Actual Opus: SAME P18-01-CODE normalrepair6,used6capnull,repair_ready. Heldcleanb7a7cc0 actualsubmitted. No implementationlive. Rootfreshnative7/1163/308parse/9ownedended passed, defaultprotected, formalvalidator95d55 passed. Independentreviewactuald002 changes_requested high1medium1low3. Noacceptancecredit. Do not waive findings or substitute counts; address the meaningful failures below in one scoped batch, preserve all heldP02/data/legacy/identity repairs and all4backend/wholeoriginalconditions. Return action=run with fullconcretedirection andmodelchoice (default6.1Sol unless actual difficultyjustifiesAstra), no extraapproval/capreset/newtask/corepolicy/DB changes.

Highrequiredfix: oldaffectedP03route_mismatch test nowrejects onlyprojection/legacy mismatch beforeexclusive-route invariant. Keepold5testsbodiesbyteidentical, doNOTweaken/mutatelegacytests. In newP18suites add validpositivecontrol and invalidEXCLUSIVE_LOCKED emptyroute_id while keepinglegacy.relationships andprojection EXACTLYconsistent andallotherfieldsvalid. Provevalidcounterpart loads (nonemptyroute_id) toensuretestnotvacuouslywrongshape. Rejectinvalid via actualnormalANDrecoveryrestore, provingoldserviceidentity/state, wholeRuntimebytes andinputbytesunchanged. This is existing P03safeguard, no routegameplayrulesinvented. Use actual service/state/Runtime recovery API after readingtargetP03test andState.is_valid, notguessits signature.

Mediumrequiredfix: _parse_snapshot threshold_candidates currentlyonlytypes ids. Read actual_register_threshold_candidate producer/create_snapshot andolderfixturelegitimate shapes. Validate its established fields metric_id,threshold,requires_unlock_event,created_at,actor_ids,deduplication_key accordingtoproducertypes andexistingcontract, includingcontainedIDs/types whereactualproducerestablishes them. No inventednewgameplaythresholdvalues. Preserveunknownrawextra fields unchanged; rejectwrongtypes/nonfinite/invalidrefsatomically, preservevalidoldcandidates and rawfactroundtrip. Add meaningfulservice+Runtime negativecases for eachrequiredfield wrongtype, validpositivecandidate and exactinput/state preservation. Do not count duplicates orpartialchecks ascompletion.

Lowcandidateordering: assessactualoldproducer sortedcandidate_id order and rawlegacy preservationcontract. Preservelegacyunchangedobservablebehavior afternewcandidate creation. Ifrealbehaviorregression, correctnecessarymerge behavior andproveunsortedinput/rawfacts preserveduntilmutation AND newlycreatedcandidate ordermatchesoldcanonicalpolicy afterupdate, withoutsilentlydroppingrawfacts. If no realregression, givepreciseexistingcontract/source evidence; do not just declareintended. Lowdocshelper absolutepath is outsidecurrentrequiredacceptance; recorddeferredunlessrequired. Integration/final remainordinarynextgates, notreviewblockers.

Freezeallrelatedcorrections, exactnewtestSHAmarker/policy rows, existing5suitesbyteidentical, static+prepareonly ONLY. Workerreturnstatussubmitted meansreadyforRootnative, notbackend/wholeacceptance. NoGodot/native/defaultprofile/full/commit/push/main edits. KeepP02fixtures actualboundedrawbyte provenance, alloriginalvalues/UI/routes untouched. Native b7proofstaysownversion; newmodifiedcandidate needsfresh7 beforeformalvalidation/separateOpusreview. Source countderivedstrict andallsource/profile/PIDguards retained. Currentfree~2.5GiB; Rootwillcontent-preservingcompressclosedenginesbeforenativeifneeded; no deletions/permission changes. Normalmerge-tree ofb7andcurrentmainfe has0conflicts, butactualmergedsource needsfreshnative7beforeordinaryintegration/final. No postmergehooks or guardbypass.

Actualindependentreviewfull follows:
{"task_id": "P18-01-CODE", "commit": "b7a7cc01d4d0e874e10464c686b7fdeecd9b348c", "status": "changes_requested", "summary": "I reviewed the full diff, the complete changed Runtime methods, RelationshipService, OriginalRelationshipState, both new suites, the collector, the marker and policy pins, and the registered validation material. The verifier in .review-material/validation-runs/.../stdout.log reports verified=true, 7 suites, 1163 checks and 308 parse paths.\n\nP18-C-1 is met: the dedicated directional model requires explicit fields, ties shield_max to Affection, keeps unset distinct from explicit zero, and invents no coefficients.\n\nP18-C-3 is largely met: there is a real Runtime command, an identity validator tied to restored and then live staff and catalog, restore-before-swap atomicity, and read-only report projections.\n\nP18-C-2 is mostly met. The v1 raw facts, aliases, extensions and record order survive the v2 round trip, and the original relationship state is kept separate from the five legacy axes.\n\nHowever, the v2 container makes an existing affected-regression assertion pass vacuously. In tests/s6/test_runtime_save_lifecycle.gd:520-537, the \"recovery never guesses an exclusive Relationship route lock\" case appends an invalid EXCLUSIVE_LOCKED relationship with an empty route_id only to systems.runtime.relationships.relationships. That is now just the compatibility projection. The candidate is rejected by the new \"projection disagrees with legacy\" check (relationship_service.gd restore_snapshot) before the route-lock invariant is ever evaluated. The test body is unchanged and still passes, but it no longer verifies the P03 restore safeguard the spec requires to be preserved. Neither new suite restores the v2 legacy path with an invalid route lock. The 1163 passing checks therefore overstate coverage of that safeguard.\n\nThere are smaller gaps:\n- Threshold candidate fields other than the ids are not type-checked.\n- Candidate ordering in snapshots changed from sorted to insertion order once a legacy payload has been restored.\n\nP18-C-4: the native evidence is strong, but integration and affected final validation are still pending. The original P18-01 unit is correctly not claimed complete.", "acceptance_ids": ["P18-C-1", "P18-C-2", "P18-C-3", "P18-C-4"], "findings": [{"severity": "high", "message": "An existing restore-safeguard test now passes vacuously. tests/s6/test_runtime_save_lifecycle.gd:520-537 (route_mismatch) appends an invalid EXCLUSIVE_LOCKED relationship with route_id \"\" only to runtime.relationships[\"relationships\"], which under SNAPSHOT_VERSION 2 is just the compatibility projection. RelationshipService.restore_snapshot rejects it at the projection-vs-legacy equality check, so RelationshipState.is_valid's route-lock invariant is never reached. The test, which says \"recovery never guesses an exclusive Relationship route lock\", still passes without exercising that invariant, which weakens the P03 safeguard verification the spec requires to be retained. Fix: add a new-suite check that injects the invalid route-lock record into legacy.relationships and the projection consistently, then assert atomic rejection (normal and recovery restore), so the affected regression truly covers this invariant. Do not edit the existing test body."}, {"severity": "medium", "message": "The wrong-type rejection for v1 threshold_candidates is partial. _parse_snapshot type-checks only candidate_id and relationship_id. It does not check metric_id, threshold (int), requires_unlock_event (bool), created_at (int), actor_ids (Array) or deduplication_key, even though RelationshipService._register_threshold_candidate produces typed values for all of them. Since \"wrong types\" must reject atomically, either validate these fields against the producer's types or record an explicit justification for leaving them opaque, and add a test for that decision."}, {"severity": "low", "message": "Legacy snapshot ordering changed. create_snapshot used to sort threshold_candidates by candidate_id. After any restore (when _legacy_raw is non-empty) it now emits insertion order, while a fresh service still emits sorted order. The result is deterministic, but it is an undocumented change to legacy output. Confirm this is intended, or keep the sorted order for candidates created after the restore."}, {"severity": "low", "message": "docs/.../p18-01-code/inspect_repair5_inputs.py hardcodes an absolute path under the worker allocation. It is a docs-only helper, but it is not reproducible from the checkout. Consider making the path a parameter."}, {"severity": "low", "message": "P18-C-4: native local and affected evidence is present and verified (validation id 5, 9 owned PIDs, no cleanup or guard errors). Integration and affected final validation on merged main remain pending Runner gates. The P18-01 original unit remains at 30/88 and in progress; this is correctly not claimed complete."}]}