
+                key=(x['candidate_status0'],x['candidate_status4'],x['candidate_fraction'],x['prior_status4'])
+                by_input.setdefault(key,[]).append((x['lane'],x['final_words']))
+            self.assertEqual(len(by_input),36)
+            for cases in by_input.values():
+                self.assertEqual([lane for lane,_ in cases],[0,1,2])
+                self.assertTrue(all(words==cases[0][1] for _,words in cases))
+
+    def test_equal_fraction_keeps_old_payload_and_identifier(self):
+        for n in self.r['native'].values():
+            for x in n['composition_traces']:
+                if x['candidate_fraction']==.5:
+                    self.assertEqual(x['final_words'][2:],x['old_words'][2:])
+                    self.assertEqual(x['final_words'][13],42)
+
+    def test_canaries_and_current_write_envelope(self):
+        for n in self.r['native'].values():
+            for x in n['composition_traces']:
+                self.assertEqual(x['canaries'],[0xab,0xcd])
+                for w in x['writes']:
+                    if w['address']<0x20000:
+                        self.assertGreaterEqual(w['address'],0x10000+0x3c)
+                        self.assertLessEqual(w['address']+w['bytes'],0x10000+0x3c+56)
+                if x['candidate_fraction']<.5:
+                    self.assertEqual(sum(w['bytes'] for w in x['writes'] if w['bytes']==8),56)
+
+    def test_world_sentinels_and_zero_fraction_skip(self):
+        for n in self.r['native'].values():
+            cases=n['world_decision_traces']
+            self.assertEqual([x['identifier_word'] for x in cases],[1022,1022,1022,1023,1022,1022])
+            self.assertEqual([x['skips_entity_clip_path'] for x in cases],[True,True,False,False,False,False])
+
+    def test_byte_aliasing_and_32bit_register_write(self):
+        m={};put_word(m,0x10000,0x1122334455667788,8)
+        g=graph(('movl','$0xffffffff, %eax'),('movq','%rax, 0x10000(%rbx)'))
+        t=evaluate(g,1,[3],m,{'%rbx':0,'%rax':2**63})
+        self.assertEqual(get_word(t['memory'],0x10000,8),0xffffffff)
+        g=graph(('movl','$0xaabbccdd, 0x10004(%rbx)'))
+        t=evaluate(g,1,[2],m,{'%rbx':0})
+        self.assertEqual(get_word(t['memory'],0x10000,8),0xaabbccdd55667788)
+
+    def test_low_byte_write_preserves_other_register_bits(self):
+        g=graph(('cmpl','%eax, %eax'),('sete','%al'),('movq','%rax, 0x10000(%rbx)'))
+        m={};put_word(m,0x10000,0,8)
+        t=evaluate(g,1,[4],m,{'%rbx':0,'%rax':0x12345678})
+        self.assertEqual(get_word(t['memory'],0x10000,8),0x12345601)
+
+    def test_unknown_memory_ops_nan_and_limits_fail_closed(self):
+        g=graph(('movq','0x10000(%rbx), %rax'))
+        with self.assertRaises(ValueError):evaluate(g,1,[2],{}, {'%rbx':0})
+        with self.assertRaises(ValueError):evaluate(graph(('callq','0x123')),1,[2],{}, {})
+        with self.assertRaises(ValueError):evaluate(graph(('comiss','%xmm0, %xmm1')),1,[2],{},
+                                                   {'%xmm0':0x7fc00000,'%xmm1':0})
+        with self.assertRaises(ValueError):evaluate(graph(('jmp','0x1')),1,[2],{}, {},limit=3)
+
+
+if __name__=='__main__':unittest.main()