Continue markers after numerical recovery failures

[krystophny]

Risk tier

• T0: docs, comments, small build metadata
• T1: pure refactor, no behavior change intended
• T2: local numerical logic
• T3: physics, output behavior, coordinate convention
• T4: parallelism, GPU, dependency, CI, or security-sensitive build logic

Correctness contract

Intended behavior change

Default warning mode no longer terminates a marker when all numerical recovery for one microstep is exhausted. The accepted state is retained for the unresolved interval, warning_step_skip is counted, and the same marker resumes on the next microstep. SPECTRE still attempts sheet and full-orbit recovery first. Numerical full-orbit failure falls back to the last valid guiding-centre state; physical full-orbit loss remains a loss.

The generic trace, wall-check trace, and classifier trace share this policy. SPECTRE RK45 and symplectic traces now also assign completed, physical-loss, and strict numerical exit codes explicitly.

Behavior that must not change

Physical LCFS and wall events still terminate the marker. Successful steps, bounded warning-mode Newton acceptance, recursive half-step recovery, SPECTRE reflection/transmission, sheet recovery, and full-orbit recovery retain their existing order. Warning-off strict mode still rolls back and returns the numerical status.

Coordinate / unit conventions

No coordinate, gauge, timestep-unit, momentum, or field convention changes. A last-resort hold advances only the normalized clock for the unresolved remainder; it does not commit a failed canonical or physical-coordinate state.

Numerical invariants

• A failed trial never replaces the last accepted state.
• Recovery methods are attempted before a last-state hold.
• Numerical statuses never become physical losses in default mode.
• Physical boundary events are never intercepted by numerical recovery.
• Strict mode remains available to expose fixed-map failure.

Tests added

• unit: strict failure preserves status/time/state; default warning mode consumes the interval, preserves state, and continues in both macrostep paths
• integration: SPECTRE crossing and end-to-end validation, including reflection, loss accounting, and full-orbit recovery
• system: complete fo suite
• golden record: unchanged

Golden-record impact

• unchanged
• changed

Existing successful trajectories and physical loss semantics are unchanged. Only markers that previously ended on an exhausted numerical recovery continue.

Failure modes considered

Maximum-iteration and linear-solve exhaustion, coordinate inversion failure, sheet initialization/advance failure, landing failure, teleport/event caps, full-orbit initialization/advance failure, physical full-orbit loss, wall/LCFS loss, and strict warning-off operation.

Manual validation

The history chain was audited: #456 introduced rollback and top-level early return; #457 made solver failures observable; #487 restored bounded warning acceptance; #488 added halved retries but still returned a hard status after exhaustion. This change separates rollback/diagnostics from marker lifetime.

The focused SPECTRE crossing suite completed with zero CROSS_STOP events and the end-to-end SPECTRE validation completed all markers. The generic injected-failure test confirms state preservation and clock continuation.

Verification

• fo test test_sympl_testfield: pass
• fo test test_spectre_sympl_crossing test_spectre_validation: 2/2 pass
• complete fo before formatting: all 84 tests pass, static/build/lint pass
• complete fo after formatting: 83/84 pass; test_magfie_refcoords_splines was externally terminated during the 32-way memory-heavy run
• isolated fo test test_magfie_refcoords_splines: pass in 24.93 s
• formatter check: pass

The formatter mechanically touched pre-existing layout throughout five modified Fortran files; the behavioral diff is substantially smaller than the raw line count.

[krystophny]

Superseded by the adversarially reviewed integration PR #492, which includes this continuation policy and fixes its stale Meiss-coils accounting/runtime regression plus the post-hold retry bug.