[krystophny]

SIMPLE cleared RK recovery history after one accepted symplectic microstep. If the next attempt failed, recovery restarted with the shortest cooldown and could repeatedly probe the same difficult region. Treat the first accepted symplectic step as provisional and clear the history after the second consecutive accepted step.

An accepted step counts after wall and collision checks. A failed attempt, including an unresolved hold or collision rollback, interrupts the provisional streak while retaining recovery history. The first accepted step still clears the stale recovery momentum reference. Recovery thresholds, tolerances, energy bounds and golden references are unchanged.

The regression exercises both macrostep paths. It checks retention after one accepted step, clearing after two, and interruption by failed attempts, unresolved holds and collision rejection. The previous source fails the new interruption assertion; the candidate passes.

Validation on aa1fb46, based on main fb81524:

• Changed-line formatting, whitespace checks and source review passed.
• Native fast gate: 147/147 passed in sCluster job 3361483, with libneo 266f0a3c844315522d8b620fa4b96b69aedfeafc and deterministic floating-point flags.
• Resident gate: all 147 approved cases have unique PASS/exit-zero events on the exact captured source, driver and input inventory in job 3361611. Final status was clean, quiescent and green at 147/147, followed by normal shutdown. The external harness retained FAIL because it counted internal .capture, .locks and .state directories as generations. Controller and independent review accepted the preserved numerical evidence without rerunning tests or changing the failed receipt. This covers the selected 147-case gate, not all 211 registered cases.
• All four optional Albert field initializations and both existing comparisons passed in diagnostic-only job 3361661 (7:46 elapsed, 14,432 MiB guarded peak). Baseline/candidate input hashes agree, and source/dependency/driver/build inputs match the native-qualified state before and after. References and comparator tolerances are unchanged.

The unchanged recovery policy also passed bounded paired diagnostic job 3361418 before rebasing onto the formatting-only main update. Both protected Albert/Meiss orbit comparisons passed, with identical inputs, starts and marker exit statuses: each public case retained 15 completed trajectories and 17 physical LCFS losses. The 16-start, 0.1-second Drevlak pair retained 11 completed trajectories, two physical LCFS losses and three starts skipped by the existing strongly-passing rule (code 3), with zero NaN loss times or numerical exit statuses. Those three starts were assumed confined and were not traced. In this bounded pair, activations changed from 11,952 to 9,330, field evaluations from 367,437,373 to 348,868,024, and tracing time from 153.356 s to 141.372 s.

Chris&AI