# Raw float transport and finite angle codecs

Reproduce with `python3 scripts/analyze_message_numeric.py`; validate with `python3 scripts/test_message_numeric.py`. [message-numeric.json](message-numeric.json) retains fourteen source/disassembly-hash-verified graphs across the Linux ELF64 dedicated/client engines, 48 float OOB compositions, 360 supplied float-reader tails, sixty finite angle-writer compositions and 210 supplied angle16-reader tails. Thirty of the angle-writer compositions also decode their exact OOB output through ReadBits and ReadAngle16 instructions. Four file-backed numeric constants per engine retain addresses, offsets and exact bytes.

Original processes and native callees never execute. These are synthetic instruction compositions with explicit virtual memory/frames, stopped CALL/tail-jump boundaries and caller-register retention. Frame saves/restores and PUSH/POP are omitted/stopped. Supplied reader-tail return/count probes are separate from actual OOB writer/reader compositions. Float transport uses raw moves without numeric arithmetic. Angle arithmetic is restricted to finite in-range inputs and modeled ordinary scalar rounding; MXCSR, FTZ/DAZ, exceptions, nonfinite/out-of-range conversion and CPU/platform/runtime equivalence remain open. No compressed/full-packet conformance is established.

## NUM-001 — Float word transport and post-read EOF (RE-381)

MSG_WriteFloat moves the supplied low scalar word into a stack slot, reloads it as an integer and tail-forwards MSG_WriteBits(message, word, 32). It does not numerically convert the float to an integer. The recovered instruction slice therefore transports the raw 32-bit payload word.

The sampled words include positive/negative zero, ordinary finite values, the largest finite binary32 word, a subnormal word, infinity words and multiple NaN payload words. Only move/store/load instructions operate on these words. This is synthetic raw-bit transport evidence, not execution of nonfinite floating arithmetic or a complete hardware NaN contract.

Each engine has 24 OOB compositions: twelve raw words at capacities three/64. Ample capacity writes four little-endian bytes; the actual OOB reader consumes the same word and the Float reader tail returns its low scalar bits unchanged. Guarded capacity three sets writer overflow and emits nothing. The explicitly padded backing bytes remain 0xa5; the underlying OOB reader still advances readcount four and bit thirty-two, then ReadFloat substitutes the constant word 0xbf800000 (-1.0) because readcount exceeds cursize.

Another 180 tail probes per engine supply twelve raw words, size words zero/four/0xffffffff and post-read count words zero/four/five/0x80000000/0xffffffff. The native signed comparison returns the supplied float bits when post-read count <= size; otherwise it returns 0xbf800000. A valid -1.0 payload shares the EOF fallback bits. Caller interpretation, legal wrapping cursors, access safety and compressed reads remain open.

## NUM-002 — Finite angle writers (RE-382)

The recovered file-backed binary32 scales are:

| Writer | Scale bytes (little-endian) | Nominal expression |
| --- | --- | --- |
| MSG_WriteAngle | 610b363f | binary32(256 / 360) |
| MSG_WriteAngle16 | 610b3643 | binary32(65536 / 360) |

Each writer multiplies the supplied binary32 angle by its scale, converts the resulting scalar to a signed integer by truncation toward zero, masks that integer to eight/sixteen bits, and tail-forwards positive width eight/sixteen to WriteBits. The native scale is the rounded binary32 constant; the product is also modeled with binary32 rounding before truncation. Integer masking gives wrap behavior after conversion. It does not establish arbitrary input normalization or valid caller angle ranges.

Thirty finite writer fixtures per engine cover both widths, positive/negative zero, positive/negative one, ±45.125, ±90, 180, 270, 359.9, ±360, 720 and 65535 degrees. All scaled values are within the modeled signed conversion range. Independent struct-based float rounding and truncation oracles verify the intermediate scalar word, forwarded integer/width, little-endian OOB payload, size and bit cursor.

Examples: 90 maps to byte 64/short 16384; -90 maps to byte 192/short 49152; 180 maps to byte 128/short 32768; ±360 and 720 mask to zero in these fixtures. Nonfinite, conversion overflow, altered rounding modes, denormal handling and actual angle caller quantization remain unverified.

The parsed function sets contain MSG_WriteAngle but no MSG_ReadAngle symbol. This does not establish that eight-bit angle decoding is absent from inlined code, other binaries or platforms.

## NUM-003 — Signed angle16 reads and fallback (RE-383)

MSG_ReadAngle16 requests positive width sixteen, then performs a signed post-read count/size check. Accepted reads sign extend the low sixteen-bit word, convert that integer to scalar binary64, multiply by the file-backed binary64 constant 360/65536, and convert the result to binary32. The multiplier bytes are 000000000080763f. This maps the accepted local domain to [-180, 180), with the high half of unsigned sixteen-bit input represented as negative angles.

For example, 0x4000 returns +90; 0x8000 returns -180; 0xc000 returns -90; 0xffff returns -0.0054931640625. A failed post-read size check returns a file-backed binary32 constant directly: bytes 0000b4bb, also -0.0054931640625. This EOF fallback is therefore the same angle word as a valid signed short -1; it is not the float reader's -1.0 fallback. Caller sentinel handling remains open.

Each image has 105 supplied-tail probes across seven low/full input words, three size words and five count words, including signed-negative count/size boundaries. Every sampled finite WriteAngle16 OOB output is also read through actual ReadBits instructions and the angle16 tail, verifying the signed decoded domain and exact read count/bit updates. These are quantized results, not exact restoration of arbitrary input degrees.

The shared restricted evaluator adds DX, finite in-range CVTTSS2SI, signed-int32 CVTSI2SD, finite low-scalar MULSD and CVTSD2SS support. A dedicated independent fixture verifies register/memory conversion and truncation; NaN, infinity and out-of-range float-to-int inputs fail closed. Other double/vector lanes and machine floating control state remain unsupported/unmodeled.

## Validation and next work

Eight independent tests verify raw float words/OOB payloads, float signed EOF tails, exact file-backed constants, finite angle scale/round/truncate/mask, signed angle16 decoding/fallback, angle16 OOB compositions, paired engine outcomes and the restricted evaluator extension. The report retains compact composed instruction trace hashes.

RE-384: recover delta/key/float/usercmd/entity/player/snapshot codecs and angle callers/inlined byte-angle decoding; validate compressed numeric wrappers, nonfinite/out-of-range/MXCSR/FTZ/DAZ conversion behavior, caller sentinel/lifecycle/truncation/cursor contracts, native seeded codewords and actual packet/runtime/all-platform/renderer conformance.

Follow-up: [scalar message deltas](MESSAGE_DELTA.md) recovers bounded integer and finite float change flags and modeled-tree compressed compositions. Broader RE-384 remains open; RE-388 tracks keyed/higher-level and complete packet/platform contracts.