qvm: event57 firing setup

docs/ASSET_PIPELINE_TODO.md

@@ -478,3 +478,6 @@ Research progress: RE-597 [report](research/QVM_SERVER_FIRE_DISPATCH.md); remain
 
 
 Research progress: RE-598 [report](research/QVM_TEMP_EVENT.md); remaining native/content/runtime/platform scope stays open.
+
+
+Research progress: RE-599 [report](research/QVM_SERVER_SHOT_SETUP.md); remaining native/content/runtime/platform scope stays open.

docs/FINDINGS.md

@@ -836,3 +836,6 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 
 
 **RE-598 — Temporary event record construction and position setter:** 277695 builds a tempEntity with event type+19, time and flags, truncates the position before actual278138 sets trajectory/base/live origin, then issues native link−31. [Evidence](research/QVM_TEMP_EVENT.md).
+
+
+**RE-599 — Event57 firing setup quantization and actual PRNG:** 285840 builds event57, stores trunc(forward×4096) as float direction, derives a seed byte from actual36717 xorshift, records shooter/weapon IDs and prepares295018 arguments. [Evidence](research/QVM_SERVER_SHOT_SETUP.md).

docs/PROVISIONAL_TODO.md

@@ -796,3 +796,6 @@ Research progress: RE-597 [report](research/QVM_SERVER_FIRE_DISPATCH.md); remain
 
 
 Research progress: RE-598 [report](research/QVM_TEMP_EVENT.md); remaining native/content/runtime/platform scope stays open.
+
+
+Research progress: RE-599 [report](research/QVM_SERVER_SHOT_SETUP.md); remaining native/content/runtime/platform scope stays open.

docs/RESEARCH_LEDGER.md

@@ -680,3 +680,8 @@ Actual outer31 publication reaches server151634, which writes client4140=0 and43
 ## 2026-10-20 — RE-598 Temporary event record construction and position setter (separate task commit)
 
 277695 builds a tempEntity with event type+19, time and flags, truncates the position before actual278138 sets trajectory/base/live origin, then issues native link−31. 36 independent880-byte record oracles check all changed and retained words, negative/fractional truncation, event/time boundaries, child order, numeric return and exact captured link request. Full suite: 903 tests pass. Report regenerates byte-identically (1805563 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.
+
+
+## 2026-10-20 — RE-599 Event57 firing setup quantization and actual PRNG (separate task commit)
+
+285840 builds event57, stores trunc(forward×4096) as float direction, derives a seed byte from actual36717 xorshift, records shooter/weapon IDs and prepares295018 arguments. 24 independent full-record/PRNG fixtures check fractional/negative quantization, seed0/1/hex/unsigned−1, tempEntity handoff, link-time ordering and exact opaque-call ABI. Full suite: 907 tests pass. Report regenerates byte-identically (1527580 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.

docs/REVERSE_ENGINEERING_TODO.md

@@ -838,3 +838,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-598 Temporary event record construction and position setter ([report](research/QVM_TEMP_EVENT.md)).
+
+
+- [x] RE-599 Event57 firing setup quantization and actual PRNG ([report](research/QVM_SERVER_SHOT_SETUP.md)).

docs/research/QVM_SERVER_SHOT_SETUP.md

@@ -0,0 +1,11 @@
+# Event57 firing setup quantization and actual PRNG
+
+RE-599. Reproduce with `python3 scripts/analyze_qvm_server_shot_setup.py`; check with `python3 scripts/test_qvm_server_shot_setup.py`. The [machine report](qvm-server-shot-setup.json) retains source identity and bounded fixtures.
+
+285841..285965 calls actual277695(MUZZLE,57) using its supplied-allocation/captured-link model. It writes each direction component as CVIF(CVFI(float32(forward×4096))), then actual36717 updates global21044 using32-bit xor shifts5,21 and unsigned27 and returns low15 bits. The record stores the low8 bits, shooter entity ID and entity weapon ID.
+
+24 fixtures independently reconstruct all880 bytes from the temp-event oracle plus these writes and the exact PRNG recurrence. The link request occurs before direction/seed/shooter writes; the linked-request snapshot therefore differs from the final record. No native linking result is presumed. Shooter inputs remain unchanged.
+
+Execution stops before CALL285967 to295018 with entity, event position pointer, direction pointer and seed arguments retained explicitly. No spread/collision/hit/damage outcome from that body is assumed. Recover295018 and its reached children before claiming this firing path complete.
+
+No original executable/full QVM/native collision/physics/rendering executes. Native responses and legal input domains are supplied or unverified where stated; full runtime/macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/README.md

@@ -397,3 +397,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-598: Temporary event record construction and position setter](QVM_TEMP_EVENT.md). Reproduce with `python3 scripts/analyze_qvm_temp_event.py`; check with `python3 scripts/test_qvm_temp_event.py`.
+
+
+[RE-599: Event57 firing setup quantization and actual PRNG](QVM_SERVER_SHOT_SETUP.md). Reproduce with `python3 scripts/analyze_qvm_server_shot_setup.py`; check with `python3 scripts/test_qvm_server_shot_setup.py`.

scripts/analyze_qvm_server_shot_setup.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+"""285840 event57/quantized direction/actual PRNG, stopped before295018."""
+import itertools
+from pathlib import Path
+from qvm_research_support import source,execute
+from qvm_server_fire_support import seed,state,ENTITY,PROJECTILE,MUZZLE,FORWARD
+from analyze_qvm_temp_event import temp_event,record
+from analyze_qvm_acceleration import word
+from analyze_qvm import write_json
+LOCAL=0x7e000000
+RNG=LOCAL+0x1000
+
+def random_word(ins,m):
+    before=m[21044]&0xffffffff;m,c,r=execute(ins,36718,36777,m,(0,0,0),RNG);return m,{'initial_seed':before,'final_seed':m[21044]&0xffffffff,'execution':r,'result':r['return']}
+
+def shot_setup(ins,m):
+    initial=state(m);before=record(m);initial_seed=m[21044]&0xffffffff;m[LOCAL+52]=ENTITY
+    def event(i,m,a,c):m,r=temp_event(i,m,a[8],a[12]);return m,c,r['execution']['return'],r
+    def rng(i,m,a,c):m,r=random_word(i,m);return m,c,r['result'],r
+    m,c,r=execute(ins,285841,285966,m,(0,0,0),LOCAL,{277695:event,36717:rng})
+    assert ins[285966]['operand']==295018
+    return m,{'initial':initial,'initial_record':before,'initial_seed':initial_seed,'final_seed':m[21044]&0xffffffff,'execution':r,'final_record':record(m),'pending_call':{'instruction':285967,'target':295018,'arguments':{8:ENTITY,12:PROJECTILE+24,16:PROJECTILE+104,20:m[PROJECTILE+184]}},'final':state(m)}
+
+def main():
+    q,raw,h,ins=source();rows=[]
+    for forward,rng,origin in itertools.product([(1,0,0),(.6,-.25,.8),(-.1234,2.75,-.5)],[0,1,0x12345678,0xffffffff],[(1.9,-2.9,3.1),(0,0,0)]):
+        m=seed(raw,h,4);m[21044]=rng
+        for p,values in [(FORWARD,forward),(MUZZLE,origin)]:
+            for j,v in enumerate(values):m[p+4*j]=word(v)
+        rows.append(shot_setup(ins,m)[1])
+    write_json(Path('docs/research/qvm-server-shot-setup.json'),{'source':q['source'],'sha256':q['sha256'],'probes':rows,'limits':'285841..285965 plus actual36717 and277695/278138; allocation supplied/native link captured. Stops before295018, so no spread traces/hits/damage or successful shot outcome is assumed.'})
+if __name__=='__main__':main()

scripts/test_qvm_server_shot_setup.py

@@ -0,0 +1,25 @@
+import json,unittest
+from pathlib import Path
+from test_qvm_temp_event import event_record
+from test_qvm_ground import word,n,f
+
+def random_oracle(seed):
+    x=(seed^(seed<<5))&0xffffffff;x=(x^(x<<21))&0xffffffff;x=(x^(x>>27))&0xffffffff;return x,x&32767
+class ServerShotSetupTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-server-shot-setup.json').read_text())
+    def test_exact_complete_record_before_pending_shot_body(self):
+        self.assertEqual(len(self.r['probes']),24)
+        for p in self.r['probes']:
+            temp=p['execution']['children'][0]['effect'];r=event_record(temp);seed,result=random_oracle(p['initial_seed'])
+            for j,v in enumerate(p['initial']['forward']):r[str(104+4*j)]=word(float(int(f(n(v)*4096))))
+            r.update({'184':result&255,'140':p['initial']['entity_id'],'192':p['initial']['entity_weapon']});self.assertEqual(p['final_record'],r);self.assertEqual(p['final_seed'],seed)
+    def test_actual_rng_numeric_return_and_call_order(self):
+        for p in self.r['probes']:
+            self.assertEqual([c['target'] for c in p['execution']['calls']],[277695,36717]);rng=p['execution']['children'][1]['effect'];self.assertEqual((rng['final_seed'],rng['result']),random_oracle(p['initial_seed']))
+    def test_opaque295018_arguments_and_unchanged_firing_inputs(self):
+        for p in self.r['probes']:self.assertEqual(p['pending_call'],{'instruction':285967,'target':295018,'arguments':{'8':589824,'12':720920,'16':721000,'20':random_oracle(p['initial_seed'])[1]&255}});self.assertEqual(p['initial'],p['final'])
+    def test_link_request_precedes_direction_and_seed_writes(self):
+        for p in self.r['probes']:
+            linked=p['execution']['children'][0]['effect']['link_requests'][0]['record_at_request'];self.assertEqual([linked[str(o)] for o in [104,108,112,184,140,192]],[0]*6)
+if __name__=='__main__':unittest.main()