qvm: recover connect completion callback order

docs/FINDINGS.md

@@ -1757,3 +1757,6 @@ RE-813–822 replaces the scoreboard decimal assumption with actual37914 executi
 
 
 **RE-919:** Rust matches160 original173979 admission prefixes, preserving bot bypass, address-before-password rejection, none/empty server password behavior, exact case-sensitive password results, messages and userinfo selector order. Typed invalid domains preserve selector state. Native userinfo/filter population and complete caller acceptance remain open. [Evidence](research/RUST_CONNECT_ADMISSION.md).
+
+
+**RE-920:** 144 actual173979 suffix cases execute original mode classification and broadcast formatting with explicit bot/userinfo answers. Team normalization precedes bot flags/admission; failed bots return after those mutations. First-time paths clear selected ranges and overwrite timeout without the initializer60-second default. Updated userinfo/name precedes broadcast and a second team decision; ranking is requested last. Bot, userinfo, join, ranking, logs/network and native memset remain supplied/captured/modeled boundaries. [Evidence](research/QVM_CONNECT_TAIL.md).

docs/PROVISIONAL_TODO.md

@@ -1797,3 +1797,6 @@ RE-918: 160 actual173979 prefix cases execute userinfo70503, address252643, unsi
 
 
 RE-919: Rust matches160 original173979 admission prefixes, preserving bot bypass, address-before-password rejection, none/empty server password behavior, exact case-sensitive password results, messages and userinfo selector order. Typed invalid domains preserve selector state. Native userinfo/filter population and complete caller acceptance remain open. Full runtime completion remains open. [Evidence](research/RUST_CONNECT_ADMISSION.md).
+
+
+RE-920: 144 actual173979 suffix cases execute original mode classification and broadcast formatting with explicit bot/userinfo answers. Team normalization precedes bot flags/admission; failed bots return after those mutations. First-time paths clear selected ranges and overwrite timeout without the initializer60-second default. Updated userinfo/name precedes broadcast and a second team decision; ranking is requested last. Bot, userinfo, join, ranking, logs/network and native memset remain supplied/captured/modeled boundaries. Full runtime completion remains open. [Evidence](research/QVM_CONNECT_TAIL.md).

docs/RESEARCH_LEDGER.md

@@ -2320,3 +2320,8 @@ Rust matches270 original252643 parser/filter cases, retaining byte wrapping, per
 ## 2026-10-28 — RE-919 Rust connect admission and password ordering
 
 Rust matches160 original173979 admission prefixes, preserving bot bypass, address-before-password rejection, none/empty server password behavior, exact case-sensitive password results, messages and userinfo selector order. Typed invalid domains preserve selector state. Native userinfo/filter population and complete caller acceptance remain open. Focused `cargo xtask test-group rust-connect-admission` passes (9 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.
+
+
+## 2026-10-28 — RE-920 Original post-session connect normalization and callbacks
+
+144 actual173979 suffix cases execute original mode classification and broadcast formatting with explicit bot/userinfo answers. Team normalization precedes bot flags/admission; failed bots return after those mutations. First-time paths clear selected ranges and overwrite timeout without the initializer60-second default. Updated userinfo/name precedes broadcast and a second team decision; ranking is requested last. Bot, userinfo, join, ranking, logs/network and native memset remain supplied/captured/modeled boundaries. Focused `cargo xtask test-group qvm-connect-tail` passes (4 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1834,3 +1834,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-919 Rust connect admission and password ordering ([evidence](research/RUST_CONNECT_ADMISSION.md)).
+
+
+- [x] RE-920 Original post-session connect normalization and callbacks ([evidence](research/QVM_CONNECT_TAIL.md)).

docs/research/QVM_CONNECT_TAIL.md

@@ -0,0 +1,7 @@
+# Original post-session connect normalization and callbacks
+
+RE-920. Reproduce with `python3 scripts/analyze_qvm_connect_tail.py`; focused validation: `cargo xtask test-group qvm-connect-tail`. [Machine report](qvm-connect-tail.json).
+
+144 actual173979 suffix cases execute original mode classification and broadcast formatting with explicit bot/userinfo answers. Team normalization precedes bot flags/admission; failed bots return after those mutations. First-time paths clear selected ranges and overwrite timeout without the initializer60-second default. Updated userinfo/name precedes broadcast and a second team decision; ranking is requested last. Bot, userinfo, join, ranking, logs/network and native memset remain supplied/captured/modeled boundaries.
+
+Original executable/native runtime and complete Linux/macOS Rust/Bevy/Solari acceptance remain unverified.

docs/research/README.md

@@ -1369,3 +1369,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-919: Rust connect admission and password ordering](RUST_CONNECT_ADMISSION.md).
+
+
+[RE-920: Original post-session connect normalization and callbacks](QVM_CONNECT_TAIL.md).

scripts/analyze_qvm_connect_tail.py

@@ -0,0 +1,21 @@
+#!/usr/bin/env python3
+"""Execute the verified original QVM body; native effects are supplied or captured."""
+import itertools
+from pathlib import Path
+from qvm_research_support import source,constants
+from qvm_camera_world_support import B,run
+from qvm_exit_rules_support import POOL,CPOOL
+from analyze_qvm_acceleration import word,number
+from analyze_qvm import write_json
+
+def main():
+ q,raw,h,ins=source();rows=[]
+ from qvm_connect_policy_support import environment,connect_tail,WATCH
+ from qvm_map_commands_support import put_string
+ for mode,team,bot,first,answer,changed in itertools.product([0,3,9],[0,2,3],[0,1],[0,1],[0,1],[False,True]):
+  m,b=environment(raw,h);slot=3;pointer=CPOOL+6336*slot
+  for o in range(0,6336,4):m[pointer+o]=0xaabbccdd
+  now=2147483647 if mode==9 else 100;seconds={0:0,2:2,3:-1}[team];m.update({pointer+3096:team,34090788:mode,34992532:now,34085460:seconds,POOL+880*slot+424:32,POOL+880*slot+532:0});put_string(m,b,pointer+504,b'old');m,p,b=connect_tail(ins,m,b,slot,first,bot,answer,2 if changed else None,b'new^1name');p.update(input=dict(mode=mode,team=team,bot=bot,first=first,answer=answer,changed=changed,now=now,seconds=seconds),words={str(o):m[pointer+o]&0xffffffff for o in WATCH},entity_flags=m[POOL+880*slot+424]&0xffffffff,in_use=m[POOL+880*slot+532]&0xffffffff,ring=m[23708]&0xffffffff);rows.append(p)
+
+ write_json(Path('docs/research/qvm-connect-tail.json'),{'source':q['source'],'sha256':q['sha256'],'root':173979,'probes':rows,'limits':'144 actual173979 suffix cases execute original mode classification and broadcast formatting with explicit bot/userinfo answers. Team normalization precedes bot flags/admission; failed bots return after those mutations. First-time paths clear selected ranges and overwrite timeout without the initializer60-second default. Updated userinfo/name precedes broadcast and a second team decision; ranking is requested last. Bot, userinfo, join, ranking, logs/network and native memset remain supplied/captured/modeled boundaries.'})
+if __name__=='__main__':main()

scripts/qvm_connect_policy_support.py

@@ -40,3 +40,33 @@ def admission_handlers(userinfo,steps,state):
 
 def admission(ins,m,b,slot,first,bot,userinfo):
  steps=[];state={};m,v,p,b=run(ins,m,173979,174081,1080,{8:slot,12:first,16:bot},b,admission_handlers(userinfo,steps,state),base=AUTH);p.update(steps=steps,filter=state,accepted=v is None,message=None if v is None else cstring(m,b,v).hex());return m,p,b
+
+TAIL=COMPARE+0x8000
+WATCH=[504,508,512,516,3096,3140,*range(668,696,4),*range(3204,3592,4)]
+def tail_handlers(slot,bot_answer,after_team,name,events):
+ from qvm_scoreboard_wire_support import final_format
+ from qvm_formatter_support import formatter
+ from qvm_camera_world_support import POOL
+ from qvm_exit_rules_support import CPOOL
+ pointer=CPOOL+6336*slot
+ def classify(i,m,a,bs):
+  events.append(dict(op='classify',mode=a[8]));m,v,p,b=run(i,m,33715,33740,12,a,dict(bs),base=COMPARE+0xa000);return m,v,{'actual_source_child':33715}
+ def bot(i,m,a,bs):events.append(dict(op='bot',slot=a[8],restart=a[12]));return m,bot_answer,{'bot_answer_supplied':True}
+ def zero(i,m,a,bs):events.append(dict(op='zero',offset=a[8]-pointer,length=a[16]));return m,a[8],{'native_memset_modeled':True,'child_memory_bytes':{a[8]+j:0 for j in range(a[16])}}
+ def log(i,m,a,bs):events.append(dict(op='log',slot=a[12]));return m,0,{'log_captured':True}
+ def info(i,m,a,bs):
+  events.append(dict(op='userinfo',slot=a[8]));
+  if after_team is not None:m[pointer+3096]=after_team
+  data=name.split(b'\0')[0]+b'\0';return m,0,{'userinfo_effect_supplied':True,'child_memory_bytes':{pointer+504+j:v for j,v in enumerate(data)}}
+ def fmt(i,m,a,bs):events.append(dict(op='format'));return final_format(i,m,a,dict(bs),formatter)
+ def send(i,m,a,bs):events.append(dict(op='send',recipient=a[8],text=cstring(m,bs,a[12]).hex()));return m,0,{'network_send_captured':True}
+ def join(i,m,a,bs):events.append(dict(op='join',slot=(a[8]-CPOOL)//6336,choice=a[12]));return m,0,{'team_callback_captured':True}
+ def rank(i,m,a,bs):events.append(dict(op='rank'));return m,0,{'ranking_callback_captured':True}
+ return {33715:classify,161744:bot,-101:zero,7259:log,171668:info,70458:fmt,-18:send,182896:join,5864:rank}
+
+def connect_tail(ins,m,b,slot,first,bot,bot_answer,after_team,name):
+ import hashlib,json
+ from qvm_camera_world_support import POOL
+ from qvm_exit_rules_support import CPOOL
+ events=[];m[TAIL+20]=CPOOL+6336*slot;m[TAIL+24]=POOL+880*slot
+ m,v,p,b=run(ins,m,174173,174397,1080,{8:slot,12:first,16:bot},b,tail_handlers(slot,bot_answer,after_team,name,events),base=TAIL);changes=p.pop('changes');p.update(events=events,change_count=len(changes),changes_sha256=hashlib.sha256(json.dumps(changes,sort_keys=True).encode()).hexdigest(),accepted=v==0,message=None if v==0 else cstring(m,b,v).hex());return m,p,b

scripts/qvm_connect_tail_oracle.py

@@ -0,0 +1,18 @@
+"""Independent connect suffix state/event oracle."""
+WATCH=[504,508,512,516,3096,3140,*range(668,696,4),*range(3204,3592,4)]
+def policy(a):
+ raw=bytearray((0xaabbccdd).to_bytes(4,'little')*1584);put=lambda o,v:raw.__setitem__(slice(o,o+4),(v&0xffffffff).to_bytes(4,'little'));put(3096,a['team']);raw[504:516]=b'old'+b'\0'*9;team=(3 if a['team']==0 else a['team']) if a['mode']==3 else 3 if a['team']==3 else 0;put(3096,team);events=[dict(op='classify',mode=a['mode'])];flags=32;active=0;accepted=True;message=None;ring=0
+ if a['bot']:
+  flags|=8;active=1;events.append(dict(op='bot',slot=3,restart=int(not a['first'])))
+  if not a['answer']:accepted=False;message=b'BotConnectfailed'.hex()
+ if accepted:
+  if a['first']:raw[668:696]=b'\0'*28;put(3140,a['now']+a['seconds']*1000);events.append(dict(op='zero',offset=668,length=28))
+  events.append(dict(op='log',slot=3))
+  if a['first']:put(3588,0);raw[3204:3332]=b'\0'*128;raw[3332:3588]=b'\0'*256;events.extend([dict(op='zero',offset=3204,length=128),dict(op='zero',offset=3332,length=256)])
+  events.append(dict(op='userinfo',slot=3));raw[504:514]=b'new^1name\0'
+  if a['changed']:team=2;put(3096,team)
+  if a['first']:events.extend([dict(op='format'),dict(op='send',recipient=-1,text=b'print "new^1name^7 connected\n"'.hex())]);ring=1
+  events.append(dict(op='classify',mode=a['mode']))
+  if a['mode']==3 and team!=3:events.append(dict(op='join',slot=3,choice=-1))
+  events.append(dict(op='rank'))
+ return dict(words={str(o):int.from_bytes(raw[o:o+4],'little') for o in WATCH},events=events,entity_flags=flags,in_use=active,accepted=accepted,message=message,ring=ring)

scripts/test_qvm_connect_tail.py

@@ -0,0 +1,12 @@
+import json,unittest
+from pathlib import Path
+class OriginalTests(unittest.TestCase):
+ def test_instruction_results(self):
+  rows=json.loads(Path('docs/research/qvm-connect-tail.json').read_text())['probes']
+  self.assertEqual(len(rows),144)
+  from qvm_connect_tail_oracle import policy
+  for p in rows:
+   expected=policy(p['input'])
+   for k,v in expected.items():self.assertEqual(p[k],v)
+
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -2960,3 +2960,9 @@ report	scripts/analyze_rust_connect_admission.py	docs/research/rust-connect-admi
 edge	docs/research/rust-connect-admission.json	scripts/test_rust_connect_admission.py
 group	rust-connect-admission	scripts/analyze_rust_connect_admission.py
 edge	scripts/analyze_rust_connect_admission.py	scripts/analyze_qvm_resumer_audit.py
+edge	scripts/qvm_connect_tail_oracle.py	scripts/test_qvm_connect_tail.py
+report	scripts/analyze_qvm_connect_tail.py	docs/research/qvm-connect-tail.json
+edge	docs/research/qvm-connect-tail.json	scripts/test_qvm_connect_tail.py
+group	qvm-connect-tail	scripts/analyze_qvm_connect_tail.py
+edge	scripts/analyze_qvm_connect_tail.py	scripts/analyze_qvm_resumer_audit.py
+edge	scripts/qvm_connect_tail_oracle.py	scripts/analyze_qvm_resumer_audit.py