SameP13-03, ordinaryrepair_ready repairs5 (maxNone), submittedbc1299, clean. Preservecompletebc1299, all7/84/6, all18negatives. No newtask/re-registration/rebase/Runner/core/policy/stateDB changes. Actualworker1cd hadcompletedlocal18/AST/diff butreturnedblocked solelyliteralpythonmissing; Root provedactualregistered{python}->RunnerbasePython3.12 exits0, normalrepair4->normalsubmitbc1299->FORMALvalidate095b1cPASS. NormalindependentOpusreview5ce72d returnedstatuspassbut mediumfutureintegrationstalenessfinding, so normalbackendcorrectlyrepair_pending. Rootdidnotrelabelfindings. Actualreview:
{"task_id": "P13-03", "commit": "bc1299acf5bb93c3375918659ed2457a176bf762", "status": "pass", "summary": "I reviewed frozen candidate bc1299a against all 8 required outcomes of the P13-03 spec and the single acceptance ID. My evidence was the spec, the full diff, the primary sources in the checkout and the registered validation material in .review-material.\n\n1. **Facility coverage.** The ledger lists all seven chapter 10.4/10.6 facilities under their stable original IDs: original_facility_13, 14, 15, 16, 24, 25 and 26. Positions, names and IDs match original_facility_mapping.json. The five historically unmapped facilities are re-searched against the current catalog and every definition under data/facilities, not assumed from the old null. mana_control_room is explicitly excluded as a stand-in, and the checker raises an error if that proxy appears.\n\n2. **Per-facility connections.** Each facility has separate normal_entry, runtime, event_state, save and test observations. Every one is status unverified with accepted=false, and each keeps its search tokens, matched line numbers and full line text, source path and SHA-256. I checked the claims against the sources:\n   - facility_catalog.gd puts adult_private_room in FACILITY_PATHS and black_market only in EXPANSION paths.\n   - Runtime line 437 loads only the base, infrastructure, rescue and original path lists.\n   - There are no matches for the other five facilities.\n\n3. **Media usage slots.** All 84 slots (7 facilities × 12) are listed by exact slot_id, which matches the 84 entries in facility_usage_slots.json. Each is unverified_required_slot with approved_asset=null and content_complete=false. The actual asset count is null/unknown, so slot counts are not treated as image counts.\n\n4. **Non-facility differences.** Six categories are recorded: event, overlay, history, story, voice and scene. Their requirement IDs (B-1.6, B-2.5, B-8.2, B-8.3) are consistent with BASELINE §1.6, §2.5, §8.2 and §8.3. Content IDs and quantities are null/unknown, and D08 and D09 are unknown. Only neutral metadata is recorded; no scenes are described.\n\n5. **Separation of claims.** Technical observations, completed asset acceptance and original content completion are kept as separate fields. Accounting keeps the 30/88 denominator with no partial credit and package_completion_inferred=false. Original views are not edited.\n\n6. **Outputs.** The readable ledger (DIFFERENCE_LEDGER.md), the machine ledger and the receipt are all present. The receipt separates current_checkout sources from the work_packages file, which is pinned to its Git version at base e1a1651. It lists every ID, gives reasons why runtime, native, Windows, engine and full-regression tests do not apply, and pins the output hashes.\n\n7. **Checker.** The checker regenerates the expected ledger from live sources and requires exact equality with the ledger on disk. Before that, it confirms the spec's raw and Runner hashes, every source pin, the work_packages version at the base commit, and that the JSON has no duplicate keys or slot IDs. It also compares the receipt and the readable Markdown exactly. All 18 mandatory negative mutations always run under the registered `--verify-only` call, including omission, stale pin, false completion, technical-as-content, unknown-to-zero, and shared-reference tampering or dangling references. There is no unconditional failure, and pending fields are compared rather than skipped.\n\n8. **Formal validation.** The Runner's p13-difference run passed with exit 0 on this commit, using the expanded registered argv: `python3.12 -B tools/check_p13_content_difference.py --verify-only`. Its stdout shows record_integrity pass, content_acceptance not_claimed, and all 18 negatives rejected. This review is the separate formal review.\n\n**Scope.** Only allowed paths changed. There are no product, asset, save, spec or policy edits.\n\n**Integration.** Passing this candidate covers the neutral record only. It gives no credit for content completion, the P13 package or the game.\n\nMain 57131ec has new hashes for autoload/simulation_runtime.gd and scenes/main/main.gd. In those files, the matched lines (437, 555, 2012, 2221 and 4602 in Runtime; line 53 in main.gd) have the same text, so the observations' meaning does not change.\n\nThe checker deliberately rejects stale sources, so it will fail on main until the record is refreshed. The minimal safe handling is a reviewed integration refresh:\n- Rerun the existing expected(), compact(), readable() and receipt_expected() against the integrated checkout.\n- Regenerate the ledger, the Markdown and the receipt together, keeping the 7/84/6 coverage and every unknown and unverified status.\n- Do not hand-replace hashes.\n- Re-run the normal integration gates.\n\nNo policy, core or state DB changes are needed.", "acceptance_ids": ["P13-03"], "findings": [{"severity": "medium", "message": "This candidate's ledger, Markdown and receipt are pinned to base e1a1651. On main 57131ec, simulation_runtime.gd hashes to 4696df4a… and main.gd to 92677e4a…, so the checker's exact-equality check will reject the record there. The matched lines are unchanged in main, so the observations themselves are the same. The ledger already contains a refresh note. At integration, Root must regenerate the ledger, readable Markdown and receipt with the existing checker functions, keeping the 7/84/6 coverage and all unknown statuses. Do not hand-edit the hashes."}, {"severity": "low", "message": "validation.json is hard-coded in receipt_expected() with status 'blocked' and registered_argv 'blocked: python executable is unavailable'. This is the worker's state from before formal validation, and it is now out of date: the formal Runner validation has passed. It understates rather than overclaims, so it does not promote anything. However, the refresh should update it to describe the Runner state accurately rather than leave a misleading 'blocked' value."}, {"severity": "low", "message": "The negative mutations change the compacted canonical record and rely on the exact-equality check. The 'stale_pin' case therefore changes the recorded pin, not a source file. Rejection of an actually stale source happens through the raise in expected(), but no negative case exercises that path. The --ledger option is also only partly honoured: receipt_expected() always reads the default ledger path."}, {"severity": "low", "message": "The runtime note says the runtime does not load 'expansion paths'. That is slightly imprecise: ORIGINAL_FACILITY_PATHS does load four files from data/facilities/expansion/. The conclusion is still correct, because black_market.tres is not loaded. P13_ORDER_FINAL_REPAIR_INPUT.md still contains old 500k/450k byte-cap instructions; it is committed inside the allowed directory and labelled as root context, and those caps are now superseded."}]}
Need concrete RUN toresolve actualmedium beforeformalclosure and relevantsmalllowfindings inONEcoherentchecker/recordsupdate. Themedium cannotbehandwaved orconvertedtoalow warning. Current checker.expected recomputescurrentCheckout observations but ledgerwasfrozenoldbase; ordinaryprepare_integration mergesmain, so stale Runtime/main hashes andlinepositions cause actualvalidationfailure. CurrentRuntime/Mainsourcefacts unchangedmeaningbutfreshsourceprovenancerequired. Existinggeneratorfunctions expected/compact/readable/receipt_expected alreadyexist. No Rootpostmergehookorpolicy/DB/Corepatchpermitted; ordinaryRunnerprepare_integration/finalgatesmustwork withoutmanualgitmetadatarefresh aftermerge.
PROPOSED MINIMAL SOURCE-VIEW solution foryourjudgment (notpermissiontorelabeloldhashes): bind ONLYthetwoobservationsources (autoload/simulation_runtime.gd,scenes/main/main.gd) to real immutablemain57131ec Gitblobs and READ/re-search those actualbytes inthesamerepo, explicitprovenancemain_git_blob+commit+SHA. KeepBASEe1 work_packages frozeninput andALLotherprimarysources/currentasset/catalogdefshashchecks unchanged. Beforepermittingtargetview, independentlyverifyfilesystemapplicability: when57131ec IS ancestorofactualcheckoutHEAD (normalmergedintegration/final), actualworkingtwofilesMUST byte/hash equal571 blobs; whenitISNOT ancestor (thisexistingfrozenworkerbranch), actualtwofilesMUST stillbyteequalBASEe1, whileobservationsareexplicitlythe571snapshot, nevercalledcurrent_checkout. DeriveancestryusingrealreadonlyGitcommand, NOT ledgerflags; invalidgiterrorreject. Iflatermainchangesgame2filesorrollsbackthem, descendantcase MUSTreject, nolegacyfallback. Thisprovidesactualmaintechnicalobservationsnow andintegratesunchangedrecords throughnormalgateswithoutRoot codehooks. Nohand-swappingoldSHA; regenerateallmatchedlines,text,pins,MD,receiptfromactualtargetGitbytes, everyunknownunverifiedstays. CurrentmainotherobservationfilesalreadyRootSHAcomparedmatchsubmitted; only2difference. NoteprimaryspecsourcepinsdoNOTincludeRuntime/main. Useexacttargetfullcommitresolvedfrom57131ec insharedrepo; don'tusefloatingmain; oldspecs/primaryBASELINEmapping/assets/decisionsremainstrict. MainonlyRootprogressmetadatachangedafter571nogamechanges. Ifthisproposalviolatesoriginalexactapplicability oryoufindsimplersafernormalworkflow, explainandchooseconcretecompliantalternative now; don't repeatfutureRootrefreshpromisewithnogatepath.
Otherboundedfixes: (1) receipt_expected muststoppermanentlyhardcoding'blocked/pythonunavailable' andselfclaimedlocalpassascurrentstate. Usestablehonestrecordreadiness/externalformalRunnerstates; preserveactualfailedworkerhistoryinRootartifact, no falsecurrentformalpass. (2) Addmeaningfulsource-stalenessnegativesthatexercise source-read/applicability rejection, notonlymutatingledgerpin; keepall18existingnegatives. Tempactualcorruptsourcecopy/read-onlyGit andstdlibmock/injectionfortestsareokay, no productfilemutationsorGitwrites; testbothfrozenlegacyandmergedcurrentmodes, rejecttamperedancestry/reportflags. (3) Optional--ledger currentlypartiallyhonored; eithercorrectreadonlyalternate-inputhandlingwithtests orclearlyscope/deferoutsideoriginalregistereddefaultgateswithreason; don'tbreakmandatory--verify-only/--negative-checks. (4) Correct'notexpansionpaths' wording: Runtime loadsORIGINAL_FACILITY_PATHS inclsomeexpansiondirectoryfilesbutNOT EXPANSION_FACILITY_PATHS/black_market; avoidwronggeneralization. (5) MarkoldP13_ORDER_FINAL_REPAIR_INPUTrepair2/500k/450kcaps assupersededatitshead, preservinghistory. Allindividualcapsremoved, no furthercompactionneeded.
Worker usespython3 -B/AST/checker mandatorynegatives/diff ONLY. Actualregisteredargv TEMPLATEis{python},NOT requirementthataliteralpythonbinaryexist. RootRunnerexpandsbaseinterpreter. Do NOTreturnblockedjustbecausepythonaliasmissing orRootformalreview/integrationnotyetdone. Finishallnecessarycoherentfixesandlocalchecks; return submitted schemas/result.jsonfixedBASEwhenready; Rootformalvalidate/separateOpusreview/ordinaryintegration/finalremainrequired. No engine/full/UI/assets/values/Runtime/Gitwrites/agentsproviders. ChoosedefaultSol unlessexplicitcomplexityreasonAstra. Existingdefaulttimeout900unchanged. Userauthorizesnecessaryrepairs/reorder/mainupdates; no newpermissionaskorcapincrease. Original30/88/no partialcredit,noP13package/content/gamecompletioncredit. Do NOT wasteanotherimplementation onreceipt-onlyprogressif mediumsourceapplicabilitynotactuallysolved.
