qvm: hitscan rejection sampling

docs/ASSET_PIPELINE_TODO.md

@@ -511,3 +511,6 @@ Research progress: RE-609 [report](research/QVM_SPREAD_PARAMETERS.md); remaining
 
 
 Research progress: RE-610 [report](research/QVM_SPREAD_SPEED.md); remaining native/content/runtime/platform scope stays open.
+
+
+Research progress: RE-611 [report](research/QVM_SPREAD_SAMPLING.md); remaining native/content/runtime/platform scope stays open.

docs/FINDINGS.md

@@ -869,3 +869,6 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 
 
 **RE-610 — Hitscan movement speed normalization and airborne floor:** 290493 normalizes velocity, applies an airborne ID14/23 floor below224.4, caps at340, then converts speed before its200 split. [Evidence](research/QVM_SPREAD_SPEED.md).
+
+
+**RE-611 — Hitscan rejection sampling and RNG consumption:** Each spread candidate consumes four actual36717 draws; acceptance requires radius²<1 and radius²>local40×0.15. Zero RNG state never escapes its rejection loop. [Evidence](research/QVM_SPREAD_SAMPLING.md).

docs/PROVISIONAL_TODO.md

@@ -831,3 +831,6 @@ Research progress: RE-609 [report](research/QVM_SPREAD_PARAMETERS.md); remaining
 
 
 Research progress: RE-610 [report](research/QVM_SPREAD_SPEED.md); remaining native/content/runtime/platform scope stays open.
+
+
+Research progress: RE-611 [report](research/QVM_SPREAD_SAMPLING.md); remaining native/content/runtime/platform scope stays open.

docs/RESEARCH_LEDGER.md

@@ -737,3 +737,8 @@ Full-pool retry relaxes the recent-free guard; source count1022 enters diagnosti
 ## 2026-10-20 — RE-610 Hitscan movement speed normalization and airborne floor (separate task commit)
 
 290493 normalizes velocity, applies an airborne ID14/23 floor below224.4, caps at340, then converts speed before its200 split. 48 velocity/ID/ground fixtures reproduce source-order f32 math independently, including the discontinuity at224.4. Full suite: 941 tests pass. Report regenerates byte-identically (101488 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.
+
+
+## 2026-10-20 — RE-611 Hitscan rejection sampling and RNG consumption (separate task commit)
+
+Each spread candidate consumes four actual36717 draws; acceptance requires radius²<1 and radius²>local40×0.15. Zero RNG state never escapes its rejection loop. Independent PRNG/f32 sampling oracles check every draw and candidate across12 seed/counter fixtures, with explicit32-attempt exhaustion. Full suite: 945 tests pass. Report regenerates byte-identically (142282 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.

docs/REVERSE_ENGINEERING_TODO.md

@@ -874,3 +874,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-610 Hitscan movement speed normalization and airborne floor ([report](research/QVM_SPREAD_SPEED.md)).
+
+
+- [x] RE-611 Hitscan rejection sampling and RNG consumption ([report](research/QVM_SPREAD_SAMPLING.md)).

docs/research/QVM_SPREAD_SAMPLING.md

@@ -0,0 +1,7 @@
+# Hitscan rejection sampling and RNG consumption
+
+RE-611. Reproduce with `python3 scripts/analyze_qvm_spread_sampling.py`; check with `python3 scripts/test_qvm_spread_sampling.py`. The [machine report](qvm-spread-sampling.json) retains source identity and bounded fixtures.
+
+The sampler executes actual290995–291078 with actual36717 for every call. Two sums of centered low15-bit samples form x/y; both radius boundaries are strict. Source291079 loops back to290995 when rejected; the bounded harness restarts at that exact point and retains RNG state. It stops at291081 when accepted. The actual parameter/speed prefixes establish local40; the intervening290969–290994 branch only alters local44 and is outside this sampler, so this does not establish the later trigonometric offset path. Seed0 remains0, produces x=y=−1 and rejects radius²2 forever in the source; the harness reports budget exhaustion after32 attempts, never a successful return. This does not prove zero is a legal runtime seed. Tests reconstruct all candidate draws, f32 components, radius and final RNG state independently. Native trig, endpoint and contact remain pending.
+
+No original executable/full QVM/native collision/physics/rendering executes. Native responses and legal input domains are supplied or unverified where stated; full runtime/macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/README.md

@@ -432,3 +432,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-610: Hitscan movement speed normalization and airborne floor](QVM_SPREAD_SPEED.md). Reproduce with `python3 scripts/analyze_qvm_spread_speed.py`; check with `python3 scripts/test_qvm_spread_speed.py`.
+
+
+[RE-611: Hitscan rejection sampling and RNG consumption](QVM_SPREAD_SAMPLING.md). Reproduce with `python3 scripts/analyze_qvm_spread_sampling.py`; check with `python3 scripts/test_qvm_spread_sampling.py`.

scripts/analyze_qvm_spread_sampling.py

@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+"""Bounded rejection sampling using actual source RNG and explicit attempt limit."""
+import itertools
+from pathlib import Path
+from qvm_research_support import source,execute
+from qvm_server_fire_support import seed
+from analyze_qvm_spread_speed import speed
+from analyze_qvm_spread_parameters import LOCAL
+from analyze_qvm_server_shot_setup import random_word
+from analyze_qvm_acceleration import PS
+from analyze_qvm import write_json
+
+def sample(ins,m,attempt_limit=32):
+    if not 1<=attempt_limit<=64:raise ValueError('Attempt limit outside1..64')
+    m,p=speed(ins,m);before=m[21044]&0xffffffff;attempts=[]
+    def rng(i,m,a,c):m,r=random_word(i,m);return m,c,r['result'],r
+    for _ in range(attempt_limit):
+        m,_,r=execute(ins,290995,291081,m,(0,0,0),LOCAL,{36717:rng},boundaries=[291079]);accepted=r['stop']==291081
+        attempts.append({'draws':[child['effect']['result'] for child in r['children']],'seed_after':m[21044]&0xffffffff,'x':m[LOCAL+28]&0xffffffff,'y':m[LOCAL+32]&0xffffffff,'radius_squared':m[LOCAL+128]&0xffffffff,'accepted':accepted,'execution':{'calls':r['calls'],'trace_length':r['trace_length'],'trace_sha256':r['trace_sha256']}})
+        if accepted:break
+    return m,{'speed':p,'initial_seed':before,'final_seed':m[21044]&0xffffffff,'attempt_limit':attempt_limit,'threshold_input':m[LOCAL+40]&0xffffffff,'attempts':attempts,'status':'accepted' if accepted else 'attempt-budget-exhausted'}
+
+def main():
+    q,raw,h,ins=source();rows=[]
+    for rng,counter in itertools.product([0,1,0x12345678,0xffffffff],[0,10,100000]):
+        m=seed(raw,h,22);m[PS+216]=counter;m[21044]=rng;rows.append(sample(ins,m)[1])
+    write_json(Path('docs/research/qvm-spread-sampling.json'),{'source':q['source'],'sha256':q['sha256'],'probes':rows,'limits':'Actual290995–291080 with actual36717 per draw after actual parameter/speed prefixes. At most32 candidate attempts; budget exhaustion is not a QVM return. No global RNG seeding legality/native trig/endpoint/trace/damage inferred.'})
+if __name__=='__main__':main()

scripts/test_qvm_spread_sampling.py

@@ -0,0 +1,25 @@
+import json,unittest
+from pathlib import Path
+from test_qvm_ground import word,n,f
+from test_qvm_server_shot_setup import random_oracle
+class SpreadSamplingTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-spread-sampling.json').read_text())
+    def test_independent_rng_and_rejection_oracle(self):
+        for p in self.r['probes']:
+            seed=p['initial_seed']
+            for a in p['attempts']:
+                draws=[]
+                for _ in range(4):seed,v=random_oracle(seed);draws.append(v)
+                xy=[f(f(f(float(draws[j])*n(939524352))-.5)+f(f(float(draws[j+1])*n(939524352))-.5)) for j in [0,2]];radius=f(f(xy[0]*xy[0])+f(xy[1]*xy[1]));accepted=radius<1 and radius>f(n(p['threshold_input'])*n(1041865114));self.assertEqual(a['draws'],draws);self.assertEqual((a['x'],a['y'],a['radius_squared']),(*map(word,xy),word(radius)));self.assertEqual(a['accepted'],accepted);self.assertEqual(a['seed_after'],seed)
+            self.assertEqual(p['final_seed'],seed)
+    def test_only_final_candidate_can_be_accepted(self):
+        for p in self.r['probes']:
+            self.assertFalse(any(a['accepted'] for a in p['attempts'][:-1]));self.assertEqual(p['status']=='accepted',p['attempts'][-1]['accepted'])
+    def test_zero_seed_is_explicit_budget_boundary(self):
+        for p in self.r['probes']:
+            if p['initial_seed']==0:self.assertEqual(p['status'],'attempt-budget-exhausted');self.assertEqual(len(p['attempts']),32);self.assertEqual(p['final_seed'],0);self.assertTrue(all(n(a['radius_squared'])==2 for a in p['attempts']))
+    def test_actual_rng_calls_per_attempt(self):
+        for p in self.r['probes']:
+            for a in p['attempts']:self.assertEqual([c['target'] for c in a['execution']['calls']],[36717]*4)
+if __name__=='__main__':unittest.main()