native: divergence at tic 301, a shot's puff misses its own first tic

[MarcusKainth]

ROM sha256

9a6a47d01119f67580e48e9875207186c25efd56ff93019df331eb307cfaa5d9

WAD sha256

1d7d43be501e67d927e415e0b8f3e29c3bf33075e859721816f652a526cac771

ClickHouse version

26.8.2.7

First divergent tic (gametic)

301

First divergent frame, if a frame differs

Not checked. The run stops at the state comparison.

What disagrees

A mobj field

The divergence report

clickdoom: error: tic 301 mobj slot 272 m_z: 1569317 against the probe's 1634853
exit=3

Slot 272 is the puff a zombieman's shot leaves at gametic 301, mobj type 37.
Its z is exactly 65536 low, one FRACUNIT, on the tic it spawns and on every
tic after. Its momentum and its state agree:

 tic    z ours    z theirs   momz ours  momz theirs  state ours  state theirs
 301   1569317     1634853       65536        65536          93            93
 302   1634853     1700389       65536        65536          93            93
 303   1700389     1765925       65536        65536          93            93

Our z at each tic is the engine's z at the tic before. The lag is constant,
never grows, and the momentum driving it is right, so the puff is a whole
tic behind from birth rather than moving wrongly.

P_SpawnPuff sets th->momz = FRACUNIT, and P_AddThinker appends the new
thing to the end of the thinker list. P_RunThinkers walks that list to its
end, so a thing appended during the walk is still reached by it and runs its
own P_MobjThinker on the tic it was spawned. That first step is the
missing FRACUNIT.

mobj::thrown_thinks already does this for the fireball a tic throws, with
a comment saying the compaction has appended it so it runs last, exactly
where P_AddThinker put it. The debris a gun attacker's shot leaves —
mt_debris, the puffs and blood spots — has no equivalent, so it is spawned
and then not run.

Random draws at that tic

Not involved. prndindex agrees at this tic and after it, once #560's own
fix is in. The draws this shot makes are right; where the thing they spawn
ends up is not.

Reproduction

Not reachable on main, which stops at gametic 210. It needs
native/player-death-actions at 691ed81 to pass 210, the chase crossing
fix to pass 275, and #560's fix to pass 301's draw count.

git checkout --detach 691ed81
git cherry-pick 2659738 3fc2eb9 c061770   # native/chase-crossing

make gen-probe-trace
cargo build --locked --release -p clickdoom-driver

CONN="--host localhost --port 18124 --password clickdoom --database clickdoom_native"
PROBE=refemu/reference_traces/demo3/probe.9a6a47d01119.tsv
./target/release/clickdoom native load --fresh $CONN
./target/release/clickdoom native load --probe $PROBE $CONN
./target/release/clickdoom native diff 400 --probe $PROBE $CONN   # exit 3 at 301

Why it has not been seen before

Gametic 301 is the first tic of demo3 that puts a gun attacker in the list
at all, so A_PosAttack has never run here and has never left a puff here.
The routine landed in #517 with seeded arms that assert what the shot leaves
— the puff's own spawn — rather than what the puff does on the tic it is
left. Both this and #560 sat behind those arms passing.

[MarcusKainth]

Handover

Written for someone picking this up cold. Everything needed is here or in the
issues it names; nothing depends on a session's memory.

The branch

native/chase-crossing, based on main at 0270dff, three commits:

sha	what it is
2659738	#554's fix, a monster's crossing dispatched against its own allow-list. This is also PR #557 on its own branch native/monster-crossing-allow-list, reviewed and queued to merge. When it lands, rebase this branch from 2659738's parent.
3fc2eb9	The chase-crossing fix. cc_special narrowed to the winning direction, the side flip and MONSTER_CROSSABLE_SPECIALS; 10 and 88 emitted to cross_dispatch; 4, 39, 97, 125, 126 keep the refusal. Clears demo3's refusal at gametic 275.
c061770	#560's fix, a gun attacker's draws added to the tic's now_prndindex. Clears the divergence at 301.

308 unit tests, fmt, clippy --all-targets --all-features and
check_purity.sh all pass on it. No live suite has been run against it yet.

Note: 3fc2eb9 adds cw_crossed_line to STAGE_EXTRA_COLUMNS and to
native/schema.sql's native_stage, because cross_dispatch runs in the
second resident statement and the chase in the first. The unit test that no
bare alias crosses the boundary is what catches this if it is missed.

What is left, in order

1. This issue's fix. A post-compaction debris stage, designed below.
2. An arm for it, asserting the puff's z on the spawn tic against the
   oracle: P_SpawnPuff's own z plus one tic of momz. Not only what the shot
   left.
3. Extend native: run the zombieman's and the shotgun guy's own attack #517's two gun arms (sim_gunshot_live, and the seeded arms
   under native/tests/support/attacks.rs) to assert the tic's own
   prndindex and the debris's first tic. They assert what a shot leaves,
   which is why both native: divergence at tic 301, a zombieman fires seven draws short #560 and this one passed them.
4. Seeded arms for the chase crossing: a monster whose winning direction
   crosses a line given special 97 asserts the refusal stays and names its
   bit; the same seed with 88 asserts the plat runs and nothing refuses.
   E1M7 carries no 97 line, so the seed overrides line_special, the way
   sim_plat_live's one-shot arm already does.
5. Numbers for the chase fix: analysis by QueryAnalysisMicroseconds,
   and the harness at tics 20 and 170. Expected near free, because the
   narrowing happens where cc_special already reads w and no new
   instantiation lands at fold depth. Measure rather than assert.
6. Open the PR against main, pins moved to the measured first refusal.

The design for this issue's fix

thrown_thinks runs missile::thinks_fold — the whole missile thinker —
over slots it computes as length(mt_kept) + i for mt_thrown. The debris
sits further along the appended run, after mt_thrown and mt_drops, and
wants almost none of that fold. So this is a new post-compaction stage beside
the thrown one, not a widening of it.

Per debris thing, from P_MobjThinker:

• No P_XYMovement. P_SpawnPuff and P_SpawnBlood set no momx or
  momy, and the branch is guarded on them.
• P_ZMovement, because momz is non-zero. z += momz; then, where
  MF_NOGRAVITY is absent, gravity; then the floor and ceiling clip.
• The state cycle. tics--, and the state advances where that reaches
  zero. P_SpawnPuff has already set tics to between 1 and 4 by subtracting
  P_Random()&3, so the cycle can fire on the spawn tic and is not optional.

The two types differ where it matters. MT_PUFF is flags 0x210,
MF_NOBLOCKMAP|MF_NOGRAVITY. MT_BLOOD is 0x10, MF_NOBLOCKMAP only, so
blood takes gravity on this same step. A fix that only adds momz is right
for the puff at gametic 301 and wrong for every blood spot, and blood is what
a shot leaves whenever it hits something that bleeds.

thing_falls cannot be reused: it runs over mt_slots, the things that
existed when the tic began, and the debris is not among them.

Why nothing hit this before: mt_drops is the other appended class, and
P_KillMobj spawns a drop at ONFLOORZ with no momentum, so z == floorz
and momz == 0 and both movement branches are skipped. The debris is the
first appended thing with momentum that is not a missile.

How #560 was found, since the same method applies here

By elimination with throwaway unresolved bits, not by reading. Three bits
were added at unused positions in one build — at_gun non-empty, the fold
returning no gun answer, and a gun answer whose draws are zero — and the run
stops at the first tic any of them fires, naming all that are set. Only the
first fired, so the list was right, the answer existed and it drew, which
left the tic's own total as the only place the draws could go missing.

That run also established that gametic 301 is the first tic of the whole demo
with a gun attacker in the list at all, which is why #517's routines had never
run in a real tic.

The throwaway is never committed: the patch asserts on every anchor it edits
so a partial application fails loudly rather than building something that
looks fine and prints a number, and the files are restored with
git checkout HEAD -- <paths> afterwards. Not git checkout -- <paths>,
which restores from the index and silently does nothing if the revert staged
anything.

Validating against demo3

Gametic 301 is not reachable on main, which stops at 210, nor on this
branch alone. It needs clickdoom-c's step 3 as well:

git checkout --detach 691ed81          # native/player-death-actions
git cherry-pick 2659738 3fc2eb9 c061770

make gen-probe-trace                   # the trace must be state_schema_version 2
cargo build --locked --release -p clickdoom-driver

CONN="--host localhost --port 18124 --password clickdoom --database clickdoom_native"
PROBE=refemu/reference_traces/demo3/probe.9a6a47d01119.tsv
./target/release/clickdoom native load --fresh $CONN
./target/release/clickdoom native load --probe $PROBE $CONN
./target/release/clickdoom native diff 400 --probe $PROBE $CONN

691ed81's tick.rs predates the cut machinery, so the cherry-pick of
3fc2eb9 conflicts there. Take 691ed81's side and re-apply only the
cw_crossed_line entry in STAGE_EXTRA_COLUMNS.

With all three commits that run stops at tic 301 mobj slot 272 m_z: 1569317 against the probe's 1634853, which is this issue. make gen-probe-trace
dirties refemu/reference_traces/demo3/probe.<sha>.json with wall-clock
fields only; restore it.

Two things that are not this issue but bear on it

native diff stops at the first refused tic before comparing any field, so a
run whose span holds a refusal compares nothing (#534, fixed in #539, which
waits on the spec-change #540). And sim_parity_live compares every field but
only against the committed fixture, which holds gametics 2, 3, 4 and 963 — so
a divergence at any other tic is invisible to CI, and only a manual
native diff against the full trace finds it. Both of tonight's divergences
were found that way rather than by a suite.