qvm: recover timer countdown and recovery flags

docs/FINDINGS.md

@@ -1867,3 +1867,5 @@ RE-965: Rust matches144 original terminal-fragment cases, preserving wrapping co
 RE-966: A288-case source loop contract covers signed residual thresholds, wrapping phase increments and signed remainder with rates0/1/2/5. Rate0 reads preceding word1120403456 instead of a zero divisor. Flag256 plus positive supplied health and phase0 request damage1, means23 and caller weapon/owner pointers. Damage effects remain captured and flag512 is disabled in this stage; health mutation and other branches remain open. [Evidence](research/QVM_CLIENT_TIMER_TICKS.md).
 
 RE-967: Rust matches288 original tick-loop cases with signed residual/remainder and wrapping phase behavior. Rate0 retains the preceding-word divisor1120403456. Typed damage requests retain all source arguments without mutating supplied health. Unit tests cover alias behavior, signed wrap, exact request ABI and atomic invalid-rate rejection. Flag512 is deliberately outside this first loop subset; the residual budget bounds execution. [Evidence](research/RUST_CLIENT_TIMER_TICKS.md).
+
+RE-968: A216-case source contract extends the tick loop through flags512/256/128 and f32 subtraction of0.1. Crossing zero resets flag256/rate/timer but delays secondary flag128/status cleanup until a later tick; initially nonpositive timers can clear immediately. Reset rate0 changes later modulo through the preceding-word alias. Damage stays captured and health supplied; nonfinite/unsafe table domains remain open. [Evidence](research/QVM_CLIENT_TIMER_RECOVERY.md).

docs/PROVISIONAL_TODO.md

@@ -1919,3 +1919,5 @@ RE-954–963 completed add/remove wrappers, resolved duration export, full-capac
 - [x] RE-966 Original100ms timer phase loop and damage-request ABI ([evidence](research/QVM_CLIENT_TIMER_TICKS.md)).
 
 - [x] RE-967 Rust100ms phase loop and captured damage requests ([evidence](research/RUST_CLIENT_TIMER_TICKS.md)).
+
+- [x] RE-968 Original float countdown and flag-recovery loop ([evidence](research/QVM_CLIENT_TIMER_RECOVERY.md)).

docs/RESEARCH_LEDGER.md

@@ -2539,3 +2539,7 @@ A288-case source loop contract covers signed residual thresholds, wrapping phase
 ## 2026-10-28 — RE-967 Rust100ms phase loop and captured damage requests
 
 Rust matches288 original tick-loop cases with signed residual/remainder and wrapping phase behavior. Rate0 retains the preceding-word divisor1120403456. Typed damage requests retain all source arguments without mutating supplied health. Unit tests cover alias behavior, signed wrap, exact request ABI and atomic invalid-rate rejection. Flag512 is deliberately outside this first loop subset; the residual budget bounds execution. Focused `cargo xtask test-group rust-client-timer-ticks` passes with deterministic report regeneration, relevant regressions and storage/documentation/whitespace checks. Full suite deferred to the tenth-commit boundary. Original assets unchanged; native IO effects remain captured.
+
+## 2026-10-28 — RE-968 Original float countdown and flag-recovery loop
+
+A216-case source contract extends the tick loop through flags512/256/128 and f32 subtraction of0.1. Crossing zero resets flag256/rate/timer but delays secondary flag128/status cleanup until a later tick; initially nonpositive timers can clear immediately. Reset rate0 changes later modulo through the preceding-word alias. Damage stays captured and health supplied; nonfinite/unsafe table domains remain open. Focused `cargo xtask test-group qvm-client-timer-recovery` passes with deterministic report regeneration, relevant regressions and storage/documentation/whitespace checks. Full suite deferred to the tenth-commit boundary. Original assets unchanged; native IO effects remain captured.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1956,3 +1956,5 @@ RE-954–963 recover bounded command wrappers, resolved duration export, full-ca
 - [x] RE-966 Original100ms timer phase loop and damage-request ABI ([evidence](research/QVM_CLIENT_TIMER_TICKS.md)).
 
 - [x] RE-967 Rust100ms phase loop and captured damage requests ([evidence](research/RUST_CLIENT_TIMER_TICKS.md)).
+
+- [x] RE-968 Original float countdown and flag-recovery loop ([evidence](research/QVM_CLIENT_TIMER_RECOVERY.md)).

docs/research/QVM_CLIENT_TIMER_RECOVERY.md

@@ -0,0 +1,5 @@
+# Original float countdown and flag-recovery loop
+
+RE-968. Focused validation: `cargo xtask test-group qvm-client-timer-recovery`. [Machine report](qvm-client-timer-recovery.json).
+
+A216-case source contract extends the tick loop through flags512/256/128 and f32 subtraction of0.1. Crossing zero resets flag256/rate/timer but delays secondary flag128/status cleanup until a later tick; initially nonpositive timers can clear immediately. Reset rate0 changes later modulo through the preceding-word alias. Damage stays captured and health supplied; nonfinite/unsafe table domains remain open.

docs/research/README.md

@@ -1491,3 +1491,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 - [RE-966: Original100ms timer phase loop and damage-request ABI](QVM_CLIENT_TIMER_TICKS.md).
 
 - [RE-967: Rust100ms phase loop and captured damage requests](RUST_CLIENT_TIMER_TICKS.md).
+
+- [RE-968: Original float countdown and flag-recovery loop](QVM_CLIENT_TIMER_RECOVERY.md).

scripts/analyze_qvm_client_timer_recovery.py

@@ -0,0 +1,12 @@
+"""Original full tick loop with float countdown and flag512 recovery paths."""
+from pathlib import Path
+from analyze_qvm import write_json
+from qvm_research_support import source
+from qvm_client_timer_support import seed,seed_loop,tick_loop,recovery_fixtures
+
+def main():
+ q,raw,h,ins=source();probes=[]
+ for a in recovery_fixtures():
+  m,b=seed(raw,h,a);seed_loop(m,a);m,p,b=tick_loop(ins,m,b,a);p['input']=a;probes.append(p)
+ write_json(Path('docs/research/qvm-client-timer-recovery.json'),dict(source=q['source'],sha256=q['sha256'],range=[150810,151085],probes=probes,limits='216 original loop cases recover flag512/256/128 gates, repeated f32 subtraction of0.1, rate/float resets and status-bit clearing. Positive countdown crossing zero skips flag128 cleanup until a later iteration; nonpositive initial timer can clean immediately. Rate reset0 changes subsequent modulo through the preceding-word alias. Damage callbacks captured, finite float/rate domains only.'))
+if __name__=='__main__':main()

scripts/qvm_client_timer_support.py

@@ -40,3 +40,7 @@ def tick_loop(ins,m,b,a):
 def tick_fixtures():
  from itertools import product
  return [dict(residual=residual,rate=rate,flags=flags,health=health,phase=phase,status=3,timer=0.0,weapon=7) for residual,rate,flags,health,phase in product([-1,99,100,250,500,1000],[0,1,2,5],[0,256],[0,1],[0,3,0x7fffffff])]
+
+def recovery_fixtures():
+ from itertools import product
+ return [dict(flags=flags,timer=timer,rate=rate,residual=residual,health=health,phase=3,status=3,weapon=7) for flags,timer,rate,residual,health in product([512,768,896],[0.0,0.05,0.1,0.2,1.0,-0.1],[0,2],[100,250,550],[0,1])]

scripts/test_qvm_client_timer_recovery.py

@@ -0,0 +1,12 @@
+import json,unittest
+from pathlib import Path
+from qvm_client_timer_oracle import ticks
+class RecoveryTests(unittest.TestCase):
+ def test_original_full_loop(self):
+  rows=json.loads(Path('docs/research/qvm-client-timer-recovery.json').read_text())['probes'];self.assertEqual(len(rows),216)
+  for p in rows:
+   for k,v in ticks(p['input']).items():self.assertEqual(p[k],v)
+ def test_zero_crossing_delays_secondary_cleanup(self):
+  a=dict(flags=896,status=3,rate=2,phase=3,timer=0.05,residual=100,health=1,weapon=7);p=ticks(a);self.assertEqual(p['state'][0],640);self.assertEqual(p['state'][1],3);self.assertEqual(p['state'][2],0);self.assertEqual(len(p['damage']),1)
+  a['residual']=250;p=ticks(a);self.assertEqual(p['state'][0],512);self.assertEqual(p['state'][1],2);self.assertEqual(p['state'][3],1)
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -3466,3 +3466,7 @@ edge	crates/urt-gameplay/src/filter_commands.rs	scripts/analyze_rust_client_time
 edge	crates/urt-gameplay/src/bin/urt-filter-commands.rs	scripts/analyze_rust_client_timer_ticks.py
 edge	crates/urt-gameplay/src/client_timer.rs	scripts/analyze_rust_client_timer_ticks.py
 edge	crates/urt-gameplay/src/bin/urt-client-timer.rs	scripts/analyze_rust_client_timer_ticks.py
+report	scripts/analyze_qvm_client_timer_recovery.py	docs/research/qvm-client-timer-recovery.json
+edge	docs/research/qvm-client-timer-recovery.json	scripts/test_qvm_client_timer_recovery.py
+group	qvm-client-timer-recovery	scripts/analyze_qvm_client_timer_recovery.py
+edge	scripts/analyze_qvm_client_timer_recovery.py	scripts/analyze_qvm_resumer_audit.py