qvm: audit water and gait resumption

docs/ASSET_PIPELINE_TODO.md

@@ -1012,3 +1012,6 @@ Research progress: RE-785 [report](research/QVM_AWARD_REENTRY.md); original asse
 
 
 Research progress: RE-786 [report](research/QVM_COUNTER_REENTRY.md); original assets unchanged.
+
+
+Research progress: RE-787 [report](research/QVM_MOVEMENT_REENTRY.md); original assets unchanged.

docs/FINDINGS.md

@@ -1358,3 +1358,6 @@ RE-725–734 batch: [health, contact and Rust impulse findings](research/QVM_HEA
 
 
 **RE-786 — Audited method counters team pairs and dense record clearing:** 278834,279720 and285486 now use corrected reentry; independent counter/alias/address oracles and full legacy tuple comparisons cover160 expanded fixtures. [Evidence](research/QVM_COUNTER_REENTRY.md).
+
+
+**RE-787 — Audited water-entry dynamic returns and locomotion source consumers:** 41486 and selected47884 prefix/ground paths use corrected movement execution, with full returned-memory differential checks and independent water/gait/event expectations. [Evidence](research/QVM_MOVEMENT_REENTRY.md).

docs/PROVISIONAL_TODO.md

@@ -1359,3 +1359,6 @@ Research progress: RE-785 [report](research/QVM_AWARD_REENTRY.md); full native/p
 
 
 Research progress: RE-786 [report](research/QVM_COUNTER_REENTRY.md); full native/platform/game scope remains open.
+
+
+Research progress: RE-787 [report](research/QVM_MOVEMENT_REENTRY.md); full native/platform/game scope remains open.

docs/RESEARCH_LEDGER.md

@@ -1592,3 +1592,8 @@ The movement resumer also loses non-command STORE1 writes across calls in legacy
 ## 2026-10-21 — RE-786 Audited method counters team pairs and dense record clearing
 
 278834,279720 and285486 now use corrected reentry; independent counter/alias/address oracles and full legacy tuple comparisons cover160 expanded fixtures. Focused `cargo xtask test-group counter-reentry` passes (34 Python tests); selected reports regenerate twice byte-identically, with storage, links and whitespace guards. New report: 200891 bytes. Full-suite validation is deferred to the tenth batch commit. Three bounded source helpers migrated; independent numeric/address expectations and existing source/Rust regressions check their contracts.
+
+
+## 2026-10-21 — RE-787 Audited water-entry dynamic returns and locomotion source consumers
+
+41486 and selected47884 prefix/ground paths use corrected movement execution, with full returned-memory differential checks and independent water/gait/event expectations. Focused `cargo xtask test-group movement-reentry` passes (65 Python tests); selected reports regenerate twice byte-identically, with storage, links and whitespace guards. New report: 413676 bytes. Full-suite validation is deferred to the tenth batch commit. Selected movement producers migrated; the shared execute default remains legacy during the wider audit.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1408,3 +1408,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-786 Audited method counters team pairs and dense record clearing ([report](research/QVM_COUNTER_REENTRY.md)).
+
+
+- [x] RE-787 Audited water-entry dynamic returns and locomotion source consumers ([report](research/QVM_MOVEMENT_REENTRY.md)).

docs/research/QVM_MOVEMENT_REENTRY.md

@@ -0,0 +1,7 @@
+# Audited water-entry dynamic returns and locomotion source consumers
+
+RE-787. Reproduce with `python3 scripts/analyze_qvm_movement_reentry.py`; validate with `cargo xtask test-group movement-reentry`. See the [machine report](qvm-movement-reentry.json).
+
+The42 source audit fixtures cover both dynamic contents queries, water launch gates and grounded stance/gait/event combinations. The full existing36 water and120 locomotion report cases, prefix consumers and dependent reports are regenerated and checked through xtask. Both reviewed dynamic result offsets preserve the contents pointer. Supplied native contents and modeled square roots remain explicit. Other movement consumers and arbitrary callback byte effects are still open.
+
+No original executable/full VM/native world collision or rendering runs. Supplied callback/native responses and fixture domains remain explicit; complete macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/README.md

@@ -948,3 +948,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-786: Audited method counters team pairs and dense record clearing](QVM_COUNTER_REENTRY.md).
+
+
+[RE-787: Audited water-entry dynamic returns and locomotion source consumers](QVM_MOVEMENT_REENTRY.md).

docs/research/qvm-resumer-audit.json

@@ -2469,7 +2469,7 @@
         48714
       ],
       "path": "scripts/analyze_qvm_locomotion.py",
-      "repeated_calls_opt_in": false
+      "repeated_calls_opt_in": true
     },
     {
       "backward_conditional_branches": [],
@@ -2742,7 +2742,7 @@
         48714
       ],
       "path": "scripts/analyze_qvm_locomotion_prefix.py",
-      "repeated_calls_opt_in": false
+      "repeated_calls_opt_in": true
     },
     {
       "backward_conditional_branches": [],
@@ -6258,7 +6258,7 @@
         41766
       ],
       "path": "scripts/analyze_qvm_water_entry.py",
-      "repeated_calls_opt_in": false
+      "repeated_calls_opt_in": true
     },
     {
       "backward_conditional_branches": [],
@@ -8920,7 +8920,7 @@
   "summary": {
     "call_expressions": 179,
     "files": 140,
-    "legacy_expressions": 166,
+    "legacy_expressions": 163,
     "nonliteral_ranges": 20
   }
 }

scripts/analyze_qvm_locomotion.py

@@ -10,7 +10,7 @@ from analyze_qvm import write_json
 
 def locomotion(ins,m,cmd=(0,0,0)):
     surface=m[35023988];m,p=locomotion_prefix(ins,m,cmd);prefix=p.pop('execution');after=state(m);tail=None
-    if prefix['stop']==48209:m,c,tail=execute(ins,48209,48714,m,cmd,LOCAL,handlers())
+    if prefix['stop']==48209:m,c,tail=execute(ins,48209,48714,m,cmd,LOCAL,handlers(),repeated_calls=True)
     return m,{**p,'surface':surface,'prefix_execution':prefix,'after_prefix':after,'ground_execution':tail,'final':state(m)}
 
 def main():

scripts/analyze_qvm_locomotion_prefix.py

@@ -11,7 +11,7 @@ LOCAL=0x71000000
 
 def locomotion_prefix(ins,m,cmd=(0,0,0)):
     before=state(m);velocity=vec(m,PS+32);ps216=m[PS+216];cfg=weapon_words(m,before['packed']&255)
-    m,c,r=execute(ins,47885,48714,m,cmd,LOCAL,handlers(),boundaries=[48209])
+    m,c,r=execute(ins,47885,48714,m,cmd,LOCAL,handlers(),boundaries=[48209],repeated_calls=True)
     return m,{'initial':before,'commands':list(cmd),'buttons':m[FRAME+20],'level':m[FRAME+212],'dt':m[35023932],'kind':m[PS+4],'velocity':velocity,'config':cfg,'ps216_before':ps216,'ps216_after':m[PS+216],'execution':r,'final':state(m)}
 
 def main():

scripts/analyze_qvm_movement_reentry.py

@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+"""Selected movement source consumers with full returned-memory differential checks."""
+from contextlib import ExitStack
+from unittest.mock import patch
+import itertools
+from pathlib import Path
+import analyze_qvm_water_entry as water
+import analyze_qvm_locomotion as gait
+import analyze_qvm_locomotion_prefix as prefix
+from qvm_research_support import source,memory
+from analyze_qvm_acceleration import PS,FRAME,word
+from qvm_suffix_support import seed,weapon_config
+from analyze_qvm import write_json
+
+def compare(invoke):
+    def old_call(fn):
+        def call(*a,**kw):kw['repeated_calls']=False;return fn(*a,**kw)
+        return call
+    with ExitStack() as stack:
+        for module in [water,gait,prefix]:stack.enter_context(patch.object(module,'execute',old_call(module.execute)))
+        old=invoke()
+    new=invoke();return new,old==new
+
+def main():
+    q,raw,h,ins=source();waters=[];gaits=[]
+    for timer,level,samples in itertools.product([0,1],[1,2,3],[(0,0),(1,0),(3,8)]):
+        def invoke():
+            m=memory(raw,h);m.update({PS+16:timer,FRAME+212:level,FRAME+228:-26})
+            for j,v in enumerate([3,4,9]):m[35023892+4*j]=word(v)
+            return water.water_entry(ins,m,samples=samples)
+        new,equal=compare(invoke);waters.append({'legacy_equal':equal,'probe':new[1]})
+    for flags,buttons,level in itertools.product([0,1,16384,16385],[0,16,256],[0,2]):
+        def invoke():
+            cmd=(127,0,0);m=weapon_config(seed(raw,h,cmd),raw,h);m.update({PS+312:22,PS+68:8,PS+12:flags,FRAME+20:buttons,PS+220:128,FRAME+212:level,PS+8:60,35023932:16});return gait.locomotion(ins,m,cmd)
+        new,equal=compare(invoke);gaits.append({'legacy_equal':equal,'probe':new[1]})
+    write_json(Path('docs/research/qvm-movement-reentry.json'),{'source':q['source'],'sha256':q['sha256'],'water':waters,'gaits':gaits,'limits':'Corrected41486 and selected47884 prefix/ground consumers. Full returned memory/effect equality on18 water and24 gait fixtures. Actual recovered animation/event children, supplied contents and modeled sqrt; no native world physics/animation playback. Other execute consumers remain unaudited.'})
+if __name__=='__main__':main()

scripts/analyze_qvm_water_entry.py

@@ -15,7 +15,7 @@ def water_entry(ins,m,cmd=(0,0,0),samples=(1,0)):
     initial=snapshot(m);level=m[FRAME+212];basis=vec(m,35023892);queries=[]
     def contents(i,m,a,c):
         value=samples[len(queries)];r={'point':vec(m,a[8]),'entity':a[12],'value':value};queries.append(r);return m,c,value,r
-    m,cmd,r=execute(ins,41487,41766,m,cmd,LOCAL,{-26:contents},{41650:52,41691:60})
+    m,cmd,r=execute(ins,41487,41766,m,cmd,LOCAL,{-26:contents},{41650:52,41691:60},repeated_calls=True)
     return m,{'initial':initial,'level':level,'basis':basis,'samples':list(samples),'queries':queries,'return_word':r['return'],'execution':r,'final':snapshot(m)}
 
 

scripts/test_qvm_movement_reentry.py

@@ -0,0 +1,23 @@
+import json,copy,unittest
+from pathlib import Path
+from test_qvm_ground import word,n,f
+from test_qvm_locomotion import locomotion_state
+class MovementReentryTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-movement-reentry.json').read_text())
+    def test_water_launch_state_and_full_memory_compatibility(self):
+        self.assertEqual(len(self.r['water']),18)
+        for row in self.r['water']:
+            p=row['probe'];entered=p['initial']['timer']==0 and p['level']==2 and p['samples'][0]&1 and p['samples'][1]==0;out=copy.deepcopy(p['initial'])
+            if entered:out['velocity']=[word(f(n(v)*200)) for v in p['basis'][:2]]+[word(350)];out['flags']|=128;out['timer']=2000
+            self.assertEqual(p['final'],out);self.assertEqual(p['return_word'],int(bool(entered)));self.assertTrue(row['legacy_equal'])
+    def test_gait_state_event_order_and_memory_compatibility(self):
+        self.assertEqual(len(self.r['gaits']),24)
+        for row in self.r['gaits']:
+            p=row['probe'];state,requests=locomotion_state(p);self.assertEqual(p['final'],state);calls=p['prefix_execution']['calls']+(p['ground_execution']['calls'] if p['ground_execution'] else []);self.assertEqual([(c['target'],None if c['target']==45887 else c['args']['8']) for c in calls if c['target']!=-107],requests);self.assertTrue(row['legacy_equal'])
+    def test_dynamic_contents_pointer_and_query_paths(self):
+        ps=[r['probe'] for r in self.r['water']];self.assertEqual({len(p['queries']) for p in ps},{0,1,2})
+        for p in ps:
+            for c in p['execution']['calls']:
+                if c['instruction'] in [41650,41691]:self.assertEqual(c['target'],-26)
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -1751,3 +1751,13 @@ report	scripts/analyze_qvm_counter_reentry.py	docs/research/qvm-counter-reentry.
 edge	docs/research/qvm-counter-reentry.json	scripts/test_qvm_counter_reentry.py
 edge	scripts/analyze_qvm_counter_reentry.py	scripts/analyze_qvm_resumer_audit.py
 group	counter-reentry	scripts/analyze_qvm_counter_reentry.py
+
+group	movement-reentry	scripts/analyze_qvm_water_entry.py
+
+group	movement-reentry	scripts/analyze_qvm_locomotion_prefix.py
+
+group	movement-reentry	scripts/analyze_qvm_locomotion.py
+report	scripts/analyze_qvm_movement_reentry.py	docs/research/qvm-movement-reentry.json
+edge	docs/research/qvm-movement-reentry.json	scripts/test_qvm_movement_reentry.py
+edge	scripts/analyze_qvm_movement_reentry.py	scripts/analyze_qvm_resumer_audit.py
+group	movement-reentry	scripts/analyze_qvm_movement_reentry.py