P13-02-CODE1: P13-02 背面対象参照・占有・保存の非描写機構（全原成果の一部、加算なし）

tests/special/peeping_room_fixture.gd

@@ -0,0 +1,59 @@
+extends SceneTree
+
+## CONTROLLED_FIXTURE. No production placement, recorder or eligibility claim.
+const Rooms := preload("res://scripts/special/peeping_room_service.gd")
+var checks := 0
+var failures := 0
+var fixtures: Array[Dictionary] = []
+
+func _initialize() -> void:
+	call_deferred("_run")
+
+func expect(ok: bool, label: String) -> void:
+	checks += 1
+	if not ok:
+		failures += 1
+		push_error(label)
+
+func fixture(build_bath := true) -> Dictionary:
+	var clock: Variant = load("res://autoload/game_clock.gd").new()
+	var state: Variant = load("res://autoload/game_state.gd").new()
+	var runtime: Variant = load("res://autoload/simulation_runtime.gd").new()
+	clock.reset(1, 6, 0)
+	state.reset()
+	expect(runtime.initialize(clock, state, 1302)[&"valid"], "CONTROLLED_FIXTURE real Runtime initializes")
+	clock.set_paused(true)
+	runtime.configure_save_policy({&"enabled": false, &"daily_checkpoint_enabled": false})
+	var f := {&"clock": clock, &"state": state, &"runtime": runtime, &"target": &"", &"origin": Vector3i(-6, 1, 1)}
+	fixtures.append(f)
+	if build_bath:
+		var built: CommandResult = runtime.submit_command(&"build_facility", {&"definition_id": &"public_bath", &"origin": Vector3i(-6, 0, 0)})
+		expect(built.is_success(), "real paid public bath construction")
+		clock.advance_minutes(runtime.definition_registry.get_facility(&"public_bath").build_minutes)
+		for target: FacilityInstance in runtime.facility_service.get_instances():
+			if target.definition_id == &"public_bath": f[&"target"] = target.instance_id
+		expect(not f[&"target"].is_empty(), "completed FRONT target has real stable identity")
+	return f
+
+func place(f: Dictionary, origin: Variant = null) -> StringName:
+	var report: Dictionary = f[&"runtime"].peeping_room_service.controlled_fixture_place(f[&"origin"] if origin == null else origin)
+	expect(report[&"ok"], "CONTROLLED_FIXTURE only room placement: " + String(report[&"reason"]))
+	return report.get(&"room_id", &"")
+
+func enable_fixture(f: Dictionary, room: StringName) -> void:
+	var runtime: Variant = f[&"runtime"]
+	expect(runtime.peeping_room_service.controlled_fixture_set_stopped(room, false), "CONTROLLED_FIXTURE explicitly enables ledger exercise")
+	expect(runtime.facility_service.set_operational_status(f[&"target"], {&"power_available": true, &"operator_open": true}, f[&"clock"].absolute_minute).is_success(), "CONTROLLED_FIXTURE target conditions")
+
+func rejects_atomically(runtime: Variant, snapshot: Dictionary) -> bool:
+	var before := var_to_bytes(runtime.create_snapshot())
+	return not runtime.restore_snapshot(snapshot) and before == var_to_bytes(runtime.create_snapshot())
+
+func finish(label: String) -> void:
+	for f: Dictionary in fixtures:
+		f[&"runtime"].free()
+		f[&"clock"].free()
+		f[&"state"].free()
+	fixtures.clear()
+	print("%s: %d checks, %d failures" % [label, checks, failures])
+	quit(1 if failures else 0)

tests/special/test_peeping_room_evidence.gd

@@ -0,0 +1,40 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var room := place(f)
+	var other := place(f, Vector3i(-4, 1, 1))
+	var service: Variant = runtime.peeping_room_service
+	var minute: int = f[&"clock"].absolute_minute
+	expect(service.record_evidence(room, &"", minute)[&"reason"] == &"SOURCE_EVENT_KEY_REQUIRED", "named source key required first")
+	expect(service.controlled_fixture_record_evidence(room, &"fixture.event", minute)[&"reason"] == &"STOPPED", "initial stopped state rejects even fixture ledger")
+	enable_fixture(f, room)
+	enable_fixture(f, other)
+	var target: FacilityInstance = runtime.facility_service.get_instance(f[&"target"])
+	target.power_available = false
+	target.operator_open = false
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"NO_POWER", "power rejection precedes closed")
+	target.power_available = true
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"CLOSED", "closed target rejects")
+	target.operator_open = true
+	# CONTROLLED_FIXTURE temporarily omit construction authority, leaving live target.
+	var empty_construction := ConstructionService.new(runtime.world_service)
+	service.configure(runtime.world_service, runtime.facility_service, empty_construction, runtime.path_service, runtime.id_generator)
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"UNDER_CONSTRUCTION", "uncompleted construction authority rejects collection")
+	service.configure(runtime.world_service, runtime.facility_service, runtime.construction_service, runtime.path_service, runtime.id_generator)
+	var before := var_to_bytes(service.create_snapshot())
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"RECORDER_ELIGIBILITY_PENDING_D04_D08_P16", "production collection never invents eligibility")
+	expect(before == var_to_bytes(service.create_snapshot()), "production collection leaves ledger unchanged")
+	var first: Dictionary = service.controlled_fixture_record_evidence(room, &"fixture.event", minute)
+	var replay: Dictionary = service.controlled_fixture_record_evidence(room, &"fixture.event", minute + 1)
+	expect(first[&"ok"] and not first[&"duplicated"] and replay[&"duplicated"] and replay[&"evidence_id"] == first[&"evidence_id"], "tuple replay returns exactly one stable ID")
+	var second: Dictionary = service.controlled_fixture_record_evidence(other, &"fixture.event", minute)
+	var third: Dictionary = service.controlled_fixture_record_evidence(room, &"fixture:event:日本語", minute)
+	expect(second[&"evidence_id"] != first[&"evidence_id"] and third[&"evidence_id"] != first[&"evidence_id"], "different room/key distinct, delimiter and UTF-8 input supported")
+	expect(service.create_snapshot()[&"evidence"].size() == 3, "replay adds no ledger record")
+	var snapshot: Dictionary = runtime.create_snapshot()
+	expect(runtime.restore_snapshot(snapshot), "active fixture evidence restores")
+	var restored: Dictionary = runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.event", minute)
+	expect(restored[&"duplicated"] and restored[&"evidence_id"] == first[&"evidence_id"], "evidence stable across restore")
+	finish("Peeping room evidence")

tests/special/test_peeping_room_geometry.gd

@@ -0,0 +1,62 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var service: Variant = runtime.peeping_room_service
+	var origin: Vector3i = f[&"origin"]
+	var before := var_to_bytes(runtime.create_snapshot())
+	expect(service.validate_placement(origin)[&"ok"], "public bath entirely behind one completed FRONT target")
+	expect(service.validate_placement(Vector3i(-6, 1, 0))[&"reason"] == &"WRONG_LAYER", "FRONT room rejected")
+	expect(service.validate_placement(origin, Vector2i(1, 2))[&"reason"] == &"WRONG_FOOTPRINT", "rotated footprint rejected")
+	expect(service.validate_placement(origin, Vector2i(2, 1), &"vip_suite")[&"reason"] == &"PENDING_P10_01", "VIP unavailable, never substituted")
+	expect(service.validate_placement(Vector3i(-1, 1, 1))[&"reason"] == &"PARTIAL_TARGET", "partial target rejected")
+	expect(service.validate_placement(Vector3i(8, 1, 1))[&"reason"] == &"TARGET_MISSING", "missing target rejected")
+	expect(service.validate_placement(origin, Vector2i(2, 1), &"missing")[&"reason"] == &"TARGET_MISMATCH", "named reference must match FRONT occupant")
+	expect(before == var_to_bytes(runtime.create_snapshot()), "geometry validation is pure across whole Runtime")
+	# Complete real second bath; the 2x1 footprint at the boundary spans targets.
+	expect(runtime.submit_command(&"build_facility", {&"definition_id": &"public_bath", &"origin": Vector3i(0, 0, 0)}).is_success(), "second paid target starts")
+	expect(service.validate_placement(Vector3i(0, 1, 1))[&"reason"] == &"TARGET_INCOMPLETE", "construction reservation is not a completed target")
+	f[&"clock"].advance_minutes(runtime.definition_registry.get_facility(&"public_bath").build_minutes)
+	expect(service.validate_placement(Vector3i(-1, 1, 1))[&"reason"] == &"MULTIPLE_TARGETS", "multiple FRONT target footprints rejected")
+	# A real path joining both sides through the proposed footprint must survive.
+	for x in range(-7, -3): runtime.world_service.set_walkable(Vector3i(x, 1, 1), true)
+	expect(runtime.rebuild_path_graph_from_world(), "CONTROLLED_FIXTURE corridor graph rebuild")
+	var path_before: Array = runtime.path_service.find_path(Vector3i(-7, 1, 1), Vector3i(-4, 1, 1))
+	expect(not path_before.is_empty(), "proposed footprint lies across a connected corridor")
+	expect(service.validate_placement(origin)[&"reason"] == &"CORRIDOR_CONFLICT", "would disconnect BACK corridor: reject with no bypass")
+	expect(runtime.path_service.find_path(Vector3i(-7, 1, 1), Vector3i(-4, 1, 1)) == path_before, "rejected cut preserves route")
+	for x in range(-7, -3): runtime.world_service.set_walkable(Vector3i(x, 1, 1), false)
+	expect(service.validate_placement(origin)[&"reason"] == &"CORRIDOR_CONFLICT", "stale path authority also rejects conflict")
+	expect(runtime.rebuild_path_graph_from_world(), "corridor fixture removed explicitly")
+	var room := place(f)
+	expect(service.validate_placement(origin)[&"reason"] == &"BACK_OCCUPIED", "dedicated room occupancy blocks overlap")
+	expect(runtime.world_service.get_entity_kind(room) == Rooms.OCCUPANCY_KIND, "dedicated cross-reference occupancy kind")
+	_private_geometry()
+	finish("Peeping room geometry")
+
+func _private_geometry() -> void:
+	var f := fixture(false)
+	var runtime: Variant = f[&"runtime"]
+	# CONTROLLED_FIXTURE underground geometry only: no unlock/normal palette claim.
+	var bounds: Dictionary = runtime.world_service.get_bounds()
+	bounds[&"min_y"] = -1
+	expect(runtime.world_service.expand_bounds(bounds), "CONTROLLED_FIXTURE underground bounds")
+	var definition: FacilityDefinition = runtime.definition_registry.get_facility(&"adult_private_room")
+	for x in range(2):
+		var cell := Vector3i(x, -1, 0)
+		runtime.world_service.set_excavated(cell, true)
+		runtime.world_service.set_support(cell, definition.weight_per_cell, true)
+	var started: CommandResult = runtime.construction_service.start_construction(definition, Vector3i(0, -1, 0))
+	expect(started.is_success(), "CONTROLLED_FIXTURE paid real adult_private_room definition")
+	f[&"clock"].advance_minutes(definition.build_minutes)
+	var service: Variant = runtime.peeping_room_service
+	expect(service.validate_placement(Vector3i(0, -1, 1))[&"ok"], "adult_private_room valid completed geometry")
+	var target_id: StringName = runtime.world_service.get_occupant(Vector3i(0, -1, 0))
+	var target: FacilityInstance = runtime.facility_service.get_instance(target_id)
+	if target != null:
+		target.definition_id = &"vip_private_salon"
+		expect(service.validate_placement(Vector3i(0, -1, 1))[&"reason"] == &"TARGET_NOT_ALLOWED", "salon is not VIP suite substitute")
+		target.definition_id = &"adult_private_room"
+		runtime.facility_service.unregister_instance(target_id)
+		expect(service.validate_placement(Vector3i(0, -1, 1))[&"reason"] == &"TARGET_UNKNOWN", "world occupant without actual FacilityService target rejected")

tests/special/test_peeping_room_reference.gd

@@ -0,0 +1,37 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var room := place(f)
+	enable_fixture(f, room)
+	var old_target: StringName = f[&"target"]
+	var old_evidence: Dictionary = runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.event", f[&"clock"].absolute_minute)
+	expect(old_evidence[&"ok"], "fixture evidence before removal")
+	expect(runtime.submit_command(&"demolish_facility", {&"instance_id": old_target}).is_success(), "real Runtime demolition")
+	var lost: Dictionary = runtime.peeping_room_service.get_room(room)
+	expect(lost[&"link_state"] == &"TARGET_LOST" and lost[&"stopped"], "target removal immediately marks lost and stopped")
+	expect(runtime.peeping_room_service.record_evidence(room, &"fixture.after_loss", f[&"clock"].absolute_minute)[&"reason"] == &"STOPPED", "collection rejected after loss with prescribed stopped precedence")
+	expect(not runtime.peeping_room_service.controlled_fixture_set_stopped(room, false), "lost target cannot resume even through fixture")
+	var lost_snapshot: Dictionary = runtime.create_snapshot()
+	expect(runtime.restore_snapshot(lost_snapshot), "lost reference roundtrip retains historical identity")
+	expect(var_to_bytes(lost_snapshot) == var_to_bytes(runtime.create_snapshot()), "lost snapshot exact typed roundtrip")
+	expect(runtime.submit_command(&"build_facility", {&"definition_id": &"public_bath", &"origin": Vector3i(-6, 0, 0)}).is_success(), "rebuild at same geometry starts")
+	f[&"clock"].advance_minutes(runtime.definition_registry.get_facility(&"public_bath").build_minutes)
+	var new_target: StringName = runtime.world_service.get_occupant(Vector3i(-6, 0, 0))
+	expect(new_target != old_target, "rebuild receives different target identity")
+	expect(runtime.peeping_room_service.get_room(room)[&"target_instance_id"] == old_target, "no implicit relink on geometry reuse")
+	var rejected: CommandResult = runtime.submit_command(&"peeping_room_relink", {&"room_id": room, &"target_instance_id": old_target})
+	expect(not rejected.is_success(), "explicit old target relink rejected")
+	expect(runtime.submit_command(&"peeping_room_relink", {&"room_id": room, &"target_instance_id": new_target}).is_success(), "explicit new target full validation")
+	var linked: Dictionary = runtime.peeping_room_service.get_room(room)
+	expect(linked[&"stopped"] and linked[&"stop_reason"] == &"RELINKED_PENDING_RESUME", "explicit relink never auto resumes")
+	f[&"target"] = new_target
+	enable_fixture(f, room)
+	var new_evidence: Dictionary = runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.event", f[&"clock"].absolute_minute)
+	expect(new_evidence[&"ok"] and new_evidence[&"evidence_id"] != old_evidence.get(&"evidence_id"), "same room/event on different target never aliases")
+	var linked_snapshot: Dictionary = runtime.create_snapshot()
+	expect(runtime.restore_snapshot(linked_snapshot) and var_to_bytes(linked_snapshot) == var_to_bytes(runtime.create_snapshot()), "relinked ledger keeps both historical target bindings")
+	expect(runtime.facility_service.unregister_instance(new_target).is_success(), "equivalent FacilityService removal path")
+	expect(runtime.peeping_room_service.get_room(room)[&"link_state"] == &"TARGET_LOST", "unregister signal also invalidates target")
+	finish("Peeping room reference")

tests/special/test_peeping_room_runtime.gd

@@ -0,0 +1,58 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	# Direct executor invocation distinguishes read-only domain state from queue receipts.
+	var validation := SimulationCommand.new()
+	validation.command_type = &"peeping_room_validate"
+	validation.payload = {&"origin": f[&"origin"]}
+	var before := var_to_bytes(runtime.create_snapshot())
+	expect(runtime._execute_peeping_room(validation).is_success(), "read-only validator executor")
+	expect(before == var_to_bytes(runtime.create_snapshot()), "validator changes no whole Runtime bytes")
+	var public_validation: CommandResult = runtime.submit_command(&"peeping_room_validate", validation.payload)
+	expect(public_validation.is_success(), "registered validation command runs through real queue")
+	var domain_before := [runtime.world_service.create_snapshot(), runtime.economy_service.create_snapshot(), runtime.id_generator.create_snapshot(), runtime.peeping_room_service.create_snapshot()]
+	var unavailable: CommandResult = runtime.submit_command(&"peeping_room_place", validation.payload)
+	expect(not unavailable.is_success() and unavailable.details[&"reason"] == &"BUILD_DEFINITION_PENDING_D04", "production placement unavailable with precise reason")
+	expect(var_to_bytes(domain_before) == var_to_bytes([runtime.world_service.create_snapshot(), runtime.economy_service.create_snapshot(), runtime.id_generator.create_snapshot(), runtime.peeping_room_service.create_snapshot()]), "placement adds no room, occupancy, cost or ID (normal queue receipt only)")
+	var room := place(f)
+	enable_fixture(f, room)
+	var blocked: CommandResult = runtime.submit_command(&"peeping_room_record_evidence", {&"room_id": room, &"source_event_key": &"fixture.command"})
+	expect(not blocked.is_success() and blocked.details[&"reason"] == &"RECORDER_ELIGIBILITY_PENDING_D04_D08_P16", "registered evidence command cannot reach ledger")
+	var missing: CommandResult = runtime.submit_command(&"peeping_room_record_evidence", {&"room_id": room})
+	expect(not missing.is_success() and missing.details[&"reason"] == &"SOURCE_EVENT_KEY_REQUIRED", "public command requires named key")
+	var malformed: CommandResult = runtime.submit_command(&"peeping_room_validate", {&"origin": [0, 1, 1]})
+	expect(not malformed.is_success() and malformed.details[&"reason"] == &"INVALID_PAYLOAD", "wrong payload type safely rejected")
+	expect(runtime.peeping_room_service.create_snapshot()[&"evidence"].is_empty(), "commands cannot inject arbitrary content events")
+	var fixture_command: CommandResult = runtime.submit_command(&"controlled_fixture_place", validation.payload)
+	expect(not fixture_command.is_success(), "no fixture command registration")
+	_mimi_format(f)
+	finish("Peeping room runtime")
+
+func _mimi_format(f: Dictionary) -> void:
+	var runtime: Variant = f[&"runtime"]
+	const Quote := preload("res://scripts/supply/supply_purchase_quote_v2.gd")
+	expect(runtime.submit_command(&"build_facility", {&"definition_id": &"warehouse", &"origin": Vector3i(2, 0, 1)}).is_success(), "paid warehouse for independent existing MIMI format path")
+	f[&"clock"].advance_minutes(runtime.definition_registry.get_facility(&"warehouse").build_minutes)
+	var warehouse: StringName = &""
+	for facility: FacilityInstance in runtime.facility_service.get_instances():
+		if facility.definition_id == &"warehouse": warehouse = facility.instance_id
+	expect(not warehouse.is_empty(), "completed real warehouse")
+	var mimi := StaffRuntime.new().configure(Quote.MIMI, &"porter", {&"employment_kind": StaffRuntime.EmploymentKind.UNIQUE})
+	expect(runtime.staff_service.register_staff(mimi).is_success(), "CONTROLLED_FIXTURE existing MIMI unique registration, no natural join claim")
+	expect(runtime.submit_command(&"set_staff_work_assignment", {&"staff_id": Quote.MIMI, &"facility_id": warehouse, &"template_id": &"NIGHT"}).is_success(), "existing persistent MIMI assignment")
+	expect(runtime.submit_command(&"purchase_supplies", {&"warehouse_id": warehouse, &"item_id": SupplyCatalog.RAW_FOOD, &"quantity": 1}).is_success(), "existing real v2 paid purchase")
+	var snapshot: Dictionary = runtime.create_snapshot()
+	expect(snapshot[&"systems"][&"runtime"][&"runtime_schema_version"] == 15 and snapshot[&"systems"][&"runtime"].has(&"special_peeping_rooms"), "v2 purchase history and special section coexist")
+	expect(runtime.restore_snapshot(snapshot) and var_to_bytes(snapshot) == var_to_bytes(runtime.create_snapshot()), "v15 optional section exact typed restore")
+	var directory := "user://tests/p13_reference_mimi_%d" % OS.get_process_id()
+	expect(SaveService.save_snapshot(directory, snapshot)[&"ok"], "physical v15 save accepts validated extension without loosening purchase allowlist")
+	var loaded := SaveService.load_snapshot(directory)
+	expect(loaded[&"ok"], "physical MIMI section save loads")
+	if loaded[&"ok"]:
+		expect(loaded[&"manifest"]["format_version"] == 2 and loaded[&"manifest"]["runtime_schema_version"] == 15, "format2 manifest still exactly15")
+		expect(runtime.restore_snapshot(loaded[&"snapshot"]), "MIMI package restore reaches same staged section validator")
+	var bad := snapshot.duplicate(true)
+	bad[&"systems"][&"runtime"][&"special_peeping_rooms"][&"version"] = 2
+	expect(not SaveService.save_snapshot(directory + "_bad", bad)[&"ok"], "save-format adapter rejects malformed optional section")

tests/special/test_peeping_room_save.gd

@@ -0,0 +1,66 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var empty: Dictionary = runtime.create_snapshot()
+	expect(not empty[&"systems"][&"runtime"].has(&"special_peeping_rooms"), "empty service does not alter existing snapshot keys")
+	expect(runtime.restore_snapshot(empty) and var_to_bytes(empty) == var_to_bytes(runtime.create_snapshot()), "pre-extension v14 absence exact roundtrip")
+	var legacy := empty.duplicate(true)
+	legacy[&"systems"][&"runtime"][&"runtime_schema_version"] = 13
+	legacy[&"systems"][&"runtime"].erase(&"auto_purchase_plans")
+	expect(runtime.restore_snapshot(legacy) and runtime.peeping_room_service.is_empty(), "genuine v13 absent section migrates empty")
+	expect(runtime.restore_snapshot(empty), "restore canonical baseline before controlled room")
+	var room := place(f)
+	enable_fixture(f, room)
+	expect(runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.save", f[&"clock"].absolute_minute)[&"ok"], "controlled evidence before mid-state save")
+	expect(runtime.submit_command(&"peeping_room_relink", {&"room_id": room, &"target_instance_id": f[&"target"]}, &"player", room, 0, f[&"clock"].absolute_minute + 1).is_success(), "future explicit relink remains pending at checkpoint")
+	var snapshot: Dictionary = runtime.create_snapshot()
+	expect(snapshot[&"systems"][&"runtime"][&"runtime_schema_version"] == 14, "extension never bumps Runtime version")
+	expect(runtime.restore_snapshot(snapshot) and var_to_bytes(snapshot) == var_to_bytes(runtime.create_snapshot()), "exact typed room/evidence whole Runtime roundtrip")
+	var directory := "user://tests/p13_reference_save_%d" % OS.get_process_id()
+	var saved := SaveService.save_snapshot(directory, snapshot)
+	expect(saved[&"ok"], "actual SaveService writes section in format 1")
+	var loaded := SaveService.load_snapshot(directory)
+	expect(loaded[&"ok"], "actual SaveService reads section")
+	if loaded[&"ok"]:
+		expect(loaded[&"manifest"]["format_version"] == 1, "existing format mapping unchanged")
+		expect(runtime.restore_snapshot(loaded[&"snapshot"]), "loaded physical package reaches Runtime validation")
+		expect(var_to_bytes(snapshot) == var_to_bytes(runtime.create_snapshot()), "physical save retains all typed fields")
+	for mutation in range(18):
+		var bad := snapshot.duplicate(true)
+		var data: Dictionary = bad[&"systems"][&"runtime"]
+		var section: Dictionary = data[&"special_peeping_rooms"]
+		match mutation:
+			0: data.erase(&"special_peeping_rooms")
+			1: data[&"special_peeping_rooms"] = null
+			2: section[&"version"] = 2
+			3: section[&"version"] = 1.0
+			4: section[&"unknown"] = true
+			5: section.erase(&"evidence")
+			6: section[&"rooms"].append(section[&"rooms"][0].duplicate(true))
+			7: section[&"evidence"].append(section[&"evidence"][0].duplicate(true))
+			8: section[&"rooms"][0][&"target_instance_id"] = &"missing.target"
+			9: section[&"rooms"][0][&"target_definition_id"] = &"adult_private_room"
+			10: section[&"rooms"][0][&"origin"] = Vector3i(8, 1, 1)
+			11: section[&"rooms"][0][&"stopped"] = 1
+			12: section[&"evidence"][0][&"room_id"] = &"peeping_room.999999999999"
+			13: section[&"evidence"][0][&"source_event_key"] = &"aliased.event"
+			14: section[&"evidence"][0][&"minute"] = f[&"clock"].absolute_minute + 1
+			15: data[&"id_generator"]["counters"]["peeping_room"] = 0
+			16:
+				section.erase(&"version")
+				section["version"] = 1
+			17:
+				section[&"rooms"][0][&"link_state"] = &"TARGET_LOST"
+				section[&"rooms"][0][&"stopped"] = true
+				section[&"rooms"][0][&"stop_reason"] = &"TARGET_LOST"
+		expect(rejects_atomically(runtime, bad), "malformed/current missing/reference/duplicate rejection atomic case %d" % mutation)
+	var orphan := empty.duplicate(true)
+	orphan[&"systems"][&"runtime"][&"world"] = snapshot[&"systems"][&"runtime"][&"world"].duplicate(true)
+	expect(rejects_atomically(runtime, orphan), "world-owned room without any section rejects atomically")
+	var removed_world := snapshot.duplicate(true)
+	removed_world[&"systems"][&"runtime"][&"world"] = empty[&"systems"][&"runtime"][&"world"].duplicate(true)
+	expect(rejects_atomically(runtime, removed_world), "section-owned room without world occupancy rejects atomically")
+	expect(runtime.restore_snapshot(empty) and runtime.peeping_room_service.is_empty(), "absent legacy section clears previous nonempty service on valid load")
+	finish("Peeping room save")