qvm: recover capped random target selection

docs/FINDINGS.md

@@ -1571,3 +1571,6 @@ RE-813–822 replaces the scoreboard decimal assumption with actual37914 executi
 
 
 **RE-857:** Rust matches 150 original field searches and 256 comparator cases, preserving nullable ordering, signed high bytes, ASCII folding, embedded NUL and count gates. The API receives resolved logical fields with bounded entity/string sizes; raw pointer/offset ABI remains outside this safe contract. [Evidence](research/RUST_ENTITY_FIELD.md).
+
+
+**RE-858:** 168 original 276586 cases compose actual 276505/69386 matching and actual36717 random state updates. At most32 matches are collected; random state advances exactly once only when matches exist, then selects by modulo. Five six-step RNG sequences and null/missing diagnostic paths are verified. Native initialization/world ownership remain open. [Evidence](research/QVM_TARGET_PICK.md).

docs/PROVISIONAL_TODO.md

@@ -1593,3 +1593,6 @@ RE-856: 150 original 276505 searches and 256 actual 69386 comparisons recover cu
 
 
 RE-857: Rust matches 150 original field searches and 256 comparator cases, preserving nullable ordering, signed high bytes, ASCII folding, embedded NUL and count gates. The API receives resolved logical fields with bounded entity/string sizes; raw pointer/offset ABI remains outside this safe contract. Full runtime completion remains open. [Evidence](research/RUST_ENTITY_FIELD.md).
+
+
+RE-858: 168 original 276586 cases compose actual 276505/69386 matching and actual36717 random state updates. At most32 matches are collected; random state advances exactly once only when matches exist, then selects by modulo. Five six-step RNG sequences and null/missing diagnostic paths are verified. Native initialization/world ownership remain open. Full runtime completion remains open. [Evidence](research/QVM_TARGET_PICK.md).

docs/RESEARCH_LEDGER.md

@@ -1967,3 +1967,8 @@ Rust matches 80 original class-hash search cases, including inactive/null class
 ## 2026-10-27 — RE-857 Rust case-insensitive field search and signed-byte comparator
 
 Rust matches 150 original field searches and 256 comparator cases, preserving nullable ordering, signed high bytes, ASCII folding, embedded NUL and count gates. The API receives resolved logical fields with bounded entity/string sizes; raw pointer/offset ABI remains outside this safe contract. Focused `cargo xtask test-group rust-entity-field` passes (9 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.
+
+
+## 2026-10-27 — RE-858 Original target selection with actual field search and random generator
+
+168 original 276586 cases compose actual 276505/69386 matching and actual36717 random state updates. At most32 matches are collected; random state advances exactly once only when matches exist, then selects by modulo. Five six-step RNG sequences and null/missing diagnostic paths are verified. Native initialization/world ownership remain open. Focused `cargo xtask test-group target-pick` passes (5 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1630,3 +1630,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-857 Rust case-insensitive field search and signed-byte comparator ([evidence](research/RUST_ENTITY_FIELD.md)).
+
+
+- [x] RE-858 Original target selection with actual field search and random generator ([evidence](research/QVM_TARGET_PICK.md)).

docs/research/QVM_TARGET_PICK.md

@@ -0,0 +1,7 @@
+# Original target selection with actual field search and random generator
+
+RE-858. Reproduce with `python3 scripts/analyze_qvm_target_pick.py`; focused validation: `cargo xtask test-group target-pick`. [Machine report](qvm-target-pick.json).
+
+168 original 276586 cases compose actual 276505/69386 matching and actual36717 random state updates. At most32 matches are collected; random state advances exactly once only when matches exist, then selects by modulo. Five six-step RNG sequences and null/missing diagnostic paths are verified. Native initialization/world ownership remain open.
+
+Original executable/native runtime and complete Linux/macOS Rust/Bevy/Solari acceptance remain unverified.

docs/research/README.md

@@ -1167,3 +1167,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-857: Rust case-insensitive field search and signed-byte comparator](RUST_ENTITY_FIELD.md).
+
+
+[RE-858: Original target selection with actual field search and random generator](QVM_TARGET_PICK.md).

scripts/analyze_qvm_target_pick.py

@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+import itertools
+from pathlib import Path
+from qvm_research_support import source
+from qvm_camera_world_support import pick_target,random_word,string,POOL,S
+from analyze_qvm import write_json
+SEEDS=[0,1,0xffffffff,0x12345678]
+def entities(n,mixed):return [{'active':0 if mixed and j%3==1 else 1,'text':None if mixed and j%7==3 else b'NODE' if not mixed or j%2==0 else b'other'} for j in range(n)]
+def main():
+ q,raw,h,ins=source();rows=[];sequences=[]
+ for n,mixed,needle,seed in itertools.product([0,1,5,31,32,33,70],[False,True],[None,b'node',b'missing'],SEEDS):
+  c=entities(n,mixed);m={34992508:n,21044:seed};b={}
+  for j,e in enumerate(c):
+   m[POOL+880*j+532]=e['active'];m[POOL+880*j+608]=0 if e['text'] is None else S+j*256
+   if e['text'] is not None:string(m,b,S+j*256,e['text'])
+  if needle is not None:string(m,b,S+0x10000,needle)
+  m,value,p,b=pick_target(ins,m,{8:0 if needle is None else S+0x10000},b);p.update(input=dict(count=n,mixed=mixed,needle=None if needle is None else needle.hex(),seed=seed),result=-1 if value==0 else (value-POOL)//880,rng_state=m[21044]&0xffffffff);rows.append(p)
+ for seed in SEEDS+[0x80000000]:
+  m={21044:seed};values=[]
+  for _ in range(6):m,value,p,b=random_word(ins,m);values.append({'value':value,'state':m[21044]&0xffffffff})
+  sequences.append({'seed':seed,'steps':values})
+ write_json(Path('docs/research/qvm-target-pick.json'),{'source':q['source'],'sha256':q['sha256'],'probes':rows,'sequences':sequences,'limits':'Actual276586 with actual276505/69386 and36717 across168 cases plus5 six-step random sequences. First32 eligible matches cap, seed mutation and modulo selection verified.2294 diagnostics captured; native RNG initialization and live world ownership remain open.'})
+if __name__=='__main__':main()

scripts/qvm_camera_world_support.py

@@ -21,3 +21,15 @@ def find_field(ins,m,args,b=None,base=B+0x1000):
     def compare(i,m,a,bs):
         m,value,p,b=casecmp(i,m,a,bs);comparisons.append({'arguments':a,'result':value,'trace_sha256':p['execution']['trace_sha256']});return m,value,{'actual_source_child':69386}
     m,value,p,b=run(ins,m,276505,276584,28,args,b,{69386:compare},base=base);p['comparisons']=comparisons;return m,value,p,b
+
+def random_word(ins,m,args=None,b=None):return run(ins,m,36717,36777,32,args,b,base=B+0x6000)
+def pick_target(ins,m,args,b=None,base=B+0x3000):
+    searches=[];matches=[];diagnostics=[];random_calls=[]
+    def search(i,m,a,bs):
+        m,value,p,b=find_field(i,m,a,bs);searches.append({'after':a[8],'result':value,'comparisons':len(p['comparisons'])})
+        if value:matches.append((value-POOL)//880)
+        return m,value,{'actual_source_child':276505}
+    def rng(i,m,a,bs):
+        m,value,p,b=random_word(i,m,a,bs);random_calls.append({'value':value,'state':m[21044]&0xffffffff});return m,value,{'actual_source_child':36717}
+    def diagnostic(i,m,a,bs):diagnostics.append(a);return m,0,{'diagnostic_captured':True}
+    m,value,p,b=run(ins,m,276586,276686,164,args,b,{276505:search,36717:rng,2294:diagnostic},base=base);p.update(searches=searches,matches=matches,diagnostics=diagnostics,random_calls=random_calls);return m,value,p,b

scripts/test_qvm_target_pick.py

@@ -0,0 +1,21 @@
+import json,unittest
+from pathlib import Path
+from analyze_qvm_target_pick import entities
+from test_qvm_entity_field import compare
+
+def draw(seed):
+ seed=(seed^(seed<<5))&0xffffffff;seed=(seed^(seed<<21))&0xffffffff;seed=(seed^(seed>>27))&0xffffffff;return seed,seed&32767
+class PickTests(unittest.TestCase):
+ def test_independent_cap_selection_and_rng_consumption(self):
+  rows=json.loads(Path('docs/research/qvm-target-pick.json').read_text())['probes'];self.assertEqual(len(rows),168)
+  for p in rows:
+   a=p['input'];needle=None if a['needle'] is None else bytes.fromhex(a['needle']);c=entities(a['count'],a['mixed']);ids=[j for j,e in enumerate(c) if needle is not None and e['active'] and e['text'] is not None and compare(e['text'],needle)==0][:32];self.assertEqual(p['matches'],ids);state,value=draw(a['seed']) if ids else (a['seed'],0);self.assertEqual(p['rng_state'],state);self.assertEqual(p['result'],ids[value%len(ids)] if ids else -1);self.assertEqual(len(p['random_calls']),int(bool(ids)))
+ def test_sequences_diagnostics_and_write_scope(self):
+  r=json.loads(Path('docs/research/qvm-target-pick.json').read_text());self.assertEqual(len(r['sequences']),5)
+  for p in r['sequences']:
+   state=p['seed']
+   for s in p['steps']:state,value=draw(state);self.assertEqual(s,{'state':state,'value':value})
+  for p in r['probes']:
+   self.assertTrue(all(w['address']==21044 for w in p['changes']));self.assertEqual(len(p['diagnostics']),int(not p['matches']))
+   if p['diagnostics']:self.assertEqual(p['diagnostics'][0]['8'],97367 if p['input']['needle'] is None else 97332)
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -2370,3 +2370,7 @@ report	scripts/analyze_rust_entity_field.py	docs/research/rust-entity-field.json
 edge	docs/research/rust-entity-field.json	scripts/test_rust_entity_field.py
 group	rust-entity-field	scripts/analyze_rust_entity_field.py
 edge	scripts/analyze_rust_entity_field.py	scripts/analyze_qvm_resumer_audit.py
+report	scripts/analyze_qvm_target_pick.py	docs/research/qvm-target-pick.json
+edge	docs/research/qvm-target-pick.json	scripts/test_qvm_target_pick.py
+group	target-pick	scripts/analyze_qvm_target_pick.py
+edge	scripts/analyze_qvm_target_pick.py	scripts/analyze_qvm_resumer_audit.py