qvm: recover client timer deadline fragments

docs/FINDINGS.md

@@ -1859,3 +1859,5 @@ RE-961: Rust matches48 original full-table expiry/admission cases and all table
 RE-962: Forty actual150692 prefix executions through150791 compose source65613 squared horizontal motion and252067 full-table expiry. Strict elapsed>3000 and square>100 gate activity, z is discarded, entity bit64 copies to the client flag, and the timer wraps. Every prefix invocation reaches expiry regardless of movement gates/count. Direct sites place loader252933 at3924 inside3877 and expiry252067 at150789 inside150692. Whole callback/cadence and native runtime remain open. [Evidence](research/QVM_FILTER_FRAME_PREFIX.md).
 
 RE-963: Rust matches40 original frame-prefix cases, retaining squared horizontal motion, strict elapsed/square gates, ignored z, source bit64 copy, wrapping accumulation and unconditional full-table expiry. Unit tests cover ignored NaN z, equality, tick wrap and atomic rejection of unsupported horizontal values/incomplete storage. This ports only150692..150791; full callback/caller cadence and native runtime remain open. [Evidence](research/RUST_FILTER_FRAME_PREFIX.md).
+
+RE-964: A144-case source contract executes disjoint150791..150810 and151085..151131 fragments. Entity cooldown multiplication/addition wraps before signed comparison; exact equality preserves flags. Client bit2 clears only after a strict deadline, unrelated bits and deadline/stamp words survive, and elapsed-total accumulation wraps. Intervening loop and native scheduling remain outside this fragment contract. [Evidence](research/QVM_CLIENT_TIMER_TERMINAL.md).

docs/PROVISIONAL_TODO.md

@@ -1911,3 +1911,5 @@ RE-944–953 completed bounded time/expiry/loading/duration and export/reload co
 - [x] RE-963 Rust client-frame prefix with source motion gates and expiry ([evidence](research/RUST_FILTER_FRAME_PREFIX.md)).
 
 RE-954–963 completed add/remove wrappers, resolved duration export, full-capacity expiry/admission and a bounded frame prefix. RE-964 tracks remaining callers/native ownership and runtime integration. [Batch and next work](research/QVM_FILTER_COMMANDS_BATCH.md).
+
+- [x] RE-964 Original client timer deadline and terminal-counter fragments ([evidence](research/QVM_CLIENT_TIMER_TERMINAL.md)).

docs/RESEARCH_LEDGER.md

@@ -2523,3 +2523,7 @@ Forty actual150692 prefix executions through150791 compose source65613 squared h
 Rust matches40 original frame-prefix cases, retaining squared horizontal motion, strict elapsed/square gates, ignored z, source bit64 copy, wrapping accumulation and unconditional full-table expiry. Unit tests cover ignored NaN z, equality, tick wrap and atomic rejection of unsupported horizontal values/incomplete storage. This ports only150692..150791; full callback/caller cadence and native runtime remain open. Focused `cargo xtask test-group rust-filter-frame-prefix` passes with deterministic report regeneration, relevant regressions and storage/documentation/whitespace checks. Full suite deferred to the tenth-commit boundary. Original assets unchanged; native IO effects remain captured.
 
 Batch RE-954–963 boundary: the single `cargo xtask test-full --since 696a4794` run after commit ten passed with the flake-declared Nix Python: 1,858 Python tests, 260 Rust tests (assets10, gameplay220, xtask30), 106 deterministic report producers, storage policy, 535 documentation files and whitespace guards. No generated report drift. Focused dependency-selection regression covers all five new source/Rust pairs and shared command/loading/lifecycle/native-policy/formatter inputs, including scoped gameplay test-count metadata. Validation notes were amended into task ten; original assets unchanged. See [batch findings and next work](research/QVM_FILTER_COMMANDS_BATCH.md).
+
+## 2026-10-28 — RE-964 Original client timer deadline and terminal-counter fragments
+
+A144-case source contract executes disjoint150791..150810 and151085..151131 fragments. Entity cooldown multiplication/addition wraps before signed comparison; exact equality preserves flags. Client bit2 clears only after a strict deadline, unrelated bits and deadline/stamp words survive, and elapsed-total accumulation wraps. Intervening loop and native scheduling remain outside this fragment contract. Focused `cargo xtask test-group qvm-client-timer-terminal` passes with deterministic report regeneration, relevant regressions and storage/documentation/whitespace checks. Full suite deferred to the tenth-commit boundary. Original assets unchanged; native IO effects remain captured.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1948,3 +1948,5 @@ RE-954–963 recover bounded command wrappers, resolved duration export, full-ca
 - [x] RE-963 Rust client-frame prefix with source motion gates and expiry ([evidence](research/RUST_FILTER_FRAME_PREFIX.md)).
 
 - [ ] RE-964 Recover remaining frame/initialization callers and native command/time/file/network ownership, bot setup/userinfo and full Rust/Bevy/Solari acceptance ([next work](research/QVM_FILTER_COMMANDS_BATCH.md)).
+
+- [x] RE-964 Original client timer deadline and terminal-counter fragments ([evidence](research/QVM_CLIENT_TIMER_TERMINAL.md)).

docs/research/QVM_CLIENT_TIMER_TERMINAL.md

@@ -0,0 +1,5 @@
+# Original client timer deadline and terminal-counter fragments
+
+RE-964. Focused validation: `cargo xtask test-group qvm-client-timer-terminal`. [Machine report](qvm-client-timer-terminal.json).
+
+A144-case source contract executes disjoint150791..150810 and151085..151131 fragments. Entity cooldown multiplication/addition wraps before signed comparison; exact equality preserves flags. Client bit2 clears only after a strict deadline, unrelated bits and deadline/stamp words survive, and elapsed-total accumulation wraps. Intervening loop and native scheduling remain outside this fragment contract.

docs/research/README.md

@@ -1483,3 +1483,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 - [RE-963: Rust client-frame prefix with source motion gates and expiry](RUST_FILTER_FRAME_PREFIX.md).
 
 - [RE-954–963 filter commands batch and RE-964 next work](QVM_FILTER_COMMANDS_BATCH.md).
+
+- [RE-964: Original client timer deadline and terminal-counter fragments](QVM_CLIENT_TIMER_TERMINAL.md).

scripts/analyze_qvm_client_timer_terminal.py

@@ -0,0 +1,12 @@
+"""Execute original pre-loop deadline and post-loop terminal timer fragments."""
+from pathlib import Path
+from analyze_qvm import write_json
+from qvm_research_support import source
+from qvm_client_timer_support import seed,terminal,terminal_fixtures
+
+def main():
+ q,raw,h,ins=source();probes=[]
+ for a in terminal_fixtures():
+  m,b=seed(raw,h,a);m,p,b=terminal(ins,m,b,a);p['input']=a;probes.append(p)
+ write_json(Path('docs/research/qvm-client-timer-terminal.json'),dict(source=q['source'],sha256=q['sha256'],ranges=[[150791,150810],[151085,151131]],probes=probes,limits='144 original fragment pairs cover signed wrapping cooldown multiplication/addition, strict deadline expiry, flag-bit preservation and elapsed-total wrap. These are disjoint pre/post-loop fragments; intervening loop and native frame scheduling are not executed in this contract.'))
+if __name__=='__main__':main()

scripts/qvm_client_timer_oracle.py

@@ -0,0 +1,5 @@
+"""Independent word arithmetic and reviewed timer-state expectations."""
+def signed(v):v&=0xffffffff;return v if v<2**31 else v-2**32
+
+def terminal(a):
+ return dict(entity_flag=0 if signed(a['stamp']+a['cooldown']*1000)<signed(a['tick']) else a['entity_flag'],client_flags=a['client_flags']&~2 if a['client_flags']&2 and signed(a['tick'])>signed(a['deadline']) else a['client_flags'],elapsed_total=(a['elapsed_total']+a['msec'])&0xffffffff,deadline=a['deadline']&0xffffffff,stamp=a['stamp']&0xffffffff)

scripts/qvm_client_timer_support.py

@@ -0,0 +1,23 @@
+"""Original client timer fragments and full body, with captured damage effects."""
+from qvm_camera_world_support import B,run,POOL
+from qvm_exit_rules_support import CPOOL
+from qvm_filter_loading_support import environment
+ROOT=B+0x340000
+ENTITY=POOL+880*2
+CLIENT=CPOOL+6336*2
+TERMINAL_FIELDS=[104,4164]
+
+def seed(raw,h,a,rows=()):
+ from qvm_byte_memory_support import write_bytes
+ m,b=environment(raw,h,rows);write_bytes(m,b,{p:raw[h['data_offset']+p] for p in range(29084,29112)});m[ENTITY+520]=CLIENT;m[ROOT+44]=CLIENT
+ m.update({34992532:a.get('tick',10000),34075100:a.get('cooldown',2),ENTITY+768:a.get('stamp',8000),ENTITY+764:a.get('entity_flag',7),CLIENT+104:a.get('client_flags',7),CLIENT+4148:a.get('deadline',9999),CLIENT+4164:a.get('elapsed_total',0xffffffff)})
+ return m,b
+
+def terminal(ins,m,b,a):
+ m,v,p,b=run(ins,m,150790,150810,92,{8:ENTITY,12:a['msec']},b,base=ROOT)
+ m,v,q,b=run(ins,m,151084,151131,92,{8:ENTITY,12:a['msec']},b,base=ROOT)
+ return m,dict(entity_flag=m[ENTITY+764]&0xffffffff,client_flags=m[CLIENT+104]&0xffffffff,elapsed_total=m[CLIENT+4164]&0xffffffff,deadline=m[CLIENT+4148]&0xffffffff,stamp=m[ENTITY+768]&0xffffffff,execution=p['execution'],tail_execution=q['execution']),b
+
+def terminal_fixtures():
+ from itertools import product
+ return [dict(stamp=stamp,cooldown=cooldown,tick=tick,client_flags=flags,deadline=deadline,entity_flag=7,elapsed_total=0xffffffff,msec=2) for stamp,cooldown,tick,flags,deadline in product([7999,8000,8001,0xffffffff],[0,2,0x7fffffff],[10000,0x80000000],[0,2,7],[9999,10000])]

scripts/test_qvm_client_timer_terminal.py

@@ -0,0 +1,11 @@
+import json,unittest
+from pathlib import Path
+from qvm_client_timer_oracle import terminal
+class TerminalTests(unittest.TestCase):
+ def test_original_fragments(self):
+  rows=json.loads(Path('docs/research/qvm-client-timer-terminal.json').read_text())['probes'];self.assertEqual(len(rows),144)
+  for p in rows:
+   for k,v in terminal(p['input']).items():self.assertEqual(p[k],v)
+ def test_equal_deadlines_preserve_flags(self):
+  p=terminal(dict(stamp=8000,cooldown=2,tick=10000,entity_flag=7,client_flags=7,deadline=10000,elapsed_total=0xffffffff,msec=2));self.assertEqual(p['entity_flag'],7);self.assertEqual(p['client_flags'],7);self.assertEqual(p['elapsed_total'],1)
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -3416,3 +3416,7 @@ group	rust-filter-frame-prefix	scripts/analyze_rust_health_impulse.py
 group	gameplay	scripts/analyze_rust_filter_frame_prefix.py
 edge	crates/urt-gameplay/src/filter_commands.rs	scripts/analyze_rust_filter_frame_prefix.py
 edge	crates/urt-gameplay/src/bin/urt-filter-commands.rs	scripts/analyze_rust_filter_frame_prefix.py
+report	scripts/analyze_qvm_client_timer_terminal.py	docs/research/qvm-client-timer-terminal.json
+edge	docs/research/qvm-client-timer-terminal.json	scripts/test_qvm_client_timer_terminal.py
+group	qvm-client-timer-terminal	scripts/analyze_qvm_client_timer_terminal.py
+edge	scripts/analyze_qvm_client_timer_terminal.py	scripts/analyze_qvm_resumer_audit.py