qvm: recover repeated bomb defuse transitions

docs/FINDINGS.md

@@ -1981,3 +1981,5 @@ RE-1019: Rust matches32 active source completion cases with signed wrapped elaps
 RE-1020: Ninety-six source scenarios connect original admission/teammate scan to actual276433 bomb hash lookup and65655 distance, then start/wait/cancel/complete transitions. Three selectors, radius75 equality, zero/64 teammate counts, inactive/classless/hash-mismatched decoys, wrapped time, completed latch and missing bomb are covered. Missing lookup stops before original2319 fatal handler. Native sqrt is modeled; event/native effect feedback is captured or supplied, not executed. [Evidence](research/QVM_DEFUSE_COMPLETE.md).
 
 RE-1021: Rust composes verified eligibility, first eligible bomb hash lookup, finite f32 distance and start/cancel/finish across96 source cases. Missing bomb returns the source fatal boundary diagnostic without inventing subsequent behavior. Radius equality does not start defusing; decoy identity and selector semantics match source. State and effect plans stage before commit, with missing/invalid geometry unit tests preserving prior state. Native effects remain captured plans. [Evidence](research/RUST_DEFUSE_COMPLETE.md).
+
+RE-1022: Thirty coherent source scenarios replay up to five complete callbacks, producing138 snapshots. Scripted motion, held-button changes and teammate release test cancellation/restart; shared state persists through waiting and exact completion. Completed latch prevents repeated allocation/log/award. Missing-bomb boundary stops after one call. Actual lookup/distance bodies execute, while native effect feedback and scheduling remain modeled/captured inputs. [Evidence](research/QVM_DEFUSE_SEQUENCE.md).

docs/PROVISIONAL_TODO.md

@@ -2040,3 +2040,5 @@ RE-974–983 completed routing, command rewrite, inactivity, movement-parameter
 - [x] RE-1020 Recover complete mode8 bomb-defuse callback ([evidence](research/QVM_DEFUSE_COMPLETE.md)).
 
 - [x] RE-1021 Port complete bomb-defuse lookup and state policy ([evidence](research/RUST_DEFUSE_COMPLETE.md)).
+
+- [x] RE-1022 Recover bomb-defuse sequences and completion latching ([evidence](research/QVM_DEFUSE_SEQUENCE.md)).

docs/RESEARCH_LEDGER.md

@@ -2759,3 +2759,7 @@ Ninety-six source scenarios connect original admission/teammate scan to actual27
 ## 2026-10-29 — RE-1021 Port complete bomb-defuse lookup and state policy
 
 Rust composes verified eligibility, first eligible bomb hash lookup, finite f32 distance and start/cancel/finish across96 source cases. Missing bomb returns the source fatal boundary diagnostic without inventing subsequent behavior. Radius equality does not start defusing; decoy identity and selector semantics match source. State and effect plans stage before commit, with missing/invalid geometry unit tests preserving prior state. Native effects remain captured plans. Focused `cargo xtask test-group rust-defuse-complete` passes with deterministic report regeneration and selected regressions. Full suite deferred to task ten. Original assets unchanged; Python uses the flake-declared Nix runtime.
+
+## 2026-10-29 — RE-1022 Recover bomb-defuse sequences and completion latching
+
+Thirty coherent source scenarios replay up to five complete callbacks, producing138 snapshots. Scripted motion, held-button changes and teammate release test cancellation/restart; shared state persists through waiting and exact completion. Completed latch prevents repeated allocation/log/award. Missing-bomb boundary stops after one call. Actual lookup/distance bodies execute, while native effect feedback and scheduling remain modeled/captured inputs. Focused `cargo xtask test-group qvm-defuse-sequence` passes with deterministic report regeneration and selected regressions. Full suite deferred to task ten. Original assets unchanged; Python uses the flake-declared Nix runtime.

docs/REVERSE_ENGINEERING_TODO.md

@@ -2077,3 +2077,5 @@ RE-974–983 recover routing, command rewriting, inactivity and composed setup t
 - [x] RE-1020 Recover complete mode8 bomb-defuse callback ([evidence](research/QVM_DEFUSE_COMPLETE.md)).
 
 - [x] RE-1021 Port complete bomb-defuse lookup and state policy ([evidence](research/RUST_DEFUSE_COMPLETE.md)).
+
+- [x] RE-1022 Recover bomb-defuse sequences and completion latching ([evidence](research/QVM_DEFUSE_SEQUENCE.md)).

docs/research/QVM_DEFUSE_SEQUENCE.md

@@ -0,0 +1,5 @@
+# Recover bomb-defuse sequences and completion latching
+
+RE-1022. Focused validation: `cargo xtask test-group qvm-defuse-sequence`. [Machine report](qvm-defuse-sequence.json).
+
+Thirty coherent source scenarios replay up to five complete callbacks, producing138 snapshots. Scripted motion, held-button changes and teammate release test cancellation/restart; shared state persists through waiting and exact completion. Completed latch prevents repeated allocation/log/award. Missing-bomb boundary stops after one call. Actual lookup/distance bodies execute, while native effect feedback and scheduling remain modeled/captured inputs.

docs/research/README.md

@@ -1609,3 +1609,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 - [RE-1020: Recover complete mode8 bomb-defuse callback](QVM_DEFUSE_COMPLETE.md).
 
 - [RE-1021: Port complete bomb-defuse lookup and state policy](RUST_DEFUSE_COMPLETE.md).
+
+- [RE-1022: Recover bomb-defuse sequences and completion latching](QVM_DEFUSE_SEQUENCE.md).

scripts/analyze_qvm_defuse_sequence.py

@@ -0,0 +1,12 @@
+"""Verified original movement-context source contract."""
+from pathlib import Path
+from analyze_qvm import write_json
+from qvm_research_support import source
+from qvm_defuse_support import seed,sequence,sequence_fixtures
+
+def main():
+ q,raw,h,ins=source();probes=[]
+ for a in sequence_fixtures():
+  m,b=seed(raw,h,a);m,p,b=sequence(ins,m,b,a);p['input']=a;probes.append(p)
+ write_json(Path('docs/research/qvm-defuse-sequence.json'),dict(source=q['source'],sha256=q['sha256'],probes=probes,limits='Up to five actual153419 calls with coherent state, actual hash/distance children, scripted button/motion/teammate updates and captured/supplied native effects. Missing-bomb fatal boundary stops replay; no scheduler/native runtime conformance.'))
+if __name__=='__main__':main()

scripts/qvm_defuse_oracle.py

@@ -1,7 +1,7 @@
 """Independent expectations for source mode8 objective transitions."""
 from qvm_move_callbacks_oracle import signed
 
-def initial(a):return {**{k:a[k] for k in ['flags','flags104','busy','clock','complete','animation','weapon']},'event':[7,0x80000001],'guards':[0xaabbccdd,0x11223344]}
+def initial(a):return {**{k:a[k] for k in ['flags','flags104','busy','clock','complete','animation','weapon']},'event':list(a.get('event',[7,0x80000001])),'guards':[0xaabbccdd,0x11223344]}
 def begin(a):
  out=initial(a)
  if a['flags']&32:out['flags']&=~96;out['animation']=2
@@ -31,3 +31,15 @@ def full(a):
  elif a['busy']:out.update(finish(a))
  else:out.update(begin(a))
  return out
+
+def sequence(a):
+ import copy
+ current=copy.deepcopy(a);state=initial(a);frames=[]
+ for index,offset in enumerate([0,1000,2000,5000,6000]):
+  current.update({k:copy.deepcopy(state[k]) for k in ['flags','flags104','busy','clock','complete','animation','weapon','event']});current['tick']=(a['tick']+offset)&0xffffffff
+  if index==1 and a['profile']==3:current['distance']=10.
+  if index==1 and a['profile']==5:current['flags']|=32768
+  if index==1 and a['profile']==16:current['other_busy']=0
+  state=full(current);frames.append(state)
+  if state['missing']:break
+ return dict(frames=frames)

scripts/qvm_defuse_support.py

@@ -120,3 +120,17 @@ def full_run(ins,m,b,a):
  m,p=resume(ins,153420,154088,m,BASE,boundaries=(153612,154087),handlers={**handlers(events),276433:lookup,65655:distance},byte_inputs=b,repeated_calls=True,sync_child_words=True,coherent_memory=True,byte_handlers=True,capture_byte_memory=True,limit=32768)
  return m,dict(**view(m,a),events=events,lookups=lookups,distances=distances,missing=p['stop']==153612,execution={k:p[k] for k in ['stop','trace_length','trace_sha256']}),p['byte_memory']
 def full(ins,m,b,a):full_seed(m,b,a);return full_run(ins,m,b,a)
+
+def sequence_fixtures():return [a for a in full_fixtures() if a['profile'] in [0,1,2,3,5,16,23,26,27,29]]
+def sequence(ins,m,b,a):
+ import hashlib
+ full_seed(m,b,a);frames=[];traces=[]
+ def store(address,value):write_bytes(m,b,{address+k:(value>>(8*k))&255 for k in range(4)})
+ for index,offset in enumerate([0,1000,2000,5000,6000]):
+  tick=(a['tick']+offset)&0xffffffff;store(34992532,tick)
+  if index==1 and a['profile']==3:store(BOMB+24,word(10.))
+  if index==1 and a['profile']==5:store(CLIENT+220,(m[CLIENT+220]&0xffffffff)|32768)
+  if index==1 and a['profile']==16:store(CPOOL+6336*a['busy_slot']+6164,0)
+  m,p,b=full_run(ins,m,b,dict(a,tick=tick));traces.append(p.pop('execution'));frames.append(p)
+  if p['missing']:break
+ return m,dict(frames=frames,execution=dict(stop=traces[-1]['stop'],trace_length=sum(p['trace_length'] for p in traces),trace_sha256=hashlib.sha256(''.join(p['trace_sha256'] for p in traces).encode()).hexdigest())),b

scripts/test_qvm_defuse_sequence.py

@@ -0,0 +1,13 @@
+import json,unittest
+from pathlib import Path
+from qvm_defuse_oracle import sequence
+class OriginalTests(unittest.TestCase):
+ def test_original_contract(self):
+  rows=json.loads(Path('docs/research/qvm-defuse-sequence.json').read_text())['probes'];self.assertEqual(len(rows),30)
+  for p in rows:
+   with self.subTest(input=p['input']):
+    for k,v in sequence(p['input']).items():self.assertEqual(p[k],v,k)
+ def test_fixture_identity_and_trace(self):
+  r=json.loads(Path('docs/research/qvm-defuse-sequence.json').read_text());self.assertEqual(len(r['sha256']),64)
+  self.assertTrue(all(p['execution']['trace_length']>0 for p in r['probes']))
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -4278,3 +4278,7 @@ edge	crates/urt-gameplay/src/move_callbacks.rs	scripts/analyze_rust_defuse_compl
 edge	crates/urt-gameplay/src/defuse.rs	scripts/analyze_rust_defuse_complete.py
 edge	crates/urt-gameplay/src/bin/urt-defuse.rs	scripts/analyze_rust_defuse_complete.py
 edge	crates/urt-gameplay/src/move_callbacks.rs	scripts/analyze_rust_defuse_complete.py
+report	scripts/analyze_qvm_defuse_sequence.py	docs/research/qvm-defuse-sequence.json
+edge	docs/research/qvm-defuse-sequence.json	scripts/test_qvm_defuse_sequence.py
+group	qvm-defuse-sequence	scripts/analyze_qvm_defuse_sequence.py
+edge	scripts/analyze_qvm_defuse_sequence.py	scripts/analyze_qvm_resumer_audit.py