qvm: recover method counter updates

docs/ASSET_PIPELINE_TODO.md

@@ -910,3 +910,6 @@ Research progress: RE-748 [report](research/QVM_CLIENT_NOTIFICATIONS.md); origin
 
 
 Research progress: RE-749 [report](research/QVM_METHOD_STAT_SLOTS.md); original assets unchanged.
+
+
+Research progress: RE-750 [report](research/QVM_METHOD_STAT_UPDATES.md); original assets unchanged.

docs/FINDINGS.md

@@ -1256,3 +1256,6 @@ RE-725–734 batch: [health, contact and Rust impulse findings](research/QVM_HEA
 
 
 **RE-749 — Complete method to statistic slot classification:** 278733 maps19 selected methods into statistic slots0..18 using the original jump table; all other tested methods return-1. [Evidence](research/QVM_METHOD_STAT_SLOTS.md).
+
+
+**RE-750 — Complete method counter mutation aliases and notifications:** 278834 updates per-method or fallback counters with wrapping increments, distinct self cases, and ordered aggregate/report requests. [Evidence](research/QVM_METHOD_STAT_UPDATES.md).

docs/PROVISIONAL_TODO.md

@@ -1248,3 +1248,6 @@ Research progress: RE-748 [report](research/QVM_CLIENT_NOTIFICATIONS.md); full n
 
 
 Research progress: RE-749 [report](research/QVM_METHOD_STAT_SLOTS.md); full native/platform/game scope remains open.
+
+
+Research progress: RE-750 [report](research/QVM_METHOD_STAT_UPDATES.md); full native/platform/game scope remains open.

docs/RESEARCH_LEDGER.md

@@ -1395,3 +1395,8 @@ Exactly ten task commits follow baseline `e1f7eb5a`. Each task passed focused `c
 ## 2026-10-21 — RE-749 Complete method to statistic slot classification
 
 278733 maps19 selected methods into statistic slots0..18 using the original jump table; all other tested methods return-1. Focused `cargo xtask test-group stat-slots` passes (3 Python tests); selected reports regenerate twice byte-identically, with storage, links and whitespace guards. New report: 19282 bytes. Full-suite validation is deferred to the tenth batch commit. No original assets, Rust runtime or shared VM evaluator changed.
+
+
+## 2026-10-21 — RE-750 Complete method counter mutation aliases and notifications
+
+278834 updates per-method or fallback counters with wrapping increments, distinct self cases, and ordered aggregate/report requests. Focused `cargo xtask test-group stat-updates` passes (3 Python tests); selected reports regenerate twice byte-identically, with storage, links and whitespace guards. New report: 956970 bytes. Full-suite validation is deferred to the tenth batch commit. No original assets, Rust runtime or shared VM evaluator changed.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1291,3 +1291,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-749 Complete method to statistic slot classification ([report](research/QVM_METHOD_STAT_SLOTS.md)).
+
+
+- [x] RE-750 Complete method counter mutation aliases and notifications ([report](research/QVM_METHOD_STAT_UPDATES.md)).

docs/research/QVM_METHOD_STAT_UPDATES.md

@@ -0,0 +1,7 @@
+# Complete method counter mutation aliases and notifications
+
+RE-750. Reproduce with `python3 scripts/analyze_qvm_method_stat_updates.py`; validate with `cargo xtask test-group stat-updates`. See the [machine report](qvm-method-stat-updates.json).
+
+Recovered complete278834 across205 fixtures with actual278733, every method-1..49, self aliases, absent actor and zero/max counter values. Independent offset and callback oracles cover table/fallback dispatch.279720/279586/285227/283622 internals stay captured; invalid victim/null low-page accesses and semantic stat names remain open.
+
+No original executable/full VM/native world collision or rendering runs. Supplied callback/native responses and fixture domains remain explicit; complete macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/README.md

@@ -846,3 +846,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-749: Complete method to statistic slot classification](QVM_METHOD_STAT_SLOTS.md).
+
+
+[RE-750: Complete method counter mutation aliases and notifications](QVM_METHOD_STAT_UPDATES.md).

scripts/analyze_qvm_method_stat_updates.py

@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+"""Complete278834 counter writes, aliasing and notification requests."""
+import itertools
+from pathlib import Path
+from qvm_research_support import source
+from qvm_stat_update_support import seed,update,OFFSETS
+from analyze_qvm import write_json
+
+def main():
+    q,raw,h,ins=source();rows=[]
+    cases=[dict(method=m,self=s,initial=v) for m,s,v in itertools.product([-1,*range(50)],[False,True],[0,0xffffffff])];cases += [dict(method=20,self=False,initial=0,actor_absent=True)]
+    for a in cases:
+        actor=-1 if a.get('actor_absent') else 1;victim=1 if a['self'] else 2
+        _,_,p=update(ins,seed(raw,h,**a),{8:actor,12:a['method'],16:victim});p['input']=a;rows.append(p)
+    write_json(Path('docs/research/qvm-method-stat-updates.json'),{'source':q['source'],'sha256':q['sha256'],'tracked_offsets':OFFSETS,'probes':rows,'limits':'Complete278834 finite methods-1..49, actor1/victim2 or self1, absent actor-1, zero/max counters. Actual278733;279720/279586/285227/283622 captured. Invalid victim/null low-page domains excluded; no aggregate/report/native effect execution.'})
+if __name__=='__main__':main()

scripts/qvm_stat_update_support.py

@@ -0,0 +1,22 @@
+"""278834 counters with actual278733; reporting/aggregate children captured."""
+from qvm_health_effects_support import seed as health_seed,H,CLIENT,A_CLIENT
+from qvm_research_support import constants
+from qvm_trace_support import resume,captured
+from qvm_method_stats_support import method_seed,classify
+from qvm_notification_support import POOL
+T=H+0xf0000
+OFFSETS=sorted(set([856+76*j+k for j in range(19) for k in [60,64]]+list(range(2376,2516,4))))
+
+def seed(raw,h,**a):
+    m=health_seed(raw,h);m.update(method_seed(raw,h));m.update(constants(raw,h,range(31532,31684,4)));m[POOL+880+520]=A_CLIENT;m[POOL+1760+520]=CLIENT
+    for c in [CLIENT,A_CLIENT]:
+        for o in OFFSETS:m[c+o]=a.get('initial',0)
+    return m
+
+def update(ins,m,args):
+    for o,v in args.items():m[T+52+o]=v
+    addresses=sorted({c+o for c in [CLIENT,A_CLIENT] for o in OFFSETS});before={a:m[a]&0xffffffff for a in addresses};requests=[]
+    hs={c:captured(c,requests) for c in [279720,279586,285227,283622]};hs[278733]=classify
+    m,e=resume(ins,278835,279584,m,T,handlers=hs)
+    changes=[{'client':'actor' if a>=A_CLIENT and a<A_CLIENT+7000 else 'victim','offset':a-(A_CLIENT if a>=A_CLIENT and a<A_CLIENT+7000 else CLIENT),'before':before[a],'after':m[a]&0xffffffff} for a in addresses if before[a]!=(m[a]&0xffffffff)]
+    return m,0,{'arguments':args,'changes':changes,'requests':requests,'execution':e}

scripts/test_qvm_method_stat_updates.py

@@ -0,0 +1,30 @@
+import json,unittest
+from pathlib import Path
+from test_qvm_method_stat_slots import SLOTS
+from qvm_notification_support import POOL
+
+def expected(a):
+    if a.get('actor_absent'):return [],[]
+    method=a['method'];slot=SLOTS.get(method,-1);items=[];pair=False;self_hit=a['self'];victim='actor' if self_hit else 'victim'
+    if slot>=0:items=[('actor',916+76*slot),(victim,920+76*slot)];pair=True
+    elif method in [0,1,2,3,4,5,8,9]:items=[(victim,2512)]
+    elif method in {6:2488,7:2492,31:2504,32:2508,33:2508,35:2508,47:2496}:items=[(victim,{6:2488,7:2492,31:2504,32:2508,33:2508,35:2508,47:2496}[method])]
+    elif method in [22,25] and self_hit:items=[(victim,2460 if method==22 else 2452)]
+    elif method in [12,13,22,23,24,25,34,37,48]:
+        x,y={12:(2396,2468),13:(2400,2472),22:(2384,2456),23:(2408,2480),24:(2404,2476),25:(2376,2448),34:(2428,2500),37:(2392,2464),48:(2412,2484)}[method];items=[('actor',x),(victim,y)];pair=method!=34
+    changes=[{'client':c,'offset':o,'before':a['initial'],'after':(a['initial']+1)&0xffffffff} for c,o in items];changes.sort(key=lambda r:(0 if r['client']=='victim' else 1,r['offset']))
+    return changes,([279720] if pair else [])+[279586,279586,285227,283622]
+class MethodStatUpdateTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.ps=json.loads(Path('docs/research/qvm-method-stat-updates.json').read_text())['probes']
+    def test_independent_counter_and_callback_oracle(self):
+        for p in self.ps:
+            changes,calls=expected(p['input']);self.assertEqual(p['changes'],changes,p['input']);self.assertEqual([c['target'] for c in p['requests']],calls,p['input'])
+    def test_self_alias_and_unsigned_wrap_coverage(self):
+        self.assertEqual(len(self.ps),205);self.assertTrue(any(p['input']['self'] and p['changes'] for p in self.ps));self.assertTrue(any(c['after']==0 for p in self.ps for c in p['changes']))
+    def test_complete_exit_and_identifier_notification_abi(self):
+        for p in self.ps:
+            self.assertEqual(p['execution']['stop'],279584)
+            for c in p['requests']:
+                if c['target']==285227:self.assertEqual(c['arguments'],{'8':1 if p['input']['self'] else 2,'12':1})
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -1230,3 +1230,6 @@ group	notifications	scripts/analyze_qvm_client_notifications.py
 report	scripts/analyze_qvm_method_stat_slots.py	docs/research/qvm-method-stat-slots.json
 edge	docs/research/qvm-method-stat-slots.json	scripts/test_qvm_method_stat_slots.py
 group	stat-slots	scripts/analyze_qvm_method_stat_slots.py
+report	scripts/analyze_qvm_method_stat_updates.py	docs/research/qvm-method-stat-updates.json
+edge	docs/research/qvm-method-stat-updates.json	scripts/test_qvm_method_stat_updates.py
+group	stat-updates	scripts/analyze_qvm_method_stat_updates.py