Recover crosshair geometry and trace result routing

docs/FINDINGS.md

@@ -276,3 +276,9 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 **F-068 — Observed cached location contract:** nonzero object field 848 returns only when signed now < pointed-field 596; equality misses. Wrapper 268637 returns zero without formatting on NULL, otherwise formats pointed-field 592 and returns one. Cache writers, source validity, caller failure handling and signed-wrap conformance remain open. [LOC-002](research/CHAT_LOCATIONS.md).
 
 **F-069 — Observed location list/search structure:** guarded registration publishes unknown at configstring 640, numbers qualifying objects and inserts reverse-order links through *(object+524)+24. Static lookup retains first trigger_location in a 40/40/52 query box, then distance <= best plus visibility fallback. Geometry/engine services, raw tag identity, list lifecycle and runtime/platform parity remain unverified. [LOC-003](research/CHAT_LOCATIONS.md).
+
+**F-070 — Observed crosshair arithmetic:** offset-4 >=3/override bypasses geometry; other paths use paired angle-service outputs, object-position plus integer height, and forward times 30000. Finite cardinal instruction fixtures verify basis/endpoint routing while native trig and coordinate conventions remain open. [AIM-001](research/CHAT_CROSSHAIR.md).
+
+**F-071 — Observed crosshair trace arguments:** service 24 receives result/origin/NULL/NULL/endpoint pointers, sender-record field 140 and mask 1. G_TRACE remains a pinned upstream candidate; full shipped structure/service semantics and runtime collision are unverified. [AIM-002](research/CHAT_CROSSHAIR.md).
+
+**F-072 — Observed crosshair result handling:** trace word +4 exactly 1 requests unknown then sender location. Other observed words build a cache-cleared temporary object from result +12/+16/+20; a subsequent comparison return zero triggers sender fallback. Calls/returns remain synthetic placeholders or isolated supplied inputs, so actual endpoint output/failure behavior is open. [AIM-003](research/CHAT_CROSSHAIR.md).

docs/PROVISIONAL_TODO.md

@@ -33,7 +33,7 @@ For implementation items, the minimum done condition is a documented contract, a
 
 ### First research batch
 
-Progress: [RE-232–234 / TIME-001–003](research/FRAME_TIMING.md) now cover Linux ELF64 elapsed modification, event sources and pause predicates. The [RE-237–239 follow-up](research/EVENT_QUEUES.md) resolves the pause-field address/bot chain and adds queue/journal evidence. The [RE-241–243 announcement pass](research/AUTH_ANNOUNCEMENTS.md) recovers label tables and recipient paths; The [RE-245–247 cvar pass](research/GAME_CVARS.md) adds all 126 main registration rows and resolves auth_verbosity/callers. The [RE-249–251 change pass](research/CVAR_CHANGES.md) adds cache/notification behavior, four numeric correction branches and direct registration coverage. The [RE-253–255 query pass](research/AUTH_QUERIES.md) adds selector helpers, command-role routing and internal authentication modes. The [RE-257–259 bounds/entry pass](research/SELECTOR_BOUNDS.md) adds integer parsing, selector storage/count evidence and native/QVM/chat route connections. The [RE-261–263 chat pass](research/CHAT_PATHS.md) adds native command metadata/filter evidence and bounded message/recipient paths, including the documented argument-mapping correction. The [RE-265–267 delivery pass](research/CHAT_DELIVERY.md) adds bounded dead-chat predicates, formatter argument routing and echo/fanout calls. The [RE-269–271 expansion pass](research/CHAT_EXPANSION.md) adds marker states, twelve key comparisons and health/momo branches. The [RE-273–275 item/time pass](research/CHAT_ITEMS_TIME.md) adds packed ammunition fields, sampled names and countdown branches. The [RE-277–279 location pass](research/CHAT_LOCATIONS.md) adds leader selection, cache/format boundaries and location-list/spatial evidence. PROV-002 remains open for full output/reset coverage. PROV-001 remains open for complete scheduling and platform coverage.
+Progress: [RE-232–234 / TIME-001–003](research/FRAME_TIMING.md) now cover Linux ELF64 elapsed modification, event sources and pause predicates. The [RE-237–239 follow-up](research/EVENT_QUEUES.md) resolves the pause-field address/bot chain and adds queue/journal evidence. The [RE-241–243 announcement pass](research/AUTH_ANNOUNCEMENTS.md) recovers label tables and recipient paths; The [RE-245–247 cvar pass](research/GAME_CVARS.md) adds all 126 main registration rows and resolves auth_verbosity/callers. The [RE-249–251 change pass](research/CVAR_CHANGES.md) adds cache/notification behavior, four numeric correction branches and direct registration coverage. The [RE-253–255 query pass](research/AUTH_QUERIES.md) adds selector helpers, command-role routing and internal authentication modes. The [RE-257–259 bounds/entry pass](research/SELECTOR_BOUNDS.md) adds integer parsing, selector storage/count evidence and native/QVM/chat route connections. The [RE-261–263 chat pass](research/CHAT_PATHS.md) adds native command metadata/filter evidence and bounded message/recipient paths, including the documented argument-mapping correction. The [RE-265–267 delivery pass](research/CHAT_DELIVERY.md) adds bounded dead-chat predicates, formatter argument routing and echo/fanout calls. The [RE-269–271 expansion pass](research/CHAT_EXPANSION.md) adds marker states, twelve key comparisons and health/momo branches. The [RE-273–275 item/time pass](research/CHAT_ITEMS_TIME.md) adds packed ammunition fields, sampled names and countdown branches. The [RE-277–279 location pass](research/CHAT_LOCATIONS.md) adds leader selection, cache/format boundaries and location-list/spatial evidence. The [RE-281–283 crosshair pass](research/CHAT_CROSSHAIR.md) adds finite geometry fixtures, trace arguments and result routing. PROV-002 remains open for full output/reset coverage. PROV-001 remains open for complete scheduling and platform coverage.
 
 Start with the open questions raised by the current binary evidence. These tasks depend on the linked reports, not on a working rewrite.
 

docs/RESEARCH_LEDGER.md

@@ -141,3 +141,7 @@ Completed bounded milestones RE-273–275 with `analyze_chat_items_time.py`: 32
 ## 2026-10-11 — Team leader and location lookup paths
 
 Completed RE-277–279 bounded/static milestones with `analyze_chat_locations.py`: six leader scans, three name chains, five cache boundaries, two wrapper returns, four registration paths, literal-reference windows and file-backed box extents. LOC-001–003/F-067–069 separate executed synthetic integer slices from retained floating-point/engine spatial code and distinguish upstream ABI candidates from native proof. Seven tests check first-match/nonzero semantics, strict expiry, failure/success formatting requests, guard/filter/numbering/reverse links and static spatial constants/branches. RE-272 remains open; RE-280 tracks writers/ownership/reset/geometry/client/runtime/platform composition. No original process/full QVM or recorded callee executes.
+
+## 2026-10-11 — Crosshair geometry and result routing
+
+Completed bounded milestones RE-281–283 with `analyze_chat_crosshair.py`: five dead gates, three origin/height cases, five supplied cardinal basis/endpoint cases, exact trace arguments, three result paths and three isolated comparison-return paths. AIM-001–003/F-070–072 separate finite straight-line binary32 arithmetic from native trig/collision and explicit zero callee-return placeholders. Eight tests check basis/origin/endpoints, seven-word ABI requests, exact-one status and temporary writes, fallback predicates and fail-closed float/memory/opcode/copy bounds. Added a separate restricted arithmetic evaluator without expanding the integer evaluator's domain. RE-272/280 remain open; RE-284 tracks full layout/float/temporary-object/output/runtime/platform contracts. No original process/full QVM or recorded callee executes.

docs/REVERSE_ENGINEERING_TODO.md

@@ -332,3 +332,8 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 - [x] RE-278 Recover strict location cache-expiry boundaries and isolated NULL/nonzero formatter-wrapper returns ([LOC-002](research/CHAT_LOCATIONS.md)).
 - [x] RE-279 Recover bounded location registration/filter/numbering/reverse-link paths and retain static box/distance/visibility search evidence ([LOC-003](research/CHAT_LOCATIONS.md)).
 - [ ] RE-280 Recover leader/cache/state writers, count/slot bounds, location class-tag derivation/list ownership/reset, caller failure/default behavior, full float/box/PVS search, configstring client consumption and original-runtime/platform fixtures.
+
+- [x] RE-281 Recover crosshair dead-state precondition, raw angle/distance constants, origin copy/height adjustment and finite cardinal basis/endpoint instruction fixtures ([AIM-001](research/CHAT_CROSSHAIR.md)).
+- [x] RE-282 Recover exact seven-word crosshair trace argument contract and supplied field-140 forwarding ([AIM-002](research/CHAT_CROSSHAIR.md)).
+- [x] RE-283 Recover trace offset-4 exact-one branch, endpoint temporary-object/cache-clear writes and isolated comparison-controlled sender fallback ([AIM-003](research/CHAT_CROSSHAIR.md)).
+- [ ] RE-284 Confirm native trig services, full record/vector/trace layouts, float exceptional/angle domains, temporary-object requirements, location/comparison/default composition, collision masks and original-runtime/platform fixtures.

docs/research/CHAT_CROSSHAIR.md

@@ -0,0 +1,57 @@
+# Crosshair substitution geometry and result routing
+
+Static pass, 2026-10-11. Reproduce with `python3 scripts/analyze_chat_crosshair.py`; check with `python3 scripts/test_chat_crosshair.py`. [Generated evidence](chat-crosshair.json) includes verified qagame partitions, raw constants, bounded gate/argument/result traces and a separate finite binary32 arithmetic evaluator. No original process, complete QVM, native trig/collision service or recorded callee executes. Trig outputs, trace words/endpoints and isolated comparison returns are supplied fixture inputs. This extends the [location lookup findings](CHAT_LOCATIONS.md).
+
+## AIM-001: precondition, origin and direction arithmetic
+
+The `crosshair` key's branch in lookup 185212 first tests sender-record offset **4324 !=0** or offset **4 >=3**. Either condition calls location wrapper 268637 with sender/shared buffer/capacity 150 and returns the buffer pointer without computing a crosshair ray. The wrapper return is discarded. Synthetic state 0/2 reaches geometry; 3/4 or override reaches fallback. Failure/default output composition remains open.
+
+For the other path, record fields **152/156/160** are multiplied by raw float bits **1016003125**, value **0.01745329238474369**, before six encoded service calls, alternating **-104/-105** (service numbers 103/104). The supplied syscall candidate report does not identify these two names. The conventional sine/cosine interpretation of their paired outputs is used only to label the synthetic direction fixtures; the native service bodies and their accuracy remain unverified here.
+
+The subsequent instruction arithmetic forms three vectors. With supplied variables sp/cp at locals 1092/1108, sy/cy at 1096/1104 and sr/cr at 1088/1100, the recovered expressions are:
+
+```
+forward = (cp*cy, cp*sy, -sp)
+right   = (-sr*sp*cy + cr*sy, -sr*sp*sy - cr*cy, -sr*cp)
+up      = (cr*sp*cy + sr*sy, cr*sp*sy - sr*cy, cr*cp)
+```
+
+Only forward feeds this endpoint. Five supplied cardinal-output fixtures cover forward, yaw 90, pitch 90, yaw 180 and roll 90. The actual MULF/ADDF/NEGF sequence is evaluated with a binary32 pack after each operation. Those fixtures produce orthogonal unit bases, expected cardinal forward vectors and a roll-independent endpoint. They do not establish angle conventions against camera coordinates or all-angle/native trigonometric conformance.
+
+Origin helper **288871** copies three words from object offsets **24/28/32** into the caller vector, then adds signed integer sender-record field **164**, converted by CVIF, to its third component. Three synthetic position/height cases evaluate that BLOCK_COPY/CVIF/ADDF sequence. The endpoint then evaluates:
+
+```
+endpoint = origin + forward * 30000.0
+```
+
+Distance bits **1189765120** decode to **30000.0**. The finite evaluator supports only straight-line CONST/LOCAL/word load/store/address add, finite MULF/ADDF/NEGF/CVIF and aligned 12-byte fixture copies. Unknown memory, unsupported operations, stack underflow, nonfinite inputs/results, overflow and slice limits fail closed. It is separate from the existing integer evaluator and does not model byte aliasing, native rounding modes, exceptional floats or full VM frame unwinding. Tests include binary32 integer-rounding and signed zero.
+
+## AIM-002: trace argument contract
+
+The ray call uses encoded target **-25**, service **24**, labeled **G_TRACE** by the [pinned ABI candidate report](qvm/qagame.abi-candidates.json). The collector checks that report's qagame hash. Its exact seven argument words are:
+
+| Argument offset | Value |
+| ---: | --- |
+| 8 | result structure pointer, local 144 |
+| 12 | origin pointer, local 120 |
+| 16 | zero |
+| 20 | zero |
+| 24 | endpoint pointer, local 132 |
+| 28 | sender-record word 140 |
+| 32 | integer **1** |
+
+The fixture supplies field 140 as 7 and records it without interpreting its complete identity. Null extents and mask 1 are raw call evidence; point-ray/content/pass-entity semantics still require native structure/service confirmation across targets. The origin-helper and trace callees are not entered in this argument slice. The ray result structure layout is only partly observed by subsequent word reads.
+
+## AIM-003: trace status, temporary object and comparison fallback
+
+After the trace call, local **148**, the word at result base **+4**, is compared to **exactly 1**. This is the second result word; its full status-field identity is not assigned here.
+
+When that word equals 1, the code requests copy helper 36185 to set the shared output to literal **`unknown`**, then calls 268637 for the sender and reaches the buffer-return tail. Neither helper executes in the fixture, so failure of the second call does not prove its actual final output.
+
+For other tested words **0 and 2**, it copies result words at offsets **+12/+16/+20** into a temporary object beginning at local **200**, specifically object-relative offsets **488/492/496**. It clears temporary offset **848**, then requests location wrapper 268637 with that temporary object, output buffer 35738436 and capacity 150. Clearing offset 848 ensures this temporary lookup cannot take the observed nonzero-cache fast path; the rest of the object's initialization/lifetime remains open.
+
+The wrapper return is discarded. Next helper **36306** receives the shared buffer and literal `unknown`. A comparison return **zero** invokes sender location fallback; supplied returns **1/-1** skip it. Full comparison-string execution is retained in the helper partition but not evaluated by this pass. Whole bounded result fixtures have zero CALL return placeholders and therefore take this fallback; those traces must not be mistaken for evidence that the real endpoint lookup always fails or yields unknown.
+
+## Remaining work and Rust dependencies
+
+RE-281–283 cover bounded geometry, trace arguments and result routing. RE-272/280 remain open; RE-284 tracks native service-103/104 trig identity/accuracy, real record/vector/trace layouts, exceptional float and angle domains, full temporary-object memory requirements, location/comparison/default composition, collision/content masks and original-runtime/platform fixtures. Rust crosshair text needs both sender and endpoint location routes, exact status predicates and validated coordinate/trace contracts before claiming gameplay parity.

docs/research/CHAT_LOCATIONS.md

@@ -46,3 +46,5 @@ The [pinned ABI candidate report](qvm/qagame.abi-candidates.json), checked again
 ## Remaining work and Rust dependencies
 
 RE-277–279 record these bounded/static milestones; RE-272 remains open for full substitution behavior. RE-280 tracks leader-flag/state writers, count/slot invariants, caller failure/default behavior, cache writers/expiry/reset, raw class tag derivation, linked-field ownership, full floating-point/box/PVS selection, configstring clients and original-runtime/platform fixtures. Rust location lookup needs explicit cache/ordering/tie rules and ownership backed by that evidence; a generic nearest-point search would not reproduce the observed two-stage control flow by itself.
+
+The [AIM-001–003 follow-up](CHAT_CROSSHAIR.md) recovers the crosshair caller's geometry/trace/result routes. Full spatial services, caller output and runtime behavior remain open under RE-280/284.

docs/research/README.md

@@ -40,10 +40,11 @@ python3 scripts/test_chat_delivery.py
 python3 scripts/test_chat_expansion.py
 python3 scripts/test_chat_items_time.py
 python3 scripts/test_chat_locations.py
+python3 scripts/test_chat_crosshair.py
 python3 scripts/storage_policy.py check --require-setup
 ```
 
-The pipeline runs `fetch_analysis_references.py`, `analyze_qvm.py`, `analyze_native.py`, `analyze_vm_abi.py`, `analyze_native_dispatch.py`, `analyze_vm_extensions.py`, `analyze_native_metadata.py`, `analyze_native_coverage.py`, `analyze_auth_drop.py`, `analyze_deferred_auth.py`, `analyze_engine_control.py`, `analyze_frame_timing.py`, `analyze_event_queues.py`, `analyze_auth_announcements.py`, `analyze_game_cvars.py`, `analyze_cvar_changes.py`, `analyze_auth_queries.py`, `analyze_selector_bounds.py`, `analyze_chat_paths.py`, `analyze_chat_delivery.py`, `analyze_chat_expansion.py`, `analyze_chat_items_time.py`, and `analyze_chat_locations.py` in that order. Python 3.9+ and **LLVM objdump** with x86 ELF/COFF/Mach-O support are required. This pass used Apple LLVM 17.0.0 on macOS arm64; it disassembled x86 images without running them. Upstream references are downloaded only if absent, checked against the committed SHA-256 manifest, and cached under `.cache/research/upstream/`. A clone also needs `git lfs pull` to obtain the derived artifacts/extracted members.
+The pipeline runs `fetch_analysis_references.py`, `analyze_qvm.py`, `analyze_native.py`, `analyze_vm_abi.py`, `analyze_native_dispatch.py`, `analyze_vm_extensions.py`, `analyze_native_metadata.py`, `analyze_native_coverage.py`, `analyze_auth_drop.py`, `analyze_deferred_auth.py`, `analyze_engine_control.py`, `analyze_frame_timing.py`, `analyze_event_queues.py`, `analyze_auth_announcements.py`, `analyze_game_cvars.py`, `analyze_cvar_changes.py`, `analyze_auth_queries.py`, `analyze_selector_bounds.py`, `analyze_chat_paths.py`, `analyze_chat_delivery.py`, `analyze_chat_expansion.py`, `analyze_chat_items_time.py`, `analyze_chat_locations.py`, and `analyze_chat_crosshair.py` in that order. Python 3.9+ and **LLVM objdump** with x86 ELF/COFF/Mach-O support are required. This pass used Apple LLVM 17.0.0 on macOS arm64; it disassembled x86 images without running them. Upstream references are downloaded only if absent, checked against the committed SHA-256 manifest, and cached under `.cache/research/upstream/`. A clone also needs `git lfs pull` to obtain the derived artifacts/extracted members.
 
 Generated JSON/JSONL and compressed evidence are regenerated in place; keep prose notes in Markdown. Rerunning the four analysis stages reproduced every generated report and gzip artifact byte-for-byte on the same toolchain. gzip timestamps and stored filenames are fixed. Different objdump versions can produce different disassembly text, so tool version and uncompressed evidence hashes are recorded. Reports are UTF-8 normal Git text, with individual files below the storage policy's 2 MiB limit.
 
@@ -91,3 +92,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 [Chat ammunition, item names and countdowns](CHAT_ITEMS_TIME.md) adds RE-273–275: packed byte extraction, thirty sampled name words/game-item branches and timer/cvar/gate evidence. Reproduce with `python3 scripts/analyze_chat_items_time.py`; check with `python3 scripts/test_chat_items_time.py`. Complete item tables/producers and timing/output/runtime contracts remain open.
 
 [Team-leader and location lookup paths](CHAT_LOCATIONS.md) adds RE-277–279: first-match leader scan, strict cache/format boundaries, location registration/list order and retained spatial control flow/constants. Reproduce with `python3 scripts/analyze_chat_locations.py`; check with `python3 scripts/test_chat_locations.py`. Geometry/services, ownership, caller output and runtime/platform contracts remain open.
+
+[Crosshair substitution geometry and results](CHAT_CROSSHAIR.md) adds RE-281–283: bounded origin/basis/endpoint arithmetic, exact trace arguments and status/temp-object/fallback routes. Reproduce with `python3 scripts/analyze_chat_crosshair.py`; check with `python3 scripts/test_chat_crosshair.py`. Engine trig/collision and complete output/runtime/platform conformance remain open.

scripts/analyze_binaries.py

@@ -14,7 +14,7 @@ def main():
                    'analyze_deferred_auth.py', 'analyze_engine_control.py', 'analyze_frame_timing.py',
                    'analyze_event_queues.py', 'analyze_auth_announcements.py', 'analyze_game_cvars.py',
                    'analyze_cvar_changes.py', 'analyze_auth_queries.py', 'analyze_selector_bounds.py',
-                   'analyze_chat_paths.py', 'analyze_chat_delivery.py', 'analyze_chat_expansion.py', 'analyze_chat_items_time.py', 'analyze_chat_locations.py'):
+                   'analyze_chat_paths.py', 'analyze_chat_delivery.py', 'analyze_chat_expansion.py', 'analyze_chat_items_time.py', 'analyze_chat_locations.py', 'analyze_chat_crosshair.py'):
         subprocess.run([sys.executable, str(Path('scripts')/script)], check=True)
 
 

scripts/analyze_chat_crosshair.py

@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+"""Recover bounded crosshair gates, finite float arithmetic and result routing."""
+import json
+import math
+import struct
+from pathlib import Path
+from analyze_deferred_auth import partition_function,trace_slice,signed32
+from analyze_game_cvars import vm_string
+from analyze_qvm import decode,write_json
+from analyze_vm_extensions import verified
+
+BASE=0x40000000
+
+
+def bits(value):
+    if not math.isfinite(value):raise ValueError('nonfinite float input')
+    try:raw=struct.pack('<f',value)
+    except (OverflowError,struct.error) as e:raise ValueError('float outside finite binary32') from e
+    if not math.isfinite(struct.unpack('<f',raw)[0]):raise ValueError('float outside finite binary32')
+    return signed32(struct.unpack('<I',raw)[0])
+
+
+def number(word):
+    value=struct.unpack('<f',struct.pack('<I',word&0xffffffff))[0]
+    if not math.isfinite(value):raise ValueError('nonfinite float word')
+    return value
+
+
+def float_slice(ins,start,stop,memory,locals_map,limit=256):
+    """Isolated straight-line finite arithmetic, not a full QVM float runtime."""
+    if not 0<=start<=stop<=len(ins) or stop-start>limit:raise ValueError('invalid float slice bounds')
+    m=dict(memory);m.update({BASE+k:v for k,v in locals_map.items()});stack=[];trace=[]
+    def read(address):
+        if address not in m:raise ValueError('unknown float-slice word')
+        return m[address]
+    for pc in range(start,stop):
+        x=ins[pc];op,v=x['opcode'],x['operand'];trace.append(pc)
+        needed={'LOAD4':1,'STORE4':2,'ADD':2,'MULF':2,'ADDF':2,'NEGF':1,'CVIF':1,'BLOCK_COPY':2}.get(op,0)
+        if len(stack)<needed:raise ValueError('float-slice stack underflow')
+        if op=='CONST':stack.append(v)
+        elif op=='LOCAL':stack.append(BASE+v)
+        elif op=='LOAD4':stack.append(read(stack.pop()))
+        elif op=='STORE4':
+            value,address=stack.pop(),stack.pop();m[address]=signed32(value)
+        elif op=='ADD':
+            b,a=stack.pop(),stack.pop();stack.append(signed32(a+b))
+        elif op in ['MULF','ADDF']:
+            b,a=number(stack.pop()),number(stack.pop());stack.append(bits(a*b if op=='MULF' else a+b))
+        elif op=='NEGF':stack.append(bits(-number(stack.pop())))
+        elif op=='CVIF':stack.append(bits(float(signed32(stack.pop()))))
+        elif op=='BLOCK_COPY':
+            if v!=12:raise ValueError('unsupported block-copy width')
+            source,destination=stack.pop(),stack.pop()
+            if source%4 or destination%4:raise ValueError('unaligned block-copy fixture')
+            values=[read(source+i) for i in [0,4,8]]
+            for i,val in zip([0,4,8],values):m[destination+i]=val
+        else:raise ValueError('unsupported float-slice opcode '+op)
+    return {'trace':trace,'memory':m,'stack':stack}
+
+
+def main():
+    q=json.loads(Path('docs/research/qvm/qagame.json').read_text())
+    d=verified(Path(q['source']['member']['output']).read_bytes(),q['sha256']);h,ins=decode(d)
+    obj,record=0x10000,0x20000
+    gates=[]
+    for state,override in [(0,0),(2,0),(3,0),(4,0),(0,1)]:
+        t=trace_slice(ins,186046,186084,{obj+520:record,record+4:state,record+4324:override},
+                      {1144:obj},halt_on_leave=True,capture_stack=True)
+        gates.append({'raw_state':state,'override':override,'trace':t})
+    origins=[]
+    for position,height in [([1,2,3],0),([10,20,30],26),([-1,-2,-3],-8)]:
+        output=0x30000;m={obj+24+4*i:bits(v) for i,v in enumerate(position)}
+        m.update({obj+520:record,record+164:height})
+        t=float_slice(ins,288872,288901,m,{20:obj,24:output})
+        origins.append({'position':position,'height_integer':height,'trace':t,
+                        'origin':[number(t['memory'][output+4*i]) for i in range(3)]})
+    vectors=[]
+    # Supplied trig outputs: cardinal yaw/pitch and roll variation, not syscall execution.
+    for label,sp,cp,sy,cy,sr,cr in [('forward',0,1,0,1,0,1),('yaw90',0,1,1,0,0,1),
+          ('pitch90',1,0,0,1,0,1),('yaw180',0,1,0,-1,0,1),('roll90',0,1,0,1,1,0)]:
+        trig={1092:bits(sp),1108:bits(cp),1096:bits(sy),1104:bits(cy),1088:bits(sr),1100:bits(cr)}
+        t=float_slice(ins,186186,186297,{},trig)
+        basis=[[number(t['memory'][BASE+k]) for k in offsets] for offsets in
+               [[84,88,92],[96,100,104],[108,112,116]]]
+        ep=float_slice(ins,186305,186332,{}, {120:bits(10),124:bits(20),128:bits(30),
+                           **{k:t['memory'][BASE+k] for k in [84,88,92]}})
+        vectors.append({'label':label,'supplied_trig_words':trig,'basis':basis,'trace':t,
+                        'origin':[10,20,30],'endpoint_trace':ep,
+                        'endpoint':[number(ep['memory'][BASE+k]) for k in [132,136,140]]})
+    trace_args=trace_slice(ins,186332,186356,{obj+520:record,record+140:7},{1144:obj})
+    results=[]
+    for flag in [0,1,2]:
+        t=trace_slice(ins,186356,186431,{}, {148:flag,156:bits(100),160:bits(200),164:bits(300),1144:obj})
+        results.append({'trace_word_offset4':flag,'endpoint':[100,200,300],'trace':t})
+    comparisons=[]
+    for result in [0,1,-1]:
+        t=trace_slice(ins,186411,186431,{}, {1084:result,1144:obj})
+        comparisons.append({'supplied_comparison_return':result,'trace':t})
+    abi=json.loads(Path('docs/research/qvm/qagame.abi-candidates.json').read_text())
+    if abi['sha256']!=q['sha256']:raise ValueError('ABI provenance mismatch')
+    out={'source':q['source'],'sha256':q['sha256'],'dead_gate_traces':gates,'origin_traces':origins,
+         'basis_endpoint_traces':vectors,'trace_argument_trace':trace_args,'result_traces':results,
+         'comparison_return_traces':comparisons,'abi_reference_revision':abi['reference_revision'],
+         'trace_service_candidate':next(x for x in abi['syscalls'] if x['number']==24),
+         'constants':{'angle_scale_bits':1016003125,'angle_scale_float':number(1016003125),
+                      'distance_bits':1189765120,'distance_float':number(1189765120)},
+         'strings':{'78120':vm_string(d,h,78120)},
+         'functions':{str(e):partition_function(ins,e,d,h) for e in [185212,288871,36306]},
+         'limitations':'Bounded synthetic integer and separate finite binary32 straight-line arithmetic, not '
+         'original runtime/full QVM. Trig outputs, trace status/endpoints and isolated comparison returns are '
+         'supplied. CALLs return zero placeholders. Native trigonometry/collision, floating-point exceptional '
+         'domains, actual string comparison/format/location output and platform parity remain open.'}
+    write_json(Path('docs/research/chat-crosshair.json'),out)
+    print('Recovered crosshair gate, origin/basis/endpoint arithmetic and trace-result routing')
+
+
+if __name__=='__main__':main()

scripts/test_chat_crosshair.py

@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+"""Crosshair finite arithmetic and independently supplied result boundaries."""
+import json
+from pathlib import Path
+import unittest
+from analyze_chat_crosshair import BASE,bits,number,float_slice
+
+
+class ChatCrosshairTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/chat-crosshair.json').read_text())
+
+    def test_dead_gate_preempts_direction(self):
+        rows=self.r['dead_gate_traces']
+        self.assertEqual([bool(x['trace']['calls']) for x in rows],[False,False,True,True,True])
+        for x in rows[2:]:
+            self.assertEqual(x['trace']['calls'][0]['target'],268637)
+            self.assertEqual(x['trace']['stack'],[35738436])
+            self.assertEqual(x['trace']['calls'][0]['args'],{'8':0x10000,'12':35738436,'16':150})
+
+    def test_origin_copy_and_integer_height(self):
+        for x in self.r['origin_traces']:
+            self.assertEqual(x['origin'],[x['position'][0],x['position'][1],x['position'][2]+x['height_integer']])
+            self.assertEqual(x['trace']['stack'],[])
+        self.assertEqual(self.r['constants']['distance_float'],30000.0)
+        self.assertAlmostEqual(self.r['constants']['angle_scale_float'],0.01745329238474369)
+
+    def test_basis_cardinals_and_roll_independence(self):
+        rows=self.r['basis_endpoint_traces']
+        self.assertEqual([x['basis'][0] for x in rows],[[1,0,0],[0,1,0],[0,0,-1],[-1,0,0],[1,0,0]])
+        for x in rows:
+            v=x['basis'];self.assertEqual([sum(a*a for a in axis) for axis in v],[1,1,1])
+            self.assertEqual([sum(a*b for a,b in zip(v[i],v[j])) for i,j in [(0,1),(0,2),(1,2)]],[0,0,0])
+            self.assertEqual(x['endpoint'],[o+30000*f for o,f in zip(x['origin'],v[0])])
+        self.assertNotEqual(rows[0]['basis'][1:],rows[-1]['basis'][1:])
+
+    def test_trace_argument_contract(self):
+        c=self.r['trace_argument_trace']['calls'];self.assertEqual(len(c),1)
+        self.assertEqual(c[0]['target'],-25)
+        self.assertEqual(c[0]['args'],{'8':BASE+144,'12':BASE+120,'16':0,'20':0,
+                                     '24':BASE+132,'28':7,'32':1})
+        self.assertEqual(self.r['trace_service_candidate']['upstream_name_candidate'],'G_TRACE')
+
+    def test_trace_status_exact_one_and_temp_object(self):
+        rows=self.r['result_traces']
+        self.assertEqual([[c['target'] for c in x['trace']['calls']] for x in rows],
+                         [[268637,36306,268637],[36185,268637],[268637,36306,268637]])
+        for x in [rows[0],rows[2]]:
+            t=x['trace'];self.assertEqual(t['calls'][0]['args']['8'],BASE+200)
+            self.assertEqual([number(t['memory'][str(BASE+k)]) for k in [688,692,696]],[100,200,300])
+            self.assertEqual(t['memory'][str(BASE+1048)],0)
+        self.assertEqual(rows[1]['trace']['calls'][0]['args'],{'8':35738436,'12':78120})
+        self.assertEqual(self.r['strings']['78120'],'unknown')
+
+    def test_supplied_comparison_return_controls_fallback(self):
+        rows=self.r['comparison_return_traces']
+        self.assertEqual([len(x['trace']['calls']) for x in rows],[1,0,0])
+        self.assertEqual(rows[0]['trace']['calls'][0]['args']['8'],0x10000)
+
+    def test_finite_float_rounding_and_exception_bounds(self):
+        self.assertEqual(number(bits(16777217.0)),16777216.0)
+        self.assertEqual(bits(-0.0),-2147483648)
+        for value in [float('nan'),float('inf'),-float('inf'),1e39]:
+            with self.assertRaises(ValueError):bits(value)
+        for word in [0x7f800000,0x7fc00000]:
+            with self.assertRaises(ValueError):number(word)
+        ins=[{'opcode':op,'operand':value} for op,value in [('CONST',bits(3e38)),('CONST',bits(2)),('MULF',None)]]
+        with self.assertRaises(ValueError):float_slice(ins,0,3,{}, {})
+
+    def test_float_slice_unknown_reads_opcodes_and_copy_width(self):
+        with self.assertRaises(ValueError):float_slice([{'opcode':'LOAD4','operand':None}],0,1,{}, {})
+        # Provide the address before testing unknown-word rejection.
+        ins=[{'opcode':'CONST','operand':123},{'opcode':'LOAD4','operand':None}]
+        with self.assertRaises(ValueError):float_slice(ins,0,2,{}, {})
+        with self.assertRaises(ValueError):float_slice([{'opcode':'CALL','operand':None}],0,1,{}, {})
+        with self.assertRaises(ValueError):float_slice(ins,0,2,{}, {},limit=1)
+        copy=[{'opcode':'CONST','operand':0x20000},{'opcode':'CONST','operand':0x10000},
+              {'opcode':'BLOCK_COPY','operand':16}]
+        with self.assertRaises(ValueError):float_slice(copy,0,3,{}, {})
+
+
+if __name__=='__main__':unittest.main()