qvm: shared shot basis and handoff

docs/ASSET_PIPELINE_TODO.md

@@ -517,3 +517,9 @@ Research progress: RE-611 [report](research/QVM_SPREAD_SAMPLING.md); remaining n
 
 
 Research progress: RE-612 [report](research/QVM_SHOT_FRAME.md); remaining native/content/runtime/platform scope stays open.
+
+
+The [RE-604–613 allocation/spread batch](research/QVM_ALLOCATION_SPREAD_BATCH.md) recovers source allocation and its temp-event/grenade compositions, spread prefixes/sampling and shot frames. Follow its ten concrete next tasks for remaining aim, trace/contact/damage and lifecycle work. Original references and full Rust/Bevy/Solari macOS/Linux/native/content/network/rendering scope remain open.
+
+
+Research progress: RE-613 [report](research/QVM_SHARED_SHOT_BASIS.md); remaining native/content/runtime/platform scope stays open.

docs/FINDINGS.md

@@ -875,3 +875,6 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 
 
 **RE-612 — Shot body table copies and direction frame construction:** 295018 copies four initialized tables, resolves the first matching weapon slot, normalizes input direction and builds a minimum-axis perpendicular/cross frame. [Evidence](research/QVM_SHOT_FRAME.md).
+
+
+**RE-613 — Shared shot handler basis muzzle and pending aim handoff:** 293732 resolves entity weaponID in16 slots, creates local forward/up and global right, computes the alternate muzzle and stops before290493 aim. [Evidence](research/QVM_SHARED_SHOT_BASIS.md).

docs/PROVISIONAL_TODO.md

@@ -837,3 +837,9 @@ Research progress: RE-611 [report](research/QVM_SPREAD_SAMPLING.md); remaining n
 
 
 Research progress: RE-612 [report](research/QVM_SHOT_FRAME.md); remaining native/content/runtime/platform scope stays open.
+
+
+The [RE-604–613 allocation/spread batch](research/QVM_ALLOCATION_SPREAD_BATCH.md) recovers source allocation and its temp-event/grenade compositions, spread prefixes/sampling and shot frames. Follow its ten concrete next tasks for remaining aim, trace/contact/damage and lifecycle work. Original references and full Rust/Bevy/Solari macOS/Linux/native/content/network/rendering scope remain open.
+
+
+Research progress: RE-613 [report](research/QVM_SHARED_SHOT_BASIS.md); remaining native/content/runtime/platform scope stays open.

docs/RESEARCH_LEDGER.md

@@ -747,3 +747,8 @@ Each spread candidate consumes four actual36717 draws; acceptance requires radiu
 ## 2026-10-20 — RE-612 Shot body table copies and direction frame construction (separate task commit)
 
 295018 copies four initialized tables, resolves the first matching weapon slot, normalizes input direction and builds a minimum-axis perpendicular/cross frame. 28 axis/tie/oblique/quantized/zero and slot/ID fixtures match independent f32 frame, lookup and complete table-copy oracles. Full suite: 948 tests pass. Report regenerates byte-identically (257716 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.
+
+
+## 2026-10-20 — RE-613 Shared shot handler basis muzzle and pending aim handoff (separate task commit)
+
+293732 resolves entity weaponID in16 slots, creates local forward/up and global right, computes the alternate muzzle and stops before290493 aim. 32 angle/slot/ID/mode fixtures independently check complete state, basis/muzzle, call order, pending ABI, canaries and full static child inventory. Full suite: 952 tests pass. Report regenerates byte-identically (488656 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.

docs/REVERSE_ENGINEERING_TODO.md

@@ -849,7 +849,7 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 - [x] RE-601 Base-dependent firing gate scan and distance contract ([report](research/QVM_BASE_FIRE_GATE.md)).
 
 
-- [ ] RE-603 Recover293732/295018 shot processing,277165/277125 allocator,276433 query/native linking, grenade223156 and remaining dispatcher/base/event consumers. Validate real collision/damage/lifetime and original traces, complete step/scheduler and native snap, map asset identities and implement Rust/Bevy/Solari macOS/Linux gameplay. See the [next ten tasks](research/QVM_SERVER_FIRE_BATCH.md#next-ten-concrete-tasks).
+- [ ] RE-603 Partially advanced by RE-604–613:277165/277125 allocation is recovered with captured native registration and explicit error boundaries;293732/295018 preparation is partly recovered. Full shot processing,276433 query/native linking, grenade223156 and remaining dispatcher/base/event consumers remain open, as do original reference traces and full Rust/Bevy/Solari macOS/Linux gameplay. See the [current next ten tasks](research/QVM_ALLOCATION_SPREAD_BATCH.md#next-ten-concrete-tasks).
 
 
 - [x] RE-602 Published firing event to bounded server handler chains ([report](research/QVM_SERVER_FIRE_CHAIN.md)).
@@ -880,3 +880,9 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-612 Shot body table copies and direction frame construction ([report](research/QVM_SHOT_FRAME.md)).
+
+
+- [ ] RE-614 Complete the remaining aim offsets/endpoint,293732 trace/contact consumers and295018 seeded pellet path; recover query/linking, base/grenade lifecycle and original runtime reference. Follow the [next ten tasks](research/QVM_ALLOCATION_SPREAD_BATCH.md#next-ten-concrete-tasks); retain wider native/content/network/rendering/platform work.
+
+
+- [x] RE-613 Shared shot handler basis muzzle and pending aim handoff ([report](research/QVM_SHARED_SHOT_BASIS.md)).

docs/research/QVM_ALLOCATION_SPREAD_BATCH.md

@@ -0,0 +1,45 @@
+# Entity allocation and shot preparation: RE-604–613
+
+Ten separately checked and committed tasks extend the [server firing batch](QVM_SERVER_FIRE_BATCH.md). They recover entity allocation and more of the shared hitscan and shot preparation paths. This remains bounded reverse engineering; the Rust game does not gain playable behavior from these reports alone.
+
+| Task | Scope | Evidence |
+| --- | --- | --- |
+| RE-604 |277125 initializer, identity and preserved fields | [Entity initializer](QVM_ENTITY_INIT.md) |
+| RE-605 |277165 first-fit scan and recent-free timing guard | [Reuse](QVM_ENTITY_REUSE.md) |
+| RE-606 | Full-capacity retry, extension, error boundaries and native−16 request | [Allocator](QVM_ENTITY_ALLOCATE.md) |
+| RE-607 |277695 tempEntity with actual allocator/initializer and278138 | [Allocated event](QVM_ALLOCATED_EVENT.md) |
+| RE-608 |285971 grenade with actual allocator/initializer | [Allocated grenade](QVM_ALLOCATED_GRENADE.md) |
+| RE-609 |290493 table selection and spread scalar prefix | [Parameters](QVM_SPREAD_PARAMETERS.md) |
+| RE-610 | Movement normalization, airborne floor and converted-speed split | [Speed](QVM_SPREAD_SPEED.md) |
+| RE-611 | Four-draw rejection sampler and explicit attempt limit | [Sampling](QVM_SPREAD_SAMPLING.md) |
+| RE-612 |295018 table copies, lookup, normalization and direction frame | [Shot frame](QVM_SHOT_FRAME.md) |
+| RE-613 |293732 local basis/muzzle preparation and full static child inventory | [Shared handler basis](QVM_SHARED_SHOT_BASIS.md) |
+
+## Implications for the port
+
+The initializer changes five words of an880-byte record. It does not clear position, client pointers, callbacks or other payload. Allocation starts at slot64 in the literal source pool, preserves record contents beyond those initializer writes, and delays recent frees only under the strict two-condition guard. At full capacity its retry relaxes that delay. The count1022 diagnostic path differs from the1023→1024 extension path; retain the evidence until a native/reference run explains intended limits.
+
+The temp-event and grenade compositions now execute actual allocation. Native−16 registration and−31 linking are captured requests, and the grenade world query is still supplied. No engine collision/lifetime/physics effects are established. The earlier broad server-chain report retains its original supplied-pointer contract and has not silently gained this narrower composition.
+
+Shared spread parameters depend on the packed current slot, while293732 first locates entity weaponID in the first16 slots. These are different reads; they must not be collapsed into an assumed single configuration source. IDs14/23 have an airborne speed floor strictly below224.4, followed by a340 cap. Later200 splitting happens after radians conversion, leaving excess zero in the tested finite domain.
+
+Spread rejection consumes four global RNG draws per candidate. Acceptance is inside radius1 and strictly outside a counter-derived lower radius. Seed zero remains zero and rejects forever in these source operations; the harness stops after32 attempts. This is neither an original QVM return nor evidence that zero is a legal live seed.
+
+Shot295018 chooses the first minimum-absolute axis, preserves a squared reciprocal in the projection arithmetic, normalizes the perpendicular and computes a cross vector. Zero direction is reported before division by zero. Shared293732 writes local forward/up and global right, then uses the alternate muzzle helper without14×forward. Its pending290493 output remains an untouched canary.
+
+## Validation and limits
+
+The919-test baseline gains33 independent checks, ending at952 tests. Each task includes source identity, bounded execution evidence, independent arithmetic/record/control-flow expectations, deterministic regeneration and a report below2MiB. Storage/filter policy and documentation links pass. No original assets, Rust implementation or shared VM evaluator change in this batch. No original executable or native library runs, and no complete shot/hit/damage, native trace, full VM, macOS/Linux runtime or Solari rendering parity is claimed.
+
+## Next ten concrete tasks
+
+1. Recover290969–290994 and291081–291314: airborne local44 adjustment, stance flags and trigonometric offset terms, with exact native argument order and f32 responses.
+2. Recover291315–291475 extra offset rules for IDs10/14/23, flags8192/16384, future field6304 and recent field4404, preserving every additional RNG draw.
+3. Recover291476–291640 endpoint writes, then compose complete290493 with actual sampling, math and explicit rejection budget. Check arbitrary finite basis and origin handoffs.
+4. Compose293732 through actual290493, then recover291641's first trace request/record ABI. Stop at unknown world effects and preserve all caller output pointers.
+5. Continue295018 after its frame:295495 muzzle, sine/cosine width, rotation61092 and the argument-local signed-right-shift seed path. Do not substitute the global36717 unsigned RNG without checking equivalence.
+6. Recover295018's first per-pellet endpoint, initialized table consumption and actual trace-loop boundaries, keeping all variants and RNG updates visible.
+7. Recover292545 contact/material consumers and279820 bookkeeping, following211239 damage only once reached child contracts are explicit.
+8. Recover276433 entity query and native−31 linking contracts; apply recovered allocation to288903 after289113 and retain its base-selection assumptions.
+9. Recover grenade223156 expiry/explosion and reached trajectory/contact/bounce consumers; establish which routine clears/spawns/frees source records and validates allocator timing/capacity.
+10. Capture original reference traces and connect one validated firing path to the Rust runtime. Continue the wider native/DLL/network/content inventory and macOS/Linux Bevy/Solari gameplay/rendering work; static QVM fixtures do not establish platform support.

docs/research/QVM_SERVER_FIRE_BATCH.md

@@ -47,3 +47,6 @@ The879-test baseline gains40 independent checks. Reports regenerate deterministi
 8. Recover remaining dispatcher handlers298842/293732/294171/286473/287330 and event consumers21/12/14/15/49/50/87, with explicit asset/animation/audio mappings.
 9. Complete native vector snap and movement/scheduler composition, then capture original reference execution and legal multi-step event/weapon outcomes.
 10. Continue the native/DLL/network/rendering/content inventory and first Rust/Bevy/Solari gameplay slice on macOS/Linux with measured parity. Bounded server data flow is not whole-game completion.
+
+
+Follow-up: the [RE-604–613 allocation/spread batch](QVM_ALLOCATION_SPREAD_BATCH.md) recovers277165/277125 and constructor compositions, plus parts of293732/295018. Earlier supplied-pointer reports remain historical bounded contracts. Use the newer batch for current next tasks.

docs/research/QVM_SHARED_SHOT_BASIS.md

@@ -0,0 +1,7 @@
+# Shared shot handler basis muzzle and pending aim handoff
+
+RE-613. Reproduce with `python3 scripts/analyze_qvm_shared_shot_basis.py`; check with `python3 scripts/test_qvm_shared_shot_basis.py`. The [machine report](qvm-shared-shot-basis.json) retains source identity and bounded fixtures.
+
+Actual293733–294013 uses actual31691 and288871 plus supplied finite sin/cos. Unlike the outer firing preparation, this handler writes forward/up into its own frame and only right into globals. The alternate muzzle is entity+24 plus integer viewheight; no14×forward offset is added. The pending294024 call290493 receives entity, global muzzle, local36 forward and local392 endpoint. Endpoint canaries remain untouched at the boundary. Source-local lookup slot/mode are checked separately from the current-slot fields read inside290493. Static inventory retains all12 call sites through the void epilogue: lookup, six trig calls, muzzle, aim290493, trace291641, contact292545 and bookkeeping279820. The last four are inventoried rather than executed here. Independent32-fixture oracles compare complete initial/final server state and local vectors. The batch overview documents all ten tasks and the next ten concrete gaps, without promoting the incomplete overarching game task to complete.
+
+No original executable/full QVM/native collision/physics/rendering executes. Native responses and legal input domains are supplied or unverified where stated; full runtime/macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/README.md

@@ -438,3 +438,9 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-612: Shot body table copies and direction frame construction](QVM_SHOT_FRAME.md). Reproduce with `python3 scripts/analyze_qvm_shot_frame.py`; check with `python3 scripts/test_qvm_shot_frame.py`.
+
+
+[RE-604–613 allocation/spread batch and current next ten tasks](QVM_ALLOCATION_SPREAD_BATCH.md): actual entity allocation, constructor composition, spread parameters/sampling and shot direction frames.
+
+
+[RE-613: Shared shot handler basis muzzle and pending aim handoff](QVM_SHARED_SHOT_BASIS.md). Reproduce with `python3 scripts/analyze_qvm_shared_shot_basis.py`; check with `python3 scripts/test_qvm_shared_shot_basis.py`.

scripts/analyze_qvm_shared_shot_basis.py

@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+"""293732 current-slot lookup, local basis and alternate muzzle before aim child."""
+import itertools,math
+from pathlib import Path
+from qvm_research_support import source,execute
+from qvm_server_fire_support import seed,state,ENTITY,RIGHT,MUZZLE
+from analyze_qvm_weapon_lookup import lookup
+from analyze_qvm_server_muzzle import muzzle
+from analyze_qvm_acceleration import PS,word,number
+from analyze_qvm_slide_prefix import vec
+from analyze_qvm import write_json
+LOCAL=0x79600000
+
+def shared_basis(ins,m):
+    m=dict(m);before=state(m);m[LOCAL+488]=ENTITY
+    for o in range(392,404,4):m[LOCAL+o]=0x12345678
+    def trig(kind):
+        def apply(i,m,a,c):v=word((math.sin if kind=='sin' else math.cos)(number(a[8])));return m,c,v,{'model':kind,'argument':a[8]&0xffffffff,'result':v}
+        return apply
+    def origin(i,m,a,c):m,r=muzzle(i,m,288871,a);return m,c,0,r
+    m,_,r=execute(ins,293733,294014,m,(0,0,0),LOCAL,{31691:lookup,-104:trig('sin'),-105:trig('cos'),288871:origin})
+    return m,{'initial':before,'execution':r,'lookup_slot':m[LOCAL+116],'packed_id':m[LOCAL+120],'packed_mode':m[LOCAL+412],'local_forward':vec(m,LOCAL+36),'local_up':vec(m,LOCAL+48),'output_canary':vec(m,LOCAL+392),'pending_call':{'instruction':294024,'target':290493,'arguments':{8:ENTITY,12:MUZZLE,16:LOCAL+36,20:LOCAL+392}},'final':state(m)}
+
+def inventory(ins):
+    return [{'instruction':n,'target':ins[n-1]['operand']} for n in range(293733,294098) if ins[n]['opcode']=='CALL']
+
+def main():
+    q,raw,h,ins=source();rows=[]
+    for angles,slot,ident,mode in itertools.product([(0,0,0),(30,45,10),(-90,180,-45),(15.25,-170.5,90)],[0,15],[2,22],[0,1]):
+        m=seed(raw,h,ident)
+        for j in range(16):m[PS+312+4*j]=4
+        m[PS+312+4*slot]=ident|(mode<<16)
+        for j,v in enumerate(angles):m[PS+152+4*j]=word(v)
+        _,r=shared_basis(ins,m);r['expected_slot_fixture']=slot;r['mode_fixture']=mode;rows.append(r)
+    write_json(Path('docs/research/qvm-shared-shot-basis.json'),{'source':q['source'],'sha256':q['sha256'],'call_inventory':inventory(ins),'probes':rows,'limits':'Actual293733–294013 with actual31691/288871 and supplied finite sin/cos. Stops before290493; static suffix inventory is not executed. Trace291641/contact292545/stat279820 remain unresolved; no damage or full handler outcome.'})
+if __name__=='__main__':main()

scripts/test_qvm_shared_shot_basis.py

@@ -0,0 +1,18 @@
+import json,copy,unittest
+from pathlib import Path
+from test_qvm_server_fire_basis import vectors
+from test_qvm_ground import word,n,f
+class SharedShotBasisTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-shared-shot-basis.json').read_text())
+    def test_full_state_and_basis_oracle(self):
+        self.assertEqual(len(self.r['probes']),32)
+        for p in self.r['probes']:
+            expected=copy.deepcopy(p['initial']);fw,right,up=vectors(expected['angles']);expected['right']=right;point=list(expected['entity_base']);point[2]=word(f(n(point[2])+float(expected['viewheight'])));expected['muzzle']=point;self.assertEqual(p['final'],expected);self.assertEqual(p['local_forward'],fw);self.assertEqual(p['local_up'],up)
+    def test_actual_lookup_mode_and_child_order(self):
+        for p in self.r['probes']:
+            self.assertEqual(p['lookup_slot'],p['expected_slot_fixture']);self.assertEqual(p['packed_mode'],p['mode_fixture']);self.assertEqual(p['packed_id'],p['initial']['entity_weapon']);self.assertEqual([c['target'] for c in p['execution']['calls']],[31691,-104,-105,-104,-105,-104,-105,288871])
+    def test_pending_aim_output_untouched(self):
+        for p in self.r['probes']:self.assertEqual(p['output_canary'],[0x12345678]*3);self.assertEqual(p['pending_call'],{'instruction':294024,'target':290493,'arguments':{'8':589824,'12':36477712,'16':0x79600000+36,'20':0x79600000+392}})
+    def test_complete_static_call_inventory(self):self.assertEqual([c['target'] for c in self.r['call_inventory']],[31691,-104,-105,-104,-105,-104,-105,288871,290493,291641,292545,279820])
+if __name__=='__main__':unittest.main()