Recovering public key with small R parameter
It is error in my recovery procedure, or signing should be bad for nonce which generate small $r$ parameter?

The issue happens because the recovery procedure is a simplified version of the standard method, attributed to Daniel R. L. Brown of Certicom.
Problem happens I guess when in signing, r does not match p.x.value; that is when p.x.value lies in $[n,p)$, where $n$ is the Elliptic Curve group order, and $p$ is the field order.
That has probability about $1-n/p$ to occur by chance. With non-toy parameters that's negligible, e.g. $\approx2^{-127.65}$ for sepk256k1.
If that needed to be avoided for small parameters, we could use the full method, or I guess fix the signature to fail (thus be retried with a different nonce) when the problematic condition arises. Just replace r==0 with p.x.value &gt;= CurvePoint16::ORDER (and perhaps move that up one line).