qvm: lethal and method24 interception

docs/ASSET_PIPELINE_TODO.md

@@ -847,3 +847,6 @@ Research progress: RE-726 [report](research/QVM_HEALTH_CREDIT.md); original asse
 
 
 Research progress: RE-727 [report](research/QVM_HEALTH_SPECIAL_TARGET.md); original assets unchanged.
+
+
+Research progress: RE-728 [report](research/QVM_HEALTH_INTERCEPTS.md); original assets unchanged.

docs/FINDINGS.md

@@ -1193,3 +1193,6 @@ RE-714–723 batch complete: [complete contact and health prefixes](research/QVM
 
 
 **RE-727 — Special target health classes and actual RNG:** The magic checksum routes method34 directly to health−999; class0–4 can choose1/2/3 damage through actual36717, while classes5–10 filter methods22/25 and selected classes halve method25 damage. [Evidence](research/QVM_HEALTH_SPECIAL_TARGET.md).
+
+
+**RE-728 — Lethal mode interception and method24 override:** Mode10 can divert distinct live-client lethal damage to206128, while method24/global34066516 zeros direction z and requests impulse without ordinary health subtraction. [Evidence](research/QVM_HEALTH_INTERCEPTS.md).

docs/PROVISIONAL_TODO.md

@@ -1182,3 +1182,6 @@ Research progress: RE-726 [report](research/QVM_HEALTH_CREDIT.md); full native/p
 
 
 Research progress: RE-727 [report](research/QVM_HEALTH_SPECIAL_TARGET.md); full native/platform/game scope remains open.
+
+
+Research progress: RE-728 [report](research/QVM_HEALTH_INTERCEPTS.md); full native/platform/game scope remains open.

docs/RESEARCH_LEDGER.md

@@ -1278,3 +1278,8 @@ Health bookkeeping adjusts attacker client252, clamps incoming integer damage to
 ## 2026-10-21 — RE-727 Special target health classes and actual RNG
 
 The magic checksum routes method34 directly to health−999; class0–4 can choose1/2/3 damage through actual36717, while classes5–10 filter methods22/25 and selected classes halve method25 damage. Focused `cargo xtask test-group health` passes (20 Python tests); selected reports regenerate twice byte-identically, with storage, links and whitespace guards. New report: 1189392 bytes. Full-suite validation is deferred to the tenth batch commit. No original assets, Rust runtime or shared VM evaluator changed.
+
+
+## 2026-10-21 — RE-728 Lethal mode interception and method24 override
+
+Mode10 can divert distinct live-client lethal damage to206128, while method24/global34066516 zeros direction z and requests impulse without ordinary health subtraction. Focused `cargo xtask test-group health` passes (24 Python tests); selected reports regenerate twice byte-identically, with storage, links and whitespace guards. New report: 351229 bytes. Full-suite validation is deferred to the tenth batch commit. No original assets, Rust runtime or shared VM evaluator changed.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1225,3 +1225,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-727 Special target health classes and actual RNG ([report](research/QVM_HEALTH_SPECIAL_TARGET.md)).
+
+
+- [x] RE-728 Lethal mode interception and method24 override ([report](research/QVM_HEALTH_INTERCEPTS.md)).

docs/research/QVM_HEALTH_INTERCEPTS.md

@@ -0,0 +1,7 @@
+# Lethal mode interception and method24 override
+
+RE-728. Reproduce with `python3 scripts/analyze_qvm_health_intercepts.py`; validate with `cargo xtask test-group health`. See the [machine report](qvm-health-intercepts.json).
+
+Actual212479–212621 intercepts mode10 lethal damage only for distinct client attacker/target, clear target client220 bit16384 and a method outside6/7/1/3/2/4/9/31/35/33/32. The206128 target/attacker/method request is captured. Otherwise method24 with global34066516 nonzero zeros supplied direction z, captures213009(target,direction,knockback), and exits. Other cases continue at212622. The100 supplied mode/client/self/health/method/flag/override fixtures verify both request signatures, branch order and unchanged health/client state. Intercept lifecycle and impulse effects are not executed here.
+
+No original executable/full VM/native world collision or rendering runs. Supplied callback/native responses and fixture domains remain explicit; complete macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/README.md

@@ -783,3 +783,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-727: Special target health classes and actual RNG](QVM_HEALTH_SPECIAL_TARGET.md).
+
+
+[RE-728: Lethal mode interception and method24 override](QVM_HEALTH_INTERCEPTS.md).

scripts/analyze_qvm_health_intercepts.py

@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+"""Mode10 lethal interception and method24 override before ordinary subtraction."""
+import itertools
+from pathlib import Path
+from qvm_research_support import source
+from qvm_health_effects_support import seed,run
+from analyze_qvm import write_json
+
+def main():
+    q,raw,h,ins=source();rows=[]
+    cases=[dict(mode=mode,method=method,health=health,damage=damage,flags220=flags) for mode,method,health,damage,flags in itertools.product([3,10],[1,6,12,24,33],[99,100],[99,100],[0,16384])]
+    cases += [dict(mode=10,method=12,client=client,attacker_client=attacker,self=self_hit) for client,attacker,self_hit in itertools.product([False,True],[False,True],[False,True])]
+    cases += [dict(method=24,override=override,knockback=kb,direction=direction) for override,kb,direction in itertools.product([0,1],[-50,0,100],[(3,4,7),(0,0,0)])]
+    for a in cases:
+        _,p=run(ins,seed(raw,h,**a),212479,212622);p['input']=a;rows.append(p)
+    write_json(Path('docs/research/qvm-health-intercepts.json'),{'source':q['source'],'sha256':q['sha256'],'probes':rows,'limits':'Actual212479..212621;206128 and213009 requests captured. No intercepted lifecycle or velocity effects execute. Nonnull direction supplied for override writes.'})
+if __name__=='__main__':main()

scripts/test_qvm_health_intercepts.py

@@ -0,0 +1,24 @@
+import json,unittest
+from pathlib import Path
+from qvm_health_effects_support import TARGET,ATTACKER,DIRECTION
+from test_qvm_ground import word
+class HealthInterceptTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.ps=json.loads(Path('docs/research/qvm-health-intercepts.json').read_text())['probes']
+    def test_independent_interception_and_override_truth_table(self):
+        for p in self.ps:
+            a=p['input'];intercept=a.get('mode',3)==10 and a.get('client',True) and a.get('attacker_client',True) and not a.get('self',False) and a.get('health',100)-a.get('damage',100)<=0 and not a.get('flags220',0)&16384 and a.get('method',12) not in (6,7,1,3,2,4,9,31,35,33,32);override=not intercept and a.get('method',12)==24 and a.get('override',0)!=0
+            self.assertEqual(len(p['effects']['intercepts']),int(intercept));self.assertEqual(len(p['effects']['impulses']),int(override));self.assertEqual(p['execution']['stop'],213007 if intercept or override else 212622)
+    def test_exact_request_abis(self):
+        for p in self.ps:
+            for c in p['effects']['intercepts']:self.assertEqual(c['arguments'],{'8':TARGET,'12':ATTACKER,'16':p['input'].get('method',12)})
+            for c in p['effects']['impulses']:self.assertEqual(c['arguments'],{'8':TARGET,'12':DIRECTION,'16':word(p['input'].get('knockback',100))})
+    def test_override_zeros_only_direction_z(self):
+        for p in self.ps:
+            values=list(p['initial']['direction'])
+            if p['effects']['impulses']:values[2]=0
+            self.assertEqual(p['final']['direction'],values)
+    def test_health_and_client_fields_unchanged(self):
+        self.assertEqual(len(self.ps),100)
+        for p in self.ps:self.assertEqual(p['initial']['entity'],p['final']['entity']);self.assertEqual(p['initial']['client'],p['final']['client'])
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -1149,3 +1149,5 @@ report	scripts/analyze_qvm_health_credit.py	docs/research/qvm-health-credit.json
 edge	docs/research/qvm-health-credit.json	scripts/test_qvm_health_credit.py
 report	scripts/analyze_qvm_health_special_target.py	docs/research/qvm-health-special-target.json
 edge	docs/research/qvm-health-special-target.json	scripts/test_qvm_health_special_target.py
+report	scripts/analyze_qvm_health_intercepts.py	docs/research/qvm-health-intercepts.json
+edge	docs/research/qvm-health-intercepts.json	scripts/test_qvm_health_intercepts.py