# Binary reverse engineering: first static analysis pass

Analysis date: **2026-10-11**. Reference: Urban Terror 4.3.4, with source hashes from [the installation snapshot](../inventory/snapshot.json) and [extraction manifests](../extraction/README.md). No original executable, library or recovered native code was launched. No complete QVM module was run; the deferred-auth follow-up evaluates selected decoded instructions with synthetic memory and records calls without entering callees.

This pass decodes every supplied QVM and inventories/disassembles all eight native images. It recovers entry-command jump tables and selected native syscall tables, while retaining unknown calls, ambiguous strings and unreviewed function bodies. It does not establish gameplay parity or a complete engine ABI.

Read [QVM findings and ABI candidates](qvm/README.md), [native images, libraries and DLL dependencies](native/README.md), and [the remaining task list](../REVERSE_ENGINEERING_TODO.md). Generated reports contain source hashes and addresses. Large derived evidence belongs under `assets/analysis/` and uses the existing Xet filters; originals stay only in `.cache/`.

The [extension follow-up](VM_EXTENSIONS.md) traces all four extra game/UI entry commands and five network/auth syscall numbers through QVM callers and the Linux ELF64 engines. Its [focused generated report](vm-extensions.json) preserves selected function bodies and instruction evidence; descriptive roles and partial signatures are distinguished from unresolved behavior.

The [native metadata follow-up](native/METADATA.md) recovers SDL/client debug-map ranges and all supplied Windows resource leaves, reconstructs the icon group and records unclassified icon surplus.

[Byte reconciliation](native/COVERAGE.md) now explains the SDL text gaps and entire Windows resource region; [authentication drop analysis](AUTH_DROP.md) traces parameter meanings, invalid-index returns and QVM state branches.

[Deferred authentication analysis](DEFERRED_AUTH.md) traces message-copy/error services and the sentinel/timestamp state branches, with bounded synthetic-memory instruction checks distinct from runtime conformance.

[Engine control findings](ENGINE_CONTROL.md) link native simulation timing, frame-abort/process-exit paths and the QVM authentication announcement gate to address-keyed instruction graphs.

## Reproduce

From the repository root, with the verified source installation and extracted assets present:

```sh
python3 scripts/analyze_binaries.py
python3 scripts/test_binary_analysis.py
python3 scripts/test_vm_extensions.py
python3 scripts/test_native_metadata.py
python3 scripts/test_native_followup.py
python3 scripts/test_deferred_auth.py
python3 scripts/test_engine_control.py
python3 scripts/test_frame_timing.py
python3 scripts/test_event_queues.py
python3 scripts/test_auth_announcements.py
python3 scripts/test_game_cvars.py
python3 scripts/test_cvar_changes.py
python3 scripts/test_auth_queries.py
python3 scripts/test_selector_bounds.py
python3 scripts/test_chat_paths.py
python3 scripts/test_chat_delivery.py
python3 scripts/test_chat_expansion.py
python3 scripts/test_chat_items_time.py
python3 scripts/test_chat_locations.py
python3 scripts/test_chat_crosshair.py
python3 scripts/test_native_spatial.py
python3 scripts/test_native_collision.py
python3 scripts/test_collision_composition.py
python3 scripts/storage_policy.py check --require-setup
```

The pipeline runs `fetch_analysis_references.py`, `analyze_qvm.py`, `analyze_native.py`, `analyze_vm_abi.py`, `analyze_native_dispatch.py`, `analyze_vm_extensions.py`, `analyze_native_metadata.py`, `analyze_native_coverage.py`, `analyze_auth_drop.py`, `analyze_deferred_auth.py`, `analyze_engine_control.py`, `analyze_frame_timing.py`, `analyze_event_queues.py`, `analyze_auth_announcements.py`, `analyze_game_cvars.py`, `analyze_cvar_changes.py`, `analyze_auth_queries.py`, `analyze_selector_bounds.py`, `analyze_chat_paths.py`, `analyze_chat_delivery.py`, `analyze_chat_expansion.py`, `analyze_chat_items_time.py`, `analyze_chat_locations.py`, `analyze_chat_crosshair.py`, `analyze_native_spatial.py`, `analyze_native_collision.py`, and `analyze_collision_composition.py` in that order. Python 3.9+ and **LLVM objdump** with x86 ELF/COFF/Mach-O support are required. This pass used Apple LLVM 17.0.0 on macOS arm64; it disassembled x86 images without running them. Upstream references are downloaded only if absent, checked against the committed SHA-256 manifest, and cached under `.cache/research/upstream/`. A clone also needs `git lfs pull` to obtain the derived artifacts/extracted members.

Generated JSON/JSONL and compressed evidence are regenerated in place; keep prose notes in Markdown. Rerunning the four analysis stages reproduced every generated report and gzip artifact byte-for-byte on the same toolchain. gzip timestamps and stored filenames are fixed. Different objdump versions can produce different disassembly text, so tool version and uncompressed evidence hashes are recorded. Reports are UTF-8 normal Git text, with individual files below the storage policy's 2 MiB limit.

## Evidence and confidence

| Evidence | Meaning | Does not establish |
| --- | --- | --- |
| QVM structural validation and exact byte reconstruction | All 659,048 encoded instructions were decoded with correct boundaries | Execution equivalence, complete dataflow or gameplay meaning |
| `ENTER` records | 3,037 candidate entries with linear partition bounds | Complete function recovery or reachability |
| Adjacent constant calls/string addresses | Searchable local reference candidates | All possible targets, arguments, or uses |
| Bounded entry-prologue evaluation | Dispatch destinations for the observed command ranges | Command-body semantics or names of engine extensions |
| Native section/import/symbol metadata and LLVM disassembly | Static code/data/dependency evidence for every supplied image | Runtime loader behavior, exact upstream correspondence or dead-code classification |
| Native x86_64 ELF switch tables | Address-keyed dispatch evidence for four native syscall dispatchers | Full signatures or equivalent behavior on other platforms |

Eighteen new tests cover malformed QVM/native structures, signed syscall operands, instruction indices versus offsets, strings, branch ambiguity, PE imports and address bases, all shipped native dependencies, every supplied QVM's byte reconstruction/entry dispatch, and real native switch targets. Existing extraction/storage tests remain applicable. The test fixture source paths require the ignored original installation; failure on a clone lacking that installation is expected and explicit.

## Completion record

RE-041 is complete for the supplied three modules: decoder, full address-keyed instruction evidence, source-table correspondence, fixture tests and exact code reconstruction exist. RE-002's member-hash/provenance deliverable was already completed by extraction and is now linked in the checklist. Other binary/gameplay research tasks remain unchecked where only a portion is addressed. No FILE item is fully reverse engineered.

Next work should complete the extra game/UI entry command specifications and packet grammar, finish the 519 unresolved call sites and computed branches, recover syscall argument structures across platforms, decode SDL STABS and Windows resources, then follow QVM gameplay functions into movement/weapon/entity specifications and deterministic runtime fixtures.

The extension collector adds five focused tests for native tail calls, command-register clobbers and intervening control transfers, fail-closed source identities/function boundaries, and shipped command/service connections. RE-211–213 record completed static milestones; RE-205/206 remain open for full behavior and platform coverage.

[Frame elapsed, event sources and pause gates](FRAME_TIMING.md) adds RE-232–234, ten Linux ELF64 graphs and 64 bounded native instruction traces. Reproduce with `python3 scripts/analyze_frame_timing.py`; check with `python3 scripts/test_frame_timing.py`. Original-runtime and all-platform scheduling remain open.

[Native address types, event queues and journals](EVENT_QUEUES.md) adds RE-237–239: the pause-field address/bot chain, two queue policies, clock-query event preservation and a bounded Linux ELF64 journal inspector. Reproduce with `python3 scripts/analyze_event_queues.py`; check with `python3 scripts/test_event_queues.py`.

[Authentication announcement tables and recipients](AUTH_ANNOUNCEMENTS.md) adds RE-241–243: signed status/role labels, bounded mode/recipient fixtures, Linux command-boundary evidence and direct flag references. Reproduce with `python3 scripts/analyze_auth_announcements.py`; check with `python3 scripts/test_auth_announcements.py`.

[Main game cvars and announcement callers](GAME_CVARS.md) adds RE-245–247: all 126 main registry rows, native cvar mirror evidence and direct output-caller paths. Reproduce with `python3 scripts/analyze_game_cvars.py`; check with `python3 scripts/test_game_cvars.py`.

[Cvar changes, limits and extra registrations](CVAR_CHANGES.md) adds RE-249–251: row-word/cache behavior, four setting correction paths, 28 direct registration sites and 23 exact constant argument traces. Reproduce with `python3 scripts/analyze_cvar_changes.py`; check with `python3 scripts/test_cvar_changes.py`.

[Authentication selectors, command policy and internal mode](AUTH_QUERIES.md) adds RE-253–255: slot/name helper evidence, role routing and query dispatch, and internal-mode assignment/disable paths. Reproduce with `python3 scripts/analyze_auth_queries.py`; check with `python3 scripts/test_auth_queries.py`.

[Selector conversion, storage and entry routes](SELECTOR_BOUNDS.md) adds RE-257–259: integer overflow/slot compositions, copy/match/count bounds and native/QVM/chat dispatcher connections. Reproduce with `python3 scripts/analyze_selector_bounds.py`; check with `python3 scripts/test_selector_bounds.py`.

[Native command admission and chat paths](CHAT_PATHS.md) adds RE-261–263: native tables/filter evidence, bounded concatenation capacity and recipient front gates. It also corrects the preceding chat third-argument/channel-mode mapping. Reproduce with `python3 scripts/analyze_chat_paths.py`; check with `python3 scripts/test_chat_paths.py`.

[Chat policy, formats and delivery calls](CHAT_DELIVERY.md) adds RE-265–267: 512 bounded policy paths, mode/formatter/control-byte evidence and echo/fanout calls. Reproduce with `python3 scripts/analyze_chat_delivery.py`; check with `python3 scripts/test_chat_delivery.py`. Field/global lifetime, actual formatted output and runtime delivery remain open.

[Radio/chat expansion states and keys](CHAT_EXPANSION.md) adds RE-269–271: marker and length branches, all twelve comparison keys, health labels and momo side-effect writes. Reproduce with `python3 scripts/analyze_chat_expansion.py`; check with `python3 scripts/test_chat_expansion.py`. Full composed parser output, buffer bounds and the remaining substitution bodies stay open.

[Chat ammunition, item names and countdowns](CHAT_ITEMS_TIME.md) adds RE-273–275: packed byte extraction, thirty sampled name words/game-item branches and timer/cvar/gate evidence. Reproduce with `python3 scripts/analyze_chat_items_time.py`; check with `python3 scripts/test_chat_items_time.py`. Complete item tables/producers and timing/output/runtime contracts remain open.

[Team-leader and location lookup paths](CHAT_LOCATIONS.md) adds RE-277–279: first-match leader scan, strict cache/format boundaries, location registration/list order and retained spatial control flow/constants. Reproduce with `python3 scripts/analyze_chat_locations.py`; check with `python3 scripts/test_chat_locations.py`. Geometry/services, ownership, caller output and runtime/platform contracts remain open.

[Crosshair substitution geometry and results](CHAT_CROSSHAIR.md) adds RE-281–283: bounded origin/basis/endpoint arithmetic, exact trace arguments and status/temp-object/fallback routes. Reproduce with `python3 scripts/analyze_chat_crosshair.py`; check with `python3 scripts/test_chat_crosshair.py`. Engine trig/collision and complete output/runtime/platform conformance remain open.

[Native trig, spatial services and VM pointers](NATIVE_SPATIAL.md) adds RE-285–287: confirmed paired Linux service mappings/float transport, bounded VM_ArgPtr branches and native trace/PVS/area-query graphs. Reproduce with `python3 scripts/analyze_native_spatial.py`; check with `python3 scripts/test_native_spatial.py`. Complete geometry, layout, exceptional arithmetic and all-platform runtime contracts remain open.

[Native entity collision filters and decisions](NATIVE_COLLISION.md) adds RE-289–291: paired first-lane filter/result probes, result-field relationships and model/transform paths. Reproduce with `python3 scripts/analyze_native_collision.py`; check with `python3 scripts/test_native_collision.py`. Full collision geometry/lane composition/runtime/platform behavior remains open.

[Collision copy/status composition and world decisions](COLLISION_COMPOSITION.md) adds RE-293–295: all three bounded merge/copy lanes, byte-addressed payload/status preservation and world sentinel/zero-fraction routing. Reproduce with `python3 scripts/analyze_collision_composition.py`; check with `python3 scripts/test_collision_composition.py`. Whole-loop/geometry/exception/runtime/platform behavior remains open.

[Entity-clipping loop and sentinel normalization](COLLISION_LOOP.md) adds RE-297–299: signed count/status entry gates, parity-selected lanes, bounded continuation/scheduling compositions and pass/related sentinel normalization. Reproduce with `python3 scripts/analyze_collision_loop.py`; check with `python3 scripts/test_collision_loop.py`. Count/order/lookup ownership, candidate/callee/geometry behavior and runtime/platform conformance remain open.

[Entity addressing and area-query boundaries](AREA_QUERIES.md) adds RE-301–303: registered low-width addressing, inclusive overlap/capacity insertion and static list/strict split ordering. Reproduce with `python3 scripts/analyze_area_queries.py`; check with `python3 scripts/test_area_queries.py`. Complete node/list/count/ABI ownership, query composition and runtime/platform conformance remain open.

[World-sector construction and entity linking](WORLD_LINKS.md) adds RE-305–307: bounded sector topology/allocation, strict placement/head insertion and standalone unlink repairs/state. Reproduce with `python3 scripts/analyze_world_links.py`; check with `python3 scripts/test_world_links.py`. Complete bounds/BSP metadata, reset/relink/list ownership and whole-query/runtime/platform conformance remain open.

[Entity bounds, inline removal and leaf-return gates](LINK_BOUNDS.md) adds RE-309–311: finite radius/padding compositions, metadata/query/return gates and owned-removal agreement with a NULL-owner precheck distinction. Reproduce with `python3 scripts/analyze_link_bounds.py`; check with `python3 scripts/test_link_bounds.py`. Full BSP metadata, producer/lifetime/relink/float and runtime/platform contracts remain open.

[Leaf areas, clusters and query outputs](LEAF_METADATA.md) adds RE-313–315: all-lane area/cluster compositions, exact overflow fallback and guarded leaf/store callback contracts. Reproduce with `python3 scripts/analyze_leaf_metadata.py`; check with `python3 scripts/test_leaf_metadata.py`. Full BSP traversal/layout/output ownership, consumers and original-runtime/platform conformance remain open.

[Native BSP planes and bounded node traversal](BSP_PLANES.md) adds RE-317–319: axial/general equality rules, verified eight-case sign dispatch and one-node child order/addressing. Reproduce with `python3 scripts/analyze_bsp_planes.py`; check with `python3 scripts/test_bsp_planes.py`. Full traversal/loading/callback/float/runtime/platform contracts remain open.

[Native BSP plane, node and leaf loading](BSP_LOADING.md) adds RE-321–323: descriptor routing, bounded payload conversion, derived plane fields, native node pointers, leaf projection/maxima and allocation requests. Reproduce with `python3 scripts/analyze_bsp_loading.py`; check with `python3 scripts/test_bsp_loading.py`. Complete validation/loading/ownership/recursive-query/runtime/platform contracts remain open.

[Leaf references, connectivity and portal counters](BSP_REFERENCES.md) adds RE-325–327: bounded reference copying/consumer addressing, connectivity guard priority and portal mutation/epoch/flood-request boundaries. Reproduce with `python3 scripts/analyze_bsp_references.py`; check with `python3 scripts/test_bsp_references.py`. Full inline loading/flooding/lifecycle/geometry/runtime/platform contracts remain open.

[Area flooding, epoch guards and area-bit output](AREA_FLOODING.md) adds RE-329–331: bounded unrolled/recursive flood and portal-to-label compositions, entry revisit/epoch guards and byte OR/fill packing. Reproduce with `python3 scripts/analyze_area_flooding.py`; check with `python3 scripts/test_area_flooding.py`. Complete lifecycle/error/asymmetric/real-map/snapshot/runtime/platform contracts remain open.

[Snapshot area-mask lifecycle and message arguments](SNAPSHOT_AREAS.md) adds RE-333–335: bounded ring/reset, native area union/complement and length/data request spans. Reproduce with `python3 scripts/analyze_snapshot_areas.py`; check with `python3 scripts/test_snapshot_areas.py`. Full viewpoint/entity/PVS/portal/lifecycle/codec/client/renderer/runtime/platform contracts remain open.

[Client snapshot area-mask parsing](CLIENT_MASKS.md) adds RE-337–339: temporary reset/length guards, byte-reader EOF and bounded unrolled data copies. Reproduce with `python3 scripts/analyze_client_masks.py`; check with `python3 scripts/test_client_masks.py`. Actual codecs/cursors, full snapshot publication and renderer/runtime/platform contracts remain open.

[Message read modes and bit assembly](MESSAGE_BITS.md) adds RE-341–343: exact resets, OOB loads/errors/cursors and raw-bit/compressed-symbol/sign-tail compositions. Reproduce with `python3 scripts/analyze_message_bits.py`; check with `python3 scripts/test_message_bits.py`. Huffman trees, writers, legal caller invariants and real packet/runtime/platform conformance remain open.

[Raw-bit helpers and supplied Huffman trees](HUFFMAN_HELPERS.md) adds RE-345–347: byte clear/OR, raw round trips, supplied-tree decoding/null cursor paths and transmit lookup/request boundaries. Reproduce with `python3 scripts/analyze_huffman_helpers.py`; check with `python3 scripts/test_huffman_helpers.py`. Full send, real codebooks/messages and runtime/platform contracts remain open.

[Bounded Huffman encoding and symbol streams](HUFFMAN_ENCODING.md) adds RE-349–351: unrolled/recursive send, supplied-tree symbol round trips and shared multi-symbol streams. Reproduce with `python3 scripts/analyze_huffman_encoding.py`; check with `python3 scripts/test_huffman_encoding.py`. Actual adaptive initialization/codebooks, message packets and runtime/platform contracts remain open.

[Huffman frequencies and initialization](HUFFMAN_INITIALIZATION.md) adds RE-353–355: verified native frequencies, empty-tree layout and bounded paired seed requests. Reproduce with `python3 scripts/analyze_huffman_initialization.py`; check with `python3 scripts/test_huffman_initialization.py`. Adaptive updates, trained codewords and actual message/runtime/platform contracts remain open.

[Adaptive Huffman update compositions](HUFFMAN_UPDATES.md) adds RE-357–359: insertion/dispatch, recursive count/tree invariants and rank/block/freelist reuse. Reproduce with `python3 scripts/analyze_huffman_updates.py`; check with `python3 scripts/test_huffman_updates.py`. Full branch/tie/second-object/seeded-codebook/message/runtime/platform contracts remain open.

[Differential recoding and provisional Huffman codebook](HUFFMAN_CODEBOOK.md) adds RE-361–363: full sampled state comparisons, both object halves and modeled seed training/codewords with native-helper symbol compositions. Reproduce with `python3 scripts/analyze_huffman_codebook.py`; check with `python3 scripts/test_huffman_codebook.py`. Native full-training, runtime/platform and complete packet compatibility remain open.

[Message byte codec and writer guards](MESSAGE_BYTE_CODEC.md) adds RE-365–367: space/width/range priorities and native byte writer/reader compositions against model-derived trees. Reproduce with `python3 scripts/analyze_message_byte_codec.py`; check with `python3 scripts/test_message_byte_codec.py`. General codecs, padding/overflow/truncation, native codebook and actual packet/runtime/platform coverage remain open.

[Message initialization, OOB and mixed-width codecs](MESSAGE_WIDTHS.md) adds RE-369–371: warm/cold record effects, exact clear retention and native writer/reader compositions for OOB and raw-remainder/Huffman paths. Reproduce with `python3 scripts/analyze_message_widths.py`; check with `python3 scripts/test_message_widths.py`. Wrappers, lifecycle, real packets and runtime/platform validation remain open.

[Scalar message wrappers and data overflow](MESSAGE_WRAPPERS.md) adds RE-373–375: fixed-width forwarding, scalar conversion/post-read EOF, and data-writer continuation after child space failure. Reproduce with `python3 scripts/analyze_message_wrappers.py`; check with `python3 scripts/test_message_wrappers.py`. ReadData, compressed/higher-level codecs and actual packet/runtime/platform coverage remain open.

[OOB data reads and message strings](MESSAGE_STRINGS.md) adds RE-377–379: actual ReadData cursor/EOF composition, ordinary/big/line string read limits/sanitation, and bounded supplied-copy string writing. Reproduce with `python3 scripts/analyze_message_strings.py`; check with `python3 scripts/test_message_strings.py`. Compressed/library/caller/higher-level and real packet/runtime/platform contracts remain open.

[Raw float transport and finite angle codecs](MESSAGE_NUMERIC.md) adds RE-381–383: raw float OOB/EOF behavior, finite angle encoding and signed angle16 reads. Reproduce with `python3 scripts/analyze_message_numeric.py`; check with `python3 scripts/test_message_numeric.py`. Delta/caller/control-state/compressed and actual packet/runtime/platform contracts remain open.

[Scalar delta flags and compressed compositions](MESSAGE_DELTA.md) adds RE-385–387: integer changes, finite float equality/signed zeros and modeled-tree byte/cursor composition. Reproduce with `python3 scripts/analyze_message_delta.py`; check with `python3 scripts/test_message_delta.py`. Keyed/higher-level/overflow/EOF/nonfinite and actual packet/runtime/platform contracts remain open.

[Keyed delta masks, XOR and compressed compositions](MESSAGE_DELTA_KEY.md) adds RE-389–391: actual integer table/bounds/adjacent reads, finite float XOR and modeled-tree payload/cursor checks. Reproduce with `python3 scripts/analyze_message_delta_key.py`; check with `python3 scripts/test_message_delta_key.py`. Caller/narrowing/index/higher-level and actual packet/runtime/platform contracts remain open.

[Keyed user-command codecs](MESSAGE_USERCMD.md) adds RE-393–395. Reproduce with `python3 scripts/analyze_message_usercmd.py`; check with `python3 scripts/test_message_usercmd.py`. Caller/time/key provenance, packet/entity/player/snapshot and runtime/platform validation remain open.

[Usercmd caller keys and bundles](USERCMD_CALLERS.md) adds RE-397–399. Reproduce with `python3 scripts/analyze_usercmd_callers.py`; check with `python3 scripts/test_usercmd_callers.py`. Hash instructions are evaluated; caller hash returns and server codec effects are supplied. Full packet/runtime conformance remains open.

[Server usercmd acceptance and VM boundary](USERCMD_ACCEPTANCE.md) adds RE-401–403. Reproduce with `python3 scripts/analyze_usercmd_acceptance.py`; check with `python3 scripts/test_usercmd_acceptance.py`. Supplied state/decoded records and stopped external/VM boundaries do not validate live packets or game simulation.

[Native retrieval and game-QVM usercmd prefix](QVM_USERCMD.md) adds RE-405–407. Reproduce with `python3 scripts/analyze_qvm_usercmd.py`; check with `python3 scripts/test_qvm_usercmd.py`. Cross-address mapping is supplied and remaining VM/simulation/runtime effects are open.

[QVM think routes, inactivity and mode selection](QVM_THINK_GATES.md) adds RE-409–411. Reproduce with `python3 scripts/analyze_qvm_think_gates.py`; check with `python3 scripts/test_qvm_think_gates.py`. External actions are recorded with omitted effects; full simulation/runtime work remains open.

[QVM gravity and movement-frame assembly](QVM_MOVEMENT_FRAME.md) adds RE-413–415. Reproduce with `python3 scripts/analyze_qvm_movement_frame.py`; check with `python3 scripts/test_qvm_movement_frame.py`. Frame zeroing/helper results are supplied; movement physics and callback/runtime effects remain open.

[QVM movement scheduler and outputs](QVM_MOVEMENT_LOOP.md) adds RE-417–419. Reproduce with `python3 scripts/analyze_qvm_movement_loop.py`; check with `python3 scripts/test_qvm_movement_loop.py`. Child clock advancement is supplied; physics and event effects remain open.

[QVM child flags, clock and early dispatch](QVM_STEP_STATE.md) adds RE-421–423. Reproduce with `python3 scripts/analyze_qvm_step_state.py`; check with `python3 scripts/test_qvm_step_state.py`. Only the decoded clock prefix is composed into selected schedulers; physics and other child effects remain open.

[QVM view angles, supplied-trig basis and position tails](QVM_VIEW_MOTION.md) adds RE-425–427. Reproduce with `python3 scripts/analyze_qvm_view_motion.py`; check with `python3 scripts/test_qvm_view_motion.py`. Trig returns and post-acceleration vectors are supplied; full mode/native/runtime effects remain open.

[QVM command scaling and acceleration](QVM_ACCELERATION.md) adds RE-429–431. Reproduce with `python3 scripts/analyze_qvm_acceleration.py`; check with `python3 scripts/test_qvm_acceleration.py`. Sqrt, basis and post-friction inputs are supplied; complete mode/native/runtime effects remain open.

[QVM friction and velocity composition](QVM_FRICTION.md) adds RE-433–435. Reproduce with `python3 scripts/analyze_qvm_friction.py`; check with `python3 scripts/test_qvm_friction.py`. Constants are initialized-image snapshots; native sqrt, live policy and full state/collision/runtime effects remain open.

[QVM content sampling, ground classification and friction inputs](QVM_GROUND.md) adds RE-437–439. Reproduce with `python3 scripts/analyze_qvm_ground.py`; check with `python3 scripts/test_qvm_ground.py`. Callback results are supplied and only scalar states bridge into friction; full collision/runtime work remains open.

[QVM posture bounds, transitions and consumer bridges](QVM_POSTURE.md) adds RE-441–443. Reproduce with `python3 scripts/analyze_qvm_posture.py`; check with `python3 scripts/test_qvm_posture.py`. Trace/sqrt results are supplied and only selected state transfers into consumers; native collision/callees/full runtime remain open.

[QVM animation helpers and contact registration](QVM_ANIMATION_CONTACTS.md) adds RE-445–447. Reproduce with `python3 scripts/analyze_qvm_animation_contacts.py`; check with `python3 scripts/test_qvm_animation_contacts.py`. Animation children are evaluated, table duration words supplied, and selected posture requests composed; full collision/runtime remains open.

[QVM animation assets, table loader and duration consumers](QVM_ANIMATION_TABLES.md) adds RE-449–451. Reproduce with `python3 scripts/analyze_qvm_animation_tables.py`; check with `python3 scripts/test_qvm_animation_tables.py`. Verified assets supply token integer values; complete native preprocessing, live playback and runtime remain open.

[QVM resource update, caller arguments and consumer bridges](QVM_RESOURCE.md) adds RE-453–455. Reproduce with `python3 scripts/analyze_qvm_resource.py`; check with `python3 scripts/test_qvm_resource.py`. Resource helper is evaluated completely within its bounded body; native sqrt/collision, preceding callers, full state and runtime remain open.

[QVM timer aging, main routing and consumer bridges](QVM_TIMERS_DISPATCH.md) adds RE-457–459. Reproduce with `python3 scripts/analyze_qvm_timers_dispatch.py`; check with `python3 scripts/test_qvm_timers_dispatch.py`. Timer body is evaluated; other main helpers/native effects are omitted, with selected producer/consumer words transferred.

[QVM direction and traversal-query transitions](QVM_TRAVERSAL_QUERY.md) adds RE-461–463. Reproduce with `python3 scripts/analyze_qvm_traversal_query.py`; check with `python3 scripts/test_qvm_traversal_query.py`. Direction/torso children are evaluated; native roots/trace fractions/clearance results are supplied, and only query return/state bridge into main routing.

[QVM side-hull acceptance and conditional gravity mode](QVM_CLEARANCE_MODE.md) adds RE-465–467. Reproduce with `python3 scripts/analyze_qvm_clearance_mode.py`; check with `python3 scripts/test_qvm_clearance_mode.py`. Side-helper QVM logic is evaluated with supplied native traces/roots;60091 remains omitted and mode tail inputs supplied.

[QVM step attempt, fallback wrapper and gravity-mode composition](QVM_STEP_COLLISION.md) adds RE-469–471. Reproduce with `python3 scripts/analyze_qvm_step_collision.py`; check with `python3 scripts/test_qvm_step_collision.py`. Step/wrapper/mode policies are evaluated;57714 and native traces still supply physical results.

[QVM slide preparation, first trace and clear caller chain](QVM_SLIDE_PREFIX.md) adds RE-473–475. Reproduce with `python3 scripts/analyze_qvm_slide_prefix.py`; check with `python3 scripts/test_qvm_slide_prefix.py`. Clear/allsolid paths finish; contact probes stop before plane solving. Native roots/one trace record remain supplied.

[QVM plane registration and first velocity candidates](QVM_SLIDE_PLANES.md) adds RE-477–479. Reproduce with `python3 scripts/analyze_qvm_slide_planes.py`; check with `python3 scripts/test_qvm_slide_planes.py`. Contacts continue through plane gate/first candidate only; secondary planes, commit and repeated bumps remain open.


[QVM secondary-plane solver and crease projection](QVM_SLIDE_SOLVER.md) adds RE-481–483. Reproduce with `python3 scripts/analyze_qvm_slide_solver.py`; check with `python3 scripts/test_qvm_slide_solver.py`. Solver commits/third-plane returns are evaluated; native roots/traces remain supplied and normal paths stop before repeated bumps.


[QVM bump gate, common exit and second trace](QVM_SLIDE_LOOP.md) adds RE-485–487. Reproduce with `python3 scripts/analyze_qvm_slide_loop.py`; check with `python3 scripts/test_qvm_slide_loop.py`. Actual first-contact state continues into second clear/allsolid exits; repeated contact/native collision/full runtime remain open.


[QVM continuous repeated contacts and exhaustion](QVM_SLIDE_REPEATED.md) adds RE-489–491. Reproduce with `python3 scripts/analyze_qvm_slide_repeated.py`; check with `python3 scripts/test_qvm_slide_repeated.py`. The helper runs continuously with evaluated touch registration and supplied native roots/traces; full callers/native collision/runtime remain open.


[QVM contact slides inside step/wrapper/mode](QVM_CONTACT_CALLERS.md) adds RE-493–495. Reproduce with `python3 scripts/analyze_qvm_contact_callers.py`; check with `python3 scripts/test_qvm_contact_callers.py`. Both57714 children run against actual shared state; native roots/traces and initial mode environment remain supplied.


[QVM clock/main routing into selected contact mode](QVM_MAIN_CONTACT.md) adds RE-497–499. Reproduce with `python3 scripts/analyze_qvm_main_contact.py`; check with `python3 scripts/test_qvm_main_contact.py`. Actual clock/timer and selected contact children share state; intervening/other main/native effects remain omitted or supplied.


[QVM pre/post main content and ground](QVM_MAIN_ENVIRONMENT.md) adds RE-501–503. Reproduce with `python3 scripts/analyze_qvm_main_environment.py`; check with `python3 scripts/test_qvm_main_environment.py`. Actual environment producers feed reached contact children and post-resampling; native records and remaining main/callee effects stay supplied or omitted.


[QVM main posture and animation-derived bounds](QVM_MAIN_POSTURE.md) adds RE-505–507. Reproduce with `python3 scripts/analyze_qvm_main_posture.py`; check with `python3 scripts/test_qvm_main_posture.py`. Actual posture/animation children feed ground/motion/content consumers; native records and remaining main/callee effects remain supplied or omitted.


[QVM ground loss and landing kinematics prefix](QVM_GROUND_CALLEES.md) adds RE-509–511. Reproduce with `python3 scripts/analyze_qvm_ground_callees.py`; check with `python3 scripts/test_qvm_ground_callees.py`. Ground loss composes at its actual main classifier boundary; landing stops before severity/events/damage and native effects remain supplied or omitted.


[QVM landing severity, event queue and ground caller](QVM_LANDING.md) adds RE-513–515. Reproduce with `python3 scripts/analyze_qvm_landing.py`; check with `python3 scripts/test_qvm_landing.py`. Landing/event writers evaluate before actual ground timer/touch stores; numeric consumers/native collision/full runtime remain open.


[QVM allsolid recovery and ground/main caller](QVM_RECOVERY.md) adds RE-517–519. Reproduce with `python3 scripts/analyze_qvm_recovery.py`; check with `python3 scripts/test_qvm_recovery.py`. Actual46296/caller state evaluates with supplied trace responses; consistent collision/native/full runtime domains remain open.


[QVM combined posture and ground callees](QVM_COMBINED_GROUND.md) adds RE-521–523. Reproduce with `python3 scripts/analyze_qvm_combined_ground.py`; check with `python3 scripts/test_qvm_combined_ground.py`. Recovered children compose at both main ground boundaries; native/action/other mode/full runtime scope remains open.


[QVM54981 forward probes and main producer](QVM_ACTION_PROBE.md) adds RE-525–527. Reproduce with `python3 scripts/analyze_qvm_action_probe.py`; check with `python3 scripts/test_qvm_action_probe.py`. Actual main argument0 effects and standalone recursive argument1 evaluate; nested ground-loss integration/query/other modes/native/full runtime remain open.


[QVM ground-loss nested action and main re-probe](QVM_LOST_ACTION.md) adds RE-529–531. Reproduce with `python3 scripts/analyze_qvm_lost_action.py`; check with `python3 scripts/test_qvm_lost_action.py`. Actual nested/main action ordering composes with ground/movement; query/other modes/native/full runtime remain open.


[QVM shared query and main acquisition event](QVM_MAIN_QUERY.md) adds RE-533–535. Reproduce with `python3 scripts/analyze_qvm_main_query.py`; check with `python3 scripts/test_qvm_main_query.py`. Actual side-clearance/query/full state and conditional event23 compose at main; other modes/combined environment/native/full runtime remain open.


[QVM57312 active-state movement](QVM_ACTIVE_MODE.md) adds RE-537–539. Reproduce with `python3 scripts/analyze_qvm_active_mode.py`; check with `python3 scripts/test_qvm_active_mode.py`. Live friction/scale/acceleration/slide compose at actual main routing; native/combined environment/other modes/full runtime remain open. See [project progress](../PROGRESS.md) for the completion estimate and remaining implementation gates.


[QVM55465 flagged movement and measured resource](QVM_FLAGGED_MODE.md) adds RE-541–543. Reproduce with `python3 scripts/analyze_qvm_flagged_mode.py`; check with `python3 scripts/test_qvm_flagged_mode.py`. Relevant40966 entry state, movement/clip/slide/resource compose at the actual main branch; other entry/movement/native/combined/runtime scope remains open.


[Full40966 entry helper](QVM_JUMP_ENTRY.md) adds RE-545. Reproduce with `python3 scripts/analyze_qvm_jump_entry.py`; check with `python3 scripts/test_qvm_jump_entry.py`. Caller/native/runtime integration remains open.


[Walking43626 entry routing](QVM_WALK_ENTRY.md) adds RE-546. Reproduce with `python3 scripts/analyze_qvm_walk_entry.py`; check with `python3 scripts/test_qvm_walk_entry.py`. Ordinary/delegated movement suffixes remain omitted in these prefix fixtures.


[Ordinary42838 air path](QVM_AIR_MODE.md) adds RE-547. Reproduce with `python3 scripts/analyze_qvm_air_mode.py`; check with `python3 scripts/test_qvm_air_mode.py`. Actual walking launch can continue through recovered air/wrapper/step/slides; wall-specific/ordinary walking/native/runtime remain open.


[RE-549: Recover40679 movement direction classification](QVM_MOVE_DIRECTION.md). Reproduce with `python3 scripts/analyze_qvm_move_direction.py`; check with `python3 scripts/test_qvm_move_direction.py`.


[RE-550: Recover162-vector direction codec60317 and60408](QVM_DIRECTION_CODEC.md). Reproduce with `python3 scripts/analyze_qvm_direction_codec.py`; check with `python3 scripts/test_qvm_direction_codec.py`.



[RE-551: Recover42838 wall guard and trace hull restoration](QVM_WALL_PROBE.md). Reproduce with `python3 scripts/analyze_qvm_wall_probe.py`; check with `python3 scripts/test_qvm_wall_probe.py`.


[RE-552: Compose wall success entry events and air continuation](QVM_WALL_ACTION.md). Reproduce with `python3 scripts/analyze_qvm_wall_action.py`; check with `python3 scripts/test_qvm_wall_action.py`.


[RE-553: Recover41486 water-entry queries and launch state](QVM_WATER_ENTRY.md). Reproduce with `python3 scripts/analyze_qvm_water_entry.py`; check with `python3 scripts/test_qvm_water_entry.py`.


[RE-554: Connect41848 entry guard to actual41768 fallback](QVM_WATER_ROUTE.md). Reproduce with `python3 scripts/analyze_qvm_water_route.py`; check with `python3 scripts/test_qvm_water_route.py`.


[RE-555: Recover complete ordinary41848 swimming and main handoff](QVM_SWIM_MODE.md). Reproduce with `python3 scripts/analyze_qvm_swim_mode.py`; check with `python3 scripts/test_qvm_swim_mode.py`.


[RE-556: Recover ordinary walking direction and slope wish producer](QVM_WALK_WISH.md). Reproduce with `python3 scripts/analyze_qvm_walk_wish.py`; check with `python3 scripts/test_qvm_walk_wish.py`.


[RE-557: Recover walking speed policy acceleration projection and resource](QVM_WALK_POLICY.md). Reproduce with `python3 scripts/analyze_qvm_walk_policy.py`; check with `python3 scripts/test_qvm_walk_policy.py`.


[RE-558: Complete bounded walking wrapper and combined main handoffs](QVM_WALKING_MODE.md). Reproduce with `python3 scripts/analyze_qvm_walking_mode.py`; check with `python3 scripts/test_qvm_walking_mode.py`.


[RE-560: Complete bounded freeflight movement](QVM_FREEFLIGHT.md). Reproduce with `python3 scripts/analyze_qvm_freeflight.py`; check with `python3 scripts/test_qvm_freeflight.py`.


[RE-561: Water transition event matrix and queue composition](QVM_WATER_EVENTS.md). Reproduce with `python3 scripts/analyze_qvm_water_events.py`; check with `python3 scripts/test_qvm_water_events.py`.


[RE-562: Torso selector priority and weapon class dispatch](QVM_TORSO_SELECTOR.md). Reproduce with `python3 scripts/analyze_qvm_torso_selector.py`; check with `python3 scripts/test_qvm_torso_selector.py`.


[RE-563: Reload request gates and timer animation event effects](QVM_RELOAD_REQUEST.md). Reproduce with `python3 scripts/analyze_qvm_reload_request.py`; check with `python3 scripts/test_qvm_reload_request.py`.


[RE-564: Interaction trace and direct action consumers](QVM_INTERACTION_REQUEST.md). Reproduce with `python3 scripts/analyze_qvm_interaction_request.py`; check with `python3 scripts/test_qvm_interaction_request.py`.


[RE-565: Packed mode availability edge latch and resource countdown](QVM_PACKED_CONTROLS.md). Reproduce with `python3 scripts/analyze_qvm_packed_controls.py`; check with `python3 scripts/test_qvm_packed_controls.py`.


[RE-566: Mode switch and ordered weapon prefix](QVM_WEAPON_PREFIX.md). Reproduce with `python3 scripts/analyze_qvm_weapon_prefix.py`; check with `python3 scripts/test_qvm_weapon_prefix.py`.


[RE-567: Airborne locomotion animation and bob cycle](QVM_LOCOMOTION_PREFIX.md). Reproduce with `python3 scripts/analyze_qvm_locomotion_prefix.py`; check with `python3 scripts/test_qvm_locomotion_prefix.py`.


[RE-568: Complete locomotion gait bob and footstep consumer](QVM_LOCOMOTION.md). Reproduce with `python3 scripts/analyze_qvm_locomotion.py`; check with `python3 scripts/test_qvm_locomotion.py`.

[RE-560–569 consumer batch and next work](QVM_CONSUMER_BATCH.md): ten separate task commits, bounded coverage and explicit missing weapon/main runtime scope.


[RE-569: Main request and independently bounded animation consumer chains](QVM_MAIN_CONSUMERS.md). Reproduce with `python3 scripts/analyze_qvm_main_consumers.py`; check with `python3 scripts/test_qvm_main_consumers.py`.


[RE-571: Weapon slot lookup and numeric return contract](QVM_WEAPON_LOOKUP.md). Reproduce with `python3 scripts/analyze_qvm_weapon_lookup.py`; check with `python3 scripts/test_qvm_weapon_lookup.py`.


[RE-572: Weapon selection request gates and transition effects](QVM_WEAPON_SELECT.md). Reproduce with `python3 scripts/analyze_qvm_weapon_select.py`; check with `python3 scripts/test_qvm_weapon_select.py`.


[RE-573: Weapon transition completion and fallback contract](QVM_WEAPON_COMPLETE.md). Reproduce with `python3 scripts/analyze_qvm_weapon_complete.py`; check with `python3 scripts/test_qvm_weapon_complete.py`.


[RE-574: Helper50525 native trace gates and event contract](QVM_SPECIAL_QUERY.md). Reproduce with `python3 scripts/analyze_qvm_special_query.py`; check with `python3 scripts/test_qvm_special_query.py`.


[RE-575: Weapon prefix to actual selection handoff](QVM_WEAPON_SELECTION_CALLER.md). Reproduce with `python3 scripts/analyze_qvm_weapon_selection_caller.py`; check with `python3 scripts/test_qvm_weapon_selection_caller.py`.


[RE-576: Weapon continuation guards timer floors and cancellation](QVM_WEAPON_GUARDS.md). Reproduce with `python3 scripts/analyze_qvm_weapon_guards.py`; check with `python3 scripts/test_qvm_weapon_guards.py`.


[RE-577: Ready weapon refill cadence and interaction re-entry](QVM_WEAPON_READY.md). Reproduce with `python3 scripts/analyze_qvm_weapon_ready.py`; check with `python3 scripts/test_qvm_weapon_ready.py`.


[RE-578: Reload completion packed ammo transfer and re-entry](QVM_RELOAD_COMPLETE.md). Reproduce with `python3 scripts/analyze_qvm_reload_complete.py`; check with `python3 scripts/test_qvm_reload_complete.py`.


[RE-579: Weapon lowering raising and frame gates](QVM_WEAPON_PHASES.md). Reproduce with `python3 scripts/analyze_qvm_weapon_phases.py`; check with `python3 scripts/test_qvm_weapon_phases.py`.

[RE-571–580 weapon batch and next ten tasks](QVM_WEAPON_BATCH.md): source-ordered transition/reload return paths and the explicit remaining firing/main boundary.


[RE-580: Pre-firing weapon return chains and actual main suffix handoff](QVM_WEAPON_RETURN_CHAINS.md). Reproduce with `python3 scripts/analyze_qvm_weapon_return_chains.py`; check with `python3 scripts/test_qvm_weapon_return_chains.py`.


[RE-582: Firing charge hold release and ordinary input gate](QVM_FIRE_GATE.md). Reproduce with `python3 scripts/analyze_qvm_fire_gate.py`; check with `python3 scripts/test_qvm_fire_gate.py`.


[RE-583: Availability failure event and timer exception](QVM_FIRE_AVAILABILITY.md). Reproduce with `python3 scripts/analyze_qvm_fire_availability.py`; check with `python3 scripts/test_qvm_fire_availability.py`.


[RE-584: Firing magazine debit and preserved mode flag](QVM_FIRE_AMMO.md). Reproduce with `python3 scripts/analyze_qvm_fire_ammo.py`; check with `python3 scripts/test_qvm_fire_ammo.py`.


[RE-585: Firing animation priority before class dispatch](QVM_FIRE_POSE_PRIORITY.md). Reproduce with `python3 scripts/analyze_qvm_fire_pose_priority.py`; check with `python3 scripts/test_qvm_fire_pose_priority.py`.


[RE-586: Complete firing animation class tag and gait dispatch](QVM_FIRE_POSE.md). Reproduce with `python3 scripts/analyze_qvm_fire_pose.py`; check with `python3 scripts/test_qvm_fire_pose.py`.


[RE-587: Firing request publication burst counter and selected delay](QVM_FIRE_COUNTER.md). Reproduce with `python3 scripts/analyze_qvm_fire_counter.py`; check with `python3 scripts/test_qvm_fire_counter.py`.


[RE-588: Firing resource snapshot capacity arithmetic and reset](QVM_FIRE_RESOURCE.md). Reproduce with `python3 scripts/analyze_qvm_fire_resource.py`; check with `python3 scripts/test_qvm_fire_resource.py`.


[RE-589: Final firing delay and last-round exception](QVM_FIRE_DELAY.md). Reproduce with `python3 scripts/analyze_qvm_fire_delay.py`; check with `python3 scripts/test_qvm_fire_delay.py`.


[RE-590: Complete bounded weapon body and actual main consumer suffix](QVM_WEAPON_COMPLETE_BODY.md). Reproduce with `python3 scripts/analyze_qvm_weapon_complete_body.py`; check with `python3 scripts/test_qvm_weapon_complete_body.py`.

[RE-582–591 firing batch and next ten tasks](QVM_FIRING_BATCH.md): complete finite weapon producer, actual outer publication and explicit native/full-tick boundaries.


[RE-591: Timer-coupled firing sequences and actual outer publication](QVM_FIRE_SEQUENCES.md). Reproduce with `python3 scripts/analyze_qvm_fire_sequences.py`; check with `python3 scripts/test_qvm_fire_sequences.py`.


[RE-593: Server event queue window and firing branch routing](QVM_SERVER_EVENT_ROUTE.md). Reproduce with `python3 scripts/analyze_qvm_server_event_route.py`; check with `python3 scripts/test_qvm_server_event_route.py`.


[RE-594: Published firing event to server pre-call reset](QVM_SERVER_FIRE_EVENT.md). Reproduce with `python3 scripts/analyze_qvm_server_fire_event.py`; check with `python3 scripts/test_qvm_server_fire_event.py`.


[RE-595: Server firing suppression statistic and angle basis](QVM_SERVER_FIRE_BASIS.md). Reproduce with `python3 scripts/analyze_qvm_server_fire_basis.py`; check with `python3 scripts/test_qvm_server_fire_basis.py`.


[RE-596: Server muzzle origins and actual firing handoff](QVM_SERVER_MUZZLE.md). Reproduce with `python3 scripts/analyze_qvm_server_muzzle.py`; check with `python3 scripts/test_qvm_server_muzzle.py`.


[RE-597: Entity weapon dispatcher and unresolved handler inventory](QVM_SERVER_FIRE_DISPATCH.md). Reproduce with `python3 scripts/analyze_qvm_server_fire_dispatch.py`; check with `python3 scripts/test_qvm_server_fire_dispatch.py`.


[RE-598: Temporary event record construction and position setter](QVM_TEMP_EVENT.md). Reproduce with `python3 scripts/analyze_qvm_temp_event.py`; check with `python3 scripts/test_qvm_temp_event.py`.


[RE-599: Event57 firing setup quantization and actual PRNG](QVM_SERVER_SHOT_SETUP.md). Reproduce with `python3 scripts/analyze_qvm_server_shot_setup.py`; check with `python3 scripts/test_qvm_server_shot_setup.py`.


[RE-600: Grenade record construction and inherited velocity](QVM_GRENADE_SETUP.md). Reproduce with `python3 scripts/analyze_qvm_grenade_setup.py`; check with `python3 scripts/test_qvm_grenade_setup.py`.


[RE-601: Base-dependent firing gate scan and distance contract](QVM_BASE_FIRE_GATE.md). Reproduce with `python3 scripts/analyze_qvm_base_fire_gate.py`; check with `python3 scripts/test_qvm_base_fire_gate.py`.

[RE-593–602 server firing batch and next ten tasks](QVM_SERVER_FIRE_BATCH.md): source-ordered event31 consumers, selected handler setup and explicit engine/opaque-call boundaries.


[RE-602: Published firing event to bounded server handler chains](QVM_SERVER_FIRE_CHAIN.md). Reproduce with `python3 scripts/analyze_qvm_server_fire_chain.py`; check with `python3 scripts/test_qvm_server_fire_chain.py`.


[RE-604: Entity initializer and preserved record fields](QVM_ENTITY_INIT.md). Reproduce with `python3 scripts/analyze_qvm_entity_init.py`; check with `python3 scripts/test_qvm_entity_init.py`.


[RE-605: Entity allocator reuse and recent-free guard](QVM_ENTITY_REUSE.md). Reproduce with `python3 scripts/analyze_qvm_entity_reuse.py`; check with `python3 scripts/test_qvm_entity_reuse.py`.


[RE-606: Allocator capacity retry and native registration request](QVM_ENTITY_ALLOCATE.md). Reproduce with `python3 scripts/analyze_qvm_entity_allocate.py`; check with `python3 scripts/test_qvm_entity_allocate.py`.


[RE-607: Temporary event with actual entity allocation](QVM_ALLOCATED_EVENT.md). Reproduce with `python3 scripts/analyze_qvm_allocated_event.py`; check with `python3 scripts/test_qvm_allocated_event.py`.


[RE-608: Grenade constructor with actual entity allocation](QVM_ALLOCATED_GRENADE.md). Reproduce with `python3 scripts/analyze_qvm_allocated_grenade.py`; check with `python3 scripts/test_qvm_allocated_grenade.py`.


[RE-609: Shared hitscan spread parameter calculation](QVM_SPREAD_PARAMETERS.md). Reproduce with `python3 scripts/analyze_qvm_spread_parameters.py`; check with `python3 scripts/test_qvm_spread_parameters.py`.


[RE-610: Hitscan movement speed normalization and airborne floor](QVM_SPREAD_SPEED.md). Reproduce with `python3 scripts/analyze_qvm_spread_speed.py`; check with `python3 scripts/test_qvm_spread_speed.py`.


[RE-611: Hitscan rejection sampling and RNG consumption](QVM_SPREAD_SAMPLING.md). Reproduce with `python3 scripts/analyze_qvm_spread_sampling.py`; check with `python3 scripts/test_qvm_spread_sampling.py`.


[RE-612: Shot body table copies and direction frame construction](QVM_SHOT_FRAME.md). Reproduce with `python3 scripts/analyze_qvm_shot_frame.py`; check with `python3 scripts/test_qvm_shot_frame.py`.


[RE-604–613 allocation/spread batch and current next ten tasks](QVM_ALLOCATION_SPREAD_BATCH.md): actual entity allocation, constructor composition, spread parameters/sampling and shot direction frames.


[RE-613: Shared shot handler basis muzzle and pending aim handoff](QVM_SHARED_SHOT_BASIS.md). Reproduce with `python3 scripts/analyze_qvm_shared_shot_basis.py`; check with `python3 scripts/test_qvm_shared_shot_basis.py`.


[RE-615: Aim airborne adjustment and trigonometric offsets](QVM_AIM_TRIG.md). Reproduce with `python3 scripts/analyze_qvm_aim_trig.py`; check with `python3 scripts/test_qvm_aim_trig.py`.


[RE-616: Conditional aim jitter and additional RNG draws](QVM_AIM_EXTRA_OFFSETS.md). Reproduce with `python3 scripts/analyze_qvm_aim_extra_offsets.py`; check with `python3 scripts/test_qvm_aim_extra_offsets.py`.


[RE-617: Aim endpoint construction and selected alias behavior](QVM_AIM_ENDPOINT.md). Reproduce with `python3 scripts/analyze_qvm_aim_endpoint.py`; check with `python3 scripts/test_qvm_aim_endpoint.py`.


[RE-618: Complete bounded shared aim function control flow](QVM_COMPLETE_AIM.md). Reproduce with `python3 scripts/analyze_qvm_complete_aim.py`; check with `python3 scripts/test_qvm_complete_aim.py`.


[RE-619: Shared firing handler through complete aim and trace handoff](QVM_SHARED_SHOT_AIM.md). Reproduce with `python3 scripts/analyze_qvm_shared_shot_aim.py`; check with `python3 scripts/test_qvm_shared_shot_aim.py`.


[RE-620: Shot trace prelude candidate bounds and native request](QVM_SHOT_TRACE_REQUEST.md). Reproduce with `python3 scripts/analyze_qvm_shot_trace_request.py`; check with `python3 scripts/test_qvm_shot_trace_request.py`.


[RE-621: Complete point rotation helper and alias write ordering](QVM_ROTATE_POINT.md). Reproduce with `python3 scripts/analyze_qvm_rotate_point.py`; check with `python3 scripts/test_qvm_rotate_point.py`.


[RE-622: Pellet muzzle width and indexed point rotation](QVM_PELLET_ROTATION.md). Reproduce with `python3 scripts/analyze_qvm_pellet_rotation.py`; check with `python3 scripts/test_qvm_pellet_rotation.py`.


[RE-623: Signed pellet seed perturbation and endpoint construction](QVM_PELLET_ENDPOINT.md). Reproduce with `python3 scripts/analyze_qvm_pellet_endpoint.py`; check with `python3 scripts/test_qvm_pellet_endpoint.py`.


[RE-615–624 aim/trace batch and current next ten tasks](QVM_AIM_TRACE_BATCH.md): complete bounded aim, trace prelude, rotation, signed pellet seeds and actual allocated event57 composition.


[RE-624: Allocated event57 to first pellet native trace boundary](QVM_EVENT57_TRACE_CHAIN.md). Reproduce with `python3 scripts/analyze_qvm_event57_trace_chain.py`; check with `python3 scripts/test_qvm_event57_trace_chain.py`.


[RE-626: Trace entity classification and suspended hit consumers](QVM_TRACE_CLASSIFY.md). Reproduce with `python3 scripts/analyze_qvm_trace_classify.py`; check with `python3 scripts/test_qvm_trace_classify.py`.


[RE-627: Trace retry unlink stack and ten-attempt boundary](QVM_TRACE_RETRY.md). Reproduce with `python3 scripts/analyze_qvm_trace_retry.py`; check with `python3 scripts/test_qvm_trace_retry.py`.


[RE-628: Skipped target relink ordering and duplicate entries](QVM_TRACE_RELINK.md). Reproduce with `python3 scripts/analyze_qvm_trace_relink.py`; check with `python3 scripts/test_qvm_trace_relink.py`.


[RE-629: Candidate bound restoration and f32 round-trip limits](QVM_TRACE_BOUNDS_RESTORE.md). Reproduce with `python3 scripts/analyze_qvm_trace_bounds_restore.py`; check with `python3 scripts/test_qvm_trace_bounds_restore.py`.


[RE-630: Shooter restoration gate final link and trace return](QVM_TRACE_FINALIZE.md). Reproduce with `python3 scripts/analyze_qvm_trace_finalize.py`; check with `python3 scripts/test_qvm_trace_finalize.py`.


[RE-631: Complete trace retry cleanup flow under supplied response sequences](QVM_TRACE_RESPONSE_CHAIN.md). Reproduce with `python3 scripts/analyze_qvm_trace_response_chain.py`; check with `python3 scripts/test_qvm_trace_response_chain.py`.


[RE-632: Rewind snapshot prefix and packed animation bytes](QVM_REWIND_SNAPSHOT.md). Reproduce with `python3 scripts/analyze_qvm_rewind_snapshot.py`; check with `python3 scripts/test_qvm_rewind_snapshot.py`.


[RE-633: Complete rewind record restoration and byte widening](QVM_REWIND_RESTORE.md). Reproduce with `python3 scripts/analyze_qvm_rewind_restore.py`; check with `python3 scripts/test_qvm_rewind_restore.py`.


[RE-634: Fixed player rewind selection and actual restore enumeration](QVM_REWIND_SELECTORS.md). Reproduce with `python3 scripts/analyze_qvm_rewind_selectors.py`; check with `python3 scripts/test_qvm_rewind_selectors.py`.


[RE-626–635 trace/rewind batch and current next ten tasks](QVM_TRACE_REWIND_BATCH.md): classification/retry/cleanup, supplied-response trace chains, snapshot/restore/selectors and configured player_bb construction.


[RE-635: Configured player_bb construction with recovered allocation](QVM_PLAYER_BB_CONSTRUCT.md). Reproduce with `python3 scripts/analyze_qvm_player_bb_construct.py`; check with `python3 scripts/test_qvm_player_bb_construct.py`.


[RE-637: Rewind history bracketing and unclamped fraction](QVM_REWIND_HISTORY_SELECT.md). Reproduce with `python3 scripts/analyze_qvm_rewind_history_select.py`; check with `python3 scripts/test_qvm_rewind_history_select.py`.


[RE-638: Exact weighted history vector interpolation and aliases](QVM_HISTORY_VECTOR_LERP.md). Reproduce with `python3 scripts/analyze_qvm_history_vector_lerp.py`; check with `python3 scripts/test_qvm_history_vector_lerp.py`.


[RE-639: History angle interpolation and strict half-turn correction](QVM_HISTORY_ANGLE_LERP.md). Reproduce with `python3 scripts/analyze_qvm_history_angle_lerp.py`; check with `python3 scripts/test_qvm_history_angle_lerp.py`.


[RE-640: History application vector angle and discrete state map](QVM_REWIND_HISTORY_APPLY.md). Reproduce with `python3 scripts/analyze_qvm_rewind_history_apply.py`; check with `python3 scripts/test_qvm_rewind_history_apply.py`.


[RE-641: Complete bounded rewind and snapshot restoration round trip](QVM_COMPLETE_REWIND.md). Reproduce with `python3 scripts/analyze_qvm_complete_rewind.py`; check with `python3 scripts/test_qvm_complete_rewind.py`.


[RE-642: Complete player rewind and restore selector composition](QVM_COMPLETE_REWIND_SELECTORS.md). Reproduce with `python3 scripts/analyze_qvm_complete_rewind_selectors.py`; check with `python3 scripts/test_qvm_complete_rewind_selectors.py`.


[RE-643: Trace composition with actual rewind configured construction and restoration](QVM_REWOUND_TRACE.md). Reproduce with `python3 scripts/analyze_qvm_rewound_trace.py`; check with `python3 scripts/test_qvm_rewound_trace.py`.


[RE-644: Twenty pellet source loop signed seed carry and no-target handoff](QVM_TWENTY_PELLETS.md). Reproduce with `python3 scripts/analyze_qvm_twenty_pellets.py`; check with `python3 scripts/test_qvm_twenty_pellets.py`.


[RE-645: Statistic category maps and complete no-target bookkeeping](QVM_NO_TARGET_STATS.md). Reproduce with `python3 scripts/analyze_qvm_no_target_stats.py`; check with `python3 scripts/test_qvm_no_target_stats.py`.


[RE-637–646 history/pellet batch and current next ten tasks](QVM_HISTORY_PELLET_BATCH.md): complete bounded history rewind/trace composition, twenty-pellet seed carry, no-target statistics and allocated event57 caller continuation.


[RE-646: Allocated event57 twenty-world-pellet bookkeeping and caller continuation](QVM_EVENT57_WORLD_RETURN.md). Reproduce with `python3 scripts/analyze_qvm_event57_world_return.py`; check with `python3 scripts/test_qvm_event57_world_return.py`.


[RE-648: History reset writer and preserved row fields](QVM_HISTORY_RESET.md). Reproduce with `python3 scripts/analyze_qvm_history_reset.py`; check with `python3 scripts/test_qvm_history_reset.py`.


[RE-649: History append shift and complete newest row writer](QVM_HISTORY_APPEND.md). Reproduce with `python3 scripts/analyze_qvm_history_append.py`; check with `python3 scripts/test_qvm_history_append.py`.


[RE-650: Source-produced twenty-row history through rewind and restoration](QVM_PRODUCED_HISTORY_REWIND.md). Reproduce with `python3 scripts/analyze_qvm_produced_history_rewind.py`; check with `python3 scripts/test_qvm_produced_history_rewind.py`.


[RE-651: Victim team and hit statistic bookkeeping](QVM_VICTIM_STATS.md). Reproduce with `python3 scripts/analyze_qvm_victim_stats.py`; check with `python3 scripts/test_qvm_victim_stats.py`.


[RE-652: Model hit target ray normalization and pending pose ABI](QVM_MODEL_RAY_PREFIX.md). Reproduce with `python3 scripts/analyze_qvm_model_ray_prefix.py`; check with `python3 scripts/test_qvm_model_ray_prefix.py`.


[RE-653: Pose animation masks and controller preparation](QVM_POSE_PREFIX.md). Reproduce with `python3 scripts/analyze_qvm_pose_prefix.py`; check with `python3 scripts/test_qvm_pose_prefix.py`.


[RE-654: Complete finite angle swing controller](QVM_SWING_CONTROLLER.md). Reproduce with `python3 scripts/analyze_qvm_swing_controller.py`; check with `python3 scripts/test_qvm_swing_controller.py`.


[RE-655: Hit-record ordering and trace publication](QVM_HIT_PUBLICATION.md). Reproduce with `python3 scripts/analyze_qvm_hit_publication.py`; check with `python3 scripts/test_qvm_hit_publication.py`.


[RE-656: Model-hit transform record construction](QVM_MODEL_TRANSFORMS.md). Reproduce with `python3 scripts/analyze_qvm_model_transforms.py`; check with `python3 scripts/test_qvm_model_transforms.py`.


[RE-657: Complete entity tag query and continuation](QVM_ENTITY_QUERY.md). Reproduce with `python3 scripts/analyze_qvm_entity_query.py`; check with `python3 scripts/test_qvm_entity_query.py`.


[RE-648–657: History production and model-hit preparation](QVM_HISTORY_HIT_BATCH.md), with validation limits and the next ten concrete tasks.


[RE-659: History producer caller and literal-reference inventory](QVM_HISTORY_CALLERS.md). Reproduce with `python3 scripts/analyze_qvm_history_callers.py`; check with `python3 scripts/test_qvm_history_callers.py`.


[RE-660: Pose prefix with both actual swing controllers](QVM_POSE_CONTROLLERS.md). Reproduce with `python3 scripts/analyze_qvm_pose_controllers.py`; check with `python3 scripts/test_qvm_pose_controllers.py`.


[RE-661: Complete vector-to-angle helper and alias behavior](QVM_VECTOR_ANGLES.md). Reproduce with `python3 scripts/analyze_qvm_vector_angles.py`; check with `python3 scripts/test_qvm_vector_angles.py`.


[RE-662: Animation-dispatched movement yaw and speed scaling](QVM_POSE_MOTION_YAW.md). Reproduce with `python3 scripts/analyze_qvm_pose_motion_yaw.py`; check with `python3 scripts/test_qvm_pose_motion_yaw.py`.


[RE-663: Pose pitch publication and lateral scratch arithmetic](QVM_POSE_LEAN.md). Reproduce with `python3 scripts/analyze_qvm_pose_lean.py`; check with `python3 scripts/test_qvm_pose_lean.py`.


[RE-664: Relative pose angle publication and numeric flag sum](QVM_POSE_PUBLICATION.md). Reproduce with `python3 scripts/analyze_qvm_pose_publication.py`; check with `python3 scripts/test_qvm_pose_publication.py`.


[RE-665: Complete finite pose routine with recovered source children](QVM_COMPLETE_POSE.md). Reproduce with `python3 scripts/analyze_qvm_complete_pose.py`; check with `python3 scripts/test_qvm_complete_pose.py`.


[RE-666: Entity free control flow and conditional record reset](QVM_ENTITY_FREE.md). Reproduce with `python3 scripts/analyze_qvm_entity_free.py`; check with `python3 scripts/test_qvm_entity_free.py`.


[RE-667: Grenade constructor with actual entity query and allocation](QVM_QUERIED_GRENADE.md). Reproduce with `python3 scripts/analyze_qvm_queried_grenade.py`; check with `python3 scripts/test_qvm_queried_grenade.py`.


[RE-668: Model-child traversal and frame-sample interpolation](QVM_MODEL_CHILD_SAMPLES.md). Reproduce with `python3 scripts/analyze_qvm_model_child_samples.py`; check with `python3 scripts/test_qvm_model_child_samples.py`.


[RE-659–668: Complete finite pose and lifecycle composition](QVM_POSE_LIFECYCLE_BATCH.md), with validation limits and the next ten concrete tasks.


[RE-670: Model ray through actual pose and transform construction](QVM_POSED_MODEL.md). Reproduce with `python3 scripts/analyze_qvm_posed_model.py`; check with `python3 scripts/test_qvm_posed_model.py`.


[RE-671: Child sample origin through parent-chain rotations](QVM_CHILD_ORIGIN.md). Reproduce with `python3 scripts/analyze_qvm_child_origin.py`; check with `python3 scripts/test_qvm_child_origin.py`.


[RE-672: Complete child transform with exact fourth-row arithmetic](QVM_CHILD_TRANSFORM.md). Reproduce with `python3 scripts/analyze_qvm_child_transform.py`; check with `python3 scripts/test_qvm_child_transform.py`.


[RE-673: Complete hierarchy traversal through actual child transforms](QVM_MODEL_HIERARCHY.md). Reproduce with `python3 scripts/analyze_qvm_model_hierarchy.py`; check with `python3 scripts/test_qvm_model_hierarchy.py`.


[RE-674: Leaf ancestry matrix accumulation](QVM_LEAF_BASIS.md). Reproduce with `python3 scripts/analyze_qvm_leaf_basis.py`; check with `python3 scripts/test_qvm_leaf_basis.py`.


[RE-675: Packed-word string length for resource release](QVM_WORD_STRLEN.md). Reproduce with `python3 scripts/analyze_qvm_word_strlen.py`; check with `python3 scripts/test_qvm_word_strlen.py`.


[RE-676: String resource list detach and bounded byte wipe](QVM_STRING_RELEASE.md). Reproduce with `python3 scripts/analyze_qvm_string_release.py`; check with `python3 scripts/test_qvm_string_release.py`.


[RE-677: Actual entity free through allocator reuse timing](QVM_FREE_REALLOCATE.md). Reproduce with `python3 scripts/analyze_qvm_free_reallocate.py`; check with `python3 scripts/test_qvm_free_reallocate.py`.


[RE-678: Basic source trajectory position branches](QVM_BASIC_TRAJECTORY.md). Reproduce with `python3 scripts/analyze_qvm_basic_trajectory.py`; check with `python3 scripts/test_qvm_basic_trajectory.py`.


[RE-679: Constructed grenade through trajectory and event prelude](QVM_GRENADE_EVENT_PREFIX.md). Reproduce with `python3 scripts/analyze_qvm_grenade_event_prefix.py`; check with `python3 scripts/test_qvm_grenade_event_prefix.py`.


[RE-670–679: Model transforms, resources and grenade prelude](QVM_MODEL_RESOURCE_BATCH.md), with validation limits and the next ten concrete tasks.


[RE-681: Packed frame vertices through world triangle construction](QVM_LEAF_VERTICES.md). Reproduce with `python3 scripts/analyze_qvm_leaf_vertices.py`; check with `python3 scripts/test_qvm_leaf_vertices.py`.


[RE-682: Leaf ray triangle determinant and barycentric tests](QVM_RAY_TRIANGLE.md). Reproduce with `python3 scripts/analyze_qvm_ray_triangle.py`; check with `python3 scripts/test_qvm_ray_triangle.py`.


[RE-683: Accepted candidate normal and exact source point construction](QVM_HIT_GEOMETRY.md). Reproduce with `python3 scripts/analyze_qvm_hit_geometry.py`; check with `python3 scripts/test_qvm_hit_geometry.py`.


[RE-684: File-backed surface name classifier and exact string children](QVM_SURFACE_CATEGORY.md). Reproduce with `python3 scripts/analyze_qvm_surface_category.py`; check with `python3 scripts/test_qvm_surface_category.py`.


[RE-685: Nearest farthest context updates and bounded hit append](QVM_LEAF_HIT_PUBLISH.md). Reproduce with `python3 scripts/analyze_qvm_leaf_hit_publish.py`; check with `python3 scripts/test_qvm_leaf_hit_publish.py`.


[RE-686: Complete packed-model leaf geometry and source-produced hit records](QVM_COMPLETE_LEAF.md). Reproduce with `python3 scripts/analyze_qvm_complete_leaf.py`; check with `python3 scripts/test_qvm_complete_leaf.py`.


[RE-687: Recursive model traversal with actual leaf geometry](QVM_GEOMETRIC_HIERARCHY.md). Reproduce with `python3 scripts/analyze_qvm_geometric_hierarchy.py`; check with `python3 scripts/test_qvm_geometric_hierarchy.py`.


[RE-688: Complete model-hit helper through geometry and publication](QVM_COMPLETE_MODEL_HIT.md). Reproduce with `python3 scripts/analyze_qvm_complete_model_hit.py`; check with `python3 scripts/test_qvm_complete_model_hit.py`.


[RE-689: Complete multi-part model hits and priority ordering](QVM_MODEL_MULTI_HITS.md). Reproduce with `python3 scripts/analyze_qvm_model_multi_hits.py`; check with `python3 scripts/test_qvm_model_multi_hits.py`.


[RE-690: Rewound trace through actual model geometry and complete cleanup](QVM_GEOMETRIC_REWOUND_TRACE.md). Reproduce with `python3 scripts/analyze_qvm_geometric_rewound_trace.py`; check with `python3 scripts/test_qvm_geometric_rewound_trace.py`.


[RE-681–690: Source model geometry through rewound trace](QVM_GEOMETRY_TRACE_BATCH.md), with validation limits and the next ten concrete tasks.


[RE-692: Bounds-checked original MD3 reader and QVM layout contract](MD3_CONTRACT.md). Reproduce with `python3 scripts/analyze_md3_contract.py`; check with `python3 scripts/test_md3_contract.py`.


[RE-693: Exhaustive extracted MD3 variant inventory](MD3_INVENTORY.md). Reproduce with `python3 scripts/analyze_md3_inventory.py`; check with `python3 scripts/test_md3_inventory.py`.


[RE-694: Source model bindings and original tag attachment evidence](MD3_BINDINGS.md). Reproduce with `python3 scripts/analyze_md3_bindings.py`; check with `python3 scripts/test_md3_bindings.py`.


[RE-695: Original MD3 bytes through QVM vertex decoder](MD3_VM_BRIDGE.md). Reproduce with `python3 scripts/analyze_md3_vm_bridge.py`; check with `python3 scripts/test_md3_vm_bridge.py`.


[RE-696: Complete QVM leaf geometry on original player models](MD3_ORIGINAL_LEAF.md). Reproduce with `python3 scripts/analyze_md3_original_leaf.py`; check with `python3 scripts/test_md3_original_leaf.py`.


[RE-697: Original tag attachment through complete hierarchy geometry](MD3_ORIGINAL_HIERARCHY.md). Reproduce with `python3 scripts/analyze_md3_original_hierarchy.py`; check with `python3 scripts/test_md3_original_hierarchy.py`.


[RE-698: Complete pose-driven model hits on original MD3 hierarchies](MD3_ORIGINAL_MODEL_HIT.md). Reproduce with `python3 scripts/analyze_md3_original_model_hit.py`; check with `python3 scripts/test_md3_original_model_hit.py`.


[RE-699: Original-asset numerical geometry comparison audit](MD3_GEOMETRY_AUDIT.md). Reproduce with `python3 scripts/analyze_md3_geometry_audit.py`; check with `python3 scripts/test_md3_geometry_audit.py`.


[RE-700: Contact eligibility gates with original-model hit contexts](QVM_CONTACT_GATES.md). Reproduce with `python3 scripts/analyze_qvm_contact_gates.py`; check with `python3 scripts/test_qvm_contact_gates.py`.


[RE-701: Rust original-byte MD3 asset core and cross-language validation](RUST_MD3.md). Reproduce with `python3 scripts/analyze_rust_md3.py`; check with `python3 scripts/test_rust_md3.py`.


[RE-692–701: Original models and Rust asset foundation](ORIGINAL_MODELS_RUST_BATCH.md), with validation limits and the next ten tasks.


[RE-703: Damage protection and armor location selection](QVM_DAMAGE_PROTECTION.md). Reproduce with `python3 scripts/analyze_qvm_damage_protection.py`; check with `python3 scripts/test_qvm_damage_protection.py`.


[RE-704: Damage descriptor and cubic range term](QVM_DAMAGE_RANGE.md). Reproduce with `python3 scripts/analyze_qvm_damage_range.py`; check with `python3 scripts/test_qvm_damage_range.py`.


[RE-705: Weapon24 distance attenuation](QVM_DAMAGE_ATTENUATION.md). Reproduce with `python3 scripts/analyze_qvm_damage_attenuation.py`; check with `python3 scripts/test_qvm_damage_attenuation.py`.


[RE-706: Damage saturation and weapon4 accumulation](QVM_DAMAGE_CLAMP.md). Reproduce with `python3 scripts/analyze_qvm_damage_clamp.py`; check with `python3 scripts/test_qvm_damage_clamp.py`.


[RE-707: Wound eligibility and client meter increments](QVM_DAMAGE_WOUNDS.md). Reproduce with `python3 scripts/analyze_qvm_damage_wounds.py`; check with `python3 scripts/test_qvm_damage_wounds.py`.


[RE-708: Active wound attribution and counter cap](QVM_DAMAGE_ATTRIBUTION.md). Reproduce with `python3 scripts/analyze_qvm_damage_attribution.py`; check with `python3 scripts/test_qvm_damage_attribution.py`.


[RE-709: Damage location jump table and client flags](QVM_DAMAGE_LOCATION_FLAGS.md). Reproduce with `python3 scripts/analyze_qvm_damage_location_flags.py`; check with `python3 scripts/test_qvm_damage_location_flags.py`.


[RE-710: Held-item deadline and final factor override](QVM_DAMAGE_INTERRUPT.md). Reproduce with `python3 scripts/analyze_qvm_damage_interrupt.py`; check with `python3 scripts/test_qvm_damage_interrupt.py`.


[RE-711: Complete damage factor on original-model contacts](QVM_DAMAGE_COMPLETE.md). Reproduce with `python3 scripts/analyze_qvm_damage_complete.py`; check with `python3 scripts/test_qvm_damage_complete.py`.


[RE-712: Contact direction basis and health-damage dispatch](QVM_CONTACT_DISPATCH.md). Reproduce with `python3 scripts/analyze_qvm_contact_dispatch.py`; check with `python3 scripts/test_qvm_contact_dispatch.py`.


[RE-703–712 batch overview and next tasks](QVM_DAMAGE_FACTOR_BATCH.md).


[RE-714: Ordinary contact factor composition](QVM_CONTACT_FACTOR.md). Reproduce with `python3 scripts/analyze_qvm_contact_factor.py`; check with `python3 scripts/test_qvm_contact_factor.py`.


[RE-715: Special weapon4 contact classification](QVM_CONTACT_SPECIAL.md). Reproduce with `python3 scripts/analyze_qvm_contact_special.py`; check with `python3 scripts/test_qvm_contact_special.py`.


[RE-716: Contact event and announcement gates](QVM_CONTACT_ANNOUNCEMENT.md). Reproduce with `python3 scripts/analyze_qvm_contact_announcement.py`; check with `python3 scripts/test_qvm_contact_announcement.py`.


[RE-717: Contact event header and health prediction](QVM_CONTACT_EVENT_HEADER.md). Reproduce with `python3 scripts/analyze_qvm_contact_event_header.py`; check with `python3 scripts/test_qvm_contact_event_header.py`.


[RE-718: Contact event scalar and direction payload](QVM_CONTACT_EVENT_VALUE.md). Reproduce with `python3 scripts/analyze_qvm_contact_event_value.py`; check with `python3 scripts/test_qvm_contact_event_value.py`.


[RE-719: Contact event vector and actual feedback ledger](QVM_CONTACT_FEEDBACK.md). Reproduce with `python3 scripts/analyze_qvm_contact_feedback.py`; check with `python3 scripts/test_qvm_contact_feedback.py`.


[RE-720: Complete impact-only contact branch](QVM_CONTACT_IMPACT.md). Reproduce with `python3 scripts/analyze_qvm_contact_impact.py`; check with `python3 scripts/test_qvm_contact_impact.py`.


[RE-721: Complete contact on original-model contexts](QVM_CONTACT_COMPLETE.md). Reproduce with `python3 scripts/analyze_qvm_contact_complete.py`; check with `python3 scripts/test_qvm_contact_complete.py`.


[RE-722: Health damage entry gates and client marker](QVM_HEALTH_GATES.md). Reproduce with `python3 scripts/analyze_qvm_health_gates.py`; check with `python3 scripts/test_qvm_health_gates.py`.


[RE-723: Health normalization and knockback selection](QVM_HEALTH_KNOCKBACK.md). Reproduce with `python3 scripts/analyze_qvm_health_knockback.py`; check with `python3 scripts/test_qvm_health_knockback.py`.


[RE-714–723 batch overview and next tasks](QVM_CONTACT_HEALTH_BATCH.md).


[RE-725: Health pointer fallback and target routing](QVM_HEALTH_ROUTING.md).


[RE-726: Health attacker credit and client damage records](QVM_HEALTH_CREDIT.md).


[RE-727: Special target health classes and actual RNG](QVM_HEALTH_SPECIAL_TARGET.md).


[RE-728: Lethal mode interception and method24 override](QVM_HEALTH_INTERCEPTS.md).


[RE-729: Ordinary health subtraction and protected publication](QVM_HEALTH_MUTATION.md).


[RE-730: Terminal health callbacks and packed meter cap](QVM_HEALTH_TERMINAL.md).


[RE-731: Complete velocity impulse and movement timer](QVM_HEALTH_IMPULSE.md).


[RE-732: Complete health function with actual velocity impulses](QVM_HEALTH_COMPLETE.md).


[RE-733: Complete original-model contact to actual health](QVM_CONTACT_HEALTH.md).


[RE-734: Rust source-order health impulse primitive](RUST_HEALTH_IMPULSE.md).


[RE-725–734 batch overview and subsequent tasks](QVM_HEALTH_RUST_BATCH.md).


[RE-736: Complete protected accumulator and completion callbacks](QVM_PROTECTED_UPDATE.md).


[RE-737: Mode10 interception gates and protected state publication](QVM_MODE10_ENTRY.md).


[RE-738: Mode10 descriptor and stance animation dispatch](QVM_MODE10_ANIMATION.md).


[RE-739: Mode10 inventory reset and obituary publication](QVM_MODE10_OBITUARY.md).


[RE-740: Mode10 team scoring penalties and lifecycle notifications](QVM_MODE10_SCORING.md).


[RE-741: Complete mode10 interception source composition](QVM_MODE10_COMPLETE.md).


[RE-742: Actual lethal health suffix to complete mode10 interception](QVM_HEALTH_MODE10.md).


[RE-743: Rust protected progress and completion primitive](RUST_PROTECTED_UPDATE.md).


[RE-744: Rust mode10 gate and protected-state entry primitive](RUST_MODE10_ENTRY.md).


[RE-745: Rust interception animation dispatch and lifecycle batch handoff](RUST_MODE10_ANIMATION.md).


[RE-747: Complete score update gates wrapping and rank refresh](QVM_SCORE_UPDATE.md).


[RE-748: Reset and pair notification gates and connected recipients](QVM_CLIENT_NOTIFICATIONS.md).


[RE-749: Complete method to statistic slot classification](QVM_METHOD_STAT_SLOTS.md).


[RE-750: Complete method counter mutation aliases and notifications](QVM_METHOD_STAT_UPDATES.md).


[RE-751: Complete cross client record clearing and inclusive index64](QVM_CROSS_CLIENT_CLEAR.md).


[RE-752: Protected completion with actual scoring and recipient dispatch](QVM_PROTECTED_RESOLVED.md).


[RE-753: Complete interception with actual score statistics and record clearing](QVM_MODE10_RESOLVED.md).


[RE-754: Rust wrapping score primitive and ranking request contract](RUST_SCORE_UPDATE.md).


[RE-755: Rust method classification wrapping counters and reporting intent](RUST_METHOD_STATS.md).


[RE-756: Rust cross client clearing and score statistics batch handoff](RUST_CROSS_CLIENT_CLEAR.md).


[RE-758: Complete statistic totals field inclusion and wrapping](QVM_STAT_TOTALS.md).


[RE-759: Complete divisor normalized totals and ratio publication](QVM_STAT_RATIOS.md).


[RE-760: Complete same team aggregate counters and participant gates](QVM_TEAM_COUNTERS.md).


[RE-761: Complete recent record awards timestamp gates and index64 alias](QVM_RECENT_AWARDS.md).


[RE-762: Single recipient numeric payload cached ping and send requests](QVM_RECIPIENT_SINGLE.md).


[RE-763: Pair recipient numeric payload gates and cache aliases](QVM_RECIPIENT_PAIR.md).


[RE-764: Ranking setup counts active slots and sort boundary](QVM_RANKING_SETUP.md).


[RE-765: Rust counter totals divisor and normalized ratio primitives](RUST_STAT_TOTALS.md).


[RE-766: Rust recent record awards timestamp gates and alias storage](RUST_RECENT_AWARDS.md).


[RE-767: Rust recipient numeric projection and reporting batch handoff](RUST_RECIPIENT_PAYLOAD.md).


[RE-769: Complete ranking comparator gates ties and mode priorities](QVM_RANK_COMPARATOR.md).


[RE-770: Actual aligned small rank sorting with dynamic comparator](QVM_RANK_SMALL_SORT.md).


[RE-771: Complete finite ranking sort tie flags and publication requests](QVM_RANKING_COMPLETE.md).


[RE-772: Leaderboard slot mapping sparse layout and sentinels](QVM_LEADERBOARD_LAYOUT.md).


[RE-773: Complete leaderboard joint thresholds sentinel updates and ties](QVM_LEADERBOARD_SELECTOR.md).


[RE-774: Actual first four leaderboard category selections](QVM_LEADERBOARD_CATEGORIES.md).


[RE-775: Original recipient command templates and bounded byte serialization model](QVM_RECIPIENT_WIRE.md).


[RE-776: Rust raw comparator and eligible rank publication primitives](RUST_RANKING.md).


[RE-777: Rust leaderboard mapping sentinels and joint metric selector](RUST_LEADERBOARD.md).


[RE-778: Rust modeled recipient byte serialization and ranking batch handoff](RUST_RECIPIENT_WIRE.md).


[RE-780: Bounded resumer call-site and return-placement audit inventory](QVM_RESUMER_AUDIT.md).


[RE-781: Fail-closed CALL return placement and coherent result bytes](QVM_RETURN_PLACEMENT.md).


[RE-782: Repeated CALL timing counterexamples and empty-stack guards](QVM_REENTRY_WITNESS.md).


[RE-783: Corrected movement resumption with persistent byte and command state](QVM_EXECUTE_REENTRY.md).


[RE-784: Audited notification reentry and 64-slot recipient dispatch](QVM_NOTIFICATION_REENTRY.md).


[RE-785: Audited dense recent-award scans timestamps and index64 alias](QVM_AWARD_REENTRY.md).


[RE-786: Audited method counters team pairs and dense record clearing](QVM_COUNTER_REENTRY.md).


[RE-787: Audited water-entry dynamic returns and locomotion source consumers](QVM_MOVEMENT_REENTRY.md).


[RE-788: Actual aligned sort swaps and dynamic median-of-three helper](QVM_RANK_PARTITION_HELPERS.md).


[RE-789: Actual aligned ranking partitions recursion and 64-client sorting](QVM_RANK_LARGE_SORT.md).


[RE-780–789 batch: resumer audit and aligned partitioned sorting](QVM_RESUMER_PARTITION_BATCH.md).


[RE-791: Explicit child word synchronization at corrected call boundaries](QVM_CHILD_WORD_MEMORY.md).


[RE-792: Complete ranking caller with actual partitioned sorting through64 clients](QVM_RANKING_LARGE_CALLER.md).


[RE-793: Mixed ranking populations and positional rank-prefix behavior](QVM_RANKING_POPULATION.md).


[RE-794: Rust source-shaped aligned ranking sort with exact tie order](RUST_RANK_SORT.md).


[RE-795: Rust eligible ranking composition through64 clients](RUST_RANKING_COMPLETE.md).


[RE-796: Rust ranking population collection and all eight count globals](RUST_RANKING_POPULATION.md).


[RE-797: Rust full mixed-population ranking and positional publication words](RUST_RANKING_MIXED.md).


[RE-798: Composed method counters team effects and actual ratio publication](QVM_STAT_COMPOSITION.md).


[RE-799: Actual scoreboard broadcast dispatch and full ranking caller gate](QVM_SCOREBOARD_BROADCAST.md).


[RE-800: Rust scoreboard recipient policy and bounded ranking publication plan](RUST_SCOREBOARD.md).


[RE-791–800 batch: Rust ranking and publication](QVM_RUST_RANKING_PUBLICATION_BATCH.md).


[RE-802: Opt-in coherent byte and unaligned word research memory](QVM_COHERENT_MEMORY.md).


[RE-803: Explicit child byte effects and read-only shared byte views](QVM_CHILD_BYTE_EFFECTS.md).


[RE-804: Actual QVM string helpers across aligned and unaligned memory](QVM_STRING_MEMORY.md).


[RE-805: Original scoreboard numeric rows cache updates and packet admission](QVM_SCOREBOARD_ROWS.md).


[RE-806: Source scoreboard buffer construction with modeled formatter boundaries](QVM_SCOREBOARD_WIRE.md).


[RE-807: Rust scoreboard numeric projection with source-specific ping and class policy](RUST_SCOREBOARD_ROWS.md).


[RE-808: Rust scoreboard packet admission cache and ring-buffer policy](RUST_SCOREBOARD_PACKET.md).


[RE-809: Source scoreboard broadcast with shared packet and cache state](QVM_SCOREBOARD_STREAM.md).


[RE-810: Rust stateful scoreboard broadcast transmission contract](RUST_SCOREBOARD_STREAM.md).


[RE-811: Shared method-stat ratio and recent-award source composition](QVM_STAT_AWARD_COMPOSITION.md).


[RE-802–811 batch: coherent memory and scoreboard packets](QVM_SCOREBOARD_MEMORY_BATCH.md).


[RE-813: Actual string formatter precision padding and null-pointer policy](QVM_FORMAT_STRING.md).


[RE-814: Actual decimal formatter padding and signed-minimum quirks](QVM_FORMAT_INTEGER.md).


[RE-815: Original formatter dispatch integer string character and literal composition](QVM_FORMATTER.md).


[RE-816: Scoreboard packets with actual original formatter execution](QVM_SCOREBOARD_FORMATTER.md).


[RE-817: Rust recovered formatter subset with original byte quirks](RUST_QVM_FORMAT.md).


[RE-818: Rust scoreboard packets corrected to original formatter bytes](RUST_SCOREBOARD_ORIGINAL.md).


[RE-819: Original bounded formatter clipping diagnostics and output-ring policy](QVM_FORMAT_WRAPPERS.md).


[RE-820: Rust bounded and rotating formatter wrapper contracts](RUST_FORMAT_WRAPPERS.md).


[RE-821: Original exit-rule prefix priority pending clocks and transition gates](QVM_EXIT_PREFIX.md).


[RE-822: Rust exit-rule prefix priority and wrapped transition clocks](RUST_EXIT_PREFIX.md).


[RE-813–822 batch: original formatter and exit prefix](QVM_ORIGINAL_FORMATTER_BATCH.md).


[RE-824: Original float formatter f32 truncation precision and width policy](QVM_FORMAT_FLOAT.md).


[RE-825: Rust f32 formatter truncation and original float dispatch](RUST_FORMAT_FLOAT.md).


[RE-826: Original exit-rule mode11 class guard and scan bound](QVM_EXIT_CLASS.md).


[RE-827: Rust exit-rule class guard with bounded configured scanning](RUST_EXIT_CLASS.md).


[RE-828: Original exit-rule score and team limit priority](QVM_EXIT_LIMITS.md).


[RE-829: Rust source exit-limit selection and first-winner policy](RUST_EXIT_LIMITS.md).


[RE-830: Original exit timers round priority and mode9 reset effects](QVM_EXIT_TIMERS.md).


[RE-831: Rust exit timer priority and mode9 reset/event intentions](RUST_EXIT_TIMERS.md).


[RE-832: Continuous original exit-rule body with all recovered priority branches](QVM_EXIT_COMPLETE.md).


[RE-833: Rust complete recovered exit-rule decision and mutation composition](RUST_EXIT_COMPLETE.md).

- [RE-824–833 float formatter and exit-rule batch](QVM_FLOAT_EXIT_RULES_BATCH.md).


[RE-834: Original exit tie predicate and mode classifier](QVM_EXIT_PREDICATE.md).


[RE-835: Rust ranked exit tie predicate](RUST_EXIT_PREDICATE.md).


[RE-836: Original intermission readiness scan and timeout policy](QVM_INTERMISSION_READY.md).


[RE-837: Rust intermission readiness and timeout policy](RUST_INTERMISSION_READY.md).


[RE-838: Original begin-intermission state and ordered effects](QVM_INTERMISSION_BEGIN.md).


[RE-839: Rust begin-intermission state and effect intentions](RUST_INTERMISSION_BEGIN.md).


[RE-840: Original exit log publication and ranked row contracts](QVM_EXIT_LOG.md).


[RE-841: Rust exit log ranked projection and pending clock](RUST_EXIT_LOG.md).


[RE-842: Original exit flow composed with recovered intermission children](QVM_INTERMISSION_FLOW.md).


[RE-843: Rust composed exit and intermission state machine](RUST_INTERMISSION_FLOW.md).

- [RE-834–843 intermission batch findings, validation and follow-up scope](QVM_INTERMISSION_BATCH.md).


[RE-844: Original intermission camera placement and client indirection](QVM_CAMERA_PLACE.md).


[RE-845: Rust intermission camera placement](RUST_CAMERA_PLACE.md).


[RE-846: Original intermission view selection and target direction](QVM_CAMERA_SELECT.md).


[RE-847: Rust camera view selection and aim intention](RUST_CAMERA_SELECT.md).


[RE-848: Original next-map team-series priority and score carry](QVM_NEXTMAP_SERIES.md).


[RE-849: Rust team-series transition policy](RUST_NEXTMAP_SERIES.md).


[RE-850: Original normal next-map reset staging and connection changes](QVM_NEXTMAP_RESET.md).


[RE-851: Rust staged normal map reset policy](RUST_NEXTMAP_RESET.md).


[RE-852: Original temporary event construction and origin snapping](QVM_EVENT_CONSTRUCT.md).


[RE-853: Rust temporary event construction and ownership boundaries](RUST_EVENT_CONSTRUCT.md).

- [RE-844–853 camera, map and event batch evidence and next work](QVM_CAMERA_MAP_EVENT_BATCH.md).


[RE-854: Original entity class-hash search and cursor semantics](QVM_ENTITY_HASH.md).


[RE-855: Rust entity class-hash search](RUST_ENTITY_HASH.md).


[RE-856: Original field-string entity search with actual comparator](QVM_ENTITY_FIELD.md).


[RE-857: Rust case-insensitive field search and signed-byte comparator](RUST_ENTITY_FIELD.md).


[RE-858: Original target selection with actual field search and random generator](QVM_TARGET_PICK.md).


[RE-859: Rust target selection and original random-state update](RUST_TARGET_PICK.md).


[RE-860: Corrected coherent vector-angle execution and legacy audit](QVM_CAMERA_ANGLES.md).


[RE-861: Rust vector-angle policy with checked math transcripts](RUST_CAMERA_ANGLES.md).


[RE-862: Original camera world composition with recovered searches and angles](QVM_CAMERA_WORLD.md).


[RE-863: Rust composed camera world selection and placement](RUST_CAMERA_WORLD.md).

- [RE-854–863 entity search and composed world camera batch](QVM_CAMERA_WORLD_BATCH.md).


[RE-864: Original fallback spawn distance ranking and selection](QVM_SPAWN_FALLBACK.md).


[RE-865: Rust fallback spawn ranking and view contract](RUST_SPAWN_FALLBACK.md).


[RE-866: Original camera setup with actual fallback spawn selection](QVM_CAMERA_SPAWN.md).


[RE-867: Rust camera composition with recovered fallback](RUST_CAMERA_SPAWN.md).


[RE-868: Original rotation cursor and refreshed filename callback policy](QVM_ROTATION_ADVANCE.md).


[RE-869: Rust refreshed rotation callback policy](RUST_ROTATION_ADVANCE.md).


[RE-870: Original map command branch with recovered copy and formatter](QVM_MAP_SELECT.md).


[RE-871: Rust cycle-mirror map command policy](RUST_MAP_SELECT.md).


[RE-872: Original normal next-map flow with recovered command children](QVM_NORMAL_MAP_FLOW.md).


[RE-873: Rust recovered normal next-map command and reset composition](RUST_NORMAL_MAP_FLOW.md).

- [RE-864–873 fallback spawn and normal map command batch](QVM_SPAWN_MAP_COMMAND_BATCH.md).


[RE-874: Original bot genome write selection](QVM_BOT_BEST.md).


[RE-875: Rust bot genome winner policy](RUST_BOT_BEST.md).


[RE-876: Original bot breeding callback and counter reset](QVM_BOT_BREED.md).


[RE-877: Rust bot breeding and post-callback reset](RUST_BOT_BREED.md).


[RE-878: Original post-map connected-client callbacks](QVM_POST_MAP_CLIENTS.md).


[RE-879: Rust post-map callback scheduling](RUST_POST_MAP_CLIENTS.md).


[RE-880: Original spawn overlap query and client filter](QVM_SPAWN_OVERLAP.md).


[RE-881: Rust spawn overlap boundary](RUST_SPAWN_OVERLAP.md).


[RE-882: Original rotation with recovered bot write and breeding children](QVM_BOT_ROTATION.md).


[RE-883: Rust composed bot rotation and callback ownership](RUST_BOT_ROTATION.md).


[RE-874–883 batch findings and next work](QVM_BOT_COLLISION_BATCH.md).


[RE-884: Original fallback spawn with actual overlap queries](QVM_QUERIED_SPAWN.md).


[RE-885: Rust queried fallback spawn policy](RUST_QUERIED_SPAWN.md).


[RE-886: Original camera placement with queried fallback](QVM_QUERIED_CAMERA.md).


[RE-887: Rust camera with lazy spatial queries](RUST_QUERIED_CAMERA.md).


[RE-888: Original session and ignore-list cvar serialization](QVM_SESSION_WRITE.md).


[RE-889: Rust session and bounded ignore-list serialization](RUST_SESSION_WRITE.md).


[RE-890: Original post-map dispatch with session persistence](QVM_POST_MAP_SESSION.md).


[RE-891: Rust post-map persistence composition](RUST_POST_MAP_SESSION.md).


[RE-892: Original normal map flow with session persistence](QVM_NORMAL_MAP_SESSION.md).


[RE-893: Rust normal map transition with session persistence](RUST_NORMAL_MAP_SESSION.md).


[RE-884–893 queried spawn/camera and persistence batch](QVM_QUERIED_PERSISTENCE_BATCH.md).


[RE-894: Original userinfo key lookup and alternating buffers](QVM_INFO_LOOKUP.md).


[RE-895: Rust userinfo lookup and buffer ownership](RUST_INFO_LOOKUP.md).


[RE-896: Original integer and float comma scanner](QVM_NUMERIC_SCAN.md).


[RE-897: Rust original comma numeric scanner](RUST_NUMERIC_SCAN.md).


[RE-898: Original saved-position write and file ownership](QVM_POSITION_SAVE.md).


[RE-899: Rust saved-position write and handle intentions](RUST_POSITION_SAVE.md).


[RE-900: Original saved-position read and all-six assignment gate](QVM_POSITION_LOAD.md).


[RE-901: Rust saved-position read and assignment ownership](RUST_POSITION_LOAD.md).


[RE-902: Original session restore with actual saved-position load](QVM_SESSION_RESTORE.md).


[RE-903: Rust session restore with caller-scratch ownership](RUST_SESSION_RESTORE.md).


[RE-894–903 saved-position and session restore batch](QVM_SAVED_RESTORE_BATCH.md).


[RE-904: Original session initialization and immediate persistence](QVM_SESSION_INIT.md).


[RE-905: Rust session initialization and raw-field ownership](RUST_SESSION_INIT.md).


[RE-906: Original post-map file and cvar persistence](QVM_POST_MAP_FILES.md).


[RE-907: Rust complete post-map persistence intentions](RUST_POST_MAP_FILES.md).


[RE-908: Original normal transition with both persistence children](QVM_NORMAL_MAP_FILES.md).


[RE-909: Rust normal map with full persistence](RUST_NORMAL_MAP_FILES.md).


[RE-910: Original write-to-restore persistence round trip](QVM_PERSISTENCE_ROUNDTRIP.md).


[RE-911: Rust in-memory persistence round trip](RUST_PERSISTENCE_ROUNDTRIP.md).


[RE-912: Original connect clear and session-branch caller](QVM_CONNECT_SESSION.md).


[RE-913: Rust connect clear and session lifecycle branch](RUST_CONNECT_SESSION.md).


[RE-904–913 lifecycle and complete persistence batch](QVM_SESSION_LIFECYCLE_BATCH.md).


[RE-914: Original unsigned byte string comparison](QVM_BYTE_COMPARE.md).


[RE-915: Rust unsigned comparison for admission](RUST_BYTE_COMPARE.md).


[RE-916: Original address parsing and filter table policy](QVM_ADDRESS_FILTER.md).


[RE-917: Rust original address filter and scratch ownership](RUST_ADDRESS_FILTER.md).


[RE-918: Original connect admission and password gates](QVM_CONNECT_ADMISSION.md).


[RE-919: Rust connect admission and password ordering](RUST_CONNECT_ADMISSION.md).


[RE-920: Original post-session connect normalization and callbacks](QVM_CONNECT_TAIL.md).


[RE-921: Rust post-session connect callbacks and normalization](RUST_CONNECT_TAIL.md).


[RE-922: Complete original connect caller with recovered admission/lifecycle/tail](QVM_CONNECT_COMPLETE.md).


[RE-923: Rust complete connect policy composition](RUST_CONNECT_COMPLETE.md).


[RE-914–923 complete connect caller policy batch](QVM_CONNECT_POLICY_BATCH.md).


[RE-924: Original bot settings admission wrapper](QVM_BOT_SETTINGS.md).


[RE-925: Rust bot setup record and drop policy](RUST_BOT_SETTINGS.md).


[RE-926: Original team announcement callback and spectator suppression](QVM_TEAM_ANNOUNCEMENT.md).


[RE-927: Rust team announcements and spectator suppression](RUST_TEAM_ANNOUNCEMENT.md).


[RE-928: Original connect suffix with bot wrapper and announcements](QVM_RESOLVED_CONNECT_TAIL.md).


[RE-929: Rust connect suffix with recovered bot and announcement children](RUST_RESOLVED_CONNECT_TAIL.md).


[RE-930: Complete original connect with bot/announcement children](QVM_RESOLVED_CONNECT_COMPLETE.md).


[RE-931: Rust complete connect with recovered child policies](RUST_RESOLVED_CONNECT_COMPLETE.md).


[RE-932: Original address-filter table insertion and wildcard parser](QVM_FILTER_INSERT.md).


[RE-933: Rust filter insertion and non-rollback semantics](RUST_FILTER_INSERT.md).


[RE-924–933 bot/announcement/filter batch](QVM_BOT_ANNOUNCEMENT_FILTER_BATCH.md).

- [RE-934: Original filter export and native file-operation order](QVM_FILTER_EXPORT.md).

- [RE-935: Rust filter export policy and bounded storage](RUST_FILTER_EXPORT.md).

- [RE-936: Original exact-match filter removal](QVM_FILTER_REMOVE.md).

- [RE-937: Rust exact-match filter removal and diagnostics](RUST_FILTER_REMOVE.md).

- [RE-938: Original filter metadata update and save gating](QVM_FILTER_METADATA.md).

- [RE-939: Rust first-match filter metadata policy](RUST_FILTER_METADATA.md).

- [RE-940: Original insertion composed with recovered export](QVM_FILTER_INSERT_EXPORT.md).

- [RE-941: Rust insertion with recovered export composition](RUST_FILTER_INSERT_EXPORT.md).

- [RE-942: Original removal composed with export and survivor serialization](QVM_FILTER_REMOVE_EXPORT.md).

- [RE-943: Rust removal with survivor export and typed file effects](RUST_FILTER_REMOVE_EXPORT.md).

- [RE-934–943 filter persistence batch and RE-944 next work](QVM_FILTER_PERSISTENCE_BATCH.md).

- [RE-944: Original filter time flattening and asymmetric inverse](QVM_FILTER_TIME.md).

- [RE-945: Rust filter time arithmetic and asymmetric inverse](RUST_FILTER_TIME.md).

- [RE-946: Original full-table filter expiry and unsigned time gates](QVM_FILTER_EXPIRY.md).

- [RE-947: Rust full-table expiry with unsigned metadata gates](RUST_FILTER_EXPIRY.md).

- [RE-948: Original banlist loading and duplicate metadata routing](QVM_FILTER_LOAD.md).

- [RE-949: Rust bounded loading with explicit read replies](RUST_FILTER_LOAD.md).

- [RE-950: Original expiration-duration command and usage paths](QVM_FILTER_DURATION.md).

- [RE-951: Rust expiration command with typed time and usage effects](RUST_FILTER_DURATION.md).

- [RE-952: Original export reload and lossy persistence behavior](QVM_FILTER_ROUNDTRIP.md).

- [RE-953: Rust export reload composition and persistence-loss regressions](RUST_FILTER_ROUNDTRIP.md).

- [RE-944–953 filter loading batch and RE-954 next work](QVM_FILTER_LOADING_BATCH.md).

- [RE-954: Original add-filter client lookup and queued kick command](QVM_FILTER_ADD_COMMAND.md).

- [RE-955: Rust add-filter wrapper and unconditional queued kick](RUST_FILTER_ADD_COMMAND.md).

- [RE-956: Original remove-filter command and usage routing](QVM_FILTER_REMOVE_COMMAND.md).

- [RE-957: Rust remove-filter wrapper and source usage effects](RUST_FILTER_REMOVE_COMMAND.md).

- [RE-958: Original duration command with metadata and export resolved](QVM_FILTER_DURATION_EXPORT.md).

- [RE-959: Rust duration command with resolved persistence plan](RUST_FILTER_DURATION_EXPORT.md).

- [RE-960: Original expiry composed with full-capacity address admission](QVM_FILTER_EXPIRY_ADMISSION.md).

- [RE-961: Rust full-capacity expiry and address-admission composition](RUST_FILTER_EXPIRY_ADMISSION.md).

- [RE-962: Original client-frame prefix with unconditional expiry](QVM_FILTER_FRAME_PREFIX.md).

- [RE-963: Rust client-frame prefix with source motion gates and expiry](RUST_FILTER_FRAME_PREFIX.md).

- [RE-954–963 filter commands batch and RE-964 next work](QVM_FILTER_COMMANDS_BATCH.md).

- [RE-964: Original client timer deadline and terminal-counter fragments](QVM_CLIENT_TIMER_TERMINAL.md).

- [RE-965: Rust client timer deadlines and terminal accumulation](RUST_CLIENT_TIMER_TERMINAL.md).

- [RE-966: Original100ms timer phase loop and damage-request ABI](QVM_CLIENT_TIMER_TICKS.md).

- [RE-967: Rust100ms phase loop and captured damage requests](RUST_CLIENT_TIMER_TICKS.md).

- [RE-968: Original float countdown and flag-recovery loop](QVM_CLIENT_TIMER_RECOVERY.md).

- [RE-969: Rust float countdown and ordered flag recovery](RUST_CLIENT_TIMER_RECOVERY.md).

- [RE-970: Complete original client timer body with expiry and ordered damage requests](QVM_CLIENT_TIMER_COMPLETE.md).

- [RE-971: Rust complete client timer with transactional persistent state](RUST_CLIENT_TIMER_COMPLETE.md).

- [RE-972: Original timer caller timing preparation and early gates](QVM_CLIENT_TIMER_PREPARE.md).

- [RE-973: Rust caller timestamp preparation and delta semantics](RUST_CLIENT_TIMER_PREPARE.md).

- [RE-964–973 client timer batch and RE-974 next work](QVM_CLIENT_TIMER_BATCH.md).

- [RE-974: Original client intermission and spectator routing](QVM_CLIENT_ROUTING.md).

- [RE-975: Rust early client routing with captured callbacks](RUST_CLIENT_ROUTING.md).

- [RE-976: Original command angle preservation and movement-byte masking](QVM_CLIENT_COMMAND_REWRITE.md).

- [RE-977: Rust client command rewriting and byte preservation](RUST_CLIENT_COMMAND_REWRITE.md).

- [RE-978: Original inactivity policy and ordered warning timeout effects](QVM_CLIENT_INACTIVITY.md).

- [RE-979: Rust inactivity deadlines and typed timeout effects](RUST_CLIENT_INACTIVITY.md).

- [RE-980: Original movement parameter selection and packed words](QVM_CLIENT_MOVEMENT_SETUP.md).

- [RE-981: Rust finite movement parameters and one-shot controller handling](RUST_CLIENT_MOVEMENT_SETUP.md).

- [RE-982: Original pre-movement client pipeline and early-exit state](QVM_CLIENT_PRE_MOVEMENT.md).

- [RE-983: Rust composed pre-movement pipeline with source early-exit mutations](RUST_CLIENT_PRE_MOVEMENT.md).

- [RE-974–983 client processing batch and RE-984 next work](QVM_CLIENT_PROCESSING_BATCH.md).

- [RE-984: Recover movement scratch initialization and mode dispatch](QVM_CLIENT_MOVE_SCRATCH.md).

- [RE-985: Port movement scratch initialization and callback plans](RUST_CLIENT_MOVE_SCRATCH.md).

- [RE-986: Recover movement suppression and command snapshot](QVM_CLIENT_MOVE_SUPPRESSION.md).

- [RE-987: Port signed movement suppression and snapshot](RUST_CLIENT_MOVE_SUPPRESSION.md).

- [RE-988: Recover movement masks and linked overlap cleanup](QVM_CLIENT_MOVE_MASK.md).

- [RE-989: Port linked overlap and movement mask selection](RUST_CLIENT_MOVE_MASK.md).

- [RE-990: Recover native movement context and vector snapshots](QVM_CLIENT_MOVE_CONTEXT.md).

- [RE-991: Port typed native movement context assembly](RUST_CLIENT_MOVE_CONTEXT.md).

- [RE-992: Compose source movement setup through physics boundary](QVM_CLIENT_MOVE_ASSEMBLY.md).

- [RE-993: Compose Rust movement setup with callback feedback](RUST_CLIENT_MOVE_ASSEMBLY.md).

- [Movement context construction: RE-984–993](QVM_MOVE_CONTEXT_BATCH.md).

- [RE-994: Recover meter completion and thaw event effects](QVM_MOVE_METER.md).

- [RE-995: Port meter completion and captured thaw effects](RUST_MOVE_METER.md).

- [RE-996: Recover timed mode10 self-recovery](QVM_MOVE_SELF_RECOVERY.md).

- [RE-997: Port timed self-recovery with atomic state updates](RUST_MOVE_SELF_RECOVERY.md).

- [RE-998: Recover mode10 assistance admission and cleanup scan](QVM_MOVE_ASSIST_CLEANUP.md).

- [RE-999: Port assistance cleanup and typed target ownership](RUST_MOVE_ASSIST_CLEANUP.md).

- [RE-1000: Recover mode8 eligibility and teammate exclusion](QVM_MOVE_MODE8_ELIGIBILITY.md).

- [RE-1001: Port mode8 eligibility and teammate exclusion](RUST_MOVE_MODE8_ELIGIBILITY.md).

- [RE-1002: Compose actual mode10 self callbacks with movement setup](QVM_MOVE_RESOLVED_SELF.md).

- [RE-1003: Compose actual Rust self callbacks with movement setup](RUST_MOVE_RESOLVED_SELF.md).

- [Movement callbacks: RE-994–1003](QVM_MOVE_CALLBACK_BATCH.md).

- [RE-1004: Recover assistance acquisition and target ownership](QVM_ASSIST_ACQUIRE.md).

- [RE-1005: Port assistance acquisition and ownership guard](RUST_ASSIST_ACQUIRE.md).

- [RE-1006: Recover far and unprotected assistance cancellation](QVM_ASSIST_CANCEL.md).

- [RE-1007: Port conditional assistance cancellation](RUST_ASSIST_CANCEL.md).

- [RE-1008: Recover assisted thaw progress and target completion](QVM_ASSIST_PROGRESS.md).

- [RE-1009: Port assisted progress with target meter feedback](RUST_ASSIST_PROGRESS.md).

- [RE-1010: Recover complete mode10 assistance callback](QVM_ASSIST_COMPLETE.md).

- [RE-1011: Port complete mode10 assistance scan](RUST_ASSIST_COMPLETE.md).

- [RE-1012: Recover assistance transitions across repeated calls](QVM_ASSIST_SEQUENCE.md).

- [RE-1013: Port bounded assistance replay and transition snapshots](RUST_ASSIST_SEQUENCE.md).

- [Assistance search and replay: RE-1004–1013](QVM_ASSISTANCE_BATCH.md).

- [RE-1014: Recover bomb-defuse start and weapon state changes](QVM_DEFUSE_BEGIN.md).

- [RE-1015: Port bomb-defuse start and effect ordering](RUST_DEFUSE_BEGIN.md).

- [RE-1016: Recover bomb-defuse cancellation branches](QVM_DEFUSE_CANCEL.md).

- [RE-1017: Port conditional bomb-defuse cancellation](RUST_DEFUSE_CANCEL.md).

- [RE-1018: Recover timed bomb-defuse completion and effect order](QVM_DEFUSE_FINISH.md).

- [RE-1019: Port timed bomb-defuse completion and captured effects](RUST_DEFUSE_FINISH.md).

- [RE-1020: Recover complete mode8 bomb-defuse callback](QVM_DEFUSE_COMPLETE.md).

- [RE-1021: Port complete bomb-defuse lookup and state policy](RUST_DEFUSE_COMPLETE.md).

- [RE-1022: Recover bomb-defuse sequences and completion latching](QVM_DEFUSE_SEQUENCE.md).

- [RE-1023: Port bomb-defuse replay and fatal/completion boundaries](RUST_DEFUSE_SEQUENCE.md).

- [Bomb-defuse transitions and replay: RE-1014–1023](QVM_DEFUSE_BATCH.md).

- [RE-1024: Correct native effect identities and recover objective counter](QVM_EFFECT_COUNTER.md).

- [RE-1025: Port indexed objective counters and label compatibility notes](RUST_EFFECT_COUNTER.md).

- [RE-1026: Recover team radio routing and marker state](QVM_EFFECT_RADIO.md).

- [RE-1027: Port team radio command planning and marker feedback](RUST_EFFECT_RADIO.md).

- [RE-1028: Resolve defuse completion score and objective counter](QVM_EFFECT_DEFUSE_FINISH.md).

- [RE-1029: Port resolved defuse score and counter feedback](RUST_EFFECT_DEFUSE_FINISH.md).

- [RE-1030: Resolve defuse start event construction and radio feedback](QVM_EFFECT_DEFUSE_BEGIN.md).

- [RE-1031: Port resolved defuse event and radio feedback](RUST_EFFECT_DEFUSE_BEGIN.md).

- [RE-1032: Resolve full defuse callback effect feedback](QVM_EFFECT_DEFUSE_COMPLETE.md).

- [RE-1033: Port full defuse policy with resolved effect bodies](RUST_EFFECT_DEFUSE_COMPLETE.md).

- [Resolved defuse effect feedback: RE-1024–1033](QVM_EFFECT_FEEDBACK_BATCH.md).

- [RE-1034: Recover cached trigger and nearest location selection](QVM_LOCATION_NEAREST.md).

- [RE-1035: Port cached trigger and nearest location policy](RUST_LOCATION_NEAREST.md).

- [RE-1036: Recover location text wrapper and bounded formatting](QVM_LOCATION_TEXT.md).

- [RE-1037: Port bounded location text and missing-result semantics](RUST_LOCATION_TEXT.md).

- [RE-1038: Resolve team radio location and source formatting chain](QVM_LOCATION_RADIO.md).

- [RE-1039: Port located team radio and formatter state](RUST_LOCATION_RADIO.md).

- [RE-1040: Recover objective-event allocator reuse and terminal boundaries](QVM_LOCATION_ALLOCATION.md).

- [RE-1041: Port fixed-pool allocation and terminal-state semantics](RUST_LOCATION_ALLOCATION.md).

- [RE-1042: Resolve defuse start through actual event allocation](QVM_LOCATION_ALLOCATED_DEFUSE.md).

- [RE-1043: Port allocated defuse start with preserved record state](RUST_LOCATION_ALLOCATED_DEFUSE.md).

- [Location, formatting and objective allocation: RE-1034–1043](QVM_LOCATION_ALLOCATION_BATCH.md).