P08-03: 配置の通常操作受入

docs/plans/original-completion-2026-10-02/execution/p08-03/CONDITION_MATRIX.md

@@ -11,7 +11,7 @@ This is one existing unit in 30 packages / 88 units, with no partial credit.
 | invalid_position_reason | Reception footprint crosses the boundary from an in-bounds origin; existing reception overlap. Exact displayed Japanese reason and report codes; whole typed before/after preservation. | Source and semantic corruption controls only; actual refusals pending. |
 | demolish_rebuild | Palette demolition toggle, cell selection, confirmation/cancel, Runtime `demolish_facility`, synchronous/queued results. Lower landing refusal, cancellation, reception removal, same-cell reconstruction. Occupancy, operational/construction instances, costs/refund checked. | Implemented; Godot parsing, actual UI, audio ownership, Runtime results pending. |
 | pan_zoom_world_identity | Move mode + non-Ctrl wheel; normal wheel zoom, 0.5/4.0 clamps; recomputed local/viewport/screen coordinates and actual selected cell. OS recorder requests CUA only. | Mock bridge/checker controls only; actual OS wheel/screenshot provenance pending. |
-| separate_pid_resume | Formal four-member save; separate native writer/reader; normal load menu; whole typed/raw checkpoint identity, instance ID, cell and overlap judgement. | Collector/source prepared; real private profiles, actual distinct PIDs and formal saves pending. |
+| separate_pid_resume | Formal four-member save; separate native writer/reader; normal load menu; whole typed/raw presave/formal identity and source-defined post-operation reconstruction, instance ID, cell and overlap judgement. | R02 diagnosed notification difference; repaired candidate requires fresh native/OS collection. |
 
 ## Original-matched diagnostic choices
 
@@ -31,7 +31,7 @@ and a budget report explicitly tagged diagnostic. No production costs,
 services, balance values or definitions are changed. New art is unnecessary;
 the demolition button reuses Main's existing styling and audio.
 
-## r01 fixture repair (current candidate)
+## r01 fixture repair (retained earlier submission)
 
 The only failure authorities used are `NATIVE_R01_FAILURE_AND_SCOPE.json`
 and `native-r01-writer-stderr.log`. The r01 writer failed 13 expectations;
@@ -51,12 +51,55 @@ explicitly recorded. Every observed Runtime save/load result and direct
 SaveService diagnostic return is recorded as typed JSON and SHA-pinned raw
 Variant, with PID, requested/absolute paths and user-data directory.
 
-The 35 local checker tests remain synthetic controls. Their negative cases
+The earlier 35 local checker tests remain synthetic controls. Their negative cases
 also cover missing backup members, slot metadata SHA, failed actual returns,
 and saves outside private profiles. The mock collector supplies a controlled
 disk-space input; the production disk-admission gate is unchanged.
 Current native/OS/full regression/review/integration remain pending.
 
+## r02 whole-model operation repair (current candidate)
+
+The retained submitted HEAD is `c2b59f04f94dda0a61991ec3bb7f0e946196f995`.
+`NATIVE_R02_READER_OPERATION_DELTA.json` and `native-r02-reader-stderr.log`
+are supplied historical evidence: reader PID 58430 failed the old whole
+postsave/postload equality assertion. Their observed 161/162 counts are
+diagnostic observations, never constants in the checker or scenario.
+
+The fixture captures the complete writer model immediately before the normal
+save, leaves `writer-checkpoint.var` as the complete postsave snapshot, and
+uses `SaveService.inspect_snapshot` to decode the formal world read-only.
+Both writer and reader retain inspection returned Dictionaries and complete
+typed/raw formal models. The presave and formal models must match in full;
+the reader formal model must match the writer formal model in full.
+
+For each role, the expected complete model starts from that formal model.
+Only one `source_defined_notification` is constructed using Runtime lines
+4680–4720, `StableIdGenerator.next_id`, `SimulationDomainEvent.to_dictionary`
+and `DomainEventStream.publish/create_snapshot`. The payload is recomputed
+from the actual returned Dictionary, including optional selected/manifest
+fields and all timing fields. Event envelope, next ID, counter increment,
+sorted published IDs, existing history and the source's recent-event limit
+are derived independently. No fields or Runtime effects are removed,
+normalized away or copied from the observed notification as an expectation.
+The complete typed expectation and raw expected Variant must match the
+complete postsave/postload checkpoint. Read-only inspection must also leave
+the whole live model unchanged.
+
+Each role exports `*-expected-operation`, `*-operation-actual` and
+`*-operation-comparison.json` alongside unchanged-format raw checkpoints,
+formal models and returned-result records. On unknown drift, these complete
+raw inputs remain and the checker reports the precise typed difference paths.
+No new native difference was observed by this worker; fresh native execution
+is pending, so the supplied R02 trace is not a PASS for these changed sources.
+
+The current Python suite retains all 35 earlier tests and adds 14 semantic
+tests, including every notification payload/envelope field, type drift,
+counter/published-ID errors, extra or rewritten history, unrelated/unknown
+model drift, read-only formal mismatch and a non-trace-derived count with
+the source's history-limit behavior. These are synthetic controls only.
+Exact executed source/input SHAs and the current 49-test result are recorded
+in `local-validation.json` and `implementation.json`.
+
 ## Evidence boundary
 
 `placement.gd` contains the shared finite scenario and handler endpoints.