qvm: traversal query

docs/ASSET_PIPELINE_TODO.md

@@ -272,3 +272,5 @@ Research progress: [QVM animation assets and tables](research/QVM_ANIMATION_TABL
 Research progress: [QVM resource update and consumers](research/QVM_RESOURCE.md) completes bounded RE-453–455: reset/drain/recovery/counter policy, selected caller arguments and resource/posture/scale bridges. RE-444/448/452/456 retain native effects/semantic producers/live animation/contact/full-state/runtime/platform work; broad game/rendering milestones remain open.
 
 Research progress: [QVM timer aging and main routing](research/QVM_TIMERS_DISPATCH.md) completes bounded RE-457–459: countdown policy, main request/mode ordering and clock/posture/animation bridges. RE-456/460 retain actual helpers/producers/full environment-state composition/runtime/platform work; broad game/rendering milestones remain open.
+
+Research progress: [QVM traversal-query recovery](research/QVM_TRAVERSAL_QUERY.md) completes bounded RE-461–463: direction/release, short hull transition policy and evaluated query-to-main outputs. RE-460/464 retain native collision/clearance/actions/producers/full state/runtime/platform work; broad game/rendering milestones remain open.

docs/FINDINGS.md

@@ -546,3 +546,9 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 **F-203 — Main mode priority:** child53418 requests content/posture/ground before timer aging and54981(0); saved/current state220 bit1024 and a supplied56639 result control flag2/event23. Flag128, mask12, level>1, current bit1024 and walk word select one of six helpers before a common suffix. Other callee effects remain omitted. [ROUTE-001](research/QVM_TIMERS_DISPATCH.md).
 
 **F-204 — Clock/posture timer connection:**36 selected bridges pass actual clock elapsed and recovered posture animation/timer results into53048, then direct animation guards. New timer200 can age to184 in the same selected16-unit step, conditional on omitted intervening effects; complete state and actual animation-request policy remain open. [TIMER-002](research/QVM_TIMERS_DISPATCH.md).
+
+**F-205 — Query direction/release:**56214 projects supplied forward XY with Z0 and normalizes using a supplied root.56639 gates on state220 bit1024 or PS flag32; active release can add25 times a normalized vector with inverted XY and Z=-0.2, clear anchor/bit1024, floor field44 at300 and return0; upper-height release returns1. Native/semantic domains remain open. [QUERY-001](research/QVM_TRAVERSAL_QUERY.md).
+
+**F-206 — Short hull transition policy:**56639 uses min/max Z-4/+4 and literal mask65537 for traces with direction multipliers4/8. Supplied first/second fractions and56335 result control state retention/acquisition, truncated origin-Z anchor, vertical velocity zero and evaluated torso requests54/55. Native collision/clearance callee effects remain omitted. [QUERY-002](research/QVM_TRAVERSAL_QUERY.md).
+
+**F-207 — Actual query-to-caller decisions:**16 bridges show evaluated acquisition setting bit1024 while returning0, causing caller event23; some releases clear that bit while returning1, causing caller flag2 from the saved old bit. Full query velocity/anchor/animation/main state and runtime remain uncomposed. [QUERY-003](research/QVM_TRAVERSAL_QUERY.md).

docs/PROVISIONAL_TODO.md

@@ -584,3 +584,5 @@ Research progress: [QVM animation assets and tables](research/QVM_ANIMATION_TABL
 Research progress: [QVM resource update and consumers](research/QVM_RESOURCE.md) completes bounded RE-453–455: reset/drain/recovery/counter policy, selected caller arguments and resource/posture/scale bridges. RE-444/448/452/456 retain native effects/semantic producers/live animation/contact/full-state/runtime/platform work; broad game/rendering milestones remain open.
 
 Research progress: [QVM timer aging and main routing](research/QVM_TIMERS_DISPATCH.md) completes bounded RE-457–459: countdown policy, main request/mode ordering and clock/posture/animation bridges. RE-456/460 retain actual helpers/producers/full environment-state composition/runtime/platform work; broad game/rendering milestones remain open.
+
+Research progress: [QVM traversal-query recovery](research/QVM_TRAVERSAL_QUERY.md) completes bounded RE-461–463: direction/release, short hull transition policy and evaluated query-to-main outputs. RE-460/464 retain native collision/clearance/actions/producers/full state/runtime/platform work; broad game/rendering milestones remain open.

docs/RESEARCH_LEDGER.md

@@ -343,3 +343,7 @@ Completed bounded RE-453–455 with `analyze_qvm_resource.py`: verifies complete
 ## 2026-10-15 — Game-QVM timer aging, main movement routing and consumer bridges
 
 Completed bounded RE-457–459 with `analyze_qvm_timers_dispatch.py`: verifies complete helper53048 and child53418 main body54244–54474,600 timer probes,250 main routing probes and36 selected producer/consumer bridges. TIMER-001/ROUTE-001/TIMER-002/F-202–204 recover nonzero movement-timer equality expiry/mask192 clear versus already-zero preservation; positive-only leg/torso timer aging and negative-timer asymmetry; main content/saved-level/posture/ground/type3/timer/action ordering, saved/current state220 query/event23 policy, six-mode priority and exact common suffix/native-43 pointer request. Timer53048 effects are applied at its actual caller boundary; other main callees are recorded with omitted effects, supplied level/walk/PS words and explicit hypothetical state220 edits after54981/56639. Query return is supplied; no helper mutation is inferred from the edits. Bridges transfer actual clock elapsed, selected evaluated posture animation children/caller timer stores, timer results and direct animation-setter guards; intervening ground/type3/action/physics/native effects and complete shared-state composition remain omitted. Separate clock synthetic addresses are explicitly respected during scalar transfer. No original executable/full QVM/native collision/physics/rendering executes. Eight independent tests verify all timer results/immutable canaries, negative-zero-equality differences,250 exact request/argument sequences and routes, expiry priority, saved/current bit distinctions,36 clock/posture/timer/animation handoffs, provenance/partitions and scope. All527 tests pass. Direct step-state/animation-contact reports regenerate byte-identically; new report reproduces twice byte-identically (1241534 bytes). Storage/filter setup, documentation links and whitespace checks pass. No assets or existing analyzer/evaluator code changed. RE-456 and earlier broad tasks remain open; RE-460 tracks actual action/query/mode/suffix/native effects, timer/flag producers/legal domains, intervening ground/type3 mutations,47884 request policy and full environment/posture/timer/mode/state/gameplay/macOS/Linux/Rust/Bevy/Solari validation. Contact/resource/playback/packet/entity/player/snapshot/rendering milestones remain open.
+
+## 2026-10-15 — Game-QVM direction and traversal-query transitions
+
+Completed bounded RE-461–463 with `analyze_qvm_traversal_query.py`: verifies complete shipped qagame helpers56214/56639, five direction probes,348 query probes and16 evaluated return/state-to-main bridges. QUERY-001–003/F-205–207 recover XY projection/Z0/finite normalization, query activation/forward/ground/anchor-height guards, release impulse using inverted XY/fixed Z=-0.2 and25 scale, anchor/bit1024 cleanup/field44 minimum/return distinctions; two hull queries with min/max Z-4/+4, direction multipliers4/8, raised second start and literal mask65537; supplied-fraction/clearance-dependent acquisition, truncated origin-Z anchor, vertical velocity zero and actual torso54/55 child effects. Known direction and torso children execute as bounded instruction slices with separate synthetic local frames; native sqrt returns come from supplied finite math. Trace fractions and56335 returns are supplied with other clearance effects omitted; no trace hit/native geometry/ABI/gameplay legality is established. Sixteen main bridges transfer actual evaluated query return/state220 under matching initial caller gates, explaining acquisition/return0 event23 and cleared-state/return1 flag2 from the saved old bit. Query velocity/anchor/field44/animation and other caller/environment/mode/native/suffix state are not fully composed. No original executable/full QVM/native collision/physics/rendering executes. Eight independent tests verify direction/root requests, all query outputs/calls, trace coordinates/pointers/bounds/mask, height/equality/field44 boundaries, entry/fraction/clearance/anchor cases, actual torso timer guards,16 main handoffs, provenance/complete partitions and explicit scope. All535 tests pass. Direct animation-contact/timer-dispatch reports regenerate byte-identically; new report reproduces twice byte-identically (986717 bytes). Storage/filter setup, documentation links and whitespace checks pass. No assets or existing analyzer/evaluator code changed. RE-460 remains open; RE-464 tracks56335/native trace/sqrt/ABI and basis/semantic/legal producers, cooldown/contact/resource interactions, actual54981/mode/suffix effects, complete query/movement shared state and runtime/macOS/Linux/Rust/Bevy/Solari compatibility. Playback/packet/entity/player/snapshot/rendering milestones remain open.

docs/REVERSE_ENGINEERING_TODO.md

@@ -557,3 +557,8 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 - [x] RE-458 Recover main child environment/posture/ground/timer request ordering, saved/current bit query/event policy, six-mode priority and common suffix with supplied omitted effects ([ROUTE-001](research/QVM_TIMERS_DISPATCH.md)).
 - [x] RE-459 Bridge evaluated child elapsed/posture animation children/timer outputs into direct animation guards with independent clock/posture/timer/animation checks ([TIMER-002](research/QVM_TIMERS_DISPATCH.md)).
 - [ ] RE-460 Recover actual54981/56639/mode/suffix/native-43 effects, timer/flag producers/legal domains, intervening ground/type3 mutations and47884 animation requests; compose complete environment/posture/timer/mode/state and validate gameplay/macOS/Linux/Rust/Bevy/Solari. Continue contact/resource/playback and packet/entity/player/snapshot/rendering work.
+
+- [x] RE-461 Recover bounded helper56214 XY direction/normalization and56639 early gates, release impulse, anchor/height/field44 exits with supplied finite sqrt ([QUERY-001](research/QVM_TRAVERSAL_QUERY.md)).
+- [x] RE-462 Recover full56639 trace/control policy, two short hull geometries, acquisition/clearance gates, anchor conversion and evaluated torso requests with supplied collision/clearance effects ([QUERY-002](research/QVM_TRAVERSAL_QUERY.md)).
+- [x] RE-463 Transfer evaluated query return/state220 into selected prior main fixtures, explaining acquisition-return0 event23 and release-return1 caller flag2 ([QUERY-003](research/QVM_TRAVERSAL_QUERY.md)).
+- [ ] RE-464 Recover56335 geometry/side effects, native traces/sqrt/ABI and basis producers, state/anchor/field44/flag semantic/legal domains and cooldown/contact/resource interactions; actual54981/mode/suffix effects, full query/movement state and gameplay/macOS/Linux/Rust/Bevy/Solari. Continue playback/packet/entity/player/snapshot/rendering work.

docs/research/QVM_ANIMATION_CONTACTS.md

@@ -43,3 +43,5 @@ Eight tests independently verify all576 animation policies/results and nested re
 RE-444 remains open for native collision/resource/semantic/full-state work. RE-448 tracks animation table allocation/loading and real duration/selector/request domains, type/timer/flag producers, frame contact count reset/list consumers/entity effects, invalid-count/alias domains, complete posture/ground/list/animation/movement composition and runtime/macOS/Linux validation before Rust/Bevy/Solari compatibility claims. Packet/entity/player/snapshot/rendering milestones remain open.
 
 Follow-up: [verified animation-table recovery](QVM_ANIMATION_TABLES.md) derives actual registration selectors, source symbol names and152 duration words from both preserved player config variants, then evaluates timed-helper consumers (RE-449–451). Native preprocessing/live table writers/playback and contact consumers remain open under RE-448/452.
+
+Follow-up: [query56639 recovery](QVM_TRAVERSAL_QUERY.md) records torso requests54/55 at acquisition/clearance branches and evaluates39338 with real timer/type guards. Actual collision/clearance/playback and full state remain open under RE-464.

docs/research/QVM_TIMERS_DISPATCH.md

@@ -61,3 +61,5 @@ Evaluated timer values then feed the previously recovered **direct** leg/torso s
 Eight tests independently verify600 timer outcomes/negative-zero-equality asymmetries,250 exact main call sequences and routes, expiry priority, saved/current state distinctions and event request,36 clock/posture/timer/animation bridges, source hash/instruction boundaries and explicit scope. Direct step-state/animation-contact dependencies regenerate unchanged; the new report reproduces twice byte-identically. Full-suite/storage/link/whitespace outcomes are recorded in the research ledger.
 
 RE-456 and earlier broad tasks remain open. RE-460 tracks actual54981/56639 and mode/suffix/native-43 effects, movement/animation timer and flag producers/legal ranges, intervening ground/type3 mutations, actual47884 animation request policy, complete environment/posture/timer/mode/state composition and gameplay/macOS/Linux/Rust/Bevy/Solari validation. Contact/resource/animation playback and packet/entity/player/snapshot/rendering milestones remain open.
+
+Follow-up: [query56639 recovery](QVM_TRAVERSAL_QUERY.md) replaces independently supplied query outputs in16 selected main bridges with evaluated return/state words. This explains acquired-bit/return0 event23 and cleared-bit/return1 caller flag2 under supplied collision/clearance assumptions. Other query/shared-state/native effects remain open (RE-461–464).

docs/research/QVM_TRAVERSAL_QUERY.md

@@ -0,0 +1,69 @@
+# Game-QVM direction and traversal-query transitions
+
+RE-461–463 / F-205–207. [qvm-traversal-query.json](qvm-traversal-query.json) retains complete shipped qagame helpers56214/56639, five direction probes,348 query probes and16 evaluated query-to-main bridges. Reproduce with `python3 scripts/analyze_qvm_traversal_query.py`; verify with `python3 scripts/test_qvm_traversal_query.py`.
+
+This follows [main timer/routing recovery](QVM_TIMERS_DISPATCH.md), where56639 returns and state220 changes were independently supplied. The new report evaluates that query's own control flow and caller stores, including its recovered direction and requested torso-animation children. Native square roots use supplied finite math results. Trace fractions and helper56335 returns are supplied; that callee's other effects remain omitted. No original executable, complete QVM, native collision, physics or rendering executes. Traversal/anchor/clearance terms describe candidate roles, not confirmed gameplay semantics or legal input domains.
+
+## QUERY-001 — Direction helper, gates and release paths (RE-461)
+
+Helper56214 writes global35023892/35023896 into output X/Y and writes Z=0, then requests sqrt of the rounded three-component squared norm through encoded target-107. A nonzero supplied root scales all components by the rounded reciprocal; zero root retains the copied vector. The source forward Z word is ignored. Five independent probes cover zero, axial,3/4,-3/4 and1/1 vectors, checking exact binary32 results and sqrt arguments. Every actual query request to56214 evaluates this same helper in a separate synthetic local frame, writing its real destination pointer.
+
+Query56639 immediately returns0 if both PS+220 bit1024 and PS+12 bit32 are clear. Otherwise it distinguishes an already-set state220 bit1024 from a new candidate. PS+12 is read but never changed by this helper.
+
+For an already-set bit1024:
+
+- If signed forward is positive, PS flags bit1 is clear, and `float(anchor) - positionZ <=5`, it checks the upper height limit. Here the integer anchor is PS+200. A rounded `positionZ - float(anchor) >50` clears anchor and bit1024, raises integer field PS+44 to at least300 and returns1. Exactly50 continues.
+- All other cases take the release-impulse path. It evaluates56214, negates that direction's X/Y, overwrites Z with binary32 word3192704205 (approximately-0.2), requests a second sqrt, normalizes the resulting vector and adds25 times each component to PS velocity. It clears anchor/bit1024, raises PS+44 to at least300 and returns0. This path runs before the later ground guard.
+
+Thus anchor-minus-position5 stays on the height/trace path;6 selects the impulse. Forward release/negative forward or supplied bit1 can also select the impulse. The three field44 probes299/300/301 demonstrate a minimum, not unconditional replacement. Other state220 bits survive clearing1024. Native sqrt/runtime floating behavior and impulse collision effects remain unverified.
+
+After these active-state branches, nonpositive forward returns0. A ground word PS+68 other than1023 also returns0. Remaining candidates reach the trace policy below. Inactive candidates require bit32 from the initial gate, but do not take the active release branches.
+
+## QUERY-002 — Two short hull queries and state/animation stores (RE-462)
+
+The helper copies frame bounds, overriding minZ to-4 and maxZ to4. It builds a point from PS origin. With bit1024 already set, point Z becomes `float(anchor+28)`; otherwise it adds the integer height word PS+164 to origin Z. The recovered56214 direction has Z=0.
+
+Both trace requests use the callback stored at frame+224 (supplied encoded target-25), the same local trace destination, pointers to local start/min/max/end vectors, PS+140 (supplied7) and **literal mask65537**. This differs from the ground helper's frame-provided mask. The fixture X/Y bounds remain-15/+15 from supplied frame bounds. Only trace fraction at output+8 is read by this helper; other output words are zero-seeded and not consumed here.
+
+| Query | Start | End |
+| --- | --- | --- |
+| First | Initial point described above | Start + direction×4 |
+| Second, only for an inactive candidate after first fraction !=1 | First point raised by maxZ-minZ, i.e.8 | Raised start + direction×8 |
+
+Independent tests verify exact rounded coordinates, bounds, callback slots/pointers/mask and supplied fractions for every reached request. These conditional fractions do not establish real collision hits, native trace ABI correctness or physical legality.
+
+Outcome policy:
+
+| Condition | Caller-side effects / return |
+| --- | --- |
+| First fraction ==1, bit1024 initially clear | Return1, no state acquisition |
+| First fraction ==1, bit1024 set | Clear anchor/bit1024, floor PS+44 at300, request39338(55), return1 |
+| First fraction !=1, bit1024 set | Return0, no second trace |
+| Inactive candidate, second fraction !=1 | Return0 |
+| Inactive candidate, second fraction ==1 | Request56335(); supplied zero return ends with0 |
+| Nonzero supplied56335 return | Zero velocity Z; anchor=trunc(originZ); set bit1024; request39338(54); return0 |
+
+The nonzero-return branch is conditional on omitted56335 side effects; in these fixtures it has no mutations beyond its supplied Boolean result. A fractional origin Z300.75 stores integer anchor300. Acquisition leaves X/Y velocity and field44 unchanged. Existing unrelated state bits are preserved when setting/clearing1024.
+
+Requests39338(54/55) evaluate the recovered torso setter, including its actual type/timer guard and bit128 toggle. Supplied initial torso26/timer0 produces182/183; timer1 rejects the animation assignment while the query's state transition still occurs. The [shipped animation definitions](QVM_ANIMATION_TABLES.md) name54 `TORSO_WEAPON_LOWER` and55 `TORSO_WEAPON_RAISE`; playback and broader state semantics remain open.
+
+The348 query probes cover inactive/active/unrelated state bits, flag gates/crouch-like bit1, signed forward, anchor height boundaries, ground sentinel, first/second fractions, clearance returns, height20/38, three direction bases, field44 minimum, torso timer gating and fractional anchor conversion. The independent oracle checks every return, state/anchor/field/velocity/torso result and ordered parent call list.
+
+## QUERY-003 — Evaluated return/state to main routing (RE-463)
+
+Sixteen bridges transfer the evaluated56639 return and PS+220 result into the prior main-body fixture with matching initial PS flags/state and an open caller query gate. They pair eight query scenarios with walk0/1 and use the caller's existing timer/action assumptions. They do not transfer query velocity, anchor, field44 or animation mutations into a complete movement state; preceding54981/environment and later mode/suffix effects remain omitted.
+
+This replaces independent guessed query outputs for the following selected cases:
+
+- Acquisition sets bit1024 while returning0. The main caller saved a clear old bit and now observes a set current bit, so it requests39238(23), then selects57312.
+- Upper-height release and active first-clear trace can return1 after clearing bit1024. The caller saved a set bit, so it sets PS flag2 despite the current bit being clear, then selects43626 or42838 from the supplied walk word.
+- Release impulse clears bit1024 but returns0, so that caller flag2 assignment does not occur.
+- Active first-hit trace retains bit1024 and returns0, selecting57312; inactive first-clear trace returns1 without acquiring the bit and therefore does not set caller flag2 or request event23.
+
+Independent main-routing tests verify the full resulting call/argument sequence and flags/state/mode. This establishes concrete producer-to-caller control flow under supplied collision/clearance assumptions, not complete native traversal or gameplay equivalence.
+
+## Validation and next tasks
+
+Eight tests independently verify direction/root arguments, all348 query outputs/calls, short hull geometry/masks/pointers, release/height/field44 boundaries, acquisition/fraction/clearance/anchor behavior, actual torso guard effects,16 evaluated main handoffs, source hash/complete helper partitions and explicit scope. Direct animation-contact/timer-dispatch dependencies regenerate unchanged; the new report reproduces twice byte-identically. Full-suite/storage/link/whitespace outcomes are recorded in the ledger.
+
+RE-460 remains open for broader main/mode/native work. RE-464 tracks helper56335 geometry and side effects, actual native traces/sqrt/ABI and basis producers, state/anchor/field44/flag meanings and legal domains, initial/cooldown/contact/resource interactions, actual54981 and mode/suffix effects, complete query-to-movement shared state, runtime/macOS/Linux/Rust/Bevy/Solari compatibility. Playback/packet/entity/player/snapshot/rendering milestones remain open.

docs/research/README.md

@@ -185,3 +185,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 [QVM resource update, caller arguments and consumer bridges](QVM_RESOURCE.md) adds RE-453–455. Reproduce with `python3 scripts/analyze_qvm_resource.py`; check with `python3 scripts/test_qvm_resource.py`. Resource helper is evaluated completely within its bounded body; native sqrt/collision, preceding callers, full state and runtime remain open.
 
 [QVM timer aging, main routing and consumer bridges](QVM_TIMERS_DISPATCH.md) adds RE-457–459. Reproduce with `python3 scripts/analyze_qvm_timers_dispatch.py`; check with `python3 scripts/test_qvm_timers_dispatch.py`. Timer body is evaluated; other main helpers/native effects are omitted, with selected producer/consumer words transferred.
+
+[QVM direction and traversal-query transitions](QVM_TRAVERSAL_QUERY.md) adds RE-461–463. Reproduce with `python3 scripts/analyze_qvm_traversal_query.py`; check with `python3 scripts/test_qvm_traversal_query.py`. Direction/torso children are evaluated; native roots/trace fractions/clearance results are supplied, and only query return/state bridge into main routing.

scripts/analyze_qvm_traversal_query.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""Bounded direction/query helpers and evaluated return/state-to-main bridges."""
+import itertools
+import json
+import math
+from pathlib import Path
+from analyze_bsp_references import trace_fields
+from analyze_deferred_auth import trace_slice
+from analyze_qvm import decode,write_json
+from analyze_qvm_acceleration import FRAME,PS,word,number,f
+from analyze_qvm_animation_contacts import evaluate as animation_effect
+from analyze_qvm_timers_dispatch import main_probe
+from analyze_vm_extensions import verified
+
+LOCAL=0x4e000000
+DIRECTION_LOCAL=0x4f000000
+DEST=0x50000
+STOPS=[56719,56766,57051,57108,57164,57219,57249,57257,57308]
+
+
+def root_word(values):
+    values=list(map(f,values));square=f(f(f(values[0]*values[0])+f(values[1]*values[1]))+f(values[2]*values[2]));return word(math.sqrt(square))
+
+
+def direction_effect(ins,m,dest):
+    root=root_word([number(m[35023892]),number(m[35023896]),0]);t=trace_slice(ins,56215,56333,m,{48:dest},call_results={56274:root},local_base=DIRECTION_LOCAL,limit=256);return t['memory'],{'destination_address':dest,'input_xy_float_words':[m[35023892]&0xffffffff,m[35023896]&0xffffffff],'supplied_sqrt_word':root,'result_direction_float_words':[t['memory'][dest+o]&0xffffffff for o in [0,4,8]],'calls':t['calls'],**trace_fields(t,False)}
+
+
+def direction_probe(ins,xy):return direction_effect(ins,{35023892:word(xy[0]),35023896:word(xy[1]),35023900:word(777)},DEST)[1]
+
+
+def query_probe(ins,state=0,flags=32,forward=1,z=300,anchor=300,ground=1023,fractions=(.5,1),clearance=1,height=38,basis=(1,0),field44=10,torso_timer=0):
+    m={35024032:FRAME,FRAME:PS,PS+220:state,PS+12:flags,PS+20:word(100),PS+24:word(200),PS+28:word(z),PS+200:anchor,PS+68:ground,PS+164:height,PS+140:7,PS+44:field44,PS+4:0,PS+80:torso_timer,PS+84:26,FRAME+224:-25,35023892:word(basis[0]),35023896:word(basis[1])}
+    for i,v in enumerate([1,2,3]):m[PS+32+i*4]=word(v)
+    for i,v in enumerate([-15,-15,-24,15,15,45]):m[FRAME+184+i*4]=word(v)
+    for o in range(96,152,4):m[LOCAL+o]=0
+    m[LOCAL+104]=word(fractions[0]);pc=56640;calls=[];trace=[];directions=[];animations=[];requests=[];returned=None;impulse_root=None
+    while returned is None:
+        if pc==56719:
+            impulse_root=root_word([-number(m[LOCAL+36]),-number(m[LOCAL+40]),number(-1102263091)])
+        t=trace_slice(ins,56640,57310,m,{},resume_at=pc,stop_targets=[s for s in STOPS if s!=pc],byte_memory={FRAME+25:forward&255},local_base=LOCAL,call_results={56764:impulse_root or 0,57255:clearance},halt_on_leave=True,capture_stack=True,limit=1024);m=t['memory'];calls+=t['calls'];trace+=t['trace'];pc=t['stop']
+        for c in t['calls']:
+            if c['target']==56214:
+                m,child=direction_effect(ins,m,c['args'][8]);directions.append(child)
+            elif c['target']==39338:
+                child=animation_effect(ins,39338,c['args'][8],m);m=child['memory'];animations.append({'request_word':c['args'][8],'result_torso_word':m[PS+84]&0xffffffff,'calls':child['calls'],**trace_fields(child,False)})
+            elif c['target']==-25:
+                args=c['args'];requests.append({'instruction':c['instruction'],'args':args,'start_float_words':[m[args[12]+o]&0xffffffff for o in [0,4,8]],'end_float_words':[m[args[24]+o]&0xffffffff for o in [0,4,8]],'mins_float_words':[m[args[16]+o]&0xffffffff for o in [0,4,8]],'maxs_float_words':[m[args[20]+o]&0xffffffff for o in [0,4,8]],'supplied_fraction_float_word':m[LOCAL+104]&0xffffffff})
+        if pc==57219:m[LOCAL+104]=word(fractions[1])
+        if t['trace'] and ins[t['trace'][-1]]['opcode']=='LEAVE':returned=t['stack'][-1]
+    return {'initial_state220_word':state,'ps_flags_word':flags,'forward_byte':forward&255,'z_float_word':word(z),'initial_anchor_word':anchor,'ground_word':ground,'supplied_fraction_float_words':[word(v) for v in fractions],'supplied_clearance_word':clearance,'height_word':height,'basis_xy_float_words':[word(v) for v in basis],'initial_field44_word':field44,'initial_torso_timer_word':torso_timer,'initial_velocity_float_words':list(map(word,[1,2,3])),'return_word':returned,'result_state220_word':m[PS+220]&0xffffffff,'result_anchor_word':m[PS+200],'result_field44_word':m[PS+44],'result_velocity_float_words':[m[PS+32+i*4]&0xffffffff for i in range(3)],'result_torso_word':m[PS+84]&0xffffffff,'result_torso_timer_word':m[PS+80],'supplied_impulse_sqrt_word':impulse_root,'direction_children':directions,'animation_children':animations,'trace_requests':requests,'calls':calls,**trace_fields({'trace':trace},False)}
+
+
+def dispatch_bridge(ins,kwargs,walk):
+    q=query_probe(ins,**kwargs);main=main_probe(ins,flags=q['ps_flags_word'],state220=q['initial_state220_word'],query_result=q['return_word'],after_query=q['result_state220_word'],walk=walk)
+    if not main['query_reached']:raise ValueError('query bridge caller gate not reached')
+    return {'query_probe':q,'main_probe':main,'transferred_outputs':['return_word','PS+220']}
+
+
+def main():
+    q=json.loads(Path('docs/research/qvm/qagame.json').read_text());raw=verified(Path(q['source']['member']['output']).read_bytes(),q['sha256']);_,ins=decode(raw)
+    probes=[query_probe(ins,state=s,flags=fl,forward=fw,z=z,ground=g,fractions=(1,1),clearance=0) for s,fl,fw,z,g in itertools.product([0,1024,1152],[0,1,32],[-1,0,1],[294,295,300,350,351],[7,1023])]
+    probes += [query_probe(ins,state=s,flags=fl,fractions=fr,clearance=c,height=h,basis=b) for (s,fl),fr,c,h,b in itertools.product([(0,32),(1024,0)],[(1,1),(.5,1),(.5,.5)],[0,1],[20,38],[(1,0),(3,4),(0,0)])]
+    probes += [query_probe(ins,state=1024,forward=0,field44=v) for v in [299,300,301]]
+    probes += [query_probe(ins,torso_timer=t) for t in [0,1]]
+    probes.append(query_probe(ins,z=300.75))
+    variants=[{}, {'state':1024,'flags':0,'forward':0}, {'state':1024,'flags':0,'z':351}, {'state':1024,'flags':0,'fractions':(1,1)}, {'state':1024,'flags':0,'fractions':(.5,1)}, {'fractions':(1,1)}, {'ground':7}, {'flags':0}]
+    out={'source':q['source'],'sha256':q['sha256'],'direction_instructions':ins[56214:56335],'query_instructions':ins[56639:57312],'direction_probes':[direction_probe(ins,v) for v in [(0,0),(1,0),(3,4),(-3,4),(1,1)]],'query_probes':probes,'dispatch_bridges':[dispatch_bridge(ins,*v) for v in itertools.product(variants,[0,1])],'limitations':'Bounded finite synthetic shipped-QVM instruction evaluations only; no original executable/full QVM/native collision/physics/rendering executes. Helper56214 and requested39338 animation children are evaluated; native sqrt returns supplied from finite math. Trace record fractions and helper56335 clearance returns are supplied; other trace words zero-seeded and not consumed here, and clearance callee effects omitted. Trace hit legality/native ABI, basis producers and state/anchor/flag semantic names remain open. Dispatch bridges transfer evaluated query return and PS+220 into prior conditional main fixtures with matching query gates; other query velocity/anchor/timer/animation effects and intervening54981/environment/mode/suffix effects are not composed. No full shared-state or runtime/macOS/Linux/Rust/Bevy/Solari compatibility claim.'};write_json(Path('docs/research/qvm-traversal-query.json'),out);print('Recovered direction, bounded traversal-query transitions and evaluated main-query handoffs')
+
+
+if __name__=='__main__':main()

scripts/test_qvm_traversal_query.py

@@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+"""Independent direction, query-transition/geometry and main-handoff oracles."""
+import hashlib
+import json
+import math
+from pathlib import Path
+import unittest
+from test_qvm_ground import word,n,f
+from test_qvm_timers_dispatch import dispatch_oracle
+
+
+def direction_oracle(words):
+    x,y=map(n,words);square=f(f(x*x)+f(y*y));root=f(math.sqrt(square));inverse=f(1/root) if root else None;return [f(x*inverse),f(y*inverse),0] if root else [x,y,0],word(root),word(square)
+
+
+def query_oracle(p):
+    state=p['initial_state220_word'];active=bool(state&1024);flags=p['ps_flags_word'];fw=p['forward_byte'] if p['forward_byte']<128 else p['forward_byte']-256;z=n(p['z_float_word']);anchor=p['initial_anchor_word'];field=p['initial_field44_word'];velocity=p['initial_velocity_float_words'];torso=26;tt=p['initial_torso_timer_word'];calls=[];geometry=[];direction,_,_=direction_oracle(p['basis_xy_float_words'])
+    if not active and not flags&32:return 0,state,anchor,field,velocity,torso,calls,geometry
+    if active:
+        near=fw>0 and not flags&1 and f(f(anchor)-z)<=5
+        if not near:
+            vector=[-direction[0],-direction[1],n(-1102263091)];sq=f(f(f(vector[0]*vector[0])+f(vector[1]*vector[1]))+f(vector[2]*vector[2]));root=f(math.sqrt(sq));inv=f(1/root);impulse=[f(v*inv) for v in vector];velocity=[word(f(n(v)+f(d*25))) for v,d in zip(velocity,impulse)];calls=[56214,-107];return 0,state&~1024,0,max(300,field),velocity,torso,calls,geometry
+        if f(z-f(anchor))>50:return 1,state&~1024,0,max(300,field),velocity,torso,calls,geometry
+    if fw<=0 or p['ground_word']!=1023:return 0,state,anchor,field,velocity,torso,calls,geometry
+    start=[100,200,f(anchor+28) if active else f(z+f(p['height_word']))];end=[f(a+f(d*4)) for a,d in zip(start,direction)];geometry.append((list(map(word,start)),list(map(word,end))));calls=[56214,-25]
+    if n(p['supplied_fraction_float_words'][0])==1:
+        if active:
+            state&=~1024;anchor=0;field=max(300,field);calls.append(39338)
+            if tt<=0:torso=128|55
+        return 1,state,anchor,field,velocity,torso,calls,geometry
+    if active:return 0,state,anchor,field,velocity,torso,calls,geometry
+    start[2]=f(start[2]+8);end=[f(a+f(d*8)) for a,d in zip(start,direction)];geometry.append((list(map(word,start)),list(map(word,end))));calls.append(-25)
+    if n(p['supplied_fraction_float_words'][1])==1:
+        calls.append(56335)
+        if p['supplied_clearance_word']:
+            state|=1024;anchor=int(z);velocity=[*velocity[:2],word(0)];calls.append(39338)
+            if tt<=0:torso=128|54
+    return 0,state,anchor,field,velocity,torso,calls,geometry
+
+
+class QvmTraversalQueryTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-traversal-query.json').read_text())
+
+    def test_direction_xy_projection_normalization_zero_and_sqrt_arguments(self):
+        self.assertEqual(len(self.r['direction_probes']),5)
+        children=self.r['direction_probes']+[d for p in self.r['query_probes'] for d in p['direction_children']]
+        for d in children:
+            vector,root,square=direction_oracle(d['input_xy_float_words']);self.assertEqual(d['result_direction_float_words'],list(map(word,vector)));self.assertEqual(d['supplied_sqrt_word'],root);self.assertEqual(d['calls'],[{'instruction':56274,'target':-107,'args':{'8':square}}])
+
+    def test_every_query_transition_result_and_parent_call_sequence(self):
+        self.assertEqual(len(self.r['query_probes']),348)
+        for p in self.r['query_probes']:
+            ret,state,anchor,field,velocity,torso,calls,geometry=query_oracle(p);self.assertEqual([p['return_word'],p['result_state220_word'],p['result_anchor_word'],p['result_field44_word'],p['result_velocity_float_words'],p['result_torso_word']],[ret,state,anchor,field,velocity,torso]);self.assertEqual([c['target'] for c in p['calls']],calls);self.assertEqual(p['result_torso_timer_word'],p['initial_torso_timer_word'])
+
+    def test_hull_trace_geometry_arguments_mask_and_supplied_fractions(self):
+        for p in self.r['query_probes']:
+            geometry=query_oracle(p)[-1];self.assertEqual(len(p['trace_requests']),len(geometry))
+            for index,(request,(start,end)) in enumerate(zip(p['trace_requests'],geometry)):
+                self.assertEqual(request['instruction'],57106 if index==0 else 57247);self.assertEqual(request['args'],{'8':0x4e000060,'12':0x4e000030,'16':0x4e000048,'20':0x4e000054,'24':0x4e00003c,'28':7,'32':65537});self.assertEqual(request['start_float_words'],start);self.assertEqual(request['end_float_words'],end);self.assertEqual(request['mins_float_words'],list(map(word,[-15,-15,-4])));self.assertEqual(request['maxs_float_words'],list(map(word,[15,15,4])));self.assertEqual(request['supplied_fraction_float_word'],p['supplied_fraction_float_words'][index])
+
+    def test_release_gap_height_equality_impulse_and_field44_floor(self):
+        rows=[p for p in self.r['query_probes'] if p['initial_state220_word']==1024 and p['ps_flags_word']==0 and p['forward_byte']==1 and p['ground_word']==1023]
+        for z,trace_count,impulse in [(294,0,True),(295,1,False),(350,1,False),(351,0,False)]:
+            p=next(p for p in rows if n(p['z_float_word'])==z);self.assertEqual(len(p['trace_requests']),trace_count);self.assertEqual(p['supplied_impulse_sqrt_word'] is not None,impulse)
+        for field,result in [(299,300),(300,300),(301,301)]:self.assertTrue(any(p['initial_field44_word']==field and p['result_field44_word']==result and p['supplied_impulse_sqrt_word'] is not None for p in self.r['query_probes']))
+
+    def test_entry_two_fraction_gates_clearance_and_anchor_truncation(self):
+        rows=[p for p in self.r['query_probes'] if p['initial_state220_word']==0 and p['ps_flags_word']==32 and p['forward_byte']==1 and p['ground_word']==1023]
+        entered=[p for p in rows if p['result_state220_word']&1024];self.assertTrue(entered)
+        for p in entered:self.assertNotEqual(n(p['supplied_fraction_float_words'][0]),1);self.assertEqual(n(p['supplied_fraction_float_words'][1]),1);self.assertTrue(p['supplied_clearance_word']);self.assertEqual(p['return_word'],0);self.assertEqual(p['result_velocity_float_words'][2],0)
+        p=next(p for p in entered if n(p['z_float_word'])==300.75);self.assertEqual(p['result_anchor_word'],300)
+        self.assertTrue(any(p['return_word']==1 and not p['result_state220_word']&1024 for p in rows))
+
+    def test_requested_animation_children_obey_real_torso_timer_guard(self):
+        children=[(p,a) for p in self.r['query_probes'] for a in p['animation_children']];self.assertEqual({a['request_word'] for _,a in children},{54,55})
+        for p,a in children:self.assertEqual(a['result_torso_word'],(128|a['request_word']) if p['initial_torso_timer_word']<=0 else 26);self.assertEqual(a['calls'],[]);self.assertEqual(a['result_torso_word'],p['result_torso_word'])
+        self.assertTrue(any(p['initial_torso_timer_word']==1 for p,_ in children))
+
+    def test_evaluated_query_return_state_replace_assumed_caller_results(self):
+        self.assertEqual(len(self.r['dispatch_bridges']),16);events=[];cleared=[]
+        for b in self.r['dispatch_bridges']:
+            q,m=b['query_probe'],b['main_probe'];self.assertEqual(m['initial_flags_word'],q['ps_flags_word']);self.assertEqual(m['initial_state220_word'],q['initial_state220_word']);self.assertEqual(m['supplied_query_result_word'],q['return_word']);self.assertEqual(m['supplied_after_query_state220_word'],q['result_state220_word']);flags,state,queried,mode,calls=dispatch_oracle(m);self.assertTrue(queried);self.assertEqual([m['result_flags_word'],m['result_state220_word'],m['selected_mode']],[flags,state,mode]);self.assertEqual([(c['target'],c['args']) for c in m['calls']],calls)
+            if any(c['target']==39238 for c in m['calls']):events.append(b);self.assertEqual(q['return_word'],0);self.assertTrue(q['result_state220_word']&1024)
+            if q['initial_state220_word']&1024 and not q['result_state220_word']&1024 and q['return_word']:cleared.append(b);self.assertTrue(m['result_flags_word']&2)
+        self.assertTrue(events);self.assertTrue(cleared)
+
+    def test_source_partitions_and_omitted_native_clearance_full_state_scope(self):
+        q=json.loads(Path('docs/research/qvm/qagame.json').read_text());self.assertEqual(self.r['source'],q['source']);self.assertEqual(self.r['sha256'],hashlib.sha256(Path(q['source']['member']['output']).read_bytes()).hexdigest());self.assertEqual(self.r['direction_instructions'][0]['index'],56214);self.assertEqual(self.r['direction_instructions'][-1]['index'],56334);self.assertEqual(self.r['query_instructions'][0]['index'],56639);self.assertEqual(self.r['query_instructions'][-1]['index'],57311)
+        for text in ['no original executable/full QVM/native collision/physics/rendering executes','clearance callee effects omitted','native sqrt returns supplied','other query velocity/anchor/timer/animation effects']:self.assertIn(text,self.r['limitations'])
+
+
+if __name__=='__main__':unittest.main()