qvm: execute original string helpers

docs/FINDINGS.md

@@ -1409,3 +1409,6 @@ RE-791–800 adds exact Rust source-sort/ranking parity, mixed count/prefix sema
 
 
 **RE-803:** Both bounded resumers now support validated child byte writes, coherent word mirroring and explicit word/byte/return precedence. [Evidence](research/QVM_CHILD_BYTE_EFFECTS.md).
+
+
+**RE-804:** Actual strlen36038 and strcpy36185 execute against coherent bytes, preserving destination guards; bounded copy69338 retains an explicit native strncpy model. [Evidence](research/QVM_STRING_MEMORY.md).

docs/PROVISIONAL_TODO.md

@@ -1416,3 +1416,6 @@ RE-802: Bounded tracing can now preserve byte/word coherence and execute unalign
 
 
 RE-803: Both bounded resumers now support validated child byte writes, coherent word mirroring and explicit word/byte/return precedence. Full runtime completion remains open. [Evidence](research/QVM_CHILD_BYTE_EFFECTS.md).
+
+
+RE-804: Actual strlen36038 and strcpy36185 execute against coherent bytes, preserving destination guards; bounded copy69338 retains an explicit native strncpy model. Full runtime completion remains open. [Evidence](research/QVM_STRING_MEMORY.md).

docs/RESEARCH_LEDGER.md

@@ -1681,3 +1681,8 @@ Bounded tracing can now preserve byte/word coherence and execute unaligned byte
 ## 2026-10-26 — RE-803 Explicit child byte effects and read-only shared byte views
 
 Both bounded resumers now support validated child byte writes, coherent word mirroring and explicit word/byte/return precedence. Focused `cargo xtask test-group child-byte-effects` passes (6 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.
+
+
+## 2026-10-26 — RE-804 Actual QVM string helpers across aligned and unaligned memory
+
+Actual strlen36038 and strcpy36185 execute against coherent bytes, preserving destination guards; bounded copy69338 retains an explicit native strncpy model. Focused `cargo xtask test-group string-memory` passes (6 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1459,3 +1459,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-803 Explicit child byte effects and read-only shared byte views ([evidence](research/QVM_CHILD_BYTE_EFFECTS.md)).
+
+
+- [x] RE-804 Actual QVM string helpers across aligned and unaligned memory ([evidence](research/QVM_STRING_MEMORY.md)).

docs/research/QVM_STRING_MEMORY.md

@@ -0,0 +1,7 @@
+# Actual QVM string helpers across aligned and unaligned memory
+
+RE-804. Reproduce with `python3 scripts/analyze_qvm_string_memory.py`; focused validation: `cargo xtask test-group string-memory`. [Machine report](qvm-string-memory.json).
+
+128 original-instruction fixtures vary source/destination alignment, NUL positions, long names and non-UTF8 bytes.32 wrapper cases verify valid capacities1/2/4/32 and exact terminal NUL. Independent byte-string oracles check lengths, return pointers and all destination guard bytes. Source word lookahead is given initialized padding; overlap and native ABI/error paths are not claimed.
+
+Original executable/native runtime and complete Linux/macOS Rust/Bevy/Solari acceptance remain unverified.

docs/research/README.md

@@ -999,3 +999,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-803: Explicit child byte effects and read-only shared byte views](QVM_CHILD_BYTE_EFFECTS.md).
+
+
+[RE-804: Actual QVM string helpers across aligned and unaligned memory](QVM_STRING_MEMORY.md).

docs/research/qvm-resumer-audit.json

@@ -9371,6 +9371,42 @@
       "repeated_calls_opt_in": true,
       "repeated_calls_setting": "literal_true"
     },
+    {
+      "backward_conditional_branches": [],
+      "calls": [
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": null,
+          "instruction": 69348,
+          "stores_result": false,
+          "target": 5096
+        },
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": null,
+          "instruction": 69359,
+          "stores_result": false,
+          "target": 5096
+        },
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": null,
+          "instruction": 69373,
+          "stores_result": false,
+          "target": -103
+        }
+      ],
+      "explicit_result_offsets": null,
+      "helper": "qvm_trace_support.resume",
+      "line": 36,
+      "literal_range": [
+        69339,
+        69384
+      ],
+      "path": "scripts/qvm_string_memory_support.py",
+      "repeated_calls_opt_in": true,
+      "repeated_calls_setting": "literal_true"
+    },
     {
       "backward_conditional_branches": [],
       "calls": [
@@ -9432,8 +9468,8 @@
     }
   },
   "summary": {
-    "call_expressions": 188,
-    "files": 146,
+    "call_expressions": 189,
+    "files": 147,
     "legacy_expressions": 158,
     "nonliteral_ranges": 24,
     "unresolved_mode_expressions": 3

scripts/analyze_qvm_string_memory.py

@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+import itertools
+from pathlib import Path
+from qvm_research_support import source
+from qvm_string_memory_support import strlen,strcpy,copy_bounded,L
+from qvm_byte_memory_support import read_bytes
+from analyze_qvm import write_json
+S=L+0x4000;D=S+0x1000
+
+def main():
+    q,raw,h,ins=source();rows=[];copies=[];names=[b'',b'A',b'AB',b'x'*31,b'x'*32,b'x'*63,b'AB\0suffix',bytes([255,254,253])]
+    for sa,da,name in itertools.product(range(4),range(4),names):
+        b={S+sa+j:v for j,v in enumerate(name+b'\0'+b'\xcc'*4)};b.update({D+j:0x7e for j in range(96)});m,n,e=strlen(ins,{}, {8:S+sa},b);m,value,c=strcpy(ins,m,{8:D+da,12:S+sa},b);out=read_bytes(m,{**b,**c['child_memory_bytes']},D,96);rows.append({'source_alignment':sa,'dest_alignment':da,'source_hex':name.hex(),'length':n,'result_pointer':value-D,'buffer_hex':out.hex(),'strlen_execution':e['execution'],'strcpy_execution':c['execution']})
+    for name,cap in itertools.product(names,[1,2,4,32]):
+        b={S+j:v for j,v in enumerate(name+b'\0'+b'\xcc'*4)};b.update({D+j:0x7e for j in range(40)});m,v,e=copy_bounded(ins,{}, {8:D,12:S,16:cap},b);out=read_bytes(m,{**b,**e['child_memory_bytes']},D,40);copies.append({'source_hex':name.hex(),'capacity':cap,'buffer_hex':out.hex(),'wrapper_trace_sha256':e['wrapper_trace_sha256']})
+    write_json(Path('docs/research/qvm-string-memory.json'),{'source':q['source'],'sha256':q['sha256'],'probes':rows,'bounded_copies':copies,'limits':'Actual36038 strlen and36185 strcpy over128 aligned/unaligned byte fixtures, plus actual69338 valid wrapper over32 cases with modeled native-103 strncpy. Source word lookahead requires initialized padding; strcpy fixtures are disjoint with initialized destination guards. Native copy/error/overlap ABI parity remains open.'})
+if __name__=='__main__':main()

scripts/qvm_string_memory_support.py

@@ -0,0 +1,38 @@
+"""Actual36038/36185 and69338 with explicit modeled native strncpy bytes."""
+from qvm_health_effects_support import H
+from qvm_byte_memory_support import read_byte,read_bytes
+from analyze_deferred_auth import trace_slice
+from analyze_bsp_references import trace_fields
+from qvm_trace_support import resume
+L=H+0x680000
+C=L+0x1000
+W=L+0x2000
+
+def cstring(m,b,address,limit=32768):
+    out=bytearray()
+    for j in range(limit):
+        v=read_byte(m,b,address+j)
+        if v==0:return bytes(out)
+        out.append(v)
+    raise ValueError('bounded string missing NUL')
+
+def strlen(ins,m,args,b):
+    m=dict(m);m[L+28]=args[8];t=trace_slice(ins,36039,36121,m,{},byte_memory=b,local_base=L,coherent_memory=True,capture_stack=True,halt_on_leave=True,limit=32768)
+    return t['memory'],t['stack'][-1],{'execution':trace_fields(t,False),'actual_strlen':True}
+
+def strcpy(ins,m,args,b):
+    n=len(cstring(m,b,args[12],1025));m=dict(m);m[C+32]=args[8];m[C+36]=args[12];t=trace_slice(ins,36186,36304,m,{},byte_memory=b,local_base=C,coherent_memory=True,capture_stack=True,halt_on_leave=True,limit=32768)
+    cells={args[8]+j:read_byte(t['memory'],t['byte_memory'],args[8]+j) for j in range(n+1)}
+    return t['memory'],t['stack'][-1],{'execution':trace_fields(t,False),'child_memory_bytes':cells,'actual_strcpy':True}
+
+def copy_bounded(ins,m,args,b):
+    if args[12]==0 or not 1<=args[16]<=1024:raise ValueError('unsupported bounded copy domain')
+    m=dict(m)
+    for o,v in args.items():m[W+20+o]=v
+    def native(i,m,a,bs):
+        if not 0<=a[16]<=1023:raise ValueError('unsupported native copy count')
+        raw=cstring(m,bs,a[12]);data=raw[:a[16]].ljust(a[16],b'\0')
+        return m,a[8],{'native_strncpy_modeled':True,'child_memory_bytes':{a[8]+j:v for j,v in enumerate(data)}}
+    m,e=resume(ins,69339,69384,m,W,handlers={-103:native},byte_inputs=b,repeated_calls=True,sync_child_words=True,coherent_memory=True,byte_handlers=True,capture_byte_memory=True)
+    cells={args[8]+j:read_byte(m,e['byte_memory'],args[8]+j) for j in range(args[16])}
+    return m,0,{'child_memory_bytes':cells,'wrapper_trace_sha256':e['trace_sha256'],'native_strncpy_modeled':True}

scripts/test_qvm_string_memory.py

@@ -0,0 +1,18 @@
+import json,unittest
+from pathlib import Path
+from qvm_string_memory_support import cstring,copy_bounded
+class StringMemoryTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-string-memory.json').read_text())
+    def test_actual_strlen_strcpy_and_preserved_post_nul_guards(self):
+        self.assertEqual(len(self.r['probes']),128)
+        for p in self.r['probes']:
+            text=bytes.fromhex(p['source_hex']).split(b'\0')[0];out=bytearray(b'~'*96);start=p['dest_alignment'];out[start:start+len(text)+1]=text+b'\0';self.assertEqual(p['length'],len(text));self.assertEqual(p['result_pointer'],start);self.assertEqual(p['buffer_hex'],out.hex())
+    def test_actual_wrapper_terminator_and_native_copy_model(self):
+        self.assertEqual(len(self.r['bounded_copies']),32)
+        for p in self.r['bounded_copies']:
+            raw=bytes.fromhex(p['source_hex']).split(b'\0')[0];cap=p['capacity'];out=bytearray(b'~'*40);out[:cap]=raw[:cap-1].ljust(cap-1,b'\0')+b'\0';self.assertEqual(p['buffer_hex'],out.hex())
+    def test_unterminated_and_invalid_domains_reject(self):
+        with self.assertRaisesRegex(ValueError,'missing NUL'):cstring({},dict(enumerate(b'abc')),0,3)
+        with self.assertRaises(ValueError):copy_bounded([],{},{8:4,12:8,16:0},{})
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -1898,3 +1898,8 @@ report	scripts/analyze_qvm_child_byte_effects.py	docs/research/qvm-child-byte-ef
 edge	docs/research/qvm-child-byte-effects.json	scripts/test_qvm_child_byte_effects.py
 group	child-byte-effects	scripts/analyze_qvm_child_byte_effects.py
 edge	scripts/analyze_qvm_child_byte_effects.py	scripts/analyze_qvm_resumer_audit.py
+report	scripts/analyze_qvm_string_memory.py	docs/research/qvm-string-memory.json
+edge	docs/research/qvm-string-memory.json	scripts/test_qvm_string_memory.py
+group	string-memory	scripts/analyze_qvm_string_memory.py
+edge	scripts/analyze_qvm_string_memory.py	scripts/analyze_qvm_resumer_audit.py
+edge	scripts/qvm_string_memory_support.py	scripts/analyze_qvm_resumer_audit.py