gameplay: port timer countdown and recovery ordering

crates/urt-gameplay/src/client_timer.rs

@@ -118,7 +118,7 @@ pub struct TimerDamage {
     pub means: u32,
     pub weapon: u32,
 }
-/// Original150810 loop subset with flag512 disabled. Damage effects are requests;
+/// Original150810 complete finite-domain loop. Damage effects are requests;
 /// supplied health is deliberately unchanged. Rate0 aliases the preceding word.
 pub fn timer_tick_loop(
     state: &mut TimerLoopState,
@@ -127,9 +127,15 @@ pub fn timer_tick_loop(
     if state.rate > 5 {
         return Err(Error::InvalidIndex);
     }
-    if state.flags & 512 != 0 || state.residual as i32 > 10000 {
+    if state.residual as i32 > 10000 {
         return Err(Error::InvalidInput);
     }
+    if state.residual as i32 >= 100
+        && state.flags & 512 != 0
+        && !f32::from_bits(state.timer).is_finite()
+    {
+        return Err(Error::NonFinite);
+    }
     let mut next = *state;
     let mut damage = vec![];
     while next.residual as i32 >= 100 {
@@ -149,6 +155,26 @@ pub fn timer_tick_loop(
                 weapon: input.weapon,
             });
         }
+        if next.flags & 512 != 0 {
+            let mut timer = f32::from_bits(next.timer);
+            if next.flags & 256 != 0 && timer <= 0.0 {
+                next.flags &= !256;
+                next.rate = 0;
+                timer = 0.0;
+            }
+            if timer > 0.0 {
+                timer -= 0.1f32;
+                if timer <= 0.0 {
+                    next.flags &= !256;
+                    next.rate = 0;
+                    timer = 0.0;
+                }
+            } else if next.flags & 128 != 0 {
+                next.flags &= !128;
+                next.status &= !1;
+            }
+            next.timer = timer.to_bits();
+        }
     }
     *state = next;
     Ok(damage)
@@ -216,3 +242,54 @@ mod tick_tests {
         assert_eq!(s, old);
     }
 }
+
+#[cfg(test)]
+mod recovery_tests {
+    use super::*;
+    fn input() -> TimerLoopInput {
+        TimerLoopInput {
+            health: 1,
+            weapon: 7,
+            target: 2,
+            owner: 3,
+        }
+    }
+    #[test]
+    fn zero_crossing_delays_secondary_cleanup_and_switches_divisor() {
+        let mut s = TimerLoopState {
+            flags: 896,
+            status: 3,
+            rate: 2,
+            phase: 3,
+            timer: 0.05f32.to_bits(),
+            residual: 100,
+        };
+        let p = timer_tick_loop(&mut s, input()).unwrap();
+        assert_eq!(p.len(), 1);
+        assert_eq!(
+            [s.flags, s.status, s.rate, s.phase, s.timer],
+            [640, 3, 0, 0, 0]
+        );
+        s.residual = 100;
+        timer_tick_loop(&mut s, input()).unwrap();
+        assert_eq!([s.flags, s.status, s.rate, s.phase], [512, 2, 0, 1]);
+    }
+    #[test]
+    fn initial_nonpositive_timer_cleans_immediately_and_nonfinite_rejects_atomically() {
+        let mut s = TimerLoopState {
+            flags: 896,
+            status: 3,
+            rate: 2,
+            phase: 3,
+            timer: (-0.1f32).to_bits(),
+            residual: 100,
+        };
+        timer_tick_loop(&mut s, input()).unwrap();
+        assert_eq!([s.flags, s.status, s.rate, s.timer], [512, 2, 0, 0]);
+        s.timer = f32::NAN.to_bits();
+        s.residual = 100;
+        let old = s;
+        assert_eq!(timer_tick_loop(&mut s, input()), Err(Error::NonFinite));
+        assert_eq!(s, old);
+    }
+}

docs/FINDINGS.md

@@ -1869,3 +1869,5 @@ RE-966: A288-case source loop contract covers signed residual thresholds, wrappi
 RE-967: Rust matches288 original tick-loop cases with signed residual/remainder and wrapping phase behavior. Rate0 retains the preceding-word divisor1120403456. Typed damage requests retain all source arguments without mutating supplied health. Unit tests cover alias behavior, signed wrap, exact request ABI and atomic invalid-rate rejection. Flag512 is deliberately outside this first loop subset; the residual budget bounds execution. [Evidence](research/RUST_CLIENT_TIMER_TICKS.md).
 
 RE-968: A216-case source contract extends the tick loop through flags512/256/128 and f32 subtraction of0.1. Crossing zero resets flag256/rate/timer but delays secondary flag128/status cleanup until a later tick; initially nonpositive timers can clear immediately. Reset rate0 changes later modulo through the preceding-word alias. Damage stays captured and health supplied; nonfinite/unsafe table domains remain open. [Evidence](research/QVM_CLIENT_TIMER_RECOVERY.md).
+
+RE-969: Rust matches216 original full-loop cases with repeated f32 subtraction, delayed secondary cleanup, raw flag/status preservation and rate0 divisor switching. The existing tick API now supports flag512 through these recovered branches. Unit tests cover countdown crossing versus initial nonpositive cleanup and atomic nonfinite rejection; damage effects remain requests against supplied health. [Evidence](research/RUST_CLIENT_TIMER_RECOVERY.md).

docs/PROVISIONAL_TODO.md

@@ -1921,3 +1921,5 @@ RE-954–963 completed add/remove wrappers, resolved duration export, full-capac
 - [x] RE-967 Rust100ms phase loop and captured damage requests ([evidence](research/RUST_CLIENT_TIMER_TICKS.md)).
 
 - [x] RE-968 Original float countdown and flag-recovery loop ([evidence](research/QVM_CLIENT_TIMER_RECOVERY.md)).
+
+- [x] RE-969 Rust float countdown and ordered flag recovery ([evidence](research/RUST_CLIENT_TIMER_RECOVERY.md)).

docs/RESEARCH_LEDGER.md

@@ -2543,3 +2543,7 @@ Rust matches288 original tick-loop cases with signed residual/remainder and wrap
 ## 2026-10-28 — RE-968 Original float countdown and flag-recovery loop
 
 A216-case source contract extends the tick loop through flags512/256/128 and f32 subtraction of0.1. Crossing zero resets flag256/rate/timer but delays secondary flag128/status cleanup until a later tick; initially nonpositive timers can clear immediately. Reset rate0 changes later modulo through the preceding-word alias. Damage stays captured and health supplied; nonfinite/unsafe table domains remain open. Focused `cargo xtask test-group qvm-client-timer-recovery` passes with deterministic report regeneration, relevant regressions and storage/documentation/whitespace checks. Full suite deferred to the tenth-commit boundary. Original assets unchanged; native IO effects remain captured.
+
+## 2026-10-28 — RE-969 Rust float countdown and ordered flag recovery
+
+Rust matches216 original full-loop cases with repeated f32 subtraction, delayed secondary cleanup, raw flag/status preservation and rate0 divisor switching. The existing tick API now supports flag512 through these recovered branches. Unit tests cover countdown crossing versus initial nonpositive cleanup and atomic nonfinite rejection; damage effects remain requests against supplied health. Focused `cargo xtask test-group rust-client-timer-recovery` passes with deterministic report regeneration, relevant regressions and storage/documentation/whitespace checks. Full suite deferred to the tenth-commit boundary. Original assets unchanged; native IO effects remain captured.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1958,3 +1958,5 @@ RE-954–963 recover bounded command wrappers, resolved duration export, full-ca
 - [x] RE-967 Rust100ms phase loop and captured damage requests ([evidence](research/RUST_CLIENT_TIMER_TICKS.md)).
 
 - [x] RE-968 Original float countdown and flag-recovery loop ([evidence](research/QVM_CLIENT_TIMER_RECOVERY.md)).
+
+- [x] RE-969 Rust float countdown and ordered flag recovery ([evidence](research/RUST_CLIENT_TIMER_RECOVERY.md)).

docs/research/README.md

@@ -1493,3 +1493,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 - [RE-967: Rust100ms phase loop and captured damage requests](RUST_CLIENT_TIMER_TICKS.md).
 
 - [RE-968: Original float countdown and flag-recovery loop](QVM_CLIENT_TIMER_RECOVERY.md).
+
+- [RE-969: Rust float countdown and ordered flag recovery](RUST_CLIENT_TIMER_RECOVERY.md).

docs/research/RUST_CLIENT_TIMER_RECOVERY.md

@@ -0,0 +1,5 @@
+# Rust float countdown and ordered flag recovery
+
+RE-969. Focused validation: `cargo xtask test-group rust-client-timer-recovery`. [Machine report](rust-client-timer-recovery.json).
+
+Rust matches216 original full-loop cases with repeated f32 subtraction, delayed secondary cleanup, raw flag/status preservation and rate0 divisor switching. The existing tick API now supports flag512 through these recovered branches. Unit tests cover countdown crossing versus initial nonpositive cleanup and atomic nonfinite rejection; damage effects remain requests against supplied health.

docs/research/RUST_CLIENT_TIMER_TICKS.md

@@ -3,3 +3,5 @@
 RE-967. Focused validation: `cargo xtask test-group rust-client-timer-ticks`. [Machine report](rust-client-timer-ticks.json).
 
 Rust matches288 original tick-loop cases with signed residual/remainder and wrapping phase behavior. Rate0 retains the preceding-word divisor1120403456. Typed damage requests retain all source arguments without mutating supplied health. Unit tests cover alias behavior, signed wrap, exact request ABI and atomic invalid-rate rejection. Flag512 is deliberately outside this first loop subset; the residual budget bounds execution.
+
+RE-969 extends the same Rust loop API through flag512 and float-countdown branches; see [recovery parity](RUST_CLIENT_TIMER_RECOVERY.md). The earlier288-case subset remains a regression.

docs/research/rust-health-impulse.json

@@ -2985,7 +2985,7 @@
       "exit_code": 2
     }
   ],
-  "rust_unit_tests": 224,
+  "rust_unit_tests": 226,
   "source_report": "docs/research/qvm-health-impulse.json",
   "source_report_sha256": "625fd8064004ea6dbdf398d51d0af844d9c635ff04c0a0790886dddb6ab81e71"
 }

scripts/analyze_rust_client_timer_recovery.py

@@ -0,0 +1,18 @@
+"""Compare recovered Rust policy with original QVM fixtures."""
+import hashlib,json,os,subprocess
+from pathlib import Path
+from analyze_qvm import write_json
+from rust_lifecycle_support import result
+
+def main():
+ subprocess.run(['cargo','build','--offline','--package','urt-gameplay','--bin','urt-client-timer'],check=True,capture_output=True)
+ binary=Path(os.environ.get('CARGO_TARGET_DIR','target'))/'debug'/'urt-client-timer'
+ path=Path('docs/research/qvm-client-timer-recovery.json');data=path.read_bytes();probes=[]
+ for p in json.loads(data)['probes']:
+  probes.append(dict(source={k:p[k] for k in ['damage', 'state', 'health']},rust=result(binary,'tick',encode(p['input']))))
+ write_json(Path('docs/research/rust-client-timer-recovery.json'),dict(source_report=str(path),source_report_sha256=hashlib.sha256(data).hexdigest(),probes=probes,limits='Finite source/Rust contract parity; native time/file/network replies remain supplied or captured.'))
+
+def encode(a):
+ from analyze_qvm_acceleration import word
+ return [a['flags'],a['status'],a['rate'],a['phase'],word(a['timer']),a['residual'],a['health'],a['weapon']]
+if __name__=='__main__':main()

scripts/test_rust_client_timer_recovery.py

@@ -0,0 +1,9 @@
+import hashlib,json,unittest
+from pathlib import Path
+class PortTests(unittest.TestCase):
+ def test_original_parity(self):
+  r=json.loads(Path('docs/research/rust-client-timer-recovery.json').read_text());self.assertGreaterEqual(len(r['probes']),12)
+  for p in r['probes']:self.assertEqual(p['source'],p['rust'])
+ def test_identity(self):
+  r=json.loads(Path('docs/research/rust-client-timer-recovery.json').read_text());self.assertEqual(hashlib.sha256(Path(r['source_report']).read_bytes()).hexdigest(),r['source_report_sha256'])
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -3470,3 +3470,23 @@ report	scripts/analyze_qvm_client_timer_recovery.py	docs/research/qvm-client-tim
 edge	docs/research/qvm-client-timer-recovery.json	scripts/test_qvm_client_timer_recovery.py
 group	qvm-client-timer-recovery	scripts/analyze_qvm_client_timer_recovery.py
 edge	scripts/analyze_qvm_client_timer_recovery.py	scripts/analyze_qvm_resumer_audit.py
+report	scripts/analyze_rust_client_timer_recovery.py	docs/research/rust-client-timer-recovery.json
+edge	docs/research/rust-client-timer-recovery.json	scripts/test_rust_client_timer_recovery.py
+group	rust-client-timer-recovery	scripts/analyze_rust_client_timer_recovery.py
+edge	scripts/analyze_rust_client_timer_recovery.py	scripts/analyze_qvm_resumer_audit.py
+edge	Cargo.toml	scripts/analyze_rust_client_timer_recovery.py
+edge	Cargo.lock	scripts/analyze_rust_client_timer_recovery.py
+edge	crates/urt-gameplay/Cargo.toml	scripts/analyze_rust_client_timer_recovery.py
+edge	crates/urt-gameplay/src/lib.rs	scripts/analyze_rust_client_timer_recovery.py
+edge	crates/urt-gameplay/src/filter_loading.rs	scripts/analyze_rust_client_timer_recovery.py
+edge	crates/urt-gameplay/src/filter_lifecycle.rs	scripts/analyze_rust_client_timer_recovery.py
+edge	crates/urt-gameplay/src/native_policy.rs	scripts/analyze_rust_client_timer_recovery.py
+edge	crates/urt-gameplay/src/bin/urt-filter-loading.rs	scripts/analyze_rust_client_timer_recovery.py
+edge	crates/urt-gameplay/src/qvm_format.rs	scripts/analyze_rust_client_timer_recovery.py
+edge	docs/research/qvm-client-timer-recovery.json	scripts/analyze_rust_client_timer_recovery.py
+group	rust-client-timer-recovery	scripts/analyze_rust_health_impulse.py
+group	gameplay	scripts/analyze_rust_client_timer_recovery.py
+edge	crates/urt-gameplay/src/filter_commands.rs	scripts/analyze_rust_client_timer_recovery.py
+edge	crates/urt-gameplay/src/bin/urt-filter-commands.rs	scripts/analyze_rust_client_timer_recovery.py
+edge	crates/urt-gameplay/src/client_timer.rs	scripts/analyze_rust_client_timer_recovery.py
+edge	crates/urt-gameplay/src/bin/urt-client-timer.rs	scripts/analyze_rust_client_timer_recovery.py