qvm: configured player bounds records

docs/ASSET_PIPELINE_TODO.md

@@ -583,3 +583,9 @@ Research progress: RE-633 [report](research/QVM_REWIND_RESTORE.md); remaining na
 
 
 Research progress: RE-634 [report](research/QVM_REWIND_SELECTORS.md); remaining native/content/runtime/platform scope stays open.
+
+
+The [RE-626–635 trace/rewind batch](research/QVM_TRACE_REWIND_BATCH.md) recovers trace cleanup under supplied responses, snapshot/restore state, fixed player selectors and configured player_bb construction. Its next ten tasks prioritize history interpolation, model hits, contact/damage and full pellet aggregation. Original reference and full Rust/Bevy/Solari macOS/Linux/native/content/network/rendering scope remain open.
+
+
+Research progress: RE-635 [report](research/QVM_PLAYER_BB_CONSTRUCT.md); remaining native/content/runtime/platform scope stays open.

docs/FINDINGS.md

@@ -935,3 +935,6 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 
 
 **RE-634 — Fixed player rewind selection and actual restore enumeration:** 144082 and144413 scan exactly64 source slots using matching client/in-use/state/exclusion gates; the restore selector now executes recovered144165. [Evidence](research/QVM_REWIND_SELECTORS.md).
+
+
+**RE-635 — Configured player_bb construction with recovered allocation:** 144493 constructs file-named player_bb records with actual allocation/origin setup, using fewer selector gates; the position setter overwrites the earlier trajectory time. [Evidence](research/QVM_PLAYER_BB_CONSTRUCT.md).

docs/PROVISIONAL_TODO.md

@@ -903,3 +903,9 @@ Research progress: RE-633 [report](research/QVM_REWIND_RESTORE.md); remaining na
 
 
 Research progress: RE-634 [report](research/QVM_REWIND_SELECTORS.md); remaining native/content/runtime/platform scope stays open.
+
+
+The [RE-626–635 trace/rewind batch](research/QVM_TRACE_REWIND_BATCH.md) recovers trace cleanup under supplied responses, snapshot/restore state, fixed player selectors and configured player_bb construction. Its next ten tasks prioritize history interpolation, model hits, contact/damage and full pellet aggregation. Original reference and full Rust/Bevy/Solari macOS/Linux/native/content/network/rendering scope remain open.
+
+
+Research progress: RE-635 [report](research/QVM_PLAYER_BB_CONSTRUCT.md); remaining native/content/runtime/platform scope stays open.

docs/RESEARCH_LEDGER.md

@@ -847,3 +847,8 @@ Whole291641 now follows supplied world/entity traces through retry, ordered reli
 ## 2026-10-20 — RE-634 Fixed player rewind selection and actual restore enumeration (separate task commit)
 
 144082 and144413 scan exactly64 source slots using matching client/in-use/state/exclusion gates; the restore selector now executes recovered144165. 16 selector/exclusion/global-count/delta fixtures independently check all64 predicates, call order, time ABI and actual child restoration. Full suite: 1019 tests pass. Report regenerates byte-identically (1219554 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.
+
+
+## 2026-10-20 — RE-635 Configured player_bb construction with recovered allocation (separate task commit)
+
+144493 constructs file-named player_bb records with actual allocation/origin setup, using fewer selector gates; the position setter overwrites the earlier trajectory time. Five selector/time cases independently reconstruct every spawned record, allocation/link ordering, owner fields, expiry overflow and final time16=0. Full suite: 1023 tests pass. Report regenerates byte-identically (499540 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.

docs/REVERSE_ENGINEERING_TODO.md

@@ -915,7 +915,7 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 - [x] RE-623 Signed pellet seed perturbation and endpoint construction ([report](research/QVM_PELLET_ENDPOINT.md)).
 
 
-- [ ] RE-625 Recover trace result/rewind/restoration and contact/damage consumers, full20-pellet loop and aggregation, then query/base/grenade lifecycle and original reference/Rust platform integration. See the [next ten tasks](research/QVM_AIM_TRACE_BATCH.md#next-ten-concrete-tasks).
+- [ ] RE-625 Partially advanced by RE-626–635:trace classification/retry/relink/bounds and supplied-response return paths, rewind snapshot/restore/selectors and configured player_bb construction are recovered. Actual history interpolation, model-hit/contact/damage, full20-pellet aggregation, native world effects and platform integration remain open. See the [current next ten tasks](research/QVM_TRACE_REWIND_BATCH.md#next-ten-concrete-tasks).
 
 
 - [x] RE-624 Allocated event57 to first pellet native trace boundary ([report](research/QVM_EVENT57_TRACE_CHAIN.md)).
@@ -946,3 +946,9 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-634 Fixed player rewind selection and actual restore enumeration ([report](research/QVM_REWIND_SELECTORS.md)).
+
+
+- [ ] RE-636 Recover history bracketing/interpolation and compose complete rewind/restore; continue model-hit/contact/damage, pellet aggregation and entity lifecycle, then original-reference and Rust platform integration. Follow the [next ten tasks](research/QVM_TRACE_REWIND_BATCH.md#next-ten-concrete-tasks).
+
+
+- [x] RE-635 Configured player_bb construction with recovered allocation ([report](research/QVM_PLAYER_BB_CONSTRUCT.md)).

docs/research/QVM_AIM_TRACE_BATCH.md

@@ -49,3 +49,6 @@ Native trig/sqrt are finite supplied math models; original native library bit pa
 8. Recover entity query276433 and native link/unlink contracts; continue288903 after actual allocation through temp_bomb setup/lifetime callbacks.
 9. Recover grenade223156 and reached trajectory/contact/bounce/explosion/damage paths, with entity clearing/freeing and allocator timing/capacity validated against original behavior.
 10. Capture original executable/native/DLL reference traces and implement one verified Rust gameplay slice with cross-platform checks. Continue maps/models/textures/shaders/audio/network inventory and Bevy/Solari rendering adaptation for macOS/Linux; these bounded QVM analyses do not complete the game.
+
+
+Follow-up: the [RE-626–635 trace/rewind batch](QVM_TRACE_REWIND_BATCH.md) recovers cleanup, snapshot/restore and configured construction. Use its next ten tasks for current unresolved work.

docs/research/QVM_PLAYER_BB_CONSTRUCT.md

@@ -0,0 +1,7 @@
+# Configured player_bb construction with recovered allocation
+
+RE-635. Reproduce with `python3 scripts/analyze_qvm_player_bb_construct.py`; check with `python3 scripts/test_qvm_player_bb_construct.py`. The [machine report](qvm-player-bb-construct.json) retains source identity and bounded fixtures.
+
+Actual144494–144763 scans64 slots for non-null client, in-use, client3096<3 and not the excluded player. It does not apply rewind selector fields3740/4324. Actual277165/277125 allocate source-pool records, and actual278138 sets origin before velocity/angle copies. File classname62908 is player_bb; descriptor4=10, expiry644=now+3000, callback648=277400, owner fields and client counters are retained exactly. Source initially writes16=now, then278138 clears16/20 and zeroes velocity before the caller copies owner velocity, so final16 is0. Independent full220-word oracles cover five cases, including both excluded client flags and time overflow. Native registration/link requests remain captured; no debug rendering/network/expiry or NULL-allocation legality is inferred. The batch overview records ten tasks and current next gaps; full history interpolation, model-hit/damage and Rust platform gameplay remain open.
+
+No original executable/full QVM/native collision/physics/rendering executes. Native responses and legal input domains are supplied or unverified where stated; full runtime/macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/QVM_TRACE_REWIND_BATCH.md

@@ -0,0 +1,51 @@
+# Trace cleanup and rewind state: RE-626–635
+
+Ten separately checked tasks extend the [aim and trace-boundary batch](QVM_AIM_TRACE_BATCH.md). They recover trace classification, retry and cleanup; the rewind snapshot and restore map; player selectors; and the configured `player_bb` constructor. Supplied collision responses and captured native requests remain distinct from original engine execution.
+
+| Task | Recovered scope | Evidence |
+| --- | --- | --- |
+| RE-626 | Trace entity classification before model-hit/damage consumers | [Classification](QVM_TRACE_CLASSIFY.md) |
+| RE-627 | Retry unlink, pointer stack and ten-target boundary | [Retry](QVM_TRACE_RETRY.md) |
+| RE-628 | Skipped-target relink order, including duplicates | [Relink](QVM_TRACE_RELINK.md) |
+| RE-629 | Candidate bound restoration and f32 round-trip limits | [Bounds](QVM_TRACE_BOUNDS_RESTORE.md) |
+| RE-630 | Shooter restore gate, final link and numeric return | [Finalization](QVM_TRACE_FINALIZE.md) |
+| RE-631 | Whole trace control flow under supplied response sequences | [Trace chains](QVM_TRACE_RESPONSE_CHAIN.md) |
+| RE-632 | Rewind snapshot vectors, client fields and packed bytes | [Snapshot](QVM_REWIND_SNAPSHOT.md) |
+| RE-633 | Complete snapshot restore helper and guarded second call | [Restore](QVM_REWIND_RESTORE.md) |
+| RE-634 | Fixed 64-slot rewind selection and actual restore enumeration | [Selectors](QVM_REWIND_SELECTORS.md) |
+| RE-635 | Configured `player_bb` creation with actual allocation/origin setter | [Constructor](QVM_PLAYER_BB_CONSTRUCT.md) |
+
+## Findings for the port
+
+Trace IDs at or above 1022 enter cleanup. Smaller IDs select the fixed entity pool, with separate player/model and literal-tag branches. Positive health and the relevant fields can lead to model-hit helper 144766 or damage 211239; those consumers remain suspended. Classification alone does not establish a valid hit.
+
+Retry unlinks and records each skipped pointer, then requests another trace only while fewer than ten pointers have accumulated. Cleanup relinks those pointers in insertion order, preserving duplicate entries. Synthetic repeated-target responses test source behavior without asserting that the engine would return an already unlinked target.
+
+Bound restoration repeats the candidate eligibility gates, reverses floating-point additions/subtractions and writes fixed dimensions. It does not copy a saved record. Canonical ordinary records can round-trip exactly; arbitrary dimensions and some large f32 values do not. Minimum Z fields remain untouched. State changes during actual damage may also change cleanup eligibility and require further recovery.
+
+The final trace suffix requests rewind restoration only for a client shooter with record 424 bit 8 clear and mode exactly 1. Otherwise it requests a final shooter link and returns local 96. Whole-function fixtures now follow supplied world/entity responses through retry and cleanup to that actual return. A returned zero is retained as a source value rather than interpreted as a gameplay result.
+
+The rewind snapshot saves entity vectors from offsets 488, 24, 60 and 36 into client storage, along with six selected client fields. It sets client 4408 and packs the low bytes of entity 200/196 at client 4448/4449. The restore helper clears the guard, copies the saved state back, zero-extends those bytes and requests a link. High animation bits do not survive that snapshot format. A second restore call is inactive. History selection and interpolation in 143100 remain unresolved.
+
+Both rewind and restore selectors inspect exactly 64 pool slots, ignoring the global entity count. Their gates require a client, an in-use record, client state below 3, a different record from the excluded player, and zero client fields 3740/4324. Rewind calls are captured under an explicit nonmutating child contract; the restore selector executes the recovered restore helper.
+
+The configured branch creates file-named `player_bb` records using a less restrictive selector: it omits the 3740/4324 gates. Actual allocation, initialization and origin setting now execute in this constructor analysis. Records preserve source owner/client fields, a 3000-time expiry and callback 277400, then issue captured link requests. Source order matters: the constructor initially writes the current time to record 16, but the later origin setter clears it to zero. Its final velocity is copied afterward. No rendering, networking or expiry effect is inferred from these records.
+
+## Validation and limits
+
+The 988-test baseline gains 35 checks, ending at 1023 tests. Independent branch, full-record, byte-packing, call-order and f32 oracles cover each task. Reports regenerate deterministically and remain below 2 MiB. Storage/filter, documentation-link and whitespace checks pass. No original assets, Rust runtime or shared VM evaluator change in this batch.
+
+Native collision responses in the composed trace fixtures are explicitly supplied. Native link, unlink and entity-registration requests are captured without engine effects. No model-hit/damage result or complete rewind interpolation is fabricated. Synthetic dimensions, large float values, duplicate targets, high animation bits and entity-count fixtures do not establish legal live input domains. No original executable/full VM, native physics/rendering/network stack or macOS/Linux Bevy/Solari gameplay runs here.
+
+## Next ten concrete tasks
+
+1. Recover 143100 history selection: its 20 entries, 80-byte stride, timestamp field, bracketing rules and boundary/equality/extrapolation paths. Establish the meaning of the forwarded time argument from original evidence.
+2. Recover reached interpolation helpers 143031 and 63746, including exact f32 vector order and angular wrapping. Avoid replacing them with generic library interpolation before equivalence is checked.
+3. Compose complete 143100 snapshot, history interpolation and native-link request, then restore with 144165. Test round trips across actual selected history records and retain animation-byte truncation.
+4. Bind recovered rewind/restore selectors and configured construction into the whole trace routine. Keep native responses explicit until original collision is available, and verify cleanup across each reached exit.
+5. Partition model-hit helper 144766, recover its first native/copy/math and model-state contracts, then its actual classification outputs. No successful player hit should be supplied as a shortcut.
+6. Continue shared handler 293732 after actual trace returns into contact 292545 and bookkeeping 279820, preserving caller trace/output pointers and reached damage boundaries.
+7. Recover 295018's full 20-pellet loop and signed seed carry under bounded supplied trace responses, then its four-target/fifteen-slot aggregation and no-target bookkeeping path.
+8. Recover reached damage 211239 and the tagged trace branch's event 64/normal encoding consumers. Reuse actual allocation without inventing health, penetration or impact effects.
+9. Recover `player_bb` expiry callback 277400 and entity free-time behavior. Continue query 276433, base construction after allocation, and grenade 223156 lifecycle as separate bounded follow-ups.
+10. Capture original executable/native/DLL reference traces and connect a verified gameplay path to Rust. Continue asset/map/model/texture/shader/audio/network analysis and macOS/Linux Bevy/Solari rendering and runtime work; these fixtures do not complete the game.

docs/research/README.md

@@ -504,3 +504,9 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-634: Fixed player rewind selection and actual restore enumeration](QVM_REWIND_SELECTORS.md). Reproduce with `python3 scripts/analyze_qvm_rewind_selectors.py`; check with `python3 scripts/test_qvm_rewind_selectors.py`.
+
+
+[RE-626–635 trace/rewind batch and current next ten tasks](QVM_TRACE_REWIND_BATCH.md): classification/retry/cleanup, supplied-response trace chains, snapshot/restore/selectors and configured player_bb construction.
+
+
+[RE-635: Configured player_bb construction with recovered allocation](QVM_PLAYER_BB_CONSTRUCT.md). Reproduce with `python3 scripts/analyze_qvm_player_bb_construct.py`; check with `python3 scripts/test_qvm_player_bb_construct.py`.

scripts/analyze_qvm_player_bb_construct.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+"""Configured144493 player_bb construction with recovered allocation/origin."""
+from pathlib import Path
+from qvm_research_support import source,execute
+from analyze_qvm_rewind_selectors import pool_fixture
+from analyze_qvm_entity_allocate import allocate
+from analyze_qvm_entity_init import POOL,STRIDE
+from analyze_qvm_temp_event import record,set_origin
+from analyze_qvm import write_json
+LOCAL=0x79c00000
+
+def construct(ins,m,excluded):
+    m=dict(m);m[LOCAL+52]=excluded;allocations=[];owners=[];links=[];initial_count=m[34992508];time=m[34992532];slots=[]
+    for index in range(64):
+        p=POOL+index*STRIDE;client=m[p+520];slots.append({'pointer':p,'client':client,'used':m[p+532],'state3096':m.get(client+3096) if client else None})
+    def allocated(i,m,a,c):
+        owner=m[LOCAL+16];client=m[owner+520];owners.append({'pointer':owner,'record':record(m,owner),'client_fields':{str(o):m[client+o]&0xffffffff for o in [0,700,6176,6204,6256]}});m,r=allocate(i,m)
+        if r['selected'] is None:raise ValueError('player_bb allocator did not return')
+        allocations.append(r);return m,c,r['selected'],{'allocation_index':len(allocations)-1,'selected':r['selected']}
+    def origin(i,m,a,c):m,r=set_origin(i,m,a);return m,c,0,{'input':r['input'],'execution':r['execution']}
+    def link(i,m,a,c):r={'arguments':a,'record_at_request':record(m,a[8]),'native_effect_not_executed':True};links.append(r);return m,c,0,{'link_index':len(links)-1,'arguments':a,'native_effect_not_executed':True}
+    m,_,e=execute(ins,144494,144764,m,(0,0,0),LOCAL,{277165:allocated,278138:origin,-31:link});spawned=[{'pointer':r['selected'],'owner':owner,'allocation_index':j,'final_record':record(m,r['selected'])} for j,(r,owner) in enumerate(zip(allocations,owners))]
+    return m,{'excluded':excluded,'excluded_id':m[excluded],'time':time,'initial_count':initial_count,'count':m[34992508],'slots':slots,'allocations':allocations,'links':links,'spawned':spawned,'execution':e}
+
+def fixture(raw,h,ins,keep,now):
+    m=pool_fixture(raw,h,ins);m.update({34992508:64,34992500:POOL,34992496:0x200000,34992532:now,34992544:0})
+    for index in range(64):
+        p=POOL+index*STRIDE;client=m[p+520]
+        if index not in [0,2,3,4,5]+keep:m[p+520]=0;continue
+        if client:
+            m[client]=1000+index;m[client+6176]=5000+2*index;m[client+700]=256+index
+    for index in range(64,70):
+        for o in range(0,STRIDE,4):m[POOL+index*STRIDE+o]=0x12345678
+        m[POOL+index*STRIDE+532]=0;m[POOL+index*STRIDE+564]=0
+    return m
+
+def main():
+    q,raw,h,ins=source();rows=[]
+    for label,keep,now in [('single',[1],5000),('masked-clients',[6,7],5000),('pair',[1,8],0),('all-gated',[],5000),('all-basic-eligible',[1,6,7,8,63],0x7fffffff)]:
+        m=fixture(raw,h,ins,keep,now);_,r=construct(ins,m,POOL);r['label']=label;rows.append(r)
+    classname=raw[h['data_offset']+62908:].split(b'\0',1)[0].decode()
+    write_json(Path('docs/research/qvm-player-bb-construct.json'),{'source':q['source'],'sha256':q['sha256'],'classname':{'address':62908,'text':classname},'probes':rows,'limits':'Complete144494–144763 with actual277165/277125 and278138. Native registration/link captured, no engine debug rendering or expiry277400. Null allocation/error branches remain bounded by allocator contracts. Configuration gate34082500 and rendering/network meanings remain unverified.'})
+if __name__=='__main__':main()

scripts/test_qvm_player_bb_construct.py

@@ -0,0 +1,28 @@
+import json,unittest
+from pathlib import Path
+
+def expected(p,spawn):
+    r=dict(p['allocations'][spawn['allocation_index']]['record']);a=spawn['owner'];owner=a['record'];client=a['client_fields'];updates={536:62908,540:-135097346,644:p['time']+3000,596:p['time'],648:277400,588:0,460:0,4:10,512:owner['0'],516:a['pointer'],140:client['6204'],144:client['6256'],172:client['6176']-client['0'],184:client['700'],12:0,16:0,20:0,428:p['excluded_id']}
+    r.update({str(k):v&0xffffffff for k,v in updates.items()});r['424']|=256
+    for dst,src in [(24,24),(488,24),(36,36),(60,60)]:
+        for j in range(3):r[str(dst+4*j)]=owner[str(src+4*j)]
+    return r
+class PlayerBBConstructTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-player-bb-construct.json').read_text())
+    def test_independent_every_spawn_record(self):
+        for p in self.r['probes']:
+            for spawn in p['spawned']:self.assertEqual(spawn['final_record'],expected(p,spawn));self.assertEqual(p['links'][spawn['allocation_index']]['record_at_request'],spawn['final_record'])
+    def test_selector_has_fewer_gates_than_rewind(self):
+        for p in self.r['probes']:
+            eligible=[s['pointer'] for s in p['slots'] if s['client'] and s['used'] and s['state3096']<3 and s['pointer']!=p['excluded']];self.assertEqual([s['owner']['pointer'] for s in p['spawned']],eligible)
+        masked=next(p for p in self.r['probes'] if p['label']=='masked-clients');self.assertEqual([s['owner']['pointer'] for s in masked['spawned']],[34091368+6*880,34091368+7*880])
+    def test_actual_allocator_origin_link_order_and_count(self):
+        for p in self.r['probes']:
+            self.assertEqual([c['target'] for c in p['execution']['calls']],[277165,278138,-31]*len(p['spawned']));self.assertEqual(p['count'],64+len(p['spawned']))
+            for j,a in enumerate(p['allocations']):self.assertEqual(a['selected'],34091368+(64+j)*880);self.assertEqual([c['target'] for c in a['execution']['calls']],[-16,277125])
+    def test_position_setter_overwrites_trajectory_time_and_classname(self):
+        self.assertEqual(self.r['classname'],{'address':62908,'text':'player_bb'})
+        for p in self.r['probes']:
+            for s in p['spawned']:self.assertEqual(s['final_record']['16'],0);self.assertEqual(s['final_record']['644'],(p['time']+3000)&0xffffffff);self.assertEqual(s['final_record']['648'],277400)
+if __name__=='__main__':unittest.main()