qvm: recover saved-position load and close branches

docs/FINDINGS.md

@@ -1697,3 +1697,6 @@ RE-813–822 replaces the scoreboard decimal assumption with actual37914 executi
 
 
 **RE-899:** Rust matches96 original246746 cases with recovered userinfo, path construction and floating formatter bytes. Mode/enabled/position gates,63-byte map truncation, unsanitized GUID path bytes, ignored open return and write/close ordering are preserved. Typed unsupported format errors preserve the selector. Engine userinfo, native files and unsafe paths/ABI ownership remain open. [Evidence](research/RUST_POSITION_SAVE.md).
+
+
+**RE-900:** 96 actual246554 cases execute70503,70458/37914 and38326/38355/36779. A nonzero handle and signed length>0 with unsigned length<1023 permit reading. Exactly6 scanner assignments replace all position/angle words; malformed or truncated input preserves the original six words. Successful read paths close even after scan failure; zero/negative/oversized lengths return without a close in this body. Native file buffers/handles and real engine ownership remain supplied/captured. [Evidence](research/QVM_POSITION_LOAD.md).

docs/PROVISIONAL_TODO.md

@@ -1731,3 +1731,6 @@ RE-898: 96 actual246746 cases execute70503/69386/36038,70458/37914,70386 and flo
 
 
 RE-899: Rust matches96 original246746 cases with recovered userinfo, path construction and floating formatter bytes. Mode/enabled/position gates,63-byte map truncation, unsanitized GUID path bytes, ignored open return and write/close ordering are preserved. Typed unsupported format errors preserve the selector. Engine userinfo, native files and unsafe paths/ABI ownership remain open. Full runtime completion remains open. [Evidence](research/RUST_POSITION_SAVE.md).
+
+
+RE-900: 96 actual246554 cases execute70503,70458/37914 and38326/38355/36779. A nonzero handle and signed length>0 with unsigned length<1023 permit reading. Exactly6 scanner assignments replace all position/angle words; malformed or truncated input preserves the original six words. Successful read paths close even after scan failure; zero/negative/oversized lengths return without a close in this body. Native file buffers/handles and real engine ownership remain supplied/captured. Full runtime completion remains open. [Evidence](research/QVM_POSITION_LOAD.md).

docs/RESEARCH_LEDGER.md

@@ -2210,3 +2210,8 @@ Rust matches72 actual38326/38355/37159/36779 cases, preserving digits-only integ
 ## 2026-10-28 — RE-899 Rust saved-position write and handle intentions
 
 Rust matches96 original246746 cases with recovered userinfo, path construction and floating formatter bytes. Mode/enabled/position gates,63-byte map truncation, unsanitized GUID path bytes, ignored open return and write/close ordering are preserved. Typed unsupported format errors preserve the selector. Engine userinfo, native files and unsafe paths/ABI ownership remain open. Focused `cargo xtask test-group rust-position-save` passes (9 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.
+
+
+## 2026-10-28 — RE-900 Original saved-position read and all-six assignment gate
+
+96 actual246554 cases execute70503,70458/37914 and38326/38355/36779. A nonzero handle and signed length>0 with unsigned length<1023 permit reading. Exactly6 scanner assignments replace all position/angle words; malformed or truncated input preserves the original six words. Successful read paths close even after scan failure; zero/negative/oversized lengths return without a close in this body. Native file buffers/handles and real engine ownership remain supplied/captured. Focused `cargo xtask test-group qvm-position-load` passes (7 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1768,3 +1768,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-899 Rust saved-position write and handle intentions ([evidence](research/RUST_POSITION_SAVE.md)).
+
+
+- [x] RE-900 Original saved-position read and all-six assignment gate ([evidence](research/QVM_POSITION_LOAD.md)).

docs/research/QVM_POSITION_LOAD.md

@@ -0,0 +1,7 @@
+# Original saved-position read and all-six assignment gate
+
+RE-900. Reproduce with `python3 scripts/analyze_qvm_position_load.py`; focused validation: `cargo xtask test-group qvm-position-load`. [Machine report](qvm-position-load.json).
+
+96 actual246554 cases execute70503,70458/37914 and38326/38355/36779. A nonzero handle and signed length>0 with unsigned length<1023 permit reading. Exactly6 scanner assignments replace all position/angle words; malformed or truncated input preserves the original six words. Successful read paths close even after scan failure; zero/negative/oversized lengths return without a close in this body. Native file buffers/handles and real engine ownership remain supplied/captured.
+
+Original executable/native runtime and complete Linux/macOS Rust/Bevy/Solari acceptance remain unverified.

docs/research/README.md

@@ -1303,3 +1303,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-899: Rust saved-position write and handle intentions](RUST_POSITION_SAVE.md).
+
+
+[RE-900: Original saved-position read and all-six assignment gate](QVM_POSITION_LOAD.md).

docs/research/qvm-position-save.json

@@ -1683,6 +1683,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -1730,6 +1735,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -1777,6 +1787,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -1824,6 +1839,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -2059,6 +2079,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -2106,6 +2131,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -2153,6 +2183,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -2200,6 +2235,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -2435,6 +2475,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -2482,6 +2527,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -2529,6 +2579,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -2576,6 +2631,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -2811,6 +2871,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -2858,6 +2923,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -2905,6 +2975,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -2952,6 +3027,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -3192,6 +3272,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -3252,6 +3337,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -3312,6 +3402,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -3386,6 +3481,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -3643,6 +3743,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -3690,6 +3795,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -3737,6 +3847,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [
@@ -3784,6 +3899,11 @@
           "address": 23712,
           "after": 1,
           "before": 0
+        },
+        {
+          "address": 35104424,
+          "after": 7942008,
+          "before": 0
         }
       ],
       "children": [

docs/research/rust-position-save.json

@@ -1739,5 +1739,5 @@
     }
   ],
   "source_report": "docs/research/qvm-position-save.json",
-  "source_report_sha256": "e3955ff981375c9b468392e02f4aca7f1d6f24c8bfa72242e71f4c09077c1f9f"
+  "source_report_sha256": "ccf26cb6451ead039a031bfbe2cbf48c9d26880043aece2968d998fab7c89014"
 }

scripts/analyze_qvm_position_load.py

@@ -0,0 +1,21 @@
+#!/usr/bin/env python3
+"""Execute the verified original QVM body; native effects are supplied or captured."""
+import itertools
+from pathlib import Path
+from qvm_research_support import source,constants
+from qvm_camera_world_support import B,run
+from qvm_exit_rules_support import POOL,CPOOL
+from analyze_qvm_acceleration import word,number
+from analyze_qvm import write_json
+
+def main():
+ q,raw,h,ins=source();rows=[]
+ from qvm_persistence_support import environment,load_position
+ from qvm_exit_rules_support import CPOOL
+ for mode,enabled,handle,length,valid in itertools.product([0,9],[0,1],[0,7],[-1,0,1,31,1022,1023],[False,True]):
+  data=b'1.25,-2.5,3,90,180,-45.5\nname' if valid else b'1.0,2.0,x,90,180,0';m,b=environment(raw,h);m.update({34090788:mode,34064148:enabled});pointer=CPOOL+6336*3;values=[word(77+j) for j in range(6)]
+  for j,value in enumerate(values):m[pointer+3716+4*j]=value
+  m,p,b=load_position(ins,m,b,pointer,b'\\cl_guid\\ID',b'ut4_test',handle,length,data);p.update(input=dict(mode=mode,enabled=enabled,slot=3,handle=handle,length=length,data=data.hex(),values=values),values=[m[pointer+3716+4*j]&0xffffffff for j in range(6)],ring=m[23708]&0xffffffff,info_ring=m[23712]&0xffffffff);rows.append(p)
+
+ write_json(Path('docs/research/qvm-position-load.json'),{'source':q['source'],'sha256':q['sha256'],'root':246554,'probes':rows,'limits':'96 actual246554 cases execute70503,70458/37914 and38326/38355/36779. A nonzero handle and signed length>0 with unsigned length<1023 permit reading. Exactly6 scanner assignments replace all position/angle words; malformed or truncated input preserves the original six words. Successful read paths close even after scan failure; zero/negative/oversized lengths return without a close in this body. Native file buffers/handles and real engine ownership remain supplied/captured.'})
+if __name__=='__main__':main()

scripts/qvm_persistence_support.py

@@ -29,7 +29,7 @@ def environment(raw,h):
  from qvm_formatter_support import formatter_env
  from qvm_byte_memory_support import write_bytes
  from qvm_exit_rules_support import CPOOL
- m,b=formatter_env(raw,h);m.update({23708:0,23712:0,34992496:CPOOL})
+ m,b=formatter_env(raw,h);m.update({23708:0,23712:0,34992496:CPOOL});m.update({35096232+4*j:0 for j in range(4096)})
  write_bytes(m,b,{a:raw[h['data_offset']+a] for lo,hi in [(83632,83824),(55500,55564)] for a in range(lo,hi)})
  return m,b
 
@@ -41,7 +41,7 @@ def save_position(ins,m,b,pointer,userinfo,mapname,handle,open_return=0):
  def supplied(data,dest,capacity):return {dest+j:v for j,v in enumerate((data.split(b'\0')[0][:capacity-1]+b'\0').ljust(capacity,b'\0'))}
  def info(i,m,a,bs):events.append(dict(op='userinfo',slot=a[8]));return m,0,{'engine_userinfo_supplied':True,'child_memory_bytes':supplied(userinfo,a[12],a[16])}
  def lookup(i,m,a,bs):
-  m,v,p,b=info_lookup(i,m,dict(bs),a);children.append([70503,p['execution']['trace_sha256']]);return m,v,{'actual_source_child':70503}
+  m,v,p,b=info_lookup(i,m,dict(bs),a);children.append([70503,p['execution']['trace_sha256']]);return m,v,{'actual_source_child':70503,'child_memory_bytes':{v+j:x for j,x in enumerate(cstring(m,b,v)+b'\0')}}
  def current(i,m,a,bs):events.append(dict(op='map'));return m,0,{'engine_map_supplied':True,'child_memory_bytes':supplied(mapname,a[12],a[16])}
  def fmt(i,m,a,bs):return final_format(i,m,a,dict(bs),formatter)
  def open_file(i,m,a,bs):events.append(dict(op='open',path=cstring(m,bs,a[8]).hex(),mode=a[16]));return m,open_return,{'file_open_supplied':True,'child_memory_bytes':{a[12]+j:(handle>>(8*j))&255 for j in range(4)}}
@@ -50,3 +50,21 @@ def save_position(ins,m,b,pointer,userinfo,mapname,handle,open_return=0):
  def write(i,m,a,bs):events.append(dict(op='write',handle=a[16],length=a[12],data=read_bytes(m,bs,a[8],a[12]).hex()));return m,0,{'native_file_write_captured':True}
  def close(i,m,a,bs):events.append(dict(op='close',handle=a[8]));return m,0,{'native_file_close_captured':True}
  m,v,p,b=run(ins,m,246746,246936,1176,{8:pointer},b,{-21:info,70503:lookup,-8:current,70458:fmt,-11:open_file,70386:row,-13:write,-14:close},base=B+0x35000);p.update(events=events,children=children,warnings=warnings);return m,p,b
+
+def load_position(ins,m,b,pointer,userinfo,mapname,handle,length,data):
+ from qvm_scoreboard_wire_support import final_format
+ from qvm_formatter_support import formatter
+ events=[];scan_result=None;children=[]
+ def supplied(data,dest,capacity):return {dest+j:v for j,v in enumerate((data.split(b'\0')[0][:capacity-1]+b'\0').ljust(capacity,b'\0'))}
+ def info(i,m,a,bs):events.append(dict(op='userinfo',slot=a[8]));return m,0,{'engine_userinfo_supplied':True,'child_memory_bytes':supplied(userinfo,a[12],a[16])}
+ def lookup(i,m,a,bs):
+  m,v,p,b=info_lookup(i,m,dict(bs),a);children.append([70503,p['execution']['trace_sha256']]);return m,v,{'actual_source_child':70503,'child_memory_bytes':{v+j:x for j,x in enumerate(cstring(m,b,v)+b'\0')}}
+ def current(i,m,a,bs):events.append(dict(op='map'));return m,0,{'engine_map_supplied':True,'child_memory_bytes':supplied(mapname,a[12],a[16])}
+ def fmt(i,m,a,bs):return final_format(i,m,a,dict(bs),formatter)
+ def open_file(i,m,a,bs):events.append(dict(op='open',path=cstring(m,bs,a[8]).hex(),mode=a[16]));return m,length,{'file_open_supplied':True,'child_memory_bytes':{a[12]+j:(handle>>(8*j))&255 for j in range(4)}}
+ def read(i,m,a,bs):events.append(dict(op='read',handle=a[16],length=a[12]));return m,0,{'file_read_supplied':True,'child_memory_bytes':{a[8]+j:v for j,v in enumerate(data[:a[12]].ljust(a[12],b'\0'))}}
+ def parse(i,m,a,bs):
+  nonlocal scan_result
+  m,v,p,b=scanner(i,m,dict(bs),a);scan_result=v;children.append([38326,p['execution']['trace_sha256']]);return m,v,{'actual_source_child':38326}
+ def close(i,m,a,bs):events.append(dict(op='close',handle=a[8]));return m,0,{'native_file_close_captured':True}
+ m,v,p,b=run(ins,m,246554,246744,1192,{8:pointer},b,{-21:info,70503:lookup,-8:current,70458:fmt,-11:open_file,-12:read,38326:parse,-14:close},base=B+0x37000);p.update(events=events,scan_result=scan_result,children=children);return m,p,b

scripts/test_qvm_position_load.py

@@ -0,0 +1,19 @@
+import json,unittest
+from pathlib import Path
+class OriginalTests(unittest.TestCase):
+ def test_instruction_results(self):
+  rows=json.loads(Path('docs/research/qvm-position-load.json').read_text())['probes']
+  self.assertEqual(len(rows),96)
+  from qvm_scan_oracle import scan
+  for p in rows:
+   a=p['input'];events=[];result=None;values=a['values'];ring=ir=0
+   if a['mode']==9:
+    events.append(dict(op='userinfo',slot=3));ir=1
+    if a['enabled']>=1:
+     events.extend([dict(op='map'),dict(op='open',path=b'positions/ut4_test/ID.pos'.hex(),mode=0)]);ring=1
+     if a['handle'] and 0<a['length']<1023:
+      events.extend([dict(op='read',handle=a['handle'],length=a['length']),dict(op='close',handle=a['handle'])]);result,words=scan(bytes.fromhex(a['data'])[:a['length']].ljust(a['length'],b'\0'),'f',6)
+      if result==6:values=words
+   self.assertEqual(p['events'],events);self.assertEqual(p['scan_result'],result);self.assertEqual(p['values'],values);self.assertEqual(p['ring'],ring);self.assertEqual(p['info_ring'],ir)
+
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -2762,3 +2762,9 @@ report	scripts/analyze_rust_position_save.py	docs/research/rust-position-save.js
 edge	docs/research/rust-position-save.json	scripts/test_rust_position_save.py
 group	rust-position-save	scripts/analyze_rust_position_save.py
 edge	scripts/analyze_rust_position_save.py	scripts/analyze_qvm_resumer_audit.py
+edge	scripts/qvm_scan_oracle.py	scripts/test_qvm_position_load.py
+report	scripts/analyze_qvm_position_load.py	docs/research/qvm-position-load.json
+edge	docs/research/qvm-position-load.json	scripts/test_qvm_position_load.py
+group	qvm-position-load	scripts/analyze_qvm_position_load.py
+edge	scripts/analyze_qvm_position_load.py	scripts/analyze_qvm_resumer_audit.py
+group	qvm-position-load	scripts/analyze_qvm_position_save.py