diff --git a/docs/plans/original-completion-2026-10-02/execution/p23-03/OPUS_PROOF_METHOD_AND_REVIEW_SEQUENCE_R16.json b/docs/plans/original-completion-2026-10-02/execution/p23-03/OPUS_PROOF_METHOD_AND_REVIEW_SEQUENCE_R16.json
new file mode 100644
index 0000000..e86b179
--- /dev/null
+++ b/docs/plans/original-completion-2026-10-02/execution/p23-03/OPUS_PROOF_METHOD_AND_REVIEW_SEQUENCE_R16.json
@@ -0,0 +1,29 @@
+{
+  "task": "P23-03",
+  "preserved_submitted": "0b7727a66c76d1ce2a345571718feb3117dd8802",
+  "repair_decision": {
+    "action": "request-repair",
+    "task_id": "P23-03",
+    "reason": "PROOF-METHOD DECISION: The extra classifier is an invented gate and is superseded. That means the \"expected class/state/style better than every shift/swap alternative\" pixel discriminator, including measured noise and alternative scoring. The immutable spec never asks for it. Its acceptance text is \"人物や設備の表示が実状態に対応し、同需要の動線改善を観察できる\". Its evidence clause is \"checker independently recomputes each relevant field… Screenshots pixel/rect provenance must correspond to actual rendered report positions\". It also requires Root OS observation and independent Opus all-condition review. No clause asks for automatic image classification of style or state, and the frozen images have no independent class baseline. Building one would need an arbitrary threshold. Only that algorithm is superseded. These all stay unchanged: all 7 conditions and all 6 categories on FRONT/BACK for A/B, source-field recomputation, raw/request/CUA/conversion provenance, calibrated geometry, native OS plus formal distinct-PID resume, the exact full 177 run, independent Opus review, 30/88 with no partial credit, timeout 900 and cap null.\n\nREPLACEMENT PROOF (equally strong, grounded in the spec). Per frame, everything below must pass mechanically. Then a separate independent Opus reviewer opens the actual images directly.\n\nFINISH RECIPE (local Python only; edit only tools/check_p23_life_observation_evidence.py and tools/test_p23_life_observation_evidence.py, plus world_preview.gd only for the traffic audit in step 4; keep all dirty work):\n\n(1) Pull the per-row logic in inspect_offline_mirror (lines 395-416) out into one shared function, frame_rows(report, audit, request, receipt, images, clicks, root). It reuses validate_drawing_rows, screenshot_transform, affine_*, rectangle_eligibility and the enum_names state/operation check. Every audit row returns eligibility visible/clipped/outside with a reason, plus the calibrated screenshot_rect, layer, state_name/operation, dimmed and text. No row is silently skipped, and the row count must equal drawing_rectangle_rows.\n\n(2) Delete the legacy compare_rectangles and its tests. Replace the call site at :1405 in inspect_os_requests with frame_rows, using the actual CUA receipt calibration and click events. Do not use viewport_to_screen as pixel coordinates.\n\n(3) Only grounded negatives, no tolerance constants:\n- A clipped crop that is fully outside the image fails.\n- A crop that is blank fails. Blank means every pixel is exactly identical, so no numeric threshold is involved.\n- Any wrong enum/state_name or any identity/text/rect/palette-provenance mismatch fails.\n- Affine or calibration disagreement with the recorded clicks fails.\n- A draw-consumed overlay with no audit row fails.\n- Coverage is pending if a category has no eligible visible row on that layout/layer.\nPalette RGB is provenance only and never a screenshot oracle.\n\n(4) Account for traffic overlays. Add drawing_rectangle_rows entries derived from report['traffic'] (density>0 or temporary_block). In world_preview.gd, emit the matching rectangle-audit rows using the existing audit path, read-only, with no visual change. The frozen request-0002 overlay at [-6,2,0] stays reported as a genuine audit-gap negative. Badge font_width stays an engine-recorded value bound to the pinned font/source SHA. Do not add an independent measurement gate.\n\n(5) Emit a review manifest per frame:\n- Each row: category, id, layer, state, operation, dimmed, text, local and screenshot rect, eligibility, and a crop PNG (written with a pure-Python PNG encoder from the decoded pixels) with its SHA.\n- The whole-image SHA and the raw/conversion SHAs.\n- The manifest SHA.\npixels_<category> counts only when the mechanical row check passes AND an independent review verdict file binds to that exact manifest SHA, covers every eligible row, and gives a per-row verdict on category/state/position. The worker must not create verdicts. Review stays pending at submission.\n\n(6) Tests: replace the compare_rectangles tests with the negatives in (3) and (5): shifted calibration, blank crop, missing or extra row, unaudited traffic, wrong state enum, a verdict bound to the wrong manifest SHA or missing a row, and no pixel credit without a verdict. Run the offline mirror for r07: FRONT shows EV/staff/goods pending, BACK shows queue/EV/staff/goods pending, and the CLI still exits 2 as blocked/pending.\n\n(7) Update the BLOCKED.md status honestly, keeping the history. State that the classifier was superseded by this decision, and that Root native/OS for A/B FRONT/BACK pan/zoom resume, the full 177 run and Opus review are all pending. Then genuinely submit, with no synthetic PASS.\n\nRoot afterwards: frozen native, then a fresh OS run, then full 177, then independent Opus direct-image review, then integration/final/ledger.",
+    "codex_model": "gpt-6.1-sol",
+    "codex_model_reason": "The proof method is now fixed and the work is narrow, deterministic Python. It moves existing per-row logic into one function, replaces one call site, adds traffic audit rows, writes a crop and review manifest, and adds negative tests. None of it needs new algorithm design or dense ambiguous reasoning. The reusable functions are already in the checker (validate_drawing_rows, screenshot_transform, rectangle_eligibility, enum_names). Sol is cheaper and faster, and repeated partial repairs are already expensive, so Astra's extra cost is not justified here."
+  },
+  "run_decision": {
+    "action": "run",
+    "task_id": "P23-03",
+    "reason": "RUN the repair_ready repair on the dirty worktree at submitted 0b7727a. The owner has made an explicit proof-method decision, recorded below. Keep all existing dirty work (checker, test, OFFLINE_MIRROR_106_DIAGNOSTICS.json, OFFLINE_REPAIR_0b7727a_BLOCKED.md). Commander verified these references in the current checker: screenshot_transform at :209, rectangle_eligibility at :256, validate_drawing_rows at :308, inspect_offline_mirror at :353, legacy compare_rectangles at :429, and its call site at :1405 inside inspect_os_requests (:1343).\n\nPROOF-METHOD DECISION (owner): the extra classifier is an invented gate and is superseded. It is the pixel discriminator that checks \"expected class/state/style better than every shift/swap alternative\", including measured noise and alternative scoring. The immutable spec never asks for it.\n- Acceptance text: \"人物や設備の表示が実状態に対応し、同需要の動線改善を観察できる\".\n- Evidence clause: \"checker independently recomputes each relevant field… Screenshots pixel/rect provenance must correspond to actual rendered report positions\". The spec also requires Root OS observation and independent Opus all-condition review.\n- No clause asks for automatic image classification of style or state. The frozen images have no independent class baseline, and building one would need an arbitrary threshold.\nOnly that algorithm is superseded. All of these stay unchanged:\n- all 7 conditions and all 6 categories on FRONT/BACK for A/B\n- source-field recomputation\n- raw/request/CUA/conversion provenance\n- calibrated geometry\n- native OS plus formal distinct-PID resume\n- the exact full 177 run\n- independent Opus review\n- 30/88 with no partial credit, timeout 900, cap null\nDo not expand any synthetic classifier gate.\n\nREPLACEMENT PROOF: every check below must pass mechanically for each frame. A separate independent Opus reviewer then opens the actual images directly.\n\nFINISH RECIPE (local Python only). Edit only tools/check_p23_life_observation_evidence.py and tools/test_p23_life_observation_evidence.py. Edit scenes/main/world_preview.gd only for the traffic audit in step 4. Keep all dirty work.\n\n(1) Pull the per-row logic in inspect_offline_mirror (lines 395-416) into one shared function: frame_rows(report, audit, request, receipt, images, clicks, root).\n- Reuse validate_drawing_rows, screenshot_transform, affine_*, rectangle_eligibility and the enum_names state/operation check.\n- Every audit row returns eligibility visible/clipped/outside with a reason, plus the calibrated screenshot_rect, layer, state_name/operation, dimmed and text.\n- No row is silently skipped. The row count must equal drawing_rectangle_rows.\n\n(2) Delete the legacy compare_rectangles and its tests. Replace the call site at :1405 in inspect_os_requests with frame_rows, using the actual CUA receipt calibration and click events. Do not use viewport_to_screen as pixel coordinates.\n\n(3) Grounded negatives only, with no tolerance constants:\n- A clipped crop that is fully outside the image fails.\n- A blank crop fails. Blank means every pixel is exactly identical, so no numeric threshold is involved.\n- Any wrong enum/state_name, or any identity/text/rect/palette-provenance mismatch, fails.\n- Affine or calibration disagreement with the recorded clicks fails.\n- A draw-consumed overlay with no audit row fails.\n- Coverage is pending if a category has no eligible visible row on that layout/layer.\nPalette RGB is provenance only and never a screenshot oracle.\n\n(4) Account for traffic overlays.\n- Add drawing_rectangle_rows entries derived from report['traffic'] (density>0 or temporary_block).\n- In world_preview.gd, emit the matching rectangle-audit rows through the existing audit path. This is read-only with no visual change.\n- The frozen request-0002 overlay at [-6,2,0] stays reported as a genuine audit-gap negative.\n- Badge font_width stays an engine-recorded value bound to the pinned font/source SHA. Do not add an independent measurement gate.\n\n(5) Emit a review manifest per frame, containing:\n- per row: category, id, layer, state, operation, dimmed, text, local and screenshot rect, eligibility, and a crop PNG with its SHA. Write the crop with a pure-Python PNG encoder from the decoded pixels.\n- the whole-image SHA and the raw/conversion SHAs\n- the manifest SHA\npixels_<category> counts only when both of these hold:\n- the mechanical row check passes\n- an independent review verdict file binds to that exact manifest SHA, covers every eligible row, and gives a per-row verdict on category/state/position\nThe worker must not create verdicts. Review stays pending at submission.\n\n(6) Tests: replace the compare_rectangles tests with the negatives in (3) and (5):\n- shifted calibration\n- blank crop\n- missing or extra row\n- unaudited traffic\n- wrong state enum\n- a verdict bound to the wrong manifest SHA, or missing a row\n- no pixel credit without a verdict\nThen run the offline mirror for r07. Expected: FRONT shows EV/staff/goods pending, BACK shows queue/EV/staff/goods pending, and the CLI still exits 2 as blocked/pending. Run only local Python syntax and checker tests. No Godot run and no full regression.\n\n(7) Update BLOCKED.md honestly, keeping its history.\n- State that the classifier was superseded by this decision.\n- State that these are all pending: Root native/OS for A/B FRONT/BACK pan/zoom resume, the full 177 run, and Opus review.\nThen genuinely submit, with no synthetic PASS.\n\nRoot afterwards: frozen native, then a fresh OS run, then full 177, then independent Opus direct-image review, then integration/final/ledger. Scope, acceptance, the denominator, budget, timeout 900 and cap null are all unchanged. Nothing here adds an approval or a main-integration proposal.",
+    "codex_model": "gpt-6.1-sol",
+    "codex_model_reason": "The proof method is now fixed by the owner, and the work is narrow, deterministic Python. It moves existing per-row logic (lines 395-416) into frame_rows and replaces one verified call site (:1405). It also adds traffic audit rows, writes a crop and review manifest, and adds negative tests. The reusable functions (validate_drawing_rows, screenshot_transform, rectangle_eligibility, enum_names) already exist at the verified lines. None of it needs new algorithm design or dense ambiguous reasoning. Sol is cheaper and faster, and 15 repairs are already expensive, so Astra's extra cost is not justified here."
+  },
+  "read_only_review_sequence": {
+    "action": "wait",
+    "task_id": "P23-03",
+    "reason": "WAIT。worker は実行を続け、介入・修理・ディスパッチ・ソース変更は行わない。\n\n根拠（読み取り専用で確認）: tools/check_p23_life_observation_evidence.py の inspect_os_requests（1443-1451行）は、--verify-only の実行中に BUILD_OUTPUT 証拠内の <request>/review-image-N/ へ manifest.json と manifest.sha256 を書き出す（write_frame_review は sort_keys で決定的、408-422行）。そのうえで同じフォルダの independent-verdict.json を読む。reviewed_pixel_categories（425-439行）は、verdict が無い場合に空集合を返す。verdict がある場合は manifest_sha256 の一致、reviewer=='independent-opus-direct-image'、outside 以外の行の完全カバー、行ごとの category/state/position がすべて true であることを要求する。verdict が無いと「missing actual OS <layout> semantic/pixel coverage」の不足（1557-1559行）と BLOCKERS が出るため、checker は1を返す。したがって、Runner.validate がこの checker をそのまま使い、review() が validation の証拠を要求する構成では循環が実際に起きる。\nコンテキスト不足: Runner のソース（review の約1011行、has_evidence）は制限付きチェックアウトの外にあり読めなかった。validate が登録済みの p23-life-observation checker をそのまま呼ぶ点は未検証で、前提として扱う。\n\n循環しない手順（提案A。重複レビュー費用が最小で、全ゲートを維持する）:\n1. 正確に凍結した提出候補を使う（現在の作業ツリーの未コミット checker 変更は使わない）。Root が native/OS の正規実行（A/B の writer/reader、FRONT/BACK、pan/zoom、正式セーブと別PIDでのロード）を行い、続けて全177件の回帰を1回だけ実行する。失敗履歴はすべて残す。\n2. Root が凍結 checker の --verify-only を1回実行する。これは診断扱いで、合格扱いにはしない。目的は manifest.json/sha256 と行ごとの crop PNG を生成させること。条件: 不足が pixels_* と、それによる semantic/pixel coverage・BLOCKERS 項目だけであること。それ以外の不足（mechanical、resume、route、guards、cleanup）が出たら中止し、通常の修理判断に戻す。\n3. 既存の Runner.llm role=reviewer の管理ライフサイクルで、読み取り専用の Claude 視覚レビューを1回だけ別セッションで実行する。場所は凍結した読み取り専用レビューチェックアウト。材料は .review-material に置く manifest.json、manifest.sha256、全 crop PNG、元のスクリーンショット/変換結果/受信記録/要求のハッシュで、オリジナルの実証拠のみとする。worker の文章や自己申告の判定は渡さない。出力は、eligible な行ごとの {row_index, category, state, position} の真偽と manifest_sha256 で、reviewer 名は 'independent-opus-direct-image'。タスク状態の上書き、合格扱い、必須の正式レビューの代替はいずれも行わない。\n4. Root は reviewer の生出力から行ごとの判定を一切変更せずに取り出し、各 review-image-N/independent-verdict.json に置く。セッションID、生の transcript の SHA、モデル、manifest の SHA を別ファイルの来歴情報として記録する。不一致や却下された行があれば、そのまま失敗として扱う。手作業での補完やラベルの付け替えはしない。\n5. 同じ凍結入力で checker の --verify-only を再実行する。決定的なので manifest SHA は変わらず、mechanical と visual verdict の両方を厳格に検証する。その後、通常の Runner の validate → review（Opus が全条件を独立にレビューする別セッション。視覚 verdict は参照材料の一つで、代替にはしない）→ prepare-integration → final/ledger をすべて必須として実行する。\n\n却下した案（提案B: レビュー前は mechanical の準備完了だけを見て、厳格な最終判定をレビュー後に行う）: Runner が2段階の validation に対応しているかを確認できず、validate の意味を弱めるおそれがある。採るなら Runner/checker の変更が必要で、オーナーの判断事項になる。\n\n提案Aは checker・仕様・分母・予算・権限を変えず、API 課金も新しい worker も伴わない。分類手法は、既存のユーザー範囲内で委任された Opus の技術判断であり、新たに人間の承認を得たものではない。Root は後で、記録済みの実際の推論だけを使う。",
+    "codex_model": "gpt-6.1-sol",
+    "codex_model_reason": "今回の判断は WAIT のみで、新しい worker の起動・修理・ディスパッチは許可されていない。既定値の gpt-6.1-sol をそのまま記録する。Astra を選ぶ根拠はなく、使用量を増やす理由もない。"
+  },
+  "authority_clarification": "Opus technical proof-method decision within owner-authorized original scope; not a new explicit human approval. All original acceptance gates unchanged. No task-state overrides.",
+  "root_actual_local_methods": 42,
+  "root_actual_local_pass": true,
+  "formal_credit": 0
+}
diff --git a/docs/plans/original-completion-2026-10-02/plan_validation.json b/docs/plans/original-completion-2026-10-02/plan_validation.json
index fa72831..c78f6fb 100644
--- a/docs/plans/original-completion-2026-10-02/plan_validation.json
+++ b/docs/plans/original-completion-2026-10-02/plan_validation.json
@@ -254,6 +254,6 @@
     "validate_facility_value_contracts.py": "91640e2a76cd6cc9186f7b85c0bf379b24b6cac0d48962815235ee628e7ae43e",
     "validate_plan.py": "23678227d9b3c556f1bd903f4b5b3147c4a82ce5085e10055481026803451b80",
     "validator_update_checks.json": "f997d0f3de2cea29550840b1d5cb23647d64f81329de46758551e2b6c8fecc27",
-    "work_packages.json": "ef0be986942dea41541e4db1bc53db3c335b167ff5faa4b86e0d92dd6bc1b2d3"
+    "work_packages.json": "715ace8c70ae3d7ac5816401a34dac3fcd8b1e7b2ba42e36a1e1d5184a03e4db"
   }
 }
diff --git a/docs/plans/original-completion-2026-10-02/work_packages.json b/docs/plans/original-completion-2026-10-02/work_packages.json
index cf4b973..d8a65f7 100644
--- a/docs/plans/original-completion-2026-10-02/work_packages.json
+++ b/docs/plans/original-completion-2026-10-02/work_packages.json
@@ -16058,15 +16058,21 @@
             "sha256": "57e20ca56115d821c923c0ca6df2f782d442421bd6f122be3cfc403ddaee71e9",
             "scope": "actual Root material completion/cache-only cleanup and Opus continuation; no acceptance",
             "current_game_acceptance_inferred": false
+          },
+          {
+            "path": "/Users/korizatou114/Projects/とりにく工房ゲーム制作部/docs/plans/original-completion-2026-10-02/execution/p23-03/OPUS_PROOF_METHOD_AND_REVIEW_SEQUENCE_R16.json",
+            "sha256": "58ecbc37627c23df9279fc1c5b5ea5b0636a2185fde4c4cd33cc73763522bad8",
+            "scope": "actual Opus proof-method and noncircular managed review sequence; mandatory gates unchanged, no acceptance",
+            "current_game_acceptance_inferred": false
           }
         ],
-        "progress_summary": "2026-10-15: exact0b7727a local32 PASS; Root independently verified both actual native streams17+17 semantic frames PASS and mirror2622 unchanged. Same48 demand A7153/B2585. Exactcandidate nativeimport/319parse/A+B PASS. First actualOS writer24236 completed4 CUA Front/Back requests with realcallIDs/rawSHA/ACK; early rectanglepixel failure room/facility_00000003. Root ended ownedcollector for diagnosis, ownedengine ended cleanup/guarderrors0. Actual screenshot1440x842 includes32px titlebar vs content1440x810; sourceRGB-exact assumption needs source-grounded JPEG/dim/ghost/calibration interpretation.94files mirrored readably by APFS for offline repair. OS formalresume/final177/review/integration/final pending; original30/88 no partialcredit, formal0. R15: Root supplied actual3missingPNG conversion receipts;106file immutable mirror available, prior94inventory preserved. Same-task Sol b86f0c51 implements calibration/visibility/pixel negatives. Seven ended-stage import caches removed only after full noncache source-byte identity checks; ~380MB net free recovered. No additional unit credit.",
+        "progress_summary": "2026-10-15: exact0b7727a local32 PASS; Root independently verified both actual native streams17+17 semantic frames PASS and mirror2622 unchanged. Same48 demand A7153/B2585. Exactcandidate nativeimport/319parse/A+B PASS. First actualOS writer24236 completed4 CUA Front/Back requests with realcallIDs/rawSHA/ACK; early rectanglepixel failure room/facility_00000003. Root ended ownedcollector for diagnosis, ownedengine ended cleanup/guarderrors0. Actual screenshot1440x842 includes32px titlebar vs content1440x810; sourceRGB-exact assumption needs source-grounded JPEG/dim/ghost/calibration interpretation.94files mirrored readably by APFS for offline repair. OS formalresume/final177/review/integration/final pending; original30/88 no partialcredit, formal0. R15: Root supplied actual3missingPNG conversion receipts;106file immutable mirror available, prior94inventory preserved. Same-task Sol b86f0c51 implements calibration/visibility/pixel negatives. Seven ended-stage import caches removed only after full noncache source-byte identity checks; ~380MB net free recovered. No additional unit credit. R16: Root42local tests PASS. Opus superseded invented automatic pixel class/swap discriminator only, retaining original geometry/raw provenance/semantic/all6/OS/resume/full177/independent review. Same-task Sol wires deterministic crop manifests and independently bound per-row visual verdicts. Noncircular managed visual-pass then strict checker then mandatory ordinary validate/review/integration/final sequence recorded; no human-approval fabrication or state overrides.",
         "remaining_gaps": [
           "Correct calibrated screenshot/image and actual draw-visibility interpretation against immutable FRONT/BACK OS evidence; preserve meaningful pixel/geometry negatives and original all6 category coverage.",
           "Both layouts: all6 categories, normal OS FRONT/BACK/pan/zoom, formal save and distinctPID load, screenshot provenance.",
           "Exact final177 regression, independent Opus review, integration/final/ledger. Preserve separate Windows/finished-assets/all30/undefined-values gaps."
         ],
-        "updated_at_jst": "2026-10-15T10:22:19.476892+09:00"
+        "updated_at_jst": "2026-10-15T10:29:40.368162+09:00"
       }
     ],
     "estimate_person_days_historical_2026_09_29": [