qvm: special target health classes

docs/ASSET_PIPELINE_TODO.md

@@ -844,3 +844,6 @@ Research progress: RE-725 [report](research/QVM_HEALTH_ROUTING.md); original ass
 
 
 Research progress: RE-726 [report](research/QVM_HEALTH_CREDIT.md); original assets unchanged.
+
+
+Research progress: RE-727 [report](research/QVM_HEALTH_SPECIAL_TARGET.md); original assets unchanged.

docs/FINDINGS.md

@@ -1190,3 +1190,6 @@ RE-714–723 batch complete: [complete contact and health prefixes](research/QVM
 
 
 **RE-726 — Health attacker credit and client damage records:** Health bookkeeping adjusts attacker client252, clamps incoming integer damage to at least1 and publishes per-client damage, direction/origin, attacker and method fields before health subtraction. [Evidence](research/QVM_HEALTH_CREDIT.md).
+
+
+**RE-727 — Special target health classes and actual RNG:** The magic checksum routes method34 directly to health−999; class0–4 can choose1/2/3 damage through actual36717, while classes5–10 filter methods22/25 and selected classes halve method25 damage. [Evidence](research/QVM_HEALTH_SPECIAL_TARGET.md).

docs/PROVISIONAL_TODO.md

@@ -1179,3 +1179,6 @@ Research progress: RE-725 [report](research/QVM_HEALTH_ROUTING.md); full native/
 
 
 Research progress: RE-726 [report](research/QVM_HEALTH_CREDIT.md); full native/platform/game scope remains open.
+
+
+Research progress: RE-727 [report](research/QVM_HEALTH_SPECIAL_TARGET.md); full native/platform/game scope remains open.

docs/RESEARCH_LEDGER.md

@@ -1273,3 +1273,8 @@ Null inflictor/attacker become world34990728; target kind4 with a nonmagic check
 ## 2026-10-21 — RE-726 Health attacker credit and client damage records
 
 Health bookkeeping adjusts attacker client252, clamps incoming integer damage to at least1 and publishes per-client damage, direction/origin, attacker and method fields before health subtraction. Focused `cargo xtask test-group health` passes (16 Python tests); selected reports regenerate twice byte-identically, with storage, links and whitespace guards. New report: 735718 bytes. Full-suite validation is deferred to the tenth batch commit. No original assets, Rust runtime or shared VM evaluator changed.
+
+
+## 2026-10-21 — RE-727 Special target health classes and actual RNG
+
+The magic checksum routes method34 directly to health−999; class0–4 can choose1/2/3 damage through actual36717, while classes5–10 filter methods22/25 and selected classes halve method25 damage. Focused `cargo xtask test-group health` passes (20 Python tests); selected reports regenerate twice byte-identically, with storage, links and whitespace guards. New report: 1189392 bytes. Full-suite validation is deferred to the tenth batch commit. No original assets, Rust runtime or shared VM evaluator changed.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1222,3 +1222,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-726 Health attacker credit and client damage records ([report](research/QVM_HEALTH_CREDIT.md)).
+
+
+- [x] RE-727 Special target health classes and actual RNG ([report](research/QVM_HEALTH_SPECIAL_TARGET.md)).

docs/research/QVM_HEALTH_SPECIAL_TARGET.md

@@ -0,0 +1,7 @@
+# Special target health classes and actual RNG
+
+RE-727. Reproduce with `python3 scripts/analyze_qvm_health_special_target.py`; validate with `cargo xtask test-group health`. See the [machine report](qvm-health-special-target.json).
+
+Actual212158–212478 checks the signed magic checksum−1514181943. Locked targets accept only method34; method34 stores health−999 and attacker pointer then issues the supplied callback. Original29808 class table maps0–4 to a random1/2/3 branch for methods outside13/25/22/12/24; actual36717 updates the global seed, then low15-bit result modulo100 uses thresholds50/85. Classes5/7/9 accept22 or25 and halve25 integer damage;6/8/10 accept22 only. Out-of-range classes skip filtering. Accepted subtraction floors at−999 and captures the callback ABI. Ordinary checksums continue without these effects. Callback/class gameplay meanings and valid live inputs remain unproven.
+
+No original executable/full VM/native world collision or rendering runs. Supplied callback/native responses and fixture domains remain explicit; complete macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/README.md

@@ -780,3 +780,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-726: Health attacker credit and client damage records](QVM_HEALTH_CREDIT.md).
+
+
+[RE-727: Special target health classes and actual RNG](QVM_HEALTH_SPECIAL_TARGET.md).

scripts/analyze_qvm_health_special_target.py

@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+"""Special checksum/class health rules with actual source RNG and captured callback."""
+import itertools
+from pathlib import Path
+from qvm_research_support import source
+from qvm_health_effects_support import seed,run,MAGIC
+from analyze_qvm import write_json
+
+def main():
+    q,raw,h,ins=source();rows=[];m=seed(raw,h);table=[m[29808+4*c] for c in range(11)]
+    cases=[dict(checksum=MAGIC,**{'class':cls},method=method,rng=rng,damage=101,callback=True) for cls,method,rng in itertools.product(range(-1,12),[12,13,22,24,25,34,99],[0,1,12345])]
+    cases += [dict(checksum=MAGIC,locked=locked,method=method,health=health,damage=2000,callback=True) for locked,method,health in itertools.product([0,1],[22,34],[-1000,100])]
+    cases += [dict(checksum=0,method=method) for method in [12,34]]
+    for a in cases:
+        _,p=run(ins,seed(raw,h,**a),212158,212479);p['input']=a;rows.append(p)
+    write_json(Path('docs/research/qvm-health-special-target.json'),{'source':q['source'],'sha256':q['sha256'],'class_jump_table':table,'probes':rows,'limits':'Actual212158..212478 and actual36717 RNG. Callback target is a supplied synthetic pointer captured without effects. Checksum/class meanings and live callback registration remain unresolved.'})
+if __name__=='__main__':main()

scripts/test_qvm_health_special_target.py

@@ -0,0 +1,36 @@
+import json,unittest
+from pathlib import Path
+from qvm_health_effects_support import MAGIC,ATTACKER,TARGET
+
+def rng(seed):
+    v=seed&0xffffffff;v=(v^(v<<5))&0xffffffff;v=(v^(v<<21))&0xffffffff;v^=v>>27;return v,v&32767
+
+def oracle(a):
+    health=a.get('health',100);method=a.get('method',12);take=a.get('damage',100);seed=a.get('rng',1);used=False;called=False
+    if a.get('checksum',0)!=MAGIC:return health,take,seed,False,212479
+    if method==34:return -999,take,seed,True,213007
+    if a.get('locked',0):return health,take,seed,False,213007
+    cls=a.get('class',0)
+    if 0<=cls<=4 and method not in (13,25,22,12,24):
+        seed,value=rng(seed);used=True;v=value%100;take=3 if v>=85 else 2 if v>=50 else 1
+    elif cls in (5,7,9):
+        if method not in (22,25):return health,take,seed,False,213007
+        if method==25:take=int(take/2)
+    elif cls in (6,8,10) and method!=22:return health,take,seed,False,213007
+    return max(-999,health-take),take,seed,True,213007
+class SpecialTargetHealthTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-health-special-target.json').read_text());cls.ps=cls.r['probes']
+    def test_independent_class_method_rng_and_health(self):
+        for p in self.ps:
+            health,take,seed,called,stop=oracle(p['input']);self.assertEqual((p['final']['entity']['684'],p['final']['selected_damage'],p['final']['rng'],len(p['effects']['callbacks']),p['execution']['stop']),(health&0xffffffff,take&0xffffffff,seed,int(called),stop),p['input'])
+    def test_original_jump_table(self):self.assertEqual(self.r['class_jump_table'],[212269]*5+[212326,212352,212358,212384,212390,212416])
+    def test_callback_abi_and_attacker_attribution(self):
+        for p in self.ps:
+            called=bool(p['effects']['callbacks']);self.assertEqual(p['final']['entity']['720'],ATTACKER if called else 0)
+            for c in p['effects']['callbacks']:self.assertEqual(c['arguments'],{'8':TARGET,'12':0,'16':0})
+    def test_ordinary_targets_do_not_invoke_rng_or_callback(self):
+        self.assertEqual(len(self.ps),283)
+        for p in self.ps:
+            if p['input']['checksum']!=MAGIC:self.assertEqual(p['execution']['calls'],[])
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -1147,3 +1147,5 @@ report	scripts/analyze_qvm_health_routing.py	docs/research/qvm-health-routing.js
 edge	docs/research/qvm-health-routing.json	scripts/test_qvm_health_routing.py
 report	scripts/analyze_qvm_health_credit.py	docs/research/qvm-health-credit.json
 edge	docs/research/qvm-health-credit.json	scripts/test_qvm_health_credit.py
+report	scripts/analyze_qvm_health_special_target.py	docs/research/qvm-health-special-target.json
+edge	docs/research/qvm-health-special-target.json	scripts/test_qvm_health_special_target.py