qvm: wound attribution and counter cap

docs/ASSET_PIPELINE_TODO.md

@@ -787,3 +787,6 @@ Research progress: RE-706 [report](research/QVM_DAMAGE_CLAMP.md); remaining nati
 
 
 Research progress: RE-707 [report](research/QVM_DAMAGE_WOUNDS.md); remaining native/content/runtime/platform scope stays open.
+
+
+Research progress: RE-708 [report](research/QVM_DAMAGE_ATTRIBUTION.md); remaining native/content/runtime/platform scope stays open.

docs/FINDINGS.md

@@ -1133,3 +1133,6 @@ Bounded qagame paths recover bomb-plant/inactivity correction requests, direct f
 
 
 **RE-707 — Wound eligibility and client meter increments:** Mode9, entity flag16 or protection suppress the wound word. Active client wounds set leg flag128 at locations11–14 and increment client4312 with source-specific threshold rules. [Evidence](research/QVM_DAMAGE_WOUNDS.md).
+
+
+**RE-708 — Active wound attribution and counter cap:** Active wounds record attacker pointer at target836 and weapon at client4300; counter4304 increments only below4 and resets4316 there, while client220 bit256 is always set. [Evidence](research/QVM_DAMAGE_ATTRIBUTION.md).

docs/PROVISIONAL_TODO.md

@@ -1122,3 +1122,6 @@ Research progress: RE-706 [report](research/QVM_DAMAGE_CLAMP.md); remaining nati
 
 
 Research progress: RE-707 [report](research/QVM_DAMAGE_WOUNDS.md); remaining native/content/runtime/platform scope stays open.
+
+
+Research progress: RE-708 [report](research/QVM_DAMAGE_ATTRIBUTION.md); remaining native/content/runtime/platform scope stays open.

docs/RESEARCH_LEDGER.md

@@ -1177,3 +1177,8 @@ Positive damage factors cap at1 and weapon4 additionally caps at float32 0.35; i
 ## 2026-10-21 — RE-707 Wound eligibility and client meter increments (separate task commit)
 
 Mode9, entity flag16 or protection suppress the wound word. Active client wounds set leg flag128 at locations11–14 and increment client4312 with source-specific threshold rules. 302 eligibility/weapon/location/ratio/meter fixtures pass independent exact float32 and unchanged-state checks. Full suite: 1279 tests pass. Report regenerates byte-identically (464742 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.
+
+
+## 2026-10-21 — RE-708 Active wound attribution and counter cap (separate task commit)
+
+Active wounds record attacker pointer at target836 and weapon at client4300; counter4304 increments only below4 and resets4316 there, while client220 bit256 is always set. 120 counter/weapon/flag combinations pass independent attribution, cap, reset and bit-preservation checks. Full suite: 1283 tests pass. Report regenerates byte-identically (179647 bytes). Storage/filter, links and whitespace checks pass. No assets/Rust runtime/shared VM evaluator changed; native/reference/legal/full platform scope remains open.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1165,3 +1165,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-707 Wound eligibility and client meter increments ([report](research/QVM_DAMAGE_WOUNDS.md)).
+
+
+- [x] RE-708 Active wound attribution and counter cap ([report](research/QVM_DAMAGE_ATTRIBUTION.md)).

docs/research/QVM_DAMAGE_ATTRIBUTION.md

@@ -0,0 +1,7 @@
+# Active wound attribution and counter cap
+
+RE-708. Reproduce with `python3 scripts/analyze_qvm_damage_attribution.py`; check with `python3 scripts/test_qvm_damage_attribution.py`. The [machine report](qvm-damage-attribution.json) retains source identity and bounded fixtures.
+
+Actual290228–290297 runs after the active client/wound gates. It writes target836 to the attacker pointer, client4300 to the weapon, and ORs256 into client220. Only signed client4304 below4 resets client4316 to zero and increments the counter. Existing counters4 and higher are preserved; negative fixtures expose signed arithmetic without establishing legal gameplay state. Other tracked client fields remain unchanged. This range does not allocate events, call external functions or apply health damage.
+
+No original executable/full QVM/native collision/physics/rendering executes. Native responses and legal input domains are supplied or unverified where stated; full runtime/macOS/Linux Rust/Bevy/Solari gameplay remains open.

docs/research/README.md

@@ -723,3 +723,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-707: Wound eligibility and client meter increments](QVM_DAMAGE_WOUNDS.md). Reproduce with `python3 scripts/analyze_qvm_damage_wounds.py`; check with `python3 scripts/test_qvm_damage_wounds.py`.
+
+
+[RE-708: Active wound attribution and counter cap](QVM_DAMAGE_ATTRIBUTION.md). Reproduce with `python3 scripts/analyze_qvm_damage_attribution.py`; check with `python3 scripts/test_qvm_damage_attribution.py`.

scripts/analyze_qvm_damage_attribution.py

@@ -0,0 +1,14 @@
+#!/usr/bin/env python3
+"""Active wound attribution, saturating counter and pending flag writes."""
+import itertools
+from pathlib import Path
+from qvm_research_support import source
+from qvm_damage_support import seed,run
+from analyze_qvm import write_json
+
+def main():
+    q,raw,h,ins=source();rows=[]
+    for counter,weapon,flags in itertools.product([-2,-1,0,1,3,4,5,2147483647],[3,4,24],[0,8,128,256,384]):
+        a=dict(counter=counter,weapon=weapon,flags=flags);_,p=run(ins,seed(raw,h,**a),290228,290298);p['input']=a;rows.append(p)
+    write_json(Path('docs/research/qvm-damage-attribution.json'),{'source':q['source'],'sha256':q['sha256'],'probes':rows,'limits':'Actual290228..290297 entered only for previously accepted active wounds. Negative counters are explicit arithmetic fixtures, not asserted legal state. No health damage.'})
+if __name__=='__main__':main()

scripts/test_qvm_damage_attribution.py

@@ -0,0 +1,19 @@
+import json,unittest
+from pathlib import Path
+from qvm_damage_support import ATTACKER
+class DamageAttributionTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):cls.ps=json.loads(Path('docs/research/qvm-damage-attribution.json').read_text())['probes']
+    def test_attacker_pointer_and_weapon_always_recorded(self):
+        for p in self.ps:self.assertEqual(p['final']['attacker_pointer'],ATTACKER);self.assertEqual(p['final']['client']['4300'],p['input']['weapon'])
+    def test_strict_counter_cap_and_auxiliary_reset(self):
+        for p in self.ps:
+            c=p['input']['counter'];self.assertEqual(p['final']['client']['4304'],(c+1 if c<4 else c)&0xffffffff);self.assertEqual(p['final']['client']['4316'],0 if c<4 else 77)
+    def test_pending_flag_preserves_other_bits(self):
+        for p in self.ps:self.assertEqual(p['final']['client']['220'],p['input']['flags']|256)
+    def test_meter_and_location_flags_unchanged(self):
+        self.assertEqual(len(self.ps),120)
+        for p in self.ps:
+            for o in ['192','4312','6304']:self.assertEqual(p['initial']['client'][o],p['final']['client'][o])
+            self.assertEqual(p['execution']['calls'],[])
+if __name__=='__main__':unittest.main()