qvm: resolve defuse completion score and counters

docs/FINDINGS.md

@@ -1995,3 +1995,5 @@ RE-1025: Rust implements caller-indexed wrapping counter increments across12 sou
 RE-1026: Thirty-four original-QVM scenarios recover193620 with actual mode classifier33715. Live non-following non-spectator sender obtains supplied location text, then sends rsay sender/-1/type/text to connected same-team recipients in team modes or mode9. Mode11 and signed negative modes do not route. Sender marker84 becomes tick+3500 and marker204 becomes1 only when a command is sent. Empty/quoted payloads, failed text lookup, zero/64 counts and wrap are covered. Native sending and location lookup remain boundaries; fixed formatter is modeled. [Evidence](research/QVM_EFFECT_RADIO.md).
 
 RE-1027: Rust matches34 source team-radio scenarios, including the mode9 exception, mode11/signed exclusions, failed location text, raw quote preservation and64-recipient tables. Only actual sends update an existing marker; empty routing leaves it unchanged. Tests cover connected same-team routing, wrapped marker deadlines and invalid payload atomicity. Text location and native network sends remain boundaries. [Evidence](research/RUST_EFFECT_RADIO.md).
+
+RE-1028: Sixty-four source probes execute defuse completion with actual205260 and283463. Ready completion adds one player score point and requests ranking unless paused, then increments counter index5 by1 regardless of pause. Both score and counter wrap independently. Waiting does neither. Corrected ordered requests are log, allocate, score, optional rank, counter; allocation/log/ranking remain boundaries. This replaces the earlier misleading teleport/five-point labels with actual state feedback. [Evidence](research/QVM_EFFECT_DEFUSE_FINISH.md).

docs/PROVISIONAL_TODO.md

@@ -2055,3 +2055,5 @@ RE-974–983 completed routing, command rewrite, inactivity, movement-parameter
 - [x] RE-1026 Recover team radio routing and marker state ([evidence](research/QVM_EFFECT_RADIO.md)).
 
 - [x] RE-1027 Port team radio command planning and marker feedback ([evidence](research/RUST_EFFECT_RADIO.md)).
+
+- [x] RE-1028 Resolve defuse completion score and objective counter ([evidence](research/QVM_EFFECT_DEFUSE_FINISH.md)).

docs/RESEARCH_LEDGER.md

@@ -2783,3 +2783,7 @@ Thirty-four original-QVM scenarios recover193620 with actual mode classifier3371
 ## 2026-10-29 — RE-1027 Port team radio command planning and marker feedback
 
 Rust matches34 source team-radio scenarios, including the mode9 exception, mode11/signed exclusions, failed location text, raw quote preservation and64-recipient tables. Only actual sends update an existing marker; empty routing leaves it unchanged. Tests cover connected same-team routing, wrapped marker deadlines and invalid payload atomicity. Text location and native network sends remain boundaries. Focused `cargo xtask test-group rust-effect-radio` passes with deterministic report regeneration and selected regressions. Full suite deferred to task ten. Original assets unchanged; Python uses the flake-declared Nix runtime.
+
+## 2026-10-29 — RE-1028 Resolve defuse completion score and objective counter
+
+Sixty-four source probes execute defuse completion with actual205260 and283463. Ready completion adds one player score point and requests ranking unless paused, then increments counter index5 by1 regardless of pause. Both score and counter wrap independently. Waiting does neither. Corrected ordered requests are log, allocate, score, optional rank, counter; allocation/log/ranking remain boundaries. This replaces the earlier misleading teleport/five-point labels with actual state feedback. Focused `cargo xtask test-group qvm-effect-defuse-finish` passes with deterministic report regeneration and selected regressions. Full suite deferred to task ten. Original assets unchanged; Python uses the flake-declared Nix runtime.

docs/REVERSE_ENGINEERING_TODO.md

@@ -2092,3 +2092,5 @@ RE-974–983 recover routing, command rewriting, inactivity and composed setup t
 - [x] RE-1026 Recover team radio routing and marker state ([evidence](research/QVM_EFFECT_RADIO.md)).
 
 - [x] RE-1027 Port team radio command planning and marker feedback ([evidence](research/RUST_EFFECT_RADIO.md)).
+
+- [x] RE-1028 Resolve defuse completion score and objective counter ([evidence](research/QVM_EFFECT_DEFUSE_FINISH.md)).

docs/research/QVM_EFFECT_DEFUSE_FINISH.md

@@ -0,0 +1,5 @@
+# Resolve defuse completion score and objective counter
+
+RE-1028. Focused validation: `cargo xtask test-group qvm-effect-defuse-finish`. [Machine report](qvm-effect-defuse-finish.json).
+
+Sixty-four source probes execute defuse completion with actual205260 and283463. Ready completion adds one player score point and requests ranking unless paused, then increments counter index5 by1 regardless of pause. Both score and counter wrap independently. Waiting does neither. Corrected ordered requests are log, allocate, score, optional rank, counter; allocation/log/ranking remain boundaries. This replaces the earlier misleading teleport/five-point labels with actual state feedback.

docs/research/README.md

@@ -1623,3 +1623,5 @@ The extension collector adds five focused tests for native tail calls, command-r
 - [RE-1026: Recover team radio routing and marker state](QVM_EFFECT_RADIO.md).
 
 - [RE-1027: Port team radio command planning and marker feedback](RUST_EFFECT_RADIO.md).
+
+- [RE-1028: Resolve defuse completion score and objective counter](QVM_EFFECT_DEFUSE_FINISH.md).

docs/research/qvm-resumer-audit.json

@@ -9033,6 +9033,17 @@
       "repeated_calls_opt_in": true,
       "repeated_calls_setting": "literal_true"
     },
+    {
+      "backward_conditional_branches": [],
+      "calls": [],
+      "explicit_result_offsets": null,
+      "helper": "qvm_trace_support.resume",
+      "line": 118,
+      "literal_range": null,
+      "path": "scripts/qvm_effect_feedback_support.py",
+      "repeated_calls_opt_in": true,
+      "repeated_calls_setting": "literal_true"
+    },
     {
       "backward_conditional_branches": [],
       "calls": [],
@@ -10640,10 +10651,10 @@
     }
   },
   "summary": {
-    "call_expressions": 214,
-    "files": 163,
+    "call_expressions": 215,
+    "files": 164,
     "legacy_expressions": 158,
-    "nonliteral_ranges": 31,
+    "nonliteral_ranges": 32,
     "unresolved_mode_expressions": 3
   }
 }

scripts/analyze_qvm_effect_defuse_finish.py

@@ -0,0 +1,12 @@
+"""Verified original movement-context source contract."""
+from pathlib import Path
+from analyze_qvm import write_json
+from qvm_research_support import source
+from qvm_effect_feedback_support import seed,finish,finish_fixtures
+
+def main():
+ q,raw,h,ins=source();probes=[]
+ for a in finish_fixtures():
+  m,b=seed(raw,h,a);m,p,b=finish(ins,m,b,a);p['input']=a;probes.append(p)
+ write_json(Path('docs/research/qvm-effect-defuse-finish.json'),dict(source=q['source'],sha256=q['sha256'],probes=probes,limits='Active defuse153644 with actual205260 score and283463 counter bodies. Ranking5864/log captured and event allocation supplied. Pause affects score only; no teleport execution occurs.'))
+if __name__=='__main__':main()

scripts/qvm_effect_feedback_oracle.py

@@ -16,3 +16,38 @@ def radio(a):
    if j==2:team=a['team']
    if connection==2 and (team_mode or mode==9) and team==a['team']:commands.append(dict(slot=j,text=text))
  return dict(commands=commands,getter_calls=int(active),marker=[(a['tick']+3500)&0xffffffff,1] if commands and a['marker'] else [17,18])
+
+def resolve(a,parent):
+ import copy
+ out=copy.deepcopy(parent);events=[];radios=[];score=0xffffffff;counters=[100+j for j in range(15)];counters[5]=0xffffffff;marker=[17,18];record=None
+ for e in parent['events']:
+  op=e['op']
+  if op=='teleport':
+   events.append(dict(op='score',delta=1))
+   if not a['paused']:score=0;events.append(dict(op='rank'))
+  elif op=='award':counters[5]=0;events.append(dict(op='counter',index=5))
+  elif op=='sound':
+   events.append(dict(op='radio',code=7))
+   if 'selector' in a:
+    selected=2 if a['selector']==1 else 1;team=a['team'] or selected
+    clients=[[2,selected] for _ in range(max(3,a['count']))];clients[a['busy_slot']]=[a['other_connection'],a['other_team'] or selected];clients[2]=[a['connection'],team]
+   else:team=1;clients=[[2,1],[2,2],[2,1],[1,2]]
+   payload=bytes.fromhex(a['payload']) if a['success'] else b'';text=(b'rsay 2 -1 7 "'+payload+b'"').hex()
+   commands=[dict(slot=j,text=text) for j,c in enumerate(clients[:a.get('count',4)]) if c[0]==2 and c[1]==team]
+   if commands and a['marker']:marker=[(a['tick']+3500)&0xffffffff,1]
+   radios.append(dict(commands=commands,getter_calls=1,marker=list(marker)))
+  else:
+   events.append(e)
+   if op=='allocate' and a['constructed']:
+    from analyze_qvm_acceleration import word
+    origin=a['origin'];snap=[word(float(int(v))) for v in origin];init=0x13579bdf
+    record={str(o):init for o in [4,12,16,20,24,28,32,36,40,44,84,140,400,424,488,492,496,536,540,568,572]}
+    record.update({'4':e['event']+19,'12':0,'16':0,'20':0,'36':0,'40':0,'44':0,'424':out['event'][1],'536':97191,'540':662184166,'568':a['tick'],'572':1})
+    for j,v in enumerate(snap):record[str(24+4*j)]=v;record[str(488+4*j)]=v
+    events.append(dict(op='link'))
+ out.update(events=events,score=score,teams=[100,101,102,103],counters=counters,radio=radios,marker=marker,event_record=record)
+ return out
+
+def finish(a):
+ from qvm_defuse_oracle import finish
+ return resolve(a,finish(a))

scripts/qvm_effect_feedback_support.py

@@ -62,3 +62,59 @@ def radio_run(ins,m,b,code,payload,success):
  return m,dict(commands=commands,getter_calls=len(getters),marker=[m[MARK+84]&0xffffffff,m[MARK+204]&0xffffffff],execution=p['execution']),b
 
 def radio(ins,m,b,a):radio_seed(m,b,a);return radio_run(ins,m,b,a['code'],bytes.fromhex(a['payload']),a['success'])
+
+EVENT_FIELDS=[4,12,16,20,24,28,32,36,40,44,84,140,400,424,488,492,496,536,540,568,572]
+
+def finish_fixtures():
+ from qvm_defuse_support import finish_fixtures as fixtures
+ return [dict(a,paused=paused,constructed=0,marker=1,success=1,payload=b'Bomb site'.hex(),origin=[1.9,-1.9,-0.]) for a in fixtures() for paused in [0,1]]
+
+def feedback_seed(m,b,a,full=False):
+ for o in range(0,880,4):m.setdefault(ALLOC+o,0x13579bdf)
+ m.update({CLIENT+248:0xffffffff,CLIENT+260:1,34992512:a['paused'],34090788:8,34081020:0,CLIENT+6168:MARK if a['marker'] else 0,MARK+84:17,MARK+204:18})
+ for j in range(4):m[34992552+4*j]=100+j
+ for j in range(15):m[CLIENT+3036+4*j]=100+j
+ m[CLIENT+3056]=0xffffffff
+ if not full:
+  m.update({CLIENT+208:1,CLIENT+4324:0,CLIENT+3096:1,34992524:4})
+  for j in range(4):m[POOL+880*j+520]=CPOOL+6336*j;m[CPOOL+6336*j+468]=2 if j!=3 else 1;m[CPOOL+6336*j+3096]=1 if j%2==0 else 2
+  for j,v in enumerate(a['origin']):m[BOMB+24+4*j]=word(v)
+ write_bytes(m,b,{RADIO+32+j:77 for j in range(156)})
+
+def resolved_handlers(events,radios,a):
+ def log(i,m,args,bs):events.append(dict(op='log',format=cstring(m,bs,args[8]).hex(),slot=args[12]));return m,0,{'captured_log':7259}
+ def score(i,m,args,bs):
+  assert args[8]==ENTITY and args[12]==ENTITY+488 and args[16]==1
+  events.append(dict(op='score',delta=1))
+  def rank(i,m,args,b):events.append(dict(op='rank'));return m,0,{'ranking_captured':5864}
+  m,v,p,b=run(i,m,205260,205328,16,args,dict(bs),{5864:rank},base=ROOT+0x190000)
+  return m,0,{'actual_source_child':205260}
+ def counter_(i,m,args,bs):
+  assert args[8]==ENTITY and args[12]==5
+  m,v,p,b=run(i,m,283463,283486,12,args,dict(bs),base=ROOT+0x1a0000);events.append(dict(op='counter',index=5))
+  return m,0,{'actual_source_child':283463}
+ def radio_(i,m,args,bs):
+  assert args[8]==7 and args[12]==ENTITY
+  events.append(dict(op='radio',code=7));m,p,b=radio_run(i,m,dict(bs),7,bytes.fromhex(a['payload']),a['success']);radios.append(p)
+  return m,0,{'actual_source_child':193620}
+ def allocate(i,m,args,bs):
+  events.append(dict(op='allocate',event=args[12]))
+  if not a['constructed']:return m,ALLOC,{'supplied_event_entity':True}
+  def alloc(i,m,args,b):return m,ALLOC,{'allocator277165_supplied':True}
+  def origin(i,m,args,b):
+   m,v,p,b=run(i,m,278138,278199,16,args,dict(b),base=ROOT+0x1b0000);return m,0,{'actual_source_child':278138}
+  def link(i,m,args,b):events.append(dict(op='link'));return m,0,{'native_link_captured':True}
+  m,v,p,b=run(i,m,277695,277777,36,args,dict(bs),{277165:alloc,278138:origin,-31:link},base=ROOT+0x1c0000)
+  return m,v,{'actual_source_child':277695}
+ return {7259:log,205260:score,283463:counter_,193620:radio_,277695:allocate}
+
+def feedback_view(m,radios,a,events):
+ return dict(events=events,score=m[CLIENT+248]&0xffffffff,teams=[m[34992552+4*j]&0xffffffff for j in range(4)],counters=[m[CLIENT+3036+4*j]&0xffffffff for j in range(15)],radio=[{k:p[k] for k in ['commands','getter_calls','marker']} for p in radios],marker=[m[MARK+84]&0xffffffff,m[MARK+204]&0xffffffff],event_record={str(o):m[ALLOC+o]&0xffffffff for o in EVENT_FIELDS} if a['constructed'] and any(e['op']=='allocate' for e in events) else None)
+
+def resolved_fragment(ins,m,b,a,start):
+ from qvm_defuse_support import state_seed
+ from qvm_trace_support import resume
+ state_seed(m,a);feedback_seed(m,b,a);m,b=frame_args(m,b,{DEFUSE_BASE+28:CLIENT,DEFUSE_BASE+32:BOMB,DEFUSE_BASE+100:ENTITY});events=[];radios=[]
+ m,p=resume(ins,start,154088,m,DEFUSE_BASE,boundaries=(154087,),handlers=resolved_handlers(events,radios,a),byte_inputs=b,repeated_calls=True,sync_child_words=True,coherent_memory=True,byte_handlers=True,capture_byte_memory=True,limit=32768)
+ return m,dict(**defuse_view(m,a),**feedback_view(m,radios,a,events),execution={k:p[k] for k in ['stop','trace_length','trace_sha256']}),p['byte_memory']
+def finish(ins,m,b,a):return resolved_fragment(ins,m,b,a,153644)

scripts/test_qvm_effect_defuse_finish.py

@@ -0,0 +1,13 @@
+import json,unittest
+from pathlib import Path
+from qvm_effect_feedback_oracle import finish
+class OriginalTests(unittest.TestCase):
+ def test_original_contract(self):
+  rows=json.loads(Path('docs/research/qvm-effect-defuse-finish.json').read_text())['probes'];self.assertEqual(len(rows),64)
+  for p in rows:
+   with self.subTest(input=p['input']):
+    for k,v in finish(p['input']).items():self.assertEqual(p[k],v,k)
+ def test_fixture_identity_and_trace(self):
+  r=json.loads(Path('docs/research/qvm-effect-defuse-finish.json').read_text());self.assertEqual(len(r['sha256']),64)
+  self.assertTrue(all(p['execution']['trace_length']>0 for p in r['probes']))
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -4396,3 +4396,7 @@ edge	crates/urt-gameplay/src/effect_feedback.rs	scripts/analyze_rust_effect_radi
 edge	crates/urt-gameplay/src/bin/urt-effect-feedback.rs	scripts/analyze_rust_effect_radio.py
 edge	crates/urt-gameplay/src/score.rs	scripts/analyze_rust_effect_radio.py
 edge	crates/urt-gameplay/src/transition.rs	scripts/analyze_rust_effect_radio.py
+report	scripts/analyze_qvm_effect_defuse_finish.py	docs/research/qvm-effect-defuse-finish.json
+edge	docs/research/qvm-effect-defuse-finish.json	scripts/test_qvm_effect_defuse_finish.py
+group	qvm-effect-defuse-finish	scripts/analyze_qvm_effect_defuse_finish.py
+edge	scripts/analyze_qvm_effect_defuse_finish.py	scripts/analyze_qvm_resumer_audit.py