qvm: queried grenade construction

docs/ASSET_PIPELINE_TODO.md

@@ -676,3 +676,6 @@ Research progress: RE-665 [report](research/QVM_COMPLETE_POSE.md); remaining nat
 
 
 Research progress: RE-666 [report](research/QVM_ENTITY_FREE.md); remaining native/content/runtime/platform scope stays open.
+
+
+Research progress: RE-667 [report](research/QVM_QUERIED_GRENADE.md); remaining native/content/runtime/platform scope stays open.

docs/FINDINGS.md

@@ -1022,3 +1022,6 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 
 
 **RE-666 — Entity free control flow and conditional record reset:** 277400 unlinks, requests ordered resource releases and clears nine pointer fields before deciding whether548 suppresses the whole880-byte reset. [Evidence](research/QVM_ENTITY_FREE.md).
+
+
+**RE-667 — Grenade constructor with actual entity query and allocation:** Grenade construction now runs actual276433 over an explicit pool and inherits the selected entity velocity only when its ID equals the owner ground ID. [Evidence](research/QVM_QUERIED_GRENADE.md).

docs/PROVISIONAL_TODO.md

@@ -999,3 +999,6 @@ Research progress: RE-665 [report](research/QVM_COMPLETE_POSE.md); remaining nat
 
 
 Research progress: RE-666 [report](research/QVM_ENTITY_FREE.md); remaining native/content/runtime/platform scope stays open.
+
+
+Research progress: RE-667 [report](research/QVM_QUERIED_GRENADE.md); remaining native/content/runtime/platform scope stays open.

docs/RESEARCH_LEDGER.md

@@ -992,3 +992,8 @@ Complete32254 now reaches its void output boundary with actual swing, vector-ang
 ## 2026-10-20 — RE-666 Entity free control flow and conditional record reset (separate task commit)
 
 277400 unlinks, requests ordered resource releases and clears nine pointer fields before deciding whether548 suppresses the whole880-byte reset. 49 fixtures independently check every final record word, null/protected exits, resource ordering, aliased release requests and exact zero-fill gating. Full suite: 1129 tests pass. Report regenerates byte-identically (808034 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.
+
+
+## 2026-10-20 — RE-667 Grenade constructor with actual entity query and allocation (separate task commit)
+
+Grenade construction now runs actual276433 over an explicit pool and inherits the selected entity velocity only when its ID equals the owner ground ID. 28 complete constructor fixtures check actual first-eligible query, skipped used/name/tag records, allocation reuse/extension and all220 final record words. Full suite: 1133 tests pass. Report regenerates byte-identically (1340521 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1042,3 +1042,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-666 Entity free control flow and conditional record reset ([report](research/QVM_ENTITY_FREE.md)).
+
+
+- [x] RE-667 Grenade constructor with actual entity query and allocation ([report](research/QVM_QUERIED_GRENADE.md)).

docs/research/QVM_QUERIED_GRENADE.md

@@ -0,0 +1,7 @@
+# Grenade constructor with actual entity query and allocation
+
+RE-667. Reproduce with `python3 scripts/analyze_qvm_queried_grenade.py`; check with `python3 scripts/test_qvm_queried_grenade.py`. The [machine report](qvm-queried-grenade.json) retains source identity and bounded fixtures.
+
+An optional query resolver composes recovered276433 into285971 while preserving byte-identical default supplied-query reports. New fixtures combine actual lookup31691, allocation277165/277125 and query276433; no query response pointer is supplied. Query returns the first eligible record, including skipping unused/null-name/wrong-tag candidates. The report captures velocity from that actual selected record rather than a fixed fixture address. Independent full-record oracles check inherited velocity for ground matches, unchanged owner-only velocity for mismatches/no result, and both allocation reuse/extension modes. Finite sqrt remains modeled and native−16 registration captured. Grenade callback223156, trajectory/collision/explosion and live entity-pool legality remain open.
+
+No original executable/full QVM/native collision/physics/rendering executes. Native responses and legal input domains are supplied or unverified where stated; full runtime/macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/README.md

@@ -600,3 +600,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-666: Entity free control flow and conditional record reset](QVM_ENTITY_FREE.md). Reproduce with `python3 scripts/analyze_qvm_entity_free.py`; check with `python3 scripts/test_qvm_entity_free.py`.
+
+
+[RE-667: Grenade constructor with actual entity query and allocation](QVM_QUERIED_GRENADE.md). Reproduce with `python3 scripts/analyze_qvm_queried_grenade.py`; check with `python3 scripts/test_qvm_queried_grenade.py`.

scripts/analyze_qvm_grenade_setup.py

@@ -11,7 +11,7 @@ from analyze_qvm_slide_prefix import vec
 from analyze_qvm import write_json
 LOCAL=0x7f000000
 
-def grenade(ins,m,query_pointer=0,allocator=None):
+def grenade(ins,m,query_pointer=0,allocator=None,query_resolver=None):
     initial=state(m);before=record(m);weapons=[m[PS+312+4*j]&0xffffffff for j in range(16)];minus=m[PS+308]&0xffffffff;m[LOCAL+84]=ENTITY;query=[];speeds={str(mode):m[7304+52*mode]&0xffffffff for mode in [0,1]};velocity=vec(m,PS+32);ground_velocity=vec(m,BASES+36)
     pointers=[]
     def allocated(i,m,a,c):
@@ -21,7 +21,13 @@ def grenade(ins,m,query_pointer=0,allocator=None):
         m,r=allocator(i,m);p=r['selected']
         if p is None:raise ValueError('Grenade allocation did not return')
         pointers.append(p);before=record(m,p);return m,c,p,r
-    def find(i,m,a,c):r={'arguments':a,'supplied_pointer':query_pointer,'entity_id':m.get(query_pointer),'query_not_executed':True};query.append(r);return m,c,query_pointer,r
+    def find(i,m,a,c):
+        nonlocal ground_velocity
+        if query_resolver is None:
+            r={'arguments':a,'supplied_pointer':query_pointer,'entity_id':m.get(query_pointer),'query_not_executed':True};query.append(r);return m,c,query_pointer,r
+        m,e=query_resolver(i,m,a[8],a[12]);pointer=e['result']
+        if pointer:ground_velocity=vec(m,pointer+36)
+        r={'arguments':a,'selected_pointer':pointer,'entity_id':m.get(pointer),'execution':e};query.append(r);return m,c,pointer,r
     m,c,r=execute(ins,285972,286471,m,(0,0,0),LOCAL,{31691:lookup,277165:allocated,276433:find});slot=r['children'][0]['effect']['execution']['return'];mode=m[LOCAL+24]
     return m,{'initial':initial,'initial_record':before,'weapon_slots':weapons,'slot_minus1_word':minus,'lookup_slot':slot,'mode':mode,'speeds':speeds,'word7224':m[7224]&0xffffffff,'time':m[34992532],'owner_velocity':velocity,'ground_velocity':ground_velocity,'query':query,'execution':r,'final_record':record(m,pointers[0]),'final':state(m)}
 

scripts/analyze_qvm_queried_grenade.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+"""Actual allocator and276433 query composed into grenade construction."""
+import itertools
+from pathlib import Path
+from qvm_research_support import source
+from qvm_server_fire_support import BASES
+from analyze_qvm_entity_allocate import allocate
+from analyze_qvm_entity_query import query,TAG
+from analyze_qvm_entity_init import POOL,STRIDE
+from analyze_qvm_allocated_event import setup
+from analyze_qvm_grenade_setup import grenade
+from analyze_qvm_acceleration import PS,word
+from analyze_qvm import write_json
+
+def main():
+    q,raw,h,ins=source();rows=[]
+    for reused,mode,kind in itertools.product([False,True],[0,1],['none','first-ground','first-other','skip-unused','skip-null','skip-tag','two-matches']):
+        m=setup(raw,h,reused);m[0x90000+192]=7;m[PS+312]=7|(mode<<16);m[PS+68]=8 if kind in ['first-other','skip-unused','skip-null','skip-tag'] else 2
+        for o in range(0,880,4):m[BASES+o]=0
+        for j in range(64):
+            for o in [532,536,540]:m[POOL+j*STRIDE+o]=0
+        candidates=[]
+        for j in [2,8]:
+            pointer=POOL+j*STRIDE
+            for o in range(0,880,4):m[pointer+o]=0
+            used=0 if kind=='none' or (j==2 and kind=='skip-unused') else 1;name=0 if j==2 and kind=='skip-null' else 0x50000+4*j;tag=0 if j==2 and kind=='skip-tag' else TAG;m.update({pointer:j,pointer+532:used,pointer+536:name,pointer+540:tag})
+            velocity=[word(v) for v in ([.5,-.25,2] if j==2 else [3,4,-1])]
+            for k,v in enumerate(velocity):m[pointer+36+4*k]=v
+            candidates.append({'pointer':pointer,'id':j,'used':used,'name_pointer':name,'tag':tag,'velocity':velocity})
+        _,r=grenade(ins,m,allocator=allocate,query_resolver=query);r.update({'reuse':reused,'kind':kind,'pool_candidates':candidates});rows.append(r)
+    write_json(Path('docs/research/qvm-queried-grenade.json'),{'source':q['source'],'sha256':q['sha256'],'probes':rows,'limits':'Actual285971/31691/277165/277125/276433. Native−16 registration captured and finite sqrt modeled. Entity pool is explicit; no trajectory/223156/native world collision/explosion or live reference parity.'})
+if __name__=='__main__':main()

scripts/test_qvm_queried_grenade.py

@@ -0,0 +1,20 @@
+import json,unittest,copy
+from pathlib import Path
+from test_qvm_grenade_setup import projectile
+class QueriedGrenadeTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.rows=json.loads(Path('docs/research/qvm-queried-grenade.json').read_text())['probes']
+    def test_query_selects_first_eligible_record(self):
+        self.assertEqual(len(self.rows),28)
+        for p in self.rows:
+            candidates=[c for c in p['pool_candidates'] if c['used'] and c['name_pointer'] and c['tag']==-913528516];q=p['query'][0];expected=candidates[0]['pointer'] if candidates else 0;self.assertEqual(q['selected_pointer'],expected);self.assertEqual(q['execution']['result'],expected)
+            if candidates:self.assertEqual(p['ground_velocity'],candidates[0]['velocity']);self.assertEqual(q['entity_id'],candidates[0]['id'])
+    def test_whole_constructor_record_with_independent_velocity_oracle(self):
+        for p in self.rows:
+            fixture=copy.deepcopy(p);fixture['query'][0]['supplied_pointer']=fixture['query'][0]['selected_pointer'];self.assertEqual(p['final_record'],projectile(fixture))
+    def test_actual_allocation_query_and_caller_order(self):
+        for p in self.rows:
+            self.assertEqual([c['target'] for c in p['execution']['calls']],[31691,-107,277165,276433]);self.assertNotIn('query_not_executed',p['query'][0]);self.assertNotIn('supplied_pointer',p['query'][0]);self.assertEqual(p['query'][0]['arguments'],{'8':0,'12':-913528516});self.assertEqual(p['execution']['children'][2]['effect']['selected'],34147688)
+    def test_ground_mismatch_and_no_hit_paths_covered(self):
+        self.assertTrue(any(not p['query'][0]['selected_pointer'] for p in self.rows));self.assertTrue(any(p['query'][0]['selected_pointer'] and p['query'][0]['entity_id']!=p['initial']['ground'] for p in self.rows))
+if __name__=='__main__':unittest.main()