Recover float transport and finite angle message codecs

docs/ASSET_PIPELINE_TODO.md

@@ -232,3 +232,5 @@ Research progress: [message width codecs](research/MESSAGE_WIDTHS.md) adds bound
 Research progress: [message wrappers](research/MESSAGE_WRAPPERS.md) adds scalar OOB and data overflow contracts (RE-373–375). Broader codec/packet conversion milestones remain open; RE-376 tracks compressed/read/string/delta/snapshot and runtime/platform validation.
 
 Research progress: [message strings and data reads](research/MESSAGE_STRINGS.md) adds OOB reader/cursor/string contracts (RE-377–379). RE-380 retains compressed/library/caller/higher-level packet/runtime/platform work; no broad network conversion milestone is complete.
+
+Research progress: [numeric message codecs](research/MESSAGE_NUMERIC.md) adds raw float and finite angle contracts (RE-381–383). RE-384 retains compressed/delta/caller/numeric-control/packet/runtime/platform validation; broad codec conversion milestones remain open.

docs/FINDINGS.md

@@ -426,3 +426,9 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 **F-143 — Observed string readers:** ordinary/line/big readers terminate on consumed NUL/EOF, with line also consuming newline; capacities store at most 1023/1023/8191 bytes. They return recovered static buffers and replace percent/high bytes with periods. Caller lifetime/compressed/malformed/platform coverage remains open. [TEXT-002](research/MESSAGE_STRINGS.md).
 
 **F-144 — Observed string writers:** signed low-word length guards use limits 1024/8192; null/over-limit paths request an empty byte. Small supplied-copy fixtures sanitize high bytes, retain percent and request every byte plus NUL even after child space failure. Native library-copy/strlen, complete maximum emission and real compressed/caller/runtime behavior remain open. [TEXT-003](research/MESSAGE_STRINGS.md).
+
+**F-145 — Observed float transport:** raw low scalar bits forward as a 32-bit word; bounded OOB compositions retain even supplied nonfinite payload words without arithmetic. ReadFloat's signed post-read size failure substitutes 0xbf800000 (-1.0). Hardware nonfinite semantics/caller/compressed/runtime contracts remain open. [NUM-001](research/MESSAGE_NUMERIC.md).
+
+**F-146 — Observed finite angle encoding:** file-backed binary32 scales, rounded multiplication, truncation and low 8/16-bit masks determine sampled OOB words. Nonfinite/conversion/control-state and caller/platform behavior remain open; absent parsed ReadAngle symbols do not prove absent decoding. [NUM-002](research/MESSAGE_NUMERIC.md).
+
+**F-147 — Observed signed angle16 decoding:** accepted low words sign extend, scale through binary64 by 360/65536 and return binary32. Post-read EOF directly returns -360/65536, sharing a valid signed -1 angle word. Finite OOB compositions verify quantized results; full caller/compressed/runtime behavior remains open. [NUM-003](research/MESSAGE_NUMERIC.md).

docs/PROVISIONAL_TODO.md

@@ -544,3 +544,5 @@ Research progress: [message width codecs](research/MESSAGE_WIDTHS.md) completes
 Research progress: [message wrappers](research/MESSAGE_WRAPPERS.md) completes bounded RE-373–375. RE-376 leaves ReadData/compressed/string/delta/snapshot compositions, sentinel/lifecycle/alias and actual packet/platform validation open.
 
 Research progress: [message strings and data reads](research/MESSAGE_STRINGS.md) completes bounded RE-377–379. RE-380 leaves compressed/library/caller-lifetime/alias/lifecycle and higher-level packet/platform contracts open.
+
+Research progress: [numeric message codecs](research/MESSAGE_NUMERIC.md) completes bounded RE-381–383. RE-384 leaves delta/snapshot/angle callers and complete compressed/numeric-control/runtime/platform contracts open.

docs/RESEARCH_LEDGER.md

@@ -241,3 +241,7 @@ Completed bounded RE-373–375 with `analyze_message_wrappers.py`: 22 verified g
 ## 2026-10-11 — OOB data reads and message strings
 
 Completed bounded RE-377–379 with `analyze_message_strings.py`: sixteen verified graphs across the Linux ELF64 engines, 106 actual OOB data-read compositions, ninety string-read compositions, 120 string-write compositions and 24 supplied writer length-guard probes. TEXT-001–003/F-142–144 distinguish continued EOF data requests and 0xff stores from read safety, consumed NUL/newline/EOF termination from capacity termination, static output addresses from caller lifetime, and reader percent/high-byte replacement from writer high-byte-only replacement. Complete OOB capacity fixtures recover 1023/1023/8191-byte ordinary/line/big outputs, terminators, unread following bytes and canaries. Writer strlen returns and Q_strncpyz copy/NUL effects are supplied explicitly; native sanitation and byte requests compose OOB child stores, including overflow continuation. File-backed empty-byte offsets are retained; over-limit and signed low-word guard probes do not claim legal huge strings or library conformance. Save/restore/PUSH/POP omissions, disjoint virtual frames and explicit caller-register retention are documented; no original process or native callee executes. Eight independent tests verify data requests/cursors/EOF prefixes and tails, string termination/sanitation/capacity/pointers/control bytes, writer copy/NUL/capacity effects, signed length/empty-byte boundaries and paired outcomes. All 366 tests pass; new and preceding reports regenerate byte-identically, with storage/link/whitespace checks passing. RE-376 remains open; RE-380 tracks compressed/library/caller lifetime/alias/nonterminated/overflow/reset/truncation/cursor contracts, float/angle/delta/entity/player/snapshot codecs, native seeded codewords and actual packet/runtime/all-platform/renderer validation.
+
+## 2026-10-11 — Float word transport and finite angle codecs
+
+Completed bounded RE-381–383 with `analyze_message_numeric.py`: fourteen verified graphs across the Linux ELF64 engines, 48 raw float OOB compositions, 360 supplied float-reader tails, sixty finite angle-writer compositions and 210 supplied angle16-reader tails. Thirty angle16 compositions also decode exact writer bytes through OOB ReadBits and angle16 instructions. NUM-001–003/F-145–147 distinguish raw float bit transport (including supplied nonfinite payload words, without arithmetic) from numerical conversion, the float EOF word -1.0 from angle16's -360/65536 fallback, and finite scaled/truncated/masked angle output from unrestricted numeric/runtime behavior. Four file-backed constants per engine retain exact bytes/offsets; signed low-word angle decoding uses binary64 scaling before binary32 return, yielding a signed quantized domain. Scalar evaluator extensions are restricted to DX and finite/int32 conversion and low-double operations; exceptional/unsupported conversions fail closed. Frame-save/restore/PUSH/POP omissions, stopped helper/tail boundaries and explicit caller retention are documented; no original process or native callee executes. Eight independent tests verify raw payload/EOF transport, signed cursor guards, constants, struct-rounded finite encoding, signed decoding/fallback, exact angle16 OOB compositions, paired outcomes and restricted conversion/fail-closed behavior. All 374 tests pass; new and preceding reports regenerate byte-identically, and storage/link/whitespace checks pass. RE-380 remains open; RE-384 tracks delta/key/float/usercmd/entity/player/snapshot codecs, angle callers/inlined byte decoding, compressed/nonfinite/out-of-range/MXCSR/FTZ/DAZ/caller/lifecycle/truncation/cursor contracts, native seeded codewords and actual packet/runtime/all-platform/renderer conformance.

docs/REVERSE_ENGINEERING_TODO.md

@@ -457,3 +457,8 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 - [x] RE-378 Recover bounded ordinary/big/line string termination, percent/high-byte sanitation, static output and full capacity fixtures ([TEXT-002](research/MESSAGE_STRINGS.md)).
 - [x] RE-379 Recover writer length guards/null/over-limit paths and compose small supplied-copy sanitation/NUL OOB emission ([TEXT-003](research/MESSAGE_STRINGS.md)).
 - [ ] RE-380 Compose compressed scalar/data/string codecs and real library-copy/length behavior; recover string caller lifetime/limits/alias/nonterminated/overflow/reset/truncation/cursor invariants, float/angle/delta/entity/player/snapshot codecs, native seeded codewords and actual packet/runtime/all-platform/renderer contracts.
+
+- [x] RE-381 Recover raw float transport and bounded OOB/post-read EOF tails, including supplied nonfinite payload words ([NUM-001](research/MESSAGE_NUMERIC.md)).
+- [x] RE-382 Recover file-backed angle scales and bounded finite rounding/truncation/masking with OOB output ([NUM-002](research/MESSAGE_NUMERIC.md)).
+- [x] RE-383 Recover signed angle16 conversion/EOF fallback and compose finite OOB writer/reader paths ([NUM-003](research/MESSAGE_NUMERIC.md)).
+- [ ] RE-384 Recover delta/key/float/usercmd/entity/player/snapshot codecs and angle callers/inlined byte-angle decoding; validate compressed numeric/nonfinite/out-of-range/MXCSR/FTZ/DAZ/caller-sentinel/lifecycle/truncation/cursor contracts, native seeded codewords and actual packet/runtime/all-platform/renderer conformance.

docs/research/MESSAGE_NUMERIC.md

@@ -0,0 +1,48 @@
+# Raw float transport and finite angle codecs
+
+Reproduce with `python3 scripts/analyze_message_numeric.py`; validate with `python3 scripts/test_message_numeric.py`. [message-numeric.json](message-numeric.json) retains fourteen source/disassembly-hash-verified graphs across the Linux ELF64 dedicated/client engines, 48 float OOB compositions, 360 supplied float-reader tails, sixty finite angle-writer compositions and 210 supplied angle16-reader tails. Thirty of the angle-writer compositions also decode their exact OOB output through ReadBits and ReadAngle16 instructions. Four file-backed numeric constants per engine retain addresses, offsets and exact bytes.
+
+Original processes and native callees never execute. These are synthetic instruction compositions with explicit virtual memory/frames, stopped CALL/tail-jump boundaries and caller-register retention. Frame saves/restores and PUSH/POP are omitted/stopped. Supplied reader-tail return/count probes are separate from actual OOB writer/reader compositions. Float transport uses raw moves without numeric arithmetic. Angle arithmetic is restricted to finite in-range inputs and modeled ordinary scalar rounding; MXCSR, FTZ/DAZ, exceptions, nonfinite/out-of-range conversion and CPU/platform/runtime equivalence remain open. No compressed/full-packet conformance is established.
+
+## NUM-001 — Float word transport and post-read EOF (RE-381)
+
+MSG_WriteFloat moves the supplied low scalar word into a stack slot, reloads it as an integer and tail-forwards MSG_WriteBits(message, word, 32). It does not numerically convert the float to an integer. The recovered instruction slice therefore transports the raw 32-bit payload word.
+
+The sampled words include positive/negative zero, ordinary finite values, the largest finite binary32 word, a subnormal word, infinity words and multiple NaN payload words. Only move/store/load instructions operate on these words. This is synthetic raw-bit transport evidence, not execution of nonfinite floating arithmetic or a complete hardware NaN contract.
+
+Each engine has 24 OOB compositions: twelve raw words at capacities three/64. Ample capacity writes four little-endian bytes; the actual OOB reader consumes the same word and the Float reader tail returns its low scalar bits unchanged. Guarded capacity three sets writer overflow and emits nothing. The explicitly padded backing bytes remain 0xa5; the underlying OOB reader still advances readcount four and bit thirty-two, then ReadFloat substitutes the constant word 0xbf800000 (-1.0) because readcount exceeds cursize.
+
+Another 180 tail probes per engine supply twelve raw words, size words zero/four/0xffffffff and post-read count words zero/four/five/0x80000000/0xffffffff. The native signed comparison returns the supplied float bits when post-read count <= size; otherwise it returns 0xbf800000. A valid -1.0 payload shares the EOF fallback bits. Caller interpretation, legal wrapping cursors, access safety and compressed reads remain open.
+
+## NUM-002 — Finite angle writers (RE-382)
+
+The recovered file-backed binary32 scales are:
+
+| Writer | Scale bytes (little-endian) | Nominal expression |
+| --- | --- | --- |
+| MSG_WriteAngle | 610b363f | binary32(256 / 360) |
+| MSG_WriteAngle16 | 610b3643 | binary32(65536 / 360) |
+
+Each writer multiplies the supplied binary32 angle by its scale, converts the resulting scalar to a signed integer by truncation toward zero, masks that integer to eight/sixteen bits, and tail-forwards positive width eight/sixteen to WriteBits. The native scale is the rounded binary32 constant; the product is also modeled with binary32 rounding before truncation. Integer masking gives wrap behavior after conversion. It does not establish arbitrary input normalization or valid caller angle ranges.
+
+Thirty finite writer fixtures per engine cover both widths, positive/negative zero, positive/negative one, ±45.125, ±90, 180, 270, 359.9, ±360, 720 and 65535 degrees. All scaled values are within the modeled signed conversion range. Independent struct-based float rounding and truncation oracles verify the intermediate scalar word, forwarded integer/width, little-endian OOB payload, size and bit cursor.
+
+Examples: 90 maps to byte 64/short 16384; -90 maps to byte 192/short 49152; 180 maps to byte 128/short 32768; ±360 and 720 mask to zero in these fixtures. Nonfinite, conversion overflow, altered rounding modes, denormal handling and actual angle caller quantization remain unverified.
+
+The parsed function sets contain MSG_WriteAngle but no MSG_ReadAngle symbol. This does not establish that eight-bit angle decoding is absent from inlined code, other binaries or platforms.
+
+## NUM-003 — Signed angle16 reads and fallback (RE-383)
+
+MSG_ReadAngle16 requests positive width sixteen, then performs a signed post-read count/size check. Accepted reads sign extend the low sixteen-bit word, convert that integer to scalar binary64, multiply by the file-backed binary64 constant 360/65536, and convert the result to binary32. The multiplier bytes are 000000000080763f. This maps the accepted local domain to [-180, 180), with the high half of unsigned sixteen-bit input represented as negative angles.
+
+For example, 0x4000 returns +90; 0x8000 returns -180; 0xc000 returns -90; 0xffff returns -0.0054931640625. A failed post-read size check returns a file-backed binary32 constant directly: bytes 0000b4bb, also -0.0054931640625. This EOF fallback is therefore the same angle word as a valid signed short -1; it is not the float reader's -1.0 fallback. Caller sentinel handling remains open.
+
+Each image has 105 supplied-tail probes across seven low/full input words, three size words and five count words, including signed-negative count/size boundaries. Every sampled finite WriteAngle16 OOB output is also read through actual ReadBits instructions and the angle16 tail, verifying the signed decoded domain and exact read count/bit updates. These are quantized results, not exact restoration of arbitrary input degrees.
+
+The shared restricted evaluator adds DX, finite in-range CVTTSS2SI, signed-int32 CVTSI2SD, finite low-scalar MULSD and CVTSD2SS support. A dedicated independent fixture verifies register/memory conversion and truncation; NaN, infinity and out-of-range float-to-int inputs fail closed. Other double/vector lanes and machine floating control state remain unsupported/unmodeled.
+
+## Validation and next work
+
+Eight independent tests verify raw float words/OOB payloads, float signed EOF tails, exact file-backed constants, finite angle scale/round/truncate/mask, signed angle16 decoding/fallback, angle16 OOB compositions, paired engine outcomes and the restricted evaluator extension. The report retains compact composed instruction trace hashes.
+
+RE-384: recover delta/key/float/usercmd/entity/player/snapshot codecs and angle callers/inlined byte-angle decoding; validate compressed numeric wrappers, nonfinite/out-of-range/MXCSR/FTZ/DAZ conversion behavior, caller sentinel/lifecycle/truncation/cursor contracts, native seeded codewords and actual packet/runtime/all-platform/renderer conformance.

docs/research/MESSAGE_STRINGS.md

@@ -41,3 +41,5 @@ The normal reader and writer differ: the writer retains percent, while the reade
 Eight independent tests verify actual data-read requests/cursors and EOF prefixes; continuation/unchanged tails/canaries; string termination/sanitation; full capacity/return-pointer behavior; percent/high-byte/CR/newline cases; writer copied-byte/NUL/capacity effects; signed length guards/file-backed empty bytes; and paired engine outcomes. No evaluator extension was needed.
 
 RE-380: compose compressed scalar/data/string codecs and real library-copy/length behavior; recover string caller buffer lifetime/limits, alias/nonterminated/overflow/allowoverflow/reset/truncation/cursor invariants, float/angle/delta/entity/player/snapshot codecs, native full-seed codewords and actual packet/runtime/all-platform/renderer contracts.
+
+Follow-up: [numeric message codecs](MESSAGE_NUMERIC.md) recovers bounded float and finite angle wrappers. Broader RE-380 remains open; RE-384 tracks delta/angle callers and complete numeric/packet/platform contracts.

docs/research/README.md

@@ -145,3 +145,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 [Scalar message wrappers and data overflow](MESSAGE_WRAPPERS.md) adds RE-373–375: fixed-width forwarding, scalar conversion/post-read EOF, and data-writer continuation after child space failure. Reproduce with `python3 scripts/analyze_message_wrappers.py`; check with `python3 scripts/test_message_wrappers.py`. ReadData, compressed/higher-level codecs and actual packet/runtime/platform coverage remain open.
 
 [OOB data reads and message strings](MESSAGE_STRINGS.md) adds RE-377–379: actual ReadData cursor/EOF composition, ordinary/big/line string read limits/sanitation, and bounded supplied-copy string writing. Reproduce with `python3 scripts/analyze_message_strings.py`; check with `python3 scripts/test_message_strings.py`. Compressed/library/caller/higher-level and real packet/runtime/platform contracts remain open.
+
+[Raw float transport and finite angle codecs](MESSAGE_NUMERIC.md) adds RE-381–383: raw float OOB/EOF behavior, finite angle encoding and signed angle16 reads. Reproduce with `python3 scripts/analyze_message_numeric.py`; check with `python3 scripts/test_message_numeric.py`. Delta/caller/control-state/compressed and actual packet/runtime/platform contracts remain open.

scripts/analyze_collision_composition.py

@@ -6,6 +6,7 @@ import json
 import math
 from pathlib import Path
 import re
+import struct
 from analyze_chat_crosshair import bits,number
 from analyze_engine_control import control_flow
 from analyze_qvm import write_json
@@ -13,7 +14,7 @@ from analyze_vm_extensions import native_functions,verified
 
 
 def register(r):
-    aliases={'eax':('rax',32),'ax':('rax',16),'edi':('rdi',32),'esi':('rsi',32),'edx':('rdx',32),
+    aliases={'eax':('rax',32),'ax':('rax',16),'dx':('rdx',16),'edi':('rdi',32),'esi':('rsi',32),'edx':('rdx',32),
              'ecx':('rcx',32),'ebp':('rbp',32),'ebx':('rbx',32),'bx':('rbx',16),'bl':('rbx',8),'al':('rax',8),'sil':('rsi',8),'dl':('rdx',8),'cl':('rcx',8),'dil':('rdi',8),'bpl':('rbp',8)}
     r=r.lstrip('%')
     if r in aliases:return aliases[r]
@@ -144,6 +145,30 @@ def evaluate(graph,start,stops,memory,registers,limit=128,capture_registers=Fals
         elif op in ['addss','subss','mulss']:
             a,b=args.split(', ');v,w=number(read(a,4)),number(read(b,4))
             write(b,bits(w+v if op=='addss' else w-v if op=='subss' else w*v),4)
+        elif op=='cvttss2si':
+            a,b=args.split(', ')
+            if register(b)[1]!=32:raise ValueError('unsupported non-int32 scalar conversion')
+            v=number(read(a,4));value=int(v)
+            if not -2**31<=value<2**31:raise ValueError('unsupported out-of-range scalar conversion')
+            write(b,value,4)  # Finite truncation only; exception/MXCSR state unmodeled.
+        elif op=='cvtsi2sd':
+            a,b=args.split(', ')
+            if a.startswith('%') and register(a)[1]!=32:raise ValueError('unsupported non-int32 double conversion')
+            v=read(a,4)&0xffffffff;v=v if v<2**31 else v-2**32
+            regs[register(b)[0]]=struct.unpack('<Q',struct.pack('<d',float(v)))[0]
+        elif op in ['mulsd','cvtsd2ss']:
+            def scalar_double(arg):
+                if arg.startswith('%') and register(arg)[0] not in regs:raise ValueError('unknown scalar double register')
+                word=regs[register(arg)[0]] if arg.startswith('%') else read(arg,8)
+                v=struct.unpack('<d',struct.pack('<Q',word&((1<<64)-1)))[0]
+                if not math.isfinite(v):raise ValueError('unsupported nonfinite scalar double')
+                return v
+            a,b=args.split(', ');v=scalar_double(a)
+            if op=='mulsd':
+                result=scalar_double(b)*v
+                if not math.isfinite(result):raise ValueError('unsupported nonfinite scalar double result')
+                regs[register(b)[0]]=struct.unpack('<Q',struct.pack('<d',result))[0]
+            else:write(b,bits(v),4)
         elif op=='comiss':
             a,b=args.split(', ');v,w=number(read(a,4)),number(read(b,4));equal=v==w;ge=w>=v;greater=w>v;below=w<v;signed_le=signed_lt=negative=None
         elif op in ['sete','setne','setb','setbe','setae']:

scripts/analyze_message_numeric.py

@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+"""Raw float transport and bounded finite angle instruction compositions."""
+import copy
+import gzip
+import itertools
+import json
+from pathlib import Path
+import re
+from analyze_bsp_loading import read_address
+from analyze_bsp_references import global_address, trace_fields
+from analyze_chat_crosshair import bits
+from analyze_collision_composition import get_word, put_word
+from analyze_engine_control import control_flow
+from analyze_message_byte_codec import MSG
+from analyze_message_widths import reader, run, writer
+from analyze_message_wrappers import message_memory, WRAPPER_STACK
+from analyze_native import elf
+from analyze_qvm import write_json
+from analyze_vm_extensions import native_functions, verified
+
+
+WORDS=[0,0x80000000,0x3f800000,0xbf800000,0x3fc00000,0x7f7fffff,1,0x7f800000,0xff800000,0x7fc01234,0x7f801234,0xffffffff]
+ANGLES=[0.0,-0.0,1.0,-1.0,45.125,-45.125,90.0,-90.0,180.0,270.0,359.9,360.0,-360.0,720.0,65535.0]
+
+
+def frame_graph(g):
+    g=copy.deepcopy(g);omitted=[]
+    for x in g['instructions']:
+        if x['opcode'] in ['pushq','popq'] or (x['opcode']=='movq' and '(%rsp)' in x['operands']):
+            omitted.append(x['address']);x['opcode']='nop';x['operands']=''
+    return g,omitted
+
+
+def read_float(g,m,value):
+    g,omitted=frame_graph(g);rows=g['instructions'];ci=next(i for i,x in enumerate(rows) if '<MSG_ReadBits>' in x['operands']);end=next(x['address'] for x in rows if x['opcode']=='retq')
+    # Start after the helper: supply its return and retained message/frame.
+    t=run(g,rows[ci+1]['address'],[end],m,{'%rax':value,'%rbx':MSG,'%rsp':WRAPPER_STACK})
+    return t['registers']['xmm0'],t['trace'],omitted
+
+
+def read_angle(g,m,value):
+    g,omitted=frame_graph(g);rows=g['instructions'];ci=next(i for i,x in enumerate(rows) if '<MSG_ReadBits>' in x['operands']);ends=[x['address'] for x in rows if x['opcode']=='retq']
+    t=run(g,rows[ci+1]['address'],ends,m,{'%rax':value,'%rbx':MSG})
+    return t['registers']['xmm0'],t['trace'],omitted
+
+
+def main():
+    out={'native':{},'limitations':'Synthetic Linux ELF64 instruction compositions only. Original processes and native callees never execute. Float transport evaluates raw moves, including nonfinite payload words, not floating arithmetic. Angle arithmetic is restricted to supplied finite in-range inputs, signed int32 conversion, scalar binary64/32 operations under modeled ordinary rounding; exception/MXCSR/FTZ/DAZ/NaN/overflow behavior unmodeled. OOB child writer/reader instructions composed with explicit caller-register retention; frame saves/restores/PUSH/POP omitted/stopped. Supplied tail return/count probes are distinct from actual OOB compositions. Compressed/full-packet/runtime/all-platform conformance remains open.'}
+    for label in ['linux--Quake3-UrT-Ded.x86_64','linux--Quake3-UrT.x86_64']:
+        r=json.loads(Path(f'docs/research/native/{label}.json').read_text());data=verified((Path('.cache/UrbanTerror43')/r['source']['path']).read_bytes(),r['source']['sha256']);meta,_=elf(data);a=r['artifacts']['disassembly.txt'];fs=native_functions(verified(gzip.open(a['path'],'rb').read(),a['uncompressed_sha256']).decode());names=['MSG_WriteFloat','MSG_ReadFloat','MSG_WriteAngle','MSG_WriteAngle16','MSG_ReadAngle16','MSG_WriteBits','MSG_ReadBits'];graphs={n:control_flow(fs[n]) for n in names};constants=[];constant_memory={}
+        for name in ['MSG_WriteAngle','MSG_WriteAngle16','MSG_ReadAngle16']:
+            for x in graphs[name]['instructions']:
+                if '(%rip)' not in x['operands']:continue
+                size=8 if x['opcode']=='mulsd' else 4;address=global_address(x);raw,offset=read_address(data,meta['sections'],address,size)
+                for i,v in enumerate(raw):constant_memory[address+i]=v
+                constants.append({'function':name,'opcode':x['opcode'],'address':address,'file_offset':offset,'bytes_hex':raw.hex()})
+        floats=[];tails=[]
+        wg=graphs['MSG_WriteFloat'];jump=next(x['address'] for x in wg['instructions'] if x['opcode']=='jmp')
+        for word,capacity in itertools.product(WORDS,[3,64]):
+            t=run(wg,wg['instructions'][0]['address'],[jump],{}, {'%rdi':MSG,'%rsp':WRAPPER_STACK,'%xmm0':word});args=[t['registers'][k] for k in ['rdi','rsi','rdx']];m=message_memory(capacity)
+            for x in graphs['MSG_WriteBits']['instructions']:
+                if x['opcode']=='addl' and '(%rip)' in x['operands']:put_word(m,global_address(x),0)
+            m,requests,error,wt=writer(graphs,m,args[2],args[1]);size=get_word(m,MSG+28);bit=get_word(m,MSG+36);payload=bytes(m[0xa0000+i] for i in range(size)).hex();flag=get_word(m,MSG+4);put_word(m,MSG+32,0);put_word(m,MSG+36,7)
+            m,raw,read_error,rt=reader(graphs,m,32);result,tail,omitted=read_float(graphs['MSG_ReadFloat'],m,raw)
+            floats.append({'input_word':word,'capacity':capacity,'write_arguments':args,'payload_hex':payload,'write_size':size,'write_bit':bit,'read_count':get_word(m,MSG+32),'read_bit':get_word(m,MSG+36),'raw_read_word':raw,'result_word':result,'overflow_flag':flag,'omitted_frame_instructions':omitted,**trace_fields({'trace':t['trace']+wt+rt+tail},False)})
+            if requests or error or read_error:raise ValueError('unexpected float OOB helper')
+        for word,size,count in itertools.product(WORDS,[0,4,0xffffffff],[0,4,5,0x80000000,0xffffffff]):
+            m={};put_word(m,MSG+28,size);put_word(m,MSG+32,count);result,trace,omitted=read_float(graphs['MSG_ReadFloat'],m,word);tails.append({'supplied_word':word,'size_word':size,'post_count_word':count,'result_word':result,**trace_fields({'trace':trace},False)})
+        writes=[]
+        for name,angle in itertools.product(['MSG_WriteAngle','MSG_WriteAngle16'],ANGLES):
+            g=graphs[name];jump=next(x['address'] for x in g['instructions'] if x['opcode']=='jmp');word=bits(angle)&0xffffffff;t=run(g,g['instructions'][0]['address'],[jump],constant_memory,{'%xmm0':word,'%rdi':MSG});args=[t['registers'][k] for k in ['rdi','rsi','rdx']];m=message_memory(64)
+            for x in graphs['MSG_WriteBits']['instructions']:
+                if x['opcode']=='addl' and '(%rip)' in x['operands']:put_word(m,global_address(x),0)
+            m,requests,error,child=writer(graphs,m,args[2],args[1]);size=get_word(m,MSG+28);write_bit=get_word(m,MSG+36)
+            if requests or error:raise ValueError('angle OOB helper')
+            decoded=None;read_count=None;read_bit=None
+            if name=='MSG_WriteAngle16':
+                m.update(constant_memory);put_word(m,MSG+32,0);put_word(m,MSG+36,7)
+                m,raw,read_error,rt=reader(graphs,m,16);decoded,tail,_=read_angle(graphs['MSG_ReadAngle16'],m,raw);child+=rt+tail
+                if read_error:raise ValueError('angle16 OOB reader')
+                read_count=get_word(m,MSG+32);read_bit=get_word(m,MSG+36)
+            writes.append({'function':name,'input_word':word,'arguments':args,'scaled_word':t['registers']['xmm0'],'payload_hex':bytes(m[0xa0000+i] for i in range(size)).hex(),'size':size,'bit':write_bit,'angle16_read_word':decoded,'read_count':read_count,'read_bit':read_bit,**trace_fields({'trace':t['trace']+child},False)})
+        reads=[]
+        for word,size,count in itertools.product([0,1,32767,32768,65535,0x12348001,0xffffffff],[0,2,0xffffffff],[0,2,3,0x80000000,0xffffffff]):
+            m=dict(constant_memory);put_word(m,MSG+28,size);put_word(m,MSG+32,count);result,trace,omitted=read_angle(graphs['MSG_ReadAngle16'],m,word);reads.append({'supplied_word':word,'size_word':size,'post_count_word':count,'result_word':result,'omitted_frame_instructions':omitted,**trace_fields({'trace':trace},False)})
+        out['native'][label]={'source':r['source'],'disassembly_sha256':a['uncompressed_sha256'],'graphs':graphs,'file_backed_constants':constants,'float_oob':floats,'float_tails':tails,'angle_writes':writes,'angle16_tails':reads,'read_angle_symbol_present':'MSG_ReadAngle' in fs}
+    write_json(Path('docs/research/message-numeric.json'),out)
+    print('Recovered raw float transport and bounded finite angle conversions')
+
+
+if __name__=='__main__':main()

scripts/test_message_numeric.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+"""Independent raw-word transport, finite rounding and signed-angle oracles."""
+import json
+import math
+from pathlib import Path
+import struct
+import unittest
+from analyze_collision_composition import evaluate, put_word
+from test_bsp_planes import graph
+
+
+def f32(word):return struct.unpack('<f',struct.pack('<I',word&0xffffffff))[0]
+def word32(value):return struct.unpack('<I',struct.pack('<f',value))[0]
+def signed(word,bits=32):return ((word&((1<<bits)-1))^(1<<(bits-1)))-(1<<(bits-1))
+
+
+class MessageNumericTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/message-numeric.json').read_text())
+
+    def test_float_raw_words_and_oob_bytes_including_nonfinite_payloads(self):
+        for n in self.r['native'].values():
+            self.assertEqual(len(n['float_oob']),24)
+            for p in n['float_oob']:
+                accepted=p['capacity']>3;word=p['input_word'];self.assertEqual(p['write_arguments'],[0x90000,word,32]);self.assertEqual(p['payload_hex'],word.to_bytes(4,'little').hex() if accepted else '');self.assertEqual(p['write_size'],4 if accepted else 0);self.assertEqual(p['write_bit'],39 if accepted else 7);self.assertEqual(p['read_count'],4);self.assertEqual(p['read_bit'],39);self.assertEqual(p['raw_read_word'],word if accepted else 0xa5a5a5a5);self.assertEqual(p['result_word'],word if accepted else 0xbf800000);self.assertEqual(p['overflow_flag'],int(not accepted))
+
+    def test_float_post_read_signed_eof_word(self):
+        for n in self.r['native'].values():
+            self.assertEqual(len(n['float_tails']),180)
+            for p in n['float_tails']:
+                expected=p['supplied_word'] if signed(p['post_count_word'])<=signed(p['size_word']) else 0xbf800000
+                self.assertEqual(p['result_word'],expected)
+
+    def test_file_backed_angle_constants(self):
+        for n in self.r['native'].values():
+            expected={('MSG_WriteAngle','mulss'):struct.pack('<f',256/360).hex(),('MSG_WriteAngle16','mulss'):struct.pack('<f',65536/360).hex(),('MSG_ReadAngle16','movss'):struct.pack('<f',-360/65536).hex(),('MSG_ReadAngle16','mulsd'):struct.pack('<d',360/65536).hex()}
+            self.assertEqual({(p['function'],p['opcode']):p['bytes_hex'] for p in n['file_backed_constants']},expected)
+            for p in n['file_backed_constants']:self.assertGreaterEqual(p['file_offset'],0)
+            self.assertFalse(n['read_angle_symbol_present'])
+
+    def test_angle_finite_scale_truncate_mask_and_endian(self):
+        for n in self.r['native'].values():
+            self.assertEqual(len(n['angle_writes']),30)
+            for p in n['angle_writes']:
+                width=16 if p['function'].endswith('16') else 8;scale=f32(word32((1<<width)/360));scaled_word=word32(f32(p['input_word'])*scale);value=math.trunc(f32(scaled_word))&((1<<width)-1)
+                self.assertEqual(p['scaled_word'],scaled_word);self.assertEqual(p['arguments'],[0x90000,value,width]);self.assertEqual(p['payload_hex'],value.to_bytes(width//8,'little').hex());self.assertEqual(p['size'],width//8);self.assertEqual(p['bit'],7+width)
+
+    def test_angle16_signed_word_double_scale_and_eof_fallback(self):
+        for n in self.r['native'].values():
+            self.assertEqual(len(n['angle16_tails']),105)
+            for p in n['angle16_tails']:
+                accepted=signed(p['post_count_word'])<=signed(p['size_word']);value=signed(p['supplied_word'],16) if accepted else -1
+                self.assertEqual(p['result_word'],word32(value*(360/65536)))
+
+    def test_angle16_oob_roundtrip_signed_domain(self):
+        for n in self.r['native'].values():
+            for p in n['angle_writes']:
+                if not p['function'].endswith('16'):
+                    self.assertIsNone(p['angle16_read_word']);continue
+                value=p['arguments'][1];self.assertEqual(p['angle16_read_word'],word32(signed(value,16)*(360/65536)));self.assertEqual(p['read_count'],2);self.assertEqual(p['read_bit'],23)
+
+    def test_paired_results(self):
+        a,b=self.r['native'].values()
+        for key in ['float_oob','float_tails','angle_writes','angle16_tails']:
+            def clean(rows):return [{k:v for k,v in p.items() if k not in ['trace','trace_sha256','omitted_frame_instructions']} for p in rows]
+            self.assertEqual(clean(a[key]),clean(b[key]))
+
+    def test_restricted_finite_scalar_conversion_and_fail_closed(self):
+        g=graph([('cvttss2si','%xmm0, %esi'),('cvtsi2sd','%esi, %xmm1'),('mulsd','(%rdi), %xmm1'),('cvtsd2ss','%xmm1, %xmm0'),('nop','')]);m={};put_word(m,100,struct.unpack('<Q',struct.pack('<d',0.25))[0],8)
+        t=evaluate(g,0,[4],m,{'%xmm0':word32(-7.75),'%rdi':100},capture_registers=True);self.assertEqual(t['registers']['rsi'],(-7)&0xffffffff);self.assertEqual(t['registers']['xmm0'],word32(-1.75))
+        for word in [word32(2**31),0x7fc01234,0x7f800000]:
+            with self.assertRaises(ValueError):evaluate(g,0,[4],m,{'%xmm0':word,'%rdi':100},capture_registers=True)
+
+        for bad,regs in [([('cvttss2si','%xmm0, %rsi'),('nop','')],{'%xmm0':word32(1)}),([('cvtsi2sd','%rsi, %xmm1'),('nop','')],{'%rsi':1})]:
+            with self.assertRaises(ValueError):evaluate(graph(bad),0,[1],{},regs,capture_registers=True)
+
+
+if __name__=='__main__':unittest.main()