# Server firing research batch: RE-593–602

Ten separately committed tasks follow the [firing producer batch](QVM_FIRING_BATCH.md) into server-side event consumption, firing basis/muzzle preparation and selected handler setup. Recovered QVM effects are distinguished from supplied allocator/query replies, captured native requests and suspended opaque children.

| Task | Recovered scope | Evidence |
| --- | --- | --- |
| RE-593 |151254 two-slot event window and recognized-consumer routing | [Event route](QVM_SERVER_EVENT_ROUTE.md) |
| RE-594 | Actual31 publication→server prelude and pending289235 ABI | [Firing event](QVM_SERVER_FIRE_EVENT.md) |
| RE-595 |289235 suppression/statistic and finite angle basis before muzzle | [Basis](QVM_SERVER_FIRE_BASIS.md) |
| RE-596 | Complete288779/288871 muzzle helpers and actual firing caller | [Muzzle](QVM_SERVER_MUZZLE.md) |
| RE-597 | Entity weapon dispatch table and pending handler sequences | [Dispatcher](QVM_SERVER_FIRE_DISPATCH.md) |
| RE-598 |277695 tempEntity/278138 position setup with explicit engine boundaries | [Temporary event](QVM_TEMP_EVENT.md) |
| RE-599 |285840 event57, quantized direction and actual36717 PRNG before295018 | [Shot setup](QVM_SERVER_SHOT_SETUP.md) |
| RE-600 |285971 grenade descriptor, launch quantization and inherited velocity | [Grenade setup](QVM_GRENADE_SETUP.md) |
| RE-601 |288903 mode/base/range/ground gates before allocation | [Base gate](QVM_BASE_FIRE_GATE.md) |
| RE-602 | Published31→server→selected setup, with event-loop resume only on recovered returns | [Server chain](QVM_SERVER_FIRE_CHAIN.md) |

## Findings for the Rust port

- The server consumes only the latest two events from an ordinary signed sequence window. Event31 first writes client4140=0 and4328=1, then calls289235(entity); its prelude does not read the event parameter.
- Client6164 suppresses the firing function before statistic or basis effects. Otherwise client4116 increments unless entity weaponID1, including IDs subsequently rejected by dispatch.
- Forward/right/up are derived from client angles with native sin/cos requests. Finite ordinary-math float32 responses model those natives here; platform libm/reference bit parity is unverified.
- The muzzle uses entity+24 plus viewheight and14×forward. It does not use entity+488 or PS origin, normalize the vector, trace or snap. The alternate helper omits14×forward.
- Dispatch uses entity+192, independent of the selected packed slot. The initialized table has direct returns for12/18, an18-ID shared293732 handler and distinct handlers for the remaining groups. This is not proof that IDs12/18 never fire elsewhere.
- tempEntity construction truncates coordinates before its actual position setter, issues a link request, then returns the allocation pointer. The selected285840 caller patches quantized direction, seed, shooter and weapon fields after that link request.
- Actual36717 mutates a32-bit seed using xor shifts5/21/27 and returns low15 bits;285840 stores low8 before pending295018 shot processing.
- The file-named grenade constructor biases forwardZ by.2, normalizes, scales by a mode speed, truncates, then adds owner velocity and matching-ground velocity. Its descriptor is constructed, not simulated through physics/explosion/damage.
- The base-dependent handler requires mode8/active!=1 and two type18 bases. Both farther than64 or ground1023 reject; otherwise the nearer point is chosen, with ties selecting the second. Invalid cardinalities stop at the source assumptions/error boundary rather than inventing valid pointers.

## Integration and limits

RE-602 has twelve source-order chains. It resumes the actual event-loop continuation after suppressed firing, table returns, the bounded grenade constructor and recovered base-handler returns. It stays suspended at295018, base allocation277165 or other opaque handlers. Three publications demonstrate the two-event retained window and actual re-entry for returning paths. Full record, vector, queue and field handoffs have independent oracles.

Allocation277165 and world-query276433 replies are explicitly supplied; native link−31 is captured without engine effects. These contracts permit finite QVM data-flow checks, not a claim that an entity was actually allocated, linked, collided or damaged. A complete bounded constructor return is not a successful gameplay action. Other native/game callbacks and legal input domains remain open.

The879-test baseline gains40 independent checks. Reports regenerate deterministically and stay below the2MiB normal-Git cap. No original assets enter these commits; normal code/docs and filtered assets remain separated. No original executable/native library, full VM, native physics/rendering or macOS/Linux Rust runtime executes.

## Next ten concrete tasks

1. Partition shared handler293732 by call/return boundaries; decode its weapon-slot/configuration inputs and every unresolved child.
2. Recover295018's direction/seed/spread setup and first trace requests, retaining exact finite arithmetic and table provenance.
3. Follow reached trace/contact/material consumers into damage211239 only after their actual contracts are recovered; do not assume a hit from a supplied trace.
4. Recover allocator277165 and record initializer277125, including free-slot reuse, timing, capacity and failure/error paths.
5. Recover query276433 and native link−31 contracts so grenade/base construction can be tested against an actual entity list/world.
6. Recover grenade callback223156, trajectory integration, contact/bounce, expiry and reached explosion/damage paths.
7. Continue288903 after allocator289113 through its temp_bomb descriptor, linking, state and round callbacks, preserving the two-base assumptions.
8. Recover remaining dispatcher handlers298842/293732/294171/286473/287330 and event consumers21/12/14/15/49/50/87, with explicit asset/animation/audio mappings.
9. Complete native vector snap and movement/scheduler composition, then capture original reference execution and legal multi-step event/weapon outcomes.
10. Continue the native/DLL/network/rendering/content inventory and first Rust/Bevy/Solari gameplay slice on macOS/Linux with measured parity. Bounded server data flow is not whole-game completion.


Follow-up: the [RE-604–613 allocation/spread batch](QVM_ALLOCATION_SPREAD_BATCH.md) recovers277165/277125 and constructor compositions, plus parts of293732/295018. Earlier supplied-pointer reports remain historical bounded contracts. Use the newer batch for current next tasks.