gameplay: preserve filter export reload losses

crates/urt-gameplay/src/bin/urt-filter-loading.rs

@@ -63,6 +63,7 @@ fn main() {
         }
         "load" => println!("{}", loading(&w)),
         "duration" => println!("{}", duration(&w)),
+        "roundtrip" => println!("{}", roundtrip(&w)),
         _ => panic!("unknown policy"),
     }
 }
@@ -240,3 +241,71 @@ fn duration(w: &[u32]) -> String {
         effects, updates, ring, rows
     )
 }
+
+fn exported_json(p: Option<urt_gameplay::filter_lifecycle::FilterExport>) -> String {
+    let Some(p) = p else {
+        return r#"{"events":[],"formats":[],"buffer":"7374616c65"}"#.into();
+    };
+    use urt_gameplay::filter_lifecycle::FilterFileEffect;
+    let events = p
+        .effects()
+        .iter()
+        .map(|e| match e {
+            FilterFileEffect::Print(t) => format!(r#"{{"op":"print","text":"{}"}}"#, hex(t)),
+            FilterFileEffect::Open { path, mode } => {
+                format!(r#"{{"op":"open","path":"{}","mode":{}}}"#, hex(path), mode)
+            }
+            FilterFileEffect::Write { handle, bytes } => format!(
+                r#"{{"op":"write","handle":{},"text":"{}"}}"#,
+                handle,
+                hex(bytes)
+            ),
+            FilterFileEffect::Close(h) => format!(r#"{{"op":"close","handle":{}}}"#, h),
+        })
+        .collect::<Vec<_>>()
+        .join(",");
+    let formats = p
+        .lines
+        .iter()
+        .map(|l| format!("\"{}\"", hex(l)))
+        .collect::<Vec<_>>()
+        .join(",");
+    format!(
+        r#"{{"events":[{}],"formats":[{}],"buffer":"{}"}}"#,
+        events,
+        formats,
+        hex(&p.text)
+    )
+}
+fn roundtrip(w: &[u32]) -> String {
+    let n = w[2] as usize;
+    let mut p = 3;
+    let mut source = vec![];
+    for _ in 0..n {
+        source.push(urt_gameplay::native_policy::FilterRecord {
+            mask: w[p],
+            comparison: w[p + 1],
+            metadata: w[p + 2],
+        });
+        p += 3;
+    }
+    let prior = blob(w, &mut p);
+    assert_eq!(p, w.len());
+    let mut target = vec![
+        urt_gameplay::native_policy::FilterRecord {
+            mask: 0x11223344,
+            comparison: u32::MAX,
+            metadata: 0x99aabbcc
+        };
+        8
+    ];
+    let mut count = if w[1] != 0 { n } else { 0 };
+    target[..count].copy_from_slice(&source[..count]);
+    let p = filter_roundtrip(&source, &mut target, &mut count, &prior, w[0]).unwrap();
+    format!(
+        r#"{{"exported":{},"disk":"{}","loaded":{}}}"#,
+        exported_json(p.exported),
+        hex(&p.disk),
+        load_json(p.loaded, &target, count)
+    )
+}

crates/urt-gameplay/src/filter_loading.rs

@@ -408,3 +408,105 @@ mod duration_tests {
         assert_eq!(ring, 7);
     }
 }
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct FilterRoundtrip {
+    pub exported: Option<crate::filter_lifecycle::FilterExport>,
+    pub disk: Vec<u8>,
+    pub loaded: FilterLoad,
+}
+/// Compose recovered export/load using captured write bytes as the next native
+/// read reply. This models complete transfer, not actual filesystem acceptance.
+/// When export is absent, the caller's prior file is supplied to the loader.
+pub fn filter_roundtrip(
+    source: &[FilterRecord],
+    target: &mut [FilterRecord],
+    count: &mut usize,
+    prior_file: &[u8],
+    handle: u32,
+) -> Result<FilterRoundtrip, Error> {
+    let exported = crate::filter_lifecycle::export_filters(source, handle)?;
+    let disk = exported
+        .as_ref()
+        .map(|p| p.text.as_slice())
+        .unwrap_or(prior_file)
+        .to_vec();
+    if disk.len() > 131071 {
+        return Err(Error::InvalidInput);
+    }
+    let loaded = load_filters(
+        target,
+        count,
+        FilterReadReply {
+            length: disk.len() as i32,
+            handle,
+            delivered: &disk,
+            initial: b"",
+        },
+    )?;
+    Ok(FilterRoundtrip {
+        exported,
+        disk,
+        loaded,
+    })
+}
+#[cfg(test)]
+mod roundtrip_tests {
+    use super::*;
+    fn spare() -> FilterRecord {
+        FilterRecord {
+            mask: 0x11223344,
+            comparison: u32::MAX,
+            metadata: 0x99aabbcc,
+        }
+    }
+    #[test]
+    fn absent_export_reloads_prior_file_but_hole_export_truncates() {
+        let mut target = [spare(); 8];
+        let mut count = 0;
+        let p = filter_roundtrip(&[], &mut target, &mut count, b"9.8.7.6:42\n", 0).unwrap();
+        assert!(p.exported.is_none());
+        assert_eq!(count, 1);
+        assert_eq!(target[0].metadata, 42);
+        count = 0;
+        let p = filter_roundtrip(&[spare()], &mut target, &mut count, b"9.8.7.6:42\n", 0).unwrap();
+        assert!(p.exported.is_some());
+        assert_eq!(count, 0);
+        assert!(p.disk.is_empty());
+    }
+    #[test]
+    fn mask_and_minimum_integer_do_not_round_trip() {
+        let row = FilterRecord {
+            mask: 0,
+            comparison: 0x0100007f,
+            metadata: 0x80000000,
+        };
+        let mut target = [spare(); 8];
+        let mut count = 0;
+        filter_roundtrip(&[row], &mut target, &mut count, b"", 7).unwrap();
+        assert_eq!(target[0].mask, u32::MAX);
+        assert_eq!(target[0].comparison, row.comparison);
+        assert_eq!(target[0].metadata, 0);
+    }
+    #[test]
+    fn retained_duplicates_grow_and_unsupported_prior_file_is_atomic() {
+        let row = FilterRecord {
+            mask: u32::MAX,
+            comparison: 0x04030201,
+            metadata: 7,
+        };
+        let source = [row, FilterRecord { metadata: 8, ..row }];
+        let mut target = [spare(); 8];
+        target[..2].copy_from_slice(&source);
+        let mut count = 2;
+        filter_roundtrip(&source, &mut target, &mut count, b"", 7).unwrap();
+        assert_eq!(count, 4);
+        assert_eq!(target[0].metadata, 8);
+        assert_eq!(target[2].metadata, u32::MAX);
+        assert_eq!(target[3].metadata, u32::MAX);
+        let before = target;
+        assert!(filter_roundtrip(&[], &mut target, &mut count, &[b'1'; 1024], 7).is_err());
+        assert_eq!(target, before);
+        assert_eq!(count, 4);
+    }
+}

docs/FINDINGS.md

@@ -1837,3 +1837,5 @@ RE-950: Eighty actual252213 fixtures compose integer/time/metadata children, pre
 RE-951: Rust matches80 original duration/usage command fixtures, preserving wrapping numeric prefixes, first-match metadata save requests, exact client/console text and formatter-counter wrap. Typed effects preserve time-before-update order; usage skips both. Unit tests cover client-only ring changes, negative duration producing permanent-1 metadata, duplicate preservation and atomic unsupported-address rejection. Native replies remain supplied or captured. [Evidence](research/RUST_FILTER_DURATION.md).
 
 RE-952: Twenty-four actual export/reload compositions transfer captured file bytes through explicit native replies. Empty-table export leaves the prior file intact, whereas all-hole export truncates. Reload loses masks, converts the original INT_MIN formatter punctuation to metadata0, routes duplicate updates to the first match and grows retained tables. Source formatter/parser/load bodies execute; actual filesystem acceptance and unlimited reload/capacity remain open. [Evidence](research/QVM_FILTER_ROUNDTRIP.md).
+
+RE-953: Rust matches24 original export/reload compositions, retaining stale prior files when export is absent, all-hole truncation, wildcard-mask loss, INT_MIN metadata reload as0, duplicate routing and retained-table growth. The staged loader rejects unsupported domains without mutation. Unit tests cover these losses, duplicate growth and atomic unsupported prior-file rejection. Captured write bytes are supplied as read replies; actual filesystem acceptance remains open. [Evidence](research/RUST_FILTER_ROUNDTRIP.md).

docs/PROVISIONAL_TODO.md

@@ -1866,7 +1866,7 @@ RE-924–933 completed bounded bot settings, announcement, connect-child composi
 
 - [x] RE-943 Rust removal with survivor export and typed file effects ([evidence](research/RUST_FILTER_REMOVE_EXPORT.md)).
 
-RE-934–943 completed bounded filter export/removal/metadata and insertion/removal persistence compositions. RE-944 tracks loading/time/command callers, live adapters and runtime integration. [Batch and next work](research/QVM_FILTER_PERSISTENCE_BATCH.md).
+RE-934–943 completed bounded filter export/removal/metadata and insertion/removal persistence compositions. The following batch recovers time, expiry, loading and duration contracts; remaining command callers, live adapters and runtime integration remain open. [Batch and next work](research/QVM_FILTER_PERSISTENCE_BATCH.md).
 
 - [x] RE-944 Original filter time flattening and asymmetric inverse ([evidence](research/QVM_FILTER_TIME.md)).
 
@@ -1885,3 +1885,7 @@ RE-934–943 completed bounded filter export/removal/metadata and insertion/remo
 - [x] RE-951 Rust expiration command with typed time and usage effects ([evidence](research/RUST_FILTER_DURATION.md)).
 
 - [x] RE-952 Original export reload and lossy persistence behavior ([evidence](research/QVM_FILTER_ROUNDTRIP.md)).
+
+- [x] RE-953 Rust export reload composition and persistence-loss regressions ([evidence](research/RUST_FILTER_ROUNDTRIP.md)).
+
+RE-944–953 completed bounded time/expiry/loading/duration and export/reload contracts. RE-954 tracks remaining commands/callers, native ownership and runtime acceptance. [Batch and next work](research/QVM_FILTER_LOADING_BATCH.md).

docs/RESEARCH_LEDGER.md

@@ -2475,3 +2475,9 @@ Rust matches80 original duration/usage command fixtures, preserving wrapping num
 ## 2026-10-28 — RE-952 Original export reload and lossy persistence behavior
 
 Twenty-four actual export/reload compositions transfer captured file bytes through explicit native replies. Empty-table export leaves the prior file intact, whereas all-hole export truncates. Reload loses masks, converts the original INT_MIN formatter punctuation to metadata0, routes duplicate updates to the first match and grows retained tables. Source formatter/parser/load bodies execute; actual filesystem acceptance and unlimited reload/capacity remain open. Focused `cargo xtask test-group qvm-filter-roundtrip` passes with deterministic report regeneration, relevant regressions and storage/documentation/whitespace checks. Full suite deferred to the tenth-commit boundary. Original assets unchanged; native IO effects remain captured.
+
+## 2026-10-28 — RE-953 Rust export reload composition and persistence-loss regressions
+
+Rust matches24 original export/reload compositions, retaining stale prior files when export is absent, all-hole truncation, wildcard-mask loss, INT_MIN metadata reload as0, duplicate routing and retained-table growth. The staged loader rejects unsupported domains without mutation. Unit tests cover these losses, duplicate growth and atomic unsupported prior-file rejection. Captured write bytes are supplied as read replies; actual filesystem acceptance remains open. Focused `cargo xtask test-group rust-filter-roundtrip` passes with deterministic report regeneration, relevant regressions and storage/documentation/whitespace checks. Full suite deferred to the tenth-commit boundary. Original assets unchanged; native IO effects remain captured.
+
+Batch RE-944–953 boundary: the single `cargo xtask test-full --since ed9db0e6` run after commit ten passed with the flake-declared Nix Python: 1,838 Python tests, 249 Rust tests (assets10, gameplay209, xtask30), 96 deterministic report producers, storage policy, 524 documentation files and whitespace guards. No generated report drift. Focused dependency-selection regression covers all five new source/Rust pairs and shared loading/lifecycle/native-policy/formatter inputs, including gameplay test-count metadata. Validation notes were amended into task ten; original assets unchanged. See [batch findings and next work](research/QVM_FILTER_LOADING_BATCH.md).

docs/REVERSE_ENGINEERING_TODO.md

@@ -1903,7 +1903,7 @@ RE-934–943 continue the prior batch with filter export/removal/metadata and co
 
 - [x] RE-943 Rust removal with survivor export and typed file effects ([evidence](research/RUST_FILTER_REMOVE_EXPORT.md)).
 
-- [ ] RE-944 Recover filter loading/time/commands, live file/network adapters, bot setup/userinfo and remaining Rust/Bevy/Solari integration ([next work](research/QVM_FILTER_PERSISTENCE_BATCH.md)).
+RE-944–953 recover bounded time, expiry, loading, duration and persistence round trips; live adapters and full runtime integration remain open.
 
 - [x] RE-944 Original filter time flattening and asymmetric inverse ([evidence](research/QVM_FILTER_TIME.md)).
 
@@ -1922,3 +1922,7 @@ RE-934–943 continue the prior batch with filter export/removal/metadata and co
 - [x] RE-951 Rust expiration command with typed time and usage effects ([evidence](research/RUST_FILTER_DURATION.md)).
 
 - [x] RE-952 Original export reload and lossy persistence behavior ([evidence](research/QVM_FILTER_ROUNDTRIP.md)).
+
+- [x] RE-953 Rust export reload composition and persistence-loss regressions ([evidence](research/RUST_FILTER_ROUNDTRIP.md)).
+
+- [ ] RE-954 Recover remaining filter commands/callers and native time/file/network ownership, bot setup/userinfo and full Rust/Bevy/Solari acceptance ([next work](research/QVM_FILTER_LOADING_BATCH.md)).

docs/TESTING.md

@@ -177,3 +177,5 @@ RE-914–923 adds `qvm-byte-compare`, `rust-byte-compare`, `qvm-address-filter`,
 RE-924–933 adds `qvm-bot-settings`, `rust-bot-settings`, `qvm-team-announcement`, `rust-team-announcement`, `qvm-resolved-connect-tail`, `rust-resolved-connect-tail`, `qvm-resolved-connect-complete`, `rust-resolved-connect-complete`, `qvm-filter-insert` and `rust-filter-insert`. Use one group per invocation. Full validation after task ten uses `cargo xtask test-full --since bc3e7621` with explicit flake-declared Nix PYTHON. [Callback/filter evidence](research/QVM_BOT_ANNOUNCEMENT_FILTER_BATCH.md).
 
 Filter persistence focused groups: `qvm-filter-export`, `rust-filter-export`, `qvm-filter-remove`, `rust-filter-remove`, `qvm-filter-metadata`, `rust-filter-metadata`, `qvm-filter-insert-export`, `rust-filter-insert-export`, `qvm-filter-remove-export` and `rust-filter-remove-export`. The shared Rust filter lifecycle module and adapter select all affected parity reports and scoped gameplay test metadata; formatter edits also select these consumers. Run one group per invocation. Native file effects are captured plans in these checks.
+
+Filter loading focused groups: `qvm-filter-time`, `rust-filter-time`, `qvm-filter-expiry`, `rust-filter-expiry`, `qvm-filter-load`, `rust-filter-load`, `qvm-filter-duration`, `rust-filter-duration`, `qvm-filter-roundtrip` and `rust-filter-roundtrip`. The shared loading module/adapter, native policies, lifecycle module and formatter inputs select affected parity producers and scoped gameplay test-count metadata. Run one group per invocation. Time/file replies are supplied snapshots; native effects are captured.

docs/research/QVM_FILTER_LOADING_BATCH.md

@@ -0,0 +1,55 @@
+# Filter time, expiry, loading and round trips: RE-944–953
+
+Ten tasks recover five source/Rust contracts across **232 paired fixtures**. They extend the [persistence batch](QVM_FILTER_PERSISTENCE_BATCH.md) with time conversion, full-table expiry, file loading, the expiration-duration command and export/reload compositions. Every task has its own commit and focused `cargo xtask` validation. Native time and file replies remain supplied; console, network and file effects are captured plans.
+
+| Tasks | Evidence | Paired fixtures |
+| --- | --- | ---: |
+| RE-944 / RE-945 | [Original time helpers](QVM_FILTER_TIME.md) / [Rust time helpers](RUST_FILTER_TIME.md) | 84 |
+| RE-946 / RE-947 | [Original expiry](QVM_FILTER_EXPIRY.md) / [Rust expiry](RUST_FILTER_EXPIRY.md) | 12 |
+| RE-948 / RE-949 | [Original loader](QVM_FILTER_LOAD.md) / [Rust loader](RUST_FILTER_LOAD.md) | 32 |
+| RE-950 / RE-951 | [Original duration command](QVM_FILTER_DURATION.md) / [Rust command](RUST_FILTER_DURATION.md) | 80 |
+| RE-952 / RE-953 | [Original export/reload](QVM_FILTER_ROUNDTRIP.md) / [Rust composition](RUST_FILTER_ROUNDTRIP.md) | 24 |
+
+## Time and expiry findings
+
+Actual251995 combines structure words at offsets28,8,4 as day-of-year×1440 + hour×60 + minute, using wrapping32-bit arithmetic. It does not inspect the year. Actual252024 writes the quotient at offset28 and the computed hour at offset8, then stores that hour modulo60 at offset4. This inverse loses the original minutes. Source fixtures cover negative fields, signed division truncation, INT_MIN/MAX and six unrelated structure words that remain unchanged. Rust preserves the observed arithmetic and asymmetric inverse.
+
+Actual252067 requests native time, executes251995 and scans **all4096 records**, independent of active count. A metadata word other than-1 expires only when it is unsigned-less-than the current minute word. It sets comparison to-1 while retaining mask, metadata and count. Equality is retained, and the routine does not export. Twelve source fixtures check full-table checksums, permanent markers, high-bit times and last-slot mutation with count zero. Rust requires a complete4096-slot snapshot and has no active-count parameter. Native calendar rollover and invocation cadence remain open.
+
+## Loading and command findings
+
+Actual252933 opens `banlist.txt` for reading, requests the declared length, closes the supplied handle, then processes lines. It does not clear the existing count or check handle success before read/close. The bounded missing-file fixture supplies length-1 and handle0; the source still requests a read with the raw-1 length and closes0, then skips parsing. These are captured effects, not actual unsafe native reads. The Rust API supports that explicit reply while rejecting other unsupported negative lengths and unsafe buffer/line domains.
+
+The loader splits on LF, skips raw lines of zero or one byte, accepts a final unterminated line and truncates callback text at embedded NUL. It executes actual252829 insertion, then searches for a colon through36489. If found, it parses metadata through37159 and calls252127 with saving disabled. A short supplied read leaves explicitly seeded initial-buffer bytes visible. Thirty-two source cases cover these paths, CRLF, invalid addresses, wildcard/sentinel entries, overflowing metadata prefixes and loading into existing tables.
+
+Insertion and metadata update each perform their own scan. Inserting a duplicate can append a new record, while the subsequent metadata update changes an earlier matching record. The new duplicate retains metadata-1. Retained tables therefore grow on repeated loads; loading is not replacement. Rust stages all table/count changes and rejects unsupported later lines or token domains without partial mutation.
+
+Actual252213 selects exact console/client usage output when either argument is empty, without requesting time or updating metadata. Client usage executes70458/37914 and advances the formatter ring, including wrapping fromUINT_MAX. With nonempty arguments, it parses duration through37159, requests native time, executes251995, adds with word wrap and calls252127 with saving enabled. Negative durations can produce metadata-1, the permanent marker used by expiry. Eighty fixtures cover duplicate matches, missing/invalid addresses, overflow, empty arguments and both usage contexts. Export requests are captured in this command contract; export bodies are already recovered separately.
+
+## Persistence losses
+
+The24 round-trip compositions supply captured export bytes as the next native read reply. This assumes complete byte transfer for the fixture; it does not establish real filesystem acceptance, especially for supplied invalid handles.
+
+- Export ignores masks, so reload produces exact address masks from previously wildcarded entries.
+- INT_MIN metadata uses the original formatter's wrapping-negation punctuation. Reload's integer-prefix conversion reads that punctuation as zero.
+- Duplicate serialized entries update the first matching record's metadata; later inserted duplicates can retain metadata-1.
+- An empty source table performs no write. Supplying the retained prior file to reload can restore its entries.
+- A nonempty all-hole table writes an empty payload, so the prior file is replaced in the supplied-transfer composition.
+- Loading into retained tables keeps old rows and count; it does not deduplicate or reset storage.
+
+Rust exposes time, read, usage/update and persistence plans with explicit replies and ordered effects. The port preserves these observed losses rather than normalizing them.
+
+## Validation
+
+Each task ran its focused `cargo xtask test-group` before its commit: qvm/rust-filter-time, qvm/rust-filter-expiry, qvm/rust-filter-load, qvm/rust-filter-duration and qvm/rust-filter-roundtrip. Selected reports regenerated twice identically. Independent arithmetic/scan/parser/loading expectations check original fixtures; Rust parity compares all projected fields with the original source report and records its SHA256.
+
+Rust unit tests additionally check arithmetic extremes, unrelated structure fields, unsigned expiry gates, complete-storage requirements, duplicate routing, explicit missing-file/partial-read replies, ring wrap, negative durations, lossy reloads and atomic unsupported-domain rejection. Dependency-selection regression coverage includes all five report pairs and shared policy/formatter inputs, including scoped gameplay test-count metadata. Python uses the flake-declared Nix runtime throughout, including Git hooks. Original assets are unchanged. The single `cargo xtask test-full --since ed9db0e6` run after task ten passed: **1,838 Python tests**, **249 Rust tests** (assets10, gameplay209, xtask30), **96 deterministic report producers**, storage policy, links across **524 documentation files** and whitespace guards. Regeneration left no changes. The focused dependency-selection regression also passed. Validation notes are amended into task ten, preserving ten commits for the batch.
+
+## Next work: RE-954
+
+- [ ] Recover253100 add-filter and253245 removal command wrappers, including client-number/userinfo resolution, drop/console/client effects and malformed inputs.
+- [ ] Trace actual252067/252933 callers, initialization ordering, native time-structure ABI, year rollover and expiry cadence; test composition with address admission.
+- [ ] Extend loader bounds toward capacity, long lines, malformed lengths, integer/string scratch provenance, repeated loads and complete engine file-error handling.
+- [ ] Compose duration, expiry, removal, persistence and live address filtering with table ownership and all native adapters on macOS/Linux.
+- [ ] Recover125185 bot setup/resource ownership,171668 userinfo mutation and5864 ranking/publication, then compose connect with native network effects.
+- [ ] Continue collision/spatial-query recovery, respawn/intermission/events/scoreboard integration, assets/maps/models/shader conversion and Rust/Bevy/Solari runtime acceptance on macOS/Linux.

docs/research/QVM_FILTER_PERSISTENCE_BATCH.md

@@ -28,7 +28,7 @@ Each task ran its own `cargo xtask test-group` before its commit: qvm/rust-filte
 
 The dependency registry maps both the new Rust module/adapter and formatter dependencies to the affected reports. Its focused regression includes all five source/Rust pairs. All Python processes use the flake-declared Nix runtime, including Git hooks. Original assets are unchanged. The single `cargo xtask test-full --since 7bb397d4` run after task ten passed: **1,818 Python tests**, **236 Rust tests** (assets10, gameplay196, xtask30), **92 deterministic report producers**, storage policy, links across **513 documentation files** and whitespace guards. Regeneration left no changes. Validation notes are amended into task ten, preserving ten commits for the batch.
 
-## Next work: RE-944
+## Historical next work after RE-943
 
 - [ ] Recover file loading at actual252933, including newline bounds, colon metadata parsing,252829/252127 interactions, missing files, short reads and native handle failures. Check exact caller addresses before extending the trace.
 - [ ] Recover duration command252213, actual251995 time conversion and native time-structure provenance; establish metadata/expiry semantics from callers rather than names.
@@ -37,3 +37,5 @@ The dependency registry maps both the new Rust module/adapter and formatter depe
 - [ ] Implement and validate native file-effect adapters, preserving source ordering and actual engine error behavior on macOS/Linux.
 - [ ] Recover125185 bot setup/resource ownership,171668 userinfo mutation and5864 ranking/publication; compose them with connect and native network effects.
 - [ ] Continue native collision, spatial queries, respawn/intermission/event/scoreboard integration, asset conversion and Rust/Bevy/Solari runtime acceptance on macOS/Linux.
+
+Follow-up: [RE-944–953 time/loading findings and current next work](QVM_FILTER_LOADING_BATCH.md).

docs/research/README.md

@@ -1457,3 +1457,7 @@ The extension collector adds five focused tests for native tail calls, command-r
 - [RE-951: Rust expiration command with typed time and usage effects](RUST_FILTER_DURATION.md).
 
 - [RE-952: Original export reload and lossy persistence behavior](QVM_FILTER_ROUNDTRIP.md).
+
+- [RE-953: Rust export reload composition and persistence-loss regressions](RUST_FILTER_ROUNDTRIP.md).
+
+- [RE-944–953 filter loading batch and RE-954 next work](QVM_FILTER_LOADING_BATCH.md).

docs/research/RUST_FILTER_ROUNDTRIP.md

@@ -0,0 +1,5 @@
+# Rust export reload composition and persistence-loss regressions
+
+RE-953. Focused validation: `cargo xtask test-group rust-filter-roundtrip`. [Machine report](rust-filter-roundtrip.json).
+
+Rust matches24 original export/reload compositions, retaining stale prior files when export is absent, all-hole truncation, wildcard-mask loss, INT_MIN metadata reload as0, duplicate routing and retained-table growth. The staged loader rejects unsupported domains without mutation. Unit tests cover these losses, duplicate growth and atomic unsupported prior-file rejection. Captured write bytes are supplied as read replies; actual filesystem acceptance remains open.

docs/research/rust-health-impulse.json

@@ -2985,7 +2985,7 @@
       "exit_code": 2
     }
   ],
-  "rust_unit_tests": 206,
+  "rust_unit_tests": 209,
   "source_report": "docs/research/qvm-health-impulse.json",
   "source_report_sha256": "625fd8064004ea6dbdf398d51d0af844d9c635ff04c0a0790886dddb6ab81e71"
 }

scripts/analyze_rust_filter_roundtrip.py

@@ -0,0 +1,17 @@
+"""Compare recovered Rust policy with original QVM fixtures."""
+import hashlib,json,os,subprocess
+from pathlib import Path
+from analyze_qvm import write_json
+from rust_lifecycle_support import result
+
+def main():
+ subprocess.run(['cargo','build','--offline','--package','urt-gameplay','--bin','urt-filter-loading'],check=True,capture_output=True)
+ binary=Path(os.environ.get('CARGO_TARGET_DIR','target'))/'debug'/'urt-filter-loading'
+ path=Path('docs/research/qvm-filter-roundtrip.json');data=path.read_bytes();probes=[]
+ for p in json.loads(data)['probes']:
+  probes.append(dict(source={k:p[k] for k in ['exported', 'disk', 'loaded']},rust=result(binary,'roundtrip',encode(p['input']))))
+ write_json(Path('docs/research/rust-filter-roundtrip.json'),dict(source_report=str(path),source_report_sha256=hashlib.sha256(data).hexdigest(),probes=probes,limits='Finite source/Rust contract parity; native time/file/network replies remain supplied or captured.'))
+
+def encode(a):
+ prior=bytes.fromhex(a['prior_file']);return [a['handle'],a['retain'],len(a['rows']),*[v for r in a['rows'] for v in r],len(prior),*prior]
+if __name__=='__main__':main()

scripts/test_rust_filter_roundtrip.py

@@ -0,0 +1,9 @@
+import hashlib,json,unittest
+from pathlib import Path
+class PortTests(unittest.TestCase):
+ def test_original_parity(self):
+  r=json.loads(Path('docs/research/rust-filter-roundtrip.json').read_text());self.assertGreaterEqual(len(r['probes']),12)
+  for p in r['probes']:self.assertEqual(p['source'],p['rust'])
+ def test_identity(self):
+  r=json.loads(Path('docs/research/rust-filter-roundtrip.json').read_text());self.assertEqual(hashlib.sha256(Path(r['source_report']).read_bytes()).hexdigest(),r['source_report_sha256'])
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -3288,3 +3288,19 @@ report	scripts/analyze_qvm_filter_roundtrip.py	docs/research/qvm-filter-roundtri
 edge	docs/research/qvm-filter-roundtrip.json	scripts/test_qvm_filter_roundtrip.py
 group	qvm-filter-roundtrip	scripts/analyze_qvm_filter_roundtrip.py
 edge	scripts/analyze_qvm_filter_roundtrip.py	scripts/analyze_qvm_resumer_audit.py
+report	scripts/analyze_rust_filter_roundtrip.py	docs/research/rust-filter-roundtrip.json
+edge	docs/research/rust-filter-roundtrip.json	scripts/test_rust_filter_roundtrip.py
+group	rust-filter-roundtrip	scripts/analyze_rust_filter_roundtrip.py
+edge	scripts/analyze_rust_filter_roundtrip.py	scripts/analyze_qvm_resumer_audit.py
+edge	Cargo.toml	scripts/analyze_rust_filter_roundtrip.py
+edge	Cargo.lock	scripts/analyze_rust_filter_roundtrip.py
+edge	crates/urt-gameplay/Cargo.toml	scripts/analyze_rust_filter_roundtrip.py
+edge	crates/urt-gameplay/src/lib.rs	scripts/analyze_rust_filter_roundtrip.py
+edge	crates/urt-gameplay/src/filter_loading.rs	scripts/analyze_rust_filter_roundtrip.py
+edge	crates/urt-gameplay/src/filter_lifecycle.rs	scripts/analyze_rust_filter_roundtrip.py
+edge	crates/urt-gameplay/src/native_policy.rs	scripts/analyze_rust_filter_roundtrip.py
+edge	crates/urt-gameplay/src/bin/urt-filter-loading.rs	scripts/analyze_rust_filter_roundtrip.py
+edge	crates/urt-gameplay/src/qvm_format.rs	scripts/analyze_rust_filter_roundtrip.py
+edge	docs/research/qvm-filter-roundtrip.json	scripts/analyze_rust_filter_roundtrip.py
+group	rust-filter-roundtrip	scripts/analyze_rust_health_impulse.py
+group	gameplay	scripts/analyze_rust_filter_roundtrip.py

xtask/src/lib.rs

@@ -1129,6 +1129,26 @@ mod integration_tests {
             ("native_policy", "resolved_connect_complete"),
             ("native_policy", "filter_insert"),
             ("filter_lifecycle", "filter_export"),
+            ("filter_loading", "filter_time"),
+            ("filter_lifecycle", "filter_time"),
+            ("native_policy", "filter_time"),
+            ("qvm_format", "filter_time"),
+            ("filter_loading", "filter_expiry"),
+            ("filter_lifecycle", "filter_expiry"),
+            ("native_policy", "filter_expiry"),
+            ("qvm_format", "filter_expiry"),
+            ("filter_loading", "filter_load"),
+            ("filter_lifecycle", "filter_load"),
+            ("native_policy", "filter_load"),
+            ("qvm_format", "filter_load"),
+            ("filter_loading", "filter_duration"),
+            ("filter_lifecycle", "filter_duration"),
+            ("native_policy", "filter_duration"),
+            ("qvm_format", "filter_duration"),
+            ("filter_loading", "filter_roundtrip"),
+            ("filter_lifecycle", "filter_roundtrip"),
+            ("native_policy", "filter_roundtrip"),
+            ("qvm_format", "filter_roundtrip"),
             ("native_policy", "filter_export"),
             ("qvm_format", "filter_export"),
             ("filter_lifecycle", "filter_remove"),
@@ -1232,6 +1252,11 @@ mod integration_tests {
             ("qvm-resolved-connect-complete", "resolved_connect_complete"),
             ("qvm-filter-insert", "filter_insert"),
             ("qvm-filter-export", "filter_export"),
+            ("qvm-filter-time", "filter_time"),
+            ("qvm-filter-expiry", "filter_expiry"),
+            ("qvm-filter-load", "filter_load"),
+            ("qvm-filter-duration", "filter_duration"),
+            ("qvm-filter-roundtrip", "filter_roundtrip"),
             ("qvm-filter-remove", "filter_remove"),
             ("qvm-filter-metadata", "filter_metadata"),
             ("qvm-filter-insert-export", "filter_insert_export"),