qvm: clearance mode

docs/ASSET_PIPELINE_TODO.md

@@ -274,3 +274,5 @@ Research progress: [QVM resource update and consumers](research/QVM_RESOURCE.md)
 Research progress: [QVM timer aging and main routing](research/QVM_TIMERS_DISPATCH.md) completes bounded RE-457–459: countdown policy, main request/mode ordering and clock/posture/animation bridges. RE-456/460 retain actual helpers/producers/full environment-state composition/runtime/platform work; broad game/rendering milestones remain open.
 
 Research progress: [QVM traversal-query recovery](research/QVM_TRAVERSAL_QUERY.md) completes bounded RE-461–463: direction/release, short hull transition policy and evaluated query-to-main outputs. RE-460/464 retain native collision/clearance/actions/producers/full state/runtime/platform work; broad game/rendering milestones remain open.
+
+Research progress: [QVM side-hull and conditional gravity recovery](research/QVM_CLEARANCE_MODE.md) completes bounded RE-465–467:56335 geometry/acceptance, derived query/main Boolean chains and41768 tail/main handoffs. RE-464/468 retain actual collision/native effects/producers/full state/runtime/platform work; broad game/rendering milestones remain open.

docs/FINDINGS.md

@@ -552,3 +552,9 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 **F-206 — Short hull transition policy:**56639 uses min/max Z-4/+4 and literal mask65537 for traces with direction multipliers4/8. Supplied first/second fractions and56335 result control state retention/acquisition, truncated origin-Z anchor, vertical velocity zero and evaluated torso requests54/55. Native collision/clearance callee effects remain omitted. [QUERY-002](research/QVM_TRAVERSAL_QUERY.md).
 
 **F-207 — Actual query-to-caller decisions:**16 bridges show evaluated acquisition setting bit1024 while returning0, causing caller event23; some releases clear that bit while returning1, causing caller flag2 from the saved old bit. Full query velocity/anchor/animation/main state and runtime remain uncomposed. [QUERY-003](research/QVM_TRAVERSAL_QUERY.md).
+
+**F-208 — Side-helper acceptance:**56335 projects/normalizes a supplied right basis, probes opposite offsets with hull±4 and forward multiplier20, and returns1 only when both supplied fractions differ from1. All150 fixtures preserve the seeded PS snapshot; native side effects/physical legality remain open. [SIDE-001](research/QVM_CLEARANCE_MODE.md).
+
+**F-209 — Derived acquisition Boolean:**20 chains evaluate56335 at matching origin/basis, substitute its result only when query56639 requests it, and pass resulting query return/state into main routing. This closes the selected Boolean producer under supplied traces; broader PS/native state remains uncomposed. [SIDE-002](research/QVM_CLEARANCE_MODE.md).
+
+**F-210 — Conditional mode gravity:**41768 clears flag32 before60091(1), then applies gravity to supplied post-callback Z. Strictly negative Z clears mask192/timer; zero retains them.364 tail probes and18 selected main-mode handoffs verify policy while60091 collision/state effects remain omitted. [MODE-001](research/QVM_CLEARANCE_MODE.md).

docs/PROVISIONAL_TODO.md

@@ -586,3 +586,5 @@ Research progress: [QVM resource update and consumers](research/QVM_RESOURCE.md)
 Research progress: [QVM timer aging and main routing](research/QVM_TIMERS_DISPATCH.md) completes bounded RE-457–459: countdown policy, main request/mode ordering and clock/posture/animation bridges. RE-456/460 retain actual helpers/producers/full environment-state composition/runtime/platform work; broad game/rendering milestones remain open.
 
 Research progress: [QVM traversal-query recovery](research/QVM_TRAVERSAL_QUERY.md) completes bounded RE-461–463: direction/release, short hull transition policy and evaluated query-to-main outputs. RE-460/464 retain native collision/clearance/actions/producers/full state/runtime/platform work; broad game/rendering milestones remain open.
+
+Research progress: [QVM side-hull and conditional gravity recovery](research/QVM_CLEARANCE_MODE.md) completes bounded RE-465–467:56335 geometry/acceptance, derived query/main Boolean chains and41768 tail/main handoffs. RE-464/468 retain actual collision/native effects/producers/full state/runtime/platform work; broad game/rendering milestones remain open.

docs/RESEARCH_LEDGER.md

@@ -347,3 +347,7 @@ Completed bounded RE-457–459 with `analyze_qvm_timers_dispatch.py`: verifies c
 ## 2026-10-15 — Game-QVM direction and traversal-query transitions
 
 Completed bounded RE-461–463 with `analyze_qvm_traversal_query.py`: verifies complete shipped qagame helpers56214/56639, five direction probes,348 query probes and16 evaluated return/state-to-main bridges. QUERY-001–003/F-205–207 recover XY projection/Z0/finite normalization, query activation/forward/ground/anchor-height guards, release impulse using inverted XY/fixed Z=-0.2 and25 scale, anchor/bit1024 cleanup/field44 minimum/return distinctions; two hull queries with min/max Z-4/+4, direction multipliers4/8, raised second start and literal mask65537; supplied-fraction/clearance-dependent acquisition, truncated origin-Z anchor, vertical velocity zero and actual torso54/55 child effects. Known direction and torso children execute as bounded instruction slices with separate synthetic local frames; native sqrt returns come from supplied finite math. Trace fractions and56335 returns are supplied with other clearance effects omitted; no trace hit/native geometry/ABI/gameplay legality is established. Sixteen main bridges transfer actual evaluated query return/state220 under matching initial caller gates, explaining acquisition/return0 event23 and cleared-state/return1 flag2 from the saved old bit. Query velocity/anchor/field44/animation and other caller/environment/mode/native/suffix state are not fully composed. No original executable/full QVM/native collision/physics/rendering executes. Eight independent tests verify direction/root requests, all query outputs/calls, trace coordinates/pointers/bounds/mask, height/equality/field44 boundaries, entry/fraction/clearance/anchor cases, actual torso timer guards,16 main handoffs, provenance/complete partitions and explicit scope. All535 tests pass. Direct animation-contact/timer-dispatch reports regenerate byte-identically; new report reproduces twice byte-identically (986717 bytes). Storage/filter setup, documentation links and whitespace checks pass. No assets or existing analyzer/evaluator code changed. RE-460 remains open; RE-464 tracks56335/native trace/sqrt/ABI and basis/semantic/legal producers, cooldown/contact/resource interactions, actual54981/mode/suffix effects, complete query/movement shared state and runtime/macOS/Linux/Rust/Bevy/Solari compatibility. Playback/packet/entity/player/snapshot/rendering milestones remain open.
+
+## 2026-10-16 — Game-QVM side-hull acceptance, derived query chain and conditional gravity mode
+
+Completed bounded RE-465–467 with `analyze_qvm_clearance_mode.py`: verifies complete helpers56335/41768,150 side-hull probes,20 side/query/main chains,364 conditional mode probes and18 main-to-mode bridges. SIDE-001–002/MODE-001/F-208–210 recover planar right normalization/scale12, raised origin+28, two opposite-offset hull±4 traces with forward multiplier20/literal mask65537 and both-fractions-not1 acceptance/short-circuit; unchanged seeded1024-byte PS snapshots under supplied native effects; and actual derived56335 Boolean through selected56639 acquisition/main event/mode logic. Only attach the side-helper producer when the query records its request; unreached prepared results do not become child calls. Mode41768 clears flag32 before recording60091(1), then applies rounded gravity to supplied post-callback Z and clears mask192/movement timer only for strictly negative results. Zero retains supplied flags/timer. Explicit hypothetical callback flag edits verify prefix/tail ordering without claiming60091 performs them. Main mode bridges transfer evaluated flags/aged timers only when41768 is selected, retaining timer-equality suppression cases. Native sqrt/trace fractions are supplied;60091 collision/state effects and query/main shared-state composition remain omitted. No original executable/full QVM/native collision/physics/rendering executes. Eight independent tests verify geometry/root/vector/snapshot words, callback bounds/pointers/masks/short circuits,20 derived chains,364 exact mode outputs, zero/restored-flag boundaries,18 main-mode connections, provenance/complete partitions and scope. All543 tests pass. Direct traversal-query/timer-dispatch reports regenerate byte-identically; new report reproduces twice byte-identically (1145058 bytes). Storage/filter setup, documentation links and whitespace checks pass. No assets or existing analyzer/evaluator code changed. RE-464 remains open; RE-468 tracks actual60091/native trace/sqrt/ABI, basis/timer/gravity/flag producers/legal domains, complete side/query/main/mode shared state and runtime/macOS/Linux/Rust/Bevy/Solari validation. Other modes/actions/suffix/contact/resource/playback/packet/entity/player/snapshot/rendering milestones remain open.

docs/REVERSE_ENGINEERING_TODO.md

@@ -562,3 +562,8 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 - [x] RE-462 Recover full56639 trace/control policy, two short hull geometries, acquisition/clearance gates, anchor conversion and evaluated torso requests with supplied collision/clearance effects ([QUERY-002](research/QVM_TRAVERSAL_QUERY.md)).
 - [x] RE-463 Transfer evaluated query return/state220 into selected prior main fixtures, explaining acquisition-return0 event23 and release-return1 caller flag2 ([QUERY-003](research/QVM_TRAVERSAL_QUERY.md)).
 - [ ] RE-464 Recover56335 geometry/side effects, native traces/sqrt/ABI and basis producers, state/anchor/field44/flag semantic/legal domains and cooldown/contact/resource interactions; actual54981/mode/suffix effects, full query/movement state and gameplay/macOS/Linux/Rust/Bevy/Solari. Continue playback/packet/entity/player/snapshot/rendering work.
+
+- [x] RE-465 Recover complete bounded56335 side-hull geometry, two-fraction acceptance/short-circuit and unchanged seeded PS with evaluated direction child ([SIDE-001](research/QVM_CLEARANCE_MODE.md)).
+- [x] RE-466 Replace selected query56335 Boolean assumptions with evaluated matching side-helper results and connect acquisition/current state to main routing ([SIDE-002](research/QVM_CLEARANCE_MODE.md)).
+- [x] RE-467 Recover41768 flag32 prefix/60091 request and conditional gravity/negative-Z mask192/timer tail; bridge selected main flags/aged timer ([MODE-001](research/QVM_CLEARANCE_MODE.md)).
+- [ ] RE-468 Recover actual60091 collision/velocity/flag effects, native side traces/sqrt/ABI, basis/timer/gravity/flag producers/legal domains and complete side/query/main/mode shared state; validate runtime/macOS/Linux/Rust/Bevy/Solari. Continue other modes/actions/suffix/contact/resource/playback and packet/entity/player/snapshot/rendering work.

docs/research/QVM_CLEARANCE_MODE.md

@@ -0,0 +1,60 @@
+# Game-QVM side-hull acceptance and conditional gravity mode
+
+RE-465–467 / F-208–210. [qvm-clearance-mode.json](qvm-clearance-mode.json) retains complete shipped qagame helpers56335/41768,150 side-hull probes,20 helper/query/main chains,364 conditional mode probes and18 main-to-mode bridges. Reproduce with `python3 scripts/analyze_qvm_clearance_mode.py`; verify with `python3 scripts/test_qvm_clearance_mode.py`.
+
+This continues [query56639 recovery](QVM_TRAVERSAL_QUERY.md) and [main timer/dispatch recovery](QVM_TIMERS_DISPATCH.md). Bounded synthetic instruction evaluation does not execute the original executable, complete QVM, native collision, physics or rendering. Native square-root returns and trace fractions are supplied. Helper56335 and its direction child are evaluated; helper60091 is recorded without effects. Geometry legality, semantic names/legal domains and full shared-state/runtime compatibility remain open.
+
+## SIDE-001 — Helper56335 side probes and acceptance (RE-465)
+
+The previously supplied clearance Boolean comes from helper56335. Its policy is specifically **both supplied trace fractions differ from1**; it is not a general assertion that both sides are unobstructed.
+
+The helper copies the vector at globals35023904/35023908/35023912, replaces its Z with0, requests sqrt of its rounded squared norm, and scales by the reciprocal when nonzero. It then multiplies this planar vector by12. The basis is called right below, following the existing basis findings; actual producer/coordinate domains remain open. An independently evaluated56214 child supplies the normalized planar forward direction from globals35023892/35023896.
+
+It copies PS origin and adds28 to Z. Geometry is then:
+
+| Request | Start | End |
+| --- | --- | --- |
+| First | Raised origin + scaled right | Start + normalized forward ×20 |
+| Second, only if first fraction !=1 | First start + scaled right ×(-2) | New start + normalized forward ×20 |
+
+This ordered arithmetic matters: the second start is computed from the already rounded first start, rather than directly subtracting from the original position. All finite float operations round individually to binary32. Zero projected vectors remain zero; these fixtures do not claim they are physically legal basis inputs.
+
+Both requests use a local hull min(-4,-4,-4), max(4,4,4), the callback stored at frame+224 (supplied encoded target-25), PS+140 (supplied7), and literal mask65537. Start/min/max/end/result pointers and exact words are retained. Only output fraction at local trace+8 is consumed here; remaining output words are zero-seeded. First fraction1 returns0 immediately. A first fraction other than1 allows the second query; second fraction1 returns0, otherwise the helper returns1. Supplied0 and0.5 fractions exercise the non-1 branch without validating actual collision contacts.
+
+The helper's evaluated QVM body and direction child write local outputs, not PS fields. A seeded1024-byte PS snapshot remains byte-identical before/after all150 fixtures, conditional on omitted native callback side effects. This does not establish that native traces never mutate other engine/world state.
+
+Fixtures combine five right vectors, three forward vectors, Z300/300.75 and five fraction pairs. The supplied source right Z is777, verifying its replacement with0. Independent formulas check normalized/scaled vectors, root arguments, exact first/second coordinates, hull bounds, mask/pointers, callback ordering, short-circuit result and complete seeded PS snapshot hashes.
+
+## SIDE-002 — Derived side result through query56639 and main routing (RE-466)
+
+Twenty chains replace query56639's independently supplied56335 Boolean with the evaluated side-helper result. They use the same origin, forward basis and identity value. On the inactive acquisition path, query56639 does not write PS origin before requesting56335; its earlier direction/trace outputs are local under the supplied native-effect model. The side-helper return can therefore be computed in a separate matching fixture and transferred at that boundary without omitting any recovered PS mutation in56335.
+
+The report attaches the side-helper probe only when query56639 actually records its request. Prepared fraction inputs are unused when the query returns before that point. Cases combine query first/second fractions with side fractions, supplied walk0/1, and a fractional origin example.
+
+For query first-hit/second-clear conditions:
+
+- Either side trace returning fraction1 makes56335 return0, preventing acquisition.
+- Both side fractions other than1 make56335 return1. Query56639 zeros vertical velocity, stores the truncated origin-Z anchor, sets PS+220 bit1024 and requests torso54, while returning0.
+- Passing that evaluated query return/current state to the earlier main fixture produces event23 and selects57312, matching the caller's saved/current-bit policy.
+
+When the query's first trace is clear or its second remains hit,56335 is not requested. The chain preserves those branches rather than treating a prepared side result as an executed child call.
+
+Only56335 return,56639 return and PS+220 are transferred through the chain. The main fixture's environment/action/query gates retain matching supplied inputs, while query velocity/anchor/animation and broader state,54981 effects and mode/suffix effects are not fully composed. Native trace/root effects remain supplied. This closes one Boolean producer under those conditions, not a complete physical traversal implementation.
+
+## MODE-001 — Helper41768 prefix and conditional gravity tail (RE-467)
+
+The main route selected by PS flag128 records helper41768. Its source first clears PS flag32, then requests60091(1). That child is not executed in this batch. The remaining tail consumes supplied post-callback velocity, flags, movement timer, integer gravity PS+48 and binary32 timestep global35023928:
+
+`new_vz = round32(vz - round32(float32(gravity) * dt))`
+
+X/Y velocity remain unchanged by this tail. If the new Z is **strictly negative**, it clears PS flags64/128 (mask192) and resets PS+16 to0. If Z is zero or positive, those flags and timer remain as supplied after60091. For example, binary32 VZ12.8, gravity800 and dt0.016 yield exact zero in this finite model, preserving the timer/flags. This does not characterize the complete mode's gravity or collisions because60091 may also change velocity/state beforehand.
+
+The364 fixtures cover flags0/32/128/192, timers0/16, five supplied Z velocities, gravity0/800/-800 and timestep0/0.016/0.125, plus four explicit post-callback flag edits. Negative gravity is a synthetic arithmetic fixture, not established gameplay configuration. The edits demonstrate ordering: clearing32 before the callback does not guarantee it remains clear if omitted callback effects restore it. The tail clears192 on negative Z and preserves other supplied bits, including a restored32. These edits do not prove60091 actually restores that bit.
+
+Eighteen bridges pass the prior main fixture's evaluated flags and aged timer into41768 only when it selects that mode. Inputs flags128/192 and movement timers0/16/17 demonstrate the earlier distinction: timer16 expires at the main's supplied dt16, suppressing41768; already-zero timers preserve the flags and can still select it. Selected tail fixtures use independently supplied dt0.016 and post-callback VZ0/12.8/100. The collision child, other main calls and suffix are omitted; this is a conditional flag/timer/velocity-tail connection, not full mode/state composition.
+
+## Validation and next tasks
+
+Eight tests independently verify150 side-vector/root/geometry/PS-snapshot results, fraction/pointer/mask/order behavior,20 derived side/query/main chains including unreached children,364 exact conditional gravity/flag/timer results, zero boundaries/restored flag ordering,18 conditional main-mode handoffs, source hash/complete partitions and explicit scope. Direct traversal-query/timer-dispatch dependencies regenerate unchanged; the new report reproduces twice byte-identically. Full-suite/storage/link/whitespace outcomes are recorded in the ledger.
+
+RE-464 remains open for native geometry/meaning and broader query state. RE-468 tracks actual60091 collision/velocity/flag effects, native side traces/sqrt/ABI, basis and timer/gravity/flag producers/legal domains, complete side/query/main/mode shared state and runtime/macOS/Linux/Rust/Bevy/Solari validation. Other modes/actions/suffix, contact/resource/playback and packet/entity/player/snapshot/rendering milestones remain open.

docs/research/QVM_TIMERS_DISPATCH.md

@@ -63,3 +63,5 @@ Eight tests independently verify600 timer outcomes/negative-zero-equality asymme
 RE-456 and earlier broad tasks remain open. RE-460 tracks actual54981/56639 and mode/suffix/native-43 effects, movement/animation timer and flag producers/legal ranges, intervening ground/type3 mutations, actual47884 animation request policy, complete environment/posture/timer/mode/state composition and gameplay/macOS/Linux/Rust/Bevy/Solari validation. Contact/resource/animation playback and packet/entity/player/snapshot/rendering milestones remain open.
 
 Follow-up: [query56639 recovery](QVM_TRAVERSAL_QUERY.md) replaces independently supplied query outputs in16 selected main bridges with evaluated return/state words. This explains acquired-bit/return0 event23 and cleared-bit/return1 caller flag2 under supplied collision/clearance assumptions. Other query/shared-state/native effects remain open (RE-461–464).
+
+Follow-up: [mode41768 tail recovery](QVM_CLEARANCE_MODE.md) evaluates the flag32 prefix and conditional gravity/negative-Z mask192/timer policy, with18 main selection/aged-timer bridges. Collision child60091 and complete mode/shared state remain omitted under RE-468.

docs/research/QVM_TRAVERSAL_QUERY.md

@@ -67,3 +67,5 @@ Independent main-routing tests verify the full resulting call/argument sequence
 Eight tests independently verify direction/root arguments, all348 query outputs/calls, short hull geometry/masks/pointers, release/height/field44 boundaries, acquisition/fraction/clearance/anchor behavior, actual torso guard effects,16 evaluated main handoffs, source hash/complete helper partitions and explicit scope. Direct animation-contact/timer-dispatch dependencies regenerate unchanged; the new report reproduces twice byte-identically. Full-suite/storage/link/whitespace outcomes are recorded in the ledger.
 
 RE-460 remains open for broader main/mode/native work. RE-464 tracks helper56335 geometry and side effects, actual native traces/sqrt/ABI and basis producers, state/anchor/field44/flag meanings and legal domains, initial/cooldown/contact/resource interactions, actual54981 and mode/suffix effects, complete query-to-movement shared state, runtime/macOS/Linux/Rust/Bevy/Solari compatibility. Playback/packet/entity/player/snapshot/rendering milestones remain open.
+
+Follow-up: [56335 side-helper recovery](QVM_CLEARANCE_MODE.md) evaluates its two opposite-offset probes and result at matching origin/basis, replacing the independent Boolean in20 query/main chains. The evaluated body preserves seeded PS; native callback effects, full query state and geometry/legal domains remain open (RE-465–468).

docs/research/README.md

@@ -187,3 +187,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 [QVM timer aging, main routing and consumer bridges](QVM_TIMERS_DISPATCH.md) adds RE-457–459. Reproduce with `python3 scripts/analyze_qvm_timers_dispatch.py`; check with `python3 scripts/test_qvm_timers_dispatch.py`. Timer body is evaluated; other main helpers/native effects are omitted, with selected producer/consumer words transferred.
 
 [QVM direction and traversal-query transitions](QVM_TRAVERSAL_QUERY.md) adds RE-461–463. Reproduce with `python3 scripts/analyze_qvm_traversal_query.py`; check with `python3 scripts/test_qvm_traversal_query.py`. Direction/torso children are evaluated; native roots/trace fractions/clearance results are supplied, and only query return/state bridge into main routing.
+
+[QVM side-hull acceptance and conditional gravity mode](QVM_CLEARANCE_MODE.md) adds RE-465–467. Reproduce with `python3 scripts/analyze_qvm_clearance_mode.py`; check with `python3 scripts/test_qvm_clearance_mode.py`. Side-helper QVM logic is evaluated with supplied native traces/roots;60091 remains omitted and mode tail inputs supplied.

scripts/analyze_qvm_clearance_mode.py

@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+"""Bounded side-hull helper, evaluated query chain and mode41768 gravity tail."""
+import hashlib
+import itertools
+import json
+from pathlib import Path
+from analyze_bsp_references import trace_fields
+from analyze_deferred_auth import trace_slice
+from analyze_qvm import decode,write_json
+from analyze_qvm_acceleration import FRAME,PS,word,number
+from analyze_qvm_traversal_query import direction_effect,root_word,query_probe
+from analyze_qvm_timers_dispatch import main_probe
+from analyze_vm_extensions import verified
+
+LOCAL=0x50000000
+MODE_LOCAL=0x51000000
+
+
+def snapshot(m):return hashlib.sha256(b''.join((m[PS+o]&0xffffffff).to_bytes(4,'little') for o in range(0,1024,4))).hexdigest()
+
+
+def clearance_probe(ins,right=(0,1),forward=(1,0),z=300,fractions=(.5,.5)):
+    m={PS+o:0x5a5a5a5a for o in range(0,1024,4)};m.update({35024032:FRAME,FRAME:PS,FRAME+224:-25,PS+20:word(100),PS+24:word(200),PS+28:word(z),PS+140:7,35023892:word(forward[0]),35023896:word(forward[1]),35023904:word(right[0]),35023908:word(right[1]),35023912:word(777)})
+    for o in range(108,164,4):m[LOCAL+o]=0
+    m[LOCAL+116]=word(fractions[0]);before=snapshot(m);root=root_word([*right,0]);pc=56336;trace=[];calls=[];requests=[];children=[];returned=None
+    while returned is None:
+        t=trace_slice(ins,56336,56637,m,{},resume_at=pc,stop_targets=[s for s in [56399,56478,56535,56597,56627] if s!=pc],local_base=LOCAL,call_results={56397:root},halt_on_leave=True,capture_stack=True,limit=512);m=t['memory'];trace+=t['trace'];calls+=t['calls'];pc=t['stop']
+        for c in t['calls']:
+            if c['target']==56214:m,child=direction_effect(ins,m,c['args'][8]);children.append(child)
+            elif c['target']==-25:
+                a=c['args'];requests.append({'instruction':c['instruction'],'args':a,'start_float_words':[m[a[12]+o]&0xffffffff for o in [0,4,8]],'end_float_words':[m[a[24]+o]&0xffffffff for o in [0,4,8]],'mins_float_words':[m[a[16]+o]&0xffffffff for o in [0,4,8]],'maxs_float_words':[m[a[20]+o]&0xffffffff for o in [0,4,8]],'supplied_fraction_float_word':m[LOCAL+116]&0xffffffff})
+        if pc==56597:m[LOCAL+116]=word(fractions[1])
+        if t['trace'] and ins[t['trace'][-1]]['opcode']=='LEAVE':returned=t['stack'][-1]
+    return {'right_xy_float_words':list(map(word,right)),'forward_xy_float_words':list(map(word,forward)),'ignored_right_z_float_word':word(777),'z_float_word':word(z),'supplied_fraction_float_words':list(map(word,fractions)),'supplied_right_sqrt_word':root,'right_scaled_float_words':[m[LOCAL+o]&0xffffffff for o in [36,40,44]],'return_word':returned,'ps_snapshot_before_sha256':before,'ps_snapshot_after_sha256':snapshot(m),'trace_requests':requests,'direction_children':children,'calls':calls,**trace_fields({'trace':trace},False)}
+
+
+def query_chain(ins,query_fractions,side_fractions,walk,z=300):
+    side=clearance_probe(ins,z=z,fractions=side_fractions);query=query_probe(ins,z=z,fractions=query_fractions,clearance=side['return_word']);called=any(c['target']==56335 for c in query['calls']);main=main_probe(ins,flags=query['ps_flags_word'],state220=query['initial_state220_word'],query_result=query['return_word'],after_query=query['result_state220_word'],walk=walk)
+    return {'prepared_side_fraction_float_words':list(map(word,side_fractions)),'clearance_helper_called':called,'clearance_probe':side if called else None,'query_probe':query,'main_probe':main,'transferred_outputs':['56335 return','56639 return','PS+220']}
+
+
+def mode_probe(ins,flags=160,timer=16,vz=12.8,gravity=800,dt=.016,post_flags=None):
+    m={35024032:FRAME,FRAME:PS,PS+12:flags,PS+16:timer,PS+32:word(1),PS+36:word(2),PS+40:word(vz),PS+48:gravity,35023928:word(dt)};pre=trace_slice(ins,41769,41846,m,{},stop_targets=[41789],local_base=MODE_LOCAL,limit=128);m=pre['memory'];at_call=m[PS+12]&0xffffffff;supplied=at_call if post_flags is None else post_flags;m[PS+12]=supplied
+    # Velocity/timer/gravity/dt at this boundary are supplied, not callee60091 effects.
+    post=trace_slice(ins,41769,41846,m,{},resume_at=41789,local_base=MODE_LOCAL,limit=128);m=post['memory']
+    return {'initial_flags_word':flags,'initial_timer_word':timer,'flags_at_callback_word':at_call,'supplied_post_callback_flags_word':supplied,'supplied_post_callback_velocity_float_words':[word(1),word(2),word(vz)],'gravity_word':gravity,'dt_float_word':word(dt),'result_flags_word':m[PS+12]&0xffffffff,'result_timer_word':m[PS+16],'result_velocity_float_words':[m[PS+32+i*4]&0xffffffff for i in range(3)],'calls':pre['calls']+post['calls'],**trace_fields({'trace':pre['trace']+post['trace']},False)}
+
+
+def mode_bridge(ins,flags,timer,vz):
+    main=main_probe(ins,flags=flags,movement_timer=timer);mode=None
+    if main['selected_mode']==41768:mode=mode_probe(ins,flags=main['result_flags_word'],timer=main['timer_probe']['result_movement_timer_word'],vz=vz)
+    return {'main_probe':main,'supplied_post_callback_vz_float_word':word(vz),'mode_probe':mode}
+
+
+def main():
+    q=json.loads(Path('docs/research/qvm/qagame.json').read_text());raw=verified(Path(q['source']['member']['output']).read_bytes(),q['sha256']);_,ins=decode(raw)
+    clearances=[clearance_probe(ins,*v) for v in itertools.product([(1,0),(0,1),(3,4),(-3,4),(0,0)],[(1,0),(3,4),(0,0)],[300,300.75],[(1,1),(1,.5),(.5,1),(.5,.5),(0,0)])]
+    chains=[query_chain(ins,*v) for v in itertools.product([(.5,1),(1,1),(.5,.5)],[(1,1),(.5,1),(.5,.5)],[0,1])]+[query_chain(ins,(.5,1),(.5,.5),w,z=300.75) for w in [0,1]]
+    modes=[mode_probe(ins,*v) for v in itertools.product([0,32,128,192],[0,16],[-1,0,1,12.8,100],[0,800,-800],[0,.016,.125])];modes += [mode_probe(ins,vz=v,post_flags=fl) for v,fl in itertools.product([0,100],[32,224])]
+    out={'source':q['source'],'sha256':q['sha256'],'clearance_instructions':ins[56335:56639],'mode_instructions':ins[41768:41848],'clearance_probes':clearances,'query_chains':chains,'mode_probes':modes,'mode_bridges':[mode_bridge(ins,*v) for v in itertools.product([128,192],[0,16,17],[0,12.8,100])],'limitations':'Bounded finite synthetic shipped-QVM instruction evaluation only; no original executable/full QVM/native collision/physics/rendering executes. Native roots and trace fractions supplied. Helper56335 and its56214 direction child are evaluated; unchanged PS snapshot applies to supplied no-native-side-effect fixtures. Query chains derive56335 return at matching origin/basis before56639 caller acquisition; no pre-clearance PS mutation occurs on that path, but native callbacks remain omitted. Only query return/state220 transfer into conditional main fixtures; other query state and54981/environment/mode/suffix effects remain uncomposed. Mode41768 clears flag32 before recording60091(1); that callee is not executed, and post-callback velocity/timer/gravity/dt/flags are supplied. Tail arithmetic/flag/timer policy is conditional on those supplied effects. Real trace legality/ABI, semantic/legal/overflow/alias/native/platform domains and full gameplay/macOS/Linux/Rust/Bevy/Solari remain open.'};write_json(Path('docs/research/qvm-clearance-mode.json'),out);print('Recovered side-hull helper, derived query/main chain and conditional mode gravity tail')
+
+
+if __name__=='__main__':main()

scripts/test_qvm_clearance_mode.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""Independent side-hull geometry, query chain and conditional gravity oracles."""
+import hashlib
+import json
+from pathlib import Path
+import unittest
+from test_qvm_ground import word,n,f
+from test_qvm_traversal_query import direction_oracle,query_oracle
+from test_qvm_timers_dispatch import dispatch_oracle
+
+
+def clearance_geometry(p):
+    right,root,square=direction_oracle(p['right_xy_float_words']);forward,_,_=direction_oracle(p['forward_xy_float_words']);side=[f(v*12) for v in right];origin=[100,200,f(n(p['z_float_word'])+28)];start=[f(v+d) for v,d in zip(origin,side)];end=[f(v+f(d*20)) for v,d in zip(start,forward)];result=[(list(map(word,start)),list(map(word,end)))]
+    if n(p['supplied_fraction_float_words'][0])!=1:
+        start=[f(v+f(d*-2)) for v,d in zip(start,side)];end=[f(v+f(d*20)) for v,d in zip(start,forward)];result.append((list(map(word,start)),list(map(word,end))))
+    return side,root,square,result
+
+
+def mode_oracle(p):
+    velocity=p['supplied_post_callback_velocity_float_words'];vz=f(n(velocity[2])-f(f(p['gravity_word'])*n(p['dt_float_word'])));flags=p['supplied_post_callback_flags_word'];timer=p['initial_timer_word']
+    if vz<0:flags&=~192;timer=0
+    return flags,timer,[velocity[0],velocity[1],word(vz)]
+
+
+class QvmClearanceModeTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-clearance-mode.json').read_text())
+
+    def test_all_side_geometry_roots_scaled_vectors_and_ps_immutability(self):
+        self.assertEqual(len(self.r['clearance_probes']),150)
+        for p in self.r['clearance_probes']:
+            side,root,square,geometry=clearance_geometry(p);self.assertEqual(p['right_scaled_float_words'],list(map(word,side)));self.assertEqual(p['supplied_right_sqrt_word'],root);self.assertEqual(p['calls'][0],{'instruction':56397,'target':-107,'args':{'8':square}});self.assertEqual(len(p['trace_requests']),len(geometry))
+            words=[0x5a5a5a5a]*256
+            for offset,value in [(20,word(100)),(24,word(200)),(28,p['z_float_word']),(140,7)]:words[offset//4]=value
+            expected=hashlib.sha256(b''.join(v.to_bytes(4,'little') for v in words)).hexdigest();self.assertEqual(p['ps_snapshot_before_sha256'],expected);self.assertEqual(p['ps_snapshot_after_sha256'],expected)
+            for d in p['direction_children']:
+                vector,r,s=direction_oracle(d['input_xy_float_words']);self.assertEqual(d['result_direction_float_words'],list(map(word,vector)));self.assertEqual(d['supplied_sqrt_word'],r)
+
+    def test_fraction_short_circuit_arguments_and_opposite_side_rounding(self):
+        for p in self.r['clearance_probes']:
+            geometry=clearance_geometry(p)[-1];first,second=map(n,p['supplied_fraction_float_words']);self.assertEqual(p['return_word'],int(first!=1 and second!=1));self.assertEqual([c['target'] for c in p['calls']],[-107,56214]+[-25]*len(geometry))
+            for index,(request,(start,end)) in enumerate(zip(p['trace_requests'],geometry)):
+                self.assertEqual(request['instruction'],56533 if index==0 else 56625);self.assertEqual(request['args'],{'8':0x5000006c,'12':0x50000030,'16':0x50000054,'20':0x50000060,'24':0x5000003c,'28':7,'32':65537});self.assertEqual(request['start_float_words'],start);self.assertEqual(request['end_float_words'],end);self.assertEqual(request['mins_float_words'],list(map(word,[-4,-4,-4])));self.assertEqual(request['maxs_float_words'],list(map(word,[4,4,4])));self.assertEqual(request['supplied_fraction_float_word'],p['supplied_fraction_float_words'][index])
+
+    def test_derived_clearance_query_main_chain_and_unreached_child(self):
+        self.assertEqual(len(self.r['query_chains']),20);called=unused=entered=0
+        for b in self.r['query_chains']:
+            side,q,m=b['clearance_probe'],b['query_probe'],b['main_probe'];self.assertEqual(b['clearance_helper_called'],any(c['target']==56335 for c in q['calls']))
+            if side is not None:
+                called+=1;self.assertEqual(q['supplied_clearance_word'],side['return_word']);self.assertEqual(q['z_float_word'],side['z_float_word']);self.assertEqual(q['basis_xy_float_words'],side['forward_xy_float_words']);self.assertEqual(side['return_word'],int(all(n(v)!=1 for v in side['supplied_fraction_float_words'])))
+            else:unused+=1;self.assertFalse(b['clearance_helper_called'])
+            ret,state,anchor,field,vel,torso,_,_=query_oracle(q);self.assertEqual([q['return_word'],q['result_state220_word'],q['result_anchor_word'],q['result_velocity_float_words']],[ret,state,anchor,vel]);self.assertEqual(m['supplied_query_result_word'],ret);self.assertEqual(m['supplied_after_query_state220_word'],state);flags,current,queried,mode,calls=dispatch_oracle(m);self.assertTrue(queried);self.assertEqual([m['result_flags_word'],m['result_state220_word'],m['selected_mode']],[flags,current,mode]);self.assertEqual([(c['target'],c['args']) for c in m['calls']],calls)
+            if state&1024:entered+=1;self.assertIsNotNone(side);self.assertEqual(side['return_word'],1);self.assertTrue(any(c['target']==39238 for c in m['calls']))
+        self.assertTrue(called and unused and entered)
+
+    def test_all_mode_tail_float_words_flags_and_timer(self):
+        self.assertEqual(len(self.r['mode_probes']),364)
+        for p in self.r['mode_probes']:
+            flags,timer,velocity=mode_oracle(p);self.assertEqual([p['result_flags_word'],p['result_timer_word'],p['result_velocity_float_words']],[flags,timer,velocity]);self.assertEqual(p['flags_at_callback_word'],p['initial_flags_word']&~32);self.assertEqual(p['calls'],[{'instruction':41787,'target':60091,'args':{'8':1}}])
+
+    def test_zero_vertical_boundary_and_supplied_callback_flag_restoration(self):
+        rows=self.r['mode_probes'];zeros=[p for p in rows if p['initial_flags_word']==192 and p['initial_timer_word']==16 and p['gravity_word']==800 and n(p['dt_float_word'])==n(word(.016)) and n(p['supplied_post_callback_velocity_float_words'][2])==n(word(12.8))];self.assertTrue(zeros)
+        for p in zeros:self.assertEqual(p['result_velocity_float_words'][2],word(0));self.assertEqual(p['result_flags_word'],192);self.assertEqual(p['result_timer_word'],16)
+        restored=[p for p in rows if p['supplied_post_callback_flags_word']==224];self.assertTrue(restored)
+        for p in restored:self.assertTrue(p['result_flags_word']&32);self.assertEqual(p['flags_at_callback_word']&32,0)
+        self.assertTrue(any(p['result_flags_word']==32 and p['result_timer_word']==0 for p in restored))
+
+    def test_main_timer_selection_and_conditional_mode_handoff(self):
+        self.assertEqual(len(self.r['mode_bridges']),18);selected=skipped=0
+        for b in self.r['mode_bridges']:
+            m,p=b['main_probe'],b['mode_probe']
+            if m['selected_mode']==41768:
+                selected+=1;self.assertIsNotNone(p);self.assertEqual(p['initial_flags_word'],m['result_flags_word']);self.assertEqual(p['initial_timer_word'],m['timer_probe']['result_movement_timer_word']);self.assertEqual(p['supplied_post_callback_velocity_float_words'][2],b['supplied_post_callback_vz_float_word']);self.assertEqual([p['result_flags_word'],p['result_timer_word'],p['result_velocity_float_words']],list(mode_oracle(p)))
+            else:skipped+=1;self.assertIsNone(p);self.assertEqual(m['initial_movement_timer_word'],16)
+        self.assertTrue(selected and skipped)
+
+    def test_source_complete_helper_partitions_and_hash(self):
+        q=json.loads(Path('docs/research/qvm/qagame.json').read_text());self.assertEqual(self.r['source'],q['source']);self.assertEqual(self.r['sha256'],hashlib.sha256(Path(q['source']['member']['output']).read_bytes()).hexdigest());self.assertEqual(self.r['clearance_instructions'][0]['index'],56335);self.assertEqual(self.r['clearance_instructions'][-1]['index'],56638);self.assertEqual(self.r['mode_instructions'][0]['index'],41768);self.assertEqual(self.r['mode_instructions'][-1]['index'],41847)
+
+    def test_native_callee_and_partial_composition_limits_are_explicit(self):
+        for text in ['no original executable/full QVM/native collision/physics/rendering executes','Native roots and trace fractions supplied','that callee is not executed','Tail arithmetic/flag/timer policy is conditional']:self.assertIn(text,self.r['limitations'])
+
+
+if __name__=='__main__':unittest.main()