docs: record bounded D05 fee save and logistics diagnostic

docs/plans/original-completion-2026-10-02/checkpoints/d05-decision-draft-r01/BOUNDARY_CASES.md

@@ -0,0 +1,45 @@
+# D05 原7領域の有限判断ケース（未承認）
+
+全7領域の比較用入力と期待関係を整理する。試験実施・合格・正式独立レビュー・原成果完了を意味しない。fixture値を本番値に転記しない。閉店/勤務/EVの選択は保留する。
+
+## 1 closing
+
+入力: At the boundary, an active service has one minute remaining.
+
+候補・不変条件: Choice A permits completion only if power/staff/related-facility guards hold; B preserves progress and reservation without completion payment. Manual and scheduled closure scope must be specified.
+
+## 2 power
+
+入力: A service and boarded elevator pair exist when reserve reaches zero.
+
+候補・不変条件: No work completion or sale caused by the stopped interval; preserve identity. Owner chooses safe landing exception versus cabin holding; no fabricated teleport destination.
+
+## 3 destruction
+
+入力: A scheduled destruction precedes the final service interval.
+
+候補・不変条件: Destroyed instance cannot complete service; release owned reservation at most once; later power recovery must not undo destruction.
+
+## 4 departure
+
+入力: Departure and service final interval occur in one tick.
+
+候補・不変条件: Define eligible active versus queued departure. One reservation has one consume or release result, no orphan and no double payment; do not invent a new paid-refund policy.
+
+## 5 charging
+
+入力: The same completion ID is replayed after save/resume.
+
+候補・不変条件: Same payment identity must not add a second ledger transaction, wallet debit, consumed inventory or completion notification.
+
+## 6 shift
+
+入力: Day staff leaves at 18:00 and night staff is not yet physically present.
+
+候補・不変条件: Choice A settles the actual preceding interval then forbids new work without night attendance; B applies shift removal first and holds progress. No stale daytime attendance may start new work.
+
+## 7 midnight
+
+入力: A paid service reaches completion at 00:00 after the daily-close phase.
+
+候補・不変条件: Under observed ordering, closed period excludes the sale timestamp and next-day ledger contains it once. Any changed ordering needs explicit approval; same daily-close ID may not settle payroll/upkeep twice.

docs/plans/original-completion-2026-10-02/checkpoints/d05-decision-draft-r01/PROPOSAL.md

@@ -56,3 +56,21 @@ boundary-followup-r02.jsonに対象版のSHAと8関数の原文を固定した
 確定財務は[start,end)を集計する。当日UIはcoordinatorの開始時刻から現在時刻までを含む現金流を表示し、確定日のsummaryは別に選択する。従って00:00ちょうどの完了売上の帰属は現順序と承認規約を区別して決める必要がある。給与は決算境界で現金記帳する一方、確定損益はnew_wages_totalを用いWAGE現金行を除外するため、UI現金支出と損益の数値を機械的に同値条件にしない。
 
 EVのcancel_actorは乗車中の同伴組の単独取消を拒否する。停止時は同一の安全降車先について人物ごとのarrivalを生成し、Runtimeは人物ごとに位置を反映する。反映前提の欠損による分離は未再現であり、重大不具合として確定していない。通常操作・保存再開の受入を静的照合で代用しない。未承認・not_approval_ready・9/88は維持する。
+
+## 費目・保存の追加照合 r03（正式受入ではない）
+
+fees-save-followup-r03.jsonに15関数の原文・SHAを固定し、BOUNDARY_CASES.mdで原7領域の有限比較ケースを示した。別Claudeセッションの診断結果と採否はdiagnostic-review-r03.json/review-disposition-r03.jsonに保存した。
+
+| 対象 | 観測した時点・保存 | 受入上の限界 |
+|---|---|---|
+| 建設費 | 工事job作成前の支払い。失敗時は資源と占有のrollback。 | job.created_atと支払minuteは別経路。通常経路での一致を未検証。 |
+| 仕入費 | 倉庫在庫追加と同minuteの購入transfer。失敗時に原在庫・経済状態へ復元。 | 配送完了時の課金ではない。全原費目の承認時点を証明しない。 |
+| サービス | 完了時のprice_snapshotとservice.payment.<id>。 | 閉店・勤務境界で完了資格を認める規約は未承認。 |
+| 給与・維持費 | 決算境界の支払い。給与損益と現金支出は区別。A01維持費は既承認時点を維持。 | 今回の診断に既存全抜粋を再送していない。既存callsite/boundary資料を保持する。 |
+| ワープ・炉 | 受入済みproducerへの対応未完。 | 時点・値を推測で設定しない。 |
+| 経済保存 | entry・二重計上防止key・transaction ID・採番・時計を保存し、検証後に復元。 | 保存構造だけで別PID・同操作結果一致を証明しない。 |
+| 決算保存 | coordinatorの日別summary・保留境界・処理分を保存。保留通知時はsnapshotを拒否。 | Runtime wrapperは有効coordinatorだけを含む。全パイプライン受入を残す。 |
+
+物流tickは残量正の仕入れ条件の外でも呼ばれるが、実際の取出し・引渡しはallows_logisticsを確認する。同guardは手動営業・電力・耐久・休止・関連施設を確認し、営業時間区間を直接参照しない。したがってtick呼出しだけから停電中の配送完了を断定せず、逆にこのguardだけから搬送中人物の移動停止も断定しない。予定閉店の他経路への伝播を含む受入は未証明。
+
+追加読取は既存goalの許可範囲で行う。診断の『読取にも別途許可が必要』という提案は採用しない。ただし第3repair、別登録による再試行、Runner core変更、D05採用は今回行わない。not_approval_ready・原7領域未完・9/88を維持する。

docs/plans/original-completion-2026-10-02/checkpoints/d05-decision-draft-r01/fees-save-followup-r03.json

@@ -0,0 +1,175 @@
+{
+  "status": "static_trace_only",
+  "source_head": "aec7a2e1ee2e21ea08d1ff0a673d8a490ef336d4",
+  "excerpts": [
+    {
+      "path": "scripts/economy/economy_service.gd",
+      "function": "create_snapshot",
+      "source_sha256": "95aedd0a0421c93e8fa39f0f76fa890cd0a46905d9a25c88c8b17c4d6d47728e",
+      "start_line": 605,
+      "end_line": 632,
+      "excerpt": "func create_snapshot() -> Dictionary:\n\tvar saved_accounts: Array[Dictionary] = []\n\tfor account_id: StringName in _sorted_string_name_keys(_accounts):\n\t\tvar definition: Dictionary = _accounts[account_id]\n\t\tsaved_accounts.append({\n\t\t\t&\"account_id\": String(account_id),\n\t\t\t&\"allow_negative\": bool(definition[&\"allow_negative\"]),\n\t\t\t&\"system\": bool(definition[&\"system\"]),\n\t\t})\n\tvar saved_entries: Array[Dictionary] = []\n\tfor entry: LedgerEntry in _ledger:\n\t\tsaved_entries.append(entry.to_dictionary())\n\tvar saved_idempotency: Array[Dictionary] = []\n\tfor key: StringName in _sorted_string_name_keys(_idempotency_keys):\n\t\tsaved_idempotency.append({\n\t\t\t&\"key\": String(key),\n\t\t\t&\"transaction_id\": String(_idempotency_keys[key]),\n\t\t})\n\treturn {\n\t\t&\"schema_version\": SNAPSHOT_VERSION,\n\t\t&\"current_minute\": current_minute,\n\t\t&\"next_transaction_sequence\": _next_transaction_sequence,\n\t\t&\"accounts\": saved_accounts,\n\t\t&\"entries\": saved_entries,\n\t\t&\"idempotency\": saved_idempotency,\n\t}\n\n\n"
+    },
+    {
+      "path": "scripts/economy/economy_service.gd",
+      "function": "restore_snapshot",
+      "source_sha256": "95aedd0a0421c93e8fa39f0f76fa890cd0a46905d9a25c88c8b17c4d6d47728e",
+      "start_line": 633,
+      "end_line": 715,
+      "excerpt": "func restore_snapshot(snapshot: Dictionary) -> bool:\n\tif int(snapshot.get(&\"schema_version\", snapshot.get(\"schema_version\", 0))) != SNAPSHOT_VERSION:\n\t\treturn false\n\tvar saved_accounts: Variant = snapshot.get(&\"accounts\", snapshot.get(\"accounts\", null))\n\tvar saved_entries: Variant = snapshot.get(&\"entries\", snapshot.get(\"entries\", null))\n\tvar saved_idempotency: Variant = snapshot.get(&\"idempotency\", snapshot.get(\"idempotency\", null))\n\tif not saved_accounts is Array or not saved_entries is Array or not saved_idempotency is Array:\n\t\treturn false\n\n\tvar restored_accounts: Dictionary = {}\n\tfor value: Variant in saved_accounts:\n\t\tif not value is Dictionary:\n\t\t\treturn false\n\t\tvar account_id := StringName(value.get(&\"account_id\", value.get(\"account_id\", \"\")))\n\t\tif account_id.is_empty() or restored_accounts.has(account_id):\n\t\t\treturn false\n\t\trestored_accounts[account_id] = {\n\t\t\t&\"allow_negative\": bool(value.get(&\"allow_negative\", value.get(\"allow_negative\", false))),\n\t\t\t&\"system\": bool(value.get(&\"system\", value.get(\"system\", false))),\n\t\t}\n\tif not restored_accounts.has(SYSTEM_SOURCE) or not restored_accounts.has(SYSTEM_SINK):\n\t\treturn false\n\tif not bool((restored_accounts[SYSTEM_SOURCE] as Dictionary)[&\"allow_negative\"]) \\\n\t\tor bool((restored_accounts[SYSTEM_SINK] as Dictionary)[&\"allow_negative\"]):\n\t\treturn false\n\tif not bool((restored_accounts[SYSTEM_SOURCE] as Dictionary)[&\"system\"]) \\\n\t\tor not bool((restored_accounts[SYSTEM_SINK] as Dictionary)[&\"system\"]):\n\t\treturn false\n\tfor account_id: Variant in restored_accounts:\n\t\tif account_id not in [SYSTEM_SOURCE, SYSTEM_SINK] \\\n\t\t\tand bool((restored_accounts[account_id] as Dictionary)[&\"system\"]):\n\t\t\treturn false\n\n\tvar restored_ledger: Array[LedgerEntry] = []\n\tfor value: Variant in saved_entries:\n\t\tif not value is Dictionary:\n\t\t\treturn false\n\t\trestored_ledger.append(LedgerEntryType.from_dictionary(value))\n\n\tvar restored_idempotency: Dictionary = {}\n\tvar idempotent_transactions: Dictionary = {}\n\tfor value: Variant in saved_idempotency:\n\t\tif not value is Dictionary:\n\t\t\treturn false\n\t\tvar key := StringName(value.get(&\"key\", value.get(\"key\", \"\")))\n\t\tvar transaction_id := StringName(value.get(\n\t\t\t&\"transaction_id\",\n\t\t\tvalue.get(\"transaction_id\", \"\")\n\t\t))\n\t\tif key.is_empty() or transaction_id.is_empty() \\\n\t\t\tor restored_idempotency.has(key) or idempotent_transactions.has(transaction_id):\n\t\t\treturn false\n\t\trestored_idempotency[key] = transaction_id\n\t\tidempotent_transactions[transaction_id] = true\n\n\tvar calculated := _calculate_and_validate(\n\t\trestored_accounts,\n\t\trestored_ledger,\n\t\trestored_idempotency\n\t)\n\tif not (calculated[&\"errors\"] as Array).is_empty():\n\t\treturn false\n\tvar restored_transactions: Dictionary = calculated[&\"transactions\"]\n\tvar next_sequence := int(snapshot.get(\n\t\t&\"next_transaction_sequence\",\n\t\tsnapshot.get(\"next_transaction_sequence\", 0)\n\t))\n\tvar restored_minute := int(snapshot.get(&\"current_minute\", snapshot.get(\"current_minute\", -1)))\n\tif next_sequence < 1 or restored_minute < 0:\n\t\treturn false\n\n\t# Atomic swap: live fields are untouched until every saved value is valid.\n\t_accounts = restored_accounts\n\t_ledger = restored_ledger\n\t_idempotency_keys = restored_idempotency\n\t_transaction_ids = restored_transactions\n\t_balance_cache = (calculated[&\"balances\"] as Dictionary).duplicate(true)\n\t_next_transaction_sequence = next_sequence\n\t_pending_transaction_notifications.clear()\n\tcurrent_minute = restored_minute\n\treturn true\n\n\n"
+    },
+    {
+      "path": "scripts/operations/operations_coordinator.gd",
+      "function": "create_snapshot",
+      "source_sha256": "871a248ee101b6df543fd5cf0440b5d4b0f02c21fa145a99f0687888c1bc6f90",
+      "start_line": 620,
+      "end_line": 712,
+      "excerpt": "func create_snapshot() -> Dictionary:\n\tif not _initialization_valid:\n\t\tlast_error = \"Operations coordinator initialization is invalid.\"\n\t\treturn {}\n\tif _notification_delivery_deferred or not _notification_queue.is_empty():\n\t\tlast_error = \"Deferred Operations notifications must be resolved before snapshotting.\"\n\t\treturn {}\n\tvar field_cache: Dictionary = {}\n\tvar internal_report := _snapshot_root_report({\n\t\t&\"config\": _config,\n\t\t&\"demand_profiles\": _demand_profiles,\n\t\t&\"arrival_carry\": _arrival_carry,\n\t\t&\"demand_history\": _demand_history,\n\t\t&\"arrival_reports\": _arrival_reports,\n\t\t&\"day_summaries\": _day_summaries,\n\t\t&\"morning_reports\": _morning_reports,\n\t\t&\"alerts\": _alerts,\n\t\t&\"quarantine_report\": _quarantine_report,\n\t}, field_cache, true)\n\tvar shape_error := _internal_snapshot_shape_error()\n\tif not bool(internal_report[&\"ok\"]) or not shape_error.is_empty():\n\t\tlast_error = \"Operations state cannot be serialized: %s\" % [\n\t\t\tinternal_report[&\"code\"] if not bool(internal_report[&\"ok\"]) else shape_error\n\t\t]\n\t\treturn {}\n\tvar saved_profiles: Array[Dictionary] = []\n\tvar saved_carry: Array[Dictionary] = []\n\tfor key: String in _sorted_string_keys(_demand_profiles):\n\t\tvar profile: Dictionary = _demand_profiles[key]\n\t\tsaved_profiles.append({\n\t\t\t&\"facility_tag\": String(profile[&\"facility_tag\"]),\n\t\t\t&\"guest_class\": String(profile[&\"guest_class\"]),\n\t\t\t&\"time_band\": String(profile[&\"time_band\"]),\n\t\t\t&\"components\": _string_key_dictionary(profile[&\"components\"]),\n\t\t\t&\"demand_index\": int(profile[&\"demand_index\"]),\n\t\t\t&\"last_evaluated_at\": int(profile[&\"last_evaluated_at\"]),\n\t\t})\n\t\tsaved_carry.append({\n\t\t\t&\"facility_tag\": String(profile[&\"facility_tag\"]),\n\t\t\t&\"guest_class\": String(profile[&\"guest_class\"]),\n\t\t\t&\"time_band\": String(profile[&\"time_band\"]),\n\t\t\t&\"numerator\": int(_arrival_carry.get(key, 0)),\n\t\t})\n\n\tvar saved_mornings: Array[Dictionary] = []\n\tfor day: int in _sorted_int_keys(_morning_reports):\n\t\tsaved_mornings.append(_morning_reports[day])\n\tvar saved_days: Array[Dictionary] = []\n\tfor day: int in _sorted_int_keys(_day_summaries):\n\t\tsaved_days.append(_day_summaries[day])\n\n\t# These borrowed containers never leave this synchronous method. The final\n\t# canonical conversion recursively creates owned dictionaries and arrays.\n\tvar raw_snapshot := {\n\t\t&\"schema_version\": SNAPSHOT_VERSION,\n\t\t&\"legacy_calendar_last_day\": _legacy_calendar_last_day,\n\t\t&\"legacy_history_last_day\": _legacy_history_last_day,\n\t\t&\"legacy_principal_profit_last_day\": _legacy_principal_profit_last_day,\n\t\t&\"origin_minute\": _origin_minute,\n\t\t&\"current_minute\": current_minute,\n\t\t&\"config\": _string_key_dictionary(_config),\n\t\t&\"demand_profiles\": saved_profiles,\n\t\t&\"arrival_carry\": saved_carry,\n\t\t&\"demand_history\": _demand_history,\n\t\t&\"arrival_reports\": _arrival_reports,\n\t\t&\"day_summaries\": saved_days,\n\t\t&\"morning_reports\": saved_mornings,\n\t\t&\"alerts\": _alerts,\n\t\t&\"processed_demand_minutes\": _sorted_int_keys(_processed_demand_minutes),\n\t\t&\"processed_arrival_minutes\": _sorted_int_keys(_processed_arrival_minutes),\n\t\t&\"population_count\": _population_count,\n\t\t&\"arrears_total\": _arrears_total,\n\t\t&\"consecutive_insolvency_count\": _consecutive_insolvency_count,\n\t\t&\"terminal_state\": String(_terminal_state),\n\t\t&\"pause_requested\": pause_requested,\n\t\t&\"next_arrival_plan_sequence\": _next_arrival_plan_sequence,\n\t\t&\"next_guest_sequence\": _next_guest_sequence,\n\t\t&\"arrival_plan_high_water\": _arrival_plan_high_water,\n\t\t&\"guest_high_water\": _guest_high_water,\n\t\t&\"fair_rotation_counter\": _fair_rotation_counter,\n\t\t&\"pending_boundary_minute\": _pending_boundary_minute,\n\t\t&\"deferred_boundary_minute\": _deferred_boundary_minute,\n\t\t&\"pause_reason\": String(_pause_reason),\n\t\t&\"external_quarantined\": _external_quarantined,\n\t\t&\"quarantine_report\": _quarantine_report,\n\t}\n\tvar tree_report := _snapshot_root_report(raw_snapshot, field_cache, false)\n\tif not bool(tree_report[&\"ok\"]):\n\t\tlast_error = \"Operations state cannot be serialized: %s\" % tree_report[&\"code\"]\n\t\treturn {}\n\treturn tree_report[&\"value\"]\n\n\n"
+    },
+    {
+      "path": "autoload/simulation_runtime.gd",
+      "function": "_create_operations_runtime_snapshot",
+      "source_sha256": "d52a995ae715542bbc550f68d35889540658275d12e04ae0b21ac276f5843f39",
+      "start_line": 3181,
+      "end_line": 3195,
+      "excerpt": "func _create_operations_runtime_snapshot() -> Dictionary:\n\treturn {\n\t\t&\"wrapper_version\": OPERATIONS_RUNTIME_WRAPPER_VERSION,\n\t\t&\"enabled\": _operations_enabled,\n\t\t&\"personal_action_points\": _personal_action_points,\n\t\t&\"runtime_failure_latched\": _operations_runtime_failure_latched,\n\t\t&\"runtime_failure_report\": _operations_runtime_failure_report.duplicate(true),\n\t\t&\"deferred_runtime_minute\": _operations_deferred_runtime_minute,\n\t\t&\"coordinator\": (\n\t\t\toperations_coordinator.create_snapshot()\n\t\t\tif _operations_enabled and operations_coordinator != null else {}\n\t\t),\n\t}\n\n\n"
+    },
+    {
+      "path": "scripts/construction/construction_service.gd",
+      "function": "start_construction",
+      "source_sha256": "c737eb7aa927097da677ac23ad649ef871af1dea54bcb8103348b88c5303ea25",
+      "start_line": 111,
+      "end_line": 186,
+      "excerpt": "func start_construction(\n\tdefinition: Variant,\n\torigin: Vector3i,\n\trotation: int = 0,\n\tbuild_minutes: int = 0,\n\tcreated_at: int = -1\n) -> CommandResult:\n\tif not _mutation_allowed():\n\t\treturn _unavailable_result()\n\tif _jobs.size() >= MAX_JOBS or _next_job_sequence > MAX_SEQUENCE:\n\t\treturn _failure(\"CONSTRUCTION_LIMIT\", \"Construction job capacity has been reached.\")\n\tif build_minutes > MAX_BUILD_MINUTES:\n\t\treturn _failure(\"INVALID_BUILD_TIME\", \"Construction build time exceeds the supported limit.\")\n\t_mutation_in_progress = true\n\tvar report := validate_placement(definition, origin, rotation)\n\tif not report.can_build:\n\t\t_mutation_in_progress = false\n\t\treturn _failure(\"INVALID_PLACEMENT\", \"Facility placement is invalid.\", {\n\t\t\t&\"placement_report\": report.to_dictionary(),\n\t\t})\n\n\tvar job_id := StringName(\"construction_%08d\" % _next_job_sequence)\n\tvar resource_snapshot: Variant = _capture_resource_state()\n\tvar world_snapshot := _capture_world_state(report.cells)\n\tif not _spend_cost(report.total_cost):\n\t\tvar payment_rolled_back := _restore_resource_state(resource_snapshot)\n\t\t_mutation_in_progress = false\n\t\tif not payment_rolled_back:\n\t\t\t_quarantine(\"Construction payment failed after mutating resources and could not be rolled back.\")\n\t\treturn _failure(\"PAYMENT_FAILED\", \"Construction resources changed before the command was applied.\", {\n\t\t\t&\"cost\": report.total_cost.duplicate(true),\n\t\t\t&\"rolled_back\": payment_rolled_back,\n\t\t\t&\"rollback_failed\": not payment_rolled_back,\n\t\t})\n\n\tif not _world_occupy(report.cells, job_id, &\"construction\"):\n\t\tvar world_rolled_back := _restore_world_state(world_snapshot)\n\t\tvar resources_rolled_back := _restore_resource_state(resource_snapshot)\n\t\tvar rolled_back := world_rolled_back and resources_rolled_back\n\t\t_mutation_in_progress = false\n\t\tif not rolled_back:\n\t\t\t_quarantine(\"Construction reservation failed and transaction rollback was incomplete.\")\n\t\treturn _failure(\"RESERVATION_FAILED\", \"World reservation failed.\", {\n\t\t\t&\"job_id\": job_id,\n\t\t\t&\"rolled_back\": rolled_back,\n\t\t\t&\"rollback_failed\": not rolled_back,\n\t\t\t&\"world_rolled_back\": world_rolled_back,\n\t\t\t&\"resources_rolled_back\": resources_rolled_back,\n\t\t})\n\n\tvar effective_minutes := build_minutes if build_minutes > 0 else report.build_time\n\tvar effective_created_at := current_minute if created_at < 0 else created_at\n\tvar definition_id := StringName(_definition_value(definition, &\"id\", &\"\"))\n\tvar expected_layer := int(_definition_value(definition, &\"layer\", origin.z))\n\tvar job := ConstructionJobType.new().configure(\n\t\tjob_id,\n\t\tdefinition_id,\n\t\torigin,\n\t\trotation,\n\t\texpected_layer,\n\t\treport.cells,\n\t\treport.total_cost,\n\t\teffective_minutes,\n\t\teffective_created_at\n\t)\n\t_jobs[job_id] = job\n\t_last_progress_minutes[job_id] = -1\n\t_next_job_sequence += 1\n\t_mutation_in_progress = false\n\tjob_created.emit(job)\n\treturn CommandResultType.succeeded(0, {\n\t\t&\"job_id\": job_id,\n\t\t&\"placement_report\": report.to_dictionary(),\n\t})\n\n\n"
+    },
+    {
+      "path": "scripts/economy/ledger_backed_resource_state.gd",
+      "function": "apply_resource_deltas",
+      "source_sha256": "199442c566185dc0abcc4eea5b4cf59c07330731bb5d5038b605dd801ae0209b",
+      "start_line": 60,
+      "end_line": 101,
+      "excerpt": "func apply_resource_deltas(deltas: Dictionary) -> bool:\n\tif not _validate_deltas(deltas):\n\t\treturn false\n\tvar before := create_snapshot()\n\tvar non_gold: Dictionary = {}\n\tvar gold_delta := 0\n\tfor raw_name: Variant in deltas:\n\t\tvar resource_name := StringName(raw_name)\n\t\tif resource_name == &\"gold\":\n\t\t\tgold_delta += int(deltas[raw_name])\n\t\telse:\n\t\t\tnon_gold[resource_name] = int(deltas[raw_name])\n\tif not non_gold.is_empty() and not bool(_state.call(&\"apply_resource_deltas\", non_gold)):\n\t\treturn false\n\n\tif gold_delta != 0:\n\t\tvar result: CommandResult\n\t\tif gold_delta < 0:\n\t\t\tresult = _economy.transfer(\n\t\t\t\tPLAYER_CASH,\n\t\t\t\t_counter_account,\n\t\t\t\t-gold_delta,\n\t\t\t\t_current_minute(),\n\t\t\t\t_expense_category,\n\t\t\t\t_source_entity_id\n\t\t\t)\n\t\telse:\n\t\t\tresult = _economy.transfer(\n\t\t\t\t_counter_account,\n\t\t\t\tPLAYER_CASH,\n\t\t\t\tgold_delta,\n\t\t\t\t_current_minute(),\n\t\t\t\t_refund_category,\n\t\t\t\t_source_entity_id\n\t\t\t)\n\t\tif not result.is_success():\n\t\t\trestore_snapshot(before)\n\t\t\treturn false\n\t_sync_gold_mirror()\n\treturn true\n\n\n"
+    },
+    {
+      "path": "scripts/economy/ledger_backed_resource_state.gd",
+      "function": "_current_minute",
+      "source_sha256": "199442c566185dc0abcc4eea5b4cf59c07330731bb5d5038b605dd801ae0209b",
+      "start_line": 143,
+      "end_line": 146,
+      "excerpt": "func _current_minute() -> int:\n\tif _minute_provider.is_valid():\n\t\treturn maxi(int(_minute_provider.call()), 0)\n\treturn _economy.current_minute\n"
+    },
+    {
+      "path": "scripts/supply/supply_management_service.gd",
+      "function": "_purchase_paid",
+      "source_sha256": "e4ad420191020485c027004f64bb00fad9da195fe956ef10dc0c787412018f7f",
+      "start_line": 83,
+      "end_line": 126,
+      "excerpt": "func _purchase_paid(runtime: Variant, warehouse_id: StringName, item_id: StringName,\n\tquantity: int, minute: int, ledger_key: StringName, command_id: int = 0, record_auto_attempt: bool = false) -> CommandResult:\n\t# Shared transaction only; internal replenishment does not enqueue a command.\n\tvar quote := preview_purchase(runtime, warehouse_id, item_id, quantity)\n\tif not bool(quote[&\"ok\"]):\n\t\treturn _purchase_failure(command_id, StringName(quote[&\"reason\"]), quote)\n\tvar facility: FacilityInstance = runtime.facility_service.get_instance(warehouse_id)\n\tvar item := SupplyCatalog.get_item(item_id)\n\tvar inventory_before: Dictionary = runtime.inventory_service.create_snapshot()\n\tvar economy_before: Dictionary = runtime.economy_service.create_snapshot()\n\tvar plans_before: Dictionary = runtime.auto_purchase_plans.create_snapshot() if record_auto_attempt else {}\n\tvar stocked: Dictionary = runtime.inventory_service.add_stack(facility.local_inventory_id, item_id, quantity, 100, minute + int(item[&\"shelf_life_minutes\"]), minute, int(item[&\"unit_weight\"]))\n\tif not bool(stocked.get(&\"ok\", false)):\n\t\truntime.inventory_service.restore_snapshot(inventory_before)\n\t\truntime.economy_service.restore_snapshot(economy_before)\n\t\treturn _purchase_failure(command_id, &\"INVENTORY_ERROR\")\n\tvar memo: StringName = SupplyAutoPurchasePlans.receipt_memo(item_id, quantity, int(item[&\"unit_price\"]), int(quote[&\"total_cost\"])) if record_auto_attempt else &\"supply_purchase\"\n\tif quote.has(&\"purchase_quote\"):\n\t\tmemo = PurchaseQuoteV2.receipt_memo(quote[&\"purchase_quote\"])\n\tvar paid: CommandResult = runtime.economy_service.transfer(&\"PLAYER_CASH\", runtime.OPERATING_EXPENSE_ACCOUNT, int(quote[&\"total_cost\"]), minute, &\"OPERATING_EXPENSE\", warehouse_id, ledger_key, memo, &\"\", false)\n\tif not paid.is_success():\n\t\truntime.inventory_service.restore_snapshot(inventory_before)\n\t\truntime.economy_service.restore_snapshot(economy_before)\n\t\treturn _purchase_failure(command_id, &\"PAYMENT_FAILED\")\n\tvar recorded := true\n\tif record_auto_attempt:\n\t\tif quote.has(&\"purchase_quote\"):\n\t\t\trecorded = runtime.auto_purchase_plans.record_attempt(warehouse_id, item_id, minute, CommandResult.succeeded(0, {&\"transaction_id\": paid.details[&\"transaction_id\"], &\"quantity\": quantity, &\"purchase_quote\": quote[&\"purchase_quote\"], &\"total_cost\": quote[&\"total_cost\"]}), runtime.economy_service)\n\t\telse:\n\t\t\trecorded = runtime.auto_purchase_plans.record_attempt(warehouse_id, item_id, minute, CommandResult.succeeded(0, {&\"transaction_id\": paid.details[&\"transaction_id\"], &\"quantity\": quantity, &\"unit_price\": item[&\"unit_price\"], &\"total_cost\": quote[&\"total_cost\"]}), runtime.economy_service)\n\tif not recorded:\n\t\truntime.inventory_service.restore_snapshot(inventory_before)\n\t\truntime.economy_service.restore_snapshot(economy_before)\n\t\treturn _purchase_failure(command_id, &\"PAYMENT_FAILED\")\n\tif not runtime.economy_service.commit_transaction_notification(StringName(paid.details[&\"transaction_id\"])):\n\t\truntime.inventory_service.restore_snapshot(inventory_before)\n\t\truntime.economy_service.restore_snapshot(economy_before)\n\t\tif record_auto_attempt:\n\t\t\truntime.auto_purchase_plans.restore_snapshot(plans_before, runtime.facility_service, runtime.economy_service, minute)\n\t\treturn _purchase_failure(command_id, &\"PAYMENT_FAILED\")\n\tquote.merge({&\"warehouse_id\": warehouse_id, &\"item_id\": item_id, &\"quantity\": quantity, &\"transaction_id\": paid.details[&\"transaction_id\"]})\n\treturn CommandResult.succeeded(command_id, quote)\n\n\n"
+    },
+    {
+      "path": "autoload/simulation_runtime.gd",
+      "function": "_advance_inventory_and_logistics",
+      "source_sha256": "d52a995ae715542bbc550f68d35889540658275d12e04ae0b21ac276f5843f39",
+      "start_line": 8411,
+      "end_line": 8420,
+      "excerpt": "func _advance_inventory_and_logistics(absolute_minute: int) -> void:\n\tif _operations_tick_blocked:\n\t\treturn\n\tinventory_service.current_minute = absolute_minute\n\tinventory_service.process_expired(absolute_minute, &\"inventory.waste\")\n\tif int(_state.get_resource(&\"mana\")) > 0:\n\t\tsupply_management.advance_auto_purchases(self, absolute_minute)\n\t\tsupply_management.ensure_deliveries(self, absolute_minute)\n\tsupply_logistics.tick(absolute_minute)\n\n"
+    },
+    {
+      "path": "scripts/supply/supply_logistics_bridge.gd",
+      "function": "tick",
+      "source_sha256": "b9e394af788595d2744b71f1907c8e7c3d762d38ff49992b1ee74e63b9639e80",
+      "start_line": 43,
+      "end_line": 103,
+      "excerpt": "func tick(absolute_minute: int) -> Dictionary:\n\tif _runtime == null:\n\t\treturn {&\"ok\": false, &\"reason\": &\"NOT_CONFIGURED\"}\n\tvar actions: Array[Dictionary] = []\n\tfor request_id: StringName in _request_ids(_runtime.logistics_requests):\n\t\tvar request: LogisticsRequest = _runtime.logistics_requests[request_id]\n\t\tif request.is_terminal():\n\t\t\tcontinue\n\t\tif request.state == LogisticsRequest.State.BLOCKED:\n\t\t\tif absolute_minute >= request.state_changed_at + RETRY_MINUTES:\n\t\t\t\t_rearm(request, absolute_minute)\n\t\t\tcontinue\n\t\tif request.state == LogisticsRequest.State.RESERVED:\n\t\t\tif not _reserved_stock_valid(request):\n\t\t\t\t_block_before_pickup(request, \"SOURCE_STOCK_EXPIRED\", absolute_minute)\n\t\t\telse:\n\t\t\t\t_dispatch(request, absolute_minute)\n\t\t\tcontinue\n\t\tvar task := _active_task(_runtime.staff_service, request.request_id)\n\t\tvar staff: StaffRuntime = _runtime.staff_service.get_staff(request.assigned_carrier_id)\n\t\tif task == null or staff == null or staff.current_task_id != task.task_id:\n\t\t\trequest.state_reason = \"CARRIER_TASK_MISSING\"\n\t\t\tcontinue\n\t\tif request.state == LogisticsRequest.State.DELIVERING and _cargo_quantities(_runtime.inventory_service, _cargo_id(staff.staff_id)).is_empty():\n\t\t\t_cancel_empty_cargo(request, staff, task, \"CARGO_EXPIRED\", absolute_minute)\n\t\t\tcontinue\n\t\tif not staff.can_take_shift():\n\t\t\tif request.state in [LogisticsRequest.State.ASSIGNED, LogisticsRequest.State.PICKING_UP]:\n\t\t\t\t_block_before_pickup(request, \"CARRIER_UNAVAILABLE\", absolute_minute)\n\t\t\telse:\n\t\t\t\trequest.state_reason = \"CARRIER_UNAVAILABLE\"\n\t\t\tcontinue\n\t\tif request.state in [LogisticsRequest.State.ASSIGNED, LogisticsRequest.State.PICKING_UP]:\n\t\t\tif not _reserved_stock_valid(request):\n\t\t\t\t_block_before_pickup(request, \"SOURCE_STOCK_EXPIRED\", absolute_minute)\n\t\t\telif _arrived_for_work(staff, task, absolute_minute):\n\t\t\t\tif _pickup(request, staff, task, absolute_minute):\n\t\t\t\t\tactions.append({&\"request_id\": request_id, &\"action\": &\"PICKED_UP\"})\n\t\telif request.state == LogisticsRequest.State.DELIVERING:\n\t\t\tvar cargo := _cargo_quantities(_runtime.inventory_service, _cargo_id(staff.staff_id))\n\t\t\tif cargo.is_empty():\n\t\t\t\t_cancel_empty_cargo(request, staff, task, \"CARGO_EXPIRED\", absolute_minute)\n\t\t\t\tcontinue\n\t\t\tif not _quantities_cover(cargo, request.item_requirements) and task.task_type != RETURN_TYPE:\n\t\t\t\tvar source := _facility_for_inventory(_runtime.facility_service, request.source_inventory_id)\n\t\t\t\tvar route := _access_path(staff.current_cell, source)\n\t\t\t\tif not bool(route.get(&\"reachable\", false)):\n\t\t\t\t\trequest.state_reason = \"EXPIRED_CARGO_RETURN_BLOCKED\"\n\t\t\t\t\tcontinue\n\t\t\t\tif not _runtime.staff_service.retarget_external_task(task.task_id, route[&\"cell\"], absolute_minute).is_success():\n\t\t\t\t\tcontinue\n\t\t\t\ttask.task_type = RETURN_TYPE\n\t\t\t\trequest.state_reason = RETURNING\n\t\t\t\tcontinue\n\t\t\tif _arrived_for_work(staff, task, absolute_minute):\n\t\t\t\tif _deliver(request, staff, task, absolute_minute):\n\t\t\t\t\tactions.append({&\"request_id\": request_id, &\"action\": &\"DELIVERED\"})\n\tlast_report = {&\"ok\": true, &\"actions\": actions}\n\treturn last_report.duplicate(true)\n\n\n"
+    },
+    {
+      "path": "scripts/supply/supply_logistics_bridge.gd",
+      "function": "_pickup",
+      "source_sha256": "b9e394af788595d2744b71f1907c8e7c3d762d38ff49992b1ee74e63b9639e80",
+      "start_line": 215,
+      "end_line": 245,
+      "excerpt": "func _pickup(request: LogisticsRequest, staff: StaffRuntime, task: StaffTask, minute: int) -> bool:\n\tvar source := _facility_for_inventory(_runtime.facility_service, request.source_inventory_id)\n\tif source == null or not _cell_touches_facility(staff.current_cell, source):\n\t\treturn _block_before_pickup(request, \"INVALID_PICKUP_ACCESS\", minute) and false\n\tif not source.allows_logistics():\n\t\treturn _block_before_pickup(request, \"SOURCE_CLOSED\", minute) and false\n\tvar destination := _facility_for_inventory(_runtime.facility_service, request.destination_inventory_id)\n\tif destination == null or not destination.allows_logistics() or not _has_storage_space(destination, request.total_weight):\n\t\treturn _block_before_pickup(request, \"DESTINATION_FULL_OR_CLOSED\", minute) and false\n\tvar route := _access_path(staff.current_cell, destination)\n\tif not bool(route.get(&\"reachable\", false)):\n\t\treturn _block_before_pickup(request, \"NO_DELIVERY_ROUTE\", minute) and false\n\tvar before := _capture(request)\n\tif request.state == LogisticsRequest.State.ASSIGNED and not _advance_request(request, minute):\n\t\t_rollback(request, before)\n\t\treturn false\n\tif not _advance_request(request, minute):\n\t\t_rollback(request, before)\n\t\treturn _block_before_pickup(request, \"PICKUP_FAILED\", minute) and false\n\tif not _runtime.staff_service.progress_task(task.task_id, 1, minute, true).is_success():\n\t\t_rollback(request, before)\n\t\treturn false\n\tstaff.carried_inventory_id = _cargo_id(staff.staff_id)\n\tvar delivery := _create_task(request, DELIVERY_TYPE, route[&\"cell\"], minute)\n\tif delivery == null or not _runtime.staff_service.assign_task_to_staff(delivery.task_id, staff.staff_id, minute).is_success():\n\t\t_rollback(request, before)\n\t\treturn false\n\trequest.state_reason = \"\"\n\treturn true\n\n\n"
+    },
+    {
+      "path": "scripts/supply/supply_logistics_bridge.gd",
+      "function": "_deliver",
+      "source_sha256": "b9e394af788595d2744b71f1907c8e7c3d762d38ff49992b1ee74e63b9639e80",
+      "start_line": 246,
+      "end_line": 280,
+      "excerpt": "func _deliver(request: LogisticsRequest, staff: StaffRuntime, task: StaffTask, minute: int) -> bool:\n\tvar returning := task.task_type == RETURN_TYPE\n\tvar destination_id := request.source_inventory_id if returning else request.destination_inventory_id\n\tvar destination := _facility_for_inventory(_runtime.facility_service, destination_id)\n\tif destination == null or not _cell_touches_facility(staff.current_cell, destination):\n\t\trequest.state_reason = \"INVALID_DELIVERY_ACCESS\"\n\t\treturn false\n\tvar quantities := _cargo_quantities(_runtime.inventory_service, _cargo_id(staff.staff_id))\n\tif destination == null or not destination.allows_logistics() or not _has_storage_space(destination, SupplyCatalog.inventory_weight(_runtime.inventory_service, _cargo_id(staff.staff_id))):\n\t\tif not returning:\n\t\t\trequest.state_reason = \"DESTINATION_FULL\"\n\t\treturn false\n\tvar before := _capture(request)\n\tif returning:\n\t\tvar transfers: Array[Dictionary] = []\n\t\tfor item_id: StringName in _sorted_keys(quantities):\n\t\t\ttransfers.append({&\"source_inventory_id\": _cargo_id(staff.staff_id), &\"destination_inventory_id\": destination_id,\n\t\t\t\t&\"item_id\": item_id, &\"quantity\": int(quantities[item_id]), &\"operation_id\": StringName(\"supply.return.%s.%s\" % [request.request_id, item_id])})\n\t\tif not _runtime.inventory_service.transfer_available_batch(transfers, minute)[&\"ok\"] \\\n\t\t\tor not _runtime.logistics_dispatcher.release_assignment_for_request(request.request_id, staff.staff_id, request.total_weight):\n\t\t\t_rollback(request, before)\n\t\t\treturn false\n\t\trequest.cancel(\"CARGO_EXPIRED_RETURNED\", minute)\n\telse:\n\t\tif not _advance_request(request, minute):\n\t\t\t_rollback(request, before)\n\t\t\trequest.state_reason = \"DELIVERY_RETRY\"\n\t\t\treturn false\n\tif not _runtime.staff_service.progress_task(task.task_id, 1, minute, true).is_success():\n\t\t_rollback(request, before)\n\t\treturn false\n\tstaff.carried_inventory_id = &\"\"\n\treturn true\n\n\n"
+    },
+    {
+      "path": "scripts/facility/facility_instance.gd",
+      "function": "allows_logistics",
+      "source_sha256": "0c6aa493f3299611e05dd26aa429dda8cf7b5c479e4d09632036fb862f79a324",
+      "start_line": 248,
+      "end_line": 251,
+      "excerpt": "func allows_logistics() -> bool:\n\treturn operator_open and power_available and durability > 0 and suspension_reason.is_empty() and related_facility_operating\n\n\n"
+    },
+    {
+      "path": "scripts/economy/ledger_backed_resource_state.gd",
+      "function": "create_snapshot",
+      "source_sha256": "199442c566185dc0abcc4eea5b4cf59c07330731bb5d5038b605dd801ae0209b",
+      "start_line": 102,
+      "end_line": 108,
+      "excerpt": "func create_snapshot() -> Dictionary:\n\treturn {\n\t\t&\"state\": _state.call(&\"create_snapshot\"),\n\t\t&\"economy\": _economy.create_snapshot(),\n\t}\n\n\n"
+    },
+    {
+      "path": "scripts/economy/ledger_backed_resource_state.gd",
+      "function": "restore_snapshot",
+      "source_sha256": "199442c566185dc0abcc4eea5b4cf59c07330731bb5d5038b605dd801ae0209b",
+      "start_line": 109,
+      "end_line": 127,
+      "excerpt": "func restore_snapshot(snapshot: Dictionary) -> bool:\n\tif not snapshot.get(&\"state\", null) is Dictionary \\\n\t\tor not snapshot.get(&\"economy\", null) is Dictionary:\n\t\treturn false\n\tvar previous_state: Dictionary = _state.call(&\"create_snapshot\")\n\tvar previous_economy: Dictionary = _economy.create_snapshot()\n\tif not _economy.restore_snapshot(snapshot[&\"economy\"]):\n\t\treturn false\n\tif not bool(_state.call(&\"restore_snapshot\", snapshot[&\"state\"])):\n\t\t_economy.restore_snapshot(previous_economy)\n\t\t_state.call(&\"restore_snapshot\", previous_state)\n\t\treturn false\n\tif int(_state.call(&\"get_resource\", &\"gold\")) != _economy.get_balance(PLAYER_CASH):\n\t\t_economy.restore_snapshot(previous_economy)\n\t\t_state.call(&\"restore_snapshot\", previous_state)\n\t\treturn false\n\treturn true\n\n\n"
+    }
+  ],
+  "fee_scope": [
+    {
+      "kind": "construction",
+      "observed_timing": "Spend inside start_construction before job creation; failed placement/payment/reservation does not become a valid job.",
+      "authority_status": "Observed implementation, not newly approved policy."
+    },
+    {
+      "kind": "supply",
+      "observed_timing": "Warehouse inventory addition and purchase transfer use the same minute; failed payment restores inventory/economy snapshots.",
+      "authority_status": "Observed implementation; not delivery completion charging."
+    },
+    {
+      "kind": "service",
+      "observed_timing": "Completion transaction uses service.payment.<id>, actual completion minute and immutable price_snapshot.",
+      "authority_status": "See callsite-audit.json; closure/shift boundary eligibility remains D05 pending."
+    },
+    {
+      "kind": "payroll",
+      "observed_timing": "Daily-close boundary records payment; closed P&L uses new wage accrual and excludes WAGE cash entries.",
+      "authority_status": "Original midnight daily close exists; no new wage values chosen."
+    },
+    {
+      "kind": "upkeep",
+      "observed_timing": "Ownership-time accrual and midnight settlement with arrears.",
+      "authority_status": "A01 approved; do not re-ask or move timing."
+    },
+    {
+      "kind": "warp/furnace",
+      "observed_timing": null,
+      "authority_status": "No accepted producer mapped in this bounded audit. Do not treat implementation absence/search result as a completed feature or choose timing."
+    }
+  ],
+  "save_observations": [
+    "Economy snapshot stores every entry, idempotency key to transaction ID mapping, sequence and current_minute.",
+    "Economy restore validates before atomic assignment and rebuilds transaction metadata.",
+    "Coordinator snapshot stores day summaries and pending/deferred boundaries; runtime wrapper includes coordinator snapshot."
+  ],
+  "not_proven": [
+    "Full save pipeline and cross-PID replay at current version.",
+    "Original/approved authority for every fee timing.",
+    "D05 choice and all seven-domain native acceptance."
+  ],
+  "formal_acceptance": false,
+  "product_modified": false,
+  "logistics_observations": [
+    "Runtime always invokes logistics tick after optional positive-reserve purchasing/delivery generation; therefore tick invocation alone is not evidence of stopped transfer.",
+    "Pickup/delivery call FacilityInstance.allows_logistics, which requires manual-open, power, durability, no suspension and related-facility operation; it does not inspect opening intervals.",
+    "Transfer guards do not directly consult operating-hour intervals. End-to-end scheduled closure propagation and carrier movement require further evidence; manual-versus-scheduled stopping is not accepted from this excerpt alone."
+  ]
+}

docs/plans/original-completion-2026-10-02/checkpoints/d05-decision-draft-r01/review-disposition-r01.json

@@ -24,5 +24,6 @@
     "Verify persisted day/ledger identity and same-candidate resume behavior.",
     "Map all fee producers to approved authority rather than treating implementation as approval.",
     "Complete service-kind/manual closure and logistics scopes, then review finite decision alternatives."
-  ]
+  ],
+  "latest_diagnostic": "review-disposition-r03.json"
 }

docs/plans/original-completion-2026-10-02/checkpoints/d05-decision-draft-r01/review-disposition-r03.json

@@ -0,0 +1,26 @@
+{
+  "status": "not_approval_ready",
+  "review_job": "3531c49884894be6a38b90715a533505",
+  "formal_acceptance_review": false,
+  "D05_approved": false,
+  "product_modified": false,
+  "repair_budget_changed": false,
+  "accepted_findings": [
+    "Construction job created_at is not directly passed to payment minute; require actual path consistency evidence.",
+    "The transfer guard does not directly inspect operating intervals; do not extend this to complete scheduled-closure behavior.",
+    "Snapshot structure does not prove full save pipeline or cross-PID behavior.",
+    "Unmapped warp/furnace fee timing remains incomplete."
+  ],
+  "scope_clarifications": [
+    "Service/payroll/upkeep excerpts already exist in callsite-audit.json and boundary-followup-r02.json; omitted from this deliberately bounded diagnostic, not globally missing source evidence.",
+    "Additional source reading is already authorized by the active goal; the diagnostic recommendation to request separate read permission is not adopted. New repair/Runner-core change remains outside current authorization.",
+    "The resource adapter snapshot/restore pair is now recorded: both game state and economy are captured, with rollback on restore inconsistency. This is static evidence, not a proof of every native failure outcome."
+  ],
+  "finite_remaining": [
+    "Choose closure/service-kind scope and final shift interval handling.",
+    "Choose elevator emergency landing versus cabin hold policy under total depletion.",
+    "Pin all original fee producers and their authority; no fabricated warp/furnace timing.",
+    "Prove current save/resume, reservation/notification and stopped movement invariants using applicable evidence after policy freeze.",
+    "Formal independent acceptance and integration remain required."
+  ]
+}