Merge commit '806de25068bc423136063791afcea811d251ee1b' into HEAD

autoload/simulation_runtime.gd

@@ -20,6 +20,7 @@ const OPERATING_EXPENSE_ACCOUNT := &"OPERATING_EXPENSE"
 const AUTHORITY_FINE_ACCOUNT := &"AUTHORITY_FINE_EXPENSE"
 const WAGE_EXPENSE_ACCOUNT := &"WAGE_EXPENSE"
 const RUNTIME_SNAPSHOT_VERSION := 14
+const PeepingRooms := preload("res://scripts/special/peeping_room_service.gd")
 const AUTO_PURCHASE_RUNTIME_SNAPSHOT_VERSION := 14
 const EVENT_THREAT_RUNTIME_SNAPSHOT_VERSION := 13
 const MIMI_PURCHASE_RUNTIME_SNAPSHOT_VERSION := 15
@@ -97,6 +98,7 @@ const DEFENSE_COMMAND_TYPES: Array[StringName] = [
 var definition_registry := DefinitionRegistry.new()
 var command_queue := CommandQueue.new()
 var id_generator := StableIdGenerator.new()
+var peeping_room_service := PeepingRooms.new()
 var domain_events := DomainEventStream.new()
 var world_service := WorldService.new()
 var path_service := PathService.new()
@@ -233,6 +235,7 @@ func initialize(clock: SimulationKernel, state: Variant, seed := DEFAULT_WORLD_S
 	_hired_staff_candidate_ids.clear()
 	command_queue = CommandQueue.new()
 	id_generator = StableIdGenerator.new()
+	peeping_room_service = PeepingRooms.new()
 	domain_events = DomainEventStream.new()
 	world_service = WorldService.new()
 	path_service = PathService.new()
@@ -253,6 +256,7 @@ func initialize(clock: SimulationKernel, state: Variant, seed := DEFAULT_WORLD_S
 	_initialize_s5_defense()
 	construction_service = ConstructionService.new(world_service, construction_resource_state)
 	construction_service.current_minute = _clock.absolute_minute
+	peeping_room_service.configure(world_service, facility_service, construction_service, path_service, id_generator)
 	_connect_construction_signals()
 	var initial_infrastructure_ok := _initialize_infrastructure_services()
 	_next_command_id = 1
@@ -298,6 +302,8 @@ func initialize(clock: SimulationKernel, state: Variant, seed := DEFAULT_WORLD_S
 	register_command_executor(&"build_facility", Callable(self, "_execute_build_facility"))
 	register_command_executor(&"cancel_construction", Callable(self, "_execute_cancel_construction"))
 	register_command_executor(&"demolish_facility", Callable(self, "_execute_demolish_facility"))
+	for command_type: StringName in [&"peeping_room_validate", &"peeping_room_place", &"peeping_room_relink", &"peeping_room_record_evidence"]:
+		register_command_executor(command_type, Callable(self, "_execute_peeping_room"))
 	register_command_executor(&"set_elevator_operation", Callable(self, "_execute_set_elevator_operation"))
 	register_command_executor(&"start_excavation", Callable(self, "_execute_start_excavation"))
 	register_command_executor(&"pause_excavation", Callable(self, "_execute_pause_excavation"))
@@ -565,6 +571,8 @@ func create_snapshot() -> Dictionary:
 	}
 	if PurchaseQuoteV2.has_history(owned_systems[&"runtime"]):
 		owned_systems[&"runtime"][&"runtime_schema_version"] = MIMI_PURCHASE_RUNTIME_SNAPSHOT_VERSION
+	if not peeping_room_service.is_empty():
+		owned_systems[&"runtime"][&"special_peeping_rooms"] = peeping_room_service.create_snapshot()
 	# Every component above returns detached containers. Transfer this fresh
 	# tree into the envelope instead of deep-copying all component snapshots a
 	# second time. Keep generic capture's caller-owned-extra contract unchanged.
@@ -666,6 +674,8 @@ func _restore_snapshot_internal(snapshot: Dictionary, recovery_mode: bool) -> bo
 			runtime_current_keys.append(&"facility_cleanliness")
 		if runtime_schema_version >= AUTO_PURCHASE_RUNTIME_SNAPSHOT_VERSION:
 			runtime_current_keys.append(&"auto_purchase_plans")
+		if runtime_data.has(&"special_peeping_rooms"):
+			runtime_current_keys.append(&"special_peeping_rooms")
 		if not _dictionary_has_exact_canonical_keys(runtime_data, runtime_current_keys) \
 				or typeof(runtime_data.get(&"runtime_schema_version", null)) != TYPE_INT \
 				or typeof(runtime_data.get(&"world_seed", null)) != TYPE_INT \
@@ -1290,6 +1300,16 @@ func _restore_snapshot_internal(snapshot: Dictionary, recovery_mode: bool) -> bo
 	var restored_next_id := int(runtime_data.get(&"next_command_id", 0))
 	if restored_next_id <= 0:
 		return false
+	var restored_peeping_rooms := PeepingRooms.new()
+	restored_peeping_rooms.configure(restored_world, restored_facilities, restored_construction, restored_path, restored_id_generator)
+	if runtime_data.has(&"special_peeping_rooms"):
+		if not runtime_data[&"special_peeping_rooms"] is Dictionary:
+			return false
+		for raw_key: Variant in runtime_data:
+			if raw_key == &"special_peeping_rooms" and typeof(raw_key) != TYPE_STRING_NAME:
+				return false
+	if not restored_peeping_rooms.restore_section(runtime_data.get(&"special_peeping_rooms", null), restored_minute):
+		return false
 	if not SimulationSnapshot.restore(snapshot, _clock, _state):
 		return false
 	world_seed = restored_world_seed
@@ -1297,6 +1317,7 @@ func _restore_snapshot_internal(snapshot: Dictionary, recovery_mode: bool) -> bo
 	_staffing_projection_enabled = restored_staffing_projection
 	command_queue = restored_queue
 	id_generator = restored_id_generator
+	peeping_room_service = restored_peeping_rooms
 	domain_events = restored_domain_events
 	_rng_streams = restored_streams
 	world_service = restored_world
@@ -5546,6 +5567,7 @@ func _connect_facility_signals() -> void:
 		return
 	facility_service.instance_registered.connect(Callable(self, "_on_cleanliness_facility_registered"))
 	facility_service.instance_unregistered.connect(Callable(self, "_on_cleanliness_facility_unregistered"))
+	facility_service.instance_unregistered.connect(Callable(self, "_on_peeping_target_removed"))
 	facility_service.facility_state_changed.connect(Callable(self, "_on_facility_state_changed"))
 	facility_service.service_started.connect(Callable(self, "_on_service_started"))
 	facility_service.service_interrupted.connect(Callable(self, "_on_service_interrupted"))
@@ -10817,6 +10839,7 @@ func _on_excavation_completed(report: Dictionary) -> void:
 	))
 
 func _on_facility_demolished(instance_id: StringName, refund: Dictionary) -> void:
+	peeping_room_service.target_removed(instance_id)
 	if not mana_network_service.get_node(instance_id).is_empty():
 		mana_network_service.unregister_node(instance_id)
 	if facility_service.has_instance(instance_id):
@@ -10831,6 +10854,31 @@ func _on_facility_demolished(instance_id: StringName, refund: Dictionary) -> voi
 		0
 	))
 
+func _on_peeping_target_removed(instance_id: StringName) -> void:
+	peeping_room_service.target_removed(instance_id)
+
+func _execute_peeping_room(command: SimulationCommand) -> CommandResult:
+	var payload := command.payload
+	var report: Dictionary
+	if command.command_type == &"peeping_room_place":
+		report = PeepingRooms.result(&"BUILD_DEFINITION_PENDING_D04")
+	elif command.command_type == &"peeping_room_validate":
+		if typeof(payload.get(&"origin")) != TYPE_VECTOR3I or typeof(payload.get(&"footprint", Vector2i(2, 1))) != TYPE_VECTOR2I or typeof(payload.get(&"target_instance_id", &"")) not in [TYPE_STRING, TYPE_STRING_NAME]:
+			report = PeepingRooms.result(&"INVALID_PAYLOAD")
+		else:
+			report = peeping_room_service.validate_placement(payload[&"origin"], payload.get(&"footprint", Vector2i(2, 1)), StringName(payload.get(&"target_instance_id", &"")))
+	else:
+		var key: StringName = &"target_instance_id" if command.command_type == &"peeping_room_relink" else &"source_event_key"
+		if typeof(payload.get(&"room_id")) not in [TYPE_STRING, TYPE_STRING_NAME] or typeof(payload.get(key, &"")) not in [TYPE_STRING, TYPE_STRING_NAME]:
+			report = PeepingRooms.result(&"INVALID_PAYLOAD")
+		elif command.command_type == &"peeping_room_relink":
+			report = peeping_room_service.relink(StringName(payload[&"room_id"]), StringName(payload.get(key, &"")))
+		else:
+			report = peeping_room_service.record_evidence(StringName(payload[&"room_id"]), StringName(payload.get(key, &"")), _runtime_event_minute())
+	if report[&"ok"]:
+		return CommandResult.succeeded(command.command_id, report)
+	return CommandResult.failed(CommandResult.Code.VALIDATION_FAILED, command.command_id, String(report[&"reason"]), report)
+
 func _on_ledger_transaction_posted(transaction_id: StringName, _entries: Array) -> void:
 	if _operations_flushing_economy_notifications.has(transaction_id):
 		return

docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json

@@ -3734,6 +3734,61 @@
         "path": "docs/spec/acceptance/P23-03.json",
         "scope": "component and read-only observation only; native unexecuted; whole unit blocked"
       }
+    },
+    {
+      "test": "tests/special/test_peeping_room_geometry.gd",
+      "template": "Peeping room geometry: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "103d85f83e1e97a8637892504264275eef23f172eeec56c94e5c022d81bf6945",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
+    },
+    {
+      "test": "tests/special/test_peeping_room_reference.gd",
+      "template": "Peeping room reference: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "188b00a60f7aefda69dc4973f1de9c14447a0d4bcdd1257a2eabe7c4782e4caf",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
+    },
+    {
+      "test": "tests/special/test_peeping_room_evidence.gd",
+      "template": "Peeping room evidence: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "390e0032d14de9a8875ced163a922341ce655744200d78b4ffa776d42c4f8c2a",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
+    },
+    {
+      "test": "tests/special/test_peeping_room_save.gd",
+      "template": "Peeping room save: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "ba0e7644277477c1821135cae6d6fd533651799c6f9bd8c43ccf45e63b96c63c",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
+    },
+    {
+      "test": "tests/special/test_peeping_room_runtime.gd",
+      "template": "Peeping room runtime: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "924efd34414c12a325a1b700f799aef0396de9f15441fd88a3608292ff221657",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
     }
   ],
   "unknown_roster_suite_policy": "refuse, explicitly review its source/schema before accepting",

docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261017/ACTUAL_LATEST29_FORMAL_REVIEW.json

@@ -0,0 +1,31 @@
+{
+  "task_id": "P04-01",
+  "commit": "2dde7596a87c43f7bf0bf704b7479f2fa06a5b1c",
+  "status": "blocked",
+  "summary": "The repair29 documents describe the current code accurately but leave the required ordering rules undefined. The D05 candidate's source references match the current product (product1338): FacilityService._prepare_service_for_tick:853-874 checks RELATED_FACILITY_INACTIVE before NO_POWER, and the cited runtime functions are at 5743/7553/8482/8577/8738/9804/11785. The submission itself states that D05 items (a) power vs closure/dependency precedence, (b) destruction vs completion, (c) exit vs completion and (d) which day a 00:00 sale belongs to are pending an owner decision. P04-01 requires the order across 閉店/停電/破壊/退出/課金/シフト交代/00:00決算 to be stated ('順序を明記'). That cannot be met while these mandatory rules are only a recommended 'keep current behavior' candidate that nobody has approved. Several final steps are also unfinished, and CURRENT_STATUS.md says the unit is incomplete (13/88 unchanged). The passing p04-acceptance check is mechanical (it confirms an index exists and does not approve the rules), so it is not enough for pass. The blocker is undecided rules (spec insufficient), which needs an owner decision, so the status is blocked.",
+  "acceptance_ids": [
+    "P04-01"
+  ],
+  "findings": [
+    {
+      "severity": "high",
+      "message": "Mandatory ordering rules are undefined. The order between power stop and closure/dependency, between destruction and completion/charging, between exit and completion, and which day a 00:00 sale belongs to are pending. D05_REMAINING_ORDER_CANDIDATE.md/.json offers only Option A (keep current behavior), which has not been approved. P04-01 requires the order to be stated explicitly ('順序を明記'), and code behavior is not authority, so acceptance cannot be granted. An owner decision is needed (spec insufficient → blocked)."
+    },
+    {
+      "severity": "high",
+      "message": "Under current behavior, Option (b) allows an incident-driven destruction in the same tick to follow a completion and charge (B4a: 25G charged, then destroyed). Whether this conflicts with the 'no charging while stopped' (停止中課金なし) criterion has not been settled. A D05 destruction rule is required."
+    },
+    {
+      "severity": "medium",
+      "message": "The checker's destruction_stop rule (tools/check_p04_order_evidence.py:49) points to BASELINE:183, which covers mana depletion, not destruction. The authority reference does not match the domain. The repair is deferred until D05 is approved, so the 破壊 domain still has no valid authority link."
+    },
+    {
+      "severity": "medium",
+      "message": "No final validation has been run on the final source and checker. Full178 ran with checker f5, not the current a61, and no full1339 run exists. tests/business/test_required_kitchen.gd differs from the version that run used. The support53cb rebind, final source/config/input/environment binding, formal review, integration (P04 first, then support) and any nativeWindows conditions are all still pending."
+    },
+    {
+      "severity": "low",
+      "message": "S4 NO_POWER evidence comes from a direct disconnect_nodes call and does not represent global mana depletion, which appears only in the B1 combined diagnostic run. The documents say this correctly, but the scope of the power-stop evidence is limited."
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261017/CURRENT_ACCEPTANCE_STATUS.json

@@ -0,0 +1,62 @@
+{
+  "observed_at": "2026-10-17T16:30:38.746525+09:00",
+  "original_packages": 30,
+  "original_units": 88,
+  "formally_completed": 14,
+  "new_credit": 0,
+  "plan_id": "P04-01",
+  "state": "in_progress",
+  "runner_project": "the-tree-p04-01",
+  "runner_state": "repair_pending",
+  "repairs": 29,
+  "max_repairs": null,
+  "submitted": "2dde7596a87c43f7bf0bf704b7479f2fa06a5b1c",
+  "candidate": null,
+  "worktree_clean_at_observation": true,
+  "active_worker": false,
+  "current_main_at_audit": "565fd805079d8c446f29e30c57979242561113ea",
+  "acceptance_unchanged": {
+    "domains": [
+      "閉店",
+      "停電",
+      "破壊",
+      "退出",
+      "課金",
+      "シフト交代",
+      "00:00決算"
+    ],
+    "safety": [
+      "停止中課金0",
+      "二重決算0",
+      "予約の孤立0"
+    ],
+    "conditions": "all15 + EV, original frozen rules unchanged",
+    "required_gates": [
+      "exact final source/checker applicability",
+      "required final full regression",
+      "independent whole review",
+      "ordinary prepare-integration / integration / final",
+      "ledger reflection"
+    ]
+  },
+  "latest_commander": "ea12167cffff444596c0c36caa700a26",
+  "latest_formal_review": "275d1fd64fff4d5782c6f7667fc1e031",
+  "no_duplicate_repair": true,
+  "remaining": [
+    "owner choices for destruction order and midnight-sale day, plus explicit disposition of reason label and command/AI exit",
+    "after actual answers, normal batched checker destruction-authority pin / registry / approval record / stale current metadata correction",
+    "final gates as listed; previous full178 f5 receipt is not full final checker a61 evidence; no relabeling"
+  ],
+  "already_corrected_per_actual_opus": [
+    "raw joins",
+    "canonical getter contract explanation",
+    "candidate HEAD fixtures",
+    "schema2 index",
+    "S4r28",
+    "Local8",
+    "r22 collection"
+  ],
+  "owner_response_pending": true,
+  "approval_not_inferred": true,
+  "whole_acceptance": false
+}

docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261017/CURRENT_STATUS_REPAIR29.md

@@ -0,0 +1,31 @@
+# P04-01 current status — repair29
+
+Worker checks: SOURCE-READY / NOTRUN. No probes or tests were run by this worker.
+
+This canonical table overrides creation-time NOT RUN / pending-execution entries in REPAIR22–28, their status/validation records, and the runbooks (including S4_ROOT_RUN.md). Those files are historical and remain untouched. It does not relabel an old run as execution of repair29.
+
+`B` = `/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build`.
+
+| Item | Canonical status | Exact-version evidence |
+| --- | --- | --- |
+| Current native product / main | Root-measured `5f6bc11d` / `9b1a18c1` | Product1338 at B/audit-support/p04-r17-full-inputs-r01/product; current SHA256 inventory in REPAIR29_STATIC_SOURCE.json. Old deb11300 is not current. |
+| S4 r28 | Root-measured 4/4 PASS; import/parse/Writer/Reader PIDs49940,50044,50078,50105 all ended; guards0; cleanup0 | B/p04-s4-native-r28; B/audit-support/p04-root-fb8b-s4-r01/native.result.json. Full controls in that same support directory. |
+| Local8 | Root-measured PASS | B/audit-support/p04-root-fb8b-local-r01: bulk, negative, applicability, native, series, encoder, join, roles result/stdio records. |
+| Collection | Root-measured r22 collected, no native re-run claimed | B/audit-support/p04-raw-collect-r22/MANIFEST.json and s1/s2a/s2b/s3/s4.json. |
+| Index | Root-measured schema2, missing_conditions=[], all15 conditions + EV mechanically verified | B/p04-evidence/index.json and generation-invocation.json; local-r01 index/checker output. This is not D05 approval. |
+| Registered validation on fb8b7919 | Root-measured PASS,28.095s | B/audit-support/p04-root-fb8b-local-r01/registered-validation.result.json and stdout log. Does not establish final repair29 validation or acceptance. |
+| Full178 | Root-measured178 suites /21615 checks PASS used checker f5, **not a61** | B/audit-support/p18-regression-support-final-r01/native-full178/runner-ended.json and source-start.json; exact receipt remains preserved. Checker f5 SHA256 `f5b44827958f2ae352fe5c4bc3a1ffd4211ec7a41fc4c0759c8b954891662324`. |
+| Full1339 against a61 | **No such full run exists** | a61 SHA256 `a61c5b496e656f60c66898e42500bc9a2d45f947690ce8f5f19a03984ebbc850`. Local8 and registered validation are separate evidence. |
+| Worker repair29 | SOURCE-READY / NOTRUN | Static source/line/registration/SHA256 inspection only. No tests, probes, Git, engine, Runner or agents. |
+| Owner D05 | Pending a–d, candidate only | D05_REMAINING_ORDER_CANDIDATE.md/json; A01, dependency hold and18:00 remain approved. |
+| Original unit | **Incomplete;13/88 unchanged** | Mechanical PASS does not approve unknown mandatory priorities, replace independent review, or integrate the unit. |
+
+Proof hashes for the exact collection/index/full receipt/validation and current source are in [REPAIR29_STATIC_SOURCE.json](REPAIR29_STATIC_SOURCE.json). Applicable source/config/input/environment joins stay in the immutable schema2 index and raw collection; no raw is normalized, spliced, regenerated or relabelled here.
+
+Product reuse requires exact applicability: the178 suites do not execute the Python checker and the316-file GDScript parse roster excludes it. Static comparison with the preserved full178 selected_source_map found one test-source difference, tests/business/test_required_kitchen.gd (full178 3a9c92f8…, current product5dcc86d6…), and no game-source difference. Preserve the Runner applicability binding for this test; do not claim all1338 selected product hashes match that full178 receipt or byte-identical full1339 validation against a61. Preserve the f5 full178 receipt and all historical partial/full outputs separately.
+
+Remaining Runner steps: independent review of these documents, then Root obtains owner decisions (or explicit non-mandatory rulings) for D05 a–d. Unknown mandatory rules stay pending. Any destruction authority pin/registry or other approved implementation change follows a normal repair. The support53cb normal registered rebind, final full run on the final source/checker, final source/config/input/environment binding, formal independent review and integration remain Runner work. Integration order is **P04 first, then support on main9b (`9b1a18c1`)**. NativeWindows obligations remain individually pending if required. No criterion is waived and no extra original unit is counted.
+
+Known authority/scope gaps: destruction_stop binds BASELINE:183 (mana depletion, not destruction); explicit D05 destruction rule required before normal pin repair. S4 NO_POWER was induced by direct disconnect_nodes; global depletion appears only in B1 combined diagnostic. Preserve these distinctions even though the mechanical index passes.
+
+Changed files in repair29 (all under this directory): ORDER_AUDIT.md; order-audit.json; D05_REMAINING_ORDER_CANDIDATE.md; D05_REMAINING_ORDER_CANDIDATE.json; CHECKER_PROTOCOL.md; EVIDENCE_COLLECTION.md; P04_ORDER_EVIDENCE_PROTOCOL.json; CURRENT_STATUS.md; REPAIR29_STATIC_SOURCE.json. Product/checker/registry, native footprint, staged inputs, raw and historical runbooks are unchanged.

docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261017/D05_REMAINING_ORDER_CANDIDATE.json

@@ -0,0 +1,130 @@
+{
+  "task_id": "P04-01",
+  "revision": "repair29",
+  "status": "approval candidate only; SOURCE-READY / NOTRUN",
+  "approval": null,
+  "apply_to_product_or_checker": false,
+  "review_flow": "Root asks owner after review. This document neither requests approval from worker nor records it.",
+  "proof_legend": {
+    "R": "B/audit-support/p04-raw-collect-r22",
+    "I": "B/p04-evidence/index.json schema2",
+    "pins": "REPAIR29_STATIC_SOURCE.json; R/MANIFEST.json and I raw_references/versions"
+  },
+  "choices": [
+    {
+      "id": "a",
+      "topic": "Power vs closure/dependency",
+      "status": "pending D05",
+      "observation": {
+        "status": "observed-current",
+        "behavior": "RELATED_FACILITY_INACTIVE selected before NO_POWER; both pause service with no charge.",
+        "source": "FacilityService _prepare_service_for_tick:853–874, phase FACILITY_COMPLETION after MANA projection",
+        "proof": "Root-measured R/s4.json isolated NO_POWER; R/s3.json B1 combined RELATED diagnostic; REPAIR29_STATIC_SOURCE.json source pins"
+      },
+      "inputs": "Same service and minute, related facility inactive and power unavailable; include direct closure separately under D-034.",
+      "A": {
+        "recommended": true,
+        "rule": "Keep current RELATED-first reason selection.",
+        "outcome": "Service held, progress/payment paused, reservation and serviceID retained.",
+        "side_effects": "Reason reports dependency while both causes apply; no new hold limit.",
+        "dependencies": "Approved dependency hold, D-034 direct closure, existing MANA-before-completion order."
+      },
+      "B": {
+        "rule": "NO_POWER wins reason selection when both conditions fail.",
+        "outcome": "Same no-charge hold safety; reason reports power.",
+        "side_effects": "Reason/event and recovery-precedence semantics would change; concrete implementation and exact-version proof require normal repair.",
+        "dependencies": "Must retain no-charge while either legitimate hold persists; preserve approved dependency reservation/identity behavior."
+      }
+    },
+    {
+      "id": "b",
+      "topic": "Destruction",
+      "status": "pending D05",
+      "observation": {
+        "status": "observed-current",
+        "behavior": "Command destruction in APPLY precedes completion. Incident destruction in INCIDENTS follows it; B4a shows25G charge then destruction in same tick.",
+        "source": "Runtime _process_tick_commands:5743, _advance_facilities:8482, _advance_defense:8577 / _apply_defense_outcome_boundary:9804",
+        "proof": "Root-measured R/s3.json B4a/B4b; REPAIR29_STATIC_SOURCE.json"
+      },
+      "inputs": "A service due for completion in a minute with command or incident destruction of its facility.",
+      "A": {
+        "recommended": true,
+        "rule": "Keep command-before-completion and incident-after-completion behavior.",
+        "outcome": "Command destruction prevents completion; incident may follow a valid completion/charge that minute; next-tick broken failure/release remains.",
+        "side_effects": "Completion and destruction can coexist in one tick as B4a; not a universal no-sale-on-destruction rule.",
+        "dependencies": "P04 stopped-charge and orphan-reservation safety; explicit D05 destruction authority required."
+      },
+      "B": {
+        "rule": "An incident in the same minute suppresses that minute completion (or voids it if already posted).",
+        "outcome": "No retained completion/sale for the incident-destruction minute.",
+        "side_effects": "Would require preemption or atomic reversal of completion, inventory, payment and rewards; no unapproved numbers or refund amounts supplied.",
+        "dependencies": "Owner must specify the suppress/void transaction semantics; preserve idempotency, no orphan reservations and approved shift/hold rules; normal implementation and new proof required."
+      }
+    },
+    {
+      "id": "c",
+      "topic": "Exit",
+      "status": "pending D05",
+      "observation": {
+        "status": "observed-current",
+        "behavior": "Command exit APPLY before completion/charging; AI PLANNED_EXIT after them; LEAVING despawns later.",
+        "source": "Runtime _execute_leave_facility_queue:7553; _advance_guest_ai_decisions:8738–8762",
+        "proof": "Root-measured R/s3.json B2a/B2b/B3 and B1 departure history; source pins REPAIR29_STATIC_SOURCE.json"
+      },
+      "inputs": "Exit command or AI exit due at a minute with a completion-ready service. Current AI PLANNED_EXIT applies to DECIDING guests; do not assume it preempts an active service.",
+      "A": {
+        "recommended": true,
+        "rule": "Keep current command/AI distinction and state predicates.",
+        "outcome": "Command leave/release happens first; eligible AI planned exit follows completion/charging and queue processing.",
+        "side_effects": "AI due time alone does not universally cancel current-minute completion; later despawn remains separate.",
+        "dependencies": "D-034, reservation ownership/release, phase6 completion before phase10 AI."
+      },
+      "B": {
+        "rule": "An exit due this minute preempts completion.",
+        "outcome": "Applicable due exits release/cancel before completion and no completion sale occurs for that preempted service.",
+        "side_effects": "Changes eligibility for exit and service cancellation; would change simultaneous completion/payment observations.",
+        "dependencies": "Owner must define applicable due-exit states; preserve no orphan reservation, no duplicate charge and approved dependency/shift behavior; normal repair and exact proof required."
+      }
+    },
+    {
+      "id": "d",
+      "topic": "Cost time/day attribution beyond A01 and18:00",
+      "status": "pending D05",
+      "observation": {
+        "status": "observed-current",
+        "behavior": "Sale dated at post-increment minute. At00:00 TIME_BOUNDARIES settlement/upkeep precede completions;00:00 sales go to new day because daily-close period_end is exclusive.",
+        "source": "Kernel advance_one_minute:122; Runtime _apply_service_transaction:11785 /11826–11838; coordinator _process_daily_close:1125 /1136",
+        "proof": "Root-measured R/s2a.json paid midnight/replay; I C; REPAIR29_STATIC_SOURCE.json"
+      },
+      "inputs": "Service completes on calendar boundary; account period ends at boundary minute. A01 ownership upkeep and18:00 shift interval remain fixed.",
+      "A": {
+        "recommended": true,
+        "rule": "Keep post-increment sale time and new-day attribution for00:00 sales.",
+        "outcome": "Closing day excludes boundary-minute completion; new day receives sale.",
+        "side_effects": "Closing summary is finalized before those sales; upkeep ownership rule unchanged.",
+        "dependencies": "Exclusive daily-close interval, sale timestamp, idempotent close/replay; P04 mandatory timing/attribution separate from D04/P05 numeric cost math."
+      },
+      "B": {
+        "rule": "Boundary-minute sales belong to closing day.",
+        "outcome": "Closing day includes those sales.",
+        "side_effects": "Would require a distinct accounting attribution or revised boundary transaction sequencing; affects daily summaries/reconciliation/replay. No numeric cost policy is invented.",
+        "dependencies": "Owner must settle attribution mechanics and same-boundary replay; preserve A01 and18:00, all P04 safety criteria; normal repair and exact-version proof required."
+      }
+    }
+  ],
+  "bundle": {
+    "label": "accept current-behavior A for a-d",
+    "status": "pending D05",
+    "recommended": true,
+    "coupling_notes": [
+      "a preserves the approved hold and no-charge safety independent of reason priority.",
+      "b and c use the same completion boundary: commands before, incidents and AI after. Changing either requires separate applicability and replay checks.",
+      "d relies on TIME_BOUNDARIES before completion; changing attribution can affect the transaction history used by b/c and settlement idempotency.",
+      "A01 ownership upkeep, dependency hold and18:00 interval are already approved and are excluded from renewed approval.",
+      "Owner may explicitly rule some remaining items non-mandatory; no such ruling exists here. Unknowns stay pending; mandatory acceptance is never relaxed."
+    ]
+  },
+  "authority_gap": "destruction_stop currently binds BASELINE:183, which is mana depletion, not destruction authority. Explicit D05 destruction rule required. Pin/registry repair only after approval through normal repair.",
+  "power_scope": "S4 NO_POWER uses direct disconnect_nodes; not proof of global depletion, which exists only in B1 combined diagnostic.",
+  "original_unit_complete": false
+}

docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261017/D05_REMAINING_ORDER_CANDIDATE.md

@@ -0,0 +1,93 @@
+# D05 remaining order candidate — repair29
+
+**Approval candidate only. SOURCE-READY / NOTRUN.** Root asks the owner after review. Nothing is applied to product, checker or registry; observation is not approval. A01 midnight ownership upkeep, dependency hold and18:00 are already approved and are not re-asked.
+
+Structured choices: [D05_REMAINING_ORDER_CANDIDATE.json](D05_REMAINING_ORDER_CANDIDATE.json). Source path/line/SHA256 pins: [REPAIR29_STATIC_SOURCE.json](REPAIR29_STATIC_SOURCE.json); phase map: [ORDER_AUDIT.md](ORDER_AUDIT.md). R = B/audit-support/p04-raw-collect-r22; I = B/p04-evidence/index.json. These are Root-measured exact-version proof references, with raw/provenance pins in R/MANIFEST.json, I and the static manifest.
+
+## (a) Power vs closure/dependency — pending D05
+
+**Observed-current:** RELATED_FACILITY_INACTIVE selected before NO_POWER; both pause service with no charge. Source: FacilityService _prepare_service_for_tick:853–874, phase FACILITY_COMPLETION after MANA projection. Proof: Root-measured R/s4.json isolated NO_POWER; R/s3.json B1 combined RELATED diagnostic; REPAIR29_STATIC_SOURCE.json source pins.
+
+**Inputs:** Same service and minute, related facility inactive and power unavailable; include direct closure separately under D-034.
+
+**Option A (recommended; keep current behavior):** Keep current RELATED-first reason selection.
+
+- Outcomes: Service held, progress/payment paused, reservation and serviceID retained.
+- Side effects: Reason reports dependency while both causes apply; no new hold limit.
+- Dependencies: Approved dependency hold, D-034 direct closure, existing MANA-before-completion order.
+
+**Option B:** NO_POWER wins reason selection when both conditions fail.
+
+- Outcomes: Same no-charge hold safety; reason reports power.
+- Side effects: Reason/event and recovery-precedence semantics would change; concrete implementation and exact-version proof require normal repair.
+- Dependencies: Must retain no-charge while either legitimate hold persists; preserve approved dependency reservation/identity behavior.
+
+## (b) Destruction — pending D05
+
+**Observed-current:** Command destruction in APPLY precedes completion. Incident destruction in INCIDENTS follows it; B4a shows25G charge then destruction in same tick. Source: Runtime _process_tick_commands:5743, _advance_facilities:8482, _advance_defense:8577 / _apply_defense_outcome_boundary:9804. Proof: Root-measured R/s3.json B4a/B4b; REPAIR29_STATIC_SOURCE.json.
+
+**Inputs:** A service due for completion in a minute with command or incident destruction of its facility.
+
+**Option A (recommended; keep current behavior):** Keep command-before-completion and incident-after-completion behavior.
+
+- Outcomes: Command destruction prevents completion; incident may follow a valid completion/charge that minute; next-tick broken failure/release remains.
+- Side effects: Completion and destruction can coexist in one tick as B4a; not a universal no-sale-on-destruction rule.
+- Dependencies: P04 stopped-charge and orphan-reservation safety; explicit D05 destruction authority required.
+
+**Option B:** An incident in the same minute suppresses that minute completion (or voids it if already posted).
+
+- Outcomes: No retained completion/sale for the incident-destruction minute.
+- Side effects: Would require preemption or atomic reversal of completion, inventory, payment and rewards; no unapproved numbers or refund amounts supplied.
+- Dependencies: Owner must specify the suppress/void transaction semantics; preserve idempotency, no orphan reservations and approved shift/hold rules; normal implementation and new proof required.
+
+## (c) Exit — pending D05
+
+**Observed-current:** Command exit APPLY before completion/charging; AI PLANNED_EXIT after them; LEAVING despawns later. Source: Runtime _execute_leave_facility_queue:7553; _advance_guest_ai_decisions:8738–8762. Proof: Root-measured R/s3.json B2a/B2b/B3 and B1 departure history; source pins REPAIR29_STATIC_SOURCE.json.
+
+**Inputs:** Exit command or AI exit due at a minute with a completion-ready service. Current AI PLANNED_EXIT applies to DECIDING guests; do not assume it preempts an active service.
+
+**Option A (recommended; keep current behavior):** Keep current command/AI distinction and state predicates.
+
+- Outcomes: Command leave/release happens first; eligible AI planned exit follows completion/charging and queue processing.
+- Side effects: AI due time alone does not universally cancel current-minute completion; later despawn remains separate.
+- Dependencies: D-034, reservation ownership/release, phase6 completion before phase10 AI.
+
+**Option B:** An exit due this minute preempts completion.
+
+- Outcomes: Applicable due exits release/cancel before completion and no completion sale occurs for that preempted service.
+- Side effects: Changes eligibility for exit and service cancellation; would change simultaneous completion/payment observations.
+- Dependencies: Owner must define applicable due-exit states; preserve no orphan reservation, no duplicate charge and approved dependency/shift behavior; normal repair and exact proof required.
+
+## (d) Cost time/day attribution beyond A01 and18:00 — pending D05
+
+**Observed-current:** Sale dated at post-increment minute. At00:00 TIME_BOUNDARIES settlement/upkeep precede completions;00:00 sales go to new day because daily-close period_end is exclusive. Source: Kernel advance_one_minute:122; Runtime _apply_service_transaction:11785 /11826–11838; coordinator _process_daily_close:1125 /1136. Proof: Root-measured R/s2a.json paid midnight/replay; I C; REPAIR29_STATIC_SOURCE.json.
+
+**Inputs:** Service completes on calendar boundary; account period ends at boundary minute. A01 ownership upkeep and18:00 shift interval remain fixed.
+
+**Option A (recommended; keep current behavior):** Keep post-increment sale time and new-day attribution for00:00 sales.
+
+- Outcomes: Closing day excludes boundary-minute completion; new day receives sale.
+- Side effects: Closing summary is finalized before those sales; upkeep ownership rule unchanged.
+- Dependencies: Exclusive daily-close interval, sale timestamp, idempotent close/replay; P04 mandatory timing/attribution separate from D04/P05 numeric cost math.
+
+**Option B:** Boundary-minute sales belong to closing day.
+
+- Outcomes: Closing day includes those sales.
+- Side effects: Would require a distinct accounting attribution or revised boundary transaction sequencing; affects daily summaries/reconciliation/replay. No numeric cost policy is invented.
+- Dependencies: Owner must settle attribution mechanics and same-boundary replay; preserve A01 and18:00, all P04 safety criteria; normal repair and exact-version proof required.
+
+## Bundle: accept current-behavior A for a-d
+
+Recommended candidate, not approved.
+
+- a preserves the approved hold and no-charge safety independent of reason priority.
+- b and c use the same completion boundary: commands before, incidents and AI after. Changing either requires separate applicability and replay checks.
+- d relies on TIME_BOUNDARIES before completion; changing attribution can affect the transaction history used by b/c and settlement idempotency.
+- A01 ownership upkeep, dependency hold and18:00 interval are already approved and are excluded from renewed approval.
+- Owner may explicitly rule some remaining items non-mandatory; no such ruling exists here. Unknowns stay pending; mandatory acceptance is never relaxed.
+
+destruction_stop currently binds BASELINE:183, which is mana depletion, not destruction authority. Explicit D05 destruction rule required. Pin/registry repair only after approval through normal repair.
+
+S4 NO_POWER uses direct disconnect_nodes; not proof of global depletion, which exists only in B1 combined diagnostic.
+
+P04 timing/attribution remains mandatory; D04/P05 numeric cost math is separate. No acceptance criterion is relaxed. P04 remains incomplete; original13/88 unchanged.

docs/plans/original-completion-2026-10-02/execution/p13-02/ACTUAL_OPUS_INDEPENDENT_SELECTION.json

@@ -0,0 +1,7 @@
+{
+  "action": "wait",
+  "task_id": "P04-01",
+  "reason": "P04-01: WAIT. Waiting for the owner's Japanese answers on D05 (a) power vs closure/dependency precedence, (b) destruction vs completion, (c) exit vs completion, (d) which day a 00:00 sale belongs to. Do not re-ask, do not request-repair (repair30), do not redo tests.\n\nINDEPENDENT NEXT ORIGINAL UNIT (new contract proposal; no matching project in the 20-project inventory, nothing started here): P13-02 「背面条件と対象参照」.\n- Work: 覗き部屋の対象背面、通路寸断、対象喪失と証拠IDを状態として実装する。\n- Acceptance (unchanged): 対象撤去、重複収集、停止、途中保存で状態と参照が整合する。\n- Package P13 acceptance also applies: special rules hold at build time and run time; invalid placement and actions on lost targets rejected; event state saved; implemented scope reported separately from unmade content.\n- Package deps: P09, P12 (both incomplete; bounded progress is allowed, not unit closure). Decisions D04/D05/D08.\n- Original sources: B-2.5 (built behind VIPルーム/風俗個室/脱衣所 on back layer; its cells are no longer usable as back corridor; 記録係 collects 脅迫ネタ); B-8.3 (VIP/浴場/風俗の裏限定・裏通路を寸断); B-10.6 (覗き部屋 2x1, back-only).\n\nSOURCE GAP (main 2f3884b): no peeping/覗き code, data or tests in scripts/autoload/data/resources/tests/tools.\n- FacilityCatalog (scripts/data/facility_catalog.gd) has no peeping_room.\n- No recorder role; no back-side target reference; no evidence-ID ledger; no target-loss state.\n- Existing targets: public_bath, adult_private_room. VIP suite is undefined (P10-01); vip_private_salon must not substitute.\n- Rejected alternatives:\n  - P07-01: weather_timeline has no rain/fog effects or natural generation (D04 values).\n  - P12-01: security_station only checks the guard role (simulation_runtime.gd:6631); guard effects need D04 values.\n  - P15-02: cleric witness/morale rule needs an undecided definition of \"witness\" plus a D04 magnitude.\n  - P16: wages/severance/sale amounts are D04.\n\nMECHANISMS POSSIBLE WITH APPROVED INPUTS vs PENDING:\n- Possible:\n  - placement check: room cells must lie entirely behind a single allowed, completed target's FRONT footprint on the BACK layer;\n  - corridor blocking as an occupancy rule with no automatic bypass;\n  - stable target reference;\n  - target removal sets TARGET_LOST; no automatic recovery, explicit relink only (D03 pattern / kitchen relink);\n  - idempotent evidence IDs keyed by (room, target, source_event_key);\n  - no collection while stopped (NO_POWER/closed/under construction);\n  - versioned save section with legacy-absent migration and atomic rejection of malformed data.\n- Pending (record, do not invent):\n  - build cost/materials/build_minutes/upkeep (D04); FacilityDefinition requires them, so no normal palette registration;\n  - recorder role and staffing, collection trigger/rate (D04/D08/P16);\n  - VIP suite target (P10-01);\n  - D05 ordering;\n  - blackmail use and camera UI (P19/P24).\n\nBRIEF: Add a separate PeepingRoomService connected from the Runtime; no rewrite of the whole runtime.\n- Reuse world_service.cells_for_footprint/validate_occupancy/occupy and construction_service.validate_placement.\n- Copy the weather snapshot-version pattern (simulation_runtime.gd:29/520/663/1248).\n- Hook facility removal so the target is marked lost.\n- Add commands for placement validation, explicit relink and evidence recording.\n- No product values, no content, no Clock/P04 change.\n\nALLOWED PATHS:\n- scripts/special/peeping_room_service.gd (new)\n- autoload/simulation_runtime.gd (bounded connection: save section, removal hook, commands)\n- scripts/core/save_service.gd (only if needed)\n- tests/special/test_peeping_room_*.gd\n- docs/plans/original-completion-2026-10-02/execution/p13-02/**\n\nLOCAL TESTS:\n- Valid public_bath and adult_private_room backs.\n- Rejections: front layer, partial overlap, non-target, incomplete target, VIP pending.\n- Corridor cell conflict and path disconnect.\n- Target demolition leads to TARGET_LOST; rebuilt target does not auto-relink; explicit relink works.\n- Duplicate event key yields a single evidence ID.\n- Stopped room rejects collection.\n- Save/restore round-trip, legacy save without the section, malformed restore leaves state unchanged.\n- Existing suites: construction/world/path, tests/supply/test_supply_save_migration.gd, tests/transport/test_transport_save.gd, tests/environment/test_runtime_weather.gd.\n\nREUSE / FULL REVIEW:\n- No completed P18/P23 rerun.\n- Full regression only on the exact final version, then a separate Claude review and normal integration.\n- No partial credit (formal 14/88 and original 30/88 unchanged); do not claim P13 or the backend complete.\n\nOwner must register the new task contract before any run.",
+  "codex_model": "gpt-6.1-sol",
+  "codex_model_reason": "P04-01 itself stays in wait, so no worker runs for it. For the proposed P13-02 batch: one new state service plus a bounded runtime connection. It follows existing patterns (weather snapshot versioning, kitchen explicit relink, world occupancy), uses no numeric balancing and no native code. Sol is sufficient on quality, time and usage. Switch to Astra only if review finds the runtime save-version change crosses many existing save paths."
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_IMPLEMENTATION.md

@@ -0,0 +1,148 @@
+# P13-02-CODE1 implementation handoff
+
+This is non-graphic state/reference/occupancy/save machinery only. It does not
+complete P13-02, grant partial credit, or change the original 30/88 denominator
+or formal 14/88 count. Native execution and acceptance are pending.
+
+## Declared scope and verification
+
+Before editing, the worker declared the new service, bounded Runtime hooks,
+special tests, narrow runner, marker additions and this documentation. SaveService
+was conditional on an exact-key dependency; inspection found
+`SupplyAutoPurchaseQuotePlans.valid_runtime_format` has that dependency.
+Only allowed paths were edited. No asset, UI, content, model, policy, clock phase,
+or P04 change is involved.
+
+The full ignored `build/owner-handoff/ACTUAL_OPUS_RUN_DECISION.json` was read and
+left untouched. Base HEAD is `1e8d4ea88876865a72547ff0edf43ed5b0e74c7e`.
+The immutable spec was not edited. Its SHA-256 without the terminal newline is
+the registered `8ea65f2eefedc772c08170186f5cd03ac017432f4b069ade4f9210d4215c2d43`;
+the on-disk file including that newline is
+`988d6e18a49372549863cd433432c2852c962fa64b138e490361c023e80249dc`.
+
+Worker verification: Python AST parsing/compilation only, without executing the
+runner or importing its dependencies; source/JSON/hash review. GDScript parsing,
+all tests, `--prepare-only`, native collection and regression were **not run**.
+No check totals or native success receipts are claimed. No git writes, commits,
+branches, other agents, integration or Runner operations were performed.
+
+## Service and commands
+
+`PeepingRoomService` is a separate RefCounted service with no content or UI.
+All command executors use the existing Runtime queue; queue/history receipts
+remain normal Runtime behavior even for rejected/read-only domain commands.
+
+| Command | Preconditions and result |
+| --- | --- |
+| `peeping_room_validate` | `origin: Vector3i`, optional `footprint: Vector2i` (2x1), optional `target_instance_id: String/StringName`. Pure domain validation. |
+| `peeping_room_place` | Always `BUILD_DEFINITION_PENDING_D04`; no occupancy, resource, room or ID mutation. |
+| `peeping_room_relink` | Existing `room_id`, explicit nonempty `target_instance_id`; full geometry and ownership validation excluding only the room's exact own occupancy. Leaves `LINKED`, stopped, `RELINKED_PENDING_RESUME`. |
+| `peeping_room_record_evidence` | Existing `room_id`, nonblank named `source_event_key`. Uses Runtime minute, never caller-supplied time. Checks stopped, target power, target closure/opening hours, completed construction authority, and lost target in that order. Otherwise rejects with `RECORDER_ELIGIBILITY_PENDING_D04_D08_P16`. Never writes the ledger. |
+
+Malformed command field types return `INVALID_PAYLOAD`. Missing/blank source keys
+return `SOURCE_EVENT_KEY_REQUIRED` before operational checks. Loss latches both
+`TARGET_LOST` and stopped, so collection after normal demolition returns `STOPPED`
+while the room's link/stop reason identifies `TARGET_LOST`. No resume command or
+automatic resume is defined. Power/closure guards read actual target conditions;
+they do not define special-room power demand, staffing or normal operation.
+
+Placement is exactly 2x1 BACK, fully behind a single completed FRONT
+`public_bath` or `adult_private_room`. It checks bounds/excavation, both real
+FacilityService and ConstructionService ownership, FRONT cells, World occupancy,
+and both World walkability and PathService membership. Exact rejection families:
+`WRONG_LAYER`, `WRONG_FOOTPRINT`, `OUT_OF_BOUNDS`, `NOT_EXCAVATED`,
+`TARGET_INCOMPLETE`, `TARGET_MISSING`, `PARTIAL_TARGET`, `MULTIPLE_TARGETS`,
+`TARGET_MISMATCH`, `TARGET_UNKNOWN`, `TARGET_NOT_ALLOWED`, `TARGET_WRONG_LAYER`,
+`CORRIDOR_CONFLICT`, `BACK_OCCUPIED`. The named `vip_suite` request returns
+`PENDING_P10_01`; `vip_private_salon` is not an allowed substitute.
+
+Any existing corridor cell conflicts. A proposed cut through a connected corridor
+is rejected before mutation, preserving the route; no reroute or bypass is
+invented. Accepted fixture cells were already nonwalkable and become occupied
+under `special_peeping_room`. No special-room construction weight/cost is assumed.
+
+Runtime demolition and FacilityService unregistration latch loss. Collection also
+detects missing FRONT occupancy/identity. Rebuilding the same cells produces a
+different construction ID and never silently reattaches rooms. Relink is explicit.
+
+## CONTROLLED_FIXTURE boundary
+
+Only service methods named `controlled_fixture_place`,
+`controlled_fixture_set_stopped`, and `controlled_fixture_record_evidence` create
+test rooms, enable fixture collection, or write evidence. They are labeled
+CONTROLLED_FIXTURE in code and tests. They have no command/palette registration,
+and no Runtime executor calls them. Test helpers disclose direct underground
+geometry setup and MIMI registration; those do not assert natural unlock/join or
+production eligibility. Target construction uses existing definitions/costs/times.
+
+Room IDs come from the existing StableIdGenerator's `peeping_room` counter.
+Evidence IDs encode the UTF-8 lengths and hex bytes of the full
+`(room_id, target_instance_id, source_event_key)` tuple. This is injective rather
+than delimiter concatenation or a hash with possible collisions. Replays return
+the existing ID with `duplicated=true` and retain the first minute. Evidence is
+only IDs, source key and minute. Room `target_history` retains prior bindings so
+relink does not orphan existing opaque evidence.
+
+## Save invariants
+
+Runtime versions remain 14 and 15, with version 15 only for existing v2 purchase
+history. Optional canonical StringName key `special_peeping_rooms` has section
+version 1 and exact keys `version`, `rooms`, `evidence`. Empty service state emits
+no key, preserving original snapshots. Absent sections restore empty only if no
+world occupancy uses the special kind or `peeping_room.` prefix. Thus removing
+the section from a current room-bearing save is rejected without a version bump.
+
+Restore stages the entire section against staged world, path, facilities,
+construction and ID generator before committing any Runtime state. It checks
+canonical keys/types, version, duplicate room/evidence identities, deterministic
+evidence tuple encoding, bounds/geometry, room/occupancy correspondence in both
+directions, generator high-water mark, known historical facility IDs, present
+target definition/geometry, loss/stopped coherence, and evidence room/history/time
+references. Null/present-empty sections are invalid; absence is the only empty
+encoding. Existing pending command/reference and schema migration checks remain.
+
+SaveService validates a present section through the same staged service validator,
+then supplies a shallow copy without this one key to the original purchase-format
+allowlist. No other keys are removed. The original format 1 (Runtime 1–14),
+format 2 (Runtime 15), manifest duplicate 15 and MIMI checks remain unchanged.
+
+## Verification handoff
+
+Five strict suites cover geometry/corridor, removal/relink, evidence/guards,
+typed atomic save corruption and physical format 1, and Runtime commands plus
+physical MIMI format 2. Tests use `var_to_bytes` for whole Runtime atomicity and
+roundtrip checks. New marker rows carry final test source hashes; prior rows and
+policy are unchanged. A helper under `tests/special/` is not a discovered suite.
+
+`tools/run_p13_reference_tests.py` defaults to read-only verification of
+`$BUILD_OUTPUT_DIR/p13-reference-native`, failing closed without an absolute
+environment path. Explicit `--output --collect` is for Root only. The strict flag
+parser rejects abbreviations, repeated flags, positional inputs and `=` aliases.
+`--prepare-only` is non-native but was not executed by this worker.
+
+The runner imports the existing P18 core by path. Since its three entry functions
+hardcode their label and seven/nine counts, a bounded AST adapter changes only
+protocol/runner identities, those explicit roster cardinalities, and diagnostic
+labels. It checks the exact adaptation-site counts and fails closed on drift.
+All confinement, inventory, JSON, sealing, source/engine/marker/policy binding,
+process, diagnostic, profile and cleanup gates are reused. It neither copies the
+whole runner nor modifies P18/helpers. The whole selected source map binds both
+runner sources. Phase count derives from `len(ROSTER) + 2`.
+
+Roster includes all five new suites and existing construction/world/path/runtime
+construction, supply migration, transport save, Runtime weather, snapshot
+serialization, save lifecycle and MIMI purchase suites. Receipts retain
+`formal_acceptance=false` and `original_unit_complete=false`.
+
+Root must perform serialized native collection with the allocation/private
+profile, then registered `p13-reference` validation, a separate actual Opus
+review, and the final exact-version required regression. Only those steps can
+establish execution results.
+
+## Still pending, without invented values
+
+D04 build/upkeep/build minutes and other product numbers; recorder staffing and
+natural triggers/rates D04/D08/P16; VIP suite P10-01; D05 transaction decisions
+(no tick-phase changes here); P19 evidence use and P24 camera UI; normal palette
+registration/construction/operation and natural production evidence; whole P13
+acceptance, final review/integration, and applicable native Windows conditions.

docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json

@@ -0,0 +1,65 @@
+{
+  "id": "P13-02-CODE1",
+  "parent_original_delivery_unit": "P13-02",
+  "parent_work": "覗き部屋の対象背面、通路寸断、対象喪失と証拠IDを状態として実装する。",
+  "parent_acceptance": "対象撤去、重複収集、停止、途中保存で状態と参照が整合する。",
+  "original_denominator": {
+    "packages": 30,
+    "units": 88,
+    "formal_complete_at_registration": 14,
+    "partial_credit": false
+  },
+  "whole_parent_acceptance": false,
+  "scope": "Non-graphic state/reference/occupancy/save machinery connected to real Runtime; no sexual depiction, camera content or blackmail action; this registered batch is not the whole original unit.",
+  "authority": [
+    {
+      "ref": "BASELINE:52-53",
+      "text": "Target FRONT VIP room/private room/changing area BACK; occupied room cells cannot be back corridor; recorder collects evidence."
+    },
+    {
+      "ref": "BASELINE:167-174",
+      "text": "VIP suite/public bath/private room explicitly peeping-compatible; restricted behind these target types and cuts back corridor."
+    },
+    {
+      "ref": "BASELINE:199-209",
+      "text": "Peeping room 2x1 BACK. Current public_bath/adult_private_room target definitions exist; missing VIP suite must remain missing, vip_private_salon is not a substitute."
+    }
+  ],
+  "implementation_requirements": [
+    "Introduce separate PeepingRoomService, bounded real Runtime wiring; no whole runtime rewrite.",
+    "Validate 2x1 BACK footprint entirely behind one allowed completed FRONT target, integrate existing construction/world occupancy rules; reject wrong layer, partial/multi-target overlap, unknown/missing/incomplete target and corridor conflicts.",
+    "Stable room/target identity with target removal/loss detection; reconstructed different target is not silently the old identity; explicit validated relink only, preserving stopped/no-auto-resume rules.",
+    "Idempotent evidence IDs bound to stable room/target/source event key; replay cannot duplicate or alias another target. Opaque state records only.",
+    "Collection rejects stopped/no-power/closed/under-construction/lost-target cases; do not create undefined natural trigger/rate/staffing eligibility.",
+    "Versioned Runtime snapshot section; genuinely legacy absent section migrates empty; current-schema missing/malformed/unknown/wrong-reference/duplicate data reject atomically with original whole Runtime untouched. Preserve all existing schema migrations and pending references.",
+    "No free production placement, bypassed build costs or arbitrary content-event injection exposed through new commands. Unknown build/upkeep/staff/collection values remain unset and unavailable; backend tests may use clearly labeled controlled fixtures. Normal palette registration and naturally collected production evidence are pending. Define command preconditions precisely; construction costs/definition and recorder eligibility cannot be silently invented.",
+    "Reuse existing guarded native harness logic for a strict narrow runner and add new test marker registrations without weakening prior marker/policy behavior. Do not rerun full regression during implementation."
+  ],
+  "required_local_coverage": [
+    "public_bath and adult_private_room valid geometry; VIP unavailable not substituted",
+    "wrong FRONT, partial/multiple target footprint, incomplete/missing target; corridor/path occupancy conflict/disconnection",
+    "target demolition/loss, rebuild different identity, explicit relink; reject collection after removal",
+    "same event replay one evidence ID; different room/target keys distinct and stable",
+    "stopped/no-power/closed/under-construction collection rejection",
+    "roundtrip exact typed state; legacy absence; current missing/malformed version/references/duplicates atomic unchanged",
+    "Runtime command/removal/save integration; existing construction/world/path/supply-save/transport-save/weather migrations impact coverage"
+  ],
+  "pending_not_invented": [
+    "D04 build/upkeep/build_minutes and related numbers",
+    "recorder role staffing and natural collection trigger/rate D04/D08/P16",
+    "VIP suite P10-01",
+    "D05 unresolved transaction rules; no tick-phase changes",
+    "P19 use of evidence and P24 camera UI",
+    "normal construction/operation/full parent acceptance, final whole review and applicable Windows conditions"
+  ],
+  "workflow": [
+    "Actual Opus commander confirms registered run and model; Runner worker only edits allowed paths.",
+    "Worker static/local preparation only; Root owns serialized native collection in allocation build with private profile and guarded process/cleanup receipts.",
+    "Registered validation reads/verifies complete native evidence, exact current selected source and marker/policy/engine/input/environment binding. Zero exit alone is not acceptance.",
+    "Separate actual Opus review, final exact-version required regression and ordinary integration/final; any backend completion never adds parent original-unit credit."
+  ],
+  "model_proposal": {
+    "codex": "gpt-6.1-sol",
+    "selected_by_actual_opus_run": "e65d48f5a7294378a81bb58dea00c605"
+  }
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/ACTUAL_AGGREGATE_READONLY_VERIFICATION.json

@@ -0,0 +1,18 @@
+{
+  "actual_suites": 184,
+  "missing_marker_paths": [],
+  "remaining_unexecuted_tests": [],
+  "available_marker_checks": 21903,
+  "actual_all_roster_checks": 21903,
+  "strict_accepted_checks": 21903,
+  "verified": true,
+  "composed": true,
+  "original_full_attempt_passed": false,
+  "whole_original_acceptance": false,
+  "parse_checks": 329,
+  "setup_phases": 2,
+  "owned_ended": 186,
+  "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "engines_started": 0,
+  "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/ACTUAL_CONTINUATION_CONTROLS.json

@@ -0,0 +1,73 @@
+{
+  "controller_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a",
+  "harness_sha256": "744177b243fb97ff7ad954880a433acf6a9b879c06d4ee51cfe02ed95be29422",
+  "cases": [
+    {
+      "case": "copytree string arguments create separate byte-exact support files",
+      "expected": "accept",
+      "actual": "accept"
+    },
+    {
+      "case": "exact whole private-profile move and readback",
+      "expected": "accept",
+      "actual": "accept"
+    },
+    {
+      "case": "absent empty startup profile explicitly retained",
+      "expected": "accept",
+      "actual": "accept"
+    },
+    {
+      "case": "reject unowned profile name",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject valid nonce at wrong canonical location",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject changed original profile",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject undeclared profile member",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject profile symlink",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject existing retention destination",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "large profile lossless compression entire readback",
+      "expected": "accept",
+      "actual": "accept"
+    },
+    {
+      "case": "reject compressed bytes changed",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject incomplete compressed member manifest",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject invalid archive hash",
+      "expected": "reject",
+      "actual": "reject"
+    }
+  ],
+  "passed": true,
+  "native_engines_started": 0
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/ACTUAL_INDEPENDENT_OPUS_REVIEW.json

@@ -0,0 +1,27 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "status": "pass",
+  "summary": "判定: pass。ただし対象は登録済みの限定バックエンド CODE1 のみです。親の P13-02 は完了していないままで、30/88・formal 14/88 の分母にも加算しません。\n\n【実装の照合（仕様のすべての要件・カバレッジ項目と突き合わせ）】\n- 構成: PeepingRoomService を独立サービスとして追加し、Runtime 側の接続は限定的です。\n  - 生成と読み込みのたびに構成し直し、施設登録解除と解体の両方で接続しています。\n  - コマンドは validate / place / relink / record_evidence の4種で、通常の実行キューを通ります。\n- 配置判定: 2x1 の BACK 配置が、許可された完成済み FRONT 対象1つの真裏に完全に収まるかを検査します。\n  - 拒否理由を網羅しています: 層違い、形状違い、範囲外、未掘削、建設中、対象なし、部分重なり、複数対象、対象不一致、不明対象、許可外対象、通路衝突（World の歩行可否と Path の両方で判定）、BACK 占有済み。\n  - vip_suite は PENDING_P10_01 として扱い、vip_private_salon を代用に使わないことを確認しました。\n- 対象の同一性:\n  - 撤去すると TARGET_LOST になり、停止状態に固定されます。\n  - 同じ位置に再建すると別の ID になり、自動で再リンクしません。\n  - 明示的な relink は配置判定をすべてやり直し、停止状態（RELINKED_PENDING_RESUME）のまま残ります。\n  - target_history に過去の対象 ID を残すため、既存の証拠が孤立しません。\n- 証拠 ID: (room, target, source_event_key) を長さ付き UTF-8 の hex で符号化しており、単射です。\n  - 同じイベントの再実行は同一 ID を返し、記録は増えません。\n  - 部屋や対象が違えば ID も別になり、取り違えは起きません。\n- 本番経路の封じ込め:\n  - 本番の記録は RECORDER_ELIGIBILITY_PENDING_D04_D08_P16 で拒否され、台帳を変えません。\n  - place は BUILD_DEFINITION_PENDING_D04 を返すだけです。テストで、ドメインイベントの受領が1件だけ発行され、それ以外の ID とドメインデータが変わらないことを確認しています。\n  - CONTROLLED_FIXTURE 用のメソッドは公開コマンドやパレットから呼べません。\n  - 停止中 / 無電力 / 閉店 / 建設中 / 対象喪失 の各ケースで収集を拒否します。\n- 保存:\n  - Runtime のバージョンは 14 / 15 のままで、format2 は MIMI15 の場合だけです。\n  - 新セクションは任意キーで、空のときは出力しません。セクションのない本物の旧形式セーブは空として移行します。\n  - 現行形式で不正なものは全体をそのまま保ったまま原子的に拒否し、元の Runtime を壊しません。対象は、セクション欠落 / null / バージョン / 未知キー / 重複 / 参照不正 / 時刻 / ID 上限 / 型 / 孤立占有、およびその逆方向の不整合で、テストの18変異ケースと孤立ケースで確認しています。\n  - SaveService は同じ検証器を通したうえで、購入用の許可キー一覧を元のまま維持しています。\n\n【検証証跡】\n- 登録済みの p13-reference 検証は exit 0 で通過しています（narrow 15 スイート / 863 チェック / 構文 329 / 終了 17）。\n- 全体の 184 スイート / 21903 チェックは合成検証です。\n  - 構成: 元の通し実行は ENOSPC で失敗しており、失敗のまま残っています。その前半58スイートを再検証し、後半126スイートを実際に実行した結果を組み合わせたものです。\n  - 結果: 読み取り専用の集計で verified / composed=true（ネイティブ終了 186 件、すべて一意）を、元の通し実行と対象コミットに紐付いた記録で確認しました。\n- 自己申告だけに依拠していません。\n\n【残る後続ゲート】\n- 最終版でのリグレッション、通常の統合と最終確定。\n- D04 / D08 / P16 の数値、記録係の配置、自然な収集トリガー、VIP（P10-01）、P19 / P24、通常のパレット登録、Windows 条件。",
+  "acceptance_ids": [
+    "P13-02-CODE1"
+  ],
+  "findings": [
+    {
+      "severity": "low",
+      "message": "create_snapshot は対象喪失を正規化しません（detect_target_loss は収集時にだけ遅延実行されます）。そのため、シグナルを経ずに対象が消えた場合は LINKED の部屋が残ります。こうして書かれたセーブは restore_section の配置判定で全体が拒否され、読み込めなくなります。現状、そのような経路は確認できませんでした（facility_service.restore_snapshot はシグナルを出さず、ロールバックは既存の対象を消しません）。ただし、スナップショット生成時に正規化するか、後続で防御策を入れることを推奨します。"
+    },
+    {
+      "severity": "low",
+      "message": "Runtime の schema バージョンが 5 未満（v1〜4）の旧形式に special_peeping_rooms があっても拒否されず、検証を通れば受理されます。仕様の「本物の旧形式はセクションなし」に照らすと、偽装された旧ペイロードを受け入れる余地がわずかにあります。中身は restore_section で厳密に検証されるため、実害は小さいと判断します。"
+    },
+    {
+      "severity": "low",
+      "message": "施設の寸法移行（prepare_facility_dimension_snapshot）で public_bath / adult_private_room の占有セルが変わると、LINKED の部屋の再検証に失敗し、移行全体が拒否されます。現在の部屋はテスト用フィクスチャでしか作れないため影響は限定的です。後続の本番配置の実装時に扱いを決める必要があります。"
+    },
+    {
+      "severity": "low",
+      "message": "「建設中なら収集を拒否」の分岐は、本番状態では到達できません。テストは ConstructionService を差し替えて確認しており、意味上の網羅としては人工的です。配置判定も、建物定義（D04）が未定のため construction_service.validate_placement（支持・重量の判定）を使っていません。いずれも仕様の「未定値を発明しない」範囲内として許容しますが、記録に残します。"
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/ACTUAL_SUFFIX_ENDED.json

@@ -0,0 +1,9 @@
+{
+  "passed": true,
+  "error": null,
+  "ended_unix_ns": 1792230973546897000,
+  "controller_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a",
+  "owner_runner_pid": 92258,
+  "original_full_attempt_passed": false,
+  "whole_original_acceptance": false
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/ACTUAL_SUFFIX_INPUT.json

@@ -0,0 +1,80 @@
+{
+  "source": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "original_import_and_parse_passed": 2,
+  "reusable_suites": 58,
+  "raw057_qualified_after_archival_recovery": true,
+  "original_owned_ended_pids": [
+    73903,
+    73987,
+    74026,
+    74052,
+    74079,
+    74092,
+    74125,
+    74151,
+    74171,
+    74194,
+    74212,
+    74236,
+    74256,
+    74284,
+    74327,
+    74632,
+    75319,
+    75331,
+    75368,
+    75392,
+    75429,
+    75453,
+    75466,
+    75555,
+    75577,
+    75603,
+    75619,
+    75654,
+    75687,
+    75932,
+    76254,
+    76409,
+    76434,
+    76455,
+    76480,
+    76487,
+    76566,
+    76851,
+    76898,
+    76931,
+    76945,
+    76973,
+    76989,
+    77012,
+    77035,
+    77087,
+    77108,
+    77120,
+    77143,
+    77158,
+    77179,
+    77206,
+    77240,
+    77253,
+    77277,
+    77297,
+    77325,
+    77340,
+    77364,
+    77382
+  ],
+  "original_checks": 10991,
+  "remaining_suites": 126,
+  "engine_runs": 0,
+  "whole_original_acceptance": false,
+  "original_full_attempt_passed": false,
+  "controller_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a",
+  "free_bytes": 4484616192,
+  "admission_required_bytes": 3467374666,
+  "root_owner_pid": 92258,
+  "run_id": "52bfe67d08e54acd9478d74d5b030293",
+  "started_unix_ns": 1792229968318418000,
+  "original_input_sha256": "24d10b3a91553df54b3b2fd4b1a57dce683cc72a55576e0c73c9e142b335ad40"
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/CURRENT_ACCEPTANCE_STATUS.json

@@ -0,0 +1,115 @@
+{
+  "at_jst": "2026-10-17T19:05:57.762697+09:00",
+  "plan_id": "P13-02",
+  "batch": "P13-02-CODE1",
+  "S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "original_packages": 30,
+  "original_units": 88,
+  "formally_completed": 14,
+  "new_credit": 0,
+  "normal_validation": "passed; exact S narrow15/863/329parse/17nativeended",
+  "actual_full": {
+    "actual_suites": 184,
+    "missing_marker_paths": [],
+    "remaining_unexecuted_tests": [],
+    "available_marker_checks": 21903,
+    "actual_all_roster_checks": 21903,
+    "strict_accepted_checks": 21903,
+    "verified": true,
+    "composed": true,
+    "original_full_attempt_passed": false,
+    "whole_original_acceptance": false,
+    "parse_checks": 329,
+    "setup_phases": 2,
+    "owned_ended": 186,
+    "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "engines_started": 0,
+    "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+  },
+  "formal_review": {
+    "state": "terminal_pass",
+    "run_id": "ead8e74b9683404d8cf3d97bca118726",
+    "model": "claude-opus-5-5",
+    "critical_high_medium": 0,
+    "low": 4,
+    "artifact": "ACTUAL_INDEPENDENT_OPUS_REVIEW.json"
+  },
+  "normal_integration_candidate": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "source_on_main": true,
+  "remaining_conditions": [
+    "Whole original P13-02 normal construction/recorder/natural triggers/approved quantities/VIP/UI/assets/Windows and all original conditions remain unaccepted; CODE1 has no new original-unit credit",
+    "Four low severity future-production defensive/migration/coverage observations retained from actual Opus review; no observed ordinary production path and no critical/high/medium finding",
+    "P04-01 remains next original formal closure when existing D05 owner choices arrive; independent next original-unit selection will be requested from actual Opus"
+  ],
+  "evidence": [
+    {
+      "path": "ACTUAL_AGGREGATE_READONLY_VERIFICATION.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-full-composed-readonly-verification-a7e3069.json",
+      "bytes": 562,
+      "sha256": "3a8be9f92c76d14dc1c9f6d387fad8e939d0d333a6f8d5903b53b8fc44ef584b"
+    },
+    {
+      "path": "ACTUAL_SUFFIX_INPUT.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-full-continuation-a7/controller-input.json",
+      "bytes": 1401,
+      "sha256": "81c3dcfdd092fde977c158482310f164a727a73dabea698e18807eeb585d4937"
+    },
+    {
+      "path": "ACTUAL_SUFFIX_ENDED.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-full-continuation-a7/controller-ended.json",
+      "bytes": 277,
+      "sha256": "b0759724f65175e01822b94ee731b3b9574c5098b82ce931e73e087fc5a89c65"
+    },
+    {
+      "path": "ACTUAL_CONTINUATION_CONTROLS.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-full-continuation-a7/CONTINUATION_STORAGE_CONTROLS.json",
+      "bytes": 1846,
+      "sha256": "96f47033ef95614426cb8646f7a4fbfedcb5af6bd95a0ab1e54a802d3eed77a6"
+    },
+    {
+      "path": "ACTUAL_INDEPENDENT_OPUS_REVIEW.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/ead8e74b9683404d8cf3d97bca118726/result.json",
+      "bytes": 6753,
+      "sha256": "cc12bb1011da2f3a21018da8fdde966a13e70dcf33ef7c83310dcf0ca08f4ec8"
+    },
+    {
+      "path": "FORMAL_VALIDATION.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/6df11a390bc44b48a10c916cbeab95c9-validation.json",
+      "bytes": 380,
+      "sha256": "d9e73b97bb173a75931a0263119ff6430a2049e204ca459fbb53ca04b8aa0e4a"
+    },
+    {
+      "path": "FORMAL_INTEGRATION.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/562e2bb9ca8b4f458d0cc011edd41cc4-integration.json",
+      "bytes": 381,
+      "sha256": "513ab79bd5fadafb929d5ad3201a8e9d5ff0e826eda37a80c831d82327940d8e"
+    },
+    {
+      "path": "FORMAL_FINAL.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/45fdaf3b82c84e1485ad0d4cc7bf993c-final.json",
+      "bytes": 375,
+      "sha256": "213af13d38587ff108802fc96f6c410af6e9bf66ab6bb683963af62d36ecae2f"
+    },
+    {
+      "path": "RUNNER_COMPLETED_TRACEABILITY.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/traceability/P13-02-CODE1.json",
+      "bytes": 3697,
+      "sha256": "c11f2f390bfe3222dc4e955fb001878ba5db03deafd1b85534299da758354250"
+    },
+    {
+      "path": "EXACT_INTEGRATED_FULL_REUSE_QUALIFICATION.json",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/coordinator-start-20261017/EXACT_C65F07B_FULL_REUSE_QUALIFICATION.json",
+      "bytes": 1487,
+      "sha256": "b5c4f52638b34be0c95030486560d1ce8ed83f48e855a2fddfef528e6e635721"
+    }
+  ],
+  "next_formal_original_unit": "P04-01 pending existing real-owner D05 choices; no duplicate request or fabricated approval",
+  "backend_batch_state": "completed",
+  "normal_main_base": "191ea3b4d1289144d8d31096f50fbd71435656c9",
+  "normal_final": {
+    "passed": true,
+    "commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+    "artifact": "FORMAL_FINAL.json"
+  },
+  "whole_original_acceptance": false
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/EXACT_INTEGRATED_FULL_REUSE_QUALIFICATION.json

@@ -0,0 +1,35 @@
+{
+  "S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "C": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "M": "191ea3b4d1289144d8d31096f50fbd71435656c9",
+  "candidate_worktree": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-integration-15cc1271",
+  "whole_selected_source_files": 1368,
+  "all_source_settings_assets_test_inputs_helpers_byte_equal": true,
+  "marker_policy_engine_roster_parse_default_player_equal": true,
+  "full_evidence_reuse_qualified": true,
+  "original_full_attempt_passed": false,
+  "whole_original_acceptance": false,
+  "aggregate": {
+    "actual_suites": 184,
+    "missing_marker_paths": [],
+    "remaining_unexecuted_tests": [],
+    "available_marker_checks": 21903,
+    "actual_all_roster_checks": 21903,
+    "strict_accepted_checks": 21903,
+    "verified": true,
+    "composed": true,
+    "original_full_attempt_passed": false,
+    "whole_original_acceptance": false,
+    "parse_checks": 329,
+    "setup_phases": 2,
+    "owned_ended": 186,
+    "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "engines_started": 0,
+    "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+  },
+  "actual_independent_review": "ead8e74b9683404d8cf3d97bca118726",
+  "critical_high_medium": 0,
+  "low_findings": 4,
+  "ownership_authority": "Existing explicit human main-update and commit/push permission only; no new SHA-specific human speech is claimed",
+  "time_ns": 1792231367426496000
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/FORMAL_FINAL.json

@@ -0,0 +1,14 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "kind": "final",
+  "checks": [
+    {
+      "id": "p13-reference",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/2add11628b67481495b3782fa64dee52",
+      "passed": true
+    }
+  ],
+  "passed": true
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/FORMAL_INTEGRATION.json

@@ -0,0 +1,14 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "kind": "integration",
+  "checks": [
+    {
+      "id": "p13-reference",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/19d3100d61564e3c9878624d2d8ea496",
+      "passed": true
+    }
+  ],
+  "passed": true
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/FORMAL_VALIDATION.json

@@ -0,0 +1,14 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "kind": "validation",
+  "checks": [
+    {
+      "id": "p13-reference",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/339d1c3cc94648aa94b00a750a5fa5ce",
+      "passed": true
+    }
+  ],
+  "passed": true
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/LOW_SEVERITY_FOLLOWUPS.json

@@ -0,0 +1,22 @@
+{
+  "source_review": "ead8e74b9683404d8cf3d97bca118726",
+  "scope": "Future normal production unlock and dimension-migration defensive handling; no mandatory CODE1 gate remains, parent P13-02 incomplete",
+  "findings": [
+    {
+      "severity": "low",
+      "message": "create_snapshot は対象喪失を正規化しません（detect_target_loss は収集時にだけ遅延実行されます）。そのため、シグナルを経ずに対象が消えた場合は LINKED の部屋が残ります。こうして書かれたセーブは restore_section の配置判定で全体が拒否され、読み込めなくなります。現状、そのような経路は確認できませんでした（facility_service.restore_snapshot はシグナルを出さず、ロールバックは既存の対象を消しません）。ただし、スナップショット生成時に正規化するか、後続で防御策を入れることを推奨します。"
+    },
+    {
+      "severity": "low",
+      "message": "Runtime の schema バージョンが 5 未満（v1〜4）の旧形式に special_peeping_rooms があっても拒否されず、検証を通れば受理されます。仕様の「本物の旧形式はセクションなし」に照らすと、偽装された旧ペイロードを受け入れる余地がわずかにあります。中身は restore_section で厳密に検証されるため、実害は小さいと判断します。"
+    },
+    {
+      "severity": "low",
+      "message": "施設の寸法移行（prepare_facility_dimension_snapshot）で public_bath / adult_private_room の占有セルが変わると、LINKED の部屋の再検証に失敗し、移行全体が拒否されます。現在の部屋はテスト用フィクスチャでしか作れないため影響は限定的です。後続の本番配置の実装時に扱いを決める必要があります。"
+    },
+    {
+      "severity": "low",
+      "message": "「建設中なら収集を拒否」の分岐は、本番状態では到達できません。テストは ConstructionService を差し替えて確認しており、意味上の網羅としては人工的です。配置判定も、建物定義（D04）が未定のため construction_service.validate_placement（支持・重量の判定）を使っていません。いずれも仕様の「未定値を発明しない」範囲内として許容しますが、記録に残します。"
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/RUNNER_COMPLETED_TRACEABILITY.json

@@ -0,0 +1,88 @@
+{
+  "contract": {
+    "id": "P13-02-CODE1",
+    "title": "P13-02 背面対象参照・占有・保存の非描写機構（全原成果の一部、加算なし）",
+    "requirement_ids": [
+      "P13-02"
+    ],
+    "acceptance_ids": [
+      "P13-02-CODE1"
+    ],
+    "spec_ref": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+    "base_commit": "1e8d4ea88876865a72547ff0edf43ed5b0e74c7e",
+    "worker": "codex",
+    "allowed_paths": [
+      "scripts/special/peeping_room_service.gd",
+      "autoload/simulation_runtime.gd",
+      "scripts/core/save_service.gd",
+      "tests/special/**",
+      "tools/run_p13_reference_tests.py",
+      "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json",
+      "docs/plans/original-completion-2026-10-02/execution/p13-02/**"
+    ],
+    "depends_on": [],
+    "resource_locks": [
+      "runtime-save-schema",
+      "special-target-reference",
+      "p13-reference-tests"
+    ],
+    "validation_ids": [
+      "p13-reference"
+    ],
+    "max_repair_attempts": null,
+    "spec_sha256": "8ea65f2eefedc772c08170186f5cd03ac017432f4b069ade4f9210d4215c2d43"
+  },
+  "implementation_commit": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "integration_commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "owner": "このチャットのユーザーによる既存の明示指示「mainの更新を明示的に許可します」「コミットすべき内容をコミットして。その上でpushして」に基づく継続許可。対象は全条件レビュー合格の登録CODE1と、この実C/M。新たなSHA指定の人間発言は主張しない。原P13-02の完了加算なし。",
+  "evidence": [
+    {
+      "id": 1,
+      "task_id": "P13-02-CODE1",
+      "kind": "validation",
+      "commit_sha": "e930a1dedff7ab4c4a94d274a2e0c55fc2b95829",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/212e4352722a442990b6fe923abe8f84-validation.json",
+      "passed": 0
+    },
+    {
+      "id": 2,
+      "task_id": "P13-02-CODE1",
+      "kind": "validation",
+      "commit_sha": "27fc5f05442ca3a2b0986a976b303cf0ef675f66",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/5526523400ff41b6aeacd0d6f8ffd9b9-validation.json",
+      "passed": 0
+    },
+    {
+      "id": 3,
+      "task_id": "P13-02-CODE1",
+      "kind": "validation",
+      "commit_sha": "a7e3069b167511b3194242b3403fbcc35244a526",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/6df11a390bc44b48a10c916cbeab95c9-validation.json",
+      "passed": 1
+    },
+    {
+      "id": 4,
+      "task_id": "P13-02-CODE1",
+      "kind": "review",
+      "commit_sha": "a7e3069b167511b3194242b3403fbcc35244a526",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/ead8e74b9683404d8cf3d97bca118726/result.json",
+      "passed": 1
+    },
+    {
+      "id": 5,
+      "task_id": "P13-02-CODE1",
+      "kind": "integration",
+      "commit_sha": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/562e2bb9ca8b4f458d0cc011edd41cc4-integration.json",
+      "passed": 1
+    },
+    {
+      "id": 6,
+      "task_id": "P13-02-CODE1",
+      "kind": "final",
+      "commit_sha": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/45fdaf3b82c84e1485ad0d4cc7bf993c-final.json",
+      "passed": 1
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-local-20261017/ACTUAL_RETAINED_UIDS.json

@@ -0,0 +1,209 @@
+{
+  "scripts/special/peeping_room_service.gd.uid": {
+    "owner": "scripts/special/peeping_room_service.gd",
+    "owner_sha256": "4dc02bc99f081d63a2518f69c960397d778d577b93d87d57bcac29bc6f108531",
+    "file_type": "regular",
+    "bytes": 20,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      98,
+      105,
+      51,
+      54,
+      102,
+      118,
+      112,
+      49,
+      106,
+      105,
+      105,
+      105,
+      118,
+      10
+    ],
+    "sha256": "3f045afc3c140886c70ec8494d6dcb012e6da645e8a3ff3c6488442ce63a9353",
+    "text": "uid://bi36fvp1jiiiv\n"
+  },
+  "tests/special/peeping_room_fixture.gd.uid": {
+    "owner": "tests/special/peeping_room_fixture.gd",
+    "owner_sha256": "0243b1d35e1fdd8aa085894a0ce1e5cd1a189e5c98fcb859f81b70ae75b98bed",
+    "file_type": "regular",
+    "bytes": 20,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      98,
+      48,
+      99,
+      51,
+      111,
+      117,
+      117,
+      113,
+      52,
+      50,
+      121,
+      99,
+      103,
+      10
+    ],
+    "sha256": "a74e5ef6d8959826919a648e8b5d82e96d1c73ff22cd6c1f216be8b5c4060a8a",
+    "text": "uid://b0c3ouuq42ycg\n"
+  },
+  "tests/special/test_peeping_room_evidence.gd.uid": {
+    "owner": "tests/special/test_peeping_room_evidence.gd",
+    "owner_sha256": "390e0032d14de9a8875ced163a922341ce655744200d78b4ffa776d42c4f8c2a",
+    "file_type": "regular",
+    "bytes": 20,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      100,
+      102,
+      116,
+      115,
+      107,
+      121,
+      49,
+      51,
+      112,
+      101,
+      48,
+      117,
+      106,
+      10
+    ],
+    "sha256": "26bbc1435bcda963b5866327b887096f798b1629c7984768c85bfb6175648ec5",
+    "text": "uid://dftsky13pe0uj\n"
+  },
+  "tests/special/test_peeping_room_geometry.gd.uid": {
+    "owner": "tests/special/test_peeping_room_geometry.gd",
+    "owner_sha256": "103d85f83e1e97a8637892504264275eef23f172eeec56c94e5c022d81bf6945",
+    "file_type": "regular",
+    "bytes": 19,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      52,
+      114,
+      52,
+      48,
+      102,
+      49,
+      107,
+      112,
+      106,
+      109,
+      118,
+      106,
+      10
+    ],
+    "sha256": "391b78806bc0bf759f00c778cb25dfaa97d47f6e309c3b302412c38123c5440c",
+    "text": "uid://4r40f1kpjmvj\n"
+  },
+  "tests/special/test_peeping_room_reference.gd.uid": {
+    "owner": "tests/special/test_peeping_room_reference.gd",
+    "owner_sha256": "188b00a60f7aefda69dc4973f1de9c14447a0d4bcdd1257a2eabe7c4782e4caf",
+    "file_type": "regular",
+    "bytes": 20,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      99,
+      110,
+      110,
+      111,
+      110,
+      53,
+      119,
+      111,
+      117,
+      102,
+      117,
+      114,
+      112,
+      10
+    ],
+    "sha256": "db8bfa98b7943dba15858ccaa6681bc430efd43f40f57de99117dc19c51ac417",
+    "text": "uid://cnnon5woufurp\n"
+  },
+  "tests/special/test_peeping_room_runtime.gd.uid": {
+    "owner": "tests/special/test_peeping_room_runtime.gd",
+    "owner_sha256": "924efd34414c12a325a1b700f799aef0396de9f15441fd88a3608292ff221657",
+    "file_type": "regular",
+    "bytes": 19,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      52,
+      110,
+      53,
+      119,
+      101,
+      108,
+      113,
+      102,
+      104,
+      100,
+      113,
+      103,
+      10
+    ],
+    "sha256": "b742bb8e4077f111e0f7b4d9039261a06fe6deaad8ea308ba3b89c7b5a4a9069",
+    "text": "uid://4n5welqfhdqg\n"
+  },
+  "tests/special/test_peeping_room_save.gd.uid": {
+    "owner": "tests/special/test_peeping_room_save.gd",
+    "owner_sha256": "ba0e7644277477c1821135cae6d6fd533651799c6f9bd8c43ccf45e63b96c63c",
+    "file_type": "regular",
+    "bytes": 19,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      56,
+      117,
+      121,
+      116,
+      109,
+      112,
+      106,
+      117,
+      112,
+      56,
+      113,
+      52,
+      10
+    ],
+    "sha256": "005561b37df9051e618d4714b2a91a82f4a48ec63c841cdf27c251bcd2865505",
+    "text": "uid://8uytmpjup8q4\n"
+  }
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-local-20261017/ACTUAL_STATIC_UID_CONTROLS.json

@@ -0,0 +1,13 @@
+{
+  "S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "argv": [
+    "/Users/korizatou114/Antigravity/\u74b0\u5883\u69cb\u7bc9/agent-control/.venv/bin/python",
+    "-B",
+    "tests/special/test_p13_uid_policy.py"
+  ],
+  "started_unix_ns": 1792225317277353000,
+  "ended_unix_ns": 1792225317417668000,
+  "exit_code": 0,
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "c8904f75939074499eaa0d8a5add9f1fd5007a4e4e5e75cc9b1ce324d8f4b69c"
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-local-20261017/ACTUAL_STATIC_UID_STDERR.log

@@ -0,0 +1,5 @@
+.......
+----------------------------------------------------------------------
+Ran 7 tests in 0.053s
+
+OK

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-local-20261017/CURRENT_ACCEPTANCE_STATUS.json

@@ -0,0 +1,88 @@
+{
+  "at_jst": "2026-10-17T17:28:02.473746+09:00",
+  "plan_id": "P13-02",
+  "batch": "P13-02-CODE1",
+  "original_packages": 30,
+  "original_units": 88,
+  "formally_completed": 14,
+  "new_credit": 0,
+  "S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "source_backup_branch": "codex/p13-02-reference",
+  "source_on_main": false,
+  "normal_integration_candidate": null,
+  "runner_state_after_registered_validation": "review_pending",
+  "repairs": 4,
+  "max_repairs": null,
+  "implementation_models": "Astra selected by Opus for coupled save schema; Sol selected by Opus for UID policy and exact queue-event oracle corrections",
+  "actual_narrow": {
+    "suites": 15,
+    "checks": 863,
+    "parse_files": 329,
+    "phases": 17,
+    "actual_PIDs": [
+      63523,
+      63619,
+      63653,
+      63684,
+      63709,
+      63723,
+      63751,
+      63773,
+      63789,
+      63815,
+      63830,
+      63854,
+      63870,
+      63896,
+      63919,
+      63933,
+      63993
+    ],
+    "passed": true,
+    "all_owned_engines_ended": true,
+    "guard_errors": [],
+    "cleanup_errors": [],
+    "finite_UID_set": 7,
+    "game_body_changed_by_latest_fix": false
+  },
+  "test_oracle_correction": "Direct rejected placement full typed Runtime unchanged; queued placement keeps world/economy/room/non-event IDs unchanged and verifies exactly1 COMMAND_FAILED domain-event ID/cause receipt. No blanket normalization or event suppression.",
+  "current_next_gate": "Full standard regression with finite native UID metadata extension must preserve all standard generated-report/audio/diagnostic/process/profile/source/marker gates; actual Opus plan requested before collection, formal independent review then ordinary integration/final remain.",
+  "whole_original_unit": "not accepted; pending ordinary construction/recorder/natural collection triggers/approved values/VIP/UI/content/Windows and all P13 conditions unchanged",
+  "P04_priority": "Next formal closure P04-01, existing D05 questions pending, no repeated questions or fake approval",
+  "previous_failures_retained": [
+    "p13-reference-native-e930a1d-import-failed",
+    "p13-reference-native-uid-corrected-27fc5f0-runtime-failed"
+  ],
+  "evidence": [
+    {
+      "path": "ACTUAL_NATIVE_ENDED.json",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native-uid-corrected/runner-ended.json",
+      "bytes": 469751,
+      "sha256": "4694cc13c0e0c309adf1f5c3c3885fc2d54efa8dc8ec63319ce016e48d2d66a5"
+    },
+    {
+      "path": "ACTUAL_NATIVE_INPUT.json",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native-uid-corrected/runner-input.json",
+      "bytes": 320481,
+      "sha256": "c899b3463fdc8925a98f5dd288eea5cca1d41b3591bc17d29394ec90da0b1094"
+    },
+    {
+      "path": "ACTUAL_RETAINED_UIDS.json",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native-uid-corrected/accepted-uids.json",
+      "bytes": 4198,
+      "sha256": "6a6987d53b93387aaa0f8cae268c96eb4bf326fa4599eea4e837af00384e3c38"
+    },
+    {
+      "path": "ACTUAL_STATIC_UID_CONTROLS.json",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/audit-support/p13-root-native-a7e3069/static-uid-controls.json",
+      "bytes": 493,
+      "sha256": "d9f4acac3e7f0ed869ece76bc5ef3e9dbe96314e893f1d7a2081a39d97b66053"
+    },
+    {
+      "path": "ACTUAL_STATIC_UID_STDERR.log",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/audit-support/p13-root-native-a7e3069/static-uid-controls.stderr.log",
+      "bytes": 105,
+      "sha256": "c8904f75939074499eaa0d8a5add9f1fd5007a4e4e5e75cc9b1ce324d8f4b69c"
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-e930a1d-native-import-20261017/ACTUAL_IMPORT_RECEIPT.json

@@ -0,0 +1,252 @@
+{
+  "phase": "import",
+  "test": null,
+  "passed": false,
+  "failed": true,
+  "validation_error": null,
+  "profile_startup_name": "TheTree-PCK-tests-974717b708984f0d81f24d8164fe7bc3-standard-startup-import",
+  "private_project_sha256": "f825875e910e090ce57fc0527f34b55386a77123c1784d6916718113139a3673",
+  "private_project_fields": 2,
+  "source_sha256": null,
+  "command": [
+    "/Applications/Godot.app/Contents/MacOS/Godot",
+    "--headless",
+    "--path",
+    "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage",
+    "--editor",
+    "--import",
+    "--quit",
+    "--verbose",
+    "--log-file",
+    "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+  ],
+  "logical_script": null,
+  "starter_sha256": null,
+  "controlled_environment": {},
+  "native_process": {
+    "argv": [
+      "/Applications/Godot.app/Contents/MacOS/Godot",
+      "--headless",
+      "--path",
+      "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage",
+      "--editor",
+      "--import",
+      "--quit",
+      "--verbose",
+      "--log-file",
+      "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+    ],
+    "pid": 55035,
+    "started_utc": "2026-10-17T08:05:39.153436+00:00",
+    "ended_utc": "2026-10-17T08:05:54.328314+00:00",
+    "wall_seconds": 15.174453041981906,
+    "exit_code": 0,
+    "helper_exit_code": 0,
+    "timed_out": false,
+    "stdout_sha256": "a7044e250290690749e344039a98595963550e89777a727da0532dd975c95778",
+    "stderr_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "error_lines": [],
+    "owned_popen_ended": true,
+    "old_helper_engine_ended": true,
+    "start_receipt_written": true,
+    "end_receipt_written": true,
+    "lifecycle_error": null,
+    "old_helper_lifecycle_error": null,
+    "actual_start_binding": {
+      "scope": "isolated diagnostic owned child",
+      "event": "ENGINE_STARTED",
+      "actual_pid": 55035,
+      "owner_pid": 53623,
+      "command": [
+        "/Applications/Godot.app/Contents/MacOS/Godot",
+        "--headless",
+        "--path",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage",
+        "--editor",
+        "--import",
+        "--quit",
+        "--verbose",
+        "--log-file",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+      ],
+      "monotonic_ns": 2836045348628125,
+      "pid": 55035,
+      "argv": [
+        "/Applications/Godot.app/Contents/MacOS/Godot",
+        "--headless",
+        "--path",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage",
+        "--editor",
+        "--import",
+        "--quit",
+        "--verbose",
+        "--log-file",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+      ],
+      "started_utc": "2026-10-17T08:05:39.153436+00:00",
+      "current_process_identity": {
+        "pid": 55035,
+        "ppid": 53623,
+        "pgid": 55035,
+        "args": "/Applications/Godot.app/Contents/MacOS/Godot --headless --path /Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage --editor --import --quit --verbose --log-file /Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+      },
+      "live_identity_exact": true,
+      "tracked_child_ended_before_initial_probe": false,
+      "signal_scope": "tracked Popen child only; no external group signal"
+    },
+    "actual_end_binding": {
+      "scope": "isolated diagnostic owned child",
+      "event": "ENGINE_ENDED",
+      "actual_pid": 55035,
+      "owner_pid": 53623,
+      "command": [
+        "/Applications/Godot.app/Contents/MacOS/Godot",
+        "--headless",
+        "--path",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage",
+        "--editor",
+        "--import",
+        "--quit",
+        "--verbose",
+        "--log-file",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+      ],
+      "monotonic_ns": 2836060496050750,
+      "exit_code": 0,
+      "actual_process_exit_code": 0,
+      "engine_ended": true,
+      "timed_out": false,
+      "lifecycle_error": null,
+      "start_receipt_written": true,
+      "pid": 55035,
+      "argv": [
+        "/Applications/Godot.app/Contents/MacOS/Godot",
+        "--headless",
+        "--path",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage",
+        "--editor",
+        "--import",
+        "--quit",
+        "--verbose",
+        "--log-file",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+      ],
+      "ended_utc": "2026-10-17T08:05:54.320361+00:00",
+      "signal_scope": "tracked Popen child only; no external group signal"
+    },
+    "strict_native_diagnostics": {
+      "errors": [],
+      "banner_count": 1,
+      "known_unicode_diagnostic_count": 0,
+      "unrecognized_unicode_diagnostic_count": 0,
+      "exit_leak_diagnostic_lines": []
+    },
+    "external_process_or_group_signals": 0,
+    "owned_child_process_helper_sha256": "c007e712c281573254faa1233c2ac92e100ab87393256a6dc096b35283e43037",
+    "adapter_owned_cleanup": {
+      "owned_child_created": true,
+      "engine_ended": true,
+      "actual_process_exit_code": 0,
+      "attempts": [
+        {
+          "attempt": 1,
+          "kill_attempted": false,
+          "wait_timeout_seconds": 5,
+          "wait_completed": true,
+          "errors": [],
+          "poll_before": 0,
+          "wait_returned_code": 0,
+          "poll_after": 0
+        }
+      ],
+      "errors": []
+    },
+    "adapter_error": null,
+    "old_helper_bytes_preserved": true,
+    "helper_wait_None_maps_to_actual_timeout_seconds": 5,
+    "explicit_helper_wait_timeouts_preserved": true,
+    "additional_cleanup_wait_timeout_seconds": 5,
+    "additional_cleanup_max_attempts": 3
+  },
+  "outer_actual_capture": {
+    "actual_captured_pids": [
+      55035
+    ],
+    "cleanup": [
+      {
+        "pid": 55035,
+        "cleanup": {
+          "owned_child_created": true,
+          "engine_ended": true,
+          "actual_process_exit_code": 0,
+          "attempts": [
+            {
+              "attempt": 1,
+              "kill_attempted": false,
+              "wait_timeout_seconds": 5,
+              "wait_completed": true,
+              "errors": [],
+              "poll_before": 0,
+              "wait_returned_code": 0,
+              "poll_after": 0
+            }
+          ],
+          "errors": []
+        },
+        "outer_cleanup_errors": [],
+        "engine_ended": true,
+        "outer_maximum_helper_invocations": 3,
+        "helper_maximum_waits": 3,
+        "per_wait_timeout_seconds": 5,
+        "foreign_process_or_group_signals": 0
+      }
+    ],
+    "adapter_exception": null,
+    "all_captured_ended": true,
+    "outer_cleanup_errors": [],
+    "foreign_process_or_group_signals": 0,
+    "all_cleanup_before_outer_receipt": true,
+    "outer_receipt_written": true,
+    "outer_receipt_error": null,
+    "passed": true
+  },
+  "actual_pid": 55035,
+  "engine_ended": true,
+  "exit_code": 0,
+  "log": "import/combined-raw.log",
+  "log_sha256": "a7044e250290690749e344039a98595963550e89777a727da0532dd975c95778",
+  "raw_native_log": {
+    "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log",
+    "bytes": 119669,
+    "sha256": "9e66d1295be17e1bfa9052e78e06e7cf9bfee7fe5624ea97226529209404b8ed"
+  },
+  "finite_original_diagnostic_review": {
+    "verified": true,
+    "original_NUL_fixture_contract_applied": false,
+    "producer_source_sha256": null,
+    "actual_transport_counts": {
+      "stdout": 0,
+      "stderr": 0,
+      "native_file": 0
+    },
+    "actual_complete_diagnostic_sequences": {
+      "stdout": [],
+      "stderr": [],
+      "native_file": []
+    },
+    "unknown_or_error_or_leak_lines": {
+      "stdout": [],
+      "stderr": [],
+      "native_file": []
+    },
+    "raw_lines_deleted_or_rewritten": 0,
+    "contract_sha256": "22fd41c59eb13e0af397984bed418870c55fa8942524c377490a90a2aca8dedd",
+    "allowed_e31_error_lines": []
+  },
+  "whole_startup_profile_after": {
+    "path": "/Users/korizatou114/Library/Application Support/TheTree-PCK-tests-974717b708984f0d81f24d8164fe7bc3-standard-startup-import",
+    "files": {},
+    "fresh_before_engine": true
+  },
+  "guard_error": "AssertionError: complete source/UID/generated report set"
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-e930a1d-native-import-20261017/ACTUAL_WORKER_RESULT.json

@@ -0,0 +1,10 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "1e8d4ea88876865a72547ff0edf43ed5b0e74c7e",
+  "status": "submitted",
+  "summary": "許可範囲内で非描写サービス、Runtime・保存連携、5試験、専用検証スクリプト、マーカー・説明書を追加。Python構文とマーカーSHA整合を確認。エンジン・試験・Runner操作・git書込みは未実施。正式検証と独立レビュー待ちで、P13受入への加算はありません。",
+  "acceptance_ids": [
+    "P13-02-CODE1"
+  ],
+  "findings": []
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-e930a1d-native-import-20261017/CURRENT_ACCEPTANCE_STATUS.json

@@ -0,0 +1,85 @@
+{
+  "at_jst": "2026-10-17T17:09:16.053627+09:00",
+  "plan_id": "P13-02",
+  "batch": "P13-02-CODE1",
+  "original_packages": 30,
+  "original_units": 88,
+  "formally_completed": 14,
+  "new_credit": 0,
+  "source_submitted": "e930a1dedff7ab4c4a94d274a2e0c55fc2b95829",
+  "source_backup_branch": "codex/p13-02-reference-e930a1d",
+  "normal_integration_candidate": null,
+  "source_on_main": false,
+  "worker_model": "gpt-6-astra",
+  "model_selection": "actual Opus19f00667 after examining coupled14/15 save paths; earlier Sol was proposal only",
+  "repairs_before_current_correction": 2,
+  "max_repairs": null,
+  "worker_run": "b3af838ff79b4f3fafe7b68040a89079",
+  "worker_terminal": "submitted",
+  "source_change_summary": "12 files/1015 additions, service plus bounded Runtime/save/5suite/harness wiring; no mandatory numbers or normal palette invented",
+  "native": {
+    "import_actual_pid": 55035,
+    "engine_ended": true,
+    "exit_code": 0,
+    "diagnostic_errors": 0,
+    "accepted": false,
+    "guard_failure": "exactly7 native-generated UID sidecars undeclared in complete source/UID/generated set",
+    "suite_count": 0,
+    "all15_suites_unexecuted": true,
+    "all329_parse_unexecuted": true,
+    "default_player_changed": false,
+    "cleanup_errors": []
+  },
+  "next": "actual Opus decision for precise UID artifact handling; do not waive source/UID/process/profile guard or rerun full regression now",
+  "P04_priority": "Next original unit to close remains P04-01; owner D05 answers pending, this batch is independent work",
+  "required_remaining": [
+    "UID correction then exact narrow/impact verification with strict raw evidence",
+    "separate actual Opus independent code/evidence review",
+    "required final exact-source full regression, normal integration/final and ledger update for backend batch",
+    "whole original P13-02 normal build/production/content/roles/approved D04/D05/D08 values/VIP/UI/Windows and all original conditions remain unaccepted"
+  ],
+  "manifest": [
+    {
+      "path": "ACTUAL_OPUS_MODEL_AND_BRIEF.json",
+      "original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/19f00667226d42dd8e9b3a4ae99aaa68/result.json",
+      "sha256": "1afa4b721f45c10cabeb10830db1c8b064d29c55000c3c6fbf5802ec0474c533",
+      "bytes": 11457
+    },
+    {
+      "path": "ACTUAL_WORKER_RESULT.json",
+      "original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/b3af838ff79b4f3fafe7b68040a89079/result.json",
+      "sha256": "e38129543ab8796c51b6f1c56fba7417a6f7efe8d4cff338d1a0b074bbf23dd1",
+      "bytes": 538
+    },
+    {
+      "path": "ACTUAL_IMPORT_RECEIPT.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import-receipt.json",
+      "sha256": "cfa6b72b59f8df394eb22adfe1e73babbca31fb0c2a9caed9190dcc80b52d8f1",
+      "bytes": 9333
+    },
+    {
+      "path": "ACTUAL_NATIVE_ENDED.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/runner-ended.json",
+      "sha256": "9f13934d7844e4ceba72e87a7c5dc88e7e2ebdea5de1c556c5f19d90092917c3",
+      "bytes": 167969
+    },
+    {
+      "path": "ACTUAL_NATIVE_INPUT.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/runner-input.json",
+      "sha256": "6018a3d83835317a46aee69188d5f3ca0e01977212e36b030a751894cb3284dc",
+      "bytes": 320355
+    },
+    {
+      "path": "ROOT_REVIEW_CHECKLIST.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/coordinator-start-20261017/ROOT_REVIEW_CHECKLIST.json",
+      "sha256": "32079bede7a4da3defabbdc4fca7eaf96a03ffc12344cfd7631c2d5c5e22e7c7",
+      "bytes": 1440
+    },
+    {
+      "path": "EXACT_FAILURE_FACTS.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-implement/build/owner-handoff/native-import-failure/ROOT_EXACT_FAILURE_FACTS.json",
+      "sha256": "a7c906d0df05003be005e8d7160ae8c104dbdb00388bd57b87696f1dd425de86",
+      "bytes": 1782
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-e930a1d-native-import-20261017/EXACT_FAILURE_FACTS.json

@@ -0,0 +1,54 @@
+{
+  "S": "e930a1dedff7ab4c4a94d274a2e0c55fc2b95829",
+  "actual_engine_pid": 55035,
+  "exit_code": 0,
+  "owned_engine_ended": true,
+  "diagnostic_errors": 0,
+  "actual_suites": 0,
+  "new_stage_files": [
+    {
+      "path": "tests/special/peeping_room_fixture.gd.uid",
+      "sha256": "a74e5ef6d8959826919a648e8b5d82e96d1c73ff22cd6c1f216be8b5c4060a8a",
+      "bytes": 20,
+      "text": "uid://b0c3ouuq42ycg\n"
+    },
+    {
+      "path": "tests/special/test_peeping_room_runtime.gd.uid",
+      "sha256": "f7276000bd3b4c3429c72612f791ca2ed6bb04dde1de8e278cb1a055ae4ce743",
+      "bytes": 20,
+      "text": "uid://dkc1kiqioypih\n"
+    },
+    {
+      "path": "tests/special/test_peeping_room_save.gd.uid",
+      "sha256": "005561b37df9051e618d4714b2a91a82f4a48ec63c841cdf27c251bcd2865505",
+      "bytes": 19,
+      "text": "uid://8uytmpjup8q4\n"
+    },
+    {
+      "path": "tests/special/test_peeping_room_geometry.gd.uid",
+      "sha256": "391b78806bc0bf759f00c778cb25dfaa97d47f6e309c3b302412c38123c5440c",
+      "bytes": 19,
+      "text": "uid://4r40f1kpjmvj\n"
+    },
+    {
+      "path": "tests/special/test_peeping_room_evidence.gd.uid",
+      "sha256": "26bbc1435bcda963b5866327b887096f798b1629c7984768c85bfb6175648ec5",
+      "bytes": 20,
+      "text": "uid://dftsky13pe0uj\n"
+    },
+    {
+      "path": "tests/special/test_peeping_room_reference.gd.uid",
+      "sha256": "db8bfa98b7943dba15858ccaa6681bc430efd43f40f57de99117dc19c51ac417",
+      "bytes": 20,
+      "text": "uid://cnnon5woufurp\n"
+    },
+    {
+      "path": "scripts/special/peeping_room_service.gd.uid",
+      "sha256": "3f045afc3c140886c70ec8494d6dcb012e6da645e8a3ff3c6488442ce63a9353",
+      "bytes": 20,
+      "text": "uid://bi36fvp1jiiiv\n"
+    }
+  ],
+  "guards_not_waived": true,
+  "whole_acceptance": false
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-e930a1d-native-import-20261017/ROOT_REVIEW_CHECKLIST.json

@@ -0,0 +1,13 @@
+{
+  "scope": "Root-derived review checklist within the immutable original P13-02 state/reference/save conditions. Not extra product rules, test results, or implementation directions.",
+  "created_unix_ns": 1792223589246621000,
+  "checks": [
+    "Retain prior evidence identities/history after target loss and explicit relink; a new target does not turn old evidence into a different event or silently discard it. Check roundtrip after this combined history.",
+    "Relink may ignore only the same room own occupancy, never another room or corridor conflict. A rebuilt different facility ID cannot silently revive the link.",
+    "Ordinary production commands cannot reach CONTROLLED_FIXTURE entry points or bypass missing build/recorder approvals; rejection leaves whole typed Runtime unchanged.",
+    "Optional section absence is valid only for truly empty state; orphan world occupancy or owned IDs cannot be accepted by dropping the section. Other existing exact schema key allowlists remain strict.",
+    "Failed section restore or later-system failure restores original whole Runtime including clock, ID generator, commands, facilities, ledger and new service references; var_to_bytes evidence, no JSON normalization.",
+    "Source/marker/policy/engine/input/environment identities and actual owned process endings cover the final tested version; local test numbers never substitute whole-unit acceptance."
+  ],
+  "formal_credit": 0
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/057-ARCHIVAL-RECOVERY.json

@@ -0,0 +1,29 @@
+{
+  "archive_sha256": "f962d3622f5da562c3c07c4afed84bf4f1042a2470f555c16148d450e70453ff",
+  "drive_archive_id": "1F6MYrZ7begmlNaZkjMOlJT5y9uMcSVwM",
+  "drive_restore_kit_id": "1eT98KWt71v62IGhxyBSjmf4FEoTvFMxA",
+  "views": [
+    {
+      "original": "/Users/korizatou114/Library/Application Support/TheTree-PCK-tests-cb0e908014ed4be48b1cc74787337f66-standard-runtime-057",
+      "files": 2792,
+      "logical_bytes": 1839108706,
+      "verified_all_bytes_before_retirement": true,
+      "restore_view": "original",
+      "absent_after": true
+    },
+    {
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-full-controller/run/profiles/057/runtime",
+      "files": 1535,
+      "logical_bytes": 861302992,
+      "verified_all_bytes_before_retirement": true,
+      "restore_view": "failed-copy",
+      "absent_after": true
+    }
+  ],
+  "free_before": 894099456,
+  "free_after": 2749599744,
+  "time_ns": 1792229099545221000,
+  "original_full_attempt_passed": false,
+  "receipt_bytes_unmodified": true,
+  "actual_free_gain_bytes": 1855500288
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/CLOSED_P13_READONLY_RETIREMENT.json

@@ -0,0 +1,28 @@
+{
+  "removed": [
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-final-b0291970",
+      "head": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "git_files": 4919,
+      "byte_equal_review_duplicate_files": 0
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-integration-15cc1271",
+      "head": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "git_files": 4919,
+      "byte_equal_review_duplicate_files": 0
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-review-e6fc1237",
+      "head": "a7e3069b167511b3194242b3403fbcc35244a526",
+      "git_files": 4894,
+      "byte_equal_review_duplicate_files": 16049
+    }
+  ],
+  "full_restore_proof": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/coordinator-start-20261017/CLOSED_P13_READONLY_FULL_RESTORE_PROOF.json",
+  "free_before": 3651289088,
+  "free_after": 4381392896,
+  "all_unique_evidence_preserved": true,
+  "time_ns": 1792232004526885000,
+  "actual_free_gain": 730103808
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/CURRENT_RESOURCE_AND_ACCEPTANCE_STATUS.json

@@ -0,0 +1,77 @@
+{
+  "at_jst": "2026-10-17T18:34:28.900674+09:00",
+  "plan_id": "P13-02",
+  "batch": "P13-02-CODE1",
+  "S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "original_packages": 30,
+  "original_units": 88,
+  "formally_completed": 14,
+  "new_credit": 0,
+  "original_full_attempt_passed": false,
+  "failure": "ENOSPC while copying ended native5374check P08 migration runtime profile; incomplete original runner-ended preserved",
+  "causal_measurements": {
+    "single_runtime_profile_files": 2792,
+    "single_runtime_logical_bytes": 1839108706,
+    "partial_duplicate_whole_files": 1534,
+    "partial_duplicate_zero_byte_fragment": 1
+  },
+  "recovery": "Exact full archive plus original partial-copy view and fragment retained; every member SHA verified locally, remote complete archives fetched and streamed SHA verified before retiring only verified uncompressed profiles. No test log or acceptance data erased.",
+  "archives": [
+    {
+      "drive_id": "1F6MYrZ7begmlNaZkjMOlJT5y9uMcSVwM",
+      "url": "https://drive.google.com/file/d/1F6MYrZ7begmlNaZkjMOlJT5y9uMcSVwM/view",
+      "purpose": "current057 full profile"
+    },
+    {
+      "drive_id": "1eT98KWt71v62IGhxyBSjmf4FEoTvFMxA",
+      "url": "https://drive.google.com/file/d/1eT98KWt71v62IGhxyBSjmf4FEoTvFMxA/view",
+      "purpose": "current057 restore kit with exact original and failed-copy views"
+    },
+    {
+      "drive_id": "1_HFt31YEAs6ak7Z2BiX9xOCQJkYBjovE",
+      "url": "https://drive.google.com/file/d/1_HFt31YEAs6ak7Z2BiX9xOCQJkYBjovE/view",
+      "purpose": "previous ended P23 full179 runtime profile, full restore metadata embedded"
+    },
+    {
+      "drive_id": "1tR_3rlst7AshVskaVxG6JFvQxF5OP5ow",
+      "url": "https://drive.google.com/file/d/1tR_3rlst7AshVskaVxG6JFvQxF5OP5ow/view",
+      "purpose": "older ended P08 phase profile, full restore metadata embedded; failed whole attempt remains failed"
+    }
+  ],
+  "proof_records": {
+    "DRIVE_FULL_ARCHIVE_READBACK.json": {
+      "bytes": 221,
+      "sha256": "36a59d70bb6b67b20c89a26bc5bc1bae3e16f1e4cdc34faf8690cb8d47f4ea55",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/storage-profile-recovery-20261017/DRIVE_FULL_ARCHIVE_READBACK.json"
+    },
+    "DRIVE_RESTORE_KIT_READBACK.json": {
+      "bytes": 219,
+      "sha256": "29119b49b58bdaed54b672bab4629fd17f56c33b5cb6961ce2061f222a0897e3",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/storage-profile-recovery-20261017/DRIVE_RESTORE_KIT_READBACK.json"
+    },
+    "057-ARCHIVAL-RECOVERY.json": {
+      "bytes": 1110,
+      "sha256": "220aa68ceb8195b1ac3358118b4ea652750cafc4a421b9f277026ccfadb76722",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/storage-profile-recovery-20261017/057-ARCHIVAL-RECOVERY.json"
+    },
+    "PREVIOUS_P23_PROFILE057_DRIVE_AND_RETIREMENT.json": {
+      "bytes": 785,
+      "sha256": "6633575fcf6cba529d72c3fc652fffc082128114e20cdf9f0fd0a223ff5d9c8e",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/storage-profile-recovery-20261017/PREVIOUS_P23_PROFILE057_DRIVE_AND_RETIREMENT.json"
+    }
+  },
+  "current_free_bytes": 4153327616,
+  "next_full_scope": "Import and329parse plus original58 suites qualified; remaining126 require unchanged native per-phase gates, exact input equality, all cross-segment checks, separate actual Opus review, normal integration/final. No restart of accepted native phases.",
+  "admission_required_bytes": 3467374666,
+  "P04_next_formal_unit": "P04-01 pending actual owner D05 choices, no fake approval",
+  "whole_original_acceptance": false,
+  "later_archival_result": "Additional1.838GB logical old profile preserved remotely with full readback SHA. Immediate measured free gain153612288B; logical size is not claimed as physical space recovered.",
+  "subsequent_verified_copy_retirements": {
+    "P13_ended3_copies_actual_gain_bytes": 730103808,
+    "P04_ended9_validation_copies_actual_gain_bytes": 1304444928,
+    "P04_preserved_remote_source": "codex/p04-01-preserved-2dde759",
+    "all_tracked_blobs_verified": true,
+    "all_unique_central_native_review_evidence_retained": true
+  },
+  "last_capacity_observation_jst": "2026-10-17T19:39:39.105864+09:00"
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/DRIVE_FULL_ARCHIVE_READBACK.json

@@ -0,0 +1,7 @@
+{
+  "drive_id": "1F6MYrZ7begmlNaZkjMOlJT5y9uMcSVwM",
+  "bytes": 97976496,
+  "sha256": "f962d3622f5da562c3c07c4afed84bf4f1042a2470f555c16148d450e70453ff",
+  "full_remote_readback": true,
+  "time_ns": 1792229035052351000
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/DRIVE_RESTORE_KIT_READBACK.json

@@ -0,0 +1,7 @@
+{
+  "drive_id": "1eT98KWt71v62IGhxyBSjmf4FEoTvFMxA",
+  "bytes": 216139,
+  "sha256": "8517b61a253141a76e3bde5bab81f3971ca91989b37b2c89e95a5ee42c010cda",
+  "full_remote_readback": true,
+  "time_ns": 1792229078775515000
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/ENDED_P04_VALIDATION_CHECKOUT_RETIREMENT.json

@@ -0,0 +1,65 @@
+{
+  "at_unix_ns": 1792232721652518000,
+  "removed": [
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-3ca36075",
+      "head": "d393e4d90f068faa82fde40ca1ecd411ff7f2c1f",
+      "files": 3022,
+      "logical_bytes": 137851869
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-998f2af8",
+      "head": "55f1fb49aaefa5c1b86de1c3eda72392ef6b58f2",
+      "files": 3025,
+      "logical_bytes": 137889196
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-a2c2024a",
+      "head": "7af6fafaf00cffbb731f6a4765e5891457c51bda",
+      "files": 3024,
+      "logical_bytes": 137863410
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-b191eb70",
+      "head": "8418560aaf2f0f9ed3977ca477b5601ffebcbbda",
+      "files": 3021,
+      "logical_bytes": 137848317
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-b85d6800",
+      "head": "b543c26c95a1d634b8d7efdf127cc55eba55611a",
+      "files": 3013,
+      "logical_bytes": 137734675
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-e0a2d54f",
+      "head": "4ab7ab8712cc3b3d8bb0514ebb4b2c0927456443",
+      "files": 3025,
+      "logical_bytes": 137887158
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-e0f78b8f",
+      "head": "fb8b7919dbecba9a9de2a28dc2a25ce5cd73e9c6",
+      "files": 3027,
+      "logical_bytes": 137898418
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-e61af951",
+      "head": "2dde7596a87c43f7bf0bf704b7479f2fa06a5b1c",
+      "files": 3031,
+      "logical_bytes": 138115695
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-f79a151b",
+      "head": "16207d353ae4a2bb180793325cba9aec9ef68d66",
+      "files": 3015,
+      "logical_bytes": 137746167
+    }
+  ],
+  "free_before_bytes": 3734835200,
+  "free_after_bytes": 5039280128,
+  "observed_gain_bytes": 1304444928,
+  "all_source_blobs_verified": true,
+  "all_unique_runtime_evidence_preserved": true,
+  "restore_manifest": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/coordinator-storage-20261017/ENDED_VALIDATION_CHECKOUT_FULL_GIT_RESTORE_PROOF.json"
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/OLDER_P08_PROFILE057_DRIVE_AND_RETIREMENT.json

@@ -0,0 +1,18 @@
+{
+  "drive_id": "1tR_3rlst7AshVskaVxG6JFvQxF5OP5ow",
+  "remote_bytes": 98084260,
+  "remote_sha256": "79879544b1351706d96e072f77a5b893aced99204c3c8fa83c216279b2cef011",
+  "full_remote_readback": true,
+  "all_original_bytes_verified_before_retirement": true,
+  "original": "/Users/korizatou114/Library/Application Support/TheTree-PCK-tests-4c87cfdfbfff41fd85a9686027d4b109-standard-runtime-057",
+  "files": 2792,
+  "archive": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/storage-profile-recovery-20261017/p08-older-ended-profile057-lossless.tar.gz",
+  "archive_contains_full_manifest": true,
+  "original_full_attempt_passed": false,
+  "phase_passed_and_ended": true,
+  "time_ns": 1792230632135468000,
+  "free_before": 3985821696,
+  "original_absent": true,
+  "free_after": 4139433984,
+  "actual_free_gain": 153612288
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/PREVIOUS_P23_PROFILE057_DRIVE_AND_RETIREMENT.json

@@ -0,0 +1,16 @@
+{
+  "drive_id": "1_HFt31YEAs6ak7Z2BiX9xOCQJkYBjovE",
+  "remote_bytes": 98141942,
+  "remote_sha256": "0cdfb0eb3dc7b5bced24f209bd024436db5450926dae74885d658bcdcf407ed5",
+  "full_remote_readback": true,
+  "all_original_bytes_verified_before_retirement": true,
+  "original": "/Users/korizatou114/Library/Application Support/TheTree-PCK-tests-4572ef90efe94bc59f24b8e3d80452d0-standard-runtime-057",
+  "files": 2792,
+  "archive": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/storage-profile-recovery-20261017/p23-previous-full179-profile057-lossless.tar.gz",
+  "archive_contains_full_manifest": true,
+  "time_ns": 1792229606376983000,
+  "free_before": 2652545024,
+  "original_absent": true,
+  "free_after": 4500942848,
+  "actual_free_gain": 1848397824
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/IMPLEMENTATION_REPORT.md

@@ -0,0 +1,75 @@
+# P19-03 実装提出報告
+
+提出状態。受入は未確定。原受入「7名×3ルートの到達表があり、未制作内容は欠損として残る。」を維持する。14/88は変更しない。
+
+## 変更範囲
+
+修復開始点e0420d57a381a1644357f0590536e1d47c9bca9fから、このディレクトリの指定5ファイルのみを変更した。原本、原子要件、work packages、decisions、TASK_SPEC、選定記録、frozen pins、ゲーム入力、marker registryは変更していない。git書込み、他worker起動、Runner操作、ゲーム起動は行っていない。素材追加なし。
+
+## 要件と検査の対応
+
+|TASK_SPEC implementation_requirements順|成果物|検査|
+|---|---|---|
+|1: 原7名×3ルート|REACHABILITY_TABLE.json / .md|expectedのPEOPLE/ROUTES、原本118–124行、atomic entityと21セルの完全一致。test_exact_cell_product|
+|2: 8カテゴリ、共通/人物固有の分離|JSON common_rules / cells.categories|CATEGORIES全件のcanonical比較。test_categories_and_citations|
+|3: 原本本文・行・status・anchorのsource SHA・owner|JSONの各共通項目/人物固有項目、catalog_evidence|expected.evidence/cite、verify。test_stale_record_evidence / test_owner_and_status|
+|4: 欠損、理由、担当、未知値pending|各character_specific、pending、natural_route_complete=false|test_no_invented_values_or_completion。D05/D08は未回答のまま|
+|5: docs内stdlibチェッカー/自己試験|check_reachability_table.py / test_reachability_table.py|stdlib importsのみ。選択対象外のdocs内配置|
+|6: read-only --check、厳密な表/Markdown|verify / verify_records / markdown|test_json_and_types / test_markdown_drift。--checkは書込み分岐を通らない|
+|7: 全frozen source mapと各identity|binding / selection|1368選択ファイルの完全map、marker/policy/engine、184-suite roster、329 .gd、baseline、spec→pins SHA。test_full_frozen_map_and_identities / test_real_source_and_baseline_changes|
+|8: UI/Runtime/save/Windowsの適用性|JSON route_support、MDルート別適用性|各ルートをcanonical比較。汎用UIラベル、原本登録Runtime、専用snapshotの限定証拠をcommon_rulesで参照|
+|9: 有意な負例と3種の正例|test_reachability_table.py|欠落/重複/誤人物/誤route/カテゴリ/引用/古い本文・SHA/値創作/誤完成/owner・status/JSON型/Markdown、実ファイル読込差替え、map差分とpins/marker/policy/engine改変。全3statusを含む正例|
+|10: P13パターン・原文保全|checkerのexpected/verify/markdown、原資料のbase blob照合|tools/check_p13_content_difference.pyのcanonical生成・厳密比較・read-only Git blob証拠パターンを参照。元ファイルは無変更|
+|11: 報告・残課題・外部gate|本報告、JSON accounting|正式試験・全単位独立レビュー・統合/finalは未実行と明記|
+
+原子要件はB-7.1〜B-7.6をsource_group_idsに含む61件の完全レコードを読込対象とし、JSON authority_snapshotsに保持する。人物キーと原名はそのentityから確認し、原本§6の順で並べた。原本§6は114–135行、§7は136–161行であり、実際の見出しと本文を照合した。人物別の原本仕様がない部分を共通ルールから創作していない。中断/保存の人物固有手順は原本に定義されず、work_packagesのP19-02受入が所有する欠損として残した。
+
+指定されたoriginal_relationship_state.gdには7名のrosterはなく、汎用subject_id等の明示入力検証のみがある。既存unique catalogのヒロインはheroine_anriのみ。監査IDには既存atomic entity.key（anri/fine/tomari/amelia/liz/mimi/satsuki）を使い、他6名の実装catalog ID、ライバル対応、初期値を創作していない。この実装欠損は表の欠損であり、原7名を削減する理由にしていない。
+
+## Repair 1: 4指摘の対応
+
+編集前に build/owner-handoff/p19-review-r01/ の ACTUAL_OPUS_REPAIR_DIRECTION.json、ACTUAL_WHOLE_UNIT_REVIEW.json、SPEC_HASH_REPRESENTATIONS.json を読んだ。
+
+- MEDIUM: coassignment_attack / zero_break / love_actions / threshold_route_loss と旧UIのlegacy_evidenceを追加。固定anchorの実際の本文・行・Git blob OID・file-bytes SHA-256を保持する。原本準拠statusはmissing、旧実装分類はlegacy_not_originalに統一。P18-01は一対一変換を禁止し、旧数値・日次制限は原本として未承認と明記した。UI定数は実際には98–101行であり、89–97行の無関係なラベルを除いた。共通ルール参照により各該当セルへ結び付けた。所有者・原本欠損・natural_route_complete=falseを維持。
+- LOW 独立試験: validate_legacyは候補とcanonicalの比較とは独立に、git showで固定anchorのソースを読み、引用行本文とgit rev-parseによるblob OID、現ファイルとの一致を検査する。test_independent_legacy_source_evidenceは実際のJSONと実ファイルを開き、git hash-object --stdin（書込みなし）でOIDを独立計算し、関数名とshield_broken/EXCLUSIVE_LOCKEDも確認。test_legacy_evidence_required_independentlyは対象全項目の証拠削除・空配列・無条件not implemented・古いOID/本文を拒否する。
+- LOW 中断参照: 全21セルのinterruption_cancellationに原本148・153行の本文とbaseline hash、および343–355行のconfirm_route_lockをlegacy_not_originalとして追加。人物固有欠損と担当は維持。
+- LOW ハッシュ表示: 263a01b943d8056727335fb76977c010298e1c229077f8da76e48683ba2e89bb は TASK_SPEC.json file-bytes SHA-256。3af3d9b931edc5449796662ad69bb6f67c80b48827a86565b1952931db68dd15 は Runner git-show stripped-UTF-8 contract spec_sha256。上記SPEC_HASH_REPRESENTATIONS.jsonのunchanged_file=trueが証拠であり、両者は同じ無変更ファイルを表す。checker定数と出力にも区別を反映。Git blob OIDは別のgit_blob_oidフィールドでありfile-bytes SHA-256とは区別する。
+
+## 実行記録（今回のローカル確認）
+
+以下は正式Runner実行ではない。記録済み修復指示に基づき3登録コマンドをローカル実行した。
+
+生成 — exit 0
+
+```sh
+python3 -B /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement --write
+```
+
+p19-table — exit 0
+
+```sh
+python3 -B /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement --check
+```
+
+p19-negative — exit 0
+
+```sh
+python3 -B /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement/docs/plans/original-completion-2026-10-02/execution/p19-03/test_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement
+```
+
+p19-source-binding — exit 0
+
+```sh
+python3 -B /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement --source-binding-only
+```
+
+--writeの実際の呼出しは同一checkout内で相対スクリプトパスと --project-root . を使用（上記は絶対パス表記）。--checkはMarkdownのバイト完全一致を確認。自己試験は12件OK。source bindingは1368ファイル一致、file_equality=true、actual_commit=e0420d57a381a1644357f0590536e1d47c9bca9f、native_evidence_reuse_accepted=false。git diff --checkはexit 0。構文は上記Python実行で確認。最初の編集用here-documentは一時ファイル作成制限でexit 1、変更は行われず、python3 -cで再実行してexit 0。native full・ゲーム起動・git書込み・Runner操作・他エージェント起動は行っていない。
+
+## 残る親成果・ゲームの欠損
+
+- P18-01: 原本3軸/盾の通常UI、承認済み初期値、本来の全単位受入。P18-02/03: 同配置・軽減・ブレイク・接触・閾値・確定遷移。既存旧汎用モデルの閾値を原本へ転用しない。
+- P19-01/02: 原本行動と全3種決闘、勝敗・費用・盾/履歴の一度だけ反映、通常入口、停止/取消/離脱/保存再開。原本状態保持のbackendを自然ルート完成としない。
+- P20-01/02/03: スキル/章・全エンド・図鑑と新規からの通常到達。P26-01/02/03: 人物別必要内容、状態接続、完成資産と制作受入。人物固有イベント/条件/履歴/立ち絵差分は欠損。
+- D05、D08はpending。未知の閾値・率・初期値もpendingのまま。P04の既存D05選択、P13の4件の制作followupも未解決。
+- この文書単位のnative GUI/Windows実行は適用外。global same-Windows、held gestures、全ゲーム受入はopen。固定入力一致から既存native証拠の正式再利用承認を推定していない。
+- Runnerの3 validator、原本§6–7と元受入に対する実装者から独立したwhole-unit Opus review、その後の通常prepare-integration/finalが必要。どの完了数・元台帳も変更していない。

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_CURRENT_ACCEPTANCE_STATUS.json

@@ -0,0 +1,64 @@
+{
+  "at_jst": "2026-10-17T19:58:24.516684+09:00",
+  "plan_id": "P19-03",
+  "registered_task": "P19-03-TABLE",
+  "project": "the-tree-p19-03-reachability",
+  "S": "806de25068bc423136063791afcea811d251ee1b",
+  "implementation_model": "gpt-6.1-sol",
+  "actual_model_decision": "c767de1cd89d40e5a23964f2e62ce4c6",
+  "state": "whole_original_review_passed_integration_final_pending",
+  "original_acceptance": "7名×3ルートの到達表があり、未制作内容は欠損として残る。",
+  "original_units": 88,
+  "formally_completed": 14,
+  "new_credit": 0,
+  "registered_validation": {
+    "passed": true,
+    "artifact": "ROOT_FORMAL_VALIDATION_806DE25.json",
+    "checks": [
+      "p19-table",
+      "p19-negative",
+      "p19-source-binding"
+    ],
+    "self_tests": 12
+  },
+  "actual_reviewer": {
+    "id": "38eaaacdb31b4c76bcf982987816a391",
+    "status": "finished_pass"
+  },
+  "reviewer_model": "claude-opus-5-5",
+  "full_game_input_equality": {
+    "files": 1368,
+    "markers_policy_engine_roster_parse_default_player_same": true,
+    "full184_21903_329parse_186ended_reuse_qualified": true,
+    "new_native_runs": 0,
+    "artifact": "ROOT_EXACT_GAME_INPUT_REUSE_806DE25.json"
+  },
+  "required_before_acceptance": [
+    "Normal actual integrationC/M and independent candidate source/input equality",
+    "Normal final and existing exact real-owner main authorization, thenledger/push; no new humanSHA speech fabricated"
+  ],
+  "source_gaps_preserved": [
+    "Six missing productioncatalog IDs are not fabricated; table audit uses existing original atomic entity keys",
+    "D05/D08 and unknown values/content remain missing or pending; backend/generic labels are not natural route completion",
+    "Global Windows/game/content conditions stay open; this audit adds no product OS behavior"
+  ],
+  "execution_issues_preserved": [
+    "Initial registered {worktree} invocation failed before scripts opened; exact-root adapter madeactual3sameSchecks run, repairs0/source/config/policy unchanged",
+    "Initial full inline review rejected beforeinference at actual1milliontoken providerlimit; completefile/diff sourceviews retainalloriginalbytes, no file/bytecaps, sameOpus5.5/sourceS"
+  ],
+  "normal_integration_candidate": null,
+  "repairs": 1,
+  "repair_cap": null,
+  "whole_original_review": {
+    "run_id": "38eaaacdb31b4c76bcf982987816a391",
+    "status": "pass",
+    "critical_high_medium": 0,
+    "low": 3,
+    "artifact": "ROOT_WHOLE_REVIEW_806DE25.json"
+  },
+  "actual_repair_worker": {
+    "id": "bf8a86e053044bfea0051253fefb2ec7",
+    "status": "finished"
+  },
+  "repair_scope": "Same5Docfiles: legacy presence vsoriginalconformance for4clauses, independent source-presence/evidence-loss tests, route-ending interruption crossrefs, precise hash labels. No game/values/pins/roster changes."
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_DEFERRED_LOW_NOTES_806DE25.json

@@ -0,0 +1,18 @@
+{
+  "actual_review": "38eaaacdb31b4c76bcf982987816a391",
+  "findings": [
+    {
+      "severity": "low",
+      "message": "Most data-level negative tests still compare the document against the same expected() canonical. The independent semantic checks name only three markers: restore_shield, shield_broken and EXCLUSIVE_LOCKED. Citations such as the preview service's contact/shield-candidate lines, and the 6850, 1039 and 1047 call sites, are checked only for text and blob equality, not for a function-name marker. Consider asserting a marker for every legacy entry."
+    },
+    {
+      "severity": "low",
+      "message": "The run log in IMPLEMENTATION_REPORT.md reports source binding actual_commit=e0420d5. That comes from the pre-commit local run. The Runner output correctly binds 806de25, but the report should mark that line as the pre-submission local value."
+    },
+    {
+      "severity": "low",
+      "message": "The snapshot_container evidence range (relationship_service.gd 423–479) starts mid-function and cuts off inside restore_snapshot. It is accurate as evidence, but a range aligned to function boundaries would be clearer for downstream owners (P18-01, P19-02)."
+    }
+  ],
+  "disposition": "Low severity optional hardening/clarity notes, not original audit blockers. Formal Runner output pins806de25; worker report e0420d5 is a pre-submission local-run HEAD, not the final accepted version."
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_EXACT_GAME_INPUT_REUSE_806DE25.json

@@ -0,0 +1,31 @@
+{
+  "artifact_S": "806de25068bc423136063791afcea811d251ee1b",
+  "existing_product_C": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "old_actual_native_S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "all1368_selected_source_settings_assets_tests_tools_byte_equal": true,
+  "marker_policy_engine_roster_parse_default_player_equal": true,
+  "scope": "All source_refs keys exactly equal; no file set was narrowed or omitted. New doc-only audit helpers are outside this unchanged pre-existing selection algorithm.",
+  "native_full_evidence_reuse_qualified": true,
+  "new_native_runs": 0,
+  "existing_full": {
+    "actual_suites": 184,
+    "missing_marker_paths": [],
+    "remaining_unexecuted_tests": [],
+    "available_marker_checks": 21903,
+    "actual_all_roster_checks": 21903,
+    "strict_accepted_checks": 21903,
+    "verified": true,
+    "composed": true,
+    "original_full_attempt_passed": false,
+    "whole_original_acceptance": false,
+    "parse_checks": 329,
+    "setup_phases": 2,
+    "owned_ended": 186,
+    "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "engines_started": 0,
+    "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+  },
+  "previous_actual_whole_backend_Opus_review": "ead8e74b9683404d8cf3d97bca118726",
+  "P19_whole_original_acceptance": "pending actual independent semantic review of full original §6–7, all21cells and all source/status/owner/gap claims, then normalintegration/final",
+  "time_ns": 1792234414270856000
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_EXACT_GAME_INPUT_REUSE_E0420D5.json

@@ -0,0 +1,31 @@
+{
+  "artifact_S": "e0420d57a381a1644357f0590536e1d47c9bca9f",
+  "existing_product_C": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "old_actual_native_S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "all1368_selected_source_settings_assets_tests_tools_byte_equal": true,
+  "marker_policy_engine_roster_parse_default_player_equal": true,
+  "scope": "All source_refs keys exactly equal; no file set was narrowed or omitted. New doc-only audit helpers are outside this unchanged pre-existing selection algorithm.",
+  "native_full_evidence_reuse_qualified": true,
+  "new_native_runs": 0,
+  "existing_full": {
+    "actual_suites": 184,
+    "missing_marker_paths": [],
+    "remaining_unexecuted_tests": [],
+    "available_marker_checks": 21903,
+    "actual_all_roster_checks": 21903,
+    "strict_accepted_checks": 21903,
+    "verified": true,
+    "composed": true,
+    "original_full_attempt_passed": false,
+    "whole_original_acceptance": false,
+    "parse_checks": 329,
+    "setup_phases": 2,
+    "owned_ended": 186,
+    "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "engines_started": 0,
+    "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+  },
+  "previous_actual_whole_backend_Opus_review": "ead8e74b9683404d8cf3d97bca118726",
+  "P19_whole_original_acceptance": "pending actual independent semantic review of full original §6–7, all21cells and all source/status/owner/gap claims, then normalintegration/final",
+  "time_ns": 1792233062748520000
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_FORMAL_VALIDATION_806DE25.json

@@ -0,0 +1,26 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "806de25068bc423136063791afcea811d251ee1b",
+  "kind": "validation",
+  "checks": [
+    {
+      "id": "p19-table",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/8d14038fd19c4277a2ab9d430bf2dbd0",
+      "passed": true
+    },
+    {
+      "id": "p19-negative",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/ad32d058245d45c6a0554ca92e0f46dd",
+      "passed": true
+    },
+    {
+      "id": "p19-source-binding",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/fec4a9beda95427d89b4050e07a771e9",
+      "passed": true
+    }
+  ],
+  "passed": true
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_FORMAL_VALIDATION_E0420D5.json

@@ -0,0 +1,26 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "e0420d57a381a1644357f0590536e1d47c9bca9f",
+  "kind": "validation",
+  "checks": [
+    {
+      "id": "p19-table",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/1c501211989843c190f0ee1eb6d4674b",
+      "passed": true
+    },
+    {
+      "id": "p19-negative",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/bc25ca3804ad4aa796ba7a2cf6d9a197",
+      "passed": true
+    },
+    {
+      "id": "p19-source-binding",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/3e07aaa43f84446aa0f375264e8d2d51",
+      "passed": true
+    }
+  ],
+  "passed": true
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_WHOLE_REVIEW_806DE25.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "806de25068bc423136063791afcea811d251ee1b",
+  "status": "pass",
+  "summary": "I re-reviewed the whole P19-03 unit at 806de25, read-only. I checked it against BASELINE §6 (lines 114–135) and §7 (lines 136–161), the work_packages P19-03 record, the 61 B-7.x atomic records snapshotted in the JSON, the immutable TASK_SPEC, and the frozen game source. I did not edit or run anything.\n\n**Original acceptance (「7名×3ルートの到達表があり、未制作内容は欠損として残る。」)**\n- The acceptance text is identical to work_packages.json:16100.\n- The table has 21 cells: the seven original names × 純愛/NTR/堕落.\n  - The names アンリ/フィーネ/トマリ/アメリア/リズ/ミミ/サツキ match BASELINE lines 118–124.\n  - The IDs are the existing atomic keys AR.heroine.<key>.route.{love,ntr,corruption}.\n  - No character or route was invented or substituted.\n- The catalog has only heroine_anri, and original_relationship_state.gd has no roster. So using the atomic keys, and leaving the six missing catalog IDs as explicit gaps, is honest and invents no IDs.\n- Each cell has all 8 categories. Common rules are kept separate from character-specific content.\n- Every character-specific item is recorded as 欠損 / 原本未定義 / D08 pending. Each carries a reason, an owner from the real work_packages deliverables (P18-02, P19-01, P19-02, P20-02, P26-01, P26-02), the citations [138–161] plus the character's own line, and natural_route_complete=false.\n- D05, D08, thresholds, rates and initial values all stay pending, with no invented numbers. The original's undefined per-character content therefore stays as gaps, which is what this audit acceptance allows. It is not game acceptance.\n\n**Previous findings from the e0420d5 review**\n1. MEDIUM, missing legacy evidence: fixed.\n   - coassignment_attack, zero_break, love_actions, threshold_route_loss and legacy_event_ui now carry legacy_evidence: path, anchor 1b07b87, git blob OID, file SHA-256, line range and quoted text.\n   - I checked every range against the real source:\n     - relationship_service.gd: restore_shield 246–261, apply_shield_attack 264–312 (includes shield_broken), request_route_lock 315–340, confirm_route_lock 343–355.\n     - simulation_runtime.gd: command registration 342–343 and the apply_shield_attack call at 6850.\n     - event_service.gd: lines 1039 and 1047.\n     - placement_risk_preview_service.gd: _contact_summary 536–565 and _shield_attack_candidates 619–640.\n     - main.gd: 98–101 is EVENT_CHOICE_NAMES. The correction from 89–101 is right, because 89–97 are unrelated excavation labels.\n   - These clauses all use the same rule: original status missing, classified legacy_not_original, with the P18-01 reason. The main.gd label constant is no longer credited as partial.\n2. LOW, independent tests: addressed.\n   - validate_legacy reads the anchored blobs via git show / rev-parse and is enforced by --check.\n   - The self-tests compute the blob OID independently with git hash-object, assert function and text markers, and reject evidence that is dropped, emptied, marked \"not implemented\", or has a stale OID or text, for every legacy clause.\n3. LOW, interruption cross-references: addressed. All 21 cells' interruption_cancellation entries now cite lines 148 and 153 (exact text plus baseline hash) and the legacy confirm_route_lock as legacy_not_original.\n4. LOW, hash labels: addressed in the checker constants, the checker output and the report.\n\n**Scope:** the diff touches only the 5 allowed files under execution/p19-03/. TASK_SPEC, the frozen pins, the selection record, the original registers and the game files are unchanged.\n\n**Validation:** all 3 registered checks ran on 806de25 and exited 0.\n- p19-table: --check output binds actual_commit 806de25, 1368 selected files, file_equality true.\n- p19-negative: 12 tests OK.\n- p19-source-binding: passed.\n\nThe earlier failed invocations were unexpanded `{worktree}` placeholders that never opened a script; no failure was turned into a pass.\n\nOnly low-severity notes remain, and they do not block the audit acceptance. Integration/final and the other gates are still required before the count moves from 14 to 15; I give no credit before those.",
+  "acceptance_ids": [
+    "P19-03"
+  ],
+  "findings": [
+    {
+      "severity": "low",
+      "message": "Most data-level negative tests still compare the document against the same expected() canonical. The independent semantic checks name only three markers: restore_shield, shield_broken and EXCLUSIVE_LOCKED. Citations such as the preview service's contact/shield-candidate lines, and the 6850, 1039 and 1047 call sites, are checked only for text and blob equality, not for a function-name marker. Consider asserting a marker for every legacy entry."
+    },
+    {
+      "severity": "low",
+      "message": "The run log in IMPLEMENTATION_REPORT.md reports source binding actual_commit=e0420d5. That comes from the pre-commit local run. The Runner output correctly binds 806de25, but the report should mark that line as the pre-submission local value."
+    },
+    {
+      "severity": "low",
+      "message": "The snapshot_container evidence range (relationship_service.gd 423–479) starts mid-function and cuts off inside restore_snapshot. It is accurate as evidence, but a range aligned to function boundaries would be clearer for downstream owners (P18-01, P19-02)."
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_WHOLE_REVIEW_E0420D5.json

@@ -0,0 +1,27 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "e0420d57a381a1644357f0590536e1d47c9bca9f",
+  "status": "changes_requested",
+  "summary": "Independent read-only whole-unit review of P19-03 at e0420d5 against BASELINE §6 (lines 114–135) and §7 (136–161), the B-7.x atomic records, work_packages and the immutable TASK_SPEC.\n\nWhat passes:\n- Scope: the diff adds only the 5 required files under execution/p19-03/**. TASK_SPEC, pins, selection record, original registers and game files are unchanged.\n- Roster and routes: exactly 7 original names (アンリ, フィーネ, トマリ, アメリア, リズ, ミミ, サツキ, matching BASELINE lines 118–124 and atomic entity keys AR.heroine.<key>.route.{love,ntr,corruption}) × 純愛/NTR/堕落 gives 21 cells. I confirmed the catalog has only heroine_anri/rival_rai and that original_relationship_state.gd has no roster, so using atomic keys and keeping the other six as gaps is honest and invents no IDs.\n- Gaps: every cell keeps 8 categories, separates common rules from character-specific content, marks character-specific content 欠損/D08 pending with a plausible owner (P18-02/P19-01/P19-02/P20-02/P26-01/P26-02), and sets natural_route_complete=false. Thresholds, rates, initial values and D05/D08 stay pending. Original citations quote exact line text with the baseline hash. Implemented/partial evidence carries path+SHA, bound to anchor 1b07b87 by blob equality.\n- Validation: the 3 registered checks ran on the same commit and exit 0 (10 self-tests OK; source binding 1368 files, file_equality true). The 3 initial exit-2 runs were literal `{worktree}` placeholders that never opened a script; no failure was converted to PASS.\n- Under the original acceptance wording the table structurally exists and missing content stays as gaps.\n\nWhat fails:\n- The 'audit existing support' requirement is not met, and several statuses are inaccurate. The audit marks coassignment_attack, zero_break, love_actions (shield recovery) and threshold_route_loss as \"not implemented\" with no source path. But the frozen game source has live legacy mechanisms for exactly these clauses:\n  - relationship_service.gd: apply_shield_attack (reports shield_broken), restore_shield, request_route_lock/confirm_route_lock (irreversible route lock).\n  - simulation_runtime.gd registers request_route_lock/confirm_route_lock as commands; line 6850 calls apply_shield_attack.\n  - event_service.gd lines 1039/1047 apply these as event effects.\n  - placement_risk_preview_service.gd computes heroine/rival contact intervals and _shield_attack_candidates.\n- Meanwhile a legacy UI label constant in main.gd is credited as 'partial'. Treating legacy support inconsistently undermines the audit's accuracy for downstream owners.\n\nThe legacy mechanisms need not count as original support (P18-01 forbids one-to-one conversion), but they must be listed with path+SHA and a stated reason for not crediting them. The 'not implemented' entries for the affected clauses are wrong as written.",
+  "acceptance_ids": [
+    "P19-03"
+  ],
+  "findings": [
+    {
+      "severity": "medium",
+      "message": "Existing-support audit is incomplete and inconsistent. coassignment_attack, zero_break, love_actions (shield recovery) and threshold_route_loss are recorded as implementation \"not implemented\", but frozen source at anchor 1b07b87 has live legacy mechanisms for them: scripts/relationship/relationship_service.gd apply_shield_attack (264–312, reports shield_broken), restore_shield (246–261), request_route_lock/confirm_route_lock (315–355); autoload/simulation_runtime.gd registers request_route_lock/confirm_route_lock as commands (342–343) and calls apply_shield_attack (6850); scripts/events/event_service.gd applies them as event effects (1039, 1047); scripts/relationship/placement_risk_preview_service.gd computes heroine/rival contact and _shield_attack_candidates (536, 619). Meanwhile a legacy main.gd label constant (89–101) is credited as 'partial'. Fix: record these legacy mechanisms per clause with exact path+SHA+lines at the anchor. Classify each as partial/legacy-not-original (or keep missing for the original model) with an explicit reason, e.g. P18-01 forbids one-to-one conversion and the numbers/daily limits are not approved originals. Keep owners and gaps unchanged. Regenerate the MD and add a self-test that rejects dropping this evidence."
+    },
+    {
+      "severity": "low",
+      "message": "Most data-level negative tests (wrong character/route, owner, status, stale text) mutate the document and compare it to a canonical built by the same expected() function. They only prove equality with hard-coded facts, not that those facts are correct. Source/baseline/blob/pin corruption tests are real. Consider adding independent assertions, e.g. that every 'missing' item's semantic claim is cross-checked against grep-able absence or presence in the cited source files, so mislabeled statuses like the one above are caught."
+    },
+    {
+      "severity": "low",
+      "message": "interruption_cancellation maps only §6.5 departure (line 135). The route-terminating clauses — duel loss 'ヒロインを即座に強奪' (153) and '純愛ルート完全消失' (148) — and legacy route_lock irreversibility are not cross-referenced as interruption/cancellation authorities. The character-specific gap covers it, but the common enumeration of interruption handling required by the original work is thin."
+    },
+    {
+      "severity": "low",
+      "message": "The checker's SPEC_HASH (263a01b9…) is the TASK_SPEC.json file-byte hash. It differs from the contract spec_sha256 (3af3d9b9…), presumably because the contract hashes a different serialization. The runner pass confirms the file is unchanged from base, but the report should say which representation each hash covers."
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/TASK_SPEC.json

@@ -0,0 +1,108 @@
+{
+  "id": "P19-03-TABLE",
+  "original_plan_id": "P19-03",
+  "title": "分岐の到達性",
+  "original_work": "人物ごとの3ルートに必要なイベント・条件・中断処理を列挙する。",
+  "original_acceptance": "7名×3ルートの到達表があり、未制作内容は欠損として残る。",
+  "original_denominator": {
+    "packages": 30,
+    "units": 88,
+    "completed_at_start": 14,
+    "partial_credit": false
+  },
+  "whole_original_unit_review_required": true,
+  "scope": "Whole original documentation/audit unit P19-03. Neutral non-graphic state/event IDs and exact source citations only; never create intimate content, narrative events, per-character mechanics or product numbers. Does not implement or accept route gameplay, content, endings, Windows or the whole game.",
+  "authority": [
+    {
+      "path": "docs/traceability/original/BASELINE.txt",
+      "sha256": "75e4bdbdeb379c9269553f0c776bdb9cc96e01f2d6aa5ca650d132c63a8aeb1a",
+      "sections": "Original §6 seven-character catalog; §7 lines136–161 three routes and relation/duel/action/history rules. Read actual full relevant lines, do not trust line numbers without matching text."
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/work_packages.json",
+      "unit": "P19-03",
+      "acceptance_exact": true
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/atomic_requirements.json",
+      "requirements": "B-7.1 through B-7.6 and relevant character/route clauses; inspect complete selected entries."
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/decisions.json",
+      "rule": "Only approved decisions may fill specifications. D08 pending cells remain 原本未定義/D08 pending 欠損."
+    }
+  ],
+  "actual_opus_selection": "dc342e4d69154660bef7e688a70fd783",
+  "frozen_game_input_pins_sha256": "6c778226a4cc6d0b0d682500759e7d4229c926a27bd2e247b00b9c3e5f1a2fb0",
+  "audit_source_anchor": "1b07b87d3736e777932315a4bdde8b70cbf9cb23",
+  "implementation_requirements": [
+    "Build REACHABILITY_TABLE.json plus deterministic REACHABILITY_TABLE.md with exactly7 canonical character IDs/names from original §6, existing catalog and scripts/relationship/original_relationship_state.gd, crossed with3 original routes 純愛/NTR/堕落. No invented or substituted character/route.",
+    "Every one of21 cells enumerates applicable entry/required events, source-defined state conditions, duel win/loss and route/selection effects, interruption/cancellation and save handling, history/marks and current reachability. Distinguish common baseline rules from character-specific content undefined by the original.",
+    "Every listed event/condition/handling item carries exact original line range+text/hash authority, concrete implementation status implemented/partial/missing, exact existing source path+SHA at the audited source anchor (or explicit not implemented with no fake path), and owning remaining original deliverable. Do not call backend model support a completed natural route.",
+    "Unproduced or undefined character-specific events/conditions/interruption/save/history content remains explicitly 欠損 with reason and owning remaining original item. Missing content is allowed by the unchanged original audit acceptance; it is never game acceptance. Preserve unknown numeric thresholds/rates/initial values as pending; use neutral abstract state IDs only.",
+    "Implement stdlib check_reachability_table.py and test_reachability_table.py under this documentation directory. This placement is inside actual Opus proposed docs/** scope and preserves the exact1368 selected native-game input set. Do not add new files under tools, game scripts, data, tests, marker registry or other game-selected paths.",
+    "Checker verifies exact7×3 unique complete cell set, canonical IDs, original pinned source+line text, no uncited item, exact current source SHA+anchor binding, valid status/owner and explicit gaps, no fabricated thresholds/unsupported completion, and byte-for-byte deterministic Markdown regeneration. --check must be read-only; optional --write may regenerate view during implementation.",
+    "Source binding enforces complete frozen selected-source map, no missing/new/changed selected files, marker/policy/engine/roster/parse identity and baseline hash. Validate FROZEN_GAME_INPUT_PINS.json against this immutable spec SHA field. Code source evidence may cite published audited anchor; checker output binds actual current commit and proves exact file equality. Do not fabricate a future self-containing commit SHA.",
+    "Cross-cutting UI/Runtime/save/Windows applicability is explicit: audit existing support and missing mechanisms per route; this documentation-only unit introduces no product OS behavior, so audit-unit native GUI/Windows execution is not applicable. Global/other-unit Windows and game acceptance remain open.",
+    "Self-tests meaningfully reject missing/duplicate cell, wrong character/route, missing category/citation, stale source/baseline text/hash, invented numeric threshold, missing content falsely marked complete, wrong owning deliverable/status, malformed JSON/types, or Markdown drift; include valid implemented/partial/missing controls. No test-count padding.",
+    "Reuse existing completed P13-03 content-audit checker pattern as guidance. Preserve all current game files, original text, decisions, frozen pins, immutable TASK_SPEC and selection record. Do not revise acceptance or invent D05/D08 answers.",
+    "Provide concise implementation report with all requirements mapped to files/checks, actual invocations/results and remaining parent/game gaps. No worker claim or exit0 substitutes for independent whole-unit review and normal gates."
+  ],
+  "required_outputs": [
+    "REACHABILITY_TABLE.json",
+    "REACHABILITY_TABLE.md",
+    "check_reachability_table.py",
+    "test_reachability_table.py",
+    "IMPLEMENTATION_REPORT.md"
+  ],
+  "validation_interface": [
+    {
+      "id": "p19-table",
+      "argv": [
+        "{python}",
+        "{worktree}/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py",
+        "--project-root",
+        "{worktree}",
+        "--check"
+      ]
+    },
+    {
+      "id": "p19-negative",
+      "argv": [
+        "{python}",
+        "{worktree}/docs/plans/original-completion-2026-10-02/execution/p19-03/test_reachability_table.py",
+        "--project-root",
+        "{worktree}"
+      ]
+    },
+    {
+      "id": "p19-source-binding",
+      "argv": [
+        "{python}",
+        "{worktree}/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py",
+        "--project-root",
+        "{worktree}",
+        "--source-binding-only"
+      ]
+    }
+  ],
+  "workflow": [
+    "Register fixed original acceptance P19-03 once; actual Opus confirms next registered run and chooses Sol6.1 default/Astra only justified. One managed worker, no duplicate task.",
+    "Worker local static+checker+self-tests only; do not run native full during implementation.",
+    "Required full native evidence may be reused only after independent exact candidate input equality against frozen C/S source/settings/markers/policy/engine/test inputs/roster/applicability. Doc helpers live outside selected source set; no narrowed equality definition. If equality fails do not claim reuse or launch an uncontrolled full.",
+    "Separate actual Opus whole-original P19-03 review against full original §6–7 and exact acceptance. Reviewer decides whether explicit D08/content gaps satisfy audit acceptance; fail honestly if not, never redefine it.",
+    "Normal prepare-integration, actual C/M exact equality, existing real main permission only (no fabricated new human speech), normal final, ledger+push. Only then original P19-03 may add1 to14/88."
+  ],
+  "pending_not_waived": [
+    "P04 existing D05 owner choices",
+    "D08 production chapter/route/content scope",
+    "P19-01/02 Runtime and normal route gameplay",
+    "P20/P26 content/endings/encyclopedia",
+    "P13 four low production followups",
+    "Global same-Windows acceptance and held gestures remain open"
+  ],
+  "model_proposal": {
+    "codex_model": "gpt-6.1-sol",
+    "actual_opus_decision": "dc342e4d69154660bef7e688a70fd783"
+  }
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py

@@ -0,0 +1,325 @@
+#!/usr/bin/env python3
+"""Read-only, stdlib P19-03 documentation validator; never accepts gameplay."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import sys
+
+OUT = 'docs/plans/original-completion-2026-10-02/execution/p19-03/'
+PLAN = 'docs/plans/original-completion-2026-10-02/'
+BASELINE = 'docs/traceability/original/BASELINE.txt'
+ANCHOR = '1b07b87d3736e777932315a4bdde8b70cbf9cb23'
+BASE = '8ca9263fee1ec4374d97c01fda82b95e1df6a977'
+BASE_HASH = '75e4bdbdeb379c9269553f0c776bdb9cc96e01f2d6aa5ca650d132c63a8aeb1a'
+SPEC_FILE_BYTES_SHA256 = '263a01b943d8056727335fb76977c010298e1c229077f8da76e48683ba2e89bb'
+# Proof: build/owner-handoff/p19-review-r01/SPEC_HASH_REPRESENTATIONS.json
+# Both hashes describe the same unchanged TASK_SPEC.json.
+RUNNER_CONTRACT_SPEC_SHA256 = '3af3d9b931edc5449796662ad69bb6f67c80b48827a86565b1952931db68dd15'
+PINS_HASH = '6c778226a4cc6d0b0d682500759e7d4229c926a27bd2e247b00b9c3e5f1a2fb0'
+ROUTES = {'love': '純愛', 'ntr': 'NTR', 'corruption': '堕落'}
+PEOPLE = [('anri', 'アンリ'), ('fine', 'フィーネ'), ('tomari', 'トマリ'),
+          ('amelia', 'アメリア'), ('liz', 'リズ'), ('mimi', 'ミミ'), ('satsuki', 'サツキ')]
+CATEGORIES = ('entry_required_events', 'state_conditions', 'duel_effects',
+              'route_selection_effects', 'interruption_cancellation', 'save_handling',
+              'history_marks', 'current_reachability')
+STATE = 'scripts/relationship/original_relationship_state.gd'
+SERVICE = 'scripts/relationship/relationship_service.gd'
+RUNTIME = 'autoload/simulation_runtime.gd'
+CATALOG = 'data/characters/mvp_unique_characters.json'
+
+EVENT = 'scripts/events/event_service.gd'
+PREVIEW = 'scripts/relationship/placement_risk_preview_service.gd'
+LEGACY_REASON = 'P18-01 forbids one-to-one conversion; legacy numbers/daily limits are not approved originals.'
+LEGACY_RANGES = {
+ 'coassignment_attack': [(SERVICE,264,312),(RUNTIME,6850,6850),(EVENT,1039,1039),(PREVIEW,536,565),(PREVIEW,619,640)],
+ 'zero_break': [(SERVICE,264,312),(RUNTIME,6850,6850),(EVENT,1039,1039)],
+ 'love_actions': [(SERVICE,246,261)],
+ 'threshold_route_loss': [(SERVICE,315,340),(SERVICE,343,355),(RUNTIME,342,343),(EVENT,1047,1047)],
+ 'legacy_event_ui': [('scenes/main/main.gd',98,101)],
+}
+
+
+def validate_legacy(root, document):
+    rules = {r['id']: r for r in document['common_rules']}
+    for identity, ranges in LEGACY_RANGES.items():
+        rule = rules[identity]
+        require(rule['status'] == 'missing' and rule['legacy_classification'] == 'legacy_not_original',
+                'legacy/original classification')
+        require(rule['implementation'] == 'original conformance missing; see legacy_evidence'
+                and rule['legacy_reason'] == LEGACY_REASON, 'unqualified legacy absence')
+        entries = rule.get('legacy_evidence')
+        require(type(entries) is list and len(entries) == len(ranges), 'missing legacy evidence')
+        for entry, (path, start, end) in zip(entries, ranges):
+            data = blob(root, ANCHOR, path)
+            oid = subprocess.check_output(['git','rev-parse',ANCHOR+':'+path],cwd=root).decode().strip()
+            require(entry == {'path':path,'anchor':ANCHOR,'git_blob_oid':oid,
+                'sha256':sha(data),'lines':[start,end],
+                'text':'\n'.join(data.decode().splitlines()[start-1:end])}, 'legacy text/blob/range')
+            require(data == (root/path).read_bytes(), 'legacy current source mismatch')
+
+
+def sha(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def require(value, message):
+    if not value:
+        raise ValueError(message)
+
+
+def decode(data):
+    def unique(pairs):
+        result = {}
+        for k, v in pairs:
+            require(k not in result, 'duplicate JSON key: ' + k)
+            result[k] = v
+        return result
+    return json.loads(data, object_pairs_hook=unique,
+                      parse_constant=lambda s: (_ for _ in ()).throw(ValueError(s)))
+
+
+def blob(root, commit, path):
+    return subprocess.check_output(['git', 'show', commit + ':' + path], cwd=root)
+
+
+def selection(root):
+    paths = [p for folder in ('autoload', 'scripts', 'scenes', 'data', 'tests', 'assets', 'tools')
+             for p in (root / folder).rglob('*')
+             if p.is_file() and p.name != '.DS_Store' and '__pycache__' not in p.parts]
+    paths += [root / p for p in ('project.godot', 'export_presets.cfg', 'Makefile', 'AGENTS.md')]
+    require(all(not p.is_symlink() for p in paths), 'selected source aliases refused')
+    return {p.relative_to(root).as_posix(): {'bytes': p.stat().st_size, 'sha256': sha(p.read_bytes())}
+            for p in sorted(paths)}
+
+
+def binding(root):
+    raw = lambda p: (root / p).read_bytes()
+    require(sha(raw(OUT + 'TASK_SPEC.json')) == SPEC_FILE_BYTES_SHA256, 'immutable spec changed')
+    spec = decode(raw(OUT + 'TASK_SPEC.json'))
+    require(sha(raw(OUT + 'FROZEN_GAME_INPUT_PINS.json')) == spec['frozen_game_input_pins_sha256'] == PINS_HASH,
+            'frozen pins SHA differs from immutable spec')
+    pins = decode(raw(OUT + 'FROZEN_GAME_INPUT_PINS.json'))
+    require(pins['audited_game_source_anchor_commit'] == spec['audit_source_anchor'] == ANCHOR, 'anchor identity')
+    actual = selection(root)
+    require(actual == pins['source_files'], 'full selected-source map: missing/new/changed file')
+    for key in ('marker_contract', 'policy', 'engine'):
+        require(sha(Path(pins[key + '_path']).read_bytes() if key == 'engine' else raw(pins[key + '_path']))
+                == pins[key + '_sha256'], key + ' identity')
+    require(sha(raw(BASELINE)) == pins['baseline_sha256'] == BASE_HASH, 'baseline hash')
+    require(len(raw(BASELINE)) == pins['baseline_bytes'], 'baseline bytes')
+    roster = ['tests/run_tests.gd'] + sorted(p.relative_to(root).as_posix()
+        for p in (root / 'tests').rglob('test*.gd') if 'export' not in p.relative_to(root).parts
+        and p.relative_to(root).as_posix() != 'tests/s0/test_kernel_and_save.gd')
+    require(roster == pins['roster'], 'roster identity')
+    require(sum(p.endswith('.gd') for p in actual) == pins['parse_files'], 'parse selection identity')
+    # Audit evidence is bound to published blobs, never a future self-containing commit.
+    for p in (STATE, SERVICE, RUNTIME, CATALOG):
+        require(raw(p) == blob(root, ANCHOR, p), 'stale audited source: ' + p)
+    return {'actual_commit': subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=root).decode().strip(),
+            'selected_files': len(actual), 'anchor': ANCHOR, 'file_equality': True,
+            'native_evidence_reuse_accepted': False,
+            'TASK_SPEC_file_bytes_sha256': SPEC_FILE_BYTES_SHA256,
+            'Runner_git_show_stripped_UTF8_contract_spec_sha256': RUNNER_CONTRACT_SPEC_SHA256}
+
+
+def expected(root):
+    raw = lambda p: (root / p).read_bytes()
+    require(sha(raw(BASELINE)) == BASE_HASH, 'baseline changed')
+    for name in ('atomic_requirements.json', 'work_packages.json', 'decisions.json'):
+        require(raw(PLAN + name) == blob(root, BASE, PLAN + name), 'original register changed: ' + name)
+    require(raw(OUT + 'ACTUAL_OPUS_NEXT_ORIGINAL_UNIT_SELECTION.json') ==
+            blob(root, BASE, OUT + 'ACTUAL_OPUS_NEXT_ORIGINAL_UNIT_SELECTION.json'), 'selection record changed')
+    lines = raw(BASELINE).decode().splitlines()
+    def cite(start, end=None):
+        end = end or start
+        return {'path': BASELINE, 'lines': [start, end],
+                'text': '\n'.join(lines[start - 1:end]), 'baseline_sha256': BASE_HASH}
+    def evidence(path, start, end):
+        data = blob(root, ANCHOR, path)
+        require(data == raw(path), 'stale source ' + path)
+        return {'path': path, 'sha256': sha(data), 'anchor': ANCHOR,
+                'lines': [start, end], 'text': '\n'.join(data.decode().splitlines()[start - 1:end])}
+    def item(identity, start, end, note, owner, status='missing', source=None):
+        return {'id': identity, 'authority': cite(start, end), 'status': status,
+                'implementation': source or 'original conformance missing', 'owner': owner,
+                'observation': note, 'gap': None if status == 'implemented' else '欠損: ' + note}
+    # Only narrow storage facts are implemented; simulation/route completion never follows.
+    rules = [
+        item('state_fields', 138, 143, '原本3値と盾の明示値の検証・保持のみ。初期値と更新方針は未定。',
+             'P18-01', 'implemented', evidence(STATE, 4, 34)),
+        item('affection_max_invariant', 140, 140, '入力時の最大値一致検証のみ。通常操作の回復・更新は欠損。',
+             'P18-01', 'partial', evidence(STATE, 20, 30)),
+        item('snapshot_container', 138, 143, '専用状態と旧値の分離保存・復元。人物別ルート進行保存を意味しない。',
+             'P18-01', 'partial', evidence(SERVICE, 423, 479)),
+        item('identity_registration', 138, 138, 'Runtimeは登録済み人物・相互対応を検証。既存カタログのヒロインはアンリのみ。通常ルート入口ではない。',
+             'P19-01', 'partial', evidence(RUNTIME, 6791, 6812)),
+        item('legacy_event_ui', 154, 157, '既存UIには汎用関係イベントの確認/保留ラベルがある。原本の行動・決闘選択・自然ルート到達は欠損。',
+             'P19-01', 'partial', evidence('scenes/main/main.gd', 98, 101)),
+    ]
+    clauses = [
+        ('defense_reduction', 141, 141, 'P18-02'), ('post_break_metric', 142, 143, 'P18-02'),
+        ('barrier_block', 143, 143, 'P18-02'), ('coassignment_attack', 145, 145, 'P18-02'),
+        ('zero_break', 146, 146, 'P18-02'), ('contact_after_break', 147, 147, 'P18-02'),
+        ('threshold_route_loss', 148, 148, 'P18-03'), ('duel_types', 150, 151, 'P19-01'),
+        ('duel_win', 152, 152, 'P19-01'), ('duel_loss', 153, 153, 'P19-01'),
+        ('love_actions', 155, 155, 'P19-01'), ('ntr_actions', 156, 156, 'P19-01'),
+        ('corruption_actions', 157, 157, 'P19-01'), ('history_fields', 159, 159, 'P19-02'),
+        ('history_cycle_parentage', 160, 160, 'P19-02'), ('portrait_marks', 161, 161, 'P26-02'),
+        ('route_skills', 132, 132, 'P20-01'), ('departure', 135, 135, 'P19-02')]
+    for identity, start, end, owner in clauses:
+        rules.append(item(identity, start, end,
+            '原本の共通要求。専用原本モデルにはこの更新・表示の実装なし。旧汎用モデルの数値やルートを代用しない。', owner))
+    for rule in rules:
+        if rule['id'] in LEGACY_RANGES:
+            rule.update(status='missing', implementation='original conformance missing; see legacy_evidence',
+                        legacy_classification='legacy_not_original', legacy_reason=LEGACY_REASON)
+            rule['gap'] = '欠損: ' + rule['observation'] + ' ' + LEGACY_REASON
+            rule['legacy_evidence'] = []
+            for path, start, end in LEGACY_RANGES[rule['id']]:
+                entry = evidence(path, start, end)
+                entry['git_blob_oid'] = subprocess.check_output(
+                    ['git','rev-parse',ANCHOR+':'+path],cwd=root).decode().strip()
+                rule['legacy_evidence'].append(entry)
+    # Read complete selected atomic records, not only their condition strings.
+    atoms = decode(raw(PLAN + 'atomic_requirements.json'))['requirements']
+    atoms = [x for x in atoms if set(x.get('source_group_ids', [])) & {'B-7.' + str(i) for i in range(1, 7)}]
+    owners = {x['id'] for p in decode(raw(PLAN + 'work_packages.json')) for x in p.get('remaining_deliverables', [])}
+    require(all(r['owner'] in owners for r in rules), 'unknown original owner')
+    for key, name in PEOPLE:
+        for route in ROUTES:
+            require(any(x['id'] == 'AR.heroine.' + key + '.route.' + route and
+                        x['entity'] == {'kind': 'heroine', 'key': key, 'original_name': name} for x in atoms),
+                    'canonical atomic character/route missing')
+    require(all(name in lines[117 + i] for i, (_, name) in enumerate(PEOPLE)), 'original character names')
+    cells = []
+    for i, (key, name) in enumerate(PEOPLE):
+        for route, route_name in ROUTES.items():
+            refs = {
+                'entry_required_events': ['identity_registration', route + '_actions'],
+                'state_conditions': ['state_fields', 'affection_max_invariant', 'defense_reduction',
+                    'post_break_metric', 'barrier_block', 'coassignment_attack', 'zero_break', 'contact_after_break'],
+                'duel_effects': ['duel_types', 'duel_win', 'duel_loss'],
+                'route_selection_effects': ['threshold_route_loss', route + '_actions', 'route_skills'],
+                'interruption_cancellation': ['departure', 'threshold_route_loss', 'duel_loss'], 'save_handling': ['snapshot_container'],
+                'history_marks': ['history_fields', 'history_cycle_parentage', 'portrait_marks'],
+                'current_reachability': ['identity_registration', 'threshold_route_loss']}
+            categories = {}
+            for category in CATEGORIES:
+                owner = {'entry_required_events': 'P26-01', 'state_conditions': 'P18-02',
+                         'duel_effects': 'P19-01', 'route_selection_effects': 'P26-02',
+                         'interruption_cancellation': 'P19-02', 'save_handling': 'P19-02',
+                         'history_marks': 'P19-02', 'current_reachability': 'P20-02'}[category]
+                gap = item(key + '_' + route + '_' + category, 138, 161,
+                    '原本未定義/D08 pending: 人物固有のイベント列・条件・中断取消・進行保存・履歴と通常到達は未制作/未証明。共通要求から固有仕様を創作しない。', owner)
+                gap['character_authority'] = cite(118 + i)
+                categories[category] = {'common_rule_refs': refs[category], 'character_specific': gap}
+                if category == 'interruption_cancellation':
+                    categories[category].update(route_termination_authorities=[cite(148),cite(153)],
+                        legacy_classification='legacy_not_original', legacy_reason=LEGACY_REASON,
+                        legacy_evidence=[e for r in rules if r['id']=='threshold_route_loss'
+                                         for e in r['legacy_evidence'] if e['path']==SERVICE and e['lines']==[343,355]])
+
+            cells.append({'character_id': key, 'name': name, 'route_id': route, 'route': route_name,
+                          'natural_route_complete': False, 'categories': categories})
+    return {'task_id': 'P19-03-TABLE', 'schema_version': 1,
+            'identity_policy': '原本§6の名前とatomic entity.keyを監査IDに使用。実装IDを捏造しない。カタログにはheroine_anriのみ。OriginalRelationshipStateはsubject_idを保持し7名の列挙はしない。',
+            'source_anchor': ANCHOR, 'common_rules': rules, 'cells': cells,
+            'authority_snapshots': {p: {'sha256': sha(raw(p)), 'base_commit': BASE,
+                'records': decode(raw(p)) if p.endswith('decisions.json') else atoms if p.endswith('atomic_requirements.json')
+                else [x for x in decode(raw(p)) if x['id'] in ('P18', 'P19', 'P20', 'P26')]}
+                for p in (PLAN + 'atomic_requirements.json', PLAN + 'work_packages.json', PLAN + 'decisions.json')},
+            'catalog_evidence': evidence(CATALOG, 1, 32),
+            'pending': {'D05': 'pending', 'D08': 'pending', 'thresholds': None, 'rates': None, 'initial_values': None},
+            'route_support': {r: {'UI': '欠損: 原本行動・3種決闘・原本3軸/盾の通常操作なし。既存汎用関係UIを原本ルートとしない。',
+                'Runtime': 'partial: 原本明示状態の登録・identity検証のみ。共通更新と通常ルート到達は欠損。',
+                'save': 'partial: 専用状態/旧値コンテナ保存あり。人物固有進行・中断再開は欠損。',
+                'Windows': '未受入: global same-Windows acceptanceはopen。文書単位のnative GUI/Windows実行は適用外。',
+                'evidence_refs': ['legacy_event_ui', 'identity_registration', 'snapshot_container', 'state_fields'],
+                'missing_mechanisms': [x[0] for x in clauses]} for r in ROUTES.values()},
+            'acceptance': '7名×3ルートの到達表があり、未制作内容は欠損として残る。',
+            'accounting': '14/88 unchanged; formal Runner validation, independent whole-unit Opus review and normal integration/final required; no game acceptance'}
+
+
+def verify(candidate, canonical, root=None):
+    require(type(candidate) is dict, 'document must be an object')
+    if root is not None:
+        validate_legacy(root, candidate)
+    # Exact canonical equality also rejects additions, type coercion, invented numbers,
+    # owner/status promotion and unsupported completion, including nested metadata.
+    require(json.dumps(candidate, ensure_ascii=False, sort_keys=True) ==
+            json.dumps(canonical, ensure_ascii=False, sort_keys=True), 'table differs from pinned canonical audit')
+
+
+def verify_records(candidate, canonical, markdown_bytes):
+    verify(candidate, canonical)
+    require(markdown_bytes == markdown(canonical).encode(), 'Markdown drift')
+
+
+def markdown(d):
+    lines = ['# P19-03 到達表', '', d['acceptance'], '', d['identity_policy'], '',
+             '共通原本ルールと人物固有欠損を分離する。implementedは狭い保持処理だけで、自然ルート完成ではない。', '',
+             '|人物ID|原名|ルート|現在の到達性|', '|---|---|---|---|']
+    for c in d['cells']:
+        lines.append('|%s|%s|%s|欠損・通常到達未証明|' % (c['character_id'], c['name'], c['route']))
+    lines += ['', '## 共通原本ルール', '']
+    for r in d['common_rules']:
+        lines += ['### ' + r['id'], '', r['status'] + ' / owner: ' + r['owner'], '',
+                  r['observation'], '', '原本 %s:%s–%s' % (BASELINE, *r['authority']['lines']), '',
+                  '```text', r['authority']['text'], '```', '',
+                  '実装証拠: ' + json.dumps(r['implementation'], ensure_ascii=False, sort_keys=True), '']
+        if 'legacy_evidence' in r:
+            lines += ['旧実装: ' + r['legacy_classification'] + ' / ' + r['legacy_reason'], '',
+                      '旧証拠 (git_blob_oid: Git blob OID; sha256: file-bytes SHA-256): ' +
+                      json.dumps(r['legacy_evidence'], ensure_ascii=False, sort_keys=True), '']
+    for c in d['cells']:
+        lines += ['## ' + c['character_id'] + ' / ' + c['name'] + ' / ' + c['route'], '']
+        for category, record in c['categories'].items():
+            g = record['character_specific']
+            lines += ['- ' + category + ': 共通 [' + ', '.join(record['common_rule_refs']) +
+                      '] / missing / ' + g['gap'] + ' / owner: ' + g['owner'] +
+                      ' / 原本 ' + str(g['authority']['lines']) + '・人物 ' + str(g['character_authority']['lines'])]
+            if category == 'interruption_cancellation':
+                lines += ['  原本中断参照: ' + json.dumps(record['route_termination_authorities'], ensure_ascii=False),
+                          '  旧確定ロック legacy_not_original: ' + json.dumps(record['legacy_evidence'], ensure_ascii=False)]
+        lines.append('')
+    lines += ['## ルート別適用性', '']
+    for route, support in d['route_support'].items():
+        lines += ['### ' + route, '']
+        lines += ['- ' + k + ': ' + v for k, v in support.items() if isinstance(v, str)]
+        lines += ['- 欠損機構: ' + ', '.join(support['missing_mechanisms']), '']
+    lines += ['D05/D08、閾値・率・初期値はpending。完全な出典本文・SHA・原子要件全レコードはJSONに保持する。', '', d['accounting'], '']
+    return '\n'.join(lines)
+
+
+def main():
+    p = argparse.ArgumentParser(description=__doc__)
+    p.add_argument('--project-root', type=Path, required=True)
+    mode = p.add_mutually_exclusive_group(required=True)
+    mode.add_argument('--check', action='store_true')
+    mode.add_argument('--write', action='store_true')
+    mode.add_argument('--source-binding-only', action='store_true')
+    args = p.parse_args()
+    try:
+        root = args.project_root.resolve()
+        result = binding(root)
+        if not args.source_binding_only:
+            canonical = expected(root)
+            validate_legacy(root, canonical)
+            if args.write:
+                (root / OUT / 'REACHABILITY_TABLE.json').write_text(json.dumps(canonical, ensure_ascii=False, indent=2) + '\n', encoding='utf-8')
+                (root / OUT / 'REACHABILITY_TABLE.md').write_text(markdown(canonical), encoding='utf-8')
+            else:
+                validate_legacy(root, decode((root / OUT / 'REACHABILITY_TABLE.json').read_bytes()))
+                verify_records(decode((root / OUT / 'REACHABILITY_TABLE.json').read_bytes()), canonical,
+                               (root / OUT / 'REACHABILITY_TABLE.md').read_bytes())
+        print(json.dumps({'audit_integrity': 'pass', 'formal_acceptance': 'pending_runner_and_independent_review', **result}))
+        return 0
+    except (ValueError, OSError, KeyError, TypeError, subprocess.CalledProcessError) as e:
+        print(json.dumps({'audit_integrity': 'fail', 'error': str(e)}))
+        return 1
+
+
+if __name__ == '__main__':
+    sys.exit(main())

docs/plans/original-completion-2026-10-02/execution/p19-03/test_reachability_table.py

@@ -0,0 +1,167 @@
+#!/usr/bin/env python3
+"""Meaningful in-memory controls; no product, Git or fixture writes."""
+import argparse
+import copy
+from pathlib import Path
+import unittest
+from unittest.mock import patch
+import check_reachability_table as audit
+
+ROOT = None
+
+
+class AuditTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.canonical = audit.expected(ROOT)
+
+    def reject(self, mutate):
+        changed = copy.deepcopy(self.canonical)
+        mutate(changed)
+        with self.assertRaises(ValueError):
+            audit.verify(changed, self.canonical)
+
+    def test_valid_implemented_partial_missing(self):
+        # All three legitimate status classes must survive serialization and the
+        # exact same verifier used by --check, without status promotion.
+        import json
+        value = audit.decode(json.dumps(self.canonical))
+        self.assertEqual({r['status'] for r in value['common_rules']}, {'implemented', 'partial', 'missing'})
+        audit.verify(value, self.canonical)
+
+    def test_independent_legacy_source_evidence(self):
+        import subprocess
+        document = audit.decode((ROOT / audit.OUT / 'REACHABILITY_TABLE.json').read_bytes())
+        audit.validate_legacy(ROOT, document)
+        for rule in document['common_rules']:
+            for entry in rule.get('legacy_evidence', []):
+                data = subprocess.check_output(['git', 'show', audit.ANCHOR + ':' + entry['path']], cwd=ROOT)
+                self.assertEqual(data, (ROOT / entry['path']).read_bytes())
+                self.assertEqual(entry['git_blob_oid'], subprocess.check_output(
+                    ['git','hash-object','--stdin'], input=data, cwd=ROOT).decode().strip())
+                start, end = entry['lines']
+                self.assertEqual(entry['text'], '\n'.join(data.decode().splitlines()[start-1:end]))
+        rules = {r['id']: r for r in document['common_rules']}
+        self.assertIn('func restore_shield', rules['love_actions']['legacy_evidence'][0]['text'])
+        self.assertIn('shield_broken', rules['zero_break']['legacy_evidence'][0]['text'])
+        self.assertIn('EXCLUSIVE_LOCKED', rules['threshold_route_loss']['legacy_evidence'][1]['text'])
+
+    def test_legacy_evidence_required_independently(self):
+        for identity in audit.LEGACY_RANGES:
+            for mutation in ('drop', 'empty', 'absence', 'blob', 'text'):
+                changed = copy.deepcopy(self.canonical)
+                rule = next(r for r in changed['common_rules'] if r['id'] == identity)
+                if mutation == 'drop':
+                    rule.pop('legacy_evidence')
+                elif mutation == 'empty':
+                    rule['legacy_evidence'] = []
+                elif mutation == 'absence':
+                    rule['implementation'] = 'not implemented'
+                else:
+                    rule['legacy_evidence'][0]['git_blob_oid' if mutation == 'blob' else 'text'] = 'stale'
+                with self.subTest(identity=identity, mutation=mutation), self.assertRaises(ValueError):
+                    audit.validate_legacy(ROOT, changed)
+
+    def test_exact_cell_product(self):
+        mutations = {
+            'missing': lambda d: d['cells'].pop(),
+            'duplicate': lambda d: d['cells'].append(copy.deepcopy(d['cells'][0])),
+            'wrong_character': lambda d: d['cells'][0].update(character_id='unregistered'),
+            'wrong_route': lambda d: d['cells'][0].update(route='unregistered'),
+        }
+        for name, mutate in mutations.items():
+            with self.subTest(name=name):
+                self.reject(mutate)
+
+    def test_categories_and_citations(self):
+        self.reject(lambda d: d['cells'][0]['categories'].pop('save_handling'))
+        self.reject(lambda d: d['common_rules'][0].pop('authority'))
+        self.reject(lambda d: d['cells'][0]['categories']['state_conditions']['character_specific'].pop('character_authority'))
+
+    def test_stale_record_evidence(self):
+        for field in ('text', 'baseline_sha256'):
+            with self.subTest(field=field):
+                self.reject(lambda d: d['common_rules'][0]['authority'].update({field: 'stale'}))
+        for field in ('text', 'sha256', 'anchor'):
+            with self.subTest(field=field):
+                self.reject(lambda d: d['common_rules'][0]['implementation'].update({field: 'stale'}))
+
+    def test_real_source_and_baseline_changes(self):
+        original = Path.read_bytes
+        for target in (audit.BASELINE, audit.STATE):
+            def corrupt(path):
+                value = original(path)
+                return value + b'\nchanged' if path == ROOT / target else value
+            with self.subTest(target=target), patch.object(Path, 'read_bytes', corrupt):
+                with self.assertRaises(ValueError):
+                    audit.expected(ROOT)
+        actual_blob = audit.blob
+        def corrupt_blob(root, commit, path):
+            value = actual_blob(root, commit, path)
+            return value + b'\nchanged' if path == audit.STATE else value
+        with patch.object(audit, 'blob', side_effect=corrupt_blob):
+            with self.assertRaises(ValueError):
+                audit.expected(ROOT)
+
+    def test_no_invented_values_or_completion(self):
+        self.reject(lambda d: d['pending'].update(thresholds=50))
+        self.reject(lambda d: d['common_rules'][5].update(status='implemented'))
+        self.reject(lambda d: d['cells'][0].update(natural_route_complete=True))
+        self.reject(lambda d: d['cells'][0]['categories']['entry_required_events']['character_specific'].update(status='implemented', gap=None))
+
+    def test_owner_and_status(self):
+        self.reject(lambda d: d['common_rules'][0].update(owner='P99-01'))
+        self.reject(lambda d: d['common_rules'][0].update(owner='P19-02'))
+        self.reject(lambda d: d['common_rules'][0].update(status='complete'))
+
+    def test_json_and_types(self):
+        for data in ('{', '{"x":1,"x":2}', '{"x":NaN}'):
+            with self.subTest(data=data), self.assertRaises(ValueError):
+                audit.decode(data)
+        for value in ([], None, 'table'):
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                audit.verify(value, self.canonical)
+        self.reject(lambda d: d.update(cells={}))
+        self.reject(lambda d: d.update(schema_version=True))
+
+    def test_markdown_drift(self):
+        expected = audit.markdown(self.canonical).encode()
+        audit.verify_records(self.canonical, self.canonical,
+                             (ROOT / audit.OUT / 'REACHABILITY_TABLE.md').read_bytes())
+        with self.assertRaises(ValueError):
+            audit.verify_records(self.canonical, self.canonical, expected + b'\nchanged')
+
+    def test_full_frozen_map_and_identities(self):
+        audit.binding(ROOT)  # Valid frozen-map control; no native execution.
+        actual_selection = audit.selection(ROOT)
+        for kind in ('missing', 'new', 'changed'):
+            changed = copy.deepcopy(actual_selection)
+            key = next(iter(changed))
+            if kind == 'missing':
+                del changed[key]
+            elif kind == 'new':
+                changed['scripts/invented.gd'] = {'bytes': 0, 'sha256': '0' * 64}
+            else:
+                changed[key]['sha256'] = '0' * 64
+            with self.subTest(kind=kind), patch.object(audit, 'selection', return_value=changed):
+                with self.assertRaises(ValueError):
+                    audit.binding(ROOT)
+        original = Path.read_bytes
+        pins = audit.decode(original(ROOT / audit.OUT / 'FROZEN_GAME_INPUT_PINS.json'))
+        targets = [ROOT / audit.OUT / 'FROZEN_GAME_INPUT_PINS.json', ROOT / pins['marker_contract_path'],
+                   ROOT / pins['policy_path'], Path(pins['engine_path'])]
+        for target in targets:
+            def corrupt(path):
+                value = original(path)
+                return value + b'\nchanged' if path == target else value
+            with self.subTest(target=str(target)), patch.object(Path, 'read_bytes', corrupt):
+                with self.assertRaises(ValueError):
+                    audit.binding(ROOT)
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--project-root', type=Path, required=True)
+    args, rest = parser.parse_known_args()
+    ROOT = args.project_root.resolve()
+    unittest.main(argv=[__file__] + rest)

docs/plans/original-completion-2026-10-02/execution/p24-02/normal-os-case-20261017/AUTHORITATIVE_NARROW_CASE_CLARIFICATIONS.json

@@ -0,0 +1,49 @@
+{
+  "scope": "Authoritative limited-case factual clarification after separate Opus review. Original primary files kept unchanged, no new gameplay/OS execution",
+  "source": {
+    "S": "fe44f550750acbf5c510346e7cacbea2ccbdd184",
+    "M": "565fd805079d8c446f29e30c57979242561113ea",
+    "Q": "42989fd90f5f83db86f846eb42b5cf2d847461a5",
+    "T": "905d844d523529862259d1b7a210fd1e7964f054"
+  },
+  "actual_review_run": "b4160dbc2bca407598d2fc2e22bff24f",
+  "actual_pause_seconds": 89.116049,
+  "actual_clock_samples": 824,
+  "sample_count_scope": "824 clock/paused-state samples, not 847 (which was sequence span); none of the per-sample rows contains a full-model digest",
+  "model_identity_scope": {
+    "checkpoints": {
+      "paused_before_menu": 2254,
+      "new_slot_dialog": 2565,
+      "cancelled": 2797
+    },
+    "digest": "077b7b8106f2448586e2ca9617e7c5525f7a7f90a71d12928a089cbe7ef1d633",
+    "binary_sha256": "7a166acfe98c39dc4432058b054e66aaa5f28485dc78ae9b406d8fa2b35204f3",
+    "continuous_model_identity_not_proven": true
+  },
+  "focus_scope": {
+    "root_viewport_focus_owner_unchanged": "/root/Main/@MarginContainer@13/@VBoxContainer@14/TopBar/@HBoxContainer@15/@Button@42",
+    "dialog_label_focused_on_open": true,
+    "dialog_label_unfocused_after_cancel": true,
+    "restoration_mechanism_proven": false
+  },
+  "input_scope": {
+    "actual_CUA_clicks": 7,
+    "root_mouse_rows": 7,
+    "embedded_popup_and_dialog_native_mouse_rows": false,
+    "embedded_action_evidence": "Actual tool-time windows + actual production menu3/cancel callbacks, not a native-parent mouse ACK",
+    "CUA_log": "exact semantic transcription after close, not a machine-emitted CUA log; first6 before hashes null; after hashes preserved; CUA screen byte files not in local material",
+    "independent_pixels": "five actual viewport PNGs inspected by Opus, never claimed as CUA images"
+  },
+  "schema_scope": {
+    "original8_denominator_unchanged": true,
+    "whole_verify": "honest incomplete rejection at placement group, no modal coverage loop inside fullverify",
+    "supported_record_primitives": "Root checked nonopaque fields/provenance/monotonic receipt range; later exact pointer probe documented separately",
+    "correction_file": "SUPPLEMENT_ACTUAL_POINTER_PROBE.json"
+  },
+  "private_data_scope": "empty pending queue; fresh-profile manual package absent; no existing-save preservation or nonempty pending case inferred",
+  "normal_exit": "owned syntax21759 and OS21770 exited0, all reader/source/default-player/cleanup guards0; both fresh profiles fully retained then cleaned",
+  "remaining_original_conditions": "all8 unaccepted; whole formal review/full roster/normal integration-final/Windows and all unexecuted cases stay required",
+  "original_formal_units": 14,
+  "new_credit": 0,
+  "at_unix_ns": 1792221809906511000
+}

docs/plans/original-completion-2026-10-02/execution/p24-02/normal-os-case-20261017/CURRENT_AND_NEXT.md

@@ -0,0 +1,17 @@
+# 現在と次の成果単位（2026-10-17）
+
+正式完了は14／88成果、30パッケージ。今回の限定ケースによる完了加算は0。
+
+P24-02はin_progress、Runner提出fe44f550750acbf5c510346e7cacbea2ccbdd184、通常統合候補なし。実main565fd805との準備合成Q42989fd9／T905d844dで通常OS操作を採取した。Qは証拠採取用で、正式統合候補ではない。
+
+通常メニューから別名保存ダイアログを開き、取消して再開し、通常ウィンドウ終了した。824回の時刻・停止サンプル（89.116049秒）で停止を確認し、3節目のモデルが一致した。独立Claude Opus5.5セッションb4160dbc2bca407598d2fc2e22bff24fはこの限定範囲でpass、critical/high/medium0。全8原条件のレビューではなく、フォーカス復元機構・既存保存・非空コマンド列の保全は証明していない。厳密な限界は同梱のAUTHORITATIVE_NARROW_CASE_CLARIFICATIONS.jsonを正とする。
+
+P24残件は全8原条件、配置と無効ドロップ、確認・復元、IME、倍率、ダイアログ背後の有効対象、吹出し・ログ・代替操作、重要警告の自然発生、最終全回帰・正式独立レビュー・通常統合final・同一Windows等。重要警告はP18/P19/P21等の実装に依存するため、限定プローブだけを積み増さない。原条件を縮小しない。
+
+次の優先候補はOpus実判断6004541957cd42cf9bae1868df1a31c8が選定したP04-01「同時発生の更新規約」。閉店・停電・破壊・退出・課金・交代・00:00決算の全7領域について、停止中課金0・二重精算0・孤立予約0を満たし、全15条件＋EVの版付き証拠、必要検証、独立した全体レビュー、通常統合final、台帳反映まで必要。P06等の基盤で既存証拠が多い点を選定理由とする。
+
+選定判断に含まれたaccd時点の不足推定を現状態へ読み替える。実Runner再確認ではP04提出は2dde7596、repair29、未稼働、worktree差分0。登録validationはpassでも正式レビュー275d1fd6はD05残4規則未確定などにより不合格。再修正や再試験はまだ起動していない。最新29の実差分と原条件をOpusへ提示し、既修正箇所を再実装せず、残4規則の必須性・具体的選択肢・独立して進める残修正を再判断中。既存2承認を維持し、未回答を承認扱いにしない。
+
+古いP04文書の13／88や旧mainは作成時点の履歴であり、現時点の正式数・適用版として再利用しない。全条件が揃うまでP04も完了加算しない。
+
+最新再判断ea12167c：raw結合・getter・HEAD fixture等は既に修正29までに是正済み。重複修正を起動しない。残る規則の具体的選択肢をユーザーへ提示した。回答後に破壊根拠pin/承認記録/現況説明を1回にまとめて通常修正し、必要な最終ゲートへ進む。回答を推定せず、記録のみによる完了加算もしない。

docs/plans/original-completion-2026-10-02/execution/p24-02/normal-os-case-20261017/EVIDENCE_MANIFEST.json

@@ -0,0 +1,34 @@
+{
+  "created_unix_ns": 1792222099990910000,
+  "files": [
+    {
+      "file": "AUTHORITATIVE_NARROW_CASE_CLARIFICATIONS.json",
+      "source": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p24-02-operations/.runtime/coordinator-os-scenario-20261017-r01/AUTHORITATIVE_NARROW_CASE_CLARIFICATIONS.json",
+      "sha256": "fd83e2edd4ac00bc9f8c568f6283ee47af43f91ef06336d36d775508a96682a5",
+      "bytes": 2833
+    },
+    {
+      "file": "ACTUAL_OPUS_LIMITED_REVIEW.json",
+      "source": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p24-02-operations/.runtime/coordinator-os-scenario-20261017-r01/ACTUAL_ONE_SCENARIO_INDEPENDENT_REVIEW_RESULT_MIRRORED_R02.json",
+      "sha256": "f9feeb5b18d3e67c2b6bd72d130068e856c9145cde89951519169549c2985e16",
+      "bytes": 141526
+    },
+    {
+      "file": "ACTUAL_OPUS_NEXT_UNIT_SELECTION.json",
+      "source": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p24-02-operations/runs/6004541957cd42cf9bae1868df1a31c8/result.json",
+      "sha256": "777c7f73e43df8801adfc29b9b0facb0474dba79fc5e8f11883d79e6ab3a8c92",
+      "bytes": 7523
+    },
+    {
+      "file": "FRESH_BINDING_AND_SOURCE_APPLICABILITY.json",
+      "source": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p24-02-operations/.runtime/coordinator-os-scenario-20261017-r01/FRESH_BINDING_AND_SOURCE_APPLICABILITY.json",
+      "sha256": "f01469d2d8a985750ca4103591067b63db7a319c015b493ad6635640247a3102",
+      "bytes": 307105
+    }
+  ],
+  "raw_capture_preserved_at": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p24-02-operations/.runtime/P24-02/build/audit-support/p24-os-normal-r01/capture",
+  "formal_credit": 0,
+  "original_packages": 30,
+  "original_units": 88,
+  "original_complete": 14
+}

docs/plans/original-completion-2026-10-02/plan_validation.json

@@ -205,8 +205,8 @@
   "remaining_delivery_units": 88,
   "current_package_state_counts": {
     "completed": 1,
-    "in_progress": 27,
-    "planned": 2
+    "in_progress": 28,
+    "planned": 1
   },
   "initial_snapshot_checked": false,
   "historical_source_bytes_compared": false,
@@ -244,7 +244,7 @@
     "facility_value_contracts_validation.json": "bf490a9ca585c48fc318e76c4a069ef244827d828d46e6415399f7710590dd16",
     "performance_audit.json": "0b630b15a392c3e0366f1362bfe4ddacb968f915f54549f82e4d6fa315384762",
     "progress_contract.json": "ccbdfce8c8365d5c13f59531955708834cce45acd0e136561c95295dfdb5df77",
-    "progress_snapshot.json": "d929905fac7089ad359154fdaa9f4d65e323becf7a6b46c8cadd2ba6d1719a9c",
+    "progress_snapshot.json": "4a5e3a1ad7e69406bf3aef43333eda19c07337f1d76a8f5c68da74b6bded9fd1",
     "progress_validator_guard_checks.json": "72ee513fcf1cad85c24bfd0a4b472f425f6acf117928ece0f6b41e29018da627",
     "progress_validator_guard_checks.r01.json": "14c26adffa5a1938241db4912e50ea54b660641ee6fee2e412d467dce14d0519",
     "requirement_coverage.json": "03b10e4da367579db502d0671a6e0dda36fd385111c6f1c0084acaff7605f593",
@@ -254,6 +254,6 @@
     "validate_facility_value_contracts.py": "91640e2a76cd6cc9186f7b85c0bf379b24b6cac0d48962815235ee628e7ae43e",
     "validate_plan.py": "23678227d9b3c556f1bd903f4b5b3147c4a82ce5085e10055481026803451b80",
     "validator_update_checks.json": "f997d0f3de2cea29550840b1d5cb23647d64f81329de46758551e2b6c8fecc27",
-    "work_packages.json": "238c01a360ac9d8554d7f12586f3b34925b37365a04aacc477877b807e76c16a"
+    "work_packages.json": "0b472eaff8c208337cf2847c196add61415fbf22db2e7c298d2fc5c4ff38e5c0"
   }
 }

docs/plans/original-completion-2026-10-02/progress_snapshot.json

@@ -152,13 +152,13 @@
   },
   "current_package_state_counts": {
     "completed": 1,
-    "in_progress": 27,
-    "planned": 2
+    "in_progress": 28,
+    "planned": 1
   },
   "current_delivery_state_counts": {
     "completed": 14,
-    "in_progress": 23,
-    "planned": 51
+    "in_progress": 25,
+    "planned": 49
   },
   "completed_current_deliveries": [
     "P00-01",
@@ -9713,7 +9713,7 @@
     "execution": "the-tree-p06-01 Runner; recorded Claude decision, one Codex implementer",
     "current_gate_status": "not implemented or executed; formal completion not accepted"
   },
-  "next_closure_plan_id": "P24-02",
+  "next_closure_plan_id": "P19-03",
   "p24_03_formal_closure": "docs/plans/original-completion-2026-10-02/execution/p24-03-formal-closure-r01/closure.json",
   "new_engine_run_scope": "Supplemental positive metadata diagnostic r01 failed cleanup preparation/log isolation; r02 passed17checks unchanged source and entire default profile. No duplicated full game regression.",
   "current_closure_targets": {
@@ -10422,5 +10422,86 @@
     "source": "fe44f550750acbf5c510346e7cacbea2ccbdd184",
     "original_unit_credit_added": 0,
     "all8_accepted": false
+  },
+  "current_p13_02_backend_local_progress": {
+    "observed_at_jst": "2026-10-17T17:28:02.473746+09:00",
+    "source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "evidence": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-local-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+    "source_adopted_on_main": false,
+    "whole_original_accepted": false,
+    "new_credit": 0,
+    "local_suites": 15,
+    "local_checks": 863,
+    "full_regression": false,
+    "formal_independent_review": false,
+    "prior_delivery_counts_before_P13_started": {
+      "completed": 14,
+      "in_progress": 23,
+      "planned": 51
+    },
+    "scope": "Corrects planned→in_progress only; no formal completion or source adoption",
+    "full_scope_native": {
+      "actual_suites": 184,
+      "missing_marker_paths": [],
+      "remaining_unexecuted_tests": [],
+      "available_marker_checks": 21903,
+      "actual_all_roster_checks": 21903,
+      "strict_accepted_checks": 21903,
+      "verified": true,
+      "composed": true,
+      "original_full_attempt_passed": false,
+      "whole_original_acceptance": false,
+      "parse_checks": 329,
+      "setup_phases": 2,
+      "owned_ended": 186,
+      "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+      "engines_started": 0,
+      "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+    },
+    "latest_full_status": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+    "formal_review": {
+      "state": "terminal_pass",
+      "run_id": "ead8e74b9683404d8cf3d97bca118726",
+      "model": "claude-opus-5-5",
+      "critical_high_medium": 0,
+      "low": 4,
+      "artifact": "ACTUAL_INDEPENDENT_OPUS_REVIEW.json"
+    },
+    "formal_credit": 0,
+    "backend_batch_state": "completed",
+    "normal_integration_candidate": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+    "normal_final": {
+      "passed": true,
+      "commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "artifact": "FORMAL_FINAL.json"
+    },
+    "whole_original_acceptance": false
+  },
+  "current_p19_03_reachability": {
+    "state": "whole_original_review_passed_integration_final_pending",
+    "spec": "docs/plans/original-completion-2026-10-02/execution/p19-03/TASK_SPEC.json",
+    "actual_opus": "dc342e4d69154660bef7e688a70fd783",
+    "original_unit_credit": 0,
+    "source_anchor": "1b07b87d3736e777932315a4bdde8b70cbf9cb23",
+    "P04_existing_questions": "preserved; no duplicate question or fake answer",
+    "S": "806de25068bc423136063791afcea811d251ee1b",
+    "actual_reviewer": {
+      "id": "d4e70e7f48f549b085692962f88531a8",
+      "status": "running",
+      "pid": 30223,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/d4e70e7f48f549b085692962f88531a8"
+    },
+    "current_status": "docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_CURRENT_ACCEPTANCE_STATUS.json",
+    "whole_review": {
+      "run_id": "38eaaacdb31b4c76bcf982987816a391",
+      "status": "pass",
+      "critical_high_medium": 0,
+      "low": 3,
+      "artifact": "ROOT_WHOLE_REVIEW_806DE25.json"
+    },
+    "actual_repair_worker": {
+      "id": "bf8a86e053044bfea0051253fefb2ec7",
+      "status": "finished"
+    }
   }
 }

docs/plans/original-completion-2026-10-02/work_packages.json

@@ -3598,7 +3598,7 @@
     },
     "legacy_state": "in_progress",
     "state_scope": "package-level; completed means whole package accepted; partial implementation is not completion",
-    "current_summary": "現行1338sourceでS1/S2a/S2b/S3実測と正式復元を収集済み。実Opus/Astra18が動的raw収集/各series検証を実装し、Rootも実data・新規拒否fixture・既存Cをfile-onlyで各exit0再確認、既存Cブロック全bytes不変。担当が全体未達を理由にblocked応答したため未commitコードを全保持し通常repair19へ継続、goal停止なし。残3条件は停電/18:00の既存raw参照と保存getter型説明・厳密適用性を補正し、A実HEAD/tree/FS結合・旧fixture整合を実装する。getter追加APIの配列型差分を旧説明が網羅していなかった点はnoticeで訂正、正式全Runtime型付き復元一致の実測は保持。全原15+EV/7領域/安全性3結果/30-88/部分点0、必須whole・独立wholereview・通常integration/final未達、原成果加点0。",
+    "current_summary": "次に閉じる優先候補。実Runnerは提出2dde7596・修正29・repair_pending・未稼働、worktree差分0。実Opus ea12167cが最新29を再監査し、旧台帳のraw結合/getter/HEAD fixture等は既修正と確認、重複repairを起動しない。登録validationはpassでも正式レビュー275d1fd6はD05規則未確定等で不合格。破壊順序・00:00売上帰属と理由表示/退出の明文化を具体案で確認中。既承認2規則維持。全15+EV/7領域/安全性3結果/全条件・必須最終全回帰・独立wholeレビュー・通常integration/finalは維持。正式14/88、今回加算0。",
     "remaining_deliverables": [
       {
         "id": "P04-01",
@@ -3851,38 +3851,41 @@
             "sha256_at_integration": "dfd9665ec1a8922201ce325c70505e7bf2d880a044daa49dddd92241007a438f",
             "scope": "S3 bounded raw proof only; six actual native cases/formal22 slots/176phase pairs/16clock replay pairs; no whole original credit",
             "linked_at_jst": "2026-10-16T04:54:54.811581+09:00"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+            "sha256": "908111f64a3d6c206504e26e76c721a0a97864238f6f6bb6604ac7b8e31ce7bf",
+            "scope": "Actual latest29 state and Opus re-audit supersede stale repair19 remaining work; zero formal credit"
           }
         ],
-        "current_summary": "現行1338sourceでS1/S2a/S2b/S3実測と正式復元を収集済み。実Opus/Astra18が動的raw収集/各series検証を実装し、Rootも実data・新規拒否fixture・既存Cをfile-onlyで各exit0再確認、既存Cブロック全bytes不変。担当が全体未達を理由にblocked応答したため未commitコードを全保持し通常repair19へ継続、goal停止なし。残3条件は停電/18:00の既存raw参照と保存getter型説明・厳密適用性を補正し、A実HEAD/tree/FS結合・旧fixture整合を実装する。getter追加APIの配列型差分を旧説明が網羅していなかった点はnoticeで訂正、正式全Runtime型付き復元一致の実測は保持。全原15+EV/7領域/安全性3結果/30-88/部分点0、必須whole・独立wholereview・通常integration/final未達、原成果加点0。",
+        "current_summary": "次に閉じる優先候補。実Runnerは提出2dde7596・修正29・repair_pending・未稼働、worktree差分0。実Opus ea12167cが最新29を再監査し、旧台帳のraw結合/getter/HEAD fixture等は既修正と確認、重複repairを起動しない。登録validationはpassでも正式レビュー275d1fd6はD05規則未確定等で不合格。破壊順序・00:00売上帰属と理由表示/退出の明文化を具体案で確認中。既承認2規則維持。全15+EV/7領域/安全性3結果/全条件・必須最終全回帰・独立wholeレビュー・通常integration/finalは維持。正式14/88、今回加算0。",
         "remaining_conditions": [
-          "原7種更新順序・証拠対応の原本/承認済み仕様への全条件適合性と規約凍結を最終独立受入する",
-          "承認D05の依存先休業pause/resume日跨ぎと正式SaveService/別PID復元はmain5f6bc11で実測済み。既存証拠と残の原7領域全条件への適合性・独立whole受入を残す。直接休業D-034と区別する。",
-          "承認18:00完了後交代/同分再送/実00:00決算、夜番不在/残業に加え、停電+直接休業/退出/元忍耐自然枯渇/破壊の原残境界と正式22slot再生をS3 accdで収集済み。全原条件raw結合・適用性・独立whole受入は未達。",
-          "既存39証拠等の適用版・入力・設定・環境を照合して不足境界だけ検証。全条件独立受入と通常統合/final/台帳反映。D05他領域は具体的根拠を確認し一括解決/一括停止にしない"
+          "owner choices for destruction order and midnight-sale day, plus explicit disposition of reason label and command/AI exit",
+          "after actual answers, normal batched checker destruction-authority pin / registry / approval record / stale current metadata correction",
+          "final gates as listed; previous full178 f5 receipt is not full final checker a61 evidence; no relabeling"
         ],
-        "progress_summary": "現行1338sourceでS1/S2a/S2b/S3実測と正式復元を収集済み。実Opus/Astra18が動的raw収集/各series検証を実装し、Rootも実data・新規拒否fixture・既存Cをfile-onlyで各exit0再確認、既存Cブロック全bytes不変。担当が全体未達を理由にblocked応答したため未commitコードを全保持し通常repair19へ継続、goal停止なし。残3条件は停電/18:00の既存raw参照と保存getter型説明・厳密適用性を補正し、A実HEAD/tree/FS結合・旧fixture整合を実装する。getter追加APIの配列型差分を旧説明が網羅していなかった点はnoticeで訂正、正式全Runtime型付き復元一致の実測は保持。全原15+EV/7領域/安全性3結果/30-88/部分点0、必須whole・独立wholereview・通常integration/final未達、原成果加点0。",
+        "progress_summary": "次に閉じる優先候補。実Runnerは提出2dde7596・修正29・repair_pending・未稼働、worktree差分0。実Opus ea12167cが最新29を再監査し、旧台帳のraw結合/getter/HEAD fixture等は既修正と確認、重複repairを起動しない。登録validationはpassでも正式レビュー275d1fd6はD05規則未確定等で不合格。破壊順序・00:00売上帰属と理由表示/退出の明文化を具体案で確認中。既承認2規則維持。全15+EV/7領域/安全性3結果/全条件・必須最終全回帰・独立wholeレビュー・通常integration/finalは維持。正式14/88、今回加算0。",
         "remaining_gaps": [
-          "既存CとS1/S2a/S2b/S3のraw収集/各series検証は実装済み、Root実data/新fixture/C各exit0。停電はS3実power flagと復旧前後、18:00はnative-first-current actual-nativeの正しい生証拠へ結合する。全原15+EV適用性を揃える。",
-          "save_restoreの正式全Runtime var_to_bytes一致は保持。追加API rawgetterに既存source _to_snapshot_variantが配列型制約も変換する点を旧説明が見落としたため、原frozen条件とsource定義のcanonical契約へ厳密に照合し訂正する。JSON-only/盲目的正規化/原基準緩和は禁止。",
-          "Aの実候補HEAD/tree/FS照合、旧MAIN/metadata数固定とcandidate_tree自己申告の穴、旧negative/applicability fixture失敗を直す。C全bodyと改ざん拒否は保持。",
-          "原7領域/安全性3結果/全条件と必須whole検証・別セッション独立wholeレビュー・通常integration/final・台帳反映を完結する。原成果加点0。"
+          "owner choices for destruction order and midnight-sale day, plus explicit disposition of reason label and command/AI exit",
+          "after actual answers, normal batched checker destruction-authority pin / registry / approval record / stale current metadata correction",
+          "final gates as listed; previous full178 f5 receipt is not full final checker a61 evidence; no relabeling"
         ],
-        "updated_at_jst": "2026-10-16T05:25:51.943207+09:00",
-        "current_recheck": "execution/p04-01-current-recheck-20261015/CURRENT_ACCEPTANCE_STATUS.json",
-        "policy_candidate": "execution/p04-01-current-recheck-20261015/D05_POLICY_CANDIDATE.md",
+        "updated_at_jst": "2026-10-17T16:30:38.746525+09:00",
+        "current_recheck": "execution/p04-01-current-recheck-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+        "policy_candidate": "execution/p04-01-current-recheck-20261017/D05_REMAINING_ORDER_CANDIDATE.md",
         "owner_policy_update": {
           "approved": true,
           "reference": "docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261015/D05_OWNER_APPROVAL.json",
           "scope": "two owner policy selections only; no acceptance credit",
           "remaining": "condition-specific evidence applicability, missing boundaries, independent review, ordinary integration/final",
-          "actual_commander": "execution/p04-01-current-recheck-20261015/OPUS_REPAIR18_FULL_INPUT_CONTINUATION_DECISION.json",
-          "runner_state": "repair_ready",
-          "repairs": 19,
-          "worker_model": "gpt-6-astra",
+          "actual_commander": "execution/p04-01-current-recheck-20261017/ACTUAL_OPUS_LATEST29_DECISION.json",
+          "runner_state": "repair_pending",
+          "repairs": 29,
+          "worker_model": null,
           "model_selected_by": "actual Claude Opus 5.5 run decision",
-          "run_decision": "execution/p04-01-current-recheck-20261015/OPUS_REPAIR18_FULL_INPUT_CONTINUATION_DECISION.json",
-          "submitted": "accd07c91d4e34d9b7c7fc20e389df2424b167e1",
-          "registered_validation": "0689f0070bd54d4f8b5849bb63bb36a8",
+          "run_decision": null,
+          "submitted": "2dde7596a87c43f7bf0bf704b7479f2fa06a5b1c",
+          "registered_validation": "91d92e164b164bb091ae90e384da5636",
           "root_work_continues": true,
           "native_shift_proof": "execution/p04-01-current-recheck-20261015/ROOT_APPROVED_SHIFT_CURRENT_RESULT.json",
           "incomplete_checkpoint": "execution/p04-01-current-recheck-20261015/REPAIR7_PRESERVED_WORK.json",
@@ -3891,7 +3894,7 @@
           "formal_dependency_proof": "execution/p04-01-current-recheck-20261015/ROOT_APPROVED_DEPENDENCY_FORMAL_RESULT.json",
           "timeout_adapter": "execution/p04-01-current-recheck-20261015/OWNER_P04_LLM_TIMEOUT_ADAPTER.json",
           "actual_run": null,
-          "current_scope": "Preserved executable R; next actual Opus direction for missing raw joins/getter type correction and real candidate A/fixtures. No new registered validation of unchanged accd.",
+          "current_scope": "Latest29 audited; no worker or repair launched. Owner D05 answers pending; normal bounded authority/record correction only after actual answer. Existing two approvals unchanged.",
           "paid_shift_midnight_formal_proof": "execution/p04-01-current-recheck-20261015/ROOT_PAID_SHIFT_MIDNIGHT_FORMAL_RESULT.json",
           "same_minute_formal_proof": "execution/p04-01-current-recheck-20261015/ROOT_SAME_MINUTE_RESEND_FORMAL_RESULT.json",
           "corrected_c_bundle": "execution/p04-01-current-recheck-20261015/ROOT_CORRECTED_C_BUNDLE_LOCAL_PASS.json",
@@ -3902,9 +3905,21 @@
             "execution/p04-01-current-recheck-20261015/ROOT_S2B_NATIVE_R02_RESULT.json",
             "execution/p04-01-current-recheck-20261015/ROOT_S2B_NATIVE_R01_RESULT.json",
             "execution/p04-01-current-recheck-20261015/ROOT_S2A_NATIVE_R03_RESULT.json"
-          ]
+          ],
+          "historical_runner_context_before_current_reaudit": {
+            "runner_state": "repair_ready",
+            "repairs": 19,
+            "submitted": "accd07c91d4e34d9b7c7fc20e389df2424b167e1",
+            "registered_validation": "0689f0070bd54d4f8b5849bb63bb36a8",
+            "worker_model": "gpt-6-astra",
+            "actual_commander": "execution/p04-01-current-recheck-20261015/OPUS_REPAIR18_FULL_INPUT_CONTINUATION_DECISION.json",
+            "run_decision": "execution/p04-01-current-recheck-20261015/OPUS_REPAIR18_FULL_INPUT_CONTINUATION_DECISION.json",
+            "current_scope": "Preserved executable R; next actual Opus direction for missing raw joins/getter type correction and real candidate A/fixtures. No new registered validation of unchanged accd."
+          }
         },
-        "historical_initial_recheck": "execution/p04-01-current-recheck-20261015/recheck.json"
+        "historical_initial_recheck": "execution/p04-01-current-recheck-20261015/recheck.json",
+        "submitted_commit": "2dde7596a87c43f7bf0bf704b7479f2fa06a5b1c",
+        "normal_integration_candidate": null
       },
       {
         "id": "P04-02",
@@ -7996,7 +8011,7 @@
     },
     "legacy_state": "planned",
     "state_scope": "package-level; completed means whole package accepted; partial implementation is not completion",
-    "current_summary": "P13-03「内容差異の記録」を正式完了。提出bd3a97e、原8条件を別Opusレビュー、実統合/最終e80c6c0で確認。全7施設/84利用枠/6分類、33拒否+代替正常系、固定原30/88・部分点なし。記録1件のみ、内容/素材/P13パッケージ/原子/ゲーム完成の加点0。P13-01/02とD08/D09・未制作内容は未完了。",
+    "current_summary": "P13-03は原成果として完了済み。P13-02の限定CODE1のみ通常最終ゲートまで完了し、元P13-02全条件は引き続き未達。限定backend CODE1は提出a7e3069→通常統合C65f07bf/M191ea3bでRunner completed。厳密15/863登録検証、全184/21903・329構文・186実PID終了の正確合成証明、別Opus全CODE1レビュー合格（重大/高/中0・低4を後続記録）、実候補の全1368入力等値照合、通常integration/finalを完了。元ENOSPC全回帰の失敗記録と全量可逆退避は保持。親P13-02の通常建設・記録係・承認値・自然収集・VIP/完成素材/Windows等は未達、原正式14/88から加算0。",
     "remaining_deliverables": [
       {
         "id": "P13-01",
@@ -8011,8 +8026,44 @@
         "title": "背面条件と対象参照",
         "work": "覗き部屋の対象背面、通路寸断、対象喪失と証拠IDを状態として実装する。",
         "acceptance": "対象撤去、重複収集、停止、途中保存で状態と参照が整合する。",
-        "state": "planned",
-        "evidence": []
+        "state": "in_progress",
+        "evidence": [
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+            "sha256": "988d6e18a49372549863cd433432c2852c962fa64b138e490361c023e80249dc",
+            "scope": "Actual Opus-selected bounded implementation contract preparation; no tests or whole acceptance credit"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-e930a1d-native-import-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+            "sha256": "87122b4256cafac78f5fe0efe3253f5d59bbda5e8bfdf727c177bb354050207c",
+            "scope": "Actual submitted backend and failed owned import guard evidence; no passing suites or formal credit"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-local-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+            "sha256": "6635dfeaa73fe69f3395e8d03bc9ae5f8506a04259e8682917a3cf11b0f8575a",
+            "scope": "Actual15/863 local and329 parse with all17 owned engines ended and exact UID policy; no whole-original acceptance or credit"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+            "sha256": "9a37598317771097232be1f92bba4b7b21fd399ec2d173abb115662d8ba5c310",
+            "scope": "Actual qualified composed184/21903/329parse/186ended; original failed full not overwritten; formal independent review and integration/final pending, original credit0"
+          }
+        ],
+        "progress_summary": "限定backend CODE1は提出a7e3069→通常統合C65f07bf/M191ea3bでRunner completed。厳密15/863登録検証、全184/21903・329構文・186実PID終了の正確合成証明、別Opus全CODE1レビュー合格（重大/高/中0・低4を後続記録）、実候補の全1368入力等値照合、通常integration/finalを完了。元ENOSPC全回帰の失敗記録と全量可逆退避は保持。親P13-02の通常建設・記録係・承認値・自然収集・VIP/完成素材/Windows等は未達、原正式14/88から加算0。",
+        "current_summary": "限定backend CODE1は提出a7e3069→通常統合C65f07bf/M191ea3bでRunner completed。厳密15/863登録検証、全184/21903・329構文・186実PID終了の正確合成証明、別Opus全CODE1レビュー合格（重大/高/中0・低4を後続記録）、実候補の全1368入力等値照合、通常integration/finalを完了。元ENOSPC全回帰の失敗記録と全量可逆退避は保持。親P13-02の通常建設・記録係・承認値・自然収集・VIP/完成素材/Windows等は未達、原正式14/88から加算0。",
+        "updated_at_jst": "2026-10-17T19:05:57.762697+09:00",
+        "current_execution": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+        "remaining_gaps": [
+          "Whole original P13-02 normal construction/recorder/natural triggers/approved quantities/VIP/UI/assets/Windows and all original conditions remain unaccepted; CODE1 has no new original-unit credit",
+          "Four low severity future-production defensive/migration/coverage observations retained from actual Opus review; no observed ordinary production path and no critical/high/medium finding",
+          "P04-01 remains next original formal closure when existing D05 owner choices arrive; independent next original-unit selection will be requested from actual Opus"
+        ],
+        "submitted_commit": "a7e3069b167511b3194242b3403fbcc35244a526",
+        "normal_integration_candidate": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+        "worker_model": "gpt-6-astra",
+        "model_selected_by_actual_opus": "19f00667226d42dd8e9b3a4ae99aaa68",
+        "integrated_commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+        "backend_batch_state": "completed"
       },
       {
         "id": "P13-03",
@@ -8076,7 +8127,7 @@
     ],
     "cross_cutting_acceptance_scope": "Completion requirements only, not achieved results. Apply each to relevant slices; non-applicable views require a recorded reason.",
     "initial_revision_state": "planned",
-    "updated_at_jst": "2026-10-15T20:07:06.405550+09:00"
+    "updated_at_jst": "2026-10-17T19:05:57.762697+09:00"
   },
   {
     "id": "P14",
@@ -8936,7 +8987,7 @@
       "D07",
       "D08"
     ],
-    "state": "planned",
+    "state": "in_progress",
     "supplement_ids": [],
     "owner_roles": {
       "implementation": "実装担当（担当者未割当）",
@@ -8945,7 +8996,7 @@
     },
     "legacy_state": "planned",
     "state_scope": "package-level; completed means whole package accepted; partial implementation is not completion",
-    "current_summary": "一般イベント基盤はあるが原本の決闘・人物行動の全接続は未着手。",
+    "current_summary": "修正版806de25の登録3検証/12自己試験が実合格。実Opus38eaaが7名×3ルート21セル・全8カテゴリ・原本/全source/欠損と旧実装区分を全原条件再レビューしpass（重大/高/中0・低3）。通常integration/final・台帳確定前で原14/88に加算0。ゲーム1368入力は同一、旧全回帰証明を厳密再利用。",
     "remaining_deliverables": [
       {
         "id": "P19-01",
@@ -8968,8 +9019,28 @@
         "title": "分岐の到達性",
         "work": "人物ごとの3ルートに必要なイベント・条件・中断処理を列挙する。",
         "acceptance": "7名×3ルートの到達表があり、未制作内容は欠損として残る。",
-        "state": "planned",
-        "evidence": []
+        "state": "in_progress",
+        "evidence": [
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p19-03/TASK_SPEC.json",
+            "sha256": "263a01b943d8056727335fb76977c010298e1c229077f8da76e48683ba2e89bb",
+            "scope": "Actual Opus-selected original unit contract preparation; no acceptance credit"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_CURRENT_ACCEPTANCE_STATUS.json",
+            "sha256": "75dd5adc99eebd16703c5f5b4df12d3e4efdc24e702b24bb7daa1a71454417e6",
+            "scope": "Actual registered3checks+selftests10 PASS; exact game-input reuse qualified; whole semantic review/integration/final pending, original credit0"
+          }
+        ],
+        "current_summary": "修正版806de25の登録3検証/12自己試験が実合格。実Opus38eaaが7名×3ルート21セル・全8カテゴリ・原本/全source/欠損と旧実装区分を全原条件再レビューしpass（重大/高/中0・低3）。通常integration/final・台帳確定前で原14/88に加算0。ゲーム1368入力は同一、旧全回帰証明を厳密再利用。",
+        "progress_summary": "初回実行パス未展開と実provider文脈上限の失敗を保持し、検査器実行前/推論前の障害のみを実行経路/全文ファイル参照で補正。提出版/全資料/受入条件/権限/課金に変更なし。人物固有未制作/D08/未定値は欠損。",
+        "updated_at_jst": "2026-10-17T19:58:24.516684+09:00",
+        "current_execution": "docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_CURRENT_ACCEPTANCE_STATUS.json",
+        "remaining_gaps": [
+          "Normal actual integrationC/M and independent candidate source/input equality",
+          "Normal final and existing exact real-owner main authorization, thenledger/push; no new humanSHA speech fabricated"
+        ],
+        "submitted_commit": "806de25068bc423136063791afcea811d251ee1b"
       }
     ],
     "estimate_person_days_historical_2026_09_29": [
@@ -8989,7 +9060,8 @@
       "要件別ログとソースハッシュを保存"
     ],
     "cross_cutting_acceptance_scope": "Completion requirements only, not achieved results. Apply each to relevant slices; non-applicable views require a recorded reason.",
-    "initial_revision_state": "planned"
+    "initial_revision_state": "planned",
+    "updated_at_jst": "2026-10-17T19:39:39.105864+09:00"
   },
   {
     "id": "P20",
@@ -16235,7 +16307,7 @@
     },
     "legacy_state": "in_progress",
     "state_scope": "package-level; completed means whole package accepted; partial implementation is not completion",
-    "current_summary": "提出bd3a134（修正使用済み4・上限なし）を同一Runnerで正式提出し保持branchへpush。GUI成果を保持してOpus判断でCodex6.1-solへ非UIのみ引継ぎ、countによる必須roster欠損容認とenv偽HEADを修正。実compile/保全/diff確認合格、局所9試験は実exit0+3入力SHA一致で再利用。別Opus限定静的review95cffd7 pass、重大/高/中0・low5、全8受入の加点0。実合成Q4bf9a1b/treea0667b9（M51e8657）を実4競合のS内容で準備、source1368/必須roster180はいずれも未実行。厳密Root合成契約・条件別artifact対応・実UI/OS/警告上流・最終全回帰/全8review/通常統合/Windowsが残る。 P24-03既完了とP24全体の完成は別。",
+    "current_summary": "提出fe44f55保持。実main565/Q429/T905で通常OSメニュー→別名保存→取消→再開→通常終了を採取。824停止サンプル89.116049秒、3節目モデル一致、実Opus b416限定review pass（重大/高/中0）。既存保存・非空待機列・focus復元機構・全8は未証明。原成果加算0。上流未実装に依存する警告等を残し、次に閉じる優先候補をP04-01へ切替。",
     "remaining_deliverables": [
       {
         "id": "P24-01",
@@ -16388,10 +16460,15 @@
             "path": "docs/plans/original-completion-2026-10-02/execution/p24-02/root-readiness-repair6-20261017/CURRENT_ACCEPTANCE_AND_NEXT_GATE.json",
             "sha256": "ad38069fb28ca3218b31bc75673a308ee29b49ac1e30eefb4009d94e0d3b26c4",
             "scope": "Current source6 limited review/actual S-Q post-submit reproduction/native import326parse/3 affected suites; all8 unaccepted, no unit credit"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p24-02/normal-os-case-20261017/AUTHORITATIVE_NARROW_CASE_CLARIFICATIONS.json",
+            "sha256": "fd83e2edd4ac00bc9f8c568f6283ee47af43f91ef06336d36d775508a96682a5",
+            "scope": "One real normal-OS case / limited separate Opus review only; all8 unaccepted, no unit credit"
           }
         ],
-        "updated_at_jst": "2026-10-17T15:19:09.416187+09:00",
-        "progress_summary": "提出fe44f55（同一Runner・修正6・上限なし）を保持branchへpush。Opus選定AstraがmovingHEAD基準と非OS証拠/段階循環の2中指摘を修正。実Sと実Qの各2局所試験を提出後に実行し全0、別Opus3cd2285限定レビューpass（重大/高/中0、low5）。実合成M54/Qefd/T1cでimport・326構文・影響3スイート171チェック合格、所有5PID終了、保全/cleanupエラー0。全8は未受入、正式加算0。実通常OS/型付き証拠のend-to-end・上流生産トリガ・最終全回帰/全8review/通常integration-finalが残る。",
+        "updated_at_jst": "2026-10-17T16:30:38.746525+09:00",
+        "progress_summary": "提出fe44f55保持。実main565/Q429/T905で通常OSメニュー→別名保存→取消→再開→通常終了を採取。824停止サンプル89.116049秒、3節目モデル一致、実Opus b416限定review pass（重大/高/中0）。既存保存・非空待機列・focus復元機構・全8は未証明。原成果加算0。上流未実装に依存する警告等を残し、次に閉じる優先候補をP04-01へ切替。",
         "remaining_gaps": [
           "placement_and_invalid_drop: Local native coverage passed. Ordinary OS valid/invalid placement and assignment/drop, actual explanation, valid-target behind-modal attempts and click equivalence with model/ledger/selection proof remain.",
           "modal_and_pause_resume: Defense visibility callback and native operation/pause/cancel checks passed. Real valid-target positive control, all required normal modal/focus/pending/save identity and distinct-process continuity remain.",
@@ -16402,7 +16479,7 @@
           "japanese_input_and_scale: Current ordinary OS IME composition/cancel/confirm/invalid input, Japanese persisted save, distinct-process load and required scale/focus/clipping remain. Same Windows release device requirements remain explicitly separate and unaccepted.",
           "final_validation_review: Source/composition guard and twoMedium corrections passed limited review; actual newS/Q post-submit stdlib proof and native import/326parse/3 affected suites passed. Real typed OS/runtime/command/roster artifact assembly and schema end-to-end positive, exact final full180-or-current roster once, whole8 formal Opus review, normal candidate/integration/final remain. Rebind actual current M/Q before formal gates; oldQ is never relabelled."
         ],
-        "current_execution": "docs/plans/original-completion-2026-10-02/execution/p24-02/root-readiness-repair6-20261017/CURRENT_ACCEPTANCE_AND_NEXT_GATE.json",
+        "current_execution": "docs/plans/original-completion-2026-10-02/execution/p24-02/normal-os-case-20261017/CURRENT_AND_NEXT.md",
         "submitted_commit": "fe44f550750acbf5c510346e7cacbea2ccbdd184",
         "normal_integration_candidate": null
       },

scripts/core/save_service.gd

@@ -1048,6 +1048,13 @@ static func _snapshot_package_format(snapshot: Dictionary) -> int:
 	if not runtime_data is Dictionary: return FORMAT_VERSION # no owned Runtime authority
 	var version: Variant = runtime_data.get(&"runtime_schema_version", 1)
 	if typeof(version) != TYPE_INT: return -1
+	if runtime_data.has(&"special_peeping_rooms"):
+		var section_clock: Variant = snapshot.get(&"clock")
+		if not section_clock is Dictionary or typeof(section_clock.get(&"absolute_minute")) != TYPE_INT: return -1
+		if not preload("res://scripts/special/peeping_room_service.gd").valid_runtime_section(runtime_data, section_clock[&"absolute_minute"]): return -1
+		# Keep PurchaseQuotePlansV2's exact original allowlist and all format rules.
+		runtime_data = runtime_data.duplicate()
+		runtime_data.erase(&"special_peeping_rooms")
 	if version >= 1 and version <= 14:
 		return -1 if PurchaseQuoteV2.has_history(runtime_data) else FORMAT_VERSION
 	if version != 15: return -1

scripts/special/peeping_room_service.gd

@@ -0,0 +1,271 @@
+class_name PeepingRoomService
+extends RefCounted
+
+## Non-graphic state/reference machinery; production definitions remain pending.
+const SECTION_VERSION := 1
+const ALLOWED_TARGETS := [&"public_bath", &"adult_private_room"]
+const OCCUPANCY_KIND := &"special_peeping_room"
+const ID_PREFIX := &"peeping_room"
+const ROOM_KEYS := [&"room_id", &"origin", &"footprint", &"cells", &"target_instance_id", &"target_definition_id", &"target_history", &"link_state", &"stopped", &"stop_reason"]
+const EVIDENCE_KEYS := [&"evidence_id", &"room_id", &"target_instance_id", &"source_event_key", &"minute"]
+
+var _rooms: Dictionary = {}
+var _evidence: Dictionary = {}
+var _world: WorldService
+var _facilities: FacilityService
+var _construction: ConstructionService
+var _path: PathService
+var _ids: StableIdGenerator
+
+func configure(world: WorldService, facilities: FacilityService, construction: ConstructionService, path: PathService, ids: StableIdGenerator) -> void:
+	_world = world
+	_facilities = facilities
+	_construction = construction
+	_path = path
+	_ids = ids
+
+static func result(reason: StringName = &"OK") -> Dictionary:
+	return {&"ok": reason == &"OK", &"reason": reason}
+
+func is_empty() -> bool:
+	return _rooms.is_empty() and _evidence.is_empty()
+
+func get_room(room_id: StringName) -> Dictionary:
+	return (_rooms.get(room_id, {}) as Dictionary).duplicate(true)
+
+## Pure validation. own_room is supplied internally only for explicit relink/restore.
+func validate_placement(origin: Vector3i, footprint: Vector2i = Vector2i(2, 1), target_id: StringName = &"", own_room: StringName = &"") -> Dictionary:
+	if origin.z != WorldService.LAYER_BACK: return result(&"WRONG_LAYER")
+	if footprint != Vector2i(2, 1): return result(&"WRONG_FOOTPRINT")
+	if target_id == &"vip_suite": return result(&"PENDING_P10_01")
+	var cells := _world.cells_for_footprint(origin, footprint)
+	var targets: Array[StringName] = []
+	var missing := false
+	for cell: Vector3i in cells:
+		if not _world.is_in_bounds(cell): return result(&"OUT_OF_BOUNDS")
+		if cell.y < 0 and not _world.is_excavated(cell): return result(&"NOT_EXCAVATED")
+		var front := Vector3i(cell.x, cell.y, WorldService.LAYER_FRONT)
+		if _world.get_occupant_kind(front) == &"construction": return result(&"TARGET_INCOMPLETE")
+		var occupant := _world.get_occupant(front)
+		if occupant.is_empty(): missing = true
+		elif occupant not in targets: targets.append(occupant)
+	if targets.size() > 1: return result(&"MULTIPLE_TARGETS")
+	if missing: return result(&"TARGET_MISSING" if targets.is_empty() else &"PARTIAL_TARGET")
+	var resolved_id := targets[0]
+	if not target_id.is_empty() and target_id != resolved_id: return result(&"TARGET_MISMATCH")
+	var target := _facilities.get_instance(resolved_id)
+	if target == null: return result(&"TARGET_UNKNOWN")
+	if target.definition_id not in ALLOWED_TARGETS: return result(&"TARGET_NOT_ALLOWED")
+	if target.origin.z != WorldService.LAYER_FRONT: return result(&"TARGET_WRONG_LAYER")
+	var built := _construction.get_facility(resolved_id)
+	if built.is_empty(): return result(&"TARGET_INCOMPLETE")
+	if built.get(&"definition_id") != target.definition_id: return result(&"TARGET_MISMATCH")
+	for cell: Vector3i in cells:
+		var front := Vector3i(cell.x, cell.y, WorldService.LAYER_FRONT)
+		if front not in target.occupied_cells or front not in built[&"occupied_cells"]: return result(&"PARTIAL_TARGET")
+		# Reject cutting an existing corridor; never construct an implicit bypass.
+		if _world.is_walkable(cell) or _path.has_cell(cell): return result(&"CORRIDOR_CONFLICT")
+	var occupancy := _world.validate_occupancy(cells)
+	if not occupancy[&"ok"]:
+		if own_room.is_empty() or _world.get_entity_cells(own_room) != cells or _world.get_entity_kind(own_room) != OCCUPANCY_KIND:
+			return result(&"BACK_OCCUPIED")
+	var report := result()
+	report.merge({&"cells": cells, &"target_instance_id": resolved_id, &"target_definition_id": target.definition_id})
+	return report
+
+## CONTROLLED_FIXTURE: tests only. No Runtime executor or palette calls this.
+func controlled_fixture_place(origin: Vector3i, target_id: StringName = &"") -> Dictionary:
+	var report := validate_placement(origin, Vector2i(2, 1), target_id)
+	if not report[&"ok"]: return report
+	var room_id := _ids.next_id(ID_PREFIX)
+	if room_id.is_empty(): return result(&"ID_EXHAUSTED")
+	if not _world.occupy(room_id, report[&"cells"], OCCUPANCY_KIND): return result(&"BACK_OCCUPIED")
+	_rooms[room_id] = {&"room_id": room_id, &"origin": origin, &"footprint": Vector2i(2, 1),
+		&"cells": report[&"cells"].duplicate(), &"target_instance_id": report[&"target_instance_id"],
+		&"target_definition_id": report[&"target_definition_id"],
+		&"target_history": [report[&"target_instance_id"]], &"link_state": &"LINKED",
+		&"stopped": true, &"stop_reason": &"CONTROLLED_FIXTURE"}
+	report[&"room_id"] = room_id
+	return report
+
+func target_removed(target_id: StringName) -> void:
+	for room: Dictionary in _rooms.values():
+		if room[&"target_instance_id"] == target_id:
+			room[&"link_state"] = &"TARGET_LOST"
+			room[&"stopped"] = true
+			room[&"stop_reason"] = &"TARGET_LOST"
+
+func detect_target_loss() -> void:
+	for room: Dictionary in _rooms.values():
+		if room[&"link_state"] == &"TARGET_LOST": continue
+		if not _target_still_present(room): target_removed(room[&"target_instance_id"])
+
+func _target_still_present(room: Dictionary) -> bool:
+	var target := _facilities.get_instance(room[&"target_instance_id"])
+	if target == null or target.definition_id != room[&"target_definition_id"]: return false
+	for cell: Vector3i in room[&"cells"]:
+		if _world.get_occupant(Vector3i(cell.x, cell.y, WorldService.LAYER_FRONT)) != target.instance_id: return false
+	return true
+
+func relink(room_id: StringName, target_id: StringName) -> Dictionary:
+	if not _rooms.has(room_id): return result(&"ROOM_MISSING")
+	if target_id.is_empty(): return result(&"TARGET_MISSING")
+	var room: Dictionary = _rooms[room_id]
+	var report := validate_placement(room[&"origin"], room[&"footprint"], target_id, room_id)
+	if not report[&"ok"]: return report
+	room[&"target_instance_id"] = target_id
+	room[&"target_definition_id"] = report[&"target_definition_id"]
+	if target_id not in room[&"target_history"]: room[&"target_history"].append(target_id)
+	room[&"link_state"] = &"LINKED"
+	room[&"stopped"] = true
+	room[&"stop_reason"] = &"RELINKED_PENDING_RESUME"
+	return result()
+
+func _collection_precondition(room_id: StringName, source_event_key: StringName, minute: int) -> Dictionary:
+	if String(source_event_key).strip_edges().is_empty(): return result(&"SOURCE_EVENT_KEY_REQUIRED")
+	if minute < 0: return result(&"INVALID_MINUTE")
+	if not _rooms.has(room_id): return result(&"ROOM_MISSING")
+	detect_target_loss()
+	var room: Dictionary = _rooms[room_id]
+	# Required precedence: stopped, power, closed, construction, lost target.
+	if room[&"stopped"]: return result(&"STOPPED")
+	var target := _facilities.get_instance(room[&"target_instance_id"])
+	if target != null:
+		if not target.power_available: return result(&"NO_POWER")
+		if not target.operator_open or not target.is_within_opening_hours(minute): return result(&"CLOSED")
+		if _construction.get_facility(target.instance_id).is_empty(): return result(&"UNDER_CONSTRUCTION")
+	if room[&"link_state"] == &"TARGET_LOST" or target == null: return result(&"TARGET_LOST")
+	return result()
+
+func record_evidence(room_id: StringName, source_event_key: StringName, minute: int) -> Dictionary:
+	var report := _collection_precondition(room_id, source_event_key, minute)
+	return report if not report[&"ok"] else result(&"RECORDER_ELIGIBILITY_PENDING_D04_D08_P16")
+
+## CONTROLLED_FIXTURE: explicit test state, never a production resume command.
+func controlled_fixture_set_stopped(room_id: StringName, stopped: bool) -> bool:
+	if not _rooms.has(room_id): return false
+	detect_target_loss()
+	var room: Dictionary = _rooms[room_id]
+	if not stopped and room[&"link_state"] == &"TARGET_LOST": return false
+	room[&"stopped"] = stopped
+	room[&"stop_reason"] = &"CONTROLLED_FIXTURE" if stopped else &""
+	return true
+
+## CONTROLLED_FIXTURE: sole ledger write entry point, opaque event keys only.
+func controlled_fixture_record_evidence(room_id: StringName, source_event_key: StringName, minute: int) -> Dictionary:
+	var report := _collection_precondition(room_id, source_event_key, minute)
+	if not report[&"ok"]: return report
+	var target_id: StringName = _rooms[room_id][&"target_instance_id"]
+	var evidence_id := _evidence_id(room_id, target_id, source_event_key)
+	var duplicated := _evidence.has(evidence_id)
+	if not duplicated:
+		_evidence[evidence_id] = {&"evidence_id": evidence_id, &"room_id": room_id,
+			&"target_instance_id": target_id, &"source_event_key": source_event_key, &"minute": minute}
+	return {&"ok": true, &"reason": &"OK", &"evidence_id": evidence_id, &"duplicated": duplicated}
+
+static func _evidence_id(room_id: StringName, target_id: StringName, event_key: StringName) -> StringName:
+	# Length-prefixed UTF-8 hex is injective; delimiters in input cannot alias.
+	var pieces: Array[String] = []
+	for value: StringName in [room_id, target_id, event_key]:
+		var bytes := String(value).to_utf8_buffer()
+		pieces.append("%d:%s" % [bytes.size(), bytes.hex_encode()])
+	return StringName("peeping_evidence:" + ":".join(pieces))
+
+func create_snapshot() -> Dictionary:
+	var rooms: Array[Dictionary] = []
+	var evidence: Array[Dictionary] = []
+	var keys := _rooms.keys()
+	keys.sort()
+	for key: StringName in keys: rooms.append(_rooms[key].duplicate(true))
+	keys = _evidence.keys()
+	keys.sort()
+	for key: StringName in keys: evidence.append(_evidence[key].duplicate(true))
+	return {&"version": SECTION_VERSION, &"rooms": rooms, &"evidence": evidence}
+
+static func _exact(value: Variant, keys: Array) -> bool:
+	if not value is Dictionary or value.size() != keys.size(): return false
+	for key: Variant in value:
+		if typeof(key) != TYPE_STRING_NAME or key not in keys: return false
+	return true
+
+## Save format 15 has a fixed purchase-key allowlist outside this task's scope.
+## Validate this independent section before passing only the original keys to it.
+static func valid_runtime_section(data: Dictionary, minute: int) -> bool:
+	if not data.get(&"special_peeping_rooms") is Dictionary: return false
+	for key: Variant in data:
+		if key == &"special_peeping_rooms" and typeof(key) != TYPE_STRING_NAME: return false
+	for key: StringName in [&"world", &"path", &"facilities", &"construction", &"id_generator"]:
+		if not data.get(key) is Dictionary: return false
+	var world := WorldService.new()
+	var path := PathService.new()
+	var facilities := FacilityService.new()
+	var ids := StableIdGenerator.new()
+	if not world.restore_snapshot(data[&"world"]) or not path.restore_snapshot(data[&"path"]) or not facilities.restore_snapshot(data[&"facilities"]) or not ids.restore_snapshot(data[&"id_generator"]): return false
+	var construction := ConstructionService.new(world)
+	if not construction.restore_snapshot(data[&"construction"]): return false
+	var service := PeepingRoomService.new()
+	service.configure(world, facilities, construction, path, ids)
+	return service.restore_section(data[&"special_peeping_rooms"], minute)
+
+## Staged restore validates both directions of world ownership before committing.
+func restore_section(section: Variant, minute: int) -> bool:
+	var rooms: Dictionary = {}
+	var evidence: Dictionary = {}
+	if section != null:
+		if not _exact(section, [&"version", &"rooms", &"evidence"]): return false
+		if typeof(section[&"version"]) != TYPE_INT or section[&"version"] != SECTION_VERSION: return false
+		if not section[&"rooms"] is Array or not section[&"evidence"] is Array: return false
+		if section[&"rooms"].is_empty(): return false # absence represents empty state
+		var known: Array = _facilities.create_snapshot()[&"known_instance_ids"]
+		for raw: Variant in section[&"rooms"]:
+			if not _exact(raw, ROOM_KEYS): return false
+			for key: StringName in [&"room_id", &"target_instance_id", &"target_definition_id", &"link_state", &"stop_reason"]:
+				if typeof(raw[key]) != TYPE_STRING_NAME: return false
+			var room_id: StringName = raw[&"room_id"]
+			var suffix := String(room_id).trim_prefix("peeping_room.")
+			if suffix.length() != 12 or not suffix.is_valid_int() or int(suffix) <= 0 or String(room_id) != "peeping_room.%012d" % int(suffix): return false
+			if int(suffix) > _ids.get_counter(ID_PREFIX) or rooms.has(room_id): return false
+			if typeof(raw[&"origin"]) != TYPE_VECTOR3I or typeof(raw[&"footprint"]) != TYPE_VECTOR2I: return false
+			if raw[&"origin"].z != WorldService.LAYER_BACK or raw[&"footprint"] != Vector2i(2, 1): return false
+			var cells := _world.cells_for_footprint(raw[&"origin"], raw[&"footprint"])
+			if not raw[&"cells"] is Array or raw[&"cells"] != cells: return false
+			for cell: Variant in raw[&"cells"]:
+				if typeof(cell) != TYPE_VECTOR3I: return false
+			if _world.get_entity_cells(room_id) != cells or _world.get_entity_kind(room_id) != OCCUPANCY_KIND: return false
+			for cell: Vector3i in cells:
+				if _world.is_walkable(cell) or _path.has_cell(cell): return false
+			if raw[&"target_definition_id"] not in ALLOWED_TARGETS: return false
+			if typeof(raw[&"stopped"]) != TYPE_BOOL or not raw[&"target_history"] is Array: return false
+			var history := {}
+			for target: Variant in raw[&"target_history"]:
+				if typeof(target) != TYPE_STRING_NAME or String(target) not in known or history.has(target): return false
+				history[target] = true
+			if not history.has(raw[&"target_instance_id"]): return false
+			var current_target := _facilities.get_instance(raw[&"target_instance_id"])
+			if current_target != null and current_target.definition_id != raw[&"target_definition_id"]: return false
+			if raw[&"link_state"] == &"TARGET_LOST":
+				if not raw[&"stopped"] or raw[&"stop_reason"] != &"TARGET_LOST" or _target_still_present(raw): return false
+			elif raw[&"link_state"] == &"LINKED":
+				if not validate_placement(raw[&"origin"], raw[&"footprint"], raw[&"target_instance_id"], room_id)[&"ok"]: return false
+				if _facilities.get_instance(raw[&"target_instance_id"]).definition_id != raw[&"target_definition_id"]: return false
+				if raw[&"stopped"]:
+					if raw[&"stop_reason"] not in [&"CONTROLLED_FIXTURE", &"RELINKED_PENDING_RESUME"]: return false
+				elif raw[&"stop_reason"] != &"": return false
+			else: return false
+			rooms[room_id] = raw.duplicate(true)
+		for raw: Variant in section[&"evidence"]:
+			if not _exact(raw, EVIDENCE_KEYS): return false
+			for key: StringName in [&"evidence_id", &"room_id", &"target_instance_id", &"source_event_key"]:
+				if typeof(raw[key]) != TYPE_STRING_NAME or raw[key].is_empty(): return false
+			if String(raw[&"source_event_key"]).strip_edges().is_empty(): return false
+			if typeof(raw[&"minute"]) != TYPE_INT or raw[&"minute"] < 0 or raw[&"minute"] > minute: return false
+			if not rooms.has(raw[&"room_id"]) or raw[&"target_instance_id"] not in rooms[raw[&"room_id"]][&"target_history"]: return false
+			var expected := _evidence_id(raw[&"room_id"], raw[&"target_instance_id"], raw[&"source_event_key"])
+			if expected != raw[&"evidence_id"] or evidence.has(expected): return false
+			evidence[expected] = raw.duplicate(true)
+	for occupied: Dictionary in _world.create_snapshot()[&"occupancies"]:
+		if occupied[&"kind"] == OCCUPANCY_KIND or String(occupied[&"entity_id"]).begins_with("peeping_room."):
+			if not rooms.has(occupied[&"entity_id"]): return false
+	_rooms = rooms
+	_evidence = evidence
+	return true

tests/special/peeping_room_fixture.gd

@@ -0,0 +1,59 @@
+extends SceneTree
+
+## CONTROLLED_FIXTURE. No production placement, recorder or eligibility claim.
+const Rooms := preload("res://scripts/special/peeping_room_service.gd")
+var checks := 0
+var failures := 0
+var fixtures: Array[Dictionary] = []
+
+func _initialize() -> void:
+	call_deferred("_run")
+
+func expect(ok: bool, label: String) -> void:
+	checks += 1
+	if not ok:
+		failures += 1
+		push_error(label)
+
+func fixture(build_bath := true) -> Dictionary:
+	var clock: Variant = load("res://autoload/game_clock.gd").new()
+	var state: Variant = load("res://autoload/game_state.gd").new()
+	var runtime: Variant = load("res://autoload/simulation_runtime.gd").new()
+	clock.reset(1, 6, 0)
+	state.reset()
+	expect(runtime.initialize(clock, state, 1302)[&"valid"], "CONTROLLED_FIXTURE real Runtime initializes")
+	clock.set_paused(true)
+	runtime.configure_save_policy({&"enabled": false, &"daily_checkpoint_enabled": false})
+	var f := {&"clock": clock, &"state": state, &"runtime": runtime, &"target": &"", &"origin": Vector3i(-6, 1, 1)}
+	fixtures.append(f)
+	if build_bath:
+		var built: CommandResult = runtime.submit_command(&"build_facility", {&"definition_id": &"public_bath", &"origin": Vector3i(-6, 0, 0)})
+		expect(built.is_success(), "real paid public bath construction")
+		clock.advance_minutes(runtime.definition_registry.get_facility(&"public_bath").build_minutes)
+		for target: FacilityInstance in runtime.facility_service.get_instances():
+			if target.definition_id == &"public_bath": f[&"target"] = target.instance_id
+		expect(not f[&"target"].is_empty(), "completed FRONT target has real stable identity")
+	return f
+
+func place(f: Dictionary, origin: Variant = null) -> StringName:
+	var report: Dictionary = f[&"runtime"].peeping_room_service.controlled_fixture_place(f[&"origin"] if origin == null else origin)
+	expect(report[&"ok"], "CONTROLLED_FIXTURE only room placement: " + String(report[&"reason"]))
+	return report.get(&"room_id", &"")
+
+func enable_fixture(f: Dictionary, room: StringName) -> void:
+	var runtime: Variant = f[&"runtime"]
+	expect(runtime.peeping_room_service.controlled_fixture_set_stopped(room, false), "CONTROLLED_FIXTURE explicitly enables ledger exercise")
+	expect(runtime.facility_service.set_operational_status(f[&"target"], {&"power_available": true, &"operator_open": true}, f[&"clock"].absolute_minute).is_success(), "CONTROLLED_FIXTURE target conditions")
+
+func rejects_atomically(runtime: Variant, snapshot: Dictionary) -> bool:
+	var before := var_to_bytes(runtime.create_snapshot())
+	return not runtime.restore_snapshot(snapshot) and before == var_to_bytes(runtime.create_snapshot())
+
+func finish(label: String) -> void:
+	for f: Dictionary in fixtures:
+		f[&"runtime"].free()
+		f[&"clock"].free()
+		f[&"state"].free()
+	fixtures.clear()
+	print("%s: %d checks, %d failures" % [label, checks, failures])
+	quit(1 if failures else 0)

tests/special/test_p13_uid_policy.py

@@ -0,0 +1,96 @@
+"""Static UID policy cases; no engine, native worker or regression invocation."""
+import importlib.util
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+
+sys.dont_write_bytecode = True
+TOOLS = Path(__file__).resolve().parents[2] / 'tools'
+sys.path.insert(0, str(TOOLS))
+spec = importlib.util.spec_from_file_location('p13_uid_policy', TOOLS / 'run_p13_reference_tests.py')
+runner = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(runner)
+
+
+class UIDPolicyTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.stage = Path(self.tmp.name)
+        self.owner = 'tests/special/example.gd'
+        self.other = 'scripts/special/peeping_room_service.gd'
+        for name in (self.owner, self.other):
+            self.write(name, b'extends RefCounted\n')
+        self.write('project.godot', b'[application]\n')
+        self.write('scripts/existing.gd.uid', b'uid://existing\n')
+        self.source = runner.shared.inventory(self.stage, stage=True)
+        self.plan = runner.uid_plan(self.source)
+        self.write(self.owner + '.uid', b'uid://first\n')
+        self.write(self.other + '.uid', b'uid://second\n')
+
+    def write(self, name, raw):
+        path = self.stage / name
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_bytes(raw)
+
+    def snapshot(self):
+        return runner.uid_snapshot(self.stage, self.source, self.plan)
+
+    def test_accept_and_owner_seal(self):
+        accepted = self.snapshot()
+        self.assertEqual(set(accepted), {self.owner + '.uid', self.other + '.uid'})
+        pin = accepted[self.owner + '.uid']
+        self.assertEqual(pin['raw_bytes'], list(b'uid://first\n'))
+        self.assertEqual(pin['text'], 'uid://first\n')
+        self.assertEqual(pin['owner_sha256'], self.source[self.owner]['sha256'])
+        self.assertEqual(pin['sha256'], runner.shared.sha(self.stage / (self.owner + '.uid')))
+
+    def test_unknown_and_extra(self):
+        for name in ('scripts/unknown.gd.uid', 'extra.txt'):
+            with self.subTest(name=name):
+                self.write(name, b'uid://extra\n')
+                with self.assertRaises(AssertionError):
+                    self.snapshot()
+                (self.stage / name).unlink()
+
+    def test_missing(self):
+        (self.stage / (self.owner + '.uid')).unlink()
+        with self.assertRaises(AssertionError):
+            self.snapshot()
+
+    def test_malformed(self):
+        for raw in (b'uid://UPPER\n', b'uid://first', b'uid://first\nextra',
+                    b'uid://12345678901234\n', b'uid://\n', b'uid://first\r\n'):
+            with self.subTest(raw=raw):
+                self.write(self.owner + '.uid', raw)
+                with self.assertRaises(AssertionError):
+                    self.snapshot()
+
+    def test_duplicate_and_existing_collision(self):
+        for raw in (b'uid://second\n', b'uid://existing\n'):
+            with self.subTest(raw=raw):
+                self.write(self.owner + '.uid', raw)
+                with self.assertRaises(AssertionError):
+                    self.snapshot()
+
+    def test_modified_original(self):
+        for name in (self.owner, 'project.godot', 'scripts/existing.gd.uid'):
+            with self.subTest(name=name):
+                path = self.stage / name
+                original = path.read_bytes()
+                path.write_bytes(original + b'tamper')
+                with self.assertRaises(AssertionError):
+                    self.snapshot()
+                path.write_bytes(original)
+
+    def test_symlink(self):
+        path = self.stage / (self.owner + '.uid')
+        path.unlink()
+        path.symlink_to(self.stage / (self.other + '.uid'))
+        with self.assertRaises(AssertionError):
+            self.snapshot()
+
+
+if __name__ == '__main__':
+    unittest.main()

tests/special/test_peeping_room_evidence.gd

@@ -0,0 +1,40 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var room := place(f)
+	var other := place(f, Vector3i(-4, 1, 1))
+	var service: Variant = runtime.peeping_room_service
+	var minute: int = f[&"clock"].absolute_minute
+	expect(service.record_evidence(room, &"", minute)[&"reason"] == &"SOURCE_EVENT_KEY_REQUIRED", "named source key required first")
+	expect(service.controlled_fixture_record_evidence(room, &"fixture.event", minute)[&"reason"] == &"STOPPED", "initial stopped state rejects even fixture ledger")
+	enable_fixture(f, room)
+	enable_fixture(f, other)
+	var target: FacilityInstance = runtime.facility_service.get_instance(f[&"target"])
+	target.power_available = false
+	target.operator_open = false
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"NO_POWER", "power rejection precedes closed")
+	target.power_available = true
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"CLOSED", "closed target rejects")
+	target.operator_open = true
+	# CONTROLLED_FIXTURE temporarily omit construction authority, leaving live target.
+	var empty_construction := ConstructionService.new(runtime.world_service)
+	service.configure(runtime.world_service, runtime.facility_service, empty_construction, runtime.path_service, runtime.id_generator)
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"UNDER_CONSTRUCTION", "uncompleted construction authority rejects collection")
+	service.configure(runtime.world_service, runtime.facility_service, runtime.construction_service, runtime.path_service, runtime.id_generator)
+	var before := var_to_bytes(service.create_snapshot())
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"RECORDER_ELIGIBILITY_PENDING_D04_D08_P16", "production collection never invents eligibility")
+	expect(before == var_to_bytes(service.create_snapshot()), "production collection leaves ledger unchanged")
+	var first: Dictionary = service.controlled_fixture_record_evidence(room, &"fixture.event", minute)
+	var replay: Dictionary = service.controlled_fixture_record_evidence(room, &"fixture.event", minute + 1)
+	expect(first[&"ok"] and not first[&"duplicated"] and replay[&"duplicated"] and replay[&"evidence_id"] == first[&"evidence_id"], "tuple replay returns exactly one stable ID")
+	var second: Dictionary = service.controlled_fixture_record_evidence(other, &"fixture.event", minute)
+	var third: Dictionary = service.controlled_fixture_record_evidence(room, &"fixture:event:日本語", minute)
+	expect(second[&"evidence_id"] != first[&"evidence_id"] and third[&"evidence_id"] != first[&"evidence_id"], "different room/key distinct, delimiter and UTF-8 input supported")
+	expect(service.create_snapshot()[&"evidence"].size() == 3, "replay adds no ledger record")
+	var snapshot: Dictionary = runtime.create_snapshot()
+	expect(runtime.restore_snapshot(snapshot), "active fixture evidence restores")
+	var restored: Dictionary = runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.event", minute)
+	expect(restored[&"duplicated"] and restored[&"evidence_id"] == first[&"evidence_id"], "evidence stable across restore")
+	finish("Peeping room evidence")

tests/special/test_peeping_room_geometry.gd

@@ -0,0 +1,62 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var service: Variant = runtime.peeping_room_service
+	var origin: Vector3i = f[&"origin"]
+	var before := var_to_bytes(runtime.create_snapshot())
+	expect(service.validate_placement(origin)[&"ok"], "public bath entirely behind one completed FRONT target")
+	expect(service.validate_placement(Vector3i(-6, 1, 0))[&"reason"] == &"WRONG_LAYER", "FRONT room rejected")
+	expect(service.validate_placement(origin, Vector2i(1, 2))[&"reason"] == &"WRONG_FOOTPRINT", "rotated footprint rejected")
+	expect(service.validate_placement(origin, Vector2i(2, 1), &"vip_suite")[&"reason"] == &"PENDING_P10_01", "VIP unavailable, never substituted")
+	expect(service.validate_placement(Vector3i(-1, 1, 1))[&"reason"] == &"PARTIAL_TARGET", "partial target rejected")
+	expect(service.validate_placement(Vector3i(8, 1, 1))[&"reason"] == &"TARGET_MISSING", "missing target rejected")
+	expect(service.validate_placement(origin, Vector2i(2, 1), &"missing")[&"reason"] == &"TARGET_MISMATCH", "named reference must match FRONT occupant")
+	expect(before == var_to_bytes(runtime.create_snapshot()), "geometry validation is pure across whole Runtime")
+	# Complete real second bath; the 2x1 footprint at the boundary spans targets.
+	expect(runtime.submit_command(&"build_facility", {&"definition_id": &"public_bath", &"origin": Vector3i(0, 0, 0)}).is_success(), "second paid target starts")
+	expect(service.validate_placement(Vector3i(0, 1, 1))[&"reason"] == &"TARGET_INCOMPLETE", "construction reservation is not a completed target")
+	f[&"clock"].advance_minutes(runtime.definition_registry.get_facility(&"public_bath").build_minutes)
+	expect(service.validate_placement(Vector3i(-1, 1, 1))[&"reason"] == &"MULTIPLE_TARGETS", "multiple FRONT target footprints rejected")
+	# A real path joining both sides through the proposed footprint must survive.
+	for x in range(-7, -3): runtime.world_service.set_walkable(Vector3i(x, 1, 1), true)
+	expect(runtime.rebuild_path_graph_from_world(), "CONTROLLED_FIXTURE corridor graph rebuild")
+	var path_before: Array = runtime.path_service.find_path(Vector3i(-7, 1, 1), Vector3i(-4, 1, 1))
+	expect(not path_before.is_empty(), "proposed footprint lies across a connected corridor")
+	expect(service.validate_placement(origin)[&"reason"] == &"CORRIDOR_CONFLICT", "would disconnect BACK corridor: reject with no bypass")
+	expect(runtime.path_service.find_path(Vector3i(-7, 1, 1), Vector3i(-4, 1, 1)) == path_before, "rejected cut preserves route")
+	for x in range(-7, -3): runtime.world_service.set_walkable(Vector3i(x, 1, 1), false)
+	expect(service.validate_placement(origin)[&"reason"] == &"CORRIDOR_CONFLICT", "stale path authority also rejects conflict")
+	expect(runtime.rebuild_path_graph_from_world(), "corridor fixture removed explicitly")
+	var room := place(f)
+	expect(service.validate_placement(origin)[&"reason"] == &"BACK_OCCUPIED", "dedicated room occupancy blocks overlap")
+	expect(runtime.world_service.get_entity_kind(room) == Rooms.OCCUPANCY_KIND, "dedicated cross-reference occupancy kind")
+	_private_geometry()
+	finish("Peeping room geometry")
+
+func _private_geometry() -> void:
+	var f := fixture(false)
+	var runtime: Variant = f[&"runtime"]
+	# CONTROLLED_FIXTURE underground geometry only: no unlock/normal palette claim.
+	var bounds: Dictionary = runtime.world_service.get_bounds()
+	bounds[&"min_y"] = -1
+	expect(runtime.world_service.expand_bounds(bounds), "CONTROLLED_FIXTURE underground bounds")
+	var definition: FacilityDefinition = runtime.definition_registry.get_facility(&"adult_private_room")
+	for x in range(2):
+		var cell := Vector3i(x, -1, 0)
+		runtime.world_service.set_excavated(cell, true)
+		runtime.world_service.set_support(cell, definition.weight_per_cell, true)
+	var started: CommandResult = runtime.construction_service.start_construction(definition, Vector3i(0, -1, 0))
+	expect(started.is_success(), "CONTROLLED_FIXTURE paid real adult_private_room definition")
+	f[&"clock"].advance_minutes(definition.build_minutes)
+	var service: Variant = runtime.peeping_room_service
+	expect(service.validate_placement(Vector3i(0, -1, 1))[&"ok"], "adult_private_room valid completed geometry")
+	var target_id: StringName = runtime.world_service.get_occupant(Vector3i(0, -1, 0))
+	var target: FacilityInstance = runtime.facility_service.get_instance(target_id)
+	if target != null:
+		target.definition_id = &"vip_private_salon"
+		expect(service.validate_placement(Vector3i(0, -1, 1))[&"reason"] == &"TARGET_NOT_ALLOWED", "salon is not VIP suite substitute")
+		target.definition_id = &"adult_private_room"
+		runtime.facility_service.unregister_instance(target_id)
+		expect(service.validate_placement(Vector3i(0, -1, 1))[&"reason"] == &"TARGET_UNKNOWN", "world occupant without actual FacilityService target rejected")

tests/special/test_peeping_room_reference.gd

@@ -0,0 +1,37 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var room := place(f)
+	enable_fixture(f, room)
+	var old_target: StringName = f[&"target"]
+	var old_evidence: Dictionary = runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.event", f[&"clock"].absolute_minute)
+	expect(old_evidence[&"ok"], "fixture evidence before removal")
+	expect(runtime.submit_command(&"demolish_facility", {&"instance_id": old_target}).is_success(), "real Runtime demolition")
+	var lost: Dictionary = runtime.peeping_room_service.get_room(room)
+	expect(lost[&"link_state"] == &"TARGET_LOST" and lost[&"stopped"], "target removal immediately marks lost and stopped")
+	expect(runtime.peeping_room_service.record_evidence(room, &"fixture.after_loss", f[&"clock"].absolute_minute)[&"reason"] == &"STOPPED", "collection rejected after loss with prescribed stopped precedence")
+	expect(not runtime.peeping_room_service.controlled_fixture_set_stopped(room, false), "lost target cannot resume even through fixture")
+	var lost_snapshot: Dictionary = runtime.create_snapshot()
+	expect(runtime.restore_snapshot(lost_snapshot), "lost reference roundtrip retains historical identity")
+	expect(var_to_bytes(lost_snapshot) == var_to_bytes(runtime.create_snapshot()), "lost snapshot exact typed roundtrip")
+	expect(runtime.submit_command(&"build_facility", {&"definition_id": &"public_bath", &"origin": Vector3i(-6, 0, 0)}).is_success(), "rebuild at same geometry starts")
+	f[&"clock"].advance_minutes(runtime.definition_registry.get_facility(&"public_bath").build_minutes)
+	var new_target: StringName = runtime.world_service.get_occupant(Vector3i(-6, 0, 0))
+	expect(new_target != old_target, "rebuild receives different target identity")
+	expect(runtime.peeping_room_service.get_room(room)[&"target_instance_id"] == old_target, "no implicit relink on geometry reuse")
+	var rejected: CommandResult = runtime.submit_command(&"peeping_room_relink", {&"room_id": room, &"target_instance_id": old_target})
+	expect(not rejected.is_success(), "explicit old target relink rejected")
+	expect(runtime.submit_command(&"peeping_room_relink", {&"room_id": room, &"target_instance_id": new_target}).is_success(), "explicit new target full validation")
+	var linked: Dictionary = runtime.peeping_room_service.get_room(room)
+	expect(linked[&"stopped"] and linked[&"stop_reason"] == &"RELINKED_PENDING_RESUME", "explicit relink never auto resumes")
+	f[&"target"] = new_target
+	enable_fixture(f, room)
+	var new_evidence: Dictionary = runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.event", f[&"clock"].absolute_minute)
+	expect(new_evidence[&"ok"] and new_evidence[&"evidence_id"] != old_evidence.get(&"evidence_id"), "same room/event on different target never aliases")
+	var linked_snapshot: Dictionary = runtime.create_snapshot()
+	expect(runtime.restore_snapshot(linked_snapshot) and var_to_bytes(linked_snapshot) == var_to_bytes(runtime.create_snapshot()), "relinked ledger keeps both historical target bindings")
+	expect(runtime.facility_service.unregister_instance(new_target).is_success(), "equivalent FacilityService removal path")
+	expect(runtime.peeping_room_service.get_room(room)[&"link_state"] == &"TARGET_LOST", "unregister signal also invalidates target")
+	finish("Peeping room reference")

tests/special/test_peeping_room_runtime.gd

@@ -0,0 +1,91 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	# Direct executor invocation distinguishes read-only domain state from queue receipts.
+	var validation := SimulationCommand.new()
+	validation.command_type = &"peeping_room_validate"
+	validation.payload = {&"origin": f[&"origin"]}
+	var before := var_to_bytes(runtime.create_snapshot())
+	expect(runtime._execute_peeping_room(validation).is_success(), "read-only validator executor")
+	expect(before == var_to_bytes(runtime.create_snapshot()), "validator changes no whole Runtime bytes")
+	var public_validation: CommandResult = runtime.submit_command(&"peeping_room_validate", validation.payload)
+	expect(public_validation.is_success(), "registered validation command runs through real queue")
+	var placement := SimulationCommand.new()
+	placement.command_type = &"peeping_room_place"
+	placement.payload = validation.payload.duplicate(true)
+	var placement_before := var_to_bytes(runtime.create_snapshot())
+	var direct_unavailable: CommandResult = runtime._execute_peeping_room(placement)
+	expect(not direct_unavailable.is_success() and direct_unavailable.details[&"reason"] == &"BUILD_DEFINITION_PENDING_D04", "direct production placement unavailable with precise reason")
+	expect(placement_before == var_to_bytes(runtime.create_snapshot()), "direct placement adds no room, occupancy, cost or ID in whole typed Runtime")
+	var domain_before := var_to_bytes([runtime.world_service.create_snapshot(), runtime.economy_service.create_snapshot(), runtime.peeping_room_service.create_snapshot()])
+	var ids_before: Dictionary = runtime.id_generator.create_snapshot()
+	var counters_before: Dictionary = ids_before["counters"]
+	var event_counter_before: int = counters_before.get("domain_event", 0)
+	var event_ids_before := {}
+	for event: SimulationDomainEvent in runtime.domain_events.recent_events():
+		event_ids_before[event.event_id] = true
+	var unavailable: CommandResult = runtime.submit_command(&"peeping_room_place", validation.payload)
+	expect(not unavailable.is_success() and unavailable.details[&"reason"] == &"BUILD_DEFINITION_PENDING_D04", "production placement unavailable with precise reason")
+	expect(domain_before == var_to_bytes([runtime.world_service.create_snapshot(), runtime.economy_service.create_snapshot(), runtime.peeping_room_service.create_snapshot()]), "queued placement adds no room, occupancy or cost")
+	var ids_after: Dictionary = runtime.id_generator.create_snapshot()
+	var counters_after: Dictionary = ids_after["counters"]
+	expect(ids_before["version"] == ids_after["version"], "queued placement preserves ID generator version")
+	for prefix: Variant in counters_before:
+		if prefix != "domain_event":
+			expect(counters_after.has(prefix) and counters_after.get(prefix) == counters_before[prefix], "queued placement consumes no non-event ID or removes prefix: %s" % prefix)
+	for prefix: Variant in counters_after:
+		if prefix != "domain_event":
+			expect(counters_before.has(prefix), "queued placement adds no non-event ID prefix: %s" % prefix)
+	expect(counters_after.has("domain_event") and counters_after["domain_event"] == event_counter_before + 1, "queued placement allocates exactly one normal receipt event ID")
+	var new_events: Array[SimulationDomainEvent] = []
+	for event: SimulationDomainEvent in runtime.domain_events.recent_events():
+		if not event_ids_before.has(event.event_id):
+			new_events.append(event)
+	expect(new_events.size() == 1, "queued placement publishes exactly one new receipt event")
+	if new_events.size() == 1:
+		var receipt: SimulationDomainEvent = new_events[0]
+		expect(receipt.event_id == StringName("domain_event.%012d" % (event_counter_before + 1)), "placement receipt uses the next domain event ID")
+		expect(receipt.event_type == &"COMMAND_FAILED", "unavailable placement receipt is COMMAND_FAILED")
+		expect(receipt.causation_command_id == unavailable.command_id, "placement receipt causation matches rejected command")
+	var room := place(f)
+	enable_fixture(f, room)
+	var blocked: CommandResult = runtime.submit_command(&"peeping_room_record_evidence", {&"room_id": room, &"source_event_key": &"fixture.command"})
+	expect(not blocked.is_success() and blocked.details[&"reason"] == &"RECORDER_ELIGIBILITY_PENDING_D04_D08_P16", "registered evidence command cannot reach ledger")
+	var missing: CommandResult = runtime.submit_command(&"peeping_room_record_evidence", {&"room_id": room})
+	expect(not missing.is_success() and missing.details[&"reason"] == &"SOURCE_EVENT_KEY_REQUIRED", "public command requires named key")
+	var malformed: CommandResult = runtime.submit_command(&"peeping_room_validate", {&"origin": [0, 1, 1]})
+	expect(not malformed.is_success() and malformed.details[&"reason"] == &"INVALID_PAYLOAD", "wrong payload type safely rejected")
+	expect(runtime.peeping_room_service.create_snapshot()[&"evidence"].is_empty(), "commands cannot inject arbitrary content events")
+	var fixture_command: CommandResult = runtime.submit_command(&"controlled_fixture_place", validation.payload)
+	expect(not fixture_command.is_success(), "no fixture command registration")
+	_mimi_format(f)
+	finish("Peeping room runtime")
+
+func _mimi_format(f: Dictionary) -> void:
+	var runtime: Variant = f[&"runtime"]
+	const Quote := preload("res://scripts/supply/supply_purchase_quote_v2.gd")
+	expect(runtime.submit_command(&"build_facility", {&"definition_id": &"warehouse", &"origin": Vector3i(2, 0, 1)}).is_success(), "paid warehouse for independent existing MIMI format path")
+	f[&"clock"].advance_minutes(runtime.definition_registry.get_facility(&"warehouse").build_minutes)
+	var warehouse: StringName = &""
+	for facility: FacilityInstance in runtime.facility_service.get_instances():
+		if facility.definition_id == &"warehouse": warehouse = facility.instance_id
+	expect(not warehouse.is_empty(), "completed real warehouse")
+	var mimi := StaffRuntime.new().configure(Quote.MIMI, &"porter", {&"employment_kind": StaffRuntime.EmploymentKind.UNIQUE})
+	expect(runtime.staff_service.register_staff(mimi).is_success(), "CONTROLLED_FIXTURE existing MIMI unique registration, no natural join claim")
+	expect(runtime.submit_command(&"set_staff_work_assignment", {&"staff_id": Quote.MIMI, &"facility_id": warehouse, &"template_id": &"NIGHT"}).is_success(), "existing persistent MIMI assignment")
+	expect(runtime.submit_command(&"purchase_supplies", {&"warehouse_id": warehouse, &"item_id": SupplyCatalog.RAW_FOOD, &"quantity": 1}).is_success(), "existing real v2 paid purchase")
+	var snapshot: Dictionary = runtime.create_snapshot()
+	expect(snapshot[&"systems"][&"runtime"][&"runtime_schema_version"] == 15 and snapshot[&"systems"][&"runtime"].has(&"special_peeping_rooms"), "v2 purchase history and special section coexist")
+	expect(runtime.restore_snapshot(snapshot) and var_to_bytes(snapshot) == var_to_bytes(runtime.create_snapshot()), "v15 optional section exact typed restore")
+	var directory := "user://tests/p13_reference_mimi_%d" % OS.get_process_id()
+	expect(SaveService.save_snapshot(directory, snapshot)[&"ok"], "physical v15 save accepts validated extension without loosening purchase allowlist")
+	var loaded := SaveService.load_snapshot(directory)
+	expect(loaded[&"ok"], "physical MIMI section save loads")
+	if loaded[&"ok"]:
+		expect(loaded[&"manifest"]["format_version"] == 2 and loaded[&"manifest"]["runtime_schema_version"] == 15, "format2 manifest still exactly15")
+		expect(runtime.restore_snapshot(loaded[&"snapshot"]), "MIMI package restore reaches same staged section validator")
+	var bad := snapshot.duplicate(true)
+	bad[&"systems"][&"runtime"][&"special_peeping_rooms"][&"version"] = 2
+	expect(not SaveService.save_snapshot(directory + "_bad", bad)[&"ok"], "save-format adapter rejects malformed optional section")

tests/special/test_peeping_room_save.gd

@@ -0,0 +1,66 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var empty: Dictionary = runtime.create_snapshot()
+	expect(not empty[&"systems"][&"runtime"].has(&"special_peeping_rooms"), "empty service does not alter existing snapshot keys")
+	expect(runtime.restore_snapshot(empty) and var_to_bytes(empty) == var_to_bytes(runtime.create_snapshot()), "pre-extension v14 absence exact roundtrip")
+	var legacy := empty.duplicate(true)
+	legacy[&"systems"][&"runtime"][&"runtime_schema_version"] = 13
+	legacy[&"systems"][&"runtime"].erase(&"auto_purchase_plans")
+	expect(runtime.restore_snapshot(legacy) and runtime.peeping_room_service.is_empty(), "genuine v13 absent section migrates empty")
+	expect(runtime.restore_snapshot(empty), "restore canonical baseline before controlled room")
+	var room := place(f)
+	enable_fixture(f, room)
+	expect(runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.save", f[&"clock"].absolute_minute)[&"ok"], "controlled evidence before mid-state save")
+	expect(runtime.submit_command(&"peeping_room_relink", {&"room_id": room, &"target_instance_id": f[&"target"]}, &"player", room, 0, f[&"clock"].absolute_minute + 1).is_success(), "future explicit relink remains pending at checkpoint")
+	var snapshot: Dictionary = runtime.create_snapshot()
+	expect(snapshot[&"systems"][&"runtime"][&"runtime_schema_version"] == 14, "extension never bumps Runtime version")
+	expect(runtime.restore_snapshot(snapshot) and var_to_bytes(snapshot) == var_to_bytes(runtime.create_snapshot()), "exact typed room/evidence whole Runtime roundtrip")
+	var directory := "user://tests/p13_reference_save_%d" % OS.get_process_id()
+	var saved := SaveService.save_snapshot(directory, snapshot)
+	expect(saved[&"ok"], "actual SaveService writes section in format 1")
+	var loaded := SaveService.load_snapshot(directory)
+	expect(loaded[&"ok"], "actual SaveService reads section")
+	if loaded[&"ok"]:
+		expect(loaded[&"manifest"]["format_version"] == 1, "existing format mapping unchanged")
+		expect(runtime.restore_snapshot(loaded[&"snapshot"]), "loaded physical package reaches Runtime validation")
+		expect(var_to_bytes(snapshot) == var_to_bytes(runtime.create_snapshot()), "physical save retains all typed fields")
+	for mutation in range(18):
+		var bad := snapshot.duplicate(true)
+		var data: Dictionary = bad[&"systems"][&"runtime"]
+		var section: Dictionary = data[&"special_peeping_rooms"]
+		match mutation:
+			0: data.erase(&"special_peeping_rooms")
+			1: data[&"special_peeping_rooms"] = null
+			2: section[&"version"] = 2
+			3: section[&"version"] = 1.0
+			4: section[&"unknown"] = true
+			5: section.erase(&"evidence")
+			6: section[&"rooms"].append(section[&"rooms"][0].duplicate(true))
+			7: section[&"evidence"].append(section[&"evidence"][0].duplicate(true))
+			8: section[&"rooms"][0][&"target_instance_id"] = &"missing.target"
+			9: section[&"rooms"][0][&"target_definition_id"] = &"adult_private_room"
+			10: section[&"rooms"][0][&"origin"] = Vector3i(8, 1, 1)
+			11: section[&"rooms"][0][&"stopped"] = 1
+			12: section[&"evidence"][0][&"room_id"] = &"peeping_room.999999999999"
+			13: section[&"evidence"][0][&"source_event_key"] = &"aliased.event"
+			14: section[&"evidence"][0][&"minute"] = f[&"clock"].absolute_minute + 1
+			15: data[&"id_generator"]["counters"]["peeping_room"] = 0
+			16:
+				section.erase(&"version")
+				section["version"] = 1
+			17:
+				section[&"rooms"][0][&"link_state"] = &"TARGET_LOST"
+				section[&"rooms"][0][&"stopped"] = true
+				section[&"rooms"][0][&"stop_reason"] = &"TARGET_LOST"
+		expect(rejects_atomically(runtime, bad), "malformed/current missing/reference/duplicate rejection atomic case %d" % mutation)
+	var orphan := empty.duplicate(true)
+	orphan[&"systems"][&"runtime"][&"world"] = snapshot[&"systems"][&"runtime"][&"world"].duplicate(true)
+	expect(rejects_atomically(runtime, orphan), "world-owned room without any section rejects atomically")
+	var removed_world := snapshot.duplicate(true)
+	removed_world[&"systems"][&"runtime"][&"world"] = empty[&"systems"][&"runtime"][&"world"].duplicate(true)
+	expect(rejects_atomically(runtime, removed_world), "section-owned room without world occupancy rejects atomically")
+	expect(runtime.restore_snapshot(empty) and runtime.peeping_room_service.is_empty(), "absent legacy section clears previous nonempty service on valid load")
+	finish("Peeping room save")

tools/run_p13_reference_tests.py

@@ -0,0 +1,283 @@
+#!/usr/bin/env python3
+"""P13 reference evidence: read-only verification by default; collection is Root-only."""
+import argparse
+import ast
+import inspect
+import json
+import os
+import re
+import stat
+import types
+from pathlib import Path
+import shutil
+import sys
+
+sys.dont_write_bytecode = True
+import run_all_tests as shared
+
+PROTOCOL = 'guarded-p13-reference-v1'
+CANONICAL_EVIDENCE = 'p13-reference-native-uid-corrected'
+NEW_TESTS = [
+    'tests/special/test_peeping_room_geometry.gd',
+    'tests/special/test_peeping_room_reference.gd',
+    'tests/special/test_peeping_room_evidence.gd',
+    'tests/special/test_peeping_room_save.gd',
+    'tests/special/test_peeping_room_runtime.gd',
+]
+ROSTER = NEW_TESTS + [
+    'tests/s1/test_construction_service.gd',
+    'tests/s1/test_world_service.gd',
+    'tests/s1/test_path_service.gd',
+    'tests/s1/test_runtime_world_construction.gd',
+    'tests/supply/test_supply_save_migration.gd',
+    'tests/transport/test_transport_save.gd',
+    'tests/environment/test_runtime_weather.gd',
+    'tests/s6/test_runtime_snapshot_serialization.gd',
+    'tests/s6/test_runtime_save_lifecycle.gd',
+    'tests/supply/test_mimi_purchase_quote.gd',
+]
+
+
+def uid_plan(refs):
+    return {name + '.uid': {'owner': name, 'owner_sha256': pin['sha256'],
+                             'file_type': 'regular'}
+            for name, pin in sorted(refs.items())
+            if name.endswith('.gd') and name + '.uid' not in refs
+            and (name.startswith('tests/special/')
+                 or name == 'scripts/special/peeping_room_service.gd')}
+
+
+def uid_snapshot(stage, source, plan):
+    """Accept exactly the source inventory and finite native UID plan."""
+    actual = shared.inventory(stage, stage=True)
+    shared.require(set(actual) == set(source) | set(plan), 'exact source and planned UID set')
+    shared.require({n: actual[n] for n in source} == source, 'original source/settings unchanged')
+    seen = set()
+    for name in source:
+        if name.endswith('.uid'):
+            raw = (stage / name).read_bytes().rstrip(b'\r\n')
+            shared.require(raw not in seen, 'existing project UID collision')
+            seen.add(raw)
+    result = {}
+    for name, binding in plan.items():
+        path = stage / name
+        shared.require(stat.S_ISREG(path.lstat().st_mode) and not path.is_symlink()
+                       and path.stat().st_nlink == 1, 'ordinary generated UID')
+        raw = path.read_bytes()
+        shared.require(re.fullmatch(rb'uid://[a-z0-9]{1,13}\n', raw) is not None,
+                       'complete canonical UID bytes')
+        shared.require(raw.rstrip(b'\n') not in seen, 'generated UID collision')
+        seen.add(raw.rstrip(b'\n'))
+        shared.require(stat.S_ISREG((stage / binding['owner']).lstat().st_mode)
+                       and shared.sha(stage / binding['owner']) == binding['owner_sha256'],
+                       'UID owner content binding')
+        result[name] = dict(binding, bytes=len(raw), raw_bytes=list(raw),
+                            sha256=shared.sha(path), text=raw.decode('ascii'))
+    return result
+
+
+def install_uid_policy(namespace):
+    """Specialize private globals; shared and P18 functions remain untouched."""
+    original_collect, original_seal = namespace['collect'], namespace['seal']
+    state = {}
+
+    def reports(stage, expected, previous, requested):
+        shared.require(not requested and not previous, 'P13 has no generated reports')
+        snapshot = uid_snapshot(stage, state['source'], state['plan'])
+        if state['accepted'] is None:
+            shared.require(state['phase'] == 'import', 'UID generation only during import')
+            state['accepted'] = snapshot
+            expected.update({n: {'bytes': p['bytes'], 'sha256': p['sha256']}
+                             for n, p in snapshot.items()})
+        shared.require(snapshot == state['accepted'], 'sealed UID bytes unchanged')
+        return shared.declared_reports(stage, expected, previous, requested)
+
+    phase_globals = dict(vars(shared), declared_reports=reports)
+    execute = types.FunctionType(shared.execute_phase.__code__, phase_globals)
+
+    def phase(*args):
+        stage, out, label = args[1:4]
+        state['phase'] = label
+        if label == 'import':
+            shared.require(shared.inventory(stage, stage=True) == state['source'],
+                           'original stage before import')
+            before = {}
+            shared.write(out / 'uid-plan.json', state['plan'])
+        else:
+            before = uid_snapshot(stage, state['source'], state['plan'])
+            shared.require(before == state['accepted'], 'UID set before phase unchanged')
+        row = execute(*args)
+        after = uid_snapshot(stage, state['source'], state['plan'])
+        shared.require(after == state['accepted'], 'UID set after phase unchanged')
+        shared.write(out / (label + '-uids.json'), {'before': before, 'after': after})
+        return row
+
+    namespace['shared'] = types.SimpleNamespace(**dict(vars(shared), execute_phase=phase))
+
+    def collect(args, root, out, refs, *rest):
+        state.update(source=namespace['content_map'](refs), plan=uid_plan(refs), accepted=None)
+        return original_collect(args, root, out, refs, *rest)
+
+    def seal(out, refs, engine, contract_sha):
+        shared.write(out / 'accepted-uids.json', state['accepted'])
+        return original_seal(out, refs, engine, contract_sha)
+
+    def retained(stage, source, out):
+        plan = namespace['read_json'](out / 'uid-plan.json')
+        shared.require(plan == uid_plan(source), 'independently derived exact UID plan')
+        accepted = uid_snapshot(stage, source, plan)
+        shared.require(namespace['read_json'](out / 'accepted-uids.json') == accepted,
+                       'retained raw UID bytes and owner bindings')
+        for label in ['import', 'parse'] + [str(i).zfill(3) for i in range(len(ROSTER))]:
+            shared.require(namespace['read_json'](out / (label + '-uids.json')) ==
+                           {'before': {} if label == 'import' else accepted, 'after': accepted},
+                           'all phase UID before/after seals')
+        return True
+
+    namespace.update(collect=collect, seal=seal, uid_retained=retained)
+
+
+def protocol_core():
+    """Reuse P18's complete guarded core without editing or copying its runner.
+
+    P18 predates configurable protocol/roster constants. Specialize its three
+    entry functions' identity literals and explicit roster cardinalities, plus
+    one retained-stage comparison for the finite UID policy. The local phase
+    adapter retains every original shared gate and seals its accepted sidecars.
+    Fail closed if an upstream function changes any of these adapter sites.
+    Both runner sources remain bound by the whole selected source map.
+    """
+    core = shared.module('p13_p18_core', shared.HERE / 'run_p18_relationship_tests.py')
+    namespace = dict(vars(core), ROSTER=ROSTER, __file__=__file__)
+    replacements = {
+        'guarded-p18-v2': PROTOCOL,
+        'tools/run_p18_relationship_tests.py': 'tools/run_p13_reference_tests.py',
+        'exact seven unique tests': 'exact unique P13 roster',
+        'exact nine phases': 'exact P13 phase count',
+        'all nine captured engines': 'all P13 captured engines',
+    }
+    cardinalities = {
+        'len(set(ROSTER)) == 7': 'len(set(ROSTER)) == len(ROSTER)',
+        'len(phases) == 9': 'len(phases) == len(ROSTER) + 2',
+        "len(tests) == 7": 'len(tests) == len(ROSTER)',
+    }
+
+    class Specialize(ast.NodeTransformer):
+        def __init__(self):
+            self.identities = 0
+            self.counts = 0
+            self.summary = 0
+
+        def visit_Constant(self, node):
+            if isinstance(node.value, str) and node.value in replacements:
+                self.identities += 1
+                return ast.copy_location(ast.Constant(replacements[node.value]), node)
+            return node
+
+        def visit_Compare(self, node):
+            expression = ast.unparse(node)
+            if expression in cardinalities:
+                self.counts += 1
+                return ast.copy_location(ast.parse(cardinalities[expression], mode='eval').body, node)
+            return self.generic_visit(node)
+
+        def visit_Dict(self, node):
+            for index, key in enumerate(node.keys):
+                if isinstance(key, ast.Constant) and key.value == 'actual_suites':
+                    shared.require(isinstance(node.values[index], ast.Constant)
+                                   and node.values[index].value == 7, 'upstream suite summary unchanged')
+                    node.values[index] = ast.parse('len(ROSTER)', mode='eval').body
+                    self.summary += 1
+            return self.generic_visit(node)
+
+    expected = {'collect': (2, 0, 0), 'seal': (1, 0, 0), 'verify': (6, 3, 1)}
+    for name, counts in expected.items():
+        adapter = Specialize()
+        tree = adapter.visit(ast.parse(inspect.getsource(getattr(core, name))))
+        shared.require((adapter.identities, adapter.counts, adapter.summary) == counts,
+                       'unchanged upstream adaptation sites: ' + name)
+        if name == 'verify':
+            old = "shared.inventory(confined(out, 'stage'), stage=True) == source"
+            matches = [node for node in ast.walk(tree)
+                       if isinstance(node, ast.Compare) and ast.unparse(node) == old]
+            shared.require(len(matches) == 1, 'unchanged retained-stage UID adapter site')
+
+            class Retained(ast.NodeTransformer):
+                def visit_Compare(self, node):
+                    if ast.unparse(node) == old:
+                        return ast.copy_location(ast.parse(
+                            "uid_retained(confined(out, 'stage'), source, out)", mode='eval').body, node)
+                    return self.generic_visit(node)
+
+            tree = Retained().visit(tree)
+        exec(compile(ast.fix_missing_locations(tree), str(shared.HERE / 'run_p18_relationship_tests.py'), 'exec'), namespace)
+    install_uid_policy(namespace)
+    return namespace
+
+
+def main(argv=None):
+    argv = list(sys.argv[1:] if argv is None else argv)
+    parser = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
+    parser.add_argument('--output')
+    modes = parser.add_mutually_exclusive_group()
+    modes.add_argument('--collect', action='store_true', help='Root only; fresh native collection')
+    modes.add_argument('--prepare-only', action='store_true')
+    seen, index = set(), 0
+    while index < len(argv):
+        flag = argv[index]
+        shared.require(flag in ('--output', '--collect', '--prepare-only', '--help')
+                       and flag not in seen, 'unknown, duplicate or malformed flag')
+        seen.add(flag)
+        if flag == '--output':
+            index += 1
+            shared.require(index < len(argv) and argv[index] and not argv[index].startswith('--'), 'output value required')
+        index += 1
+    args = parser.parse_args(argv)
+    shared.require(not args.collect or args.output is not None, 'Root collection requires explicit --output')
+    if args.output is None:
+        base = os.environ.get('BUILD_OUTPUT_DIR')
+        shared.require(bool(base) and Path(base).is_absolute(), 'absolute BUILD_OUTPUT_DIR required')
+        args.output = str(Path(base) / CANONICAL_EVIDENCE)
+    args.timeout = 1200  # unchanged guarded core timeout; not a product value
+    core = protocol_core()
+    root = shared.HERE.parent
+    out = core['plain_path'](args.output)
+    refs = shared.source_refs(root)
+    shared.require(len(set(ROSTER)) == len(ROSTER) and set(ROSTER).issubset(shared.roster(root)), 'complete unique discovered roster')
+    markers = shared.module('p13_exact_markers', shared.HERE / 'strict_test_markers.py')
+    contract_path = root / 'docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json'
+    contract_sha = shared.sha(contract_path)
+    contracts = markers.load_contracts(contract_path)
+    shared.require(all(name in contracts for name in ROSTER), 'complete marker roster')
+    policy = shared.read(shared.SUPPORT / 'suite-policy.json')
+    shared.policy_coverage(ROSTER, refs, policy)
+    for test in ROSTER:
+        shared.phase_policy(test, Path(refs[test]['path']), policy['suite_policies'])
+    for test in NEW_TESTS:
+        shared.require(contracts[test]['source_sha256_at_schema_audit'] == refs[test]['sha256'], 'new strict source-hashed marker')
+    parse_paths = ['res://' + name for name in sorted(refs) if name.endswith('.gd')]
+    if args.prepare_only:
+        ancestor = out.parent
+        while not ancestor.exists():
+            ancestor = ancestor.parent
+        free = shutil.disk_usage(ancestor).free
+        size = sum(pin['bytes'] for pin in refs.values())
+        print(json.dumps(dict(protocol=PROTOCOL, roster=ROSTER, source_files=len(refs),
+            source_bytes=size, free_bytes=free, conservative_required_bytes=size + shared.MIN_SPACE,
+            capacity_available=free >= size + shared.MIN_SPACE, parse_paths=len(parse_paths),
+            future_native_phases=len(ROSTER) + 2, actual_checks=None, engines=0, stages=0,
+            formal_acceptance=False, original_unit_complete=False)))
+        return 0
+    if args.collect:
+        shared.require(not out.exists() and out.parent.is_dir(), 'fresh output with existing parent required')
+        shared.require(not out.is_relative_to(root), 'private collection outside source tree')
+        return core['collect'](args, root, out, refs, markers, contracts, policy, contract_path, contract_sha, parse_paths)
+    return core['verify'](out, refs, markers, contracts, policy, contract_sha, parse_paths)
+
+
+if __name__ == '__main__':
+    try:
+        raise SystemExit(main())
+    except (AssertionError, OSError, ValueError, KeyError, TypeError) as error:
+        print(type(error).__name__ + ': ' + str(error), file=sys.stderr)
+        raise SystemExit(1)