Merge commit '806de25068bc423136063791afcea811d251ee1b' into HEAD

docs: pin full P19 reachability review pass before normal integration
docs: retain P19 whole-review findings and same-task repair status
2026-10-17 19:59:18 +09:00 · 2026-10-17 19:58:25 +09:00 · 2026-10-17 19:50:02 +09:00 · 2026-10-17 19:49:30 +09:00 · 2026-10-17 19:39:40 +09:00 · 2026-10-17 19:24:10 +09:00
43 changed files with 25618 additions and 45 deletions
@@ -20,6 +20,7 @@ const OPERATING_EXPENSE_ACCOUNT := &"OPERATING_EXPENSE"
 const AUTHORITY_FINE_ACCOUNT := &"AUTHORITY_FINE_EXPENSE"
 const WAGE_EXPENSE_ACCOUNT := &"WAGE_EXPENSE"
 const RUNTIME_SNAPSHOT_VERSION := 14
+const PeepingRooms := preload("res://scripts/special/peeping_room_service.gd")
 const AUTO_PURCHASE_RUNTIME_SNAPSHOT_VERSION := 14
 const EVENT_THREAT_RUNTIME_SNAPSHOT_VERSION := 13
 const MIMI_PURCHASE_RUNTIME_SNAPSHOT_VERSION := 15
@@ -97,6 +98,7 @@ const DEFENSE_COMMAND_TYPES: Array[StringName] = [
 var definition_registry := DefinitionRegistry.new()
 var command_queue := CommandQueue.new()
 var id_generator := StableIdGenerator.new()
+var peeping_room_service := PeepingRooms.new()
 var domain_events := DomainEventStream.new()
 var world_service := WorldService.new()
 var path_service := PathService.new()
@@ -233,6 +235,7 @@ func initialize(clock: SimulationKernel, state: Variant, seed := DEFAULT_WORLD_S
 	_hired_staff_candidate_ids.clear()
 	command_queue = CommandQueue.new()
 	id_generator = StableIdGenerator.new()
+	peeping_room_service = PeepingRooms.new()
 	domain_events = DomainEventStream.new()
 	world_service = WorldService.new()
 	path_service = PathService.new()
@@ -253,6 +256,7 @@ func initialize(clock: SimulationKernel, state: Variant, seed := DEFAULT_WORLD_S
 	_initialize_s5_defense()
 	construction_service = ConstructionService.new(world_service, construction_resource_state)
 	construction_service.current_minute = _clock.absolute_minute
+	peeping_room_service.configure(world_service, facility_service, construction_service, path_service, id_generator)
 	_connect_construction_signals()
 	var initial_infrastructure_ok := _initialize_infrastructure_services()
 	_next_command_id = 1
@@ -298,6 +302,8 @@ func initialize(clock: SimulationKernel, state: Variant, seed := DEFAULT_WORLD_S
 	register_command_executor(&"build_facility", Callable(self, "_execute_build_facility"))
 	register_command_executor(&"cancel_construction", Callable(self, "_execute_cancel_construction"))
 	register_command_executor(&"demolish_facility", Callable(self, "_execute_demolish_facility"))
+	for command_type: StringName in [&"peeping_room_validate", &"peeping_room_place", &"peeping_room_relink", &"peeping_room_record_evidence"]:
+		register_command_executor(command_type, Callable(self, "_execute_peeping_room"))
 	register_command_executor(&"set_elevator_operation", Callable(self, "_execute_set_elevator_operation"))
 	register_command_executor(&"start_excavation", Callable(self, "_execute_start_excavation"))
 	register_command_executor(&"pause_excavation", Callable(self, "_execute_pause_excavation"))
@@ -565,6 +571,8 @@ func create_snapshot() -> Dictionary:
 	}
 	if PurchaseQuoteV2.has_history(owned_systems[&"runtime"]):
 		owned_systems[&"runtime"][&"runtime_schema_version"] = MIMI_PURCHASE_RUNTIME_SNAPSHOT_VERSION
+	if not peeping_room_service.is_empty():
+		owned_systems[&"runtime"][&"special_peeping_rooms"] = peeping_room_service.create_snapshot()
 	# Every component above returns detached containers. Transfer this fresh
 	# tree into the envelope instead of deep-copying all component snapshots a
 	# second time. Keep generic capture's caller-owned-extra contract unchanged.
@@ -666,6 +674,8 @@ func _restore_snapshot_internal(snapshot: Dictionary, recovery_mode: bool) -> bo
 			runtime_current_keys.append(&"facility_cleanliness")
 		if runtime_schema_version >= AUTO_PURCHASE_RUNTIME_SNAPSHOT_VERSION:
 			runtime_current_keys.append(&"auto_purchase_plans")
+		if runtime_data.has(&"special_peeping_rooms"):
+			runtime_current_keys.append(&"special_peeping_rooms")
 		if not _dictionary_has_exact_canonical_keys(runtime_data, runtime_current_keys) \
 				or typeof(runtime_data.get(&"runtime_schema_version", null)) != TYPE_INT \
 				or typeof(runtime_data.get(&"world_seed", null)) != TYPE_INT \
@@ -1290,6 +1300,16 @@ func _restore_snapshot_internal(snapshot: Dictionary, recovery_mode: bool) -> bo
 	var restored_next_id := int(runtime_data.get(&"next_command_id", 0))
 	if restored_next_id <= 0:
 		return false
+	var restored_peeping_rooms := PeepingRooms.new()
+	restored_peeping_rooms.configure(restored_world, restored_facilities, restored_construction, restored_path, restored_id_generator)
+	if runtime_data.has(&"special_peeping_rooms"):
+		if not runtime_data[&"special_peeping_rooms"] is Dictionary:
+			return false
+		for raw_key: Variant in runtime_data:
+			if raw_key == &"special_peeping_rooms" and typeof(raw_key) != TYPE_STRING_NAME:
+				return false
+	if not restored_peeping_rooms.restore_section(runtime_data.get(&"special_peeping_rooms", null), restored_minute):
+		return false
 	if not SimulationSnapshot.restore(snapshot, _clock, _state):
 		return false
 	world_seed = restored_world_seed
@@ -1297,6 +1317,7 @@ func _restore_snapshot_internal(snapshot: Dictionary, recovery_mode: bool) -> bo
 	_staffing_projection_enabled = restored_staffing_projection
 	command_queue = restored_queue
 	id_generator = restored_id_generator
+	peeping_room_service = restored_peeping_rooms
 	domain_events = restored_domain_events
 	_rng_streams = restored_streams
 	world_service = restored_world
@@ -5546,6 +5567,7 @@ func _connect_facility_signals() -> void:
 		return
 	facility_service.instance_registered.connect(Callable(self, "_on_cleanliness_facility_registered"))
 	facility_service.instance_unregistered.connect(Callable(self, "_on_cleanliness_facility_unregistered"))
+	facility_service.instance_unregistered.connect(Callable(self, "_on_peeping_target_removed"))
 	facility_service.facility_state_changed.connect(Callable(self, "_on_facility_state_changed"))
 	facility_service.service_started.connect(Callable(self, "_on_service_started"))
 	facility_service.service_interrupted.connect(Callable(self, "_on_service_interrupted"))
@@ -10817,6 +10839,7 @@ func _on_excavation_completed(report: Dictionary) -> void:
 	))

 func _on_facility_demolished(instance_id: StringName, refund: Dictionary) -> void:
+	peeping_room_service.target_removed(instance_id)
 	if not mana_network_service.get_node(instance_id).is_empty():
 		mana_network_service.unregister_node(instance_id)
 	if facility_service.has_instance(instance_id):
@@ -10831,6 +10854,31 @@ func _on_facility_demolished(instance_id: StringName, refund: Dictionary) -> voi
 		0
 	))

+func _on_peeping_target_removed(instance_id: StringName) -> void:
+	peeping_room_service.target_removed(instance_id)
+
+func _execute_peeping_room(command: SimulationCommand) -> CommandResult:
+	var payload := command.payload
+	var report: Dictionary
+	if command.command_type == &"peeping_room_place":
+		report = PeepingRooms.result(&"BUILD_DEFINITION_PENDING_D04")
+	elif command.command_type == &"peeping_room_validate":
+		if typeof(payload.get(&"origin")) != TYPE_VECTOR3I or typeof(payload.get(&"footprint", Vector2i(2, 1))) != TYPE_VECTOR2I or typeof(payload.get(&"target_instance_id", &"")) not in [TYPE_STRING, TYPE_STRING_NAME]:
+			report = PeepingRooms.result(&"INVALID_PAYLOAD")
+		else:
+			report = peeping_room_service.validate_placement(payload[&"origin"], payload.get(&"footprint", Vector2i(2, 1)), StringName(payload.get(&"target_instance_id", &"")))
+	else:
+		var key: StringName = &"target_instance_id" if command.command_type == &"peeping_room_relink" else &"source_event_key"
+		if typeof(payload.get(&"room_id")) not in [TYPE_STRING, TYPE_STRING_NAME] or typeof(payload.get(key, &"")) not in [TYPE_STRING, TYPE_STRING_NAME]:
+			report = PeepingRooms.result(&"INVALID_PAYLOAD")
+		elif command.command_type == &"peeping_room_relink":
+			report = peeping_room_service.relink(StringName(payload[&"room_id"]), StringName(payload.get(key, &"")))
+		else:
+			report = peeping_room_service.record_evidence(StringName(payload[&"room_id"]), StringName(payload.get(key, &"")), _runtime_event_minute())
+	if report[&"ok"]:
+		return CommandResult.succeeded(command.command_id, report)
+	return CommandResult.failed(CommandResult.Code.VALIDATION_FAILED, command.command_id, String(report[&"reason"]), report)
+
 func _on_ledger_transaction_posted(transaction_id: StringName, _entries: Array) -> void:
 	if _operations_flushing_economy_notifications.has(transaction_id):
 		return
@@ -3734,6 +3734,61 @@
        "path": "docs/spec/acceptance/P23-03.json",
        "scope": "component and read-only observation only; native unexecuted; whole unit blocked"
      }
+    },
+    {
+      "test": "tests/special/test_peeping_room_geometry.gd",
+      "template": "Peeping room geometry: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "103d85f83e1e97a8637892504264275eef23f172eeec56c94e5c022d81bf6945",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
+    },
+    {
+      "test": "tests/special/test_peeping_room_reference.gd",
+      "template": "Peeping room reference: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "188b00a60f7aefda69dc4973f1de9c14447a0d4bcdd1257a2eabe7c4782e4caf",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
+    },
+    {
+      "test": "tests/special/test_peeping_room_evidence.gd",
+      "template": "Peeping room evidence: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "390e0032d14de9a8875ced163a922341ce655744200d78b4ffa776d42c4f8c2a",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
+    },
+    {
+      "test": "tests/special/test_peeping_room_save.gd",
+      "template": "Peeping room save: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "ba0e7644277477c1821135cae6d6fd533651799c6f9bd8c43ccf45e63b96c63c",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
+    },
+    {
+      "test": "tests/special/test_peeping_room_runtime.gd",
+      "template": "Peeping room runtime: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "924efd34414c12a325a1b700f799aef0396de9f15441fd88a3608292ff221657",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
    }
  ],
  "unknown_roster_suite_policy": "refuse, explicitly review its source/schema before accepting",
@@ -0,0 +1,148 @@
+# P13-02-CODE1 implementation handoff
+
+This is non-graphic state/reference/occupancy/save machinery only. It does not
+complete P13-02, grant partial credit, or change the original 30/88 denominator
+or formal 14/88 count. Native execution and acceptance are pending.
+
+## Declared scope and verification
+
+Before editing, the worker declared the new service, bounded Runtime hooks,
+special tests, narrow runner, marker additions and this documentation. SaveService
+was conditional on an exact-key dependency; inspection found
+`SupplyAutoPurchaseQuotePlans.valid_runtime_format` has that dependency.
+Only allowed paths were edited. No asset, UI, content, model, policy, clock phase,
+or P04 change is involved.
+
+The full ignored `build/owner-handoff/ACTUAL_OPUS_RUN_DECISION.json` was read and
+left untouched. Base HEAD is `1e8d4ea88876865a72547ff0edf43ed5b0e74c7e`.
+The immutable spec was not edited. Its SHA-256 without the terminal newline is
+the registered `8ea65f2eefedc772c08170186f5cd03ac017432f4b069ade4f9210d4215c2d43`;
+the on-disk file including that newline is
+`988d6e18a49372549863cd433432c2852c962fa64b138e490361c023e80249dc`.
+
+Worker verification: Python AST parsing/compilation only, without executing the
+runner or importing its dependencies; source/JSON/hash review. GDScript parsing,
+all tests, `--prepare-only`, native collection and regression were **not run**.
+No check totals or native success receipts are claimed. No git writes, commits,
+branches, other agents, integration or Runner operations were performed.
+
+## Service and commands
+
+`PeepingRoomService` is a separate RefCounted service with no content or UI.
+All command executors use the existing Runtime queue; queue/history receipts
+remain normal Runtime behavior even for rejected/read-only domain commands.
+
+| Command | Preconditions and result |
+| --- | --- |
+| `peeping_room_validate` | `origin: Vector3i`, optional `footprint: Vector2i` (2x1), optional `target_instance_id: String/StringName`. Pure domain validation. |
+| `peeping_room_place` | Always `BUILD_DEFINITION_PENDING_D04`; no occupancy, resource, room or ID mutation. |
+| `peeping_room_relink` | Existing `room_id`, explicit nonempty `target_instance_id`; full geometry and ownership validation excluding only the room's exact own occupancy. Leaves `LINKED`, stopped, `RELINKED_PENDING_RESUME`. |
+| `peeping_room_record_evidence` | Existing `room_id`, nonblank named `source_event_key`. Uses Runtime minute, never caller-supplied time. Checks stopped, target power, target closure/opening hours, completed construction authority, and lost target in that order. Otherwise rejects with `RECORDER_ELIGIBILITY_PENDING_D04_D08_P16`. Never writes the ledger. |
+
+Malformed command field types return `INVALID_PAYLOAD`. Missing/blank source keys
+return `SOURCE_EVENT_KEY_REQUIRED` before operational checks. Loss latches both
+`TARGET_LOST` and stopped, so collection after normal demolition returns `STOPPED`
+while the room's link/stop reason identifies `TARGET_LOST`. No resume command or
+automatic resume is defined. Power/closure guards read actual target conditions;
+they do not define special-room power demand, staffing or normal operation.
+
+Placement is exactly 2x1 BACK, fully behind a single completed FRONT
+`public_bath` or `adult_private_room`. It checks bounds/excavation, both real
+FacilityService and ConstructionService ownership, FRONT cells, World occupancy,
+and both World walkability and PathService membership. Exact rejection families:
+`WRONG_LAYER`, `WRONG_FOOTPRINT`, `OUT_OF_BOUNDS`, `NOT_EXCAVATED`,
+`TARGET_INCOMPLETE`, `TARGET_MISSING`, `PARTIAL_TARGET`, `MULTIPLE_TARGETS`,
+`TARGET_MISMATCH`, `TARGET_UNKNOWN`, `TARGET_NOT_ALLOWED`, `TARGET_WRONG_LAYER`,
+`CORRIDOR_CONFLICT`, `BACK_OCCUPIED`. The named `vip_suite` request returns
+`PENDING_P10_01`; `vip_private_salon` is not an allowed substitute.
+
+Any existing corridor cell conflicts. A proposed cut through a connected corridor
+is rejected before mutation, preserving the route; no reroute or bypass is
+invented. Accepted fixture cells were already nonwalkable and become occupied
+under `special_peeping_room`. No special-room construction weight/cost is assumed.
+
+Runtime demolition and FacilityService unregistration latch loss. Collection also
+detects missing FRONT occupancy/identity. Rebuilding the same cells produces a
+different construction ID and never silently reattaches rooms. Relink is explicit.
+
+## CONTROLLED_FIXTURE boundary
+
+Only service methods named `controlled_fixture_place`,
+`controlled_fixture_set_stopped`, and `controlled_fixture_record_evidence` create
+test rooms, enable fixture collection, or write evidence. They are labeled
+CONTROLLED_FIXTURE in code and tests. They have no command/palette registration,
+and no Runtime executor calls them. Test helpers disclose direct underground
+geometry setup and MIMI registration; those do not assert natural unlock/join or
+production eligibility. Target construction uses existing definitions/costs/times.
+
+Room IDs come from the existing StableIdGenerator's `peeping_room` counter.
+Evidence IDs encode the UTF-8 lengths and hex bytes of the full
+`(room_id, target_instance_id, source_event_key)` tuple. This is injective rather
+than delimiter concatenation or a hash with possible collisions. Replays return
+the existing ID with `duplicated=true` and retain the first minute. Evidence is
+only IDs, source key and minute. Room `target_history` retains prior bindings so
+relink does not orphan existing opaque evidence.
+
+## Save invariants
+
+Runtime versions remain 14 and 15, with version 15 only for existing v2 purchase
+history. Optional canonical StringName key `special_peeping_rooms` has section
+version 1 and exact keys `version`, `rooms`, `evidence`. Empty service state emits
+no key, preserving original snapshots. Absent sections restore empty only if no
+world occupancy uses the special kind or `peeping_room.` prefix. Thus removing
+the section from a current room-bearing save is rejected without a version bump.
+
+Restore stages the entire section against staged world, path, facilities,
+construction and ID generator before committing any Runtime state. It checks
+canonical keys/types, version, duplicate room/evidence identities, deterministic
+evidence tuple encoding, bounds/geometry, room/occupancy correspondence in both
+directions, generator high-water mark, known historical facility IDs, present
+target definition/geometry, loss/stopped coherence, and evidence room/history/time
+references. Null/present-empty sections are invalid; absence is the only empty
+encoding. Existing pending command/reference and schema migration checks remain.
+
+SaveService validates a present section through the same staged service validator,
+then supplies a shallow copy without this one key to the original purchase-format
+allowlist. No other keys are removed. The original format 1 (Runtime 1–14),
+format 2 (Runtime 15), manifest duplicate 15 and MIMI checks remain unchanged.
+
+## Verification handoff
+
+Five strict suites cover geometry/corridor, removal/relink, evidence/guards,
+typed atomic save corruption and physical format 1, and Runtime commands plus
+physical MIMI format 2. Tests use `var_to_bytes` for whole Runtime atomicity and
+roundtrip checks. New marker rows carry final test source hashes; prior rows and
+policy are unchanged. A helper under `tests/special/` is not a discovered suite.
+
+`tools/run_p13_reference_tests.py` defaults to read-only verification of
+`$BUILD_OUTPUT_DIR/p13-reference-native`, failing closed without an absolute
+environment path. Explicit `--output --collect` is for Root only. The strict flag
+parser rejects abbreviations, repeated flags, positional inputs and `=` aliases.
+`--prepare-only` is non-native but was not executed by this worker.
+
+The runner imports the existing P18 core by path. Since its three entry functions
+hardcode their label and seven/nine counts, a bounded AST adapter changes only
+protocol/runner identities, those explicit roster cardinalities, and diagnostic
+labels. It checks the exact adaptation-site counts and fails closed on drift.
+All confinement, inventory, JSON, sealing, source/engine/marker/policy binding,
+process, diagnostic, profile and cleanup gates are reused. It neither copies the
+whole runner nor modifies P18/helpers. The whole selected source map binds both
+runner sources. Phase count derives from `len(ROSTER) + 2`.
+
+Roster includes all five new suites and existing construction/world/path/runtime
+construction, supply migration, transport save, Runtime weather, snapshot
+serialization, save lifecycle and MIMI purchase suites. Receipts retain
+`formal_acceptance=false` and `original_unit_complete=false`.
+
+Root must perform serialized native collection with the allocation/private
+profile, then registered `p13-reference` validation, a separate actual Opus
+review, and the final exact-version required regression. Only those steps can
+establish execution results.
+
+## Still pending, without invented values
+
+D04 build/upkeep/build minutes and other product numbers; recorder staffing and
+natural triggers/rates D04/D08/P16; VIP suite P10-01; D05 transaction decisions
+(no tick-phase changes here); P19 evidence use and P24 camera UI; normal palette
+registration/construction/operation and natural production evidence; whole P13
+acceptance, final review/integration, and applicable native Windows conditions.
@@ -0,0 +1,27 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "status": "pass",
+  "summary": "判定: pass。ただし対象は登録済みの限定バックエンド CODE1 のみです。親の P13-02 は完了していないままで、30/88・formal 14/88 の分母にも加算しません。\n\n【実装の照合（仕様のすべての要件・カバレッジ項目と突き合わせ）】\n- 構成: PeepingRoomService を独立サービスとして追加し、Runtime 側の接続は限定的です。\n  - 生成と読み込みのたびに構成し直し、施設登録解除と解体の両方で接続しています。\n  - コマンドは validate / place / relink / record_evidence の4種で、通常の実行キューを通ります。\n- 配置判定: 2x1 の BACK 配置が、許可された完成済み FRONT 対象1つの真裏に完全に収まるかを検査します。\n  - 拒否理由を網羅しています: 層違い、形状違い、範囲外、未掘削、建設中、対象なし、部分重なり、複数対象、対象不一致、不明対象、許可外対象、通路衝突（World の歩行可否と Path の両方で判定）、BACK 占有済み。\n  - vip_suite は PENDING_P10_01 として扱い、vip_private_salon を代用に使わないことを確認しました。\n- 対象の同一性:\n  - 撤去すると TARGET_LOST になり、停止状態に固定されます。\n  - 同じ位置に再建すると別の ID になり、自動で再リンクしません。\n  - 明示的な relink は配置判定をすべてやり直し、停止状態（RELINKED_PENDING_RESUME）のまま残ります。\n  - target_history に過去の対象 ID を残すため、既存の証拠が孤立しません。\n- 証拠 ID: (room, target, source_event_key) を長さ付き UTF-8 の hex で符号化しており、単射です。\n  - 同じイベントの再実行は同一 ID を返し、記録は増えません。\n  - 部屋や対象が違えば ID も別になり、取り違えは起きません。\n- 本番経路の封じ込め:\n  - 本番の記録は RECORDER_ELIGIBILITY_PENDING_D04_D08_P16 で拒否され、台帳を変えません。\n  - place は BUILD_DEFINITION_PENDING_D04 を返すだけです。テストで、ドメインイベントの受領が1件だけ発行され、それ以外の ID とドメインデータが変わらないことを確認しています。\n  - CONTROLLED_FIXTURE 用のメソッドは公開コマンドやパレットから呼べません。\n  - 停止中 / 無電力 / 閉店 / 建設中 / 対象喪失 の各ケースで収集を拒否します。\n- 保存:\n  - Runtime のバージョンは 14 / 15 のままで、format2 は MIMI15 の場合だけです。\n  - 新セクションは任意キーで、空のときは出力しません。セクションのない本物の旧形式セーブは空として移行します。\n  - 現行形式で不正なものは全体をそのまま保ったまま原子的に拒否し、元の Runtime を壊しません。対象は、セクション欠落 / null / バージョン / 未知キー / 重複 / 参照不正 / 時刻 / ID 上限 / 型 / 孤立占有、およびその逆方向の不整合で、テストの18変異ケースと孤立ケースで確認しています。\n  - SaveService は同じ検証器を通したうえで、購入用の許可キー一覧を元のまま維持しています。\n\n【検証証跡】\n- 登録済みの p13-reference 検証は exit 0 で通過しています（narrow 15 スイート / 863 チェック / 構文 329 / 終了 17）。\n- 全体の 184 スイート / 21903 チェックは合成検証です。\n  - 構成: 元の通し実行は ENOSPC で失敗しており、失敗のまま残っています。その前半58スイートを再検証し、後半126スイートを実際に実行した結果を組み合わせたものです。\n  - 結果: 読み取り専用の集計で verified / composed=true（ネイティブ終了 186 件、すべて一意）を、元の通し実行と対象コミットに紐付いた記録で確認しました。\n- 自己申告だけに依拠していません。\n\n【残る後続ゲート】\n- 最終版でのリグレッション、通常の統合と最終確定。\n- D04 / D08 / P16 の数値、記録係の配置、自然な収集トリガー、VIP（P10-01）、P19 / P24、通常のパレット登録、Windows 条件。",
+  "acceptance_ids": [
+    "P13-02-CODE1"
+  ],
+  "findings": [
+    {
+      "severity": "low",
+      "message": "create_snapshot は対象喪失を正規化しません（detect_target_loss は収集時にだけ遅延実行されます）。そのため、シグナルを経ずに対象が消えた場合は LINKED の部屋が残ります。こうして書かれたセーブは restore_section の配置判定で全体が拒否され、読み込めなくなります。現状、そのような経路は確認できませんでした（facility_service.restore_snapshot はシグナルを出さず、ロールバックは既存の対象を消しません）。ただし、スナップショット生成時に正規化するか、後続で防御策を入れることを推奨します。"
+    },
+    {
+      "severity": "low",
+      "message": "Runtime の schema バージョンが 5 未満（v1〜4）の旧形式に special_peeping_rooms があっても拒否されず、検証を通れば受理されます。仕様の「本物の旧形式はセクションなし」に照らすと、偽装された旧ペイロードを受け入れる余地がわずかにあります。中身は restore_section で厳密に検証されるため、実害は小さいと判断します。"
+    },
+    {
+      "severity": "low",
+      "message": "施設の寸法移行（prepare_facility_dimension_snapshot）で public_bath / adult_private_room の占有セルが変わると、LINKED の部屋の再検証に失敗し、移行全体が拒否されます。現在の部屋はテスト用フィクスチャでしか作れないため影響は限定的です。後続の本番配置の実装時に扱いを決める必要があります。"
+    },
+    {
+      "severity": "low",
+      "message": "「建設中なら収集を拒否」の分岐は、本番状態では到達できません。テストは ConstructionService を差し替えて確認しており、意味上の網羅としては人工的です。配置判定も、建物定義（D04）が未定のため construction_service.validate_placement（支持・重量の判定）を使っていません。いずれも仕様の「未定値を発明しない」範囲内として許容しますが、記録に残します。"
+    }
+  ]
+}
@@ -1,5 +1,5 @@
 {
-  "at_jst": "2026-10-17T18:59:44.626679+09:00",
+  "at_jst": "2026-10-17T19:05:57.762697+09:00",
  "plan_id": "P13-02",
  "batch": "P13-02-CODE1",
  "S": "a7e3069b167511b3194242b3403fbcc35244a526",
@@ -27,20 +27,19 @@
    "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
  },
  "formal_review": {
-    "state": "actual provider running",
-    "exec_session": 96001,
+    "state": "terminal_pass",
    "run_id": "ead8e74b9683404d8cf3d97bca118726",
-    "pid": 17285,
    "model": "claude-opus-5-5",
-    "frozen_checkout": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-review-e6fc1237",
-    "material_files": 16049
+    "critical_high_medium": 0,
+    "low": 4,
+    "artifact": "ACTUAL_INDEPENDENT_OPUS_REVIEW.json"
  },
-  "normal_integration_candidate": null,
-  "source_on_main": false,
+  "normal_integration_candidate": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "source_on_main": true,
  "remaining_conditions": [
-    "Actual separate whole CODE1 review must pass with no critical/high/medium finding",
-    "Normal exact latest-main integration candidate, input-equality qualification, final verification and ledger",
-    "Whole original P13-02 normal construction/recorder/natural triggers/approved quantities/VIP/UI/assets/Windows and all original conditions remain unaccepted"
+    "Whole original P13-02 normal construction/recorder/natural triggers/approved quantities/VIP/UI/assets/Windows and all original conditions remain unaccepted; CODE1 has no new original-unit credit",
+    "Four low severity future-production defensive/migration/coverage observations retained from actual Opus review; no observed ordinary production path and no critical/high/medium finding",
+    "P04-01 remains next original formal closure when existing D05 owner choices arrive; independent next original-unit selection will be requested from actual Opus"
  ],
  "evidence": [
    {
@@ -66,7 +65,51 @@
      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-full-continuation-a7/CONTINUATION_STORAGE_CONTROLS.json",
      "bytes": 1846,
      "sha256": "96f47033ef95614426cb8646f7a4fbfedcb5af6bd95a0ab1e54a802d3eed77a6"
+    },
+    {
+      "path": "ACTUAL_INDEPENDENT_OPUS_REVIEW.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/ead8e74b9683404d8cf3d97bca118726/result.json",
+      "bytes": 6753,
+      "sha256": "cc12bb1011da2f3a21018da8fdde966a13e70dcf33ef7c83310dcf0ca08f4ec8"
+    },
+    {
+      "path": "FORMAL_VALIDATION.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/6df11a390bc44b48a10c916cbeab95c9-validation.json",
+      "bytes": 380,
+      "sha256": "d9e73b97bb173a75931a0263119ff6430a2049e204ca459fbb53ca04b8aa0e4a"
+    },
+    {
+      "path": "FORMAL_INTEGRATION.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/562e2bb9ca8b4f458d0cc011edd41cc4-integration.json",
+      "bytes": 381,
+      "sha256": "513ab79bd5fadafb929d5ad3201a8e9d5ff0e826eda37a80c831d82327940d8e"
+    },
+    {
+      "path": "FORMAL_FINAL.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/45fdaf3b82c84e1485ad0d4cc7bf993c-final.json",
+      "bytes": 375,
+      "sha256": "213af13d38587ff108802fc96f6c410af6e9bf66ab6bb683963af62d36ecae2f"
+    },
+    {
+      "path": "RUNNER_COMPLETED_TRACEABILITY.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/traceability/P13-02-CODE1.json",
+      "bytes": 3697,
+      "sha256": "c11f2f390bfe3222dc4e955fb001878ba5db03deafd1b85534299da758354250"
+    },
+    {
+      "path": "EXACT_INTEGRATED_FULL_REUSE_QUALIFICATION.json",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/coordinator-start-20261017/EXACT_C65F07B_FULL_REUSE_QUALIFICATION.json",
+      "bytes": 1487,
+      "sha256": "b5c4f52638b34be0c95030486560d1ce8ed83f48e855a2fddfef528e6e635721"
    }
  ],
-  "next_formal_original_unit": "P04-01 pending existing real-owner D05 choices; no duplicate request or fabricated approval"
+  "next_formal_original_unit": "P04-01 pending existing real-owner D05 choices; no duplicate request or fabricated approval",
+  "backend_batch_state": "completed",
+  "normal_main_base": "191ea3b4d1289144d8d31096f50fbd71435656c9",
+  "normal_final": {
+    "passed": true,
+    "commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+    "artifact": "FORMAL_FINAL.json"
+  },
+  "whole_original_acceptance": false
 }
@@ -0,0 +1,35 @@
+{
+  "S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "C": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "M": "191ea3b4d1289144d8d31096f50fbd71435656c9",
+  "candidate_worktree": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-integration-15cc1271",
+  "whole_selected_source_files": 1368,
+  "all_source_settings_assets_test_inputs_helpers_byte_equal": true,
+  "marker_policy_engine_roster_parse_default_player_equal": true,
+  "full_evidence_reuse_qualified": true,
+  "original_full_attempt_passed": false,
+  "whole_original_acceptance": false,
+  "aggregate": {
+    "actual_suites": 184,
+    "missing_marker_paths": [],
+    "remaining_unexecuted_tests": [],
+    "available_marker_checks": 21903,
+    "actual_all_roster_checks": 21903,
+    "strict_accepted_checks": 21903,
+    "verified": true,
+    "composed": true,
+    "original_full_attempt_passed": false,
+    "whole_original_acceptance": false,
+    "parse_checks": 329,
+    "setup_phases": 2,
+    "owned_ended": 186,
+    "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "engines_started": 0,
+    "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+  },
+  "actual_independent_review": "ead8e74b9683404d8cf3d97bca118726",
+  "critical_high_medium": 0,
+  "low_findings": 4,
+  "ownership_authority": "Existing explicit human main-update and commit/push permission only; no new SHA-specific human speech is claimed",
+  "time_ns": 1792231367426496000
+}
@@ -0,0 +1,14 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "kind": "final",
+  "checks": [
+    {
+      "id": "p13-reference",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/2add11628b67481495b3782fa64dee52",
+      "passed": true
+    }
+  ],
+  "passed": true
+}
@@ -0,0 +1,14 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "kind": "integration",
+  "checks": [
+    {
+      "id": "p13-reference",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/19d3100d61564e3c9878624d2d8ea496",
+      "passed": true
+    }
+  ],
+  "passed": true
+}
@@ -0,0 +1,14 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "kind": "validation",
+  "checks": [
+    {
+      "id": "p13-reference",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/339d1c3cc94648aa94b00a750a5fa5ce",
+      "passed": true
+    }
+  ],
+  "passed": true
+}
@@ -0,0 +1,22 @@
+{
+  "source_review": "ead8e74b9683404d8cf3d97bca118726",
+  "scope": "Future normal production unlock and dimension-migration defensive handling; no mandatory CODE1 gate remains, parent P13-02 incomplete",
+  "findings": [
+    {
+      "severity": "low",
+      "message": "create_snapshot は対象喪失を正規化しません（detect_target_loss は収集時にだけ遅延実行されます）。そのため、シグナルを経ずに対象が消えた場合は LINKED の部屋が残ります。こうして書かれたセーブは restore_section の配置判定で全体が拒否され、読み込めなくなります。現状、そのような経路は確認できませんでした（facility_service.restore_snapshot はシグナルを出さず、ロールバックは既存の対象を消しません）。ただし、スナップショット生成時に正規化するか、後続で防御策を入れることを推奨します。"
+    },
+    {
+      "severity": "low",
+      "message": "Runtime の schema バージョンが 5 未満（v1〜4）の旧形式に special_peeping_rooms があっても拒否されず、検証を通れば受理されます。仕様の「本物の旧形式はセクションなし」に照らすと、偽装された旧ペイロードを受け入れる余地がわずかにあります。中身は restore_section で厳密に検証されるため、実害は小さいと判断します。"
+    },
+    {
+      "severity": "low",
+      "message": "施設の寸法移行（prepare_facility_dimension_snapshot）で public_bath / adult_private_room の占有セルが変わると、LINKED の部屋の再検証に失敗し、移行全体が拒否されます。現在の部屋はテスト用フィクスチャでしか作れないため影響は限定的です。後続の本番配置の実装時に扱いを決める必要があります。"
+    },
+    {
+      "severity": "low",
+      "message": "「建設中なら収集を拒否」の分岐は、本番状態では到達できません。テストは ConstructionService を差し替えて確認しており、意味上の網羅としては人工的です。配置判定も、建物定義（D04）が未定のため construction_service.validate_placement（支持・重量の判定）を使っていません。いずれも仕様の「未定値を発明しない」範囲内として許容しますが、記録に残します。"
+    }
+  ]
+}
@@ -0,0 +1,88 @@
+{
+  "contract": {
+    "id": "P13-02-CODE1",
+    "title": "P13-02 背面対象参照・占有・保存の非描写機構（全原成果の一部、加算なし）",
+    "requirement_ids": [
+      "P13-02"
+    ],
+    "acceptance_ids": [
+      "P13-02-CODE1"
+    ],
+    "spec_ref": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+    "base_commit": "1e8d4ea88876865a72547ff0edf43ed5b0e74c7e",
+    "worker": "codex",
+    "allowed_paths": [
+      "scripts/special/peeping_room_service.gd",
+      "autoload/simulation_runtime.gd",
+      "scripts/core/save_service.gd",
+      "tests/special/**",
+      "tools/run_p13_reference_tests.py",
+      "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json",
+      "docs/plans/original-completion-2026-10-02/execution/p13-02/**"
+    ],
+    "depends_on": [],
+    "resource_locks": [
+      "runtime-save-schema",
+      "special-target-reference",
+      "p13-reference-tests"
+    ],
+    "validation_ids": [
+      "p13-reference"
+    ],
+    "max_repair_attempts": null,
+    "spec_sha256": "8ea65f2eefedc772c08170186f5cd03ac017432f4b069ade4f9210d4215c2d43"
+  },
+  "implementation_commit": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "integration_commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "owner": "このチャットのユーザーによる既存の明示指示「mainの更新を明示的に許可します」「コミットすべき内容をコミットして。その上でpushして」に基づく継続許可。対象は全条件レビュー合格の登録CODE1と、この実C/M。新たなSHA指定の人間発言は主張しない。原P13-02の完了加算なし。",
+  "evidence": [
+    {
+      "id": 1,
+      "task_id": "P13-02-CODE1",
+      "kind": "validation",
+      "commit_sha": "e930a1dedff7ab4c4a94d274a2e0c55fc2b95829",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/212e4352722a442990b6fe923abe8f84-validation.json",
+      "passed": 0
+    },
+    {
+      "id": 2,
+      "task_id": "P13-02-CODE1",
+      "kind": "validation",
+      "commit_sha": "27fc5f05442ca3a2b0986a976b303cf0ef675f66",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/5526523400ff41b6aeacd0d6f8ffd9b9-validation.json",
+      "passed": 0
+    },
+    {
+      "id": 3,
+      "task_id": "P13-02-CODE1",
+      "kind": "validation",
+      "commit_sha": "a7e3069b167511b3194242b3403fbcc35244a526",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/6df11a390bc44b48a10c916cbeab95c9-validation.json",
+      "passed": 1
+    },
+    {
+      "id": 4,
+      "task_id": "P13-02-CODE1",
+      "kind": "review",
+      "commit_sha": "a7e3069b167511b3194242b3403fbcc35244a526",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/ead8e74b9683404d8cf3d97bca118726/result.json",
+      "passed": 1
+    },
+    {
+      "id": 5,
+      "task_id": "P13-02-CODE1",
+      "kind": "integration",
+      "commit_sha": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/562e2bb9ca8b4f458d0cc011edd41cc4-integration.json",
+      "passed": 1
+    },
+    {
+      "id": 6,
+      "task_id": "P13-02-CODE1",
+      "kind": "final",
+      "commit_sha": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/45fdaf3b82c84e1485ad0d4cc7bf993c-final.json",
+      "passed": 1
+    }
+  ]
+}
@@ -0,0 +1,28 @@
+{
+  "removed": [
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-final-b0291970",
+      "head": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "git_files": 4919,
+      "byte_equal_review_duplicate_files": 0
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-integration-15cc1271",
+      "head": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "git_files": 4919,
+      "byte_equal_review_duplicate_files": 0
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-review-e6fc1237",
+      "head": "a7e3069b167511b3194242b3403fbcc35244a526",
+      "git_files": 4894,
+      "byte_equal_review_duplicate_files": 16049
+    }
+  ],
+  "full_restore_proof": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/coordinator-start-20261017/CLOSED_P13_READONLY_FULL_RESTORE_PROOF.json",
+  "free_before": 3651289088,
+  "free_after": 4381392896,
+  "all_unique_evidence_preserved": true,
+  "time_ns": 1792232004526885000,
+  "actual_free_gain": 730103808
+}
@@ -60,10 +60,18 @@
      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/storage-profile-recovery-20261017/PREVIOUS_P23_PROFILE057_DRIVE_AND_RETIREMENT.json"
    }
  },
-  "current_free_bytes": 4107698176,
+  "current_free_bytes": 4153327616,
  "next_full_scope": "Import and329parse plus original58 suites qualified; remaining126 require unchanged native per-phase gates, exact input equality, all cross-segment checks, separate actual Opus review, normal integration/final. No restart of accepted native phases.",
  "admission_required_bytes": 3467374666,
  "P04_next_formal_unit": "P04-01 pending actual owner D05 choices, no fake approval",
  "whole_original_acceptance": false,
-  "later_archival_result": "Additional1.838GB logical old profile preserved remotely with full readback SHA. Immediate measured free gain153612288B; logical size is not claimed as physical space recovered."
+  "later_archival_result": "Additional1.838GB logical old profile preserved remotely with full readback SHA. Immediate measured free gain153612288B; logical size is not claimed as physical space recovered.",
+  "subsequent_verified_copy_retirements": {
+    "P13_ended3_copies_actual_gain_bytes": 730103808,
+    "P04_ended9_validation_copies_actual_gain_bytes": 1304444928,
+    "P04_preserved_remote_source": "codex/p04-01-preserved-2dde759",
+    "all_tracked_blobs_verified": true,
+    "all_unique_central_native_review_evidence_retained": true
+  },
+  "last_capacity_observation_jst": "2026-10-17T19:39:39.105864+09:00"
 }
@@ -0,0 +1,65 @@
+{
+  "at_unix_ns": 1792232721652518000,
+  "removed": [
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-3ca36075",
+      "head": "d393e4d90f068faa82fde40ca1ecd411ff7f2c1f",
+      "files": 3022,
+      "logical_bytes": 137851869
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-998f2af8",
+      "head": "55f1fb49aaefa5c1b86de1c3eda72392ef6b58f2",
+      "files": 3025,
+      "logical_bytes": 137889196
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-a2c2024a",
+      "head": "7af6fafaf00cffbb731f6a4765e5891457c51bda",
+      "files": 3024,
+      "logical_bytes": 137863410
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-b191eb70",
+      "head": "8418560aaf2f0f9ed3977ca477b5601ffebcbbda",
+      "files": 3021,
+      "logical_bytes": 137848317
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-b85d6800",
+      "head": "b543c26c95a1d634b8d7efdf127cc55eba55611a",
+      "files": 3013,
+      "logical_bytes": 137734675
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-e0a2d54f",
+      "head": "4ab7ab8712cc3b3d8bb0514ebb4b2c0927456443",
+      "files": 3025,
+      "logical_bytes": 137887158
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-e0f78b8f",
+      "head": "fb8b7919dbecba9a9de2a28dc2a25ce5cd73e9c6",
+      "files": 3027,
+      "logical_bytes": 137898418
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-e61af951",
+      "head": "2dde7596a87c43f7bf0bf704b7479f2fa06a5b1c",
+      "files": 3031,
+      "logical_bytes": 138115695
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-f79a151b",
+      "head": "16207d353ae4a2bb180793325cba9aec9ef68d66",
+      "files": 3015,
+      "logical_bytes": 137746167
+    }
+  ],
+  "free_before_bytes": 3734835200,
+  "free_after_bytes": 5039280128,
+  "observed_gain_bytes": 1304444928,
+  "all_source_blobs_verified": true,
+  "all_unique_runtime_evidence_preserved": true,
+  "restore_manifest": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/coordinator-storage-20261017/ENDED_VALIDATION_CHECKOUT_FULL_GIT_RESTORE_PROOF.json"
+}
@@ -0,0 +1,75 @@
+# P19-03 実装提出報告
+
+提出状態。受入は未確定。原受入「7名×3ルートの到達表があり、未制作内容は欠損として残る。」を維持する。14/88は変更しない。
+
+## 変更範囲
+
+修復開始点e0420d57a381a1644357f0590536e1d47c9bca9fから、このディレクトリの指定5ファイルのみを変更した。原本、原子要件、work packages、decisions、TASK_SPEC、選定記録、frozen pins、ゲーム入力、marker registryは変更していない。git書込み、他worker起動、Runner操作、ゲーム起動は行っていない。素材追加なし。
+
+## 要件と検査の対応
+
+|TASK_SPEC implementation_requirements順|成果物|検査|
+|---|---|---|
+|1: 原7名×3ルート|REACHABILITY_TABLE.json / .md|expectedのPEOPLE/ROUTES、原本118–124行、atomic entityと21セルの完全一致。test_exact_cell_product|
+|2: 8カテゴリ、共通/人物固有の分離|JSON common_rules / cells.categories|CATEGORIES全件のcanonical比較。test_categories_and_citations|
+|3: 原本本文・行・status・anchorのsource SHA・owner|JSONの各共通項目/人物固有項目、catalog_evidence|expected.evidence/cite、verify。test_stale_record_evidence / test_owner_and_status|
+|4: 欠損、理由、担当、未知値pending|各character_specific、pending、natural_route_complete=false|test_no_invented_values_or_completion。D05/D08は未回答のまま|
+|5: docs内stdlibチェッカー/自己試験|check_reachability_table.py / test_reachability_table.py|stdlib importsのみ。選択対象外のdocs内配置|
+|6: read-only --check、厳密な表/Markdown|verify / verify_records / markdown|test_json_and_types / test_markdown_drift。--checkは書込み分岐を通らない|
+|7: 全frozen source mapと各identity|binding / selection|1368選択ファイルの完全map、marker/policy/engine、184-suite roster、329 .gd、baseline、spec→pins SHA。test_full_frozen_map_and_identities / test_real_source_and_baseline_changes|
+|8: UI/Runtime/save/Windowsの適用性|JSON route_support、MDルート別適用性|各ルートをcanonical比較。汎用UIラベル、原本登録Runtime、専用snapshotの限定証拠をcommon_rulesで参照|
+|9: 有意な負例と3種の正例|test_reachability_table.py|欠落/重複/誤人物/誤route/カテゴリ/引用/古い本文・SHA/値創作/誤完成/owner・status/JSON型/Markdown、実ファイル読込差替え、map差分とpins/marker/policy/engine改変。全3statusを含む正例|
+|10: P13パターン・原文保全|checkerのexpected/verify/markdown、原資料のbase blob照合|tools/check_p13_content_difference.pyのcanonical生成・厳密比較・read-only Git blob証拠パターンを参照。元ファイルは無変更|
+|11: 報告・残課題・外部gate|本報告、JSON accounting|正式試験・全単位独立レビュー・統合/finalは未実行と明記|
+
+原子要件はB-7.1〜B-7.6をsource_group_idsに含む61件の完全レコードを読込対象とし、JSON authority_snapshotsに保持する。人物キーと原名はそのentityから確認し、原本§6の順で並べた。原本§6は114–135行、§7は136–161行であり、実際の見出しと本文を照合した。人物別の原本仕様がない部分を共通ルールから創作していない。中断/保存の人物固有手順は原本に定義されず、work_packagesのP19-02受入が所有する欠損として残した。
+
+指定されたoriginal_relationship_state.gdには7名のrosterはなく、汎用subject_id等の明示入力検証のみがある。既存unique catalogのヒロインはheroine_anriのみ。監査IDには既存atomic entity.key（anri/fine/tomari/amelia/liz/mimi/satsuki）を使い、他6名の実装catalog ID、ライバル対応、初期値を創作していない。この実装欠損は表の欠損であり、原7名を削減する理由にしていない。
+
+## Repair 1: 4指摘の対応
+
+編集前に build/owner-handoff/p19-review-r01/ の ACTUAL_OPUS_REPAIR_DIRECTION.json、ACTUAL_WHOLE_UNIT_REVIEW.json、SPEC_HASH_REPRESENTATIONS.json を読んだ。
+
+- MEDIUM: coassignment_attack / zero_break / love_actions / threshold_route_loss と旧UIのlegacy_evidenceを追加。固定anchorの実際の本文・行・Git blob OID・file-bytes SHA-256を保持する。原本準拠statusはmissing、旧実装分類はlegacy_not_originalに統一。P18-01は一対一変換を禁止し、旧数値・日次制限は原本として未承認と明記した。UI定数は実際には98–101行であり、89–97行の無関係なラベルを除いた。共通ルール参照により各該当セルへ結び付けた。所有者・原本欠損・natural_route_complete=falseを維持。
+- LOW 独立試験: validate_legacyは候補とcanonicalの比較とは独立に、git showで固定anchorのソースを読み、引用行本文とgit rev-parseによるblob OID、現ファイルとの一致を検査する。test_independent_legacy_source_evidenceは実際のJSONと実ファイルを開き、git hash-object --stdin（書込みなし）でOIDを独立計算し、関数名とshield_broken/EXCLUSIVE_LOCKEDも確認。test_legacy_evidence_required_independentlyは対象全項目の証拠削除・空配列・無条件not implemented・古いOID/本文を拒否する。
+- LOW 中断参照: 全21セルのinterruption_cancellationに原本148・153行の本文とbaseline hash、および343–355行のconfirm_route_lockをlegacy_not_originalとして追加。人物固有欠損と担当は維持。
+- LOW ハッシュ表示: 263a01b943d8056727335fb76977c010298e1c229077f8da76e48683ba2e89bb は TASK_SPEC.json file-bytes SHA-256。3af3d9b931edc5449796662ad69bb6f67c80b48827a86565b1952931db68dd15 は Runner git-show stripped-UTF-8 contract spec_sha256。上記SPEC_HASH_REPRESENTATIONS.jsonのunchanged_file=trueが証拠であり、両者は同じ無変更ファイルを表す。checker定数と出力にも区別を反映。Git blob OIDは別のgit_blob_oidフィールドでありfile-bytes SHA-256とは区別する。
+
+## 実行記録（今回のローカル確認）
+
+以下は正式Runner実行ではない。記録済み修復指示に基づき3登録コマンドをローカル実行した。
+
+生成 — exit 0
+
+```sh
+python3 -B /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement --write
+```
+
+p19-table — exit 0
+
+```sh
+python3 -B /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement --check
+```
+
+p19-negative — exit 0
+
+```sh
+python3 -B /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement/docs/plans/original-completion-2026-10-02/execution/p19-03/test_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement
+```
+
+p19-source-binding — exit 0
+
+```sh
+python3 -B /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement --source-binding-only
+```
+
+--writeの実際の呼出しは同一checkout内で相対スクリプトパスと --project-root . を使用（上記は絶対パス表記）。--checkはMarkdownのバイト完全一致を確認。自己試験は12件OK。source bindingは1368ファイル一致、file_equality=true、actual_commit=e0420d57a381a1644357f0590536e1d47c9bca9f、native_evidence_reuse_accepted=false。git diff --checkはexit 0。構文は上記Python実行で確認。最初の編集用here-documentは一時ファイル作成制限でexit 1、変更は行われず、python3 -cで再実行してexit 0。native full・ゲーム起動・git書込み・Runner操作・他エージェント起動は行っていない。
+
+## 残る親成果・ゲームの欠損
+
+- P18-01: 原本3軸/盾の通常UI、承認済み初期値、本来の全単位受入。P18-02/03: 同配置・軽減・ブレイク・接触・閾値・確定遷移。既存旧汎用モデルの閾値を原本へ転用しない。
+- P19-01/02: 原本行動と全3種決闘、勝敗・費用・盾/履歴の一度だけ反映、通常入口、停止/取消/離脱/保存再開。原本状態保持のbackendを自然ルート完成としない。
+- P20-01/02/03: スキル/章・全エンド・図鑑と新規からの通常到達。P26-01/02/03: 人物別必要内容、状態接続、完成資産と制作受入。人物固有イベント/条件/履歴/立ち絵差分は欠損。
+- D05、D08はpending。未知の閾値・率・初期値もpendingのまま。P04の既存D05選択、P13の4件の制作followupも未解決。
+- この文書単位のnative GUI/Windows実行は適用外。global same-Windows、held gestures、全ゲーム受入はopen。固定入力一致から既存native証拠の正式再利用承認を推定していない。
+- Runnerの3 validator、原本§6–7と元受入に対する実装者から独立したwhole-unit Opus review、その後の通常prepare-integration/finalが必要。どの完了数・元台帳も変更していない。
@@ -0,0 +1,64 @@
+{
+  "at_jst": "2026-10-17T19:58:24.516684+09:00",
+  "plan_id": "P19-03",
+  "registered_task": "P19-03-TABLE",
+  "project": "the-tree-p19-03-reachability",
+  "S": "806de25068bc423136063791afcea811d251ee1b",
+  "implementation_model": "gpt-6.1-sol",
+  "actual_model_decision": "c767de1cd89d40e5a23964f2e62ce4c6",
+  "state": "whole_original_review_passed_integration_final_pending",
+  "original_acceptance": "7名×3ルートの到達表があり、未制作内容は欠損として残る。",
+  "original_units": 88,
+  "formally_completed": 14,
+  "new_credit": 0,
+  "registered_validation": {
+    "passed": true,
+    "artifact": "ROOT_FORMAL_VALIDATION_806DE25.json",
+    "checks": [
+      "p19-table",
+      "p19-negative",
+      "p19-source-binding"
+    ],
+    "self_tests": 12
+  },
+  "actual_reviewer": {
+    "id": "38eaaacdb31b4c76bcf982987816a391",
+    "status": "finished_pass"
+  },
+  "reviewer_model": "claude-opus-5-5",
+  "full_game_input_equality": {
+    "files": 1368,
+    "markers_policy_engine_roster_parse_default_player_same": true,
+    "full184_21903_329parse_186ended_reuse_qualified": true,
+    "new_native_runs": 0,
+    "artifact": "ROOT_EXACT_GAME_INPUT_REUSE_806DE25.json"
+  },
+  "required_before_acceptance": [
+    "Normal actual integrationC/M and independent candidate source/input equality",
+    "Normal final and existing exact real-owner main authorization, thenledger/push; no new humanSHA speech fabricated"
+  ],
+  "source_gaps_preserved": [
+    "Six missing productioncatalog IDs are not fabricated; table audit uses existing original atomic entity keys",
+    "D05/D08 and unknown values/content remain missing or pending; backend/generic labels are not natural route completion",
+    "Global Windows/game/content conditions stay open; this audit adds no product OS behavior"
+  ],
+  "execution_issues_preserved": [
+    "Initial registered {worktree} invocation failed before scripts opened; exact-root adapter madeactual3sameSchecks run, repairs0/source/config/policy unchanged",
+    "Initial full inline review rejected beforeinference at actual1milliontoken providerlimit; completefile/diff sourceviews retainalloriginalbytes, no file/bytecaps, sameOpus5.5/sourceS"
+  ],
+  "normal_integration_candidate": null,
+  "repairs": 1,
+  "repair_cap": null,
+  "whole_original_review": {
+    "run_id": "38eaaacdb31b4c76bcf982987816a391",
+    "status": "pass",
+    "critical_high_medium": 0,
+    "low": 3,
+    "artifact": "ROOT_WHOLE_REVIEW_806DE25.json"
+  },
+  "actual_repair_worker": {
+    "id": "bf8a86e053044bfea0051253fefb2ec7",
+    "status": "finished"
+  },
+  "repair_scope": "Same5Docfiles: legacy presence vsoriginalconformance for4clauses, independent source-presence/evidence-loss tests, route-ending interruption crossrefs, precise hash labels. No game/values/pins/roster changes."
+}
@@ -0,0 +1,18 @@
+{
+  "actual_review": "38eaaacdb31b4c76bcf982987816a391",
+  "findings": [
+    {
+      "severity": "low",
+      "message": "Most data-level negative tests still compare the document against the same expected() canonical. The independent semantic checks name only three markers: restore_shield, shield_broken and EXCLUSIVE_LOCKED. Citations such as the preview service's contact/shield-candidate lines, and the 6850, 1039 and 1047 call sites, are checked only for text and blob equality, not for a function-name marker. Consider asserting a marker for every legacy entry."
+    },
+    {
+      "severity": "low",
+      "message": "The run log in IMPLEMENTATION_REPORT.md reports source binding actual_commit=e0420d5. That comes from the pre-commit local run. The Runner output correctly binds 806de25, but the report should mark that line as the pre-submission local value."
+    },
+    {
+      "severity": "low",
+      "message": "The snapshot_container evidence range (relationship_service.gd 423–479) starts mid-function and cuts off inside restore_snapshot. It is accurate as evidence, but a range aligned to function boundaries would be clearer for downstream owners (P18-01, P19-02)."
+    }
+  ],
+  "disposition": "Low severity optional hardening/clarity notes, not original audit blockers. Formal Runner output pins806de25; worker report e0420d5 is a pre-submission local-run HEAD, not the final accepted version."
+}
@@ -0,0 +1,31 @@
+{
+  "artifact_S": "806de25068bc423136063791afcea811d251ee1b",
+  "existing_product_C": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "old_actual_native_S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "all1368_selected_source_settings_assets_tests_tools_byte_equal": true,
+  "marker_policy_engine_roster_parse_default_player_equal": true,
+  "scope": "All source_refs keys exactly equal; no file set was narrowed or omitted. New doc-only audit helpers are outside this unchanged pre-existing selection algorithm.",
+  "native_full_evidence_reuse_qualified": true,
+  "new_native_runs": 0,
+  "existing_full": {
+    "actual_suites": 184,
+    "missing_marker_paths": [],
+    "remaining_unexecuted_tests": [],
+    "available_marker_checks": 21903,
+    "actual_all_roster_checks": 21903,
+    "strict_accepted_checks": 21903,
+    "verified": true,
+    "composed": true,
+    "original_full_attempt_passed": false,
+    "whole_original_acceptance": false,
+    "parse_checks": 329,
+    "setup_phases": 2,
+    "owned_ended": 186,
+    "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "engines_started": 0,
+    "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+  },
+  "previous_actual_whole_backend_Opus_review": "ead8e74b9683404d8cf3d97bca118726",
+  "P19_whole_original_acceptance": "pending actual independent semantic review of full original §6–7, all21cells and all source/status/owner/gap claims, then normalintegration/final",
+  "time_ns": 1792234414270856000
+}
@@ -0,0 +1,31 @@
+{
+  "artifact_S": "e0420d57a381a1644357f0590536e1d47c9bca9f",
+  "existing_product_C": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "old_actual_native_S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "all1368_selected_source_settings_assets_tests_tools_byte_equal": true,
+  "marker_policy_engine_roster_parse_default_player_equal": true,
+  "scope": "All source_refs keys exactly equal; no file set was narrowed or omitted. New doc-only audit helpers are outside this unchanged pre-existing selection algorithm.",
+  "native_full_evidence_reuse_qualified": true,
+  "new_native_runs": 0,
+  "existing_full": {
+    "actual_suites": 184,
+    "missing_marker_paths": [],
+    "remaining_unexecuted_tests": [],
+    "available_marker_checks": 21903,
+    "actual_all_roster_checks": 21903,
+    "strict_accepted_checks": 21903,
+    "verified": true,
+    "composed": true,
+    "original_full_attempt_passed": false,
+    "whole_original_acceptance": false,
+    "parse_checks": 329,
+    "setup_phases": 2,
+    "owned_ended": 186,
+    "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "engines_started": 0,
+    "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+  },
+  "previous_actual_whole_backend_Opus_review": "ead8e74b9683404d8cf3d97bca118726",
+  "P19_whole_original_acceptance": "pending actual independent semantic review of full original §6–7, all21cells and all source/status/owner/gap claims, then normalintegration/final",
+  "time_ns": 1792233062748520000
+}
@@ -0,0 +1,26 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "806de25068bc423136063791afcea811d251ee1b",
+  "kind": "validation",
+  "checks": [
+    {
+      "id": "p19-table",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/8d14038fd19c4277a2ab9d430bf2dbd0",
+      "passed": true
+    },
+    {
+      "id": "p19-negative",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/ad32d058245d45c6a0554ca92e0f46dd",
+      "passed": true
+    },
+    {
+      "id": "p19-source-binding",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/fec4a9beda95427d89b4050e07a771e9",
+      "passed": true
+    }
+  ],
+  "passed": true
+}
@@ -0,0 +1,26 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "e0420d57a381a1644357f0590536e1d47c9bca9f",
+  "kind": "validation",
+  "checks": [
+    {
+      "id": "p19-table",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/1c501211989843c190f0ee1eb6d4674b",
+      "passed": true
+    },
+    {
+      "id": "p19-negative",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/bc25ca3804ad4aa796ba7a2cf6d9a197",
+      "passed": true
+    },
+    {
+      "id": "p19-source-binding",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/3e07aaa43f84446aa0f375264e8d2d51",
+      "passed": true
+    }
+  ],
+  "passed": true
+}
@@ -0,0 +1,23 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "806de25068bc423136063791afcea811d251ee1b",
+  "status": "pass",
+  "summary": "I re-reviewed the whole P19-03 unit at 806de25, read-only. I checked it against BASELINE §6 (lines 114–135) and §7 (lines 136–161), the work_packages P19-03 record, the 61 B-7.x atomic records snapshotted in the JSON, the immutable TASK_SPEC, and the frozen game source. I did not edit or run anything.\n\n**Original acceptance (「7名×3ルートの到達表があり、未制作内容は欠損として残る。」)**\n- The acceptance text is identical to work_packages.json:16100.\n- The table has 21 cells: the seven original names × 純愛/NTR/堕落.\n  - The names アンリ/フィーネ/トマリ/アメリア/リズ/ミミ/サツキ match BASELINE lines 118–124.\n  - The IDs are the existing atomic keys AR.heroine.<key>.route.{love,ntr,corruption}.\n  - No character or route was invented or substituted.\n- The catalog has only heroine_anri, and original_relationship_state.gd has no roster. So using the atomic keys, and leaving the six missing catalog IDs as explicit gaps, is honest and invents no IDs.\n- Each cell has all 8 categories. Common rules are kept separate from character-specific content.\n- Every character-specific item is recorded as 欠損 / 原本未定義 / D08 pending. Each carries a reason, an owner from the real work_packages deliverables (P18-02, P19-01, P19-02, P20-02, P26-01, P26-02), the citations [138–161] plus the character's own line, and natural_route_complete=false.\n- D05, D08, thresholds, rates and initial values all stay pending, with no invented numbers. The original's undefined per-character content therefore stays as gaps, which is what this audit acceptance allows. It is not game acceptance.\n\n**Previous findings from the e0420d5 review**\n1. MEDIUM, missing legacy evidence: fixed.\n   - coassignment_attack, zero_break, love_actions, threshold_route_loss and legacy_event_ui now carry legacy_evidence: path, anchor 1b07b87, git blob OID, file SHA-256, line range and quoted text.\n   - I checked every range against the real source:\n     - relationship_service.gd: restore_shield 246–261, apply_shield_attack 264–312 (includes shield_broken), request_route_lock 315–340, confirm_route_lock 343–355.\n     - simulation_runtime.gd: command registration 342–343 and the apply_shield_attack call at 6850.\n     - event_service.gd: lines 1039 and 1047.\n     - placement_risk_preview_service.gd: _contact_summary 536–565 and _shield_attack_candidates 619–640.\n     - main.gd: 98–101 is EVENT_CHOICE_NAMES. The correction from 89–101 is right, because 89–97 are unrelated excavation labels.\n   - These clauses all use the same rule: original status missing, classified legacy_not_original, with the P18-01 reason. The main.gd label constant is no longer credited as partial.\n2. LOW, independent tests: addressed.\n   - validate_legacy reads the anchored blobs via git show / rev-parse and is enforced by --check.\n   - The self-tests compute the blob OID independently with git hash-object, assert function and text markers, and reject evidence that is dropped, emptied, marked \"not implemented\", or has a stale OID or text, for every legacy clause.\n3. LOW, interruption cross-references: addressed. All 21 cells' interruption_cancellation entries now cite lines 148 and 153 (exact text plus baseline hash) and the legacy confirm_route_lock as legacy_not_original.\n4. LOW, hash labels: addressed in the checker constants, the checker output and the report.\n\n**Scope:** the diff touches only the 5 allowed files under execution/p19-03/. TASK_SPEC, the frozen pins, the selection record, the original registers and the game files are unchanged.\n\n**Validation:** all 3 registered checks ran on 806de25 and exited 0.\n- p19-table: --check output binds actual_commit 806de25, 1368 selected files, file_equality true.\n- p19-negative: 12 tests OK.\n- p19-source-binding: passed.\n\nThe earlier failed invocations were unexpanded `{worktree}` placeholders that never opened a script; no failure was turned into a pass.\n\nOnly low-severity notes remain, and they do not block the audit acceptance. Integration/final and the other gates are still required before the count moves from 14 to 15; I give no credit before those.",
+  "acceptance_ids": [
+    "P19-03"
+  ],
+  "findings": [
+    {
+      "severity": "low",
+      "message": "Most data-level negative tests still compare the document against the same expected() canonical. The independent semantic checks name only three markers: restore_shield, shield_broken and EXCLUSIVE_LOCKED. Citations such as the preview service's contact/shield-candidate lines, and the 6850, 1039 and 1047 call sites, are checked only for text and blob equality, not for a function-name marker. Consider asserting a marker for every legacy entry."
+    },
+    {
+      "severity": "low",
+      "message": "The run log in IMPLEMENTATION_REPORT.md reports source binding actual_commit=e0420d5. That comes from the pre-commit local run. The Runner output correctly binds 806de25, but the report should mark that line as the pre-submission local value."
+    },
+    {
+      "severity": "low",
+      "message": "The snapshot_container evidence range (relationship_service.gd 423–479) starts mid-function and cuts off inside restore_snapshot. It is accurate as evidence, but a range aligned to function boundaries would be clearer for downstream owners (P18-01, P19-02)."
+    }
+  ]
+}
@@ -0,0 +1,27 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "e0420d57a381a1644357f0590536e1d47c9bca9f",
+  "status": "changes_requested",
+  "summary": "Independent read-only whole-unit review of P19-03 at e0420d5 against BASELINE §6 (lines 114–135) and §7 (136–161), the B-7.x atomic records, work_packages and the immutable TASK_SPEC.\n\nWhat passes:\n- Scope: the diff adds only the 5 required files under execution/p19-03/**. TASK_SPEC, pins, selection record, original registers and game files are unchanged.\n- Roster and routes: exactly 7 original names (アンリ, フィーネ, トマリ, アメリア, リズ, ミミ, サツキ, matching BASELINE lines 118–124 and atomic entity keys AR.heroine.<key>.route.{love,ntr,corruption}) × 純愛/NTR/堕落 gives 21 cells. I confirmed the catalog has only heroine_anri/rival_rai and that original_relationship_state.gd has no roster, so using atomic keys and keeping the other six as gaps is honest and invents no IDs.\n- Gaps: every cell keeps 8 categories, separates common rules from character-specific content, marks character-specific content 欠損/D08 pending with a plausible owner (P18-02/P19-01/P19-02/P20-02/P26-01/P26-02), and sets natural_route_complete=false. Thresholds, rates, initial values and D05/D08 stay pending. Original citations quote exact line text with the baseline hash. Implemented/partial evidence carries path+SHA, bound to anchor 1b07b87 by blob equality.\n- Validation: the 3 registered checks ran on the same commit and exit 0 (10 self-tests OK; source binding 1368 files, file_equality true). The 3 initial exit-2 runs were literal `{worktree}` placeholders that never opened a script; no failure was converted to PASS.\n- Under the original acceptance wording the table structurally exists and missing content stays as gaps.\n\nWhat fails:\n- The 'audit existing support' requirement is not met, and several statuses are inaccurate. The audit marks coassignment_attack, zero_break, love_actions (shield recovery) and threshold_route_loss as \"not implemented\" with no source path. But the frozen game source has live legacy mechanisms for exactly these clauses:\n  - relationship_service.gd: apply_shield_attack (reports shield_broken), restore_shield, request_route_lock/confirm_route_lock (irreversible route lock).\n  - simulation_runtime.gd registers request_route_lock/confirm_route_lock as commands; line 6850 calls apply_shield_attack.\n  - event_service.gd lines 1039/1047 apply these as event effects.\n  - placement_risk_preview_service.gd computes heroine/rival contact intervals and _shield_attack_candidates.\n- Meanwhile a legacy UI label constant in main.gd is credited as 'partial'. Treating legacy support inconsistently undermines the audit's accuracy for downstream owners.\n\nThe legacy mechanisms need not count as original support (P18-01 forbids one-to-one conversion), but they must be listed with path+SHA and a stated reason for not crediting them. The 'not implemented' entries for the affected clauses are wrong as written.",
+  "acceptance_ids": [
+    "P19-03"
+  ],
+  "findings": [
+    {
+      "severity": "medium",
+      "message": "Existing-support audit is incomplete and inconsistent. coassignment_attack, zero_break, love_actions (shield recovery) and threshold_route_loss are recorded as implementation \"not implemented\", but frozen source at anchor 1b07b87 has live legacy mechanisms for them: scripts/relationship/relationship_service.gd apply_shield_attack (264–312, reports shield_broken), restore_shield (246–261), request_route_lock/confirm_route_lock (315–355); autoload/simulation_runtime.gd registers request_route_lock/confirm_route_lock as commands (342–343) and calls apply_shield_attack (6850); scripts/events/event_service.gd applies them as event effects (1039, 1047); scripts/relationship/placement_risk_preview_service.gd computes heroine/rival contact and _shield_attack_candidates (536, 619). Meanwhile a legacy main.gd label constant (89–101) is credited as 'partial'. Fix: record these legacy mechanisms per clause with exact path+SHA+lines at the anchor. Classify each as partial/legacy-not-original (or keep missing for the original model) with an explicit reason, e.g. P18-01 forbids one-to-one conversion and the numbers/daily limits are not approved originals. Keep owners and gaps unchanged. Regenerate the MD and add a self-test that rejects dropping this evidence."
+    },
+    {
+      "severity": "low",
+      "message": "Most data-level negative tests (wrong character/route, owner, status, stale text) mutate the document and compare it to a canonical built by the same expected() function. They only prove equality with hard-coded facts, not that those facts are correct. Source/baseline/blob/pin corruption tests are real. Consider adding independent assertions, e.g. that every 'missing' item's semantic claim is cross-checked against grep-able absence or presence in the cited source files, so mislabeled statuses like the one above are caught."
+    },
+    {
+      "severity": "low",
+      "message": "interruption_cancellation maps only §6.5 departure (line 135). The route-terminating clauses — duel loss 'ヒロインを即座に強奪' (153) and '純愛ルート完全消失' (148) — and legacy route_lock irreversibility are not cross-referenced as interruption/cancellation authorities. The character-specific gap covers it, but the common enumeration of interruption handling required by the original work is thin."
+    },
+    {
+      "severity": "low",
+      "message": "The checker's SPEC_HASH (263a01b9…) is the TASK_SPEC.json file-byte hash. It differs from the contract spec_sha256 (3af3d9b9…), presumably because the contract hashes a different serialization. The runner pass confirms the file is unchanged from base, but the report should say which representation each hash covers."
+    }
+  ]
+}
@@ -0,0 +1,108 @@
+{
+  "id": "P19-03-TABLE",
+  "original_plan_id": "P19-03",
+  "title": "分岐の到達性",
+  "original_work": "人物ごとの3ルートに必要なイベント・条件・中断処理を列挙する。",
+  "original_acceptance": "7名×3ルートの到達表があり、未制作内容は欠損として残る。",
+  "original_denominator": {
+    "packages": 30,
+    "units": 88,
+    "completed_at_start": 14,
+    "partial_credit": false
+  },
+  "whole_original_unit_review_required": true,
+  "scope": "Whole original documentation/audit unit P19-03. Neutral non-graphic state/event IDs and exact source citations only; never create intimate content, narrative events, per-character mechanics or product numbers. Does not implement or accept route gameplay, content, endings, Windows or the whole game.",
+  "authority": [
+    {
+      "path": "docs/traceability/original/BASELINE.txt",
+      "sha256": "75e4bdbdeb379c9269553f0c776bdb9cc96e01f2d6aa5ca650d132c63a8aeb1a",
+      "sections": "Original §6 seven-character catalog; §7 lines136–161 three routes and relation/duel/action/history rules. Read actual full relevant lines, do not trust line numbers without matching text."
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/work_packages.json",
+      "unit": "P19-03",
+      "acceptance_exact": true
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/atomic_requirements.json",
+      "requirements": "B-7.1 through B-7.6 and relevant character/route clauses; inspect complete selected entries."
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/decisions.json",
+      "rule": "Only approved decisions may fill specifications. D08 pending cells remain 原本未定義/D08 pending 欠損."
+    }
+  ],
+  "actual_opus_selection": "dc342e4d69154660bef7e688a70fd783",
+  "frozen_game_input_pins_sha256": "6c778226a4cc6d0b0d682500759e7d4229c926a27bd2e247b00b9c3e5f1a2fb0",
+  "audit_source_anchor": "1b07b87d3736e777932315a4bdde8b70cbf9cb23",
+  "implementation_requirements": [
+    "Build REACHABILITY_TABLE.json plus deterministic REACHABILITY_TABLE.md with exactly7 canonical character IDs/names from original §6, existing catalog and scripts/relationship/original_relationship_state.gd, crossed with3 original routes 純愛/NTR/堕落. No invented or substituted character/route.",
+    "Every one of21 cells enumerates applicable entry/required events, source-defined state conditions, duel win/loss and route/selection effects, interruption/cancellation and save handling, history/marks and current reachability. Distinguish common baseline rules from character-specific content undefined by the original.",
+    "Every listed event/condition/handling item carries exact original line range+text/hash authority, concrete implementation status implemented/partial/missing, exact existing source path+SHA at the audited source anchor (or explicit not implemented with no fake path), and owning remaining original deliverable. Do not call backend model support a completed natural route.",
+    "Unproduced or undefined character-specific events/conditions/interruption/save/history content remains explicitly 欠損 with reason and owning remaining original item. Missing content is allowed by the unchanged original audit acceptance; it is never game acceptance. Preserve unknown numeric thresholds/rates/initial values as pending; use neutral abstract state IDs only.",
+    "Implement stdlib check_reachability_table.py and test_reachability_table.py under this documentation directory. This placement is inside actual Opus proposed docs/** scope and preserves the exact1368 selected native-game input set. Do not add new files under tools, game scripts, data, tests, marker registry or other game-selected paths.",
+    "Checker verifies exact7×3 unique complete cell set, canonical IDs, original pinned source+line text, no uncited item, exact current source SHA+anchor binding, valid status/owner and explicit gaps, no fabricated thresholds/unsupported completion, and byte-for-byte deterministic Markdown regeneration. --check must be read-only; optional --write may regenerate view during implementation.",
+    "Source binding enforces complete frozen selected-source map, no missing/new/changed selected files, marker/policy/engine/roster/parse identity and baseline hash. Validate FROZEN_GAME_INPUT_PINS.json against this immutable spec SHA field. Code source evidence may cite published audited anchor; checker output binds actual current commit and proves exact file equality. Do not fabricate a future self-containing commit SHA.",
+    "Cross-cutting UI/Runtime/save/Windows applicability is explicit: audit existing support and missing mechanisms per route; this documentation-only unit introduces no product OS behavior, so audit-unit native GUI/Windows execution is not applicable. Global/other-unit Windows and game acceptance remain open.",
+    "Self-tests meaningfully reject missing/duplicate cell, wrong character/route, missing category/citation, stale source/baseline text/hash, invented numeric threshold, missing content falsely marked complete, wrong owning deliverable/status, malformed JSON/types, or Markdown drift; include valid implemented/partial/missing controls. No test-count padding.",
+    "Reuse existing completed P13-03 content-audit checker pattern as guidance. Preserve all current game files, original text, decisions, frozen pins, immutable TASK_SPEC and selection record. Do not revise acceptance or invent D05/D08 answers.",
+    "Provide concise implementation report with all requirements mapped to files/checks, actual invocations/results and remaining parent/game gaps. No worker claim or exit0 substitutes for independent whole-unit review and normal gates."
+  ],
+  "required_outputs": [
+    "REACHABILITY_TABLE.json",
+    "REACHABILITY_TABLE.md",
+    "check_reachability_table.py",
+    "test_reachability_table.py",
+    "IMPLEMENTATION_REPORT.md"
+  ],
+  "validation_interface": [
+    {
+      "id": "p19-table",
+      "argv": [
+        "{python}",
+        "{worktree}/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py",
+        "--project-root",
+        "{worktree}",
+        "--check"
+      ]
+    },
+    {
+      "id": "p19-negative",
+      "argv": [
+        "{python}",
+        "{worktree}/docs/plans/original-completion-2026-10-02/execution/p19-03/test_reachability_table.py",
+        "--project-root",
+        "{worktree}"
+      ]
+    },
+    {
+      "id": "p19-source-binding",
+      "argv": [
+        "{python}",
+        "{worktree}/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py",
+        "--project-root",
+        "{worktree}",
+        "--source-binding-only"
+      ]
+    }
+  ],
+  "workflow": [
+    "Register fixed original acceptance P19-03 once; actual Opus confirms next registered run and chooses Sol6.1 default/Astra only justified. One managed worker, no duplicate task.",
+    "Worker local static+checker+self-tests only; do not run native full during implementation.",
+    "Required full native evidence may be reused only after independent exact candidate input equality against frozen C/S source/settings/markers/policy/engine/test inputs/roster/applicability. Doc helpers live outside selected source set; no narrowed equality definition. If equality fails do not claim reuse or launch an uncontrolled full.",
+    "Separate actual Opus whole-original P19-03 review against full original §6–7 and exact acceptance. Reviewer decides whether explicit D08/content gaps satisfy audit acceptance; fail honestly if not, never redefine it.",
+    "Normal prepare-integration, actual C/M exact equality, existing real main permission only (no fabricated new human speech), normal final, ledger+push. Only then original P19-03 may add1 to14/88."
+  ],
+  "pending_not_waived": [
+    "P04 existing D05 owner choices",
+    "D08 production chapter/route/content scope",
+    "P19-01/02 Runtime and normal route gameplay",
+    "P20/P26 content/endings/encyclopedia",
+    "P13 four low production followups",
+    "Global same-Windows acceptance and held gestures remain open"
+  ],
+  "model_proposal": {
+    "codex_model": "gpt-6.1-sol",
+    "actual_opus_decision": "dc342e4d69154660bef7e688a70fd783"
+  }
+}
@@ -0,0 +1,325 @@
+#!/usr/bin/env python3
+"""Read-only, stdlib P19-03 documentation validator; never accepts gameplay."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import sys
+
+OUT = 'docs/plans/original-completion-2026-10-02/execution/p19-03/'
+PLAN = 'docs/plans/original-completion-2026-10-02/'
+BASELINE = 'docs/traceability/original/BASELINE.txt'
+ANCHOR = '1b07b87d3736e777932315a4bdde8b70cbf9cb23'
+BASE = '8ca9263fee1ec4374d97c01fda82b95e1df6a977'
+BASE_HASH = '75e4bdbdeb379c9269553f0c776bdb9cc96e01f2d6aa5ca650d132c63a8aeb1a'
+SPEC_FILE_BYTES_SHA256 = '263a01b943d8056727335fb76977c010298e1c229077f8da76e48683ba2e89bb'
+# Proof: build/owner-handoff/p19-review-r01/SPEC_HASH_REPRESENTATIONS.json
+# Both hashes describe the same unchanged TASK_SPEC.json.
+RUNNER_CONTRACT_SPEC_SHA256 = '3af3d9b931edc5449796662ad69bb6f67c80b48827a86565b1952931db68dd15'
+PINS_HASH = '6c778226a4cc6d0b0d682500759e7d4229c926a27bd2e247b00b9c3e5f1a2fb0'
+ROUTES = {'love': '純愛', 'ntr': 'NTR', 'corruption': '堕落'}
+PEOPLE = [('anri', 'アンリ'), ('fine', 'フィーネ'), ('tomari', 'トマリ'),
+          ('amelia', 'アメリア'), ('liz', 'リズ'), ('mimi', 'ミミ'), ('satsuki', 'サツキ')]
+CATEGORIES = ('entry_required_events', 'state_conditions', 'duel_effects',
+              'route_selection_effects', 'interruption_cancellation', 'save_handling',
+              'history_marks', 'current_reachability')
+STATE = 'scripts/relationship/original_relationship_state.gd'
+SERVICE = 'scripts/relationship/relationship_service.gd'
+RUNTIME = 'autoload/simulation_runtime.gd'
+CATALOG = 'data/characters/mvp_unique_characters.json'
+
+EVENT = 'scripts/events/event_service.gd'
+PREVIEW = 'scripts/relationship/placement_risk_preview_service.gd'
+LEGACY_REASON = 'P18-01 forbids one-to-one conversion; legacy numbers/daily limits are not approved originals.'
+LEGACY_RANGES = {
+ 'coassignment_attack': [(SERVICE,264,312),(RUNTIME,6850,6850),(EVENT,1039,1039),(PREVIEW,536,565),(PREVIEW,619,640)],
+ 'zero_break': [(SERVICE,264,312),(RUNTIME,6850,6850),(EVENT,1039,1039)],
+ 'love_actions': [(SERVICE,246,261)],
+ 'threshold_route_loss': [(SERVICE,315,340),(SERVICE,343,355),(RUNTIME,342,343),(EVENT,1047,1047)],
+ 'legacy_event_ui': [('scenes/main/main.gd',98,101)],
+}
+
+
+def validate_legacy(root, document):
+    rules = {r['id']: r for r in document['common_rules']}
+    for identity, ranges in LEGACY_RANGES.items():
+        rule = rules[identity]
+        require(rule['status'] == 'missing' and rule['legacy_classification'] == 'legacy_not_original',
+                'legacy/original classification')
+        require(rule['implementation'] == 'original conformance missing; see legacy_evidence'
+                and rule['legacy_reason'] == LEGACY_REASON, 'unqualified legacy absence')
+        entries = rule.get('legacy_evidence')
+        require(type(entries) is list and len(entries) == len(ranges), 'missing legacy evidence')
+        for entry, (path, start, end) in zip(entries, ranges):
+            data = blob(root, ANCHOR, path)
+            oid = subprocess.check_output(['git','rev-parse',ANCHOR+':'+path],cwd=root).decode().strip()
+            require(entry == {'path':path,'anchor':ANCHOR,'git_blob_oid':oid,
+                'sha256':sha(data),'lines':[start,end],
+                'text':'\n'.join(data.decode().splitlines()[start-1:end])}, 'legacy text/blob/range')
+            require(data == (root/path).read_bytes(), 'legacy current source mismatch')
+
+
+def sha(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def require(value, message):
+    if not value:
+        raise ValueError(message)
+
+
+def decode(data):
+    def unique(pairs):
+        result = {}
+        for k, v in pairs:
+            require(k not in result, 'duplicate JSON key: ' + k)
+            result[k] = v
+        return result
+    return json.loads(data, object_pairs_hook=unique,
+                      parse_constant=lambda s: (_ for _ in ()).throw(ValueError(s)))
+
+
+def blob(root, commit, path):
+    return subprocess.check_output(['git', 'show', commit + ':' + path], cwd=root)
+
+
+def selection(root):
+    paths = [p for folder in ('autoload', 'scripts', 'scenes', 'data', 'tests', 'assets', 'tools')
+             for p in (root / folder).rglob('*')
+             if p.is_file() and p.name != '.DS_Store' and '__pycache__' not in p.parts]
+    paths += [root / p for p in ('project.godot', 'export_presets.cfg', 'Makefile', 'AGENTS.md')]
+    require(all(not p.is_symlink() for p in paths), 'selected source aliases refused')
+    return {p.relative_to(root).as_posix(): {'bytes': p.stat().st_size, 'sha256': sha(p.read_bytes())}
+            for p in sorted(paths)}
+
+
+def binding(root):
+    raw = lambda p: (root / p).read_bytes()
+    require(sha(raw(OUT + 'TASK_SPEC.json')) == SPEC_FILE_BYTES_SHA256, 'immutable spec changed')
+    spec = decode(raw(OUT + 'TASK_SPEC.json'))
+    require(sha(raw(OUT + 'FROZEN_GAME_INPUT_PINS.json')) == spec['frozen_game_input_pins_sha256'] == PINS_HASH,
+            'frozen pins SHA differs from immutable spec')
+    pins = decode(raw(OUT + 'FROZEN_GAME_INPUT_PINS.json'))
+    require(pins['audited_game_source_anchor_commit'] == spec['audit_source_anchor'] == ANCHOR, 'anchor identity')
+    actual = selection(root)
+    require(actual == pins['source_files'], 'full selected-source map: missing/new/changed file')
+    for key in ('marker_contract', 'policy', 'engine'):
+        require(sha(Path(pins[key + '_path']).read_bytes() if key == 'engine' else raw(pins[key + '_path']))
+                == pins[key + '_sha256'], key + ' identity')
+    require(sha(raw(BASELINE)) == pins['baseline_sha256'] == BASE_HASH, 'baseline hash')
+    require(len(raw(BASELINE)) == pins['baseline_bytes'], 'baseline bytes')
+    roster = ['tests/run_tests.gd'] + sorted(p.relative_to(root).as_posix()
+        for p in (root / 'tests').rglob('test*.gd') if 'export' not in p.relative_to(root).parts
+        and p.relative_to(root).as_posix() != 'tests/s0/test_kernel_and_save.gd')
+    require(roster == pins['roster'], 'roster identity')
+    require(sum(p.endswith('.gd') for p in actual) == pins['parse_files'], 'parse selection identity')
+    # Audit evidence is bound to published blobs, never a future self-containing commit.
+    for p in (STATE, SERVICE, RUNTIME, CATALOG):
+        require(raw(p) == blob(root, ANCHOR, p), 'stale audited source: ' + p)
+    return {'actual_commit': subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=root).decode().strip(),
+            'selected_files': len(actual), 'anchor': ANCHOR, 'file_equality': True,
+            'native_evidence_reuse_accepted': False,
+            'TASK_SPEC_file_bytes_sha256': SPEC_FILE_BYTES_SHA256,
+            'Runner_git_show_stripped_UTF8_contract_spec_sha256': RUNNER_CONTRACT_SPEC_SHA256}
+
+
+def expected(root):
+    raw = lambda p: (root / p).read_bytes()
+    require(sha(raw(BASELINE)) == BASE_HASH, 'baseline changed')
+    for name in ('atomic_requirements.json', 'work_packages.json', 'decisions.json'):
+        require(raw(PLAN + name) == blob(root, BASE, PLAN + name), 'original register changed: ' + name)
+    require(raw(OUT + 'ACTUAL_OPUS_NEXT_ORIGINAL_UNIT_SELECTION.json') ==
+            blob(root, BASE, OUT + 'ACTUAL_OPUS_NEXT_ORIGINAL_UNIT_SELECTION.json'), 'selection record changed')
+    lines = raw(BASELINE).decode().splitlines()
+    def cite(start, end=None):
+        end = end or start
+        return {'path': BASELINE, 'lines': [start, end],
+                'text': '\n'.join(lines[start - 1:end]), 'baseline_sha256': BASE_HASH}
+    def evidence(path, start, end):
+        data = blob(root, ANCHOR, path)
+        require(data == raw(path), 'stale source ' + path)
+        return {'path': path, 'sha256': sha(data), 'anchor': ANCHOR,
+                'lines': [start, end], 'text': '\n'.join(data.decode().splitlines()[start - 1:end])}
+    def item(identity, start, end, note, owner, status='missing', source=None):
+        return {'id': identity, 'authority': cite(start, end), 'status': status,
+                'implementation': source or 'original conformance missing', 'owner': owner,
+                'observation': note, 'gap': None if status == 'implemented' else '欠損: ' + note}
+    # Only narrow storage facts are implemented; simulation/route completion never follows.
+    rules = [
+        item('state_fields', 138, 143, '原本3値と盾の明示値の検証・保持のみ。初期値と更新方針は未定。',
+             'P18-01', 'implemented', evidence(STATE, 4, 34)),
+        item('affection_max_invariant', 140, 140, '入力時の最大値一致検証のみ。通常操作の回復・更新は欠損。',
+             'P18-01', 'partial', evidence(STATE, 20, 30)),
+        item('snapshot_container', 138, 143, '専用状態と旧値の分離保存・復元。人物別ルート進行保存を意味しない。',
+             'P18-01', 'partial', evidence(SERVICE, 423, 479)),
+        item('identity_registration', 138, 138, 'Runtimeは登録済み人物・相互対応を検証。既存カタログのヒロインはアンリのみ。通常ルート入口ではない。',
+             'P19-01', 'partial', evidence(RUNTIME, 6791, 6812)),
+        item('legacy_event_ui', 154, 157, '既存UIには汎用関係イベントの確認/保留ラベルがある。原本の行動・決闘選択・自然ルート到達は欠損。',
+             'P19-01', 'partial', evidence('scenes/main/main.gd', 98, 101)),
+    ]
+    clauses = [
+        ('defense_reduction', 141, 141, 'P18-02'), ('post_break_metric', 142, 143, 'P18-02'),
+        ('barrier_block', 143, 143, 'P18-02'), ('coassignment_attack', 145, 145, 'P18-02'),
+        ('zero_break', 146, 146, 'P18-02'), ('contact_after_break', 147, 147, 'P18-02'),
+        ('threshold_route_loss', 148, 148, 'P18-03'), ('duel_types', 150, 151, 'P19-01'),
+        ('duel_win', 152, 152, 'P19-01'), ('duel_loss', 153, 153, 'P19-01'),
+        ('love_actions', 155, 155, 'P19-01'), ('ntr_actions', 156, 156, 'P19-01'),
+        ('corruption_actions', 157, 157, 'P19-01'), ('history_fields', 159, 159, 'P19-02'),
+        ('history_cycle_parentage', 160, 160, 'P19-02'), ('portrait_marks', 161, 161, 'P26-02'),
+        ('route_skills', 132, 132, 'P20-01'), ('departure', 135, 135, 'P19-02')]
+    for identity, start, end, owner in clauses:
+        rules.append(item(identity, start, end,
+            '原本の共通要求。専用原本モデルにはこの更新・表示の実装なし。旧汎用モデルの数値やルートを代用しない。', owner))
+    for rule in rules:
+        if rule['id'] in LEGACY_RANGES:
+            rule.update(status='missing', implementation='original conformance missing; see legacy_evidence',
+                        legacy_classification='legacy_not_original', legacy_reason=LEGACY_REASON)
+            rule['gap'] = '欠損: ' + rule['observation'] + ' ' + LEGACY_REASON
+            rule['legacy_evidence'] = []
+            for path, start, end in LEGACY_RANGES[rule['id']]:
+                entry = evidence(path, start, end)
+                entry['git_blob_oid'] = subprocess.check_output(
+                    ['git','rev-parse',ANCHOR+':'+path],cwd=root).decode().strip()
+                rule['legacy_evidence'].append(entry)
+    # Read complete selected atomic records, not only their condition strings.
+    atoms = decode(raw(PLAN + 'atomic_requirements.json'))['requirements']
+    atoms = [x for x in atoms if set(x.get('source_group_ids', [])) & {'B-7.' + str(i) for i in range(1, 7)}]
+    owners = {x['id'] for p in decode(raw(PLAN + 'work_packages.json')) for x in p.get('remaining_deliverables', [])}
+    require(all(r['owner'] in owners for r in rules), 'unknown original owner')
+    for key, name in PEOPLE:
+        for route in ROUTES:
+            require(any(x['id'] == 'AR.heroine.' + key + '.route.' + route and
+                        x['entity'] == {'kind': 'heroine', 'key': key, 'original_name': name} for x in atoms),
+                    'canonical atomic character/route missing')
+    require(all(name in lines[117 + i] for i, (_, name) in enumerate(PEOPLE)), 'original character names')
+    cells = []
+    for i, (key, name) in enumerate(PEOPLE):
+        for route, route_name in ROUTES.items():
+            refs = {
+                'entry_required_events': ['identity_registration', route + '_actions'],
+                'state_conditions': ['state_fields', 'affection_max_invariant', 'defense_reduction',
+                    'post_break_metric', 'barrier_block', 'coassignment_attack', 'zero_break', 'contact_after_break'],
+                'duel_effects': ['duel_types', 'duel_win', 'duel_loss'],
+                'route_selection_effects': ['threshold_route_loss', route + '_actions', 'route_skills'],
+                'interruption_cancellation': ['departure', 'threshold_route_loss', 'duel_loss'], 'save_handling': ['snapshot_container'],
+                'history_marks': ['history_fields', 'history_cycle_parentage', 'portrait_marks'],
+                'current_reachability': ['identity_registration', 'threshold_route_loss']}
+            categories = {}
+            for category in CATEGORIES:
+                owner = {'entry_required_events': 'P26-01', 'state_conditions': 'P18-02',
+                         'duel_effects': 'P19-01', 'route_selection_effects': 'P26-02',
+                         'interruption_cancellation': 'P19-02', 'save_handling': 'P19-02',
+                         'history_marks': 'P19-02', 'current_reachability': 'P20-02'}[category]
+                gap = item(key + '_' + route + '_' + category, 138, 161,
+                    '原本未定義/D08 pending: 人物固有のイベント列・条件・中断取消・進行保存・履歴と通常到達は未制作/未証明。共通要求から固有仕様を創作しない。', owner)
+                gap['character_authority'] = cite(118 + i)
+                categories[category] = {'common_rule_refs': refs[category], 'character_specific': gap}
+                if category == 'interruption_cancellation':
+                    categories[category].update(route_termination_authorities=[cite(148),cite(153)],
+                        legacy_classification='legacy_not_original', legacy_reason=LEGACY_REASON,
+                        legacy_evidence=[e for r in rules if r['id']=='threshold_route_loss'
+                                         for e in r['legacy_evidence'] if e['path']==SERVICE and e['lines']==[343,355]])
+
+            cells.append({'character_id': key, 'name': name, 'route_id': route, 'route': route_name,
+                          'natural_route_complete': False, 'categories': categories})
+    return {'task_id': 'P19-03-TABLE', 'schema_version': 1,
+            'identity_policy': '原本§6の名前とatomic entity.keyを監査IDに使用。実装IDを捏造しない。カタログにはheroine_anriのみ。OriginalRelationshipStateはsubject_idを保持し7名の列挙はしない。',
+            'source_anchor': ANCHOR, 'common_rules': rules, 'cells': cells,
+            'authority_snapshots': {p: {'sha256': sha(raw(p)), 'base_commit': BASE,
+                'records': decode(raw(p)) if p.endswith('decisions.json') else atoms if p.endswith('atomic_requirements.json')
+                else [x for x in decode(raw(p)) if x['id'] in ('P18', 'P19', 'P20', 'P26')]}
+                for p in (PLAN + 'atomic_requirements.json', PLAN + 'work_packages.json', PLAN + 'decisions.json')},
+            'catalog_evidence': evidence(CATALOG, 1, 32),
+            'pending': {'D05': 'pending', 'D08': 'pending', 'thresholds': None, 'rates': None, 'initial_values': None},
+            'route_support': {r: {'UI': '欠損: 原本行動・3種決闘・原本3軸/盾の通常操作なし。既存汎用関係UIを原本ルートとしない。',
+                'Runtime': 'partial: 原本明示状態の登録・identity検証のみ。共通更新と通常ルート到達は欠損。',
+                'save': 'partial: 専用状態/旧値コンテナ保存あり。人物固有進行・中断再開は欠損。',
+                'Windows': '未受入: global same-Windows acceptanceはopen。文書単位のnative GUI/Windows実行は適用外。',
+                'evidence_refs': ['legacy_event_ui', 'identity_registration', 'snapshot_container', 'state_fields'],
+                'missing_mechanisms': [x[0] for x in clauses]} for r in ROUTES.values()},
+            'acceptance': '7名×3ルートの到達表があり、未制作内容は欠損として残る。',
+            'accounting': '14/88 unchanged; formal Runner validation, independent whole-unit Opus review and normal integration/final required; no game acceptance'}
+
+
+def verify(candidate, canonical, root=None):
+    require(type(candidate) is dict, 'document must be an object')
+    if root is not None:
+        validate_legacy(root, candidate)
+    # Exact canonical equality also rejects additions, type coercion, invented numbers,
+    # owner/status promotion and unsupported completion, including nested metadata.
+    require(json.dumps(candidate, ensure_ascii=False, sort_keys=True) ==
+            json.dumps(canonical, ensure_ascii=False, sort_keys=True), 'table differs from pinned canonical audit')
+
+
+def verify_records(candidate, canonical, markdown_bytes):
+    verify(candidate, canonical)
+    require(markdown_bytes == markdown(canonical).encode(), 'Markdown drift')
+
+
+def markdown(d):
+    lines = ['# P19-03 到達表', '', d['acceptance'], '', d['identity_policy'], '',
+             '共通原本ルールと人物固有欠損を分離する。implementedは狭い保持処理だけで、自然ルート完成ではない。', '',
+             '|人物ID|原名|ルート|現在の到達性|', '|---|---|---|---|']
+    for c in d['cells']:
+        lines.append('|%s|%s|%s|欠損・通常到達未証明|' % (c['character_id'], c['name'], c['route']))
+    lines += ['', '## 共通原本ルール', '']
+    for r in d['common_rules']:
+        lines += ['### ' + r['id'], '', r['status'] + ' / owner: ' + r['owner'], '',
+                  r['observation'], '', '原本 %s:%s–%s' % (BASELINE, *r['authority']['lines']), '',
+                  '```text', r['authority']['text'], '```', '',
+                  '実装証拠: ' + json.dumps(r['implementation'], ensure_ascii=False, sort_keys=True), '']
+        if 'legacy_evidence' in r:
+            lines += ['旧実装: ' + r['legacy_classification'] + ' / ' + r['legacy_reason'], '',
+                      '旧証拠 (git_blob_oid: Git blob OID; sha256: file-bytes SHA-256): ' +
+                      json.dumps(r['legacy_evidence'], ensure_ascii=False, sort_keys=True), '']
+    for c in d['cells']:
+        lines += ['## ' + c['character_id'] + ' / ' + c['name'] + ' / ' + c['route'], '']
+        for category, record in c['categories'].items():
+            g = record['character_specific']
+            lines += ['- ' + category + ': 共通 [' + ', '.join(record['common_rule_refs']) +
+                      '] / missing / ' + g['gap'] + ' / owner: ' + g['owner'] +
+                      ' / 原本 ' + str(g['authority']['lines']) + '・人物 ' + str(g['character_authority']['lines'])]
+            if category == 'interruption_cancellation':
+                lines += ['  原本中断参照: ' + json.dumps(record['route_termination_authorities'], ensure_ascii=False),
+                          '  旧確定ロック legacy_not_original: ' + json.dumps(record['legacy_evidence'], ensure_ascii=False)]
+        lines.append('')
+    lines += ['## ルート別適用性', '']
+    for route, support in d['route_support'].items():
+        lines += ['### ' + route, '']
+        lines += ['- ' + k + ': ' + v for k, v in support.items() if isinstance(v, str)]
+        lines += ['- 欠損機構: ' + ', '.join(support['missing_mechanisms']), '']
+    lines += ['D05/D08、閾値・率・初期値はpending。完全な出典本文・SHA・原子要件全レコードはJSONに保持する。', '', d['accounting'], '']
+    return '\n'.join(lines)
+
+
+def main():
+    p = argparse.ArgumentParser(description=__doc__)
+    p.add_argument('--project-root', type=Path, required=True)
+    mode = p.add_mutually_exclusive_group(required=True)
+    mode.add_argument('--check', action='store_true')
+    mode.add_argument('--write', action='store_true')
+    mode.add_argument('--source-binding-only', action='store_true')
+    args = p.parse_args()
+    try:
+        root = args.project_root.resolve()
+        result = binding(root)
+        if not args.source_binding_only:
+            canonical = expected(root)
+            validate_legacy(root, canonical)
+            if args.write:
+                (root / OUT / 'REACHABILITY_TABLE.json').write_text(json.dumps(canonical, ensure_ascii=False, indent=2) + '\n', encoding='utf-8')
+                (root / OUT / 'REACHABILITY_TABLE.md').write_text(markdown(canonical), encoding='utf-8')
+            else:
+                validate_legacy(root, decode((root / OUT / 'REACHABILITY_TABLE.json').read_bytes()))
+                verify_records(decode((root / OUT / 'REACHABILITY_TABLE.json').read_bytes()), canonical,
+                               (root / OUT / 'REACHABILITY_TABLE.md').read_bytes())
+        print(json.dumps({'audit_integrity': 'pass', 'formal_acceptance': 'pending_runner_and_independent_review', **result}))
+        return 0
+    except (ValueError, OSError, KeyError, TypeError, subprocess.CalledProcessError) as e:
+        print(json.dumps({'audit_integrity': 'fail', 'error': str(e)}))
+        return 1
+
+
+if __name__ == '__main__':
+    sys.exit(main())
@@ -0,0 +1,167 @@
+#!/usr/bin/env python3
+"""Meaningful in-memory controls; no product, Git or fixture writes."""
+import argparse
+import copy
+from pathlib import Path
+import unittest
+from unittest.mock import patch
+import check_reachability_table as audit
+
+ROOT = None
+
+
+class AuditTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.canonical = audit.expected(ROOT)
+
+    def reject(self, mutate):
+        changed = copy.deepcopy(self.canonical)
+        mutate(changed)
+        with self.assertRaises(ValueError):
+            audit.verify(changed, self.canonical)
+
+    def test_valid_implemented_partial_missing(self):
+        # All three legitimate status classes must survive serialization and the
+        # exact same verifier used by --check, without status promotion.
+        import json
+        value = audit.decode(json.dumps(self.canonical))
+        self.assertEqual({r['status'] for r in value['common_rules']}, {'implemented', 'partial', 'missing'})
+        audit.verify(value, self.canonical)
+
+    def test_independent_legacy_source_evidence(self):
+        import subprocess
+        document = audit.decode((ROOT / audit.OUT / 'REACHABILITY_TABLE.json').read_bytes())
+        audit.validate_legacy(ROOT, document)
+        for rule in document['common_rules']:
+            for entry in rule.get('legacy_evidence', []):
+                data = subprocess.check_output(['git', 'show', audit.ANCHOR + ':' + entry['path']], cwd=ROOT)
+                self.assertEqual(data, (ROOT / entry['path']).read_bytes())
+                self.assertEqual(entry['git_blob_oid'], subprocess.check_output(
+                    ['git','hash-object','--stdin'], input=data, cwd=ROOT).decode().strip())
+                start, end = entry['lines']
+                self.assertEqual(entry['text'], '\n'.join(data.decode().splitlines()[start-1:end]))
+        rules = {r['id']: r for r in document['common_rules']}
+        self.assertIn('func restore_shield', rules['love_actions']['legacy_evidence'][0]['text'])
+        self.assertIn('shield_broken', rules['zero_break']['legacy_evidence'][0]['text'])
+        self.assertIn('EXCLUSIVE_LOCKED', rules['threshold_route_loss']['legacy_evidence'][1]['text'])
+
+    def test_legacy_evidence_required_independently(self):
+        for identity in audit.LEGACY_RANGES:
+            for mutation in ('drop', 'empty', 'absence', 'blob', 'text'):
+                changed = copy.deepcopy(self.canonical)
+                rule = next(r for r in changed['common_rules'] if r['id'] == identity)
+                if mutation == 'drop':
+                    rule.pop('legacy_evidence')
+                elif mutation == 'empty':
+                    rule['legacy_evidence'] = []
+                elif mutation == 'absence':
+                    rule['implementation'] = 'not implemented'
+                else:
+                    rule['legacy_evidence'][0]['git_blob_oid' if mutation == 'blob' else 'text'] = 'stale'
+                with self.subTest(identity=identity, mutation=mutation), self.assertRaises(ValueError):
+                    audit.validate_legacy(ROOT, changed)
+
+    def test_exact_cell_product(self):
+        mutations = {
+            'missing': lambda d: d['cells'].pop(),
+            'duplicate': lambda d: d['cells'].append(copy.deepcopy(d['cells'][0])),
+            'wrong_character': lambda d: d['cells'][0].update(character_id='unregistered'),
+            'wrong_route': lambda d: d['cells'][0].update(route='unregistered'),
+        }
+        for name, mutate in mutations.items():
+            with self.subTest(name=name):
+                self.reject(mutate)
+
+    def test_categories_and_citations(self):
+        self.reject(lambda d: d['cells'][0]['categories'].pop('save_handling'))
+        self.reject(lambda d: d['common_rules'][0].pop('authority'))
+        self.reject(lambda d: d['cells'][0]['categories']['state_conditions']['character_specific'].pop('character_authority'))
+
+    def test_stale_record_evidence(self):
+        for field in ('text', 'baseline_sha256'):
+            with self.subTest(field=field):
+                self.reject(lambda d: d['common_rules'][0]['authority'].update({field: 'stale'}))
+        for field in ('text', 'sha256', 'anchor'):
+            with self.subTest(field=field):
+                self.reject(lambda d: d['common_rules'][0]['implementation'].update({field: 'stale'}))
+
+    def test_real_source_and_baseline_changes(self):
+        original = Path.read_bytes
+        for target in (audit.BASELINE, audit.STATE):
+            def corrupt(path):
+                value = original(path)
+                return value + b'\nchanged' if path == ROOT / target else value
+            with self.subTest(target=target), patch.object(Path, 'read_bytes', corrupt):
+                with self.assertRaises(ValueError):
+                    audit.expected(ROOT)
+        actual_blob = audit.blob
+        def corrupt_blob(root, commit, path):
+            value = actual_blob(root, commit, path)
+            return value + b'\nchanged' if path == audit.STATE else value
+        with patch.object(audit, 'blob', side_effect=corrupt_blob):
+            with self.assertRaises(ValueError):
+                audit.expected(ROOT)
+
+    def test_no_invented_values_or_completion(self):
+        self.reject(lambda d: d['pending'].update(thresholds=50))
+        self.reject(lambda d: d['common_rules'][5].update(status='implemented'))
+        self.reject(lambda d: d['cells'][0].update(natural_route_complete=True))
+        self.reject(lambda d: d['cells'][0]['categories']['entry_required_events']['character_specific'].update(status='implemented', gap=None))
+
+    def test_owner_and_status(self):
+        self.reject(lambda d: d['common_rules'][0].update(owner='P99-01'))
+        self.reject(lambda d: d['common_rules'][0].update(owner='P19-02'))
+        self.reject(lambda d: d['common_rules'][0].update(status='complete'))
+
+    def test_json_and_types(self):
+        for data in ('{', '{"x":1,"x":2}', '{"x":NaN}'):
+            with self.subTest(data=data), self.assertRaises(ValueError):
+                audit.decode(data)
+        for value in ([], None, 'table'):
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                audit.verify(value, self.canonical)
+        self.reject(lambda d: d.update(cells={}))
+        self.reject(lambda d: d.update(schema_version=True))
+
+    def test_markdown_drift(self):
+        expected = audit.markdown(self.canonical).encode()
+        audit.verify_records(self.canonical, self.canonical,
+                             (ROOT / audit.OUT / 'REACHABILITY_TABLE.md').read_bytes())
+        with self.assertRaises(ValueError):
+            audit.verify_records(self.canonical, self.canonical, expected + b'\nchanged')
+
+    def test_full_frozen_map_and_identities(self):
+        audit.binding(ROOT)  # Valid frozen-map control; no native execution.
+        actual_selection = audit.selection(ROOT)
+        for kind in ('missing', 'new', 'changed'):
+            changed = copy.deepcopy(actual_selection)
+            key = next(iter(changed))
+            if kind == 'missing':
+                del changed[key]
+            elif kind == 'new':
+                changed['scripts/invented.gd'] = {'bytes': 0, 'sha256': '0' * 64}
+            else:
+                changed[key]['sha256'] = '0' * 64
+            with self.subTest(kind=kind), patch.object(audit, 'selection', return_value=changed):
+                with self.assertRaises(ValueError):
+                    audit.binding(ROOT)
+        original = Path.read_bytes
+        pins = audit.decode(original(ROOT / audit.OUT / 'FROZEN_GAME_INPUT_PINS.json'))
+        targets = [ROOT / audit.OUT / 'FROZEN_GAME_INPUT_PINS.json', ROOT / pins['marker_contract_path'],
+                   ROOT / pins['policy_path'], Path(pins['engine_path'])]
+        for target in targets:
+            def corrupt(path):
+                value = original(path)
+                return value + b'\nchanged' if path == target else value
+            with self.subTest(target=str(target)), patch.object(Path, 'read_bytes', corrupt):
+                with self.assertRaises(ValueError):
+                    audit.binding(ROOT)
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--project-root', type=Path, required=True)
+    args, rest = parser.parse_known_args()
+    ROOT = args.project_root.resolve()
+    unittest.main(argv=[__file__] + rest)
@@ -205,8 +205,8 @@
  "remaining_delivery_units": 88,
  "current_package_state_counts": {
    "completed": 1,
-    "in_progress": 27,
-    "planned": 2
+    "in_progress": 28,
+    "planned": 1
  },
  "initial_snapshot_checked": false,
  "historical_source_bytes_compared": false,
@@ -244,7 +244,7 @@
    "facility_value_contracts_validation.json": "bf490a9ca585c48fc318e76c4a069ef244827d828d46e6415399f7710590dd16",
    "performance_audit.json": "0b630b15a392c3e0366f1362bfe4ddacb968f915f54549f82e4d6fa315384762",
    "progress_contract.json": "ccbdfce8c8365d5c13f59531955708834cce45acd0e136561c95295dfdb5df77",
-    "progress_snapshot.json": "9e8fab3cd49f2b7c70dde88c0adba71dda7fcee27384aff5fd11f11333577476",
+    "progress_snapshot.json": "4a5e3a1ad7e69406bf3aef43333eda19c07337f1d76a8f5c68da74b6bded9fd1",
    "progress_validator_guard_checks.json": "72ee513fcf1cad85c24bfd0a4b472f425f6acf117928ece0f6b41e29018da627",
    "progress_validator_guard_checks.r01.json": "14c26adffa5a1938241db4912e50ea54b660641ee6fee2e412d467dce14d0519",
    "requirement_coverage.json": "03b10e4da367579db502d0671a6e0dda36fd385111c6f1c0084acaff7605f593",
@@ -254,6 +254,6 @@
    "validate_facility_value_contracts.py": "91640e2a76cd6cc9186f7b85c0bf379b24b6cac0d48962815235ee628e7ae43e",
    "validate_plan.py": "23678227d9b3c556f1bd903f4b5b3147c4a82ce5085e10055481026803451b80",
    "validator_update_checks.json": "f997d0f3de2cea29550840b1d5cb23647d64f81329de46758551e2b6c8fecc27",
-    "work_packages.json": "7ba154a369a9aec73bcf2d315309d094e4be5bb85f978d29fc9114d3a1569aa9"
+    "work_packages.json": "0b472eaff8c208337cf2847c196add61415fbf22db2e7c298d2fc5c4ff38e5c0"
  }
 }
@@ -152,13 +152,13 @@
  },
  "current_package_state_counts": {
    "completed": 1,
-    "in_progress": 27,
-    "planned": 2
+    "in_progress": 28,
+    "planned": 1
  },
  "current_delivery_state_counts": {
    "completed": 14,
-    "in_progress": 24,
-    "planned": 50
+    "in_progress": 25,
+    "planned": 49
  },
  "completed_current_deliveries": [
    "P00-01",
@@ -9713,7 +9713,7 @@
    "execution": "the-tree-p06-01 Runner; recorded Claude decision, one Codex implementer",
    "current_gate_status": "not implemented or executed; formal completion not accepted"
  },
-  "next_closure_plan_id": "P24-02",
+  "next_closure_plan_id": "P19-03",
  "p24_03_formal_closure": "docs/plans/original-completion-2026-10-02/execution/p24-03-formal-closure-r01/closure.json",
  "new_engine_run_scope": "Supplemental positive metadata diagnostic r01 failed cleanup preparation/log isolation; r02 passed17checks unchanged source and entire default profile. No duplicated full game regression.",
  "current_closure_targets": {
@@ -10460,14 +10460,48 @@
    },
    "latest_full_status": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/CURRENT_ACCEPTANCE_STATUS.json",
    "formal_review": {
-      "state": "actual provider running",
-      "exec_session": 96001,
+      "state": "terminal_pass",
      "run_id": "ead8e74b9683404d8cf3d97bca118726",
-      "pid": 17285,
      "model": "claude-opus-5-5",
-      "frozen_checkout": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-review-e6fc1237",
-      "material_files": 16049
+      "critical_high_medium": 0,
+      "low": 4,
+      "artifact": "ACTUAL_INDEPENDENT_OPUS_REVIEW.json"
    },
-    "formal_credit": 0
+    "formal_credit": 0,
+    "backend_batch_state": "completed",
+    "normal_integration_candidate": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+    "normal_final": {
+      "passed": true,
+      "commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "artifact": "FORMAL_FINAL.json"
+    },
+    "whole_original_acceptance": false
+  },
+  "current_p19_03_reachability": {
+    "state": "whole_original_review_passed_integration_final_pending",
+    "spec": "docs/plans/original-completion-2026-10-02/execution/p19-03/TASK_SPEC.json",
+    "actual_opus": "dc342e4d69154660bef7e688a70fd783",
+    "original_unit_credit": 0,
+    "source_anchor": "1b07b87d3736e777932315a4bdde8b70cbf9cb23",
+    "P04_existing_questions": "preserved; no duplicate question or fake answer",
+    "S": "806de25068bc423136063791afcea811d251ee1b",
+    "actual_reviewer": {
+      "id": "d4e70e7f48f549b085692962f88531a8",
+      "status": "running",
+      "pid": 30223,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/d4e70e7f48f549b085692962f88531a8"
+    },
+    "current_status": "docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_CURRENT_ACCEPTANCE_STATUS.json",
+    "whole_review": {
+      "run_id": "38eaaacdb31b4c76bcf982987816a391",
+      "status": "pass",
+      "critical_high_medium": 0,
+      "low": 3,
+      "artifact": "ROOT_WHOLE_REVIEW_806DE25.json"
+    },
+    "actual_repair_worker": {
+      "id": "bf8a86e053044bfea0051253fefb2ec7",
+      "status": "finished"
+    }
  }
 }
@@ -8011,7 +8011,7 @@
    },
    "legacy_state": "planned",
    "state_scope": "package-level; completed means whole package accepted; partial implementation is not completion",
-    "current_summary": "P13-03「内容差異の記録」を正式完了。提出bd3a97e、原8条件を別Opusレビュー、実統合/最終e80c6c0で確認。全7施設/84利用枠/6分類、33拒否+代替正常系、固定原30/88・部分点なし。記録1件のみ、内容/素材/P13パッケージ/原子/ゲーム完成の加点0。P13-01/02とD08/D09・未制作内容は未完了。",
+    "current_summary": "P13-03は原成果として完了済み。P13-02の限定CODE1のみ通常最終ゲートまで完了し、元P13-02全条件は引き続き未達。限定backend CODE1は提出a7e3069→通常統合C65f07bf/M191ea3bでRunner completed。厳密15/863登録検証、全184/21903・329構文・186実PID終了の正確合成証明、別Opus全CODE1レビュー合格（重大/高/中0・低4を後続記録）、実候補の全1368入力等値照合、通常integration/finalを完了。元ENOSPC全回帰の失敗記録と全量可逆退避は保持。親P13-02の通常建設・記録係・承認値・自然収集・VIP/完成素材/Windows等は未達、原正式14/88から加算0。",
    "remaining_deliverables": [
      {
        "id": "P13-01",
@@ -8045,23 +8045,25 @@
          },
          {
            "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/CURRENT_ACCEPTANCE_STATUS.json",
-            "sha256": "bb945dac151519f15b46f48656dd4132870a5301bf5c00a81b32592b78ff7f2a",
+            "sha256": "9a37598317771097232be1f92bba4b7b21fd399ec2d173abb115662d8ba5c310",
            "scope": "Actual qualified composed184/21903/329parse/186ended; original failed full not overwritten; formal independent review and integration/final pending, original credit0"
          }
        ],
-        "progress_summary": "実提出a7e3069で局所15/863・登録validation合格、全184スイート21903チェック/329構文/実所有186PID終了を全元ガード付きで再照合。ENOSPC終了の元全回帰は失敗のまま保存し、正確58スイートと実続行126の合成証明を明示、証跡は全量可逆圧縮・Drive読戻SHA照合。通常独立Opusレビュー工程を起動済み、通常integration/finalは未了。原P13全条件の未承認値・自然営業・VIP/完成素材/Windows等は残り、原14/88から加算0。次の正式原成果はP04-01、既存D05回答待ち。",
-        "current_summary": "実提出a7e3069で局所15/863・登録validation合格、全184スイート21903チェック/329構文/実所有186PID終了を全元ガード付きで再照合。ENOSPC終了の元全回帰は失敗のまま保存し、正確58スイートと実続行126の合成証明を明示、証跡は全量可逆圧縮・Drive読戻SHA照合。通常独立Opusレビュー工程を起動済み、通常integration/finalは未了。原P13全条件の未承認値・自然営業・VIP/完成素材/Windows等は残り、原14/88から加算0。次の正式原成果はP04-01、既存D05回答待ち。",
-        "updated_at_jst": "2026-10-17T18:59:44.626679+09:00",
+        "progress_summary": "限定backend CODE1は提出a7e3069→通常統合C65f07bf/M191ea3bでRunner completed。厳密15/863登録検証、全184/21903・329構文・186実PID終了の正確合成証明、別Opus全CODE1レビュー合格（重大/高/中0・低4を後続記録）、実候補の全1368入力等値照合、通常integration/finalを完了。元ENOSPC全回帰の失敗記録と全量可逆退避は保持。親P13-02の通常建設・記録係・承認値・自然収集・VIP/完成素材/Windows等は未達、原正式14/88から加算0。",
+        "current_summary": "限定backend CODE1は提出a7e3069→通常統合C65f07bf/M191ea3bでRunner completed。厳密15/863登録検証、全184/21903・329構文・186実PID終了の正確合成証明、別Opus全CODE1レビュー合格（重大/高/中0・低4を後続記録）、実候補の全1368入力等値照合、通常integration/finalを完了。元ENOSPC全回帰の失敗記録と全量可逆退避は保持。親P13-02の通常建設・記録係・承認値・自然収集・VIP/完成素材/Windows等は未達、原正式14/88から加算0。",
+        "updated_at_jst": "2026-10-17T19:05:57.762697+09:00",
        "current_execution": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/CURRENT_ACCEPTANCE_STATUS.json",
        "remaining_gaps": [
-          "Actual separate whole CODE1 review must pass with no critical/high/medium finding",
-          "Normal exact latest-main integration candidate, input-equality qualification, final verification and ledger",
-          "Whole original P13-02 normal construction/recorder/natural triggers/approved quantities/VIP/UI/assets/Windows and all original conditions remain unaccepted"
+          "Whole original P13-02 normal construction/recorder/natural triggers/approved quantities/VIP/UI/assets/Windows and all original conditions remain unaccepted; CODE1 has no new original-unit credit",
+          "Four low severity future-production defensive/migration/coverage observations retained from actual Opus review; no observed ordinary production path and no critical/high/medium finding",
+          "P04-01 remains next original formal closure when existing D05 owner choices arrive; independent next original-unit selection will be requested from actual Opus"
        ],
        "submitted_commit": "a7e3069b167511b3194242b3403fbcc35244a526",
-        "normal_integration_candidate": null,
+        "normal_integration_candidate": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
        "worker_model": "gpt-6-astra",
-        "model_selected_by_actual_opus": "19f00667226d42dd8e9b3a4ae99aaa68"
+        "model_selected_by_actual_opus": "19f00667226d42dd8e9b3a4ae99aaa68",
+        "integrated_commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+        "backend_batch_state": "completed"
      },
      {
        "id": "P13-03",
@@ -8125,7 +8127,7 @@
    ],
    "cross_cutting_acceptance_scope": "Completion requirements only, not achieved results. Apply each to relevant slices; non-applicable views require a recorded reason.",
    "initial_revision_state": "planned",
-    "updated_at_jst": "2026-10-15T20:07:06.405550+09:00"
+    "updated_at_jst": "2026-10-17T19:05:57.762697+09:00"
  },
  {
    "id": "P14",
@@ -8985,7 +8987,7 @@
      "D07",
      "D08"
    ],
-    "state": "planned",
+    "state": "in_progress",
    "supplement_ids": [],
    "owner_roles": {
      "implementation": "実装担当（担当者未割当）",
@@ -8994,7 +8996,7 @@
    },
    "legacy_state": "planned",
    "state_scope": "package-level; completed means whole package accepted; partial implementation is not completion",
-    "current_summary": "一般イベント基盤はあるが原本の決闘・人物行動の全接続は未着手。",
+    "current_summary": "修正版806de25の登録3検証/12自己試験が実合格。実Opus38eaaが7名×3ルート21セル・全8カテゴリ・原本/全source/欠損と旧実装区分を全原条件再レビューしpass（重大/高/中0・低3）。通常integration/final・台帳確定前で原14/88に加算0。ゲーム1368入力は同一、旧全回帰証明を厳密再利用。",
    "remaining_deliverables": [
      {
        "id": "P19-01",
@@ -9017,8 +9019,28 @@
        "title": "分岐の到達性",
        "work": "人物ごとの3ルートに必要なイベント・条件・中断処理を列挙する。",
        "acceptance": "7名×3ルートの到達表があり、未制作内容は欠損として残る。",
-        "state": "planned",
-        "evidence": []
+        "state": "in_progress",
+        "evidence": [
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p19-03/TASK_SPEC.json",
+            "sha256": "263a01b943d8056727335fb76977c010298e1c229077f8da76e48683ba2e89bb",
+            "scope": "Actual Opus-selected original unit contract preparation; no acceptance credit"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_CURRENT_ACCEPTANCE_STATUS.json",
+            "sha256": "75dd5adc99eebd16703c5f5b4df12d3e4efdc24e702b24bb7daa1a71454417e6",
+            "scope": "Actual registered3checks+selftests10 PASS; exact game-input reuse qualified; whole semantic review/integration/final pending, original credit0"
+          }
+        ],
+        "current_summary": "修正版806de25の登録3検証/12自己試験が実合格。実Opus38eaaが7名×3ルート21セル・全8カテゴリ・原本/全source/欠損と旧実装区分を全原条件再レビューしpass（重大/高/中0・低3）。通常integration/final・台帳確定前で原14/88に加算0。ゲーム1368入力は同一、旧全回帰証明を厳密再利用。",
+        "progress_summary": "初回実行パス未展開と実provider文脈上限の失敗を保持し、検査器実行前/推論前の障害のみを実行経路/全文ファイル参照で補正。提出版/全資料/受入条件/権限/課金に変更なし。人物固有未制作/D08/未定値は欠損。",
+        "updated_at_jst": "2026-10-17T19:58:24.516684+09:00",
+        "current_execution": "docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_CURRENT_ACCEPTANCE_STATUS.json",
+        "remaining_gaps": [
+          "Normal actual integrationC/M and independent candidate source/input equality",
+          "Normal final and existing exact real-owner main authorization, thenledger/push; no new humanSHA speech fabricated"
+        ],
+        "submitted_commit": "806de25068bc423136063791afcea811d251ee1b"
      }
    ],
    "estimate_person_days_historical_2026_09_29": [
@@ -9038,7 +9060,8 @@
      "要件別ログとソースハッシュを保存"
    ],
    "cross_cutting_acceptance_scope": "Completion requirements only, not achieved results. Apply each to relevant slices; non-applicable views require a recorded reason.",
-    "initial_revision_state": "planned"
+    "initial_revision_state": "planned",
+    "updated_at_jst": "2026-10-17T19:39:39.105864+09:00"
  },
  {
    "id": "P20",
@@ -1048,6 +1048,13 @@ static func _snapshot_package_format(snapshot: Dictionary) -> int:
 	if not runtime_data is Dictionary: return FORMAT_VERSION # no owned Runtime authority
 	var version: Variant = runtime_data.get(&"runtime_schema_version", 1)
 	if typeof(version) != TYPE_INT: return -1
+	if runtime_data.has(&"special_peeping_rooms"):
+		var section_clock: Variant = snapshot.get(&"clock")
+		if not section_clock is Dictionary or typeof(section_clock.get(&"absolute_minute")) != TYPE_INT: return -1
+		if not preload("res://scripts/special/peeping_room_service.gd").valid_runtime_section(runtime_data, section_clock[&"absolute_minute"]): return -1
+		# Keep PurchaseQuotePlansV2's exact original allowlist and all format rules.
+		runtime_data = runtime_data.duplicate()
+		runtime_data.erase(&"special_peeping_rooms")
 	if version >= 1 and version <= 14:
 		return -1 if PurchaseQuoteV2.has_history(runtime_data) else FORMAT_VERSION
 	if version != 15: return -1
@@ -0,0 +1,271 @@
+class_name PeepingRoomService
+extends RefCounted
+
+## Non-graphic state/reference machinery; production definitions remain pending.
+const SECTION_VERSION := 1
+const ALLOWED_TARGETS := [&"public_bath", &"adult_private_room"]
+const OCCUPANCY_KIND := &"special_peeping_room"
+const ID_PREFIX := &"peeping_room"
+const ROOM_KEYS := [&"room_id", &"origin", &"footprint", &"cells", &"target_instance_id", &"target_definition_id", &"target_history", &"link_state", &"stopped", &"stop_reason"]
+const EVIDENCE_KEYS := [&"evidence_id", &"room_id", &"target_instance_id", &"source_event_key", &"minute"]
+
+var _rooms: Dictionary = {}
+var _evidence: Dictionary = {}
+var _world: WorldService
+var _facilities: FacilityService
+var _construction: ConstructionService
+var _path: PathService
+var _ids: StableIdGenerator
+
+func configure(world: WorldService, facilities: FacilityService, construction: ConstructionService, path: PathService, ids: StableIdGenerator) -> void:
+	_world = world
+	_facilities = facilities
+	_construction = construction
+	_path = path
+	_ids = ids
+
+static func result(reason: StringName = &"OK") -> Dictionary:
+	return {&"ok": reason == &"OK", &"reason": reason}
+
+func is_empty() -> bool:
+	return _rooms.is_empty() and _evidence.is_empty()
+
+func get_room(room_id: StringName) -> Dictionary:
+	return (_rooms.get(room_id, {}) as Dictionary).duplicate(true)
+
+## Pure validation. own_room is supplied internally only for explicit relink/restore.
+func validate_placement(origin: Vector3i, footprint: Vector2i = Vector2i(2, 1), target_id: StringName = &"", own_room: StringName = &"") -> Dictionary:
+	if origin.z != WorldService.LAYER_BACK: return result(&"WRONG_LAYER")
+	if footprint != Vector2i(2, 1): return result(&"WRONG_FOOTPRINT")
+	if target_id == &"vip_suite": return result(&"PENDING_P10_01")
+	var cells := _world.cells_for_footprint(origin, footprint)
+	var targets: Array[StringName] = []
+	var missing := false
+	for cell: Vector3i in cells:
+		if not _world.is_in_bounds(cell): return result(&"OUT_OF_BOUNDS")
+		if cell.y < 0 and not _world.is_excavated(cell): return result(&"NOT_EXCAVATED")
+		var front := Vector3i(cell.x, cell.y, WorldService.LAYER_FRONT)
+		if _world.get_occupant_kind(front) == &"construction": return result(&"TARGET_INCOMPLETE")
+		var occupant := _world.get_occupant(front)
+		if occupant.is_empty(): missing = true
+		elif occupant not in targets: targets.append(occupant)
+	if targets.size() > 1: return result(&"MULTIPLE_TARGETS")
+	if missing: return result(&"TARGET_MISSING" if targets.is_empty() else &"PARTIAL_TARGET")
+	var resolved_id := targets[0]
+	if not target_id.is_empty() and target_id != resolved_id: return result(&"TARGET_MISMATCH")
+	var target := _facilities.get_instance(resolved_id)
+	if target == null: return result(&"TARGET_UNKNOWN")
+	if target.definition_id not in ALLOWED_TARGETS: return result(&"TARGET_NOT_ALLOWED")
+	if target.origin.z != WorldService.LAYER_FRONT: return result(&"TARGET_WRONG_LAYER")
+	var built := _construction.get_facility(resolved_id)
+	if built.is_empty(): return result(&"TARGET_INCOMPLETE")
+	if built.get(&"definition_id") != target.definition_id: return result(&"TARGET_MISMATCH")
+	for cell: Vector3i in cells:
+		var front := Vector3i(cell.x, cell.y, WorldService.LAYER_FRONT)
+		if front not in target.occupied_cells or front not in built[&"occupied_cells"]: return result(&"PARTIAL_TARGET")
+		# Reject cutting an existing corridor; never construct an implicit bypass.
+		if _world.is_walkable(cell) or _path.has_cell(cell): return result(&"CORRIDOR_CONFLICT")
+	var occupancy := _world.validate_occupancy(cells)
+	if not occupancy[&"ok"]:
+		if own_room.is_empty() or _world.get_entity_cells(own_room) != cells or _world.get_entity_kind(own_room) != OCCUPANCY_KIND:
+			return result(&"BACK_OCCUPIED")
+	var report := result()
+	report.merge({&"cells": cells, &"target_instance_id": resolved_id, &"target_definition_id": target.definition_id})
+	return report
+
+## CONTROLLED_FIXTURE: tests only. No Runtime executor or palette calls this.
+func controlled_fixture_place(origin: Vector3i, target_id: StringName = &"") -> Dictionary:
+	var report := validate_placement(origin, Vector2i(2, 1), target_id)
+	if not report[&"ok"]: return report
+	var room_id := _ids.next_id(ID_PREFIX)
+	if room_id.is_empty(): return result(&"ID_EXHAUSTED")
+	if not _world.occupy(room_id, report[&"cells"], OCCUPANCY_KIND): return result(&"BACK_OCCUPIED")
+	_rooms[room_id] = {&"room_id": room_id, &"origin": origin, &"footprint": Vector2i(2, 1),
+		&"cells": report[&"cells"].duplicate(), &"target_instance_id": report[&"target_instance_id"],
+		&"target_definition_id": report[&"target_definition_id"],
+		&"target_history": [report[&"target_instance_id"]], &"link_state": &"LINKED",
+		&"stopped": true, &"stop_reason": &"CONTROLLED_FIXTURE"}
+	report[&"room_id"] = room_id
+	return report
+
+func target_removed(target_id: StringName) -> void:
+	for room: Dictionary in _rooms.values():
+		if room[&"target_instance_id"] == target_id:
+			room[&"link_state"] = &"TARGET_LOST"
+			room[&"stopped"] = true
+			room[&"stop_reason"] = &"TARGET_LOST"
+
+func detect_target_loss() -> void:
+	for room: Dictionary in _rooms.values():
+		if room[&"link_state"] == &"TARGET_LOST": continue
+		if not _target_still_present(room): target_removed(room[&"target_instance_id"])
+
+func _target_still_present(room: Dictionary) -> bool:
+	var target := _facilities.get_instance(room[&"target_instance_id"])
+	if target == null or target.definition_id != room[&"target_definition_id"]: return false
+	for cell: Vector3i in room[&"cells"]:
+		if _world.get_occupant(Vector3i(cell.x, cell.y, WorldService.LAYER_FRONT)) != target.instance_id: return false
+	return true
+
+func relink(room_id: StringName, target_id: StringName) -> Dictionary:
+	if not _rooms.has(room_id): return result(&"ROOM_MISSING")
+	if target_id.is_empty(): return result(&"TARGET_MISSING")
+	var room: Dictionary = _rooms[room_id]
+	var report := validate_placement(room[&"origin"], room[&"footprint"], target_id, room_id)
+	if not report[&"ok"]: return report
+	room[&"target_instance_id"] = target_id
+	room[&"target_definition_id"] = report[&"target_definition_id"]
+	if target_id not in room[&"target_history"]: room[&"target_history"].append(target_id)
+	room[&"link_state"] = &"LINKED"
+	room[&"stopped"] = true
+	room[&"stop_reason"] = &"RELINKED_PENDING_RESUME"
+	return result()
+
+func _collection_precondition(room_id: StringName, source_event_key: StringName, minute: int) -> Dictionary:
+	if String(source_event_key).strip_edges().is_empty(): return result(&"SOURCE_EVENT_KEY_REQUIRED")
+	if minute < 0: return result(&"INVALID_MINUTE")
+	if not _rooms.has(room_id): return result(&"ROOM_MISSING")
+	detect_target_loss()
+	var room: Dictionary = _rooms[room_id]
+	# Required precedence: stopped, power, closed, construction, lost target.
+	if room[&"stopped"]: return result(&"STOPPED")
+	var target := _facilities.get_instance(room[&"target_instance_id"])
+	if target != null:
+		if not target.power_available: return result(&"NO_POWER")
+		if not target.operator_open or not target.is_within_opening_hours(minute): return result(&"CLOSED")
+		if _construction.get_facility(target.instance_id).is_empty(): return result(&"UNDER_CONSTRUCTION")
+	if room[&"link_state"] == &"TARGET_LOST" or target == null: return result(&"TARGET_LOST")
+	return result()
+
+func record_evidence(room_id: StringName, source_event_key: StringName, minute: int) -> Dictionary:
+	var report := _collection_precondition(room_id, source_event_key, minute)
+	return report if not report[&"ok"] else result(&"RECORDER_ELIGIBILITY_PENDING_D04_D08_P16")
+
+## CONTROLLED_FIXTURE: explicit test state, never a production resume command.
+func controlled_fixture_set_stopped(room_id: StringName, stopped: bool) -> bool:
+	if not _rooms.has(room_id): return false
+	detect_target_loss()
+	var room: Dictionary = _rooms[room_id]
+	if not stopped and room[&"link_state"] == &"TARGET_LOST": return false
+	room[&"stopped"] = stopped
+	room[&"stop_reason"] = &"CONTROLLED_FIXTURE" if stopped else &""
+	return true
+
+## CONTROLLED_FIXTURE: sole ledger write entry point, opaque event keys only.
+func controlled_fixture_record_evidence(room_id: StringName, source_event_key: StringName, minute: int) -> Dictionary:
+	var report := _collection_precondition(room_id, source_event_key, minute)
+	if not report[&"ok"]: return report
+	var target_id: StringName = _rooms[room_id][&"target_instance_id"]
+	var evidence_id := _evidence_id(room_id, target_id, source_event_key)
+	var duplicated := _evidence.has(evidence_id)
+	if not duplicated:
+		_evidence[evidence_id] = {&"evidence_id": evidence_id, &"room_id": room_id,
+			&"target_instance_id": target_id, &"source_event_key": source_event_key, &"minute": minute}
+	return {&"ok": true, &"reason": &"OK", &"evidence_id": evidence_id, &"duplicated": duplicated}
+
+static func _evidence_id(room_id: StringName, target_id: StringName, event_key: StringName) -> StringName:
+	# Length-prefixed UTF-8 hex is injective; delimiters in input cannot alias.
+	var pieces: Array[String] = []
+	for value: StringName in [room_id, target_id, event_key]:
+		var bytes := String(value).to_utf8_buffer()
+		pieces.append("%d:%s" % [bytes.size(), bytes.hex_encode()])
+	return StringName("peeping_evidence:" + ":".join(pieces))
+
+func create_snapshot() -> Dictionary:
+	var rooms: Array[Dictionary] = []
+	var evidence: Array[Dictionary] = []
+	var keys := _rooms.keys()
+	keys.sort()
+	for key: StringName in keys: rooms.append(_rooms[key].duplicate(true))
+	keys = _evidence.keys()
+	keys.sort()
+	for key: StringName in keys: evidence.append(_evidence[key].duplicate(true))
+	return {&"version": SECTION_VERSION, &"rooms": rooms, &"evidence": evidence}
+
+static func _exact(value: Variant, keys: Array) -> bool:
+	if not value is Dictionary or value.size() != keys.size(): return false
+	for key: Variant in value:
+		if typeof(key) != TYPE_STRING_NAME or key not in keys: return false
+	return true
+
+## Save format 15 has a fixed purchase-key allowlist outside this task's scope.
+## Validate this independent section before passing only the original keys to it.
+static func valid_runtime_section(data: Dictionary, minute: int) -> bool:
+	if not data.get(&"special_peeping_rooms") is Dictionary: return false
+	for key: Variant in data:
+		if key == &"special_peeping_rooms" and typeof(key) != TYPE_STRING_NAME: return false
+	for key: StringName in [&"world", &"path", &"facilities", &"construction", &"id_generator"]:
+		if not data.get(key) is Dictionary: return false
+	var world := WorldService.new()
+	var path := PathService.new()
+	var facilities := FacilityService.new()
+	var ids := StableIdGenerator.new()
+	if not world.restore_snapshot(data[&"world"]) or not path.restore_snapshot(data[&"path"]) or not facilities.restore_snapshot(data[&"facilities"]) or not ids.restore_snapshot(data[&"id_generator"]): return false
+	var construction := ConstructionService.new(world)
+	if not construction.restore_snapshot(data[&"construction"]): return false
+	var service := PeepingRoomService.new()
+	service.configure(world, facilities, construction, path, ids)
+	return service.restore_section(data[&"special_peeping_rooms"], minute)
+
+## Staged restore validates both directions of world ownership before committing.
+func restore_section(section: Variant, minute: int) -> bool:
+	var rooms: Dictionary = {}
+	var evidence: Dictionary = {}
+	if section != null:
+		if not _exact(section, [&"version", &"rooms", &"evidence"]): return false
+		if typeof(section[&"version"]) != TYPE_INT or section[&"version"] != SECTION_VERSION: return false
+		if not section[&"rooms"] is Array or not section[&"evidence"] is Array: return false
+		if section[&"rooms"].is_empty(): return false # absence represents empty state
+		var known: Array = _facilities.create_snapshot()[&"known_instance_ids"]
+		for raw: Variant in section[&"rooms"]:
+			if not _exact(raw, ROOM_KEYS): return false
+			for key: StringName in [&"room_id", &"target_instance_id", &"target_definition_id", &"link_state", &"stop_reason"]:
+				if typeof(raw[key]) != TYPE_STRING_NAME: return false
+			var room_id: StringName = raw[&"room_id"]
+			var suffix := String(room_id).trim_prefix("peeping_room.")
+			if suffix.length() != 12 or not suffix.is_valid_int() or int(suffix) <= 0 or String(room_id) != "peeping_room.%012d" % int(suffix): return false
+			if int(suffix) > _ids.get_counter(ID_PREFIX) or rooms.has(room_id): return false
+			if typeof(raw[&"origin"]) != TYPE_VECTOR3I or typeof(raw[&"footprint"]) != TYPE_VECTOR2I: return false
+			if raw[&"origin"].z != WorldService.LAYER_BACK or raw[&"footprint"] != Vector2i(2, 1): return false
+			var cells := _world.cells_for_footprint(raw[&"origin"], raw[&"footprint"])
+			if not raw[&"cells"] is Array or raw[&"cells"] != cells: return false
+			for cell: Variant in raw[&"cells"]:
+				if typeof(cell) != TYPE_VECTOR3I: return false
+			if _world.get_entity_cells(room_id) != cells or _world.get_entity_kind(room_id) != OCCUPANCY_KIND: return false
+			for cell: Vector3i in cells:
+				if _world.is_walkable(cell) or _path.has_cell(cell): return false
+			if raw[&"target_definition_id"] not in ALLOWED_TARGETS: return false
+			if typeof(raw[&"stopped"]) != TYPE_BOOL or not raw[&"target_history"] is Array: return false
+			var history := {}
+			for target: Variant in raw[&"target_history"]:
+				if typeof(target) != TYPE_STRING_NAME or String(target) not in known or history.has(target): return false
+				history[target] = true
+			if not history.has(raw[&"target_instance_id"]): return false
+			var current_target := _facilities.get_instance(raw[&"target_instance_id"])
+			if current_target != null and current_target.definition_id != raw[&"target_definition_id"]: return false
+			if raw[&"link_state"] == &"TARGET_LOST":
+				if not raw[&"stopped"] or raw[&"stop_reason"] != &"TARGET_LOST" or _target_still_present(raw): return false
+			elif raw[&"link_state"] == &"LINKED":
+				if not validate_placement(raw[&"origin"], raw[&"footprint"], raw[&"target_instance_id"], room_id)[&"ok"]: return false
+				if _facilities.get_instance(raw[&"target_instance_id"]).definition_id != raw[&"target_definition_id"]: return false
+				if raw[&"stopped"]:
+					if raw[&"stop_reason"] not in [&"CONTROLLED_FIXTURE", &"RELINKED_PENDING_RESUME"]: return false
+				elif raw[&"stop_reason"] != &"": return false
+			else: return false
+			rooms[room_id] = raw.duplicate(true)
+		for raw: Variant in section[&"evidence"]:
+			if not _exact(raw, EVIDENCE_KEYS): return false
+			for key: StringName in [&"evidence_id", &"room_id", &"target_instance_id", &"source_event_key"]:
+				if typeof(raw[key]) != TYPE_STRING_NAME or raw[key].is_empty(): return false
+			if String(raw[&"source_event_key"]).strip_edges().is_empty(): return false
+			if typeof(raw[&"minute"]) != TYPE_INT or raw[&"minute"] < 0 or raw[&"minute"] > minute: return false
+			if not rooms.has(raw[&"room_id"]) or raw[&"target_instance_id"] not in rooms[raw[&"room_id"]][&"target_history"]: return false
+			var expected := _evidence_id(raw[&"room_id"], raw[&"target_instance_id"], raw[&"source_event_key"])
+			if expected != raw[&"evidence_id"] or evidence.has(expected): return false
+			evidence[expected] = raw.duplicate(true)
+	for occupied: Dictionary in _world.create_snapshot()[&"occupancies"]:
+		if occupied[&"kind"] == OCCUPANCY_KIND or String(occupied[&"entity_id"]).begins_with("peeping_room."):
+			if not rooms.has(occupied[&"entity_id"]): return false
+	_rooms = rooms
+	_evidence = evidence
+	return true
@@ -0,0 +1,59 @@
+extends SceneTree
+
+## CONTROLLED_FIXTURE. No production placement, recorder or eligibility claim.
+const Rooms := preload("res://scripts/special/peeping_room_service.gd")
+var checks := 0
+var failures := 0
+var fixtures: Array[Dictionary] = []
+
+func _initialize() -> void:
+	call_deferred("_run")
+
+func expect(ok: bool, label: String) -> void:
+	checks += 1
+	if not ok:
+		failures += 1
+		push_error(label)
+
+func fixture(build_bath := true) -> Dictionary:
+	var clock: Variant = load("res://autoload/game_clock.gd").new()
+	var state: Variant = load("res://autoload/game_state.gd").new()
+	var runtime: Variant = load("res://autoload/simulation_runtime.gd").new()
+	clock.reset(1, 6, 0)
+	state.reset()
+	expect(runtime.initialize(clock, state, 1302)[&"valid"], "CONTROLLED_FIXTURE real Runtime initializes")
+	clock.set_paused(true)
+	runtime.configure_save_policy({&"enabled": false, &"daily_checkpoint_enabled": false})
+	var f := {&"clock": clock, &"state": state, &"runtime": runtime, &"target": &"", &"origin": Vector3i(-6, 1, 1)}
+	fixtures.append(f)
+	if build_bath:
+		var built: CommandResult = runtime.submit_command(&"build_facility", {&"definition_id": &"public_bath", &"origin": Vector3i(-6, 0, 0)})
+		expect(built.is_success(), "real paid public bath construction")
+		clock.advance_minutes(runtime.definition_registry.get_facility(&"public_bath").build_minutes)
+		for target: FacilityInstance in runtime.facility_service.get_instances():
+			if target.definition_id == &"public_bath": f[&"target"] = target.instance_id
+		expect(not f[&"target"].is_empty(), "completed FRONT target has real stable identity")
+	return f
+
+func place(f: Dictionary, origin: Variant = null) -> StringName:
+	var report: Dictionary = f[&"runtime"].peeping_room_service.controlled_fixture_place(f[&"origin"] if origin == null else origin)
+	expect(report[&"ok"], "CONTROLLED_FIXTURE only room placement: " + String(report[&"reason"]))
+	return report.get(&"room_id", &"")
+
+func enable_fixture(f: Dictionary, room: StringName) -> void:
+	var runtime: Variant = f[&"runtime"]
+	expect(runtime.peeping_room_service.controlled_fixture_set_stopped(room, false), "CONTROLLED_FIXTURE explicitly enables ledger exercise")
+	expect(runtime.facility_service.set_operational_status(f[&"target"], {&"power_available": true, &"operator_open": true}, f[&"clock"].absolute_minute).is_success(), "CONTROLLED_FIXTURE target conditions")
+
+func rejects_atomically(runtime: Variant, snapshot: Dictionary) -> bool:
+	var before := var_to_bytes(runtime.create_snapshot())
+	return not runtime.restore_snapshot(snapshot) and before == var_to_bytes(runtime.create_snapshot())
+
+func finish(label: String) -> void:
+	for f: Dictionary in fixtures:
+		f[&"runtime"].free()
+		f[&"clock"].free()
+		f[&"state"].free()
+	fixtures.clear()
+	print("%s: %d checks, %d failures" % [label, checks, failures])
+	quit(1 if failures else 0)
@@ -0,0 +1,96 @@
+"""Static UID policy cases; no engine, native worker or regression invocation."""
+import importlib.util
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+
+sys.dont_write_bytecode = True
+TOOLS = Path(__file__).resolve().parents[2] / 'tools'
+sys.path.insert(0, str(TOOLS))
+spec = importlib.util.spec_from_file_location('p13_uid_policy', TOOLS / 'run_p13_reference_tests.py')
+runner = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(runner)
+
+
+class UIDPolicyTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.stage = Path(self.tmp.name)
+        self.owner = 'tests/special/example.gd'
+        self.other = 'scripts/special/peeping_room_service.gd'
+        for name in (self.owner, self.other):
+            self.write(name, b'extends RefCounted\n')
+        self.write('project.godot', b'[application]\n')
+        self.write('scripts/existing.gd.uid', b'uid://existing\n')
+        self.source = runner.shared.inventory(self.stage, stage=True)
+        self.plan = runner.uid_plan(self.source)
+        self.write(self.owner + '.uid', b'uid://first\n')
+        self.write(self.other + '.uid', b'uid://second\n')
+
+    def write(self, name, raw):
+        path = self.stage / name
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_bytes(raw)
+
+    def snapshot(self):
+        return runner.uid_snapshot(self.stage, self.source, self.plan)
+
+    def test_accept_and_owner_seal(self):
+        accepted = self.snapshot()
+        self.assertEqual(set(accepted), {self.owner + '.uid', self.other + '.uid'})
+        pin = accepted[self.owner + '.uid']
+        self.assertEqual(pin['raw_bytes'], list(b'uid://first\n'))
+        self.assertEqual(pin['text'], 'uid://first\n')
+        self.assertEqual(pin['owner_sha256'], self.source[self.owner]['sha256'])
+        self.assertEqual(pin['sha256'], runner.shared.sha(self.stage / (self.owner + '.uid')))
+
+    def test_unknown_and_extra(self):
+        for name in ('scripts/unknown.gd.uid', 'extra.txt'):
+            with self.subTest(name=name):
+                self.write(name, b'uid://extra\n')
+                with self.assertRaises(AssertionError):
+                    self.snapshot()
+                (self.stage / name).unlink()
+
+    def test_missing(self):
+        (self.stage / (self.owner + '.uid')).unlink()
+        with self.assertRaises(AssertionError):
+            self.snapshot()
+
+    def test_malformed(self):
+        for raw in (b'uid://UPPER\n', b'uid://first', b'uid://first\nextra',
+                    b'uid://12345678901234\n', b'uid://\n', b'uid://first\r\n'):
+            with self.subTest(raw=raw):
+                self.write(self.owner + '.uid', raw)
+                with self.assertRaises(AssertionError):
+                    self.snapshot()
+
+    def test_duplicate_and_existing_collision(self):
+        for raw in (b'uid://second\n', b'uid://existing\n'):
+            with self.subTest(raw=raw):
+                self.write(self.owner + '.uid', raw)
+                with self.assertRaises(AssertionError):
+                    self.snapshot()
+
+    def test_modified_original(self):
+        for name in (self.owner, 'project.godot', 'scripts/existing.gd.uid'):
+            with self.subTest(name=name):
+                path = self.stage / name
+                original = path.read_bytes()
+                path.write_bytes(original + b'tamper')
+                with self.assertRaises(AssertionError):
+                    self.snapshot()
+                path.write_bytes(original)
+
+    def test_symlink(self):
+        path = self.stage / (self.owner + '.uid')
+        path.unlink()
+        path.symlink_to(self.stage / (self.other + '.uid'))
+        with self.assertRaises(AssertionError):
+            self.snapshot()
+
+
+if __name__ == '__main__':
+    unittest.main()
@@ -0,0 +1,40 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var room := place(f)
+	var other := place(f, Vector3i(-4, 1, 1))
+	var service: Variant = runtime.peeping_room_service
+	var minute: int = f[&"clock"].absolute_minute
+	expect(service.record_evidence(room, &"", minute)[&"reason"] == &"SOURCE_EVENT_KEY_REQUIRED", "named source key required first")
+	expect(service.controlled_fixture_record_evidence(room, &"fixture.event", minute)[&"reason"] == &"STOPPED", "initial stopped state rejects even fixture ledger")
+	enable_fixture(f, room)
+	enable_fixture(f, other)
+	var target: FacilityInstance = runtime.facility_service.get_instance(f[&"target"])
+	target.power_available = false
+	target.operator_open = false
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"NO_POWER", "power rejection precedes closed")
+	target.power_available = true
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"CLOSED", "closed target rejects")
+	target.operator_open = true
+	# CONTROLLED_FIXTURE temporarily omit construction authority, leaving live target.
+	var empty_construction := ConstructionService.new(runtime.world_service)
+	service.configure(runtime.world_service, runtime.facility_service, empty_construction, runtime.path_service, runtime.id_generator)
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"UNDER_CONSTRUCTION", "uncompleted construction authority rejects collection")
+	service.configure(runtime.world_service, runtime.facility_service, runtime.construction_service, runtime.path_service, runtime.id_generator)
+	var before := var_to_bytes(service.create_snapshot())
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"RECORDER_ELIGIBILITY_PENDING_D04_D08_P16", "production collection never invents eligibility")
+	expect(before == var_to_bytes(service.create_snapshot()), "production collection leaves ledger unchanged")
+	var first: Dictionary = service.controlled_fixture_record_evidence(room, &"fixture.event", minute)
+	var replay: Dictionary = service.controlled_fixture_record_evidence(room, &"fixture.event", minute + 1)
+	expect(first[&"ok"] and not first[&"duplicated"] and replay[&"duplicated"] and replay[&"evidence_id"] == first[&"evidence_id"], "tuple replay returns exactly one stable ID")
+	var second: Dictionary = service.controlled_fixture_record_evidence(other, &"fixture.event", minute)
+	var third: Dictionary = service.controlled_fixture_record_evidence(room, &"fixture:event:日本語", minute)
+	expect(second[&"evidence_id"] != first[&"evidence_id"] and third[&"evidence_id"] != first[&"evidence_id"], "different room/key distinct, delimiter and UTF-8 input supported")
+	expect(service.create_snapshot()[&"evidence"].size() == 3, "replay adds no ledger record")
+	var snapshot: Dictionary = runtime.create_snapshot()
+	expect(runtime.restore_snapshot(snapshot), "active fixture evidence restores")
+	var restored: Dictionary = runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.event", minute)
+	expect(restored[&"duplicated"] and restored[&"evidence_id"] == first[&"evidence_id"], "evidence stable across restore")
+	finish("Peeping room evidence")
@@ -0,0 +1,62 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var service: Variant = runtime.peeping_room_service
+	var origin: Vector3i = f[&"origin"]
+	var before := var_to_bytes(runtime.create_snapshot())
+	expect(service.validate_placement(origin)[&"ok"], "public bath entirely behind one completed FRONT target")
+	expect(service.validate_placement(Vector3i(-6, 1, 0))[&"reason"] == &"WRONG_LAYER", "FRONT room rejected")
+	expect(service.validate_placement(origin, Vector2i(1, 2))[&"reason"] == &"WRONG_FOOTPRINT", "rotated footprint rejected")
+	expect(service.validate_placement(origin, Vector2i(2, 1), &"vip_suite")[&"reason"] == &"PENDING_P10_01", "VIP unavailable, never substituted")
+	expect(service.validate_placement(Vector3i(-1, 1, 1))[&"reason"] == &"PARTIAL_TARGET", "partial target rejected")
+	expect(service.validate_placement(Vector3i(8, 1, 1))[&"reason"] == &"TARGET_MISSING", "missing target rejected")
+	expect(service.validate_placement(origin, Vector2i(2, 1), &"missing")[&"reason"] == &"TARGET_MISMATCH", "named reference must match FRONT occupant")
+	expect(before == var_to_bytes(runtime.create_snapshot()), "geometry validation is pure across whole Runtime")
+	# Complete real second bath; the 2x1 footprint at the boundary spans targets.
+	expect(runtime.submit_command(&"build_facility", {&"definition_id": &"public_bath", &"origin": Vector3i(0, 0, 0)}).is_success(), "second paid target starts")
+	expect(service.validate_placement(Vector3i(0, 1, 1))[&"reason"] == &"TARGET_INCOMPLETE", "construction reservation is not a completed target")
+	f[&"clock"].advance_minutes(runtime.definition_registry.get_facility(&"public_bath").build_minutes)
+	expect(service.validate_placement(Vector3i(-1, 1, 1))[&"reason"] == &"MULTIPLE_TARGETS", "multiple FRONT target footprints rejected")
+	# A real path joining both sides through the proposed footprint must survive.
+	for x in range(-7, -3): runtime.world_service.set_walkable(Vector3i(x, 1, 1), true)
+	expect(runtime.rebuild_path_graph_from_world(), "CONTROLLED_FIXTURE corridor graph rebuild")
+	var path_before: Array = runtime.path_service.find_path(Vector3i(-7, 1, 1), Vector3i(-4, 1, 1))
+	expect(not path_before.is_empty(), "proposed footprint lies across a connected corridor")
+	expect(service.validate_placement(origin)[&"reason"] == &"CORRIDOR_CONFLICT", "would disconnect BACK corridor: reject with no bypass")
+	expect(runtime.path_service.find_path(Vector3i(-7, 1, 1), Vector3i(-4, 1, 1)) == path_before, "rejected cut preserves route")
+	for x in range(-7, -3): runtime.world_service.set_walkable(Vector3i(x, 1, 1), false)
+	expect(service.validate_placement(origin)[&"reason"] == &"CORRIDOR_CONFLICT", "stale path authority also rejects conflict")
+	expect(runtime.rebuild_path_graph_from_world(), "corridor fixture removed explicitly")
+	var room := place(f)
+	expect(service.validate_placement(origin)[&"reason"] == &"BACK_OCCUPIED", "dedicated room occupancy blocks overlap")
+	expect(runtime.world_service.get_entity_kind(room) == Rooms.OCCUPANCY_KIND, "dedicated cross-reference occupancy kind")
+	_private_geometry()
+	finish("Peeping room geometry")
+
+func _private_geometry() -> void:
+	var f := fixture(false)
+	var runtime: Variant = f[&"runtime"]
+	# CONTROLLED_FIXTURE underground geometry only: no unlock/normal palette claim.
+	var bounds: Dictionary = runtime.world_service.get_bounds()
+	bounds[&"min_y"] = -1
+	expect(runtime.world_service.expand_bounds(bounds), "CONTROLLED_FIXTURE underground bounds")
+	var definition: FacilityDefinition = runtime.definition_registry.get_facility(&"adult_private_room")
+	for x in range(2):
+		var cell := Vector3i(x, -1, 0)
+		runtime.world_service.set_excavated(cell, true)
+		runtime.world_service.set_support(cell, definition.weight_per_cell, true)
+	var started: CommandResult = runtime.construction_service.start_construction(definition, Vector3i(0, -1, 0))
+	expect(started.is_success(), "CONTROLLED_FIXTURE paid real adult_private_room definition")
+	f[&"clock"].advance_minutes(definition.build_minutes)
+	var service: Variant = runtime.peeping_room_service
+	expect(service.validate_placement(Vector3i(0, -1, 1))[&"ok"], "adult_private_room valid completed geometry")
+	var target_id: StringName = runtime.world_service.get_occupant(Vector3i(0, -1, 0))
+	var target: FacilityInstance = runtime.facility_service.get_instance(target_id)
+	if target != null:
+		target.definition_id = &"vip_private_salon"
+		expect(service.validate_placement(Vector3i(0, -1, 1))[&"reason"] == &"TARGET_NOT_ALLOWED", "salon is not VIP suite substitute")
+		target.definition_id = &"adult_private_room"
+		runtime.facility_service.unregister_instance(target_id)
+		expect(service.validate_placement(Vector3i(0, -1, 1))[&"reason"] == &"TARGET_UNKNOWN", "world occupant without actual FacilityService target rejected")
@@ -0,0 +1,37 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var room := place(f)
+	enable_fixture(f, room)
+	var old_target: StringName = f[&"target"]
+	var old_evidence: Dictionary = runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.event", f[&"clock"].absolute_minute)
+	expect(old_evidence[&"ok"], "fixture evidence before removal")
+	expect(runtime.submit_command(&"demolish_facility", {&"instance_id": old_target}).is_success(), "real Runtime demolition")
+	var lost: Dictionary = runtime.peeping_room_service.get_room(room)
+	expect(lost[&"link_state"] == &"TARGET_LOST" and lost[&"stopped"], "target removal immediately marks lost and stopped")
+	expect(runtime.peeping_room_service.record_evidence(room, &"fixture.after_loss", f[&"clock"].absolute_minute)[&"reason"] == &"STOPPED", "collection rejected after loss with prescribed stopped precedence")
+	expect(not runtime.peeping_room_service.controlled_fixture_set_stopped(room, false), "lost target cannot resume even through fixture")
+	var lost_snapshot: Dictionary = runtime.create_snapshot()
+	expect(runtime.restore_snapshot(lost_snapshot), "lost reference roundtrip retains historical identity")
+	expect(var_to_bytes(lost_snapshot) == var_to_bytes(runtime.create_snapshot()), "lost snapshot exact typed roundtrip")
+	expect(runtime.submit_command(&"build_facility", {&"definition_id": &"public_bath", &"origin": Vector3i(-6, 0, 0)}).is_success(), "rebuild at same geometry starts")
+	f[&"clock"].advance_minutes(runtime.definition_registry.get_facility(&"public_bath").build_minutes)
+	var new_target: StringName = runtime.world_service.get_occupant(Vector3i(-6, 0, 0))
+	expect(new_target != old_target, "rebuild receives different target identity")
+	expect(runtime.peeping_room_service.get_room(room)[&"target_instance_id"] == old_target, "no implicit relink on geometry reuse")
+	var rejected: CommandResult = runtime.submit_command(&"peeping_room_relink", {&"room_id": room, &"target_instance_id": old_target})
+	expect(not rejected.is_success(), "explicit old target relink rejected")
+	expect(runtime.submit_command(&"peeping_room_relink", {&"room_id": room, &"target_instance_id": new_target}).is_success(), "explicit new target full validation")
+	var linked: Dictionary = runtime.peeping_room_service.get_room(room)
+	expect(linked[&"stopped"] and linked[&"stop_reason"] == &"RELINKED_PENDING_RESUME", "explicit relink never auto resumes")
+	f[&"target"] = new_target
+	enable_fixture(f, room)
+	var new_evidence: Dictionary = runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.event", f[&"clock"].absolute_minute)
+	expect(new_evidence[&"ok"] and new_evidence[&"evidence_id"] != old_evidence.get(&"evidence_id"), "same room/event on different target never aliases")
+	var linked_snapshot: Dictionary = runtime.create_snapshot()
+	expect(runtime.restore_snapshot(linked_snapshot) and var_to_bytes(linked_snapshot) == var_to_bytes(runtime.create_snapshot()), "relinked ledger keeps both historical target bindings")
+	expect(runtime.facility_service.unregister_instance(new_target).is_success(), "equivalent FacilityService removal path")
+	expect(runtime.peeping_room_service.get_room(room)[&"link_state"] == &"TARGET_LOST", "unregister signal also invalidates target")
+	finish("Peeping room reference")
@@ -0,0 +1,91 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	# Direct executor invocation distinguishes read-only domain state from queue receipts.
+	var validation := SimulationCommand.new()
+	validation.command_type = &"peeping_room_validate"
+	validation.payload = {&"origin": f[&"origin"]}
+	var before := var_to_bytes(runtime.create_snapshot())
+	expect(runtime._execute_peeping_room(validation).is_success(), "read-only validator executor")
+	expect(before == var_to_bytes(runtime.create_snapshot()), "validator changes no whole Runtime bytes")
+	var public_validation: CommandResult = runtime.submit_command(&"peeping_room_validate", validation.payload)
+	expect(public_validation.is_success(), "registered validation command runs through real queue")
+	var placement := SimulationCommand.new()
+	placement.command_type = &"peeping_room_place"
+	placement.payload = validation.payload.duplicate(true)
+	var placement_before := var_to_bytes(runtime.create_snapshot())
+	var direct_unavailable: CommandResult = runtime._execute_peeping_room(placement)
+	expect(not direct_unavailable.is_success() and direct_unavailable.details[&"reason"] == &"BUILD_DEFINITION_PENDING_D04", "direct production placement unavailable with precise reason")
+	expect(placement_before == var_to_bytes(runtime.create_snapshot()), "direct placement adds no room, occupancy, cost or ID in whole typed Runtime")
+	var domain_before := var_to_bytes([runtime.world_service.create_snapshot(), runtime.economy_service.create_snapshot(), runtime.peeping_room_service.create_snapshot()])
+	var ids_before: Dictionary = runtime.id_generator.create_snapshot()
+	var counters_before: Dictionary = ids_before["counters"]
+	var event_counter_before: int = counters_before.get("domain_event", 0)
+	var event_ids_before := {}
+	for event: SimulationDomainEvent in runtime.domain_events.recent_events():
+		event_ids_before[event.event_id] = true
+	var unavailable: CommandResult = runtime.submit_command(&"peeping_room_place", validation.payload)
+	expect(not unavailable.is_success() and unavailable.details[&"reason"] == &"BUILD_DEFINITION_PENDING_D04", "production placement unavailable with precise reason")
+	expect(domain_before == var_to_bytes([runtime.world_service.create_snapshot(), runtime.economy_service.create_snapshot(), runtime.peeping_room_service.create_snapshot()]), "queued placement adds no room, occupancy or cost")
+	var ids_after: Dictionary = runtime.id_generator.create_snapshot()
+	var counters_after: Dictionary = ids_after["counters"]
+	expect(ids_before["version"] == ids_after["version"], "queued placement preserves ID generator version")
+	for prefix: Variant in counters_before:
+		if prefix != "domain_event":
+			expect(counters_after.has(prefix) and counters_after.get(prefix) == counters_before[prefix], "queued placement consumes no non-event ID or removes prefix: %s" % prefix)
+	for prefix: Variant in counters_after:
+		if prefix != "domain_event":
+			expect(counters_before.has(prefix), "queued placement adds no non-event ID prefix: %s" % prefix)
+	expect(counters_after.has("domain_event") and counters_after["domain_event"] == event_counter_before + 1, "queued placement allocates exactly one normal receipt event ID")
+	var new_events: Array[SimulationDomainEvent] = []
+	for event: SimulationDomainEvent in runtime.domain_events.recent_events():
+		if not event_ids_before.has(event.event_id):
+			new_events.append(event)
+	expect(new_events.size() == 1, "queued placement publishes exactly one new receipt event")
+	if new_events.size() == 1:
+		var receipt: SimulationDomainEvent = new_events[0]
+		expect(receipt.event_id == StringName("domain_event.%012d" % (event_counter_before + 1)), "placement receipt uses the next domain event ID")
+		expect(receipt.event_type == &"COMMAND_FAILED", "unavailable placement receipt is COMMAND_FAILED")
+		expect(receipt.causation_command_id == unavailable.command_id, "placement receipt causation matches rejected command")
+	var room := place(f)
+	enable_fixture(f, room)
+	var blocked: CommandResult = runtime.submit_command(&"peeping_room_record_evidence", {&"room_id": room, &"source_event_key": &"fixture.command"})
+	expect(not blocked.is_success() and blocked.details[&"reason"] == &"RECORDER_ELIGIBILITY_PENDING_D04_D08_P16", "registered evidence command cannot reach ledger")
+	var missing: CommandResult = runtime.submit_command(&"peeping_room_record_evidence", {&"room_id": room})
+	expect(not missing.is_success() and missing.details[&"reason"] == &"SOURCE_EVENT_KEY_REQUIRED", "public command requires named key")
+	var malformed: CommandResult = runtime.submit_command(&"peeping_room_validate", {&"origin": [0, 1, 1]})
+	expect(not malformed.is_success() and malformed.details[&"reason"] == &"INVALID_PAYLOAD", "wrong payload type safely rejected")
+	expect(runtime.peeping_room_service.create_snapshot()[&"evidence"].is_empty(), "commands cannot inject arbitrary content events")
+	var fixture_command: CommandResult = runtime.submit_command(&"controlled_fixture_place", validation.payload)
+	expect(not fixture_command.is_success(), "no fixture command registration")
+	_mimi_format(f)
+	finish("Peeping room runtime")
+
+func _mimi_format(f: Dictionary) -> void:
+	var runtime: Variant = f[&"runtime"]
+	const Quote := preload("res://scripts/supply/supply_purchase_quote_v2.gd")
+	expect(runtime.submit_command(&"build_facility", {&"definition_id": &"warehouse", &"origin": Vector3i(2, 0, 1)}).is_success(), "paid warehouse for independent existing MIMI format path")
+	f[&"clock"].advance_minutes(runtime.definition_registry.get_facility(&"warehouse").build_minutes)
+	var warehouse: StringName = &""
+	for facility: FacilityInstance in runtime.facility_service.get_instances():
+		if facility.definition_id == &"warehouse": warehouse = facility.instance_id
+	expect(not warehouse.is_empty(), "completed real warehouse")
+	var mimi := StaffRuntime.new().configure(Quote.MIMI, &"porter", {&"employment_kind": StaffRuntime.EmploymentKind.UNIQUE})
+	expect(runtime.staff_service.register_staff(mimi).is_success(), "CONTROLLED_FIXTURE existing MIMI unique registration, no natural join claim")
+	expect(runtime.submit_command(&"set_staff_work_assignment", {&"staff_id": Quote.MIMI, &"facility_id": warehouse, &"template_id": &"NIGHT"}).is_success(), "existing persistent MIMI assignment")
+	expect(runtime.submit_command(&"purchase_supplies", {&"warehouse_id": warehouse, &"item_id": SupplyCatalog.RAW_FOOD, &"quantity": 1}).is_success(), "existing real v2 paid purchase")
+	var snapshot: Dictionary = runtime.create_snapshot()
+	expect(snapshot[&"systems"][&"runtime"][&"runtime_schema_version"] == 15 and snapshot[&"systems"][&"runtime"].has(&"special_peeping_rooms"), "v2 purchase history and special section coexist")
+	expect(runtime.restore_snapshot(snapshot) and var_to_bytes(snapshot) == var_to_bytes(runtime.create_snapshot()), "v15 optional section exact typed restore")
+	var directory := "user://tests/p13_reference_mimi_%d" % OS.get_process_id()
+	expect(SaveService.save_snapshot(directory, snapshot)[&"ok"], "physical v15 save accepts validated extension without loosening purchase allowlist")
+	var loaded := SaveService.load_snapshot(directory)
+	expect(loaded[&"ok"], "physical MIMI section save loads")
+	if loaded[&"ok"]:
+		expect(loaded[&"manifest"]["format_version"] == 2 and loaded[&"manifest"]["runtime_schema_version"] == 15, "format2 manifest still exactly15")
+		expect(runtime.restore_snapshot(loaded[&"snapshot"]), "MIMI package restore reaches same staged section validator")
+	var bad := snapshot.duplicate(true)
+	bad[&"systems"][&"runtime"][&"special_peeping_rooms"][&"version"] = 2
+	expect(not SaveService.save_snapshot(directory + "_bad", bad)[&"ok"], "save-format adapter rejects malformed optional section")
@@ -0,0 +1,66 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var empty: Dictionary = runtime.create_snapshot()
+	expect(not empty[&"systems"][&"runtime"].has(&"special_peeping_rooms"), "empty service does not alter existing snapshot keys")
+	expect(runtime.restore_snapshot(empty) and var_to_bytes(empty) == var_to_bytes(runtime.create_snapshot()), "pre-extension v14 absence exact roundtrip")
+	var legacy := empty.duplicate(true)
+	legacy[&"systems"][&"runtime"][&"runtime_schema_version"] = 13
+	legacy[&"systems"][&"runtime"].erase(&"auto_purchase_plans")
+	expect(runtime.restore_snapshot(legacy) and runtime.peeping_room_service.is_empty(), "genuine v13 absent section migrates empty")
+	expect(runtime.restore_snapshot(empty), "restore canonical baseline before controlled room")
+	var room := place(f)
+	enable_fixture(f, room)
+	expect(runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.save", f[&"clock"].absolute_minute)[&"ok"], "controlled evidence before mid-state save")
+	expect(runtime.submit_command(&"peeping_room_relink", {&"room_id": room, &"target_instance_id": f[&"target"]}, &"player", room, 0, f[&"clock"].absolute_minute + 1).is_success(), "future explicit relink remains pending at checkpoint")
+	var snapshot: Dictionary = runtime.create_snapshot()
+	expect(snapshot[&"systems"][&"runtime"][&"runtime_schema_version"] == 14, "extension never bumps Runtime version")
+	expect(runtime.restore_snapshot(snapshot) and var_to_bytes(snapshot) == var_to_bytes(runtime.create_snapshot()), "exact typed room/evidence whole Runtime roundtrip")
+	var directory := "user://tests/p13_reference_save_%d" % OS.get_process_id()
+	var saved := SaveService.save_snapshot(directory, snapshot)
+	expect(saved[&"ok"], "actual SaveService writes section in format 1")
+	var loaded := SaveService.load_snapshot(directory)
+	expect(loaded[&"ok"], "actual SaveService reads section")
+	if loaded[&"ok"]:
+		expect(loaded[&"manifest"]["format_version"] == 1, "existing format mapping unchanged")
+		expect(runtime.restore_snapshot(loaded[&"snapshot"]), "loaded physical package reaches Runtime validation")
+		expect(var_to_bytes(snapshot) == var_to_bytes(runtime.create_snapshot()), "physical save retains all typed fields")
+	for mutation in range(18):
+		var bad := snapshot.duplicate(true)
+		var data: Dictionary = bad[&"systems"][&"runtime"]
+		var section: Dictionary = data[&"special_peeping_rooms"]
+		match mutation:
+			0: data.erase(&"special_peeping_rooms")
+			1: data[&"special_peeping_rooms"] = null
+			2: section[&"version"] = 2
+			3: section[&"version"] = 1.0
+			4: section[&"unknown"] = true
+			5: section.erase(&"evidence")
+			6: section[&"rooms"].append(section[&"rooms"][0].duplicate(true))
+			7: section[&"evidence"].append(section[&"evidence"][0].duplicate(true))
+			8: section[&"rooms"][0][&"target_instance_id"] = &"missing.target"
+			9: section[&"rooms"][0][&"target_definition_id"] = &"adult_private_room"
+			10: section[&"rooms"][0][&"origin"] = Vector3i(8, 1, 1)
+			11: section[&"rooms"][0][&"stopped"] = 1
+			12: section[&"evidence"][0][&"room_id"] = &"peeping_room.999999999999"
+			13: section[&"evidence"][0][&"source_event_key"] = &"aliased.event"
+			14: section[&"evidence"][0][&"minute"] = f[&"clock"].absolute_minute + 1
+			15: data[&"id_generator"]["counters"]["peeping_room"] = 0
+			16:
+				section.erase(&"version")
+				section["version"] = 1
+			17:
+				section[&"rooms"][0][&"link_state"] = &"TARGET_LOST"
+				section[&"rooms"][0][&"stopped"] = true
+				section[&"rooms"][0][&"stop_reason"] = &"TARGET_LOST"
+		expect(rejects_atomically(runtime, bad), "malformed/current missing/reference/duplicate rejection atomic case %d" % mutation)
+	var orphan := empty.duplicate(true)
+	orphan[&"systems"][&"runtime"][&"world"] = snapshot[&"systems"][&"runtime"][&"world"].duplicate(true)
+	expect(rejects_atomically(runtime, orphan), "world-owned room without any section rejects atomically")
+	var removed_world := snapshot.duplicate(true)
+	removed_world[&"systems"][&"runtime"][&"world"] = empty[&"systems"][&"runtime"][&"world"].duplicate(true)
+	expect(rejects_atomically(runtime, removed_world), "section-owned room without world occupancy rejects atomically")
+	expect(runtime.restore_snapshot(empty) and runtime.peeping_room_service.is_empty(), "absent legacy section clears previous nonempty service on valid load")
+	finish("Peeping room save")
@@ -0,0 +1,283 @@
+#!/usr/bin/env python3
+"""P13 reference evidence: read-only verification by default; collection is Root-only."""
+import argparse
+import ast
+import inspect
+import json
+import os
+import re
+import stat
+import types
+from pathlib import Path
+import shutil
+import sys
+
+sys.dont_write_bytecode = True
+import run_all_tests as shared
+
+PROTOCOL = 'guarded-p13-reference-v1'
+CANONICAL_EVIDENCE = 'p13-reference-native-uid-corrected'
+NEW_TESTS = [
+    'tests/special/test_peeping_room_geometry.gd',
+    'tests/special/test_peeping_room_reference.gd',
+    'tests/special/test_peeping_room_evidence.gd',
+    'tests/special/test_peeping_room_save.gd',
+    'tests/special/test_peeping_room_runtime.gd',
+]
+ROSTER = NEW_TESTS + [
+    'tests/s1/test_construction_service.gd',
+    'tests/s1/test_world_service.gd',
+    'tests/s1/test_path_service.gd',
+    'tests/s1/test_runtime_world_construction.gd',
+    'tests/supply/test_supply_save_migration.gd',
+    'tests/transport/test_transport_save.gd',
+    'tests/environment/test_runtime_weather.gd',
+    'tests/s6/test_runtime_snapshot_serialization.gd',
+    'tests/s6/test_runtime_save_lifecycle.gd',
+    'tests/supply/test_mimi_purchase_quote.gd',
+]
+
+
+def uid_plan(refs):
+    return {name + '.uid': {'owner': name, 'owner_sha256': pin['sha256'],
+                             'file_type': 'regular'}
+            for name, pin in sorted(refs.items())
+            if name.endswith('.gd') and name + '.uid' not in refs
+            and (name.startswith('tests/special/')
+                 or name == 'scripts/special/peeping_room_service.gd')}
+
+
+def uid_snapshot(stage, source, plan):
+    """Accept exactly the source inventory and finite native UID plan."""
+    actual = shared.inventory(stage, stage=True)
+    shared.require(set(actual) == set(source) | set(plan), 'exact source and planned UID set')
+    shared.require({n: actual[n] for n in source} == source, 'original source/settings unchanged')
+    seen = set()
+    for name in source:
+        if name.endswith('.uid'):
+            raw = (stage / name).read_bytes().rstrip(b'\r\n')
+            shared.require(raw not in seen, 'existing project UID collision')
+            seen.add(raw)
+    result = {}
+    for name, binding in plan.items():
+        path = stage / name
+        shared.require(stat.S_ISREG(path.lstat().st_mode) and not path.is_symlink()
+                       and path.stat().st_nlink == 1, 'ordinary generated UID')
+        raw = path.read_bytes()
+        shared.require(re.fullmatch(rb'uid://[a-z0-9]{1,13}\n', raw) is not None,
+                       'complete canonical UID bytes')
+        shared.require(raw.rstrip(b'\n') not in seen, 'generated UID collision')
+        seen.add(raw.rstrip(b'\n'))
+        shared.require(stat.S_ISREG((stage / binding['owner']).lstat().st_mode)
+                       and shared.sha(stage / binding['owner']) == binding['owner_sha256'],
+                       'UID owner content binding')
+        result[name] = dict(binding, bytes=len(raw), raw_bytes=list(raw),
+                            sha256=shared.sha(path), text=raw.decode('ascii'))
+    return result
+
+
+def install_uid_policy(namespace):
+    """Specialize private globals; shared and P18 functions remain untouched."""
+    original_collect, original_seal = namespace['collect'], namespace['seal']
+    state = {}
+
+    def reports(stage, expected, previous, requested):
+        shared.require(not requested and not previous, 'P13 has no generated reports')
+        snapshot = uid_snapshot(stage, state['source'], state['plan'])
+        if state['accepted'] is None:
+            shared.require(state['phase'] == 'import', 'UID generation only during import')
+            state['accepted'] = snapshot
+            expected.update({n: {'bytes': p['bytes'], 'sha256': p['sha256']}
+                             for n, p in snapshot.items()})
+        shared.require(snapshot == state['accepted'], 'sealed UID bytes unchanged')
+        return shared.declared_reports(stage, expected, previous, requested)
+
+    phase_globals = dict(vars(shared), declared_reports=reports)
+    execute = types.FunctionType(shared.execute_phase.__code__, phase_globals)
+
+    def phase(*args):
+        stage, out, label = args[1:4]
+        state['phase'] = label
+        if label == 'import':
+            shared.require(shared.inventory(stage, stage=True) == state['source'],
+                           'original stage before import')
+            before = {}
+            shared.write(out / 'uid-plan.json', state['plan'])
+        else:
+            before = uid_snapshot(stage, state['source'], state['plan'])
+            shared.require(before == state['accepted'], 'UID set before phase unchanged')
+        row = execute(*args)
+        after = uid_snapshot(stage, state['source'], state['plan'])
+        shared.require(after == state['accepted'], 'UID set after phase unchanged')
+        shared.write(out / (label + '-uids.json'), {'before': before, 'after': after})
+        return row
+
+    namespace['shared'] = types.SimpleNamespace(**dict(vars(shared), execute_phase=phase))
+
+    def collect(args, root, out, refs, *rest):
+        state.update(source=namespace['content_map'](refs), plan=uid_plan(refs), accepted=None)
+        return original_collect(args, root, out, refs, *rest)
+
+    def seal(out, refs, engine, contract_sha):
+        shared.write(out / 'accepted-uids.json', state['accepted'])
+        return original_seal(out, refs, engine, contract_sha)
+
+    def retained(stage, source, out):
+        plan = namespace['read_json'](out / 'uid-plan.json')
+        shared.require(plan == uid_plan(source), 'independently derived exact UID plan')
+        accepted = uid_snapshot(stage, source, plan)
+        shared.require(namespace['read_json'](out / 'accepted-uids.json') == accepted,
+                       'retained raw UID bytes and owner bindings')
+        for label in ['import', 'parse'] + [str(i).zfill(3) for i in range(len(ROSTER))]:
+            shared.require(namespace['read_json'](out / (label + '-uids.json')) ==
+                           {'before': {} if label == 'import' else accepted, 'after': accepted},
+                           'all phase UID before/after seals')
+        return True
+
+    namespace.update(collect=collect, seal=seal, uid_retained=retained)
+
+
+def protocol_core():
+    """Reuse P18's complete guarded core without editing or copying its runner.
+
+    P18 predates configurable protocol/roster constants. Specialize its three
+    entry functions' identity literals and explicit roster cardinalities, plus
+    one retained-stage comparison for the finite UID policy. The local phase
+    adapter retains every original shared gate and seals its accepted sidecars.
+    Fail closed if an upstream function changes any of these adapter sites.
+    Both runner sources remain bound by the whole selected source map.
+    """
+    core = shared.module('p13_p18_core', shared.HERE / 'run_p18_relationship_tests.py')
+    namespace = dict(vars(core), ROSTER=ROSTER, __file__=__file__)
+    replacements = {
+        'guarded-p18-v2': PROTOCOL,
+        'tools/run_p18_relationship_tests.py': 'tools/run_p13_reference_tests.py',
+        'exact seven unique tests': 'exact unique P13 roster',
+        'exact nine phases': 'exact P13 phase count',
+        'all nine captured engines': 'all P13 captured engines',
+    }
+    cardinalities = {
+        'len(set(ROSTER)) == 7': 'len(set(ROSTER)) == len(ROSTER)',
+        'len(phases) == 9': 'len(phases) == len(ROSTER) + 2',
+        "len(tests) == 7": 'len(tests) == len(ROSTER)',
+    }
+
+    class Specialize(ast.NodeTransformer):
+        def __init__(self):
+            self.identities = 0
+            self.counts = 0
+            self.summary = 0
+
+        def visit_Constant(self, node):
+            if isinstance(node.value, str) and node.value in replacements:
+                self.identities += 1
+                return ast.copy_location(ast.Constant(replacements[node.value]), node)
+            return node
+
+        def visit_Compare(self, node):
+            expression = ast.unparse(node)
+            if expression in cardinalities:
+                self.counts += 1
+                return ast.copy_location(ast.parse(cardinalities[expression], mode='eval').body, node)
+            return self.generic_visit(node)
+
+        def visit_Dict(self, node):
+            for index, key in enumerate(node.keys):
+                if isinstance(key, ast.Constant) and key.value == 'actual_suites':
+                    shared.require(isinstance(node.values[index], ast.Constant)
+                                   and node.values[index].value == 7, 'upstream suite summary unchanged')
+                    node.values[index] = ast.parse('len(ROSTER)', mode='eval').body
+                    self.summary += 1
+            return self.generic_visit(node)
+
+    expected = {'collect': (2, 0, 0), 'seal': (1, 0, 0), 'verify': (6, 3, 1)}
+    for name, counts in expected.items():
+        adapter = Specialize()
+        tree = adapter.visit(ast.parse(inspect.getsource(getattr(core, name))))
+        shared.require((adapter.identities, adapter.counts, adapter.summary) == counts,
+                       'unchanged upstream adaptation sites: ' + name)
+        if name == 'verify':
+            old = "shared.inventory(confined(out, 'stage'), stage=True) == source"
+            matches = [node for node in ast.walk(tree)
+                       if isinstance(node, ast.Compare) and ast.unparse(node) == old]
+            shared.require(len(matches) == 1, 'unchanged retained-stage UID adapter site')
+
+            class Retained(ast.NodeTransformer):
+                def visit_Compare(self, node):
+                    if ast.unparse(node) == old:
+                        return ast.copy_location(ast.parse(
+                            "uid_retained(confined(out, 'stage'), source, out)", mode='eval').body, node)
+                    return self.generic_visit(node)
+
+            tree = Retained().visit(tree)
+        exec(compile(ast.fix_missing_locations(tree), str(shared.HERE / 'run_p18_relationship_tests.py'), 'exec'), namespace)
+    install_uid_policy(namespace)
+    return namespace
+
+
+def main(argv=None):
+    argv = list(sys.argv[1:] if argv is None else argv)
+    parser = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
+    parser.add_argument('--output')
+    modes = parser.add_mutually_exclusive_group()
+    modes.add_argument('--collect', action='store_true', help='Root only; fresh native collection')
+    modes.add_argument('--prepare-only', action='store_true')
+    seen, index = set(), 0
+    while index < len(argv):
+        flag = argv[index]
+        shared.require(flag in ('--output', '--collect', '--prepare-only', '--help')
+                       and flag not in seen, 'unknown, duplicate or malformed flag')
+        seen.add(flag)
+        if flag == '--output':
+            index += 1
+            shared.require(index < len(argv) and argv[index] and not argv[index].startswith('--'), 'output value required')
+        index += 1
+    args = parser.parse_args(argv)
+    shared.require(not args.collect or args.output is not None, 'Root collection requires explicit --output')
+    if args.output is None:
+        base = os.environ.get('BUILD_OUTPUT_DIR')
+        shared.require(bool(base) and Path(base).is_absolute(), 'absolute BUILD_OUTPUT_DIR required')
+        args.output = str(Path(base) / CANONICAL_EVIDENCE)
+    args.timeout = 1200  # unchanged guarded core timeout; not a product value
+    core = protocol_core()
+    root = shared.HERE.parent
+    out = core['plain_path'](args.output)
+    refs = shared.source_refs(root)
+    shared.require(len(set(ROSTER)) == len(ROSTER) and set(ROSTER).issubset(shared.roster(root)), 'complete unique discovered roster')
+    markers = shared.module('p13_exact_markers', shared.HERE / 'strict_test_markers.py')
+    contract_path = root / 'docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json'
+    contract_sha = shared.sha(contract_path)
+    contracts = markers.load_contracts(contract_path)
+    shared.require(all(name in contracts for name in ROSTER), 'complete marker roster')
+    policy = shared.read(shared.SUPPORT / 'suite-policy.json')
+    shared.policy_coverage(ROSTER, refs, policy)
+    for test in ROSTER:
+        shared.phase_policy(test, Path(refs[test]['path']), policy['suite_policies'])
+    for test in NEW_TESTS:
+        shared.require(contracts[test]['source_sha256_at_schema_audit'] == refs[test]['sha256'], 'new strict source-hashed marker')
+    parse_paths = ['res://' + name for name in sorted(refs) if name.endswith('.gd')]
+    if args.prepare_only:
+        ancestor = out.parent
+        while not ancestor.exists():
+            ancestor = ancestor.parent
+        free = shutil.disk_usage(ancestor).free
+        size = sum(pin['bytes'] for pin in refs.values())
+        print(json.dumps(dict(protocol=PROTOCOL, roster=ROSTER, source_files=len(refs),
+            source_bytes=size, free_bytes=free, conservative_required_bytes=size + shared.MIN_SPACE,
+            capacity_available=free >= size + shared.MIN_SPACE, parse_paths=len(parse_paths),
+            future_native_phases=len(ROSTER) + 2, actual_checks=None, engines=0, stages=0,
+            formal_acceptance=False, original_unit_complete=False)))
+        return 0
+    if args.collect:
+        shared.require(not out.exists() and out.parent.is_dir(), 'fresh output with existing parent required')
+        shared.require(not out.is_relative_to(root), 'private collection outside source tree')
+        return core['collect'](args, root, out, refs, markers, contracts, policy, contract_path, contract_sha, parse_paths)
+    return core['verify'](out, refs, markers, contracts, policy, contract_sha, parse_paths)
+
+
+if __name__ == '__main__':
+    try:
+        raise SystemExit(main())
+    except (AssertionError, OSError, ValueError, KeyError, TypeError) as error:
+        print(type(error).__name__ + ': ' + str(error), file=sys.stderr)
+        raise SystemExit(1)
Author	SHA1	Message	Date
Agent Control Runner	1875b032b7	Merge commit '806de25068bc423136063791afcea811d251ee1b' into HEAD	2026-10-17 19:59:18 +09:00
Takeshi	6e17cae5c9	docs: pin full P19 reachability review pass before normal integration	2026-10-17 19:58:25 +09:00
Takeshi	b81f9f2860	docs: retain P19 whole-review findings and same-task repair status	2026-10-17 19:50:02 +09:00
Agent Control Runner	806de25068	P19-03-TABLE: P19-03 分岐の到達性：原7名×3ルートの全到達表と未制作欠損監査	2026-10-17 19:49:30 +09:00
Takeshi	c5e2087dde	docs: record P19 validated submission and verified checkout recovery	2026-10-17 19:39:40 +09:00
Agent Control Runner	e0420d57a3	P19-03-TABLE: P19-03 分岐の到達性：原7名×3ルートの全到達表と未制作欠損監査	2026-10-17 19:24:10 +09:00
Takeshi	8ca9263fee	docs: register Opus-selected original P19 reachability audit scope	2026-10-17 19:16:06 +09:00
Takeshi	1b07b87d37	docs: close reviewed P13 backend batch through normal final integration	2026-10-17 19:05:58 +09:00
Agent Control Runner	65f07bf5ea	Merge commit 'a7e3069b167511b3194242b3403fbcc35244a526' into HEAD	2026-10-17 19:01:21 +09:00
Agent Control Runner	a7e3069b16	P13-02-CODE1: P13-02 背面対象参照・占有・保存の非描写機構（全原成果の一部、加算なし）	2026-10-17 17:21:43 +09:00
Agent Control Runner	27fc5f0544	P13-02-CODE1: P13-02 背面対象参照・占有・保存の非描写機構（全原成果の一部、加算なし）	2026-10-17 17:13:56 +09:00
Agent Control Runner	e930a1dedf	P13-02-CODE1: P13-02 背面対象参照・占有・保存の非描写機構（全原成果の一部、加算なし）	2026-10-17 17:03:48 +09:00