qvm: recover complete bomb defuse callback

docs/FINDINGS.md

@@ -1977,3 +1977,5 @@ RE-1017: Rust matches48 far/unflagged cancellation cases. Any nonzero busy state
 RE-1018: Thirty-two source cases recover active completion when signed wrapped elapsed reaches duration*1000, including equality, negative duration and overflow. Waiting preserves every field. Completion logs first, latches35000396=1, clears clock/busy and owned flags, allocates event84 payload1 with mask32, then requests teleport205260 and award283463 value5. Weapon/animation and neighboring event fields survive. Native nested effects remain captured or supplied. [Evidence](research/QVM_DEFUSE_FINISH.md).
 
 RE-1019: Rust matches32 active source completion cases with signed wrapped elapsed/duration arithmetic and equality completion. The original log/event84/teleport/award order is preserved as plans. Inactive selected state reuses start policy; waiting avoids unused index evaluation, while ready invalid client indices reject before mutation. Unit cases cover exact and wrapped completion, high-bit preservation and waiting/error atomicity. [Evidence](research/RUST_DEFUSE_FINISH.md).
+
+RE-1020: Ninety-six source scenarios connect original admission/teammate scan to actual276433 bomb hash lookup and65655 distance, then start/wait/cancel/complete transitions. Three selectors, radius75 equality, zero/64 teammate counts, inactive/classless/hash-mismatched decoys, wrapped time, completed latch and missing bomb are covered. Missing lookup stops before original2319 fatal handler. Native sqrt is modeled; event/native effect feedback is captured or supplied, not executed. [Evidence](research/QVM_DEFUSE_COMPLETE.md).

docs/PROVISIONAL_TODO.md

@@ -2036,3 +2036,5 @@ RE-974–983 completed routing, command rewrite, inactivity, movement-parameter
 - [x] RE-1018 Recover timed bomb-defuse completion and effect order ([evidence](research/QVM_DEFUSE_FINISH.md)).
 
 - [x] RE-1019 Port timed bomb-defuse completion and captured effects ([evidence](research/RUST_DEFUSE_FINISH.md)).
+
+- [x] RE-1020 Recover complete mode8 bomb-defuse callback ([evidence](research/QVM_DEFUSE_COMPLETE.md)).

docs/RESEARCH_LEDGER.md

@@ -2751,3 +2751,7 @@ Thirty-two source cases recover active completion when signed wrapped elapsed re
 ## 2026-10-29 — RE-1019 Port timed bomb-defuse completion and captured effects
 
 Rust matches32 active source completion cases with signed wrapped elapsed/duration arithmetic and equality completion. The original log/event84/teleport/award order is preserved as plans. Inactive selected state reuses start policy; waiting avoids unused index evaluation, while ready invalid client indices reject before mutation. Unit cases cover exact and wrapped completion, high-bit preservation and waiting/error atomicity. Focused `cargo xtask test-group rust-defuse-finish` passes with deterministic report regeneration and selected regressions. Full suite deferred to task ten. Original assets unchanged; Python uses the flake-declared Nix runtime.
+
+## 2026-10-29 — RE-1020 Recover complete mode8 bomb-defuse callback
+
+Ninety-six source scenarios connect original admission/teammate scan to actual276433 bomb hash lookup and65655 distance, then start/wait/cancel/complete transitions. Three selectors, radius75 equality, zero/64 teammate counts, inactive/classless/hash-mismatched decoys, wrapped time, completed latch and missing bomb are covered. Missing lookup stops before original2319 fatal handler. Native sqrt is modeled; event/native effect feedback is captured or supplied, not executed. Focused `cargo xtask test-group qvm-defuse-complete` passes with deterministic report regeneration and selected regressions. Full suite deferred to task ten. Original assets unchanged; Python uses the flake-declared Nix runtime.

docs/REVERSE_ENGINEERING_TODO.md

@@ -2073,3 +2073,5 @@ RE-974–983 recover routing, command rewriting, inactivity and composed setup t
 - [x] RE-1018 Recover timed bomb-defuse completion and effect order ([evidence](research/QVM_DEFUSE_FINISH.md)).
 
 - [x] RE-1019 Port timed bomb-defuse completion and captured effects ([evidence](research/RUST_DEFUSE_FINISH.md)).
+
+- [x] RE-1020 Recover complete mode8 bomb-defuse callback ([evidence](research/QVM_DEFUSE_COMPLETE.md)).

docs/research/QVM_DEFUSE_COMPLETE.md

@@ -0,0 +1,5 @@
+# Recover complete mode8 bomb-defuse callback
+
+RE-1020. Focused validation: `cargo xtask test-group qvm-defuse-complete`. [Machine report](qvm-defuse-complete.json).
+
+Ninety-six source scenarios connect original admission/teammate scan to actual276433 bomb hash lookup and65655 distance, then start/wait/cancel/complete transitions. Three selectors, radius75 equality, zero/64 teammate counts, inactive/classless/hash-mismatched decoys, wrapped time, completed latch and missing bomb are covered. Missing lookup stops before original2319 fatal handler. Native sqrt is modeled; event/native effect feedback is captured or supplied, not executed.

docs/research/README.md

@@ -1605,3 +1605,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 - [RE-1018: Recover timed bomb-defuse completion and effect order](QVM_DEFUSE_FINISH.md).
 
 - [RE-1019: Port timed bomb-defuse completion and captured effects](RUST_DEFUSE_FINISH.md).
+
+- [RE-1020: Recover complete mode8 bomb-defuse callback](QVM_DEFUSE_COMPLETE.md).

docs/research/qvm-resumer-audit.json

@@ -8939,6 +8939,100 @@
       "repeated_calls_opt_in": true,
       "repeated_calls_setting": "literal_true"
     },
+    {
+      "backward_conditional_branches": [
+        153595
+      ],
+      "calls": [
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": 56,
+          "instruction": 153602,
+          "stores_result": true,
+          "target": 276433
+        },
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": null,
+          "instruction": 153615,
+          "stores_result": false,
+          "target": 2319
+        },
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": 60,
+          "instruction": 153629,
+          "stores_result": true,
+          "target": 65655
+        },
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": null,
+          "instruction": 153670,
+          "stores_result": false,
+          "target": 7259
+        },
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": 72,
+          "instruction": 153721,
+          "stores_result": true,
+          "target": 277695
+        },
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": null,
+          "instruction": 153762,
+          "stores_result": false,
+          "target": 205260
+        },
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": null,
+          "instruction": 153770,
+          "stores_result": false,
+          "target": 283463
+        },
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": 84,
+          "instruction": 153890,
+          "stores_result": true,
+          "target": 277695
+        },
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": null,
+          "instruction": 153923,
+          "stores_result": false,
+          "target": 193620
+        },
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": 72,
+          "instruction": 153980,
+          "stores_result": true,
+          "target": 277695
+        },
+        {
+          "dynamic_store_requires_review": false,
+          "implicit_local_offset": 72,
+          "instruction": 154061,
+          "stores_result": true,
+          "target": 277695
+        }
+      ],
+      "explicit_result_offsets": null,
+      "helper": "qvm_trace_support.resume",
+      "line": 120,
+      "literal_range": [
+        153420,
+        154088
+      ],
+      "path": "scripts/qvm_defuse_support.py",
+      "repeated_calls_opt_in": true,
+      "repeated_calls_setting": "literal_true"
+    },
     {
       "backward_conditional_branches": [],
       "calls": [],
@@ -10546,7 +10640,7 @@
     }
   },
   "summary": {
-    "call_expressions": 213,
+    "call_expressions": 214,
     "files": 163,
     "legacy_expressions": 158,
     "nonliteral_ranges": 31,

scripts/analyze_qvm_defuse_complete.py

@@ -0,0 +1,12 @@
+"""Verified original movement-context source contract."""
+from pathlib import Path
+from analyze_qvm import write_json
+from qvm_research_support import source
+from qvm_defuse_support import seed,full,full_fixtures
+
+def main():
+ q,raw,h,ins=source();probes=[]
+ for a in full_fixtures():
+  m,b=seed(raw,h,a);m,p,b=full(ins,m,b,a);p['input']=a;probes.append(p)
+ write_json(Path('docs/research/qvm-defuse-complete.json'),dict(source=q['source'],sha256=q['sha256'],probes=probes,limits='Complete153419 effects through154087 or missing-bomb fatal boundary153612, with actual276433 and65655; finite native sqrt modeled. Event allocation supplied and log/sound/teleport/award captured.'))
+if __name__=='__main__':main()

scripts/qvm_defuse_oracle.py

@@ -18,3 +18,16 @@ def finish(a):
  if signed((a['tick']-a['clock'])&0xffffffff)>=signed((a['duration']*1000)&0xffffffff):
   out.update(flags=a['flags']&~4,flags104=a['flags104']&~16,busy=0,clock=0,complete=1,event=[1,0x80000021],events=[dict(op='log',format=b'Bomb was defused by %i!\n'.hex(),slot=2),dict(op='allocate',event=84),dict(op='teleport',slot=2),dict(op='award',slot=2,value=5)])
  return out
+
+from qvm_move_callbacks_oracle import word,f32
+def full(a):
+ from qvm_move_callbacks_oracle import eligibility
+ gate=eligibility(dict(a,own_busy=a['busy']))['eligible'];out=initial(a);out.update(events=[],lookups=[],distances=[],missing=False)
+ if not gate:return out
+ bomb=None if a['bomb_missing'] else 5 if a['bomb_first'] else 4;out['lookups']=[bomb]
+ if bomb is None:out['missing']=True;return out
+ d=f32(a['distance'] if bomb==4 else 30.);distance=f32(__import__('math').sqrt(f32(d*d)));out['distances']=[word(distance)]
+ if distance>=75 or not a['flags']&32768:out.update(cancel(a))
+ elif a['busy']:out.update(finish(a))
+ else:out.update(begin(a))
+ return out

scripts/qvm_defuse_support.py

@@ -19,7 +19,7 @@ def state_seed(m,a):
  m.update({CLIENT+220:a['flags'],CLIENT+104:a['flags104'],CLIENT+6164:a['busy'],35000484:a['clock'],35000396:a['complete'],CLIENT+148:a['animation'],CLIENT+144:a['index'],CLIENT+312+4*a['index']:a['weapon'],34992532:a['tick'],34080132:a['duration'],ALLOC+184:7,ALLOC+180:0xaabbccdd,ALLOC+188:0x11223344})
 def handlers(events):
  def allocate(i,m,a,b):
-  assert a[8]==BOMB+24 and a[12] in [83,84]
+  assert a[8]==m[BASE+32]+24 and a[12] in [83,84]
   events.append(dict(op='allocate',event=a[12]));return m,ALLOC,{'supplied_event_entity':True}
  def sound(i,m,a,b):
   assert a[8]==7 and a[12]==ENTITY
@@ -48,3 +48,75 @@ def finish_fixtures():
  from itertools import product
  return [dict(defaults(),busy=1,flags=f,tick=tick,clock=clock,duration=d) for f,(tick,clock),d in product([0x80008004,0xffffffff],[(10000,5000),(10000,5001),(10000,10001),(10,0xfffffff0)],[0,5,0xffffffff,0x80000000])]
 def finish(ins,m,b,a):return fragment(ins,m,b,a,153644)
+
+import math,copy
+HASH=(-82007226)&0xffffffff
+
+def full_fixtures():
+ profiles=list(range(32));rows=[]
+ for profile in profiles:
+  for selector in [0,1,2]:
+   a=dict(defaults(),profile=profile,entity=1,client=1,enabled_a=1,enabled_b=1,start=8000,delay=1,connection=2,health=1,follow=0,team=0,other_busy=0,other_connection=2,other_health=1,other_follow=0,other_team=0,count=3,busy_slot=0,selector=selector,distance=10.,bomb_first=0,bomb_missing=0)
+   if profile==1:a['busy']=1;a['clock']=9000
+   if profile==2:a['busy']=1;a['clock']=5000
+   if profile==3:a['distance']=75.;a['busy']=1
+   if profile==4:a['distance']=74.999
+   if profile==5:a['flags']&=~32768;a['busy']=1
+   if profile==6:a['enabled_a']=0
+   if profile==7:a['enabled_b']=0
+   if profile==8:a['start']=9000
+   if profile==9:a['complete']=1;a['busy']=1
+   if profile==10:a['connection']=1
+   if profile==11:a['health']=0
+   if profile==12:a['follow']=1
+   if profile==13:a['team']=3
+   if profile==14:a['entity']=0
+   if profile==15:a['client']=0
+   if profile==16:a['other_busy']=1
+   if profile==17:a['other_busy']=1;a['other_health']=0
+   if profile==18:a['other_busy']=1;a['other_follow']=1
+   if profile==19:a['other_busy']=1;a['other_connection']=1
+   if profile==20:a['other_busy']=1;a['other_team']=3
+   if profile==21:a['count']=0;a['other_busy']=1
+   if profile==22:a['count']=64;a['other_busy']=1;a['busy_slot']=63
+   if profile==23:a['bomb_first']=1
+   if profile==24:a['bomb_first']=2
+   if profile==25:a['bomb_first']=3
+   if profile==26:a['bomb_missing']=1
+   if profile==27:a['tick']=10;a['start']=0xfffff000;a['busy']=1;a['clock']=0xfffffff0;a['duration']=0
+   if profile==28:a['duration']=0xffffffff;a['busy']=1
+   if profile==29:a['duration']=0;a['busy']=0
+   if profile==30:a['flags']&=~32
+   if profile==31:a['busy']=0;a['flags']=0x80008040
+   rows.append(a)
+ return rows
+
+def full_seed(m,b,a):
+ from qvm_move_callbacks_support import eligibility_seed
+ eligibility_seed(m,dict(a,own_busy=a['busy']));state_seed(m,a)
+ m[34992508]=6
+ for j in range(6):
+  e=POOL+880*j;m.update({e+532:1,e+536:1,e+540:0})
+ for j in [4,5]:
+  e=POOL+880*j;m[e+540]=HASH
+  for k in range(3):m[e+24+4*k]=word((a['distance'] if j==4 else 30.) if k==0 else 0.)
+ for k in range(3):m[ENTITY+488+4*k]=word(0.)
+ if a['bomb_first']==1:m[BOMB+532]=0
+ if a['bomb_first']==2:m[BOMB+536]=0
+ if a['bomb_first']==3:m[BOMB+540]=0
+ if a['bomb_missing']:m[BOMB+540]=0;m[BOMB+880+540]=0
+
+def full_run(ins,m,b,a):
+ events=[];lookups=[];distances=[]
+ def lookup(i,m,args,bs):
+  assert args[8]==0 and (args[12]&0xffffffff)==HASH
+  m,value,p,b=find_class(i,m,args,dict(bs),base=ROOT+0xf0000)
+  lookups.append(None if not value else (value-POOL)//880);return m,value,{'actual_source_child':276433}
+ def distance(i,m,args,bs):
+  def sqrt(i,m,args,b):return m,word(math.sqrt(number(args[8]))),{'modeled_native_sqrt':True}
+  m,value,p,b=run(i,m,65655,65728,40,args,dict(bs),{-107:sqrt},base=ROOT+0x100000)
+  distances.append(value&0xffffffff);return m,value,{'actual_source_child':65655}
+ m,b=frame_args(m,b,{BASE+100:ENTITY if a['entity'] else 0})
+ m,p=resume(ins,153420,154088,m,BASE,boundaries=(153612,154087),handlers={**handlers(events),276433:lookup,65655:distance},byte_inputs=b,repeated_calls=True,sync_child_words=True,coherent_memory=True,byte_handlers=True,capture_byte_memory=True,limit=32768)
+ return m,dict(**view(m,a),events=events,lookups=lookups,distances=distances,missing=p['stop']==153612,execution={k:p[k] for k in ['stop','trace_length','trace_sha256']}),p['byte_memory']
+def full(ins,m,b,a):full_seed(m,b,a);return full_run(ins,m,b,a)

scripts/test_qvm_defuse_complete.py

@@ -0,0 +1,13 @@
+import json,unittest
+from pathlib import Path
+from qvm_defuse_oracle import full
+class OriginalTests(unittest.TestCase):
+ def test_original_contract(self):
+  rows=json.loads(Path('docs/research/qvm-defuse-complete.json').read_text())['probes'];self.assertEqual(len(rows),96)
+  for p in rows:
+   with self.subTest(input=p['input']):
+    for k,v in full(p['input']).items():self.assertEqual(p[k],v,k)
+ def test_fixture_identity_and_trace(self):
+  r=json.loads(Path('docs/research/qvm-defuse-complete.json').read_text());self.assertEqual(len(r['sha256']),64)
+  self.assertTrue(all(p['execution']['trace_length']>0 for p in r['probes']))
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -4242,3 +4242,7 @@ edge	crates/urt-gameplay/src/move_callbacks.rs	scripts/analyze_rust_defuse_finis
 edge	crates/urt-gameplay/src/defuse.rs	scripts/analyze_rust_defuse_finish.py
 edge	crates/urt-gameplay/src/bin/urt-defuse.rs	scripts/analyze_rust_defuse_finish.py
 edge	crates/urt-gameplay/src/move_callbacks.rs	scripts/analyze_rust_defuse_finish.py
+report	scripts/analyze_qvm_defuse_complete.py	docs/research/qvm-defuse-complete.json
+edge	docs/research/qvm-defuse-complete.json	scripts/test_qvm_defuse_complete.py
+group	qvm-defuse-complete	scripts/analyze_qvm_defuse_complete.py
+edge	scripts/analyze_qvm_defuse_complete.py	scripts/analyze_qvm_resumer_audit.py