qvm: audit counter and clear reentry

docs/ASSET_PIPELINE_TODO.md

@@ -1009,3 +1009,6 @@ Research progress: RE-784 [report](research/QVM_NOTIFICATION_REENTRY.md); origin
 
 
 Research progress: RE-785 [report](research/QVM_AWARD_REENTRY.md); original assets unchanged.
+
+
+Research progress: RE-786 [report](research/QVM_COUNTER_REENTRY.md); original assets unchanged.

docs/FINDINGS.md

@@ -1355,3 +1355,6 @@ RE-725–734 batch: [health, contact and Rust impulse findings](research/QVM_HEA
 
 
 **RE-785 — Audited dense recent-award scans timestamps and index64 alias:** 285227 uses corrected reentry;32 dense65-record fixtures preserve source scan order, signed timestamp/count gates and index64 award/count aliasing. [Evidence](research/QVM_AWARD_REENTRY.md).
+
+
+**RE-786 — Audited method counters team pairs and dense record clearing:** 278834,279720 and285486 now use corrected reentry; independent counter/alias/address oracles and full legacy tuple comparisons cover160 expanded fixtures. [Evidence](research/QVM_COUNTER_REENTRY.md).

docs/PROVISIONAL_TODO.md

@@ -1356,3 +1356,6 @@ Research progress: RE-784 [report](research/QVM_NOTIFICATION_REENTRY.md); full n
 
 
 Research progress: RE-785 [report](research/QVM_AWARD_REENTRY.md); full native/platform/game scope remains open.
+
+
+Research progress: RE-786 [report](research/QVM_COUNTER_REENTRY.md); full native/platform/game scope remains open.

docs/RESEARCH_LEDGER.md

@@ -1587,3 +1587,8 @@ The movement resumer also loses non-command STORE1 writes across calls in legacy
 ## 2026-10-21 — RE-785 Audited dense recent-award scans timestamps and index64 alias
 
 285227 uses corrected reentry;32 dense65-record fixtures preserve source scan order, signed timestamp/count gates and index64 award/count aliasing. Focused `cargo xtask test-group award-reentry` passes (10 Python tests); selected reports regenerate twice byte-identically, with storage, links and whitespace guards. New report: 659031 bytes. Full-suite validation is deferred to the tenth batch commit. Recent-award source resumption migrated. Existing Rust parity and source consumers remain bounded numeric contracts.
+
+
+## 2026-10-21 — RE-786 Audited method counters team pairs and dense record clearing
+
+278834,279720 and285486 now use corrected reentry; independent counter/alias/address oracles and full legacy tuple comparisons cover160 expanded fixtures. Focused `cargo xtask test-group counter-reentry` passes (34 Python tests); selected reports regenerate twice byte-identically, with storage, links and whitespace guards. New report: 200891 bytes. Full-suite validation is deferred to the tenth batch commit. Three bounded source helpers migrated; independent numeric/address expectations and existing source/Rust regressions check their contracts.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1405,3 +1405,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-785 Audited dense recent-award scans timestamps and index64 alias ([report](research/QVM_AWARD_REENTRY.md)).
+
+
+- [x] RE-786 Audited method counters team pairs and dense record clearing ([report](research/QVM_COUNTER_REENTRY.md)).

docs/research/QVM_COUNTER_REENTRY.md

@@ -0,0 +1,7 @@
+# Audited method counters team pairs and dense record clearing
+
+RE-786. Reproduce with `python3 scripts/analyze_qvm_counter_reentry.py`; validate with `cargo xtask test-group counter-reentry`. See the [machine report](qvm-counter-reentry.json).
+
+The audit includes48 method updates with self-aliasing and unsigned wrap,64 team-pair gates, and48 record clears across sparse and fully populated64-client pools. Accepted index64 and rejected indices-minus-one/65 are checked against exact changed addresses and initialized neighbor values. Existing full method-domain, null/team gates and Rust parity reports are selected transitively. Stat update children remain captured; no claim of full stat lifecycle execution is added.
+
+No original executable/full VM/native world collision or rendering runs. Supplied callback/native responses and fixture domains remain explicit; complete macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/README.md

@@ -945,3 +945,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-785: Audited dense recent-award scans timestamps and index64 alias](QVM_AWARD_REENTRY.md).
+
+
+[RE-786: Audited method counters team pairs and dense record clearing](QVM_COUNTER_REENTRY.md).

docs/research/qvm-resumer-audit.json

@@ -8628,7 +8628,7 @@
         285578
       ],
       "path": "scripts/qvm_record_clear_support.py",
-      "repeated_calls_opt_in": false
+      "repeated_calls_opt_in": true
     },
     {
       "backward_conditional_branches": [],
@@ -8856,7 +8856,7 @@
         279584
       ],
       "path": "scripts/qvm_stat_update_support.py",
-      "repeated_calls_opt_in": false
+      "repeated_calls_opt_in": true
     },
     {
       "backward_conditional_branches": [],
@@ -8877,7 +8877,7 @@
         279818
       ],
       "path": "scripts/qvm_team_counter_support.py",
-      "repeated_calls_opt_in": false
+      "repeated_calls_opt_in": true
     }
   ],
   "limits": "Static direct-import calls only, including local aliases. Computed ranges, indirect/module calls and reachability need manual/dynamic review. Backward branches and dynamic stores are review markers, not proven failures; fixture compatibility is not semantic proof.",
@@ -8920,7 +8920,7 @@
   "summary": {
     "call_expressions": 179,
     "files": 140,
-    "legacy_expressions": 169,
+    "legacy_expressions": 166,
     "nonliteral_ranges": 20
   }
 }

scripts/analyze_qvm_counter_reentry.py

@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+"""Differential migration of counters, aliases and sparse/dense pair clearing."""
+import itertools
+from pathlib import Path
+import qvm_stat_update_support as stats
+import qvm_record_clear_support as records
+import qvm_team_counter_support as teams
+from qvm_resumer_diff_support import compare
+from qvm_research_support import source
+from analyze_qvm import write_json
+
+def main():
+    q,raw,h,ins=source();updates=[];clears=[];pairs=[]
+    for method,self_hit,initial in itertools.product([-1,0,6,12,20,22,25,34,37,47,48,49],[False,True],[0,0xffffffff]):
+        a={'method':method,'self':self_hit,'initial':initial}
+        old,new,equal=compare(stats,lambda:stats.update(ins,stats.seed(raw,h,**a),{8:1,12:method,16:1 if self_hit else 2}))
+        updates.append({'input':a,'legacy_equal':equal,'changes':new[2]['changes'],'requests':new[2]['requests']})
+    for mode,index,dense in itertools.product([3,9,10,11],[-1,0,1,63,64,65],[False,True]):
+        a={'mode':mode,'index':index,'dense':dense};old,new,equal=compare(records,lambda:records.clear(ins,records.seed(**a),{8:index}));clears.append({'input':a,'legacy_equal':equal,'changes':new[2]['changes'],'stop':new[2]['execution']['stop']})
+    for mode,same,self_hit,initial,actor_client in itertools.product([3,9,10,11],[False,True],[False,True],[0,0xffffffff],[False,True]):
+        a={'mode':mode,'same':same,'self':self_hit,'initial':initial,'actor_client':actor_client};old,new,equal=compare(teams,lambda:teams.aggregate(ins,teams.seed(raw,h,**a),{8:teams.ATTACKER,12:teams.ATTACKER if self_hit else teams.TARGET}));pairs.append({'input':a,'legacy_equal':equal,'initial':new[2]['initial'],'final':new[2]['final']})
+    write_json(Path('docs/research/qvm-counter-reentry.json'),{'source':q['source'],'sha256':q['sha256'],'updates':updates,'clears':clears,'pairs':pairs,'limits':'Corrected278834/285486/279720;48 stat,48 clear and64 team fixtures. Full legacy/corrected tuple comparisons; complete tracked clear changes across64 dense clients and65 indices. Stat reporting/aggregate/award children remain captured in update; lifecycle/native ownership remains open.'})
+if __name__=='__main__':main()

scripts/qvm_record_clear_support.py

@@ -16,6 +16,6 @@ def seed(**a):
 
 def clear(ins,m,args):
     m[R+40]=args[8];addresses=sorted({c+2520+8*j+4*k for slot in range(64) for c in [m[POOL+880*slot+520]] if c for j in range(65) for k in [0,1]});before={a:m[a]&0xffffffff for a in addresses}
-    m,e=resume(ins,285487,285578,m,R,handlers={33715:predicate})
+    m,e=resume(ins,285487,285578,m,R,handlers={33715:predicate},repeated_calls=True)
     changes=[{'address':a,'before':v,'after':m[a]&0xffffffff} for a,v in before.items() if v!=(m[a]&0xffffffff)]
     return m,0,{'arguments':args,'changes':changes,'execution':e}

scripts/qvm_stat_update_support.py

@@ -17,6 +17,6 @@ def update(ins,m,args):
     for o,v in args.items():m[T+52+o]=v
     addresses=sorted({c+o for c in [CLIENT,A_CLIENT] for o in OFFSETS});before={a:m[a]&0xffffffff for a in addresses};requests=[]
     hs={c:captured(c,requests) for c in [279720,279586,285227,283622]};hs[278733]=classify
-    m,e=resume(ins,278835,279584,m,T,handlers=hs)
+    m,e=resume(ins,278835,279584,m,T,handlers=hs,repeated_calls=True)
     changes=[{'client':'actor' if a>=A_CLIENT and a<A_CLIENT+7000 else 'victim','offset':a-(A_CLIENT if a>=A_CLIENT and a<A_CLIENT+7000 else CLIENT),'before':before[a],'after':m[a]&0xffffffff} for a in addresses if before[a]!=(m[a]&0xffffffff)]
     return m,0,{'arguments':args,'changes':changes,'requests':requests,'execution':e}

scripts/qvm_team_counter_support.py

@@ -14,5 +14,5 @@ def snapshot(m):return {name:[m[c+o]&0xffffffff for o in [2444,2516]] for name,c
 
 def aggregate(ins,m,args):
     for o,v in args.items():m[P+32+o]=v
-    before=snapshot(m);m,e=resume(ins,279721,279818,m,P,handlers={33715:predicate})
+    before=snapshot(m);m,e=resume(ins,279721,279818,m,P,handlers={33715:predicate},repeated_calls=True)
     return m,0,{'arguments':args,'initial':before,'final':snapshot(m),'execution':e}

scripts/test_qvm_counter_reentry.py

@@ -0,0 +1,23 @@
+import json,unittest
+from pathlib import Path
+from test_qvm_method_stat_updates import expected
+from qvm_record_clear_support import RPOOL
+class CounterReentryTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.r=json.loads(Path('docs/research/qvm-counter-reentry.json').read_text())
+    def test_stat_changes_and_callback_order(self):
+        self.assertEqual(len(self.r['updates']),48)
+        for p in self.r['updates']:
+            changes,calls=expected(p['input']);self.assertEqual(p['changes'],changes);self.assertEqual([r['target'] for r in p['requests']],calls);self.assertTrue(p['legacy_equal'])
+    def test_dense_clear_exact_addresses_and_preserved_neighbors(self):
+        self.assertEqual(len(self.r['clears']),48)
+        for p in self.r['clears']:
+            a=p['input'];slots=range(64) if a['dense'] else [0,3,63];valid=a['mode'] in [3,10] and 0<=a['index']<=64;expected_changes=[{'address':RPOOL+j*6336+2520+8*a['index']+4*k,'before':10000+j*256+2*a['index']+k,'after':0} for j in slots for k in [0,1]] if valid else []
+            self.assertEqual(p['changes'],expected_changes,a);self.assertEqual(p['stop'],285578);self.assertTrue(p['legacy_equal'],a)
+    def test_team_pair_gate_alias_and_wrapping(self):
+        self.assertEqual(len(self.r['pairs']),64)
+        for p in self.r['pairs']:
+            a=p['input'];v=a['initial'];out={'actor':[v,v],'victim':[v,v]}
+            if a['mode'] in [3,10] and a['same'] and not a['self'] and a['actor_client']:out['actor'][0]=(v+1)&0xffffffff;out['victim'][1]=(v+1)&0xffffffff
+            self.assertEqual(p['final'],out,a);self.assertTrue(p['legacy_equal'])
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -1741,3 +1741,13 @@ report	scripts/analyze_qvm_award_reentry.py	docs/research/qvm-award-reentry.json
 edge	docs/research/qvm-award-reentry.json	scripts/test_qvm_award_reentry.py
 edge	scripts/analyze_qvm_award_reentry.py	scripts/analyze_qvm_resumer_audit.py
 group	award-reentry	scripts/analyze_qvm_award_reentry.py
+
+group	counter-reentry	scripts/qvm_stat_update_support.py
+
+group	counter-reentry	scripts/qvm_record_clear_support.py
+
+group	counter-reentry	scripts/qvm_team_counter_support.py
+report	scripts/analyze_qvm_counter_reentry.py	docs/research/qvm-counter-reentry.json
+edge	docs/research/qvm-counter-reentry.json	scripts/test_qvm_counter_reentry.py
+edge	scripts/analyze_qvm_counter_reentry.py	scripts/analyze_qvm_resumer_audit.py
+group	counter-reentry	scripts/analyze_qvm_counter_reentry.py