P26-01-LEDGER: 原P26-01 全必要内容の台帳

autoload/simulation_runtime.gd

@@ -20,6 +20,7 @@ const OPERATING_EXPENSE_ACCOUNT := &"OPERATING_EXPENSE"
 const AUTHORITY_FINE_ACCOUNT := &"AUTHORITY_FINE_EXPENSE"
 const WAGE_EXPENSE_ACCOUNT := &"WAGE_EXPENSE"
 const RUNTIME_SNAPSHOT_VERSION := 14
+const PeepingRooms := preload("res://scripts/special/peeping_room_service.gd")
 const AUTO_PURCHASE_RUNTIME_SNAPSHOT_VERSION := 14
 const EVENT_THREAT_RUNTIME_SNAPSHOT_VERSION := 13
 const MIMI_PURCHASE_RUNTIME_SNAPSHOT_VERSION := 15
@@ -97,6 +98,7 @@ const DEFENSE_COMMAND_TYPES: Array[StringName] = [
 var definition_registry := DefinitionRegistry.new()
 var command_queue := CommandQueue.new()
 var id_generator := StableIdGenerator.new()
+var peeping_room_service := PeepingRooms.new()
 var domain_events := DomainEventStream.new()
 var world_service := WorldService.new()
 var path_service := PathService.new()
@@ -233,6 +235,7 @@ func initialize(clock: SimulationKernel, state: Variant, seed := DEFAULT_WORLD_S
 	_hired_staff_candidate_ids.clear()
 	command_queue = CommandQueue.new()
 	id_generator = StableIdGenerator.new()
+	peeping_room_service = PeepingRooms.new()
 	domain_events = DomainEventStream.new()
 	world_service = WorldService.new()
 	path_service = PathService.new()
@@ -253,6 +256,7 @@ func initialize(clock: SimulationKernel, state: Variant, seed := DEFAULT_WORLD_S
 	_initialize_s5_defense()
 	construction_service = ConstructionService.new(world_service, construction_resource_state)
 	construction_service.current_minute = _clock.absolute_minute
+	peeping_room_service.configure(world_service, facility_service, construction_service, path_service, id_generator)
 	_connect_construction_signals()
 	var initial_infrastructure_ok := _initialize_infrastructure_services()
 	_next_command_id = 1
@@ -298,6 +302,8 @@ func initialize(clock: SimulationKernel, state: Variant, seed := DEFAULT_WORLD_S
 	register_command_executor(&"build_facility", Callable(self, "_execute_build_facility"))
 	register_command_executor(&"cancel_construction", Callable(self, "_execute_cancel_construction"))
 	register_command_executor(&"demolish_facility", Callable(self, "_execute_demolish_facility"))
+	for command_type: StringName in [&"peeping_room_validate", &"peeping_room_place", &"peeping_room_relink", &"peeping_room_record_evidence"]:
+		register_command_executor(command_type, Callable(self, "_execute_peeping_room"))
 	register_command_executor(&"set_elevator_operation", Callable(self, "_execute_set_elevator_operation"))
 	register_command_executor(&"start_excavation", Callable(self, "_execute_start_excavation"))
 	register_command_executor(&"pause_excavation", Callable(self, "_execute_pause_excavation"))
@@ -565,6 +571,8 @@ func create_snapshot() -> Dictionary:
 	}
 	if PurchaseQuoteV2.has_history(owned_systems[&"runtime"]):
 		owned_systems[&"runtime"][&"runtime_schema_version"] = MIMI_PURCHASE_RUNTIME_SNAPSHOT_VERSION
+	if not peeping_room_service.is_empty():
+		owned_systems[&"runtime"][&"special_peeping_rooms"] = peeping_room_service.create_snapshot()
 	# Every component above returns detached containers. Transfer this fresh
 	# tree into the envelope instead of deep-copying all component snapshots a
 	# second time. Keep generic capture's caller-owned-extra contract unchanged.
@@ -666,6 +674,8 @@ func _restore_snapshot_internal(snapshot: Dictionary, recovery_mode: bool) -> bo
 			runtime_current_keys.append(&"facility_cleanliness")
 		if runtime_schema_version >= AUTO_PURCHASE_RUNTIME_SNAPSHOT_VERSION:
 			runtime_current_keys.append(&"auto_purchase_plans")
+		if runtime_data.has(&"special_peeping_rooms"):
+			runtime_current_keys.append(&"special_peeping_rooms")
 		if not _dictionary_has_exact_canonical_keys(runtime_data, runtime_current_keys) \
 				or typeof(runtime_data.get(&"runtime_schema_version", null)) != TYPE_INT \
 				or typeof(runtime_data.get(&"world_seed", null)) != TYPE_INT \
@@ -1290,6 +1300,16 @@ func _restore_snapshot_internal(snapshot: Dictionary, recovery_mode: bool) -> bo
 	var restored_next_id := int(runtime_data.get(&"next_command_id", 0))
 	if restored_next_id <= 0:
 		return false
+	var restored_peeping_rooms := PeepingRooms.new()
+	restored_peeping_rooms.configure(restored_world, restored_facilities, restored_construction, restored_path, restored_id_generator)
+	if runtime_data.has(&"special_peeping_rooms"):
+		if not runtime_data[&"special_peeping_rooms"] is Dictionary:
+			return false
+		for raw_key: Variant in runtime_data:
+			if raw_key == &"special_peeping_rooms" and typeof(raw_key) != TYPE_STRING_NAME:
+				return false
+	if not restored_peeping_rooms.restore_section(runtime_data.get(&"special_peeping_rooms", null), restored_minute):
+		return false
 	if not SimulationSnapshot.restore(snapshot, _clock, _state):
 		return false
 	world_seed = restored_world_seed
@@ -1297,6 +1317,7 @@ func _restore_snapshot_internal(snapshot: Dictionary, recovery_mode: bool) -> bo
 	_staffing_projection_enabled = restored_staffing_projection
 	command_queue = restored_queue
 	id_generator = restored_id_generator
+	peeping_room_service = restored_peeping_rooms
 	domain_events = restored_domain_events
 	_rng_streams = restored_streams
 	world_service = restored_world
@@ -5546,6 +5567,7 @@ func _connect_facility_signals() -> void:
 		return
 	facility_service.instance_registered.connect(Callable(self, "_on_cleanliness_facility_registered"))
 	facility_service.instance_unregistered.connect(Callable(self, "_on_cleanliness_facility_unregistered"))
+	facility_service.instance_unregistered.connect(Callable(self, "_on_peeping_target_removed"))
 	facility_service.facility_state_changed.connect(Callable(self, "_on_facility_state_changed"))
 	facility_service.service_started.connect(Callable(self, "_on_service_started"))
 	facility_service.service_interrupted.connect(Callable(self, "_on_service_interrupted"))
@@ -10817,6 +10839,7 @@ func _on_excavation_completed(report: Dictionary) -> void:
 	))
 
 func _on_facility_demolished(instance_id: StringName, refund: Dictionary) -> void:
+	peeping_room_service.target_removed(instance_id)
 	if not mana_network_service.get_node(instance_id).is_empty():
 		mana_network_service.unregister_node(instance_id)
 	if facility_service.has_instance(instance_id):
@@ -10831,6 +10854,31 @@ func _on_facility_demolished(instance_id: StringName, refund: Dictionary) -> voi
 		0
 	))
 
+func _on_peeping_target_removed(instance_id: StringName) -> void:
+	peeping_room_service.target_removed(instance_id)
+
+func _execute_peeping_room(command: SimulationCommand) -> CommandResult:
+	var payload := command.payload
+	var report: Dictionary
+	if command.command_type == &"peeping_room_place":
+		report = PeepingRooms.result(&"BUILD_DEFINITION_PENDING_D04")
+	elif command.command_type == &"peeping_room_validate":
+		if typeof(payload.get(&"origin")) != TYPE_VECTOR3I or typeof(payload.get(&"footprint", Vector2i(2, 1))) != TYPE_VECTOR2I or typeof(payload.get(&"target_instance_id", &"")) not in [TYPE_STRING, TYPE_STRING_NAME]:
+			report = PeepingRooms.result(&"INVALID_PAYLOAD")
+		else:
+			report = peeping_room_service.validate_placement(payload[&"origin"], payload.get(&"footprint", Vector2i(2, 1)), StringName(payload.get(&"target_instance_id", &"")))
+	else:
+		var key: StringName = &"target_instance_id" if command.command_type == &"peeping_room_relink" else &"source_event_key"
+		if typeof(payload.get(&"room_id")) not in [TYPE_STRING, TYPE_STRING_NAME] or typeof(payload.get(key, &"")) not in [TYPE_STRING, TYPE_STRING_NAME]:
+			report = PeepingRooms.result(&"INVALID_PAYLOAD")
+		elif command.command_type == &"peeping_room_relink":
+			report = peeping_room_service.relink(StringName(payload[&"room_id"]), StringName(payload.get(key, &"")))
+		else:
+			report = peeping_room_service.record_evidence(StringName(payload[&"room_id"]), StringName(payload.get(key, &"")), _runtime_event_minute())
+	if report[&"ok"]:
+		return CommandResult.succeeded(command.command_id, report)
+	return CommandResult.failed(CommandResult.Code.VALIDATION_FAILED, command.command_id, String(report[&"reason"]), report)
+
 func _on_ledger_transaction_posted(transaction_id: StringName, _entries: Array) -> void:
 	if _operations_flushing_economy_notifications.has(transaction_id):
 		return

docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json

@@ -3734,6 +3734,61 @@
         "path": "docs/spec/acceptance/P23-03.json",
         "scope": "component and read-only observation only; native unexecuted; whole unit blocked"
       }
+    },
+    {
+      "test": "tests/special/test_peeping_room_geometry.gd",
+      "template": "Peeping room geometry: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "103d85f83e1e97a8637892504264275eef23f172eeec56c94e5c022d81bf6945",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
+    },
+    {
+      "test": "tests/special/test_peeping_room_reference.gd",
+      "template": "Peeping room reference: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "188b00a60f7aefda69dc4973f1de9c14447a0d4bcdd1257a2eabe7c4782e4caf",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
+    },
+    {
+      "test": "tests/special/test_peeping_room_evidence.gd",
+      "template": "Peeping room evidence: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "390e0032d14de9a8875ced163a922341ce655744200d78b4ffa776d42c4f8c2a",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
+    },
+    {
+      "test": "tests/special/test_peeping_room_save.gd",
+      "template": "Peeping room save: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "ba0e7644277477c1821135cae6d6fd533651799c6f9bd8c43ccf45e63b96c63c",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
+    },
+    {
+      "test": "tests/special/test_peeping_room_runtime.gd",
+      "template": "Peeping room runtime: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "924efd34414c12a325a1b700f799aef0396de9f15441fd88a3608292ff221657",
+      "authority": {
+        "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+        "scope": "new backend suite marker; native execution pending"
+      }
     }
   ],
   "unknown_roster_suite_policy": "refuse, explicitly review its source/schema before accepting",

docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261017/ACTUAL_LATEST29_FORMAL_REVIEW.json

@@ -0,0 +1,31 @@
+{
+  "task_id": "P04-01",
+  "commit": "2dde7596a87c43f7bf0bf704b7479f2fa06a5b1c",
+  "status": "blocked",
+  "summary": "The repair29 documents describe the current code accurately but leave the required ordering rules undefined. The D05 candidate's source references match the current product (product1338): FacilityService._prepare_service_for_tick:853-874 checks RELATED_FACILITY_INACTIVE before NO_POWER, and the cited runtime functions are at 5743/7553/8482/8577/8738/9804/11785. The submission itself states that D05 items (a) power vs closure/dependency precedence, (b) destruction vs completion, (c) exit vs completion and (d) which day a 00:00 sale belongs to are pending an owner decision. P04-01 requires the order across 閉店/停電/破壊/退出/課金/シフト交代/00:00決算 to be stated ('順序を明記'). That cannot be met while these mandatory rules are only a recommended 'keep current behavior' candidate that nobody has approved. Several final steps are also unfinished, and CURRENT_STATUS.md says the unit is incomplete (13/88 unchanged). The passing p04-acceptance check is mechanical (it confirms an index exists and does not approve the rules), so it is not enough for pass. The blocker is undecided rules (spec insufficient), which needs an owner decision, so the status is blocked.",
+  "acceptance_ids": [
+    "P04-01"
+  ],
+  "findings": [
+    {
+      "severity": "high",
+      "message": "Mandatory ordering rules are undefined. The order between power stop and closure/dependency, between destruction and completion/charging, between exit and completion, and which day a 00:00 sale belongs to are pending. D05_REMAINING_ORDER_CANDIDATE.md/.json offers only Option A (keep current behavior), which has not been approved. P04-01 requires the order to be stated explicitly ('順序を明記'), and code behavior is not authority, so acceptance cannot be granted. An owner decision is needed (spec insufficient → blocked)."
+    },
+    {
+      "severity": "high",
+      "message": "Under current behavior, Option (b) allows an incident-driven destruction in the same tick to follow a completion and charge (B4a: 25G charged, then destroyed). Whether this conflicts with the 'no charging while stopped' (停止中課金なし) criterion has not been settled. A D05 destruction rule is required."
+    },
+    {
+      "severity": "medium",
+      "message": "The checker's destruction_stop rule (tools/check_p04_order_evidence.py:49) points to BASELINE:183, which covers mana depletion, not destruction. The authority reference does not match the domain. The repair is deferred until D05 is approved, so the 破壊 domain still has no valid authority link."
+    },
+    {
+      "severity": "medium",
+      "message": "No final validation has been run on the final source and checker. Full178 ran with checker f5, not the current a61, and no full1339 run exists. tests/business/test_required_kitchen.gd differs from the version that run used. The support53cb rebind, final source/config/input/environment binding, formal review, integration (P04 first, then support) and any nativeWindows conditions are all still pending."
+    },
+    {
+      "severity": "low",
+      "message": "S4 NO_POWER evidence comes from a direct disconnect_nodes call and does not represent global mana depletion, which appears only in the B1 combined diagnostic run. The documents say this correctly, but the scope of the power-stop evidence is limited."
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261017/CURRENT_ACCEPTANCE_STATUS.json

@@ -0,0 +1,62 @@
+{
+  "observed_at": "2026-10-17T16:30:38.746525+09:00",
+  "original_packages": 30,
+  "original_units": 88,
+  "formally_completed": 14,
+  "new_credit": 0,
+  "plan_id": "P04-01",
+  "state": "in_progress",
+  "runner_project": "the-tree-p04-01",
+  "runner_state": "repair_pending",
+  "repairs": 29,
+  "max_repairs": null,
+  "submitted": "2dde7596a87c43f7bf0bf704b7479f2fa06a5b1c",
+  "candidate": null,
+  "worktree_clean_at_observation": true,
+  "active_worker": false,
+  "current_main_at_audit": "565fd805079d8c446f29e30c57979242561113ea",
+  "acceptance_unchanged": {
+    "domains": [
+      "閉店",
+      "停電",
+      "破壊",
+      "退出",
+      "課金",
+      "シフト交代",
+      "00:00決算"
+    ],
+    "safety": [
+      "停止中課金0",
+      "二重決算0",
+      "予約の孤立0"
+    ],
+    "conditions": "all15 + EV, original frozen rules unchanged",
+    "required_gates": [
+      "exact final source/checker applicability",
+      "required final full regression",
+      "independent whole review",
+      "ordinary prepare-integration / integration / final",
+      "ledger reflection"
+    ]
+  },
+  "latest_commander": "ea12167cffff444596c0c36caa700a26",
+  "latest_formal_review": "275d1fd64fff4d5782c6f7667fc1e031",
+  "no_duplicate_repair": true,
+  "remaining": [
+    "owner choices for destruction order and midnight-sale day, plus explicit disposition of reason label and command/AI exit",
+    "after actual answers, normal batched checker destruction-authority pin / registry / approval record / stale current metadata correction",
+    "final gates as listed; previous full178 f5 receipt is not full final checker a61 evidence; no relabeling"
+  ],
+  "already_corrected_per_actual_opus": [
+    "raw joins",
+    "canonical getter contract explanation",
+    "candidate HEAD fixtures",
+    "schema2 index",
+    "S4r28",
+    "Local8",
+    "r22 collection"
+  ],
+  "owner_response_pending": true,
+  "approval_not_inferred": true,
+  "whole_acceptance": false
+}

docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261017/CURRENT_STATUS_REPAIR29.md

@@ -0,0 +1,31 @@
+# P04-01 current status — repair29
+
+Worker checks: SOURCE-READY / NOTRUN. No probes or tests were run by this worker.
+
+This canonical table overrides creation-time NOT RUN / pending-execution entries in REPAIR22–28, their status/validation records, and the runbooks (including S4_ROOT_RUN.md). Those files are historical and remain untouched. It does not relabel an old run as execution of repair29.
+
+`B` = `/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build`.
+
+| Item | Canonical status | Exact-version evidence |
+| --- | --- | --- |
+| Current native product / main | Root-measured `5f6bc11d` / `9b1a18c1` | Product1338 at B/audit-support/p04-r17-full-inputs-r01/product; current SHA256 inventory in REPAIR29_STATIC_SOURCE.json. Old deb11300 is not current. |
+| S4 r28 | Root-measured 4/4 PASS; import/parse/Writer/Reader PIDs49940,50044,50078,50105 all ended; guards0; cleanup0 | B/p04-s4-native-r28; B/audit-support/p04-root-fb8b-s4-r01/native.result.json. Full controls in that same support directory. |
+| Local8 | Root-measured PASS | B/audit-support/p04-root-fb8b-local-r01: bulk, negative, applicability, native, series, encoder, join, roles result/stdio records. |
+| Collection | Root-measured r22 collected, no native re-run claimed | B/audit-support/p04-raw-collect-r22/MANIFEST.json and s1/s2a/s2b/s3/s4.json. |
+| Index | Root-measured schema2, missing_conditions=[], all15 conditions + EV mechanically verified | B/p04-evidence/index.json and generation-invocation.json; local-r01 index/checker output. This is not D05 approval. |
+| Registered validation on fb8b7919 | Root-measured PASS,28.095s | B/audit-support/p04-root-fb8b-local-r01/registered-validation.result.json and stdout log. Does not establish final repair29 validation or acceptance. |
+| Full178 | Root-measured178 suites /21615 checks PASS used checker f5, **not a61** | B/audit-support/p18-regression-support-final-r01/native-full178/runner-ended.json and source-start.json; exact receipt remains preserved. Checker f5 SHA256 `f5b44827958f2ae352fe5c4bc3a1ffd4211ec7a41fc4c0759c8b954891662324`. |
+| Full1339 against a61 | **No such full run exists** | a61 SHA256 `a61c5b496e656f60c66898e42500bc9a2d45f947690ce8f5f19a03984ebbc850`. Local8 and registered validation are separate evidence. |
+| Worker repair29 | SOURCE-READY / NOTRUN | Static source/line/registration/SHA256 inspection only. No tests, probes, Git, engine, Runner or agents. |
+| Owner D05 | Pending a–d, candidate only | D05_REMAINING_ORDER_CANDIDATE.md/json; A01, dependency hold and18:00 remain approved. |
+| Original unit | **Incomplete;13/88 unchanged** | Mechanical PASS does not approve unknown mandatory priorities, replace independent review, or integrate the unit. |
+
+Proof hashes for the exact collection/index/full receipt/validation and current source are in [REPAIR29_STATIC_SOURCE.json](REPAIR29_STATIC_SOURCE.json). Applicable source/config/input/environment joins stay in the immutable schema2 index and raw collection; no raw is normalized, spliced, regenerated or relabelled here.
+
+Product reuse requires exact applicability: the178 suites do not execute the Python checker and the316-file GDScript parse roster excludes it. Static comparison with the preserved full178 selected_source_map found one test-source difference, tests/business/test_required_kitchen.gd (full178 3a9c92f8…, current product5dcc86d6…), and no game-source difference. Preserve the Runner applicability binding for this test; do not claim all1338 selected product hashes match that full178 receipt or byte-identical full1339 validation against a61. Preserve the f5 full178 receipt and all historical partial/full outputs separately.
+
+Remaining Runner steps: independent review of these documents, then Root obtains owner decisions (or explicit non-mandatory rulings) for D05 a–d. Unknown mandatory rules stay pending. Any destruction authority pin/registry or other approved implementation change follows a normal repair. The support53cb normal registered rebind, final full run on the final source/checker, final source/config/input/environment binding, formal independent review and integration remain Runner work. Integration order is **P04 first, then support on main9b (`9b1a18c1`)**. NativeWindows obligations remain individually pending if required. No criterion is waived and no extra original unit is counted.
+
+Known authority/scope gaps: destruction_stop binds BASELINE:183 (mana depletion, not destruction); explicit D05 destruction rule required before normal pin repair. S4 NO_POWER was induced by direct disconnect_nodes; global depletion appears only in B1 combined diagnostic. Preserve these distinctions even though the mechanical index passes.
+
+Changed files in repair29 (all under this directory): ORDER_AUDIT.md; order-audit.json; D05_REMAINING_ORDER_CANDIDATE.md; D05_REMAINING_ORDER_CANDIDATE.json; CHECKER_PROTOCOL.md; EVIDENCE_COLLECTION.md; P04_ORDER_EVIDENCE_PROTOCOL.json; CURRENT_STATUS.md; REPAIR29_STATIC_SOURCE.json. Product/checker/registry, native footprint, staged inputs, raw and historical runbooks are unchanged.

docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261017/D05_REMAINING_ORDER_CANDIDATE.json

@@ -0,0 +1,130 @@
+{
+  "task_id": "P04-01",
+  "revision": "repair29",
+  "status": "approval candidate only; SOURCE-READY / NOTRUN",
+  "approval": null,
+  "apply_to_product_or_checker": false,
+  "review_flow": "Root asks owner after review. This document neither requests approval from worker nor records it.",
+  "proof_legend": {
+    "R": "B/audit-support/p04-raw-collect-r22",
+    "I": "B/p04-evidence/index.json schema2",
+    "pins": "REPAIR29_STATIC_SOURCE.json; R/MANIFEST.json and I raw_references/versions"
+  },
+  "choices": [
+    {
+      "id": "a",
+      "topic": "Power vs closure/dependency",
+      "status": "pending D05",
+      "observation": {
+        "status": "observed-current",
+        "behavior": "RELATED_FACILITY_INACTIVE selected before NO_POWER; both pause service with no charge.",
+        "source": "FacilityService _prepare_service_for_tick:853–874, phase FACILITY_COMPLETION after MANA projection",
+        "proof": "Root-measured R/s4.json isolated NO_POWER; R/s3.json B1 combined RELATED diagnostic; REPAIR29_STATIC_SOURCE.json source pins"
+      },
+      "inputs": "Same service and minute, related facility inactive and power unavailable; include direct closure separately under D-034.",
+      "A": {
+        "recommended": true,
+        "rule": "Keep current RELATED-first reason selection.",
+        "outcome": "Service held, progress/payment paused, reservation and serviceID retained.",
+        "side_effects": "Reason reports dependency while both causes apply; no new hold limit.",
+        "dependencies": "Approved dependency hold, D-034 direct closure, existing MANA-before-completion order."
+      },
+      "B": {
+        "rule": "NO_POWER wins reason selection when both conditions fail.",
+        "outcome": "Same no-charge hold safety; reason reports power.",
+        "side_effects": "Reason/event and recovery-precedence semantics would change; concrete implementation and exact-version proof require normal repair.",
+        "dependencies": "Must retain no-charge while either legitimate hold persists; preserve approved dependency reservation/identity behavior."
+      }
+    },
+    {
+      "id": "b",
+      "topic": "Destruction",
+      "status": "pending D05",
+      "observation": {
+        "status": "observed-current",
+        "behavior": "Command destruction in APPLY precedes completion. Incident destruction in INCIDENTS follows it; B4a shows25G charge then destruction in same tick.",
+        "source": "Runtime _process_tick_commands:5743, _advance_facilities:8482, _advance_defense:8577 / _apply_defense_outcome_boundary:9804",
+        "proof": "Root-measured R/s3.json B4a/B4b; REPAIR29_STATIC_SOURCE.json"
+      },
+      "inputs": "A service due for completion in a minute with command or incident destruction of its facility.",
+      "A": {
+        "recommended": true,
+        "rule": "Keep command-before-completion and incident-after-completion behavior.",
+        "outcome": "Command destruction prevents completion; incident may follow a valid completion/charge that minute; next-tick broken failure/release remains.",
+        "side_effects": "Completion and destruction can coexist in one tick as B4a; not a universal no-sale-on-destruction rule.",
+        "dependencies": "P04 stopped-charge and orphan-reservation safety; explicit D05 destruction authority required."
+      },
+      "B": {
+        "rule": "An incident in the same minute suppresses that minute completion (or voids it if already posted).",
+        "outcome": "No retained completion/sale for the incident-destruction minute.",
+        "side_effects": "Would require preemption or atomic reversal of completion, inventory, payment and rewards; no unapproved numbers or refund amounts supplied.",
+        "dependencies": "Owner must specify the suppress/void transaction semantics; preserve idempotency, no orphan reservations and approved shift/hold rules; normal implementation and new proof required."
+      }
+    },
+    {
+      "id": "c",
+      "topic": "Exit",
+      "status": "pending D05",
+      "observation": {
+        "status": "observed-current",
+        "behavior": "Command exit APPLY before completion/charging; AI PLANNED_EXIT after them; LEAVING despawns later.",
+        "source": "Runtime _execute_leave_facility_queue:7553; _advance_guest_ai_decisions:8738–8762",
+        "proof": "Root-measured R/s3.json B2a/B2b/B3 and B1 departure history; source pins REPAIR29_STATIC_SOURCE.json"
+      },
+      "inputs": "Exit command or AI exit due at a minute with a completion-ready service. Current AI PLANNED_EXIT applies to DECIDING guests; do not assume it preempts an active service.",
+      "A": {
+        "recommended": true,
+        "rule": "Keep current command/AI distinction and state predicates.",
+        "outcome": "Command leave/release happens first; eligible AI planned exit follows completion/charging and queue processing.",
+        "side_effects": "AI due time alone does not universally cancel current-minute completion; later despawn remains separate.",
+        "dependencies": "D-034, reservation ownership/release, phase6 completion before phase10 AI."
+      },
+      "B": {
+        "rule": "An exit due this minute preempts completion.",
+        "outcome": "Applicable due exits release/cancel before completion and no completion sale occurs for that preempted service.",
+        "side_effects": "Changes eligibility for exit and service cancellation; would change simultaneous completion/payment observations.",
+        "dependencies": "Owner must define applicable due-exit states; preserve no orphan reservation, no duplicate charge and approved dependency/shift behavior; normal repair and exact proof required."
+      }
+    },
+    {
+      "id": "d",
+      "topic": "Cost time/day attribution beyond A01 and18:00",
+      "status": "pending D05",
+      "observation": {
+        "status": "observed-current",
+        "behavior": "Sale dated at post-increment minute. At00:00 TIME_BOUNDARIES settlement/upkeep precede completions;00:00 sales go to new day because daily-close period_end is exclusive.",
+        "source": "Kernel advance_one_minute:122; Runtime _apply_service_transaction:11785 /11826–11838; coordinator _process_daily_close:1125 /1136",
+        "proof": "Root-measured R/s2a.json paid midnight/replay; I C; REPAIR29_STATIC_SOURCE.json"
+      },
+      "inputs": "Service completes on calendar boundary; account period ends at boundary minute. A01 ownership upkeep and18:00 shift interval remain fixed.",
+      "A": {
+        "recommended": true,
+        "rule": "Keep post-increment sale time and new-day attribution for00:00 sales.",
+        "outcome": "Closing day excludes boundary-minute completion; new day receives sale.",
+        "side_effects": "Closing summary is finalized before those sales; upkeep ownership rule unchanged.",
+        "dependencies": "Exclusive daily-close interval, sale timestamp, idempotent close/replay; P04 mandatory timing/attribution separate from D04/P05 numeric cost math."
+      },
+      "B": {
+        "rule": "Boundary-minute sales belong to closing day.",
+        "outcome": "Closing day includes those sales.",
+        "side_effects": "Would require a distinct accounting attribution or revised boundary transaction sequencing; affects daily summaries/reconciliation/replay. No numeric cost policy is invented.",
+        "dependencies": "Owner must settle attribution mechanics and same-boundary replay; preserve A01 and18:00, all P04 safety criteria; normal repair and exact-version proof required."
+      }
+    }
+  ],
+  "bundle": {
+    "label": "accept current-behavior A for a-d",
+    "status": "pending D05",
+    "recommended": true,
+    "coupling_notes": [
+      "a preserves the approved hold and no-charge safety independent of reason priority.",
+      "b and c use the same completion boundary: commands before, incidents and AI after. Changing either requires separate applicability and replay checks.",
+      "d relies on TIME_BOUNDARIES before completion; changing attribution can affect the transaction history used by b/c and settlement idempotency.",
+      "A01 ownership upkeep, dependency hold and18:00 interval are already approved and are excluded from renewed approval.",
+      "Owner may explicitly rule some remaining items non-mandatory; no such ruling exists here. Unknowns stay pending; mandatory acceptance is never relaxed."
+    ]
+  },
+  "authority_gap": "destruction_stop currently binds BASELINE:183, which is mana depletion, not destruction authority. Explicit D05 destruction rule required. Pin/registry repair only after approval through normal repair.",
+  "power_scope": "S4 NO_POWER uses direct disconnect_nodes; not proof of global depletion, which exists only in B1 combined diagnostic.",
+  "original_unit_complete": false
+}

docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261017/D05_REMAINING_ORDER_CANDIDATE.md

@@ -0,0 +1,93 @@
+# D05 remaining order candidate — repair29
+
+**Approval candidate only. SOURCE-READY / NOTRUN.** Root asks the owner after review. Nothing is applied to product, checker or registry; observation is not approval. A01 midnight ownership upkeep, dependency hold and18:00 are already approved and are not re-asked.
+
+Structured choices: [D05_REMAINING_ORDER_CANDIDATE.json](D05_REMAINING_ORDER_CANDIDATE.json). Source path/line/SHA256 pins: [REPAIR29_STATIC_SOURCE.json](REPAIR29_STATIC_SOURCE.json); phase map: [ORDER_AUDIT.md](ORDER_AUDIT.md). R = B/audit-support/p04-raw-collect-r22; I = B/p04-evidence/index.json. These are Root-measured exact-version proof references, with raw/provenance pins in R/MANIFEST.json, I and the static manifest.
+
+## (a) Power vs closure/dependency — pending D05
+
+**Observed-current:** RELATED_FACILITY_INACTIVE selected before NO_POWER; both pause service with no charge. Source: FacilityService _prepare_service_for_tick:853–874, phase FACILITY_COMPLETION after MANA projection. Proof: Root-measured R/s4.json isolated NO_POWER; R/s3.json B1 combined RELATED diagnostic; REPAIR29_STATIC_SOURCE.json source pins.
+
+**Inputs:** Same service and minute, related facility inactive and power unavailable; include direct closure separately under D-034.
+
+**Option A (recommended; keep current behavior):** Keep current RELATED-first reason selection.
+
+- Outcomes: Service held, progress/payment paused, reservation and serviceID retained.
+- Side effects: Reason reports dependency while both causes apply; no new hold limit.
+- Dependencies: Approved dependency hold, D-034 direct closure, existing MANA-before-completion order.
+
+**Option B:** NO_POWER wins reason selection when both conditions fail.
+
+- Outcomes: Same no-charge hold safety; reason reports power.
+- Side effects: Reason/event and recovery-precedence semantics would change; concrete implementation and exact-version proof require normal repair.
+- Dependencies: Must retain no-charge while either legitimate hold persists; preserve approved dependency reservation/identity behavior.
+
+## (b) Destruction — pending D05
+
+**Observed-current:** Command destruction in APPLY precedes completion. Incident destruction in INCIDENTS follows it; B4a shows25G charge then destruction in same tick. Source: Runtime _process_tick_commands:5743, _advance_facilities:8482, _advance_defense:8577 / _apply_defense_outcome_boundary:9804. Proof: Root-measured R/s3.json B4a/B4b; REPAIR29_STATIC_SOURCE.json.
+
+**Inputs:** A service due for completion in a minute with command or incident destruction of its facility.
+
+**Option A (recommended; keep current behavior):** Keep command-before-completion and incident-after-completion behavior.
+
+- Outcomes: Command destruction prevents completion; incident may follow a valid completion/charge that minute; next-tick broken failure/release remains.
+- Side effects: Completion and destruction can coexist in one tick as B4a; not a universal no-sale-on-destruction rule.
+- Dependencies: P04 stopped-charge and orphan-reservation safety; explicit D05 destruction authority required.
+
+**Option B:** An incident in the same minute suppresses that minute completion (or voids it if already posted).
+
+- Outcomes: No retained completion/sale for the incident-destruction minute.
+- Side effects: Would require preemption or atomic reversal of completion, inventory, payment and rewards; no unapproved numbers or refund amounts supplied.
+- Dependencies: Owner must specify the suppress/void transaction semantics; preserve idempotency, no orphan reservations and approved shift/hold rules; normal implementation and new proof required.
+
+## (c) Exit — pending D05
+
+**Observed-current:** Command exit APPLY before completion/charging; AI PLANNED_EXIT after them; LEAVING despawns later. Source: Runtime _execute_leave_facility_queue:7553; _advance_guest_ai_decisions:8738–8762. Proof: Root-measured R/s3.json B2a/B2b/B3 and B1 departure history; source pins REPAIR29_STATIC_SOURCE.json.
+
+**Inputs:** Exit command or AI exit due at a minute with a completion-ready service. Current AI PLANNED_EXIT applies to DECIDING guests; do not assume it preempts an active service.
+
+**Option A (recommended; keep current behavior):** Keep current command/AI distinction and state predicates.
+
+- Outcomes: Command leave/release happens first; eligible AI planned exit follows completion/charging and queue processing.
+- Side effects: AI due time alone does not universally cancel current-minute completion; later despawn remains separate.
+- Dependencies: D-034, reservation ownership/release, phase6 completion before phase10 AI.
+
+**Option B:** An exit due this minute preempts completion.
+
+- Outcomes: Applicable due exits release/cancel before completion and no completion sale occurs for that preempted service.
+- Side effects: Changes eligibility for exit and service cancellation; would change simultaneous completion/payment observations.
+- Dependencies: Owner must define applicable due-exit states; preserve no orphan reservation, no duplicate charge and approved dependency/shift behavior; normal repair and exact proof required.
+
+## (d) Cost time/day attribution beyond A01 and18:00 — pending D05
+
+**Observed-current:** Sale dated at post-increment minute. At00:00 TIME_BOUNDARIES settlement/upkeep precede completions;00:00 sales go to new day because daily-close period_end is exclusive. Source: Kernel advance_one_minute:122; Runtime _apply_service_transaction:11785 /11826–11838; coordinator _process_daily_close:1125 /1136. Proof: Root-measured R/s2a.json paid midnight/replay; I C; REPAIR29_STATIC_SOURCE.json.
+
+**Inputs:** Service completes on calendar boundary; account period ends at boundary minute. A01 ownership upkeep and18:00 shift interval remain fixed.
+
+**Option A (recommended; keep current behavior):** Keep post-increment sale time and new-day attribution for00:00 sales.
+
+- Outcomes: Closing day excludes boundary-minute completion; new day receives sale.
+- Side effects: Closing summary is finalized before those sales; upkeep ownership rule unchanged.
+- Dependencies: Exclusive daily-close interval, sale timestamp, idempotent close/replay; P04 mandatory timing/attribution separate from D04/P05 numeric cost math.
+
+**Option B:** Boundary-minute sales belong to closing day.
+
+- Outcomes: Closing day includes those sales.
+- Side effects: Would require a distinct accounting attribution or revised boundary transaction sequencing; affects daily summaries/reconciliation/replay. No numeric cost policy is invented.
+- Dependencies: Owner must settle attribution mechanics and same-boundary replay; preserve A01 and18:00, all P04 safety criteria; normal repair and exact-version proof required.
+
+## Bundle: accept current-behavior A for a-d
+
+Recommended candidate, not approved.
+
+- a preserves the approved hold and no-charge safety independent of reason priority.
+- b and c use the same completion boundary: commands before, incidents and AI after. Changing either requires separate applicability and replay checks.
+- d relies on TIME_BOUNDARIES before completion; changing attribution can affect the transaction history used by b/c and settlement idempotency.
+- A01 ownership upkeep, dependency hold and18:00 interval are already approved and are excluded from renewed approval.
+- Owner may explicitly rule some remaining items non-mandatory; no such ruling exists here. Unknowns stay pending; mandatory acceptance is never relaxed.
+
+destruction_stop currently binds BASELINE:183, which is mana depletion, not destruction authority. Explicit D05 destruction rule required. Pin/registry repair only after approval through normal repair.
+
+S4 NO_POWER uses direct disconnect_nodes; not proof of global depletion, which exists only in B1 combined diagnostic.
+
+P04 timing/attribution remains mandatory; D04/P05 numeric cost math is separate. No acceptance criterion is relaxed. P04 remains incomplete; original13/88 unchanged.

docs/plans/original-completion-2026-10-02/execution/p13-02/ACTUAL_OPUS_INDEPENDENT_SELECTION.json

@@ -0,0 +1,7 @@
+{
+  "action": "wait",
+  "task_id": "P04-01",
+  "reason": "P04-01: WAIT. Waiting for the owner's Japanese answers on D05 (a) power vs closure/dependency precedence, (b) destruction vs completion, (c) exit vs completion, (d) which day a 00:00 sale belongs to. Do not re-ask, do not request-repair (repair30), do not redo tests.\n\nINDEPENDENT NEXT ORIGINAL UNIT (new contract proposal; no matching project in the 20-project inventory, nothing started here): P13-02 「背面条件と対象参照」.\n- Work: 覗き部屋の対象背面、通路寸断、対象喪失と証拠IDを状態として実装する。\n- Acceptance (unchanged): 対象撤去、重複収集、停止、途中保存で状態と参照が整合する。\n- Package P13 acceptance also applies: special rules hold at build time and run time; invalid placement and actions on lost targets rejected; event state saved; implemented scope reported separately from unmade content.\n- Package deps: P09, P12 (both incomplete; bounded progress is allowed, not unit closure). Decisions D04/D05/D08.\n- Original sources: B-2.5 (built behind VIPルーム/風俗個室/脱衣所 on back layer; its cells are no longer usable as back corridor; 記録係 collects 脅迫ネタ); B-8.3 (VIP/浴場/風俗の裏限定・裏通路を寸断); B-10.6 (覗き部屋 2x1, back-only).\n\nSOURCE GAP (main 2f3884b): no peeping/覗き code, data or tests in scripts/autoload/data/resources/tests/tools.\n- FacilityCatalog (scripts/data/facility_catalog.gd) has no peeping_room.\n- No recorder role; no back-side target reference; no evidence-ID ledger; no target-loss state.\n- Existing targets: public_bath, adult_private_room. VIP suite is undefined (P10-01); vip_private_salon must not substitute.\n- Rejected alternatives:\n  - P07-01: weather_timeline has no rain/fog effects or natural generation (D04 values).\n  - P12-01: security_station only checks the guard role (simulation_runtime.gd:6631); guard effects need D04 values.\n  - P15-02: cleric witness/morale rule needs an undecided definition of \"witness\" plus a D04 magnitude.\n  - P16: wages/severance/sale amounts are D04.\n\nMECHANISMS POSSIBLE WITH APPROVED INPUTS vs PENDING:\n- Possible:\n  - placement check: room cells must lie entirely behind a single allowed, completed target's FRONT footprint on the BACK layer;\n  - corridor blocking as an occupancy rule with no automatic bypass;\n  - stable target reference;\n  - target removal sets TARGET_LOST; no automatic recovery, explicit relink only (D03 pattern / kitchen relink);\n  - idempotent evidence IDs keyed by (room, target, source_event_key);\n  - no collection while stopped (NO_POWER/closed/under construction);\n  - versioned save section with legacy-absent migration and atomic rejection of malformed data.\n- Pending (record, do not invent):\n  - build cost/materials/build_minutes/upkeep (D04); FacilityDefinition requires them, so no normal palette registration;\n  - recorder role and staffing, collection trigger/rate (D04/D08/P16);\n  - VIP suite target (P10-01);\n  - D05 ordering;\n  - blackmail use and camera UI (P19/P24).\n\nBRIEF: Add a separate PeepingRoomService connected from the Runtime; no rewrite of the whole runtime.\n- Reuse world_service.cells_for_footprint/validate_occupancy/occupy and construction_service.validate_placement.\n- Copy the weather snapshot-version pattern (simulation_runtime.gd:29/520/663/1248).\n- Hook facility removal so the target is marked lost.\n- Add commands for placement validation, explicit relink and evidence recording.\n- No product values, no content, no Clock/P04 change.\n\nALLOWED PATHS:\n- scripts/special/peeping_room_service.gd (new)\n- autoload/simulation_runtime.gd (bounded connection: save section, removal hook, commands)\n- scripts/core/save_service.gd (only if needed)\n- tests/special/test_peeping_room_*.gd\n- docs/plans/original-completion-2026-10-02/execution/p13-02/**\n\nLOCAL TESTS:\n- Valid public_bath and adult_private_room backs.\n- Rejections: front layer, partial overlap, non-target, incomplete target, VIP pending.\n- Corridor cell conflict and path disconnect.\n- Target demolition leads to TARGET_LOST; rebuilt target does not auto-relink; explicit relink works.\n- Duplicate event key yields a single evidence ID.\n- Stopped room rejects collection.\n- Save/restore round-trip, legacy save without the section, malformed restore leaves state unchanged.\n- Existing suites: construction/world/path, tests/supply/test_supply_save_migration.gd, tests/transport/test_transport_save.gd, tests/environment/test_runtime_weather.gd.\n\nREUSE / FULL REVIEW:\n- No completed P18/P23 rerun.\n- Full regression only on the exact final version, then a separate Claude review and normal integration.\n- No partial credit (formal 14/88 and original 30/88 unchanged); do not claim P13 or the backend complete.\n\nOwner must register the new task contract before any run.",
+  "codex_model": "gpt-6.1-sol",
+  "codex_model_reason": "P04-01 itself stays in wait, so no worker runs for it. For the proposed P13-02 batch: one new state service plus a bounded runtime connection. It follows existing patterns (weather snapshot versioning, kitchen explicit relink, world occupancy), uses no numeric balancing and no native code. Sol is sufficient on quality, time and usage. Switch to Astra only if review finds the runtime save-version change crosses many existing save paths."
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_IMPLEMENTATION.md

@@ -0,0 +1,148 @@
+# P13-02-CODE1 implementation handoff
+
+This is non-graphic state/reference/occupancy/save machinery only. It does not
+complete P13-02, grant partial credit, or change the original 30/88 denominator
+or formal 14/88 count. Native execution and acceptance are pending.
+
+## Declared scope and verification
+
+Before editing, the worker declared the new service, bounded Runtime hooks,
+special tests, narrow runner, marker additions and this documentation. SaveService
+was conditional on an exact-key dependency; inspection found
+`SupplyAutoPurchaseQuotePlans.valid_runtime_format` has that dependency.
+Only allowed paths were edited. No asset, UI, content, model, policy, clock phase,
+or P04 change is involved.
+
+The full ignored `build/owner-handoff/ACTUAL_OPUS_RUN_DECISION.json` was read and
+left untouched. Base HEAD is `1e8d4ea88876865a72547ff0edf43ed5b0e74c7e`.
+The immutable spec was not edited. Its SHA-256 without the terminal newline is
+the registered `8ea65f2eefedc772c08170186f5cd03ac017432f4b069ade4f9210d4215c2d43`;
+the on-disk file including that newline is
+`988d6e18a49372549863cd433432c2852c962fa64b138e490361c023e80249dc`.
+
+Worker verification: Python AST parsing/compilation only, without executing the
+runner or importing its dependencies; source/JSON/hash review. GDScript parsing,
+all tests, `--prepare-only`, native collection and regression were **not run**.
+No check totals or native success receipts are claimed. No git writes, commits,
+branches, other agents, integration or Runner operations were performed.
+
+## Service and commands
+
+`PeepingRoomService` is a separate RefCounted service with no content or UI.
+All command executors use the existing Runtime queue; queue/history receipts
+remain normal Runtime behavior even for rejected/read-only domain commands.
+
+| Command | Preconditions and result |
+| --- | --- |
+| `peeping_room_validate` | `origin: Vector3i`, optional `footprint: Vector2i` (2x1), optional `target_instance_id: String/StringName`. Pure domain validation. |
+| `peeping_room_place` | Always `BUILD_DEFINITION_PENDING_D04`; no occupancy, resource, room or ID mutation. |
+| `peeping_room_relink` | Existing `room_id`, explicit nonempty `target_instance_id`; full geometry and ownership validation excluding only the room's exact own occupancy. Leaves `LINKED`, stopped, `RELINKED_PENDING_RESUME`. |
+| `peeping_room_record_evidence` | Existing `room_id`, nonblank named `source_event_key`. Uses Runtime minute, never caller-supplied time. Checks stopped, target power, target closure/opening hours, completed construction authority, and lost target in that order. Otherwise rejects with `RECORDER_ELIGIBILITY_PENDING_D04_D08_P16`. Never writes the ledger. |
+
+Malformed command field types return `INVALID_PAYLOAD`. Missing/blank source keys
+return `SOURCE_EVENT_KEY_REQUIRED` before operational checks. Loss latches both
+`TARGET_LOST` and stopped, so collection after normal demolition returns `STOPPED`
+while the room's link/stop reason identifies `TARGET_LOST`. No resume command or
+automatic resume is defined. Power/closure guards read actual target conditions;
+they do not define special-room power demand, staffing or normal operation.
+
+Placement is exactly 2x1 BACK, fully behind a single completed FRONT
+`public_bath` or `adult_private_room`. It checks bounds/excavation, both real
+FacilityService and ConstructionService ownership, FRONT cells, World occupancy,
+and both World walkability and PathService membership. Exact rejection families:
+`WRONG_LAYER`, `WRONG_FOOTPRINT`, `OUT_OF_BOUNDS`, `NOT_EXCAVATED`,
+`TARGET_INCOMPLETE`, `TARGET_MISSING`, `PARTIAL_TARGET`, `MULTIPLE_TARGETS`,
+`TARGET_MISMATCH`, `TARGET_UNKNOWN`, `TARGET_NOT_ALLOWED`, `TARGET_WRONG_LAYER`,
+`CORRIDOR_CONFLICT`, `BACK_OCCUPIED`. The named `vip_suite` request returns
+`PENDING_P10_01`; `vip_private_salon` is not an allowed substitute.
+
+Any existing corridor cell conflicts. A proposed cut through a connected corridor
+is rejected before mutation, preserving the route; no reroute or bypass is
+invented. Accepted fixture cells were already nonwalkable and become occupied
+under `special_peeping_room`. No special-room construction weight/cost is assumed.
+
+Runtime demolition and FacilityService unregistration latch loss. Collection also
+detects missing FRONT occupancy/identity. Rebuilding the same cells produces a
+different construction ID and never silently reattaches rooms. Relink is explicit.
+
+## CONTROLLED_FIXTURE boundary
+
+Only service methods named `controlled_fixture_place`,
+`controlled_fixture_set_stopped`, and `controlled_fixture_record_evidence` create
+test rooms, enable fixture collection, or write evidence. They are labeled
+CONTROLLED_FIXTURE in code and tests. They have no command/palette registration,
+and no Runtime executor calls them. Test helpers disclose direct underground
+geometry setup and MIMI registration; those do not assert natural unlock/join or
+production eligibility. Target construction uses existing definitions/costs/times.
+
+Room IDs come from the existing StableIdGenerator's `peeping_room` counter.
+Evidence IDs encode the UTF-8 lengths and hex bytes of the full
+`(room_id, target_instance_id, source_event_key)` tuple. This is injective rather
+than delimiter concatenation or a hash with possible collisions. Replays return
+the existing ID with `duplicated=true` and retain the first minute. Evidence is
+only IDs, source key and minute. Room `target_history` retains prior bindings so
+relink does not orphan existing opaque evidence.
+
+## Save invariants
+
+Runtime versions remain 14 and 15, with version 15 only for existing v2 purchase
+history. Optional canonical StringName key `special_peeping_rooms` has section
+version 1 and exact keys `version`, `rooms`, `evidence`. Empty service state emits
+no key, preserving original snapshots. Absent sections restore empty only if no
+world occupancy uses the special kind or `peeping_room.` prefix. Thus removing
+the section from a current room-bearing save is rejected without a version bump.
+
+Restore stages the entire section against staged world, path, facilities,
+construction and ID generator before committing any Runtime state. It checks
+canonical keys/types, version, duplicate room/evidence identities, deterministic
+evidence tuple encoding, bounds/geometry, room/occupancy correspondence in both
+directions, generator high-water mark, known historical facility IDs, present
+target definition/geometry, loss/stopped coherence, and evidence room/history/time
+references. Null/present-empty sections are invalid; absence is the only empty
+encoding. Existing pending command/reference and schema migration checks remain.
+
+SaveService validates a present section through the same staged service validator,
+then supplies a shallow copy without this one key to the original purchase-format
+allowlist. No other keys are removed. The original format 1 (Runtime 1–14),
+format 2 (Runtime 15), manifest duplicate 15 and MIMI checks remain unchanged.
+
+## Verification handoff
+
+Five strict suites cover geometry/corridor, removal/relink, evidence/guards,
+typed atomic save corruption and physical format 1, and Runtime commands plus
+physical MIMI format 2. Tests use `var_to_bytes` for whole Runtime atomicity and
+roundtrip checks. New marker rows carry final test source hashes; prior rows and
+policy are unchanged. A helper under `tests/special/` is not a discovered suite.
+
+`tools/run_p13_reference_tests.py` defaults to read-only verification of
+`$BUILD_OUTPUT_DIR/p13-reference-native`, failing closed without an absolute
+environment path. Explicit `--output --collect` is for Root only. The strict flag
+parser rejects abbreviations, repeated flags, positional inputs and `=` aliases.
+`--prepare-only` is non-native but was not executed by this worker.
+
+The runner imports the existing P18 core by path. Since its three entry functions
+hardcode their label and seven/nine counts, a bounded AST adapter changes only
+protocol/runner identities, those explicit roster cardinalities, and diagnostic
+labels. It checks the exact adaptation-site counts and fails closed on drift.
+All confinement, inventory, JSON, sealing, source/engine/marker/policy binding,
+process, diagnostic, profile and cleanup gates are reused. It neither copies the
+whole runner nor modifies P18/helpers. The whole selected source map binds both
+runner sources. Phase count derives from `len(ROSTER) + 2`.
+
+Roster includes all five new suites and existing construction/world/path/runtime
+construction, supply migration, transport save, Runtime weather, snapshot
+serialization, save lifecycle and MIMI purchase suites. Receipts retain
+`formal_acceptance=false` and `original_unit_complete=false`.
+
+Root must perform serialized native collection with the allocation/private
+profile, then registered `p13-reference` validation, a separate actual Opus
+review, and the final exact-version required regression. Only those steps can
+establish execution results.
+
+## Still pending, without invented values
+
+D04 build/upkeep/build minutes and other product numbers; recorder staffing and
+natural triggers/rates D04/D08/P16; VIP suite P10-01; D05 transaction decisions
+(no tick-phase changes here); P19 evidence use and P24 camera UI; normal palette
+registration/construction/operation and natural production evidence; whole P13
+acceptance, final review/integration, and applicable native Windows conditions.

docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json

@@ -0,0 +1,65 @@
+{
+  "id": "P13-02-CODE1",
+  "parent_original_delivery_unit": "P13-02",
+  "parent_work": "覗き部屋の対象背面、通路寸断、対象喪失と証拠IDを状態として実装する。",
+  "parent_acceptance": "対象撤去、重複収集、停止、途中保存で状態と参照が整合する。",
+  "original_denominator": {
+    "packages": 30,
+    "units": 88,
+    "formal_complete_at_registration": 14,
+    "partial_credit": false
+  },
+  "whole_parent_acceptance": false,
+  "scope": "Non-graphic state/reference/occupancy/save machinery connected to real Runtime; no sexual depiction, camera content or blackmail action; this registered batch is not the whole original unit.",
+  "authority": [
+    {
+      "ref": "BASELINE:52-53",
+      "text": "Target FRONT VIP room/private room/changing area BACK; occupied room cells cannot be back corridor; recorder collects evidence."
+    },
+    {
+      "ref": "BASELINE:167-174",
+      "text": "VIP suite/public bath/private room explicitly peeping-compatible; restricted behind these target types and cuts back corridor."
+    },
+    {
+      "ref": "BASELINE:199-209",
+      "text": "Peeping room 2x1 BACK. Current public_bath/adult_private_room target definitions exist; missing VIP suite must remain missing, vip_private_salon is not a substitute."
+    }
+  ],
+  "implementation_requirements": [
+    "Introduce separate PeepingRoomService, bounded real Runtime wiring; no whole runtime rewrite.",
+    "Validate 2x1 BACK footprint entirely behind one allowed completed FRONT target, integrate existing construction/world occupancy rules; reject wrong layer, partial/multi-target overlap, unknown/missing/incomplete target and corridor conflicts.",
+    "Stable room/target identity with target removal/loss detection; reconstructed different target is not silently the old identity; explicit validated relink only, preserving stopped/no-auto-resume rules.",
+    "Idempotent evidence IDs bound to stable room/target/source event key; replay cannot duplicate or alias another target. Opaque state records only.",
+    "Collection rejects stopped/no-power/closed/under-construction/lost-target cases; do not create undefined natural trigger/rate/staffing eligibility.",
+    "Versioned Runtime snapshot section; genuinely legacy absent section migrates empty; current-schema missing/malformed/unknown/wrong-reference/duplicate data reject atomically with original whole Runtime untouched. Preserve all existing schema migrations and pending references.",
+    "No free production placement, bypassed build costs or arbitrary content-event injection exposed through new commands. Unknown build/upkeep/staff/collection values remain unset and unavailable; backend tests may use clearly labeled controlled fixtures. Normal palette registration and naturally collected production evidence are pending. Define command preconditions precisely; construction costs/definition and recorder eligibility cannot be silently invented.",
+    "Reuse existing guarded native harness logic for a strict narrow runner and add new test marker registrations without weakening prior marker/policy behavior. Do not rerun full regression during implementation."
+  ],
+  "required_local_coverage": [
+    "public_bath and adult_private_room valid geometry; VIP unavailable not substituted",
+    "wrong FRONT, partial/multiple target footprint, incomplete/missing target; corridor/path occupancy conflict/disconnection",
+    "target demolition/loss, rebuild different identity, explicit relink; reject collection after removal",
+    "same event replay one evidence ID; different room/target keys distinct and stable",
+    "stopped/no-power/closed/under-construction collection rejection",
+    "roundtrip exact typed state; legacy absence; current missing/malformed version/references/duplicates atomic unchanged",
+    "Runtime command/removal/save integration; existing construction/world/path/supply-save/transport-save/weather migrations impact coverage"
+  ],
+  "pending_not_invented": [
+    "D04 build/upkeep/build_minutes and related numbers",
+    "recorder role staffing and natural collection trigger/rate D04/D08/P16",
+    "VIP suite P10-01",
+    "D05 unresolved transaction rules; no tick-phase changes",
+    "P19 use of evidence and P24 camera UI",
+    "normal construction/operation/full parent acceptance, final whole review and applicable Windows conditions"
+  ],
+  "workflow": [
+    "Actual Opus commander confirms registered run and model; Runner worker only edits allowed paths.",
+    "Worker static/local preparation only; Root owns serialized native collection in allocation build with private profile and guarded process/cleanup receipts.",
+    "Registered validation reads/verifies complete native evidence, exact current selected source and marker/policy/engine/input/environment binding. Zero exit alone is not acceptance.",
+    "Separate actual Opus review, final exact-version required regression and ordinary integration/final; any backend completion never adds parent original-unit credit."
+  ],
+  "model_proposal": {
+    "codex": "gpt-6.1-sol",
+    "selected_by_actual_opus_run": "e65d48f5a7294378a81bb58dea00c605"
+  }
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/ACTUAL_AGGREGATE_READONLY_VERIFICATION.json

@@ -0,0 +1,18 @@
+{
+  "actual_suites": 184,
+  "missing_marker_paths": [],
+  "remaining_unexecuted_tests": [],
+  "available_marker_checks": 21903,
+  "actual_all_roster_checks": 21903,
+  "strict_accepted_checks": 21903,
+  "verified": true,
+  "composed": true,
+  "original_full_attempt_passed": false,
+  "whole_original_acceptance": false,
+  "parse_checks": 329,
+  "setup_phases": 2,
+  "owned_ended": 186,
+  "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "engines_started": 0,
+  "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/ACTUAL_CONTINUATION_CONTROLS.json

@@ -0,0 +1,73 @@
+{
+  "controller_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a",
+  "harness_sha256": "744177b243fb97ff7ad954880a433acf6a9b879c06d4ee51cfe02ed95be29422",
+  "cases": [
+    {
+      "case": "copytree string arguments create separate byte-exact support files",
+      "expected": "accept",
+      "actual": "accept"
+    },
+    {
+      "case": "exact whole private-profile move and readback",
+      "expected": "accept",
+      "actual": "accept"
+    },
+    {
+      "case": "absent empty startup profile explicitly retained",
+      "expected": "accept",
+      "actual": "accept"
+    },
+    {
+      "case": "reject unowned profile name",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject valid nonce at wrong canonical location",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject changed original profile",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject undeclared profile member",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject profile symlink",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject existing retention destination",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "large profile lossless compression entire readback",
+      "expected": "accept",
+      "actual": "accept"
+    },
+    {
+      "case": "reject compressed bytes changed",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject incomplete compressed member manifest",
+      "expected": "reject",
+      "actual": "reject"
+    },
+    {
+      "case": "reject invalid archive hash",
+      "expected": "reject",
+      "actual": "reject"
+    }
+  ],
+  "passed": true,
+  "native_engines_started": 0
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/ACTUAL_INDEPENDENT_OPUS_REVIEW.json

@@ -0,0 +1,27 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "status": "pass",
+  "summary": "判定: pass。ただし対象は登録済みの限定バックエンド CODE1 のみです。親の P13-02 は完了していないままで、30/88・formal 14/88 の分母にも加算しません。\n\n【実装の照合（仕様のすべての要件・カバレッジ項目と突き合わせ）】\n- 構成: PeepingRoomService を独立サービスとして追加し、Runtime 側の接続は限定的です。\n  - 生成と読み込みのたびに構成し直し、施設登録解除と解体の両方で接続しています。\n  - コマンドは validate / place / relink / record_evidence の4種で、通常の実行キューを通ります。\n- 配置判定: 2x1 の BACK 配置が、許可された完成済み FRONT 対象1つの真裏に完全に収まるかを検査します。\n  - 拒否理由を網羅しています: 層違い、形状違い、範囲外、未掘削、建設中、対象なし、部分重なり、複数対象、対象不一致、不明対象、許可外対象、通路衝突（World の歩行可否と Path の両方で判定）、BACK 占有済み。\n  - vip_suite は PENDING_P10_01 として扱い、vip_private_salon を代用に使わないことを確認しました。\n- 対象の同一性:\n  - 撤去すると TARGET_LOST になり、停止状態に固定されます。\n  - 同じ位置に再建すると別の ID になり、自動で再リンクしません。\n  - 明示的な relink は配置判定をすべてやり直し、停止状態（RELINKED_PENDING_RESUME）のまま残ります。\n  - target_history に過去の対象 ID を残すため、既存の証拠が孤立しません。\n- 証拠 ID: (room, target, source_event_key) を長さ付き UTF-8 の hex で符号化しており、単射です。\n  - 同じイベントの再実行は同一 ID を返し、記録は増えません。\n  - 部屋や対象が違えば ID も別になり、取り違えは起きません。\n- 本番経路の封じ込め:\n  - 本番の記録は RECORDER_ELIGIBILITY_PENDING_D04_D08_P16 で拒否され、台帳を変えません。\n  - place は BUILD_DEFINITION_PENDING_D04 を返すだけです。テストで、ドメインイベントの受領が1件だけ発行され、それ以外の ID とドメインデータが変わらないことを確認しています。\n  - CONTROLLED_FIXTURE 用のメソッドは公開コマンドやパレットから呼べません。\n  - 停止中 / 無電力 / 閉店 / 建設中 / 対象喪失 の各ケースで収集を拒否します。\n- 保存:\n  - Runtime のバージョンは 14 / 15 のままで、format2 は MIMI15 の場合だけです。\n  - 新セクションは任意キーで、空のときは出力しません。セクションのない本物の旧形式セーブは空として移行します。\n  - 現行形式で不正なものは全体をそのまま保ったまま原子的に拒否し、元の Runtime を壊しません。対象は、セクション欠落 / null / バージョン / 未知キー / 重複 / 参照不正 / 時刻 / ID 上限 / 型 / 孤立占有、およびその逆方向の不整合で、テストの18変異ケースと孤立ケースで確認しています。\n  - SaveService は同じ検証器を通したうえで、購入用の許可キー一覧を元のまま維持しています。\n\n【検証証跡】\n- 登録済みの p13-reference 検証は exit 0 で通過しています（narrow 15 スイート / 863 チェック / 構文 329 / 終了 17）。\n- 全体の 184 スイート / 21903 チェックは合成検証です。\n  - 構成: 元の通し実行は ENOSPC で失敗しており、失敗のまま残っています。その前半58スイートを再検証し、後半126スイートを実際に実行した結果を組み合わせたものです。\n  - 結果: 読み取り専用の集計で verified / composed=true（ネイティブ終了 186 件、すべて一意）を、元の通し実行と対象コミットに紐付いた記録で確認しました。\n- 自己申告だけに依拠していません。\n\n【残る後続ゲート】\n- 最終版でのリグレッション、通常の統合と最終確定。\n- D04 / D08 / P16 の数値、記録係の配置、自然な収集トリガー、VIP（P10-01）、P19 / P24、通常のパレット登録、Windows 条件。",
+  "acceptance_ids": [
+    "P13-02-CODE1"
+  ],
+  "findings": [
+    {
+      "severity": "low",
+      "message": "create_snapshot は対象喪失を正規化しません（detect_target_loss は収集時にだけ遅延実行されます）。そのため、シグナルを経ずに対象が消えた場合は LINKED の部屋が残ります。こうして書かれたセーブは restore_section の配置判定で全体が拒否され、読み込めなくなります。現状、そのような経路は確認できませんでした（facility_service.restore_snapshot はシグナルを出さず、ロールバックは既存の対象を消しません）。ただし、スナップショット生成時に正規化するか、後続で防御策を入れることを推奨します。"
+    },
+    {
+      "severity": "low",
+      "message": "Runtime の schema バージョンが 5 未満（v1〜4）の旧形式に special_peeping_rooms があっても拒否されず、検証を通れば受理されます。仕様の「本物の旧形式はセクションなし」に照らすと、偽装された旧ペイロードを受け入れる余地がわずかにあります。中身は restore_section で厳密に検証されるため、実害は小さいと判断します。"
+    },
+    {
+      "severity": "low",
+      "message": "施設の寸法移行（prepare_facility_dimension_snapshot）で public_bath / adult_private_room の占有セルが変わると、LINKED の部屋の再検証に失敗し、移行全体が拒否されます。現在の部屋はテスト用フィクスチャでしか作れないため影響は限定的です。後続の本番配置の実装時に扱いを決める必要があります。"
+    },
+    {
+      "severity": "low",
+      "message": "「建設中なら収集を拒否」の分岐は、本番状態では到達できません。テストは ConstructionService を差し替えて確認しており、意味上の網羅としては人工的です。配置判定も、建物定義（D04）が未定のため construction_service.validate_placement（支持・重量の判定）を使っていません。いずれも仕様の「未定値を発明しない」範囲内として許容しますが、記録に残します。"
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/ACTUAL_SUFFIX_ENDED.json

@@ -0,0 +1,9 @@
+{
+  "passed": true,
+  "error": null,
+  "ended_unix_ns": 1792230973546897000,
+  "controller_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a",
+  "owner_runner_pid": 92258,
+  "original_full_attempt_passed": false,
+  "whole_original_acceptance": false
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/ACTUAL_SUFFIX_INPUT.json

@@ -0,0 +1,80 @@
+{
+  "source": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "original_import_and_parse_passed": 2,
+  "reusable_suites": 58,
+  "raw057_qualified_after_archival_recovery": true,
+  "original_owned_ended_pids": [
+    73903,
+    73987,
+    74026,
+    74052,
+    74079,
+    74092,
+    74125,
+    74151,
+    74171,
+    74194,
+    74212,
+    74236,
+    74256,
+    74284,
+    74327,
+    74632,
+    75319,
+    75331,
+    75368,
+    75392,
+    75429,
+    75453,
+    75466,
+    75555,
+    75577,
+    75603,
+    75619,
+    75654,
+    75687,
+    75932,
+    76254,
+    76409,
+    76434,
+    76455,
+    76480,
+    76487,
+    76566,
+    76851,
+    76898,
+    76931,
+    76945,
+    76973,
+    76989,
+    77012,
+    77035,
+    77087,
+    77108,
+    77120,
+    77143,
+    77158,
+    77179,
+    77206,
+    77240,
+    77253,
+    77277,
+    77297,
+    77325,
+    77340,
+    77364,
+    77382
+  ],
+  "original_checks": 10991,
+  "remaining_suites": 126,
+  "engine_runs": 0,
+  "whole_original_acceptance": false,
+  "original_full_attempt_passed": false,
+  "controller_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a",
+  "free_bytes": 4484616192,
+  "admission_required_bytes": 3467374666,
+  "root_owner_pid": 92258,
+  "run_id": "52bfe67d08e54acd9478d74d5b030293",
+  "started_unix_ns": 1792229968318418000,
+  "original_input_sha256": "24d10b3a91553df54b3b2fd4b1a57dce683cc72a55576e0c73c9e142b335ad40"
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/CURRENT_ACCEPTANCE_STATUS.json

@@ -0,0 +1,115 @@
+{
+  "at_jst": "2026-10-17T19:05:57.762697+09:00",
+  "plan_id": "P13-02",
+  "batch": "P13-02-CODE1",
+  "S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "original_packages": 30,
+  "original_units": 88,
+  "formally_completed": 14,
+  "new_credit": 0,
+  "normal_validation": "passed; exact S narrow15/863/329parse/17nativeended",
+  "actual_full": {
+    "actual_suites": 184,
+    "missing_marker_paths": [],
+    "remaining_unexecuted_tests": [],
+    "available_marker_checks": 21903,
+    "actual_all_roster_checks": 21903,
+    "strict_accepted_checks": 21903,
+    "verified": true,
+    "composed": true,
+    "original_full_attempt_passed": false,
+    "whole_original_acceptance": false,
+    "parse_checks": 329,
+    "setup_phases": 2,
+    "owned_ended": 186,
+    "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "engines_started": 0,
+    "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+  },
+  "formal_review": {
+    "state": "terminal_pass",
+    "run_id": "ead8e74b9683404d8cf3d97bca118726",
+    "model": "claude-opus-5-5",
+    "critical_high_medium": 0,
+    "low": 4,
+    "artifact": "ACTUAL_INDEPENDENT_OPUS_REVIEW.json"
+  },
+  "normal_integration_candidate": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "source_on_main": true,
+  "remaining_conditions": [
+    "Whole original P13-02 normal construction/recorder/natural triggers/approved quantities/VIP/UI/assets/Windows and all original conditions remain unaccepted; CODE1 has no new original-unit credit",
+    "Four low severity future-production defensive/migration/coverage observations retained from actual Opus review; no observed ordinary production path and no critical/high/medium finding",
+    "P04-01 remains next original formal closure when existing D05 owner choices arrive; independent next original-unit selection will be requested from actual Opus"
+  ],
+  "evidence": [
+    {
+      "path": "ACTUAL_AGGREGATE_READONLY_VERIFICATION.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-full-composed-readonly-verification-a7e3069.json",
+      "bytes": 562,
+      "sha256": "3a8be9f92c76d14dc1c9f6d387fad8e939d0d333a6f8d5903b53b8fc44ef584b"
+    },
+    {
+      "path": "ACTUAL_SUFFIX_INPUT.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-full-continuation-a7/controller-input.json",
+      "bytes": 1401,
+      "sha256": "81c3dcfdd092fde977c158482310f164a727a73dabea698e18807eeb585d4937"
+    },
+    {
+      "path": "ACTUAL_SUFFIX_ENDED.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-full-continuation-a7/controller-ended.json",
+      "bytes": 277,
+      "sha256": "b0759724f65175e01822b94ee731b3b9574c5098b82ce931e73e087fc5a89c65"
+    },
+    {
+      "path": "ACTUAL_CONTINUATION_CONTROLS.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-full-continuation-a7/CONTINUATION_STORAGE_CONTROLS.json",
+      "bytes": 1846,
+      "sha256": "96f47033ef95614426cb8646f7a4fbfedcb5af6bd95a0ab1e54a802d3eed77a6"
+    },
+    {
+      "path": "ACTUAL_INDEPENDENT_OPUS_REVIEW.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/ead8e74b9683404d8cf3d97bca118726/result.json",
+      "bytes": 6753,
+      "sha256": "cc12bb1011da2f3a21018da8fdde966a13e70dcf33ef7c83310dcf0ca08f4ec8"
+    },
+    {
+      "path": "FORMAL_VALIDATION.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/6df11a390bc44b48a10c916cbeab95c9-validation.json",
+      "bytes": 380,
+      "sha256": "d9e73b97bb173a75931a0263119ff6430a2049e204ca459fbb53ca04b8aa0e4a"
+    },
+    {
+      "path": "FORMAL_INTEGRATION.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/562e2bb9ca8b4f458d0cc011edd41cc4-integration.json",
+      "bytes": 381,
+      "sha256": "513ab79bd5fadafb929d5ad3201a8e9d5ff0e826eda37a80c831d82327940d8e"
+    },
+    {
+      "path": "FORMAL_FINAL.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/45fdaf3b82c84e1485ad0d4cc7bf993c-final.json",
+      "bytes": 375,
+      "sha256": "213af13d38587ff108802fc96f6c410af6e9bf66ab6bb683963af62d36ecae2f"
+    },
+    {
+      "path": "RUNNER_COMPLETED_TRACEABILITY.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/traceability/P13-02-CODE1.json",
+      "bytes": 3697,
+      "sha256": "c11f2f390bfe3222dc4e955fb001878ba5db03deafd1b85534299da758354250"
+    },
+    {
+      "path": "EXACT_INTEGRATED_FULL_REUSE_QUALIFICATION.json",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/coordinator-start-20261017/EXACT_C65F07B_FULL_REUSE_QUALIFICATION.json",
+      "bytes": 1487,
+      "sha256": "b5c4f52638b34be0c95030486560d1ce8ed83f48e855a2fddfef528e6e635721"
+    }
+  ],
+  "next_formal_original_unit": "P04-01 pending existing real-owner D05 choices; no duplicate request or fabricated approval",
+  "backend_batch_state": "completed",
+  "normal_main_base": "191ea3b4d1289144d8d31096f50fbd71435656c9",
+  "normal_final": {
+    "passed": true,
+    "commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+    "artifact": "FORMAL_FINAL.json"
+  },
+  "whole_original_acceptance": false
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/EXACT_INTEGRATED_FULL_REUSE_QUALIFICATION.json

@@ -0,0 +1,35 @@
+{
+  "S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "C": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "M": "191ea3b4d1289144d8d31096f50fbd71435656c9",
+  "candidate_worktree": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-integration-15cc1271",
+  "whole_selected_source_files": 1368,
+  "all_source_settings_assets_test_inputs_helpers_byte_equal": true,
+  "marker_policy_engine_roster_parse_default_player_equal": true,
+  "full_evidence_reuse_qualified": true,
+  "original_full_attempt_passed": false,
+  "whole_original_acceptance": false,
+  "aggregate": {
+    "actual_suites": 184,
+    "missing_marker_paths": [],
+    "remaining_unexecuted_tests": [],
+    "available_marker_checks": 21903,
+    "actual_all_roster_checks": 21903,
+    "strict_accepted_checks": 21903,
+    "verified": true,
+    "composed": true,
+    "original_full_attempt_passed": false,
+    "whole_original_acceptance": false,
+    "parse_checks": 329,
+    "setup_phases": 2,
+    "owned_ended": 186,
+    "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "engines_started": 0,
+    "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+  },
+  "actual_independent_review": "ead8e74b9683404d8cf3d97bca118726",
+  "critical_high_medium": 0,
+  "low_findings": 4,
+  "ownership_authority": "Existing explicit human main-update and commit/push permission only; no new SHA-specific human speech is claimed",
+  "time_ns": 1792231367426496000
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/FORMAL_FINAL.json

@@ -0,0 +1,14 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "kind": "final",
+  "checks": [
+    {
+      "id": "p13-reference",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/2add11628b67481495b3782fa64dee52",
+      "passed": true
+    }
+  ],
+  "passed": true
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/FORMAL_INTEGRATION.json

@@ -0,0 +1,14 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "kind": "integration",
+  "checks": [
+    {
+      "id": "p13-reference",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/19d3100d61564e3c9878624d2d8ea496",
+      "passed": true
+    }
+  ],
+  "passed": true
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/FORMAL_VALIDATION.json

@@ -0,0 +1,14 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "kind": "validation",
+  "checks": [
+    {
+      "id": "p13-reference",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/339d1c3cc94648aa94b00a750a5fa5ce",
+      "passed": true
+    }
+  ],
+  "passed": true
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/LOW_SEVERITY_FOLLOWUPS.json

@@ -0,0 +1,22 @@
+{
+  "source_review": "ead8e74b9683404d8cf3d97bca118726",
+  "scope": "Future normal production unlock and dimension-migration defensive handling; no mandatory CODE1 gate remains, parent P13-02 incomplete",
+  "findings": [
+    {
+      "severity": "low",
+      "message": "create_snapshot は対象喪失を正規化しません（detect_target_loss は収集時にだけ遅延実行されます）。そのため、シグナルを経ずに対象が消えた場合は LINKED の部屋が残ります。こうして書かれたセーブは restore_section の配置判定で全体が拒否され、読み込めなくなります。現状、そのような経路は確認できませんでした（facility_service.restore_snapshot はシグナルを出さず、ロールバックは既存の対象を消しません）。ただし、スナップショット生成時に正規化するか、後続で防御策を入れることを推奨します。"
+    },
+    {
+      "severity": "low",
+      "message": "Runtime の schema バージョンが 5 未満（v1〜4）の旧形式に special_peeping_rooms があっても拒否されず、検証を通れば受理されます。仕様の「本物の旧形式はセクションなし」に照らすと、偽装された旧ペイロードを受け入れる余地がわずかにあります。中身は restore_section で厳密に検証されるため、実害は小さいと判断します。"
+    },
+    {
+      "severity": "low",
+      "message": "施設の寸法移行（prepare_facility_dimension_snapshot）で public_bath / adult_private_room の占有セルが変わると、LINKED の部屋の再検証に失敗し、移行全体が拒否されます。現在の部屋はテスト用フィクスチャでしか作れないため影響は限定的です。後続の本番配置の実装時に扱いを決める必要があります。"
+    },
+    {
+      "severity": "low",
+      "message": "「建設中なら収集を拒否」の分岐は、本番状態では到達できません。テストは ConstructionService を差し替えて確認しており、意味上の網羅としては人工的です。配置判定も、建物定義（D04）が未定のため construction_service.validate_placement（支持・重量の判定）を使っていません。いずれも仕様の「未定値を発明しない」範囲内として許容しますが、記録に残します。"
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/RUNNER_COMPLETED_TRACEABILITY.json

@@ -0,0 +1,88 @@
+{
+  "contract": {
+    "id": "P13-02-CODE1",
+    "title": "P13-02 背面対象参照・占有・保存の非描写機構（全原成果の一部、加算なし）",
+    "requirement_ids": [
+      "P13-02"
+    ],
+    "acceptance_ids": [
+      "P13-02-CODE1"
+    ],
+    "spec_ref": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+    "base_commit": "1e8d4ea88876865a72547ff0edf43ed5b0e74c7e",
+    "worker": "codex",
+    "allowed_paths": [
+      "scripts/special/peeping_room_service.gd",
+      "autoload/simulation_runtime.gd",
+      "scripts/core/save_service.gd",
+      "tests/special/**",
+      "tools/run_p13_reference_tests.py",
+      "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json",
+      "docs/plans/original-completion-2026-10-02/execution/p13-02/**"
+    ],
+    "depends_on": [],
+    "resource_locks": [
+      "runtime-save-schema",
+      "special-target-reference",
+      "p13-reference-tests"
+    ],
+    "validation_ids": [
+      "p13-reference"
+    ],
+    "max_repair_attempts": null,
+    "spec_sha256": "8ea65f2eefedc772c08170186f5cd03ac017432f4b069ade4f9210d4215c2d43"
+  },
+  "implementation_commit": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "integration_commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "owner": "このチャットのユーザーによる既存の明示指示「mainの更新を明示的に許可します」「コミットすべき内容をコミットして。その上でpushして」に基づく継続許可。対象は全条件レビュー合格の登録CODE1と、この実C/M。新たなSHA指定の人間発言は主張しない。原P13-02の完了加算なし。",
+  "evidence": [
+    {
+      "id": 1,
+      "task_id": "P13-02-CODE1",
+      "kind": "validation",
+      "commit_sha": "e930a1dedff7ab4c4a94d274a2e0c55fc2b95829",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/212e4352722a442990b6fe923abe8f84-validation.json",
+      "passed": 0
+    },
+    {
+      "id": 2,
+      "task_id": "P13-02-CODE1",
+      "kind": "validation",
+      "commit_sha": "27fc5f05442ca3a2b0986a976b303cf0ef675f66",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/5526523400ff41b6aeacd0d6f8ffd9b9-validation.json",
+      "passed": 0
+    },
+    {
+      "id": 3,
+      "task_id": "P13-02-CODE1",
+      "kind": "validation",
+      "commit_sha": "a7e3069b167511b3194242b3403fbcc35244a526",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/6df11a390bc44b48a10c916cbeab95c9-validation.json",
+      "passed": 1
+    },
+    {
+      "id": 4,
+      "task_id": "P13-02-CODE1",
+      "kind": "review",
+      "commit_sha": "a7e3069b167511b3194242b3403fbcc35244a526",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/ead8e74b9683404d8cf3d97bca118726/result.json",
+      "passed": 1
+    },
+    {
+      "id": 5,
+      "task_id": "P13-02-CODE1",
+      "kind": "integration",
+      "commit_sha": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/562e2bb9ca8b4f458d0cc011edd41cc4-integration.json",
+      "passed": 1
+    },
+    {
+      "id": 6,
+      "task_id": "P13-02-CODE1",
+      "kind": "final",
+      "commit_sha": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/45fdaf3b82c84e1485ad0d4cc7bf993c-final.json",
+      "passed": 1
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-local-20261017/ACTUAL_RETAINED_UIDS.json

@@ -0,0 +1,209 @@
+{
+  "scripts/special/peeping_room_service.gd.uid": {
+    "owner": "scripts/special/peeping_room_service.gd",
+    "owner_sha256": "4dc02bc99f081d63a2518f69c960397d778d577b93d87d57bcac29bc6f108531",
+    "file_type": "regular",
+    "bytes": 20,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      98,
+      105,
+      51,
+      54,
+      102,
+      118,
+      112,
+      49,
+      106,
+      105,
+      105,
+      105,
+      118,
+      10
+    ],
+    "sha256": "3f045afc3c140886c70ec8494d6dcb012e6da645e8a3ff3c6488442ce63a9353",
+    "text": "uid://bi36fvp1jiiiv\n"
+  },
+  "tests/special/peeping_room_fixture.gd.uid": {
+    "owner": "tests/special/peeping_room_fixture.gd",
+    "owner_sha256": "0243b1d35e1fdd8aa085894a0ce1e5cd1a189e5c98fcb859f81b70ae75b98bed",
+    "file_type": "regular",
+    "bytes": 20,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      98,
+      48,
+      99,
+      51,
+      111,
+      117,
+      117,
+      113,
+      52,
+      50,
+      121,
+      99,
+      103,
+      10
+    ],
+    "sha256": "a74e5ef6d8959826919a648e8b5d82e96d1c73ff22cd6c1f216be8b5c4060a8a",
+    "text": "uid://b0c3ouuq42ycg\n"
+  },
+  "tests/special/test_peeping_room_evidence.gd.uid": {
+    "owner": "tests/special/test_peeping_room_evidence.gd",
+    "owner_sha256": "390e0032d14de9a8875ced163a922341ce655744200d78b4ffa776d42c4f8c2a",
+    "file_type": "regular",
+    "bytes": 20,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      100,
+      102,
+      116,
+      115,
+      107,
+      121,
+      49,
+      51,
+      112,
+      101,
+      48,
+      117,
+      106,
+      10
+    ],
+    "sha256": "26bbc1435bcda963b5866327b887096f798b1629c7984768c85bfb6175648ec5",
+    "text": "uid://dftsky13pe0uj\n"
+  },
+  "tests/special/test_peeping_room_geometry.gd.uid": {
+    "owner": "tests/special/test_peeping_room_geometry.gd",
+    "owner_sha256": "103d85f83e1e97a8637892504264275eef23f172eeec56c94e5c022d81bf6945",
+    "file_type": "regular",
+    "bytes": 19,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      52,
+      114,
+      52,
+      48,
+      102,
+      49,
+      107,
+      112,
+      106,
+      109,
+      118,
+      106,
+      10
+    ],
+    "sha256": "391b78806bc0bf759f00c778cb25dfaa97d47f6e309c3b302412c38123c5440c",
+    "text": "uid://4r40f1kpjmvj\n"
+  },
+  "tests/special/test_peeping_room_reference.gd.uid": {
+    "owner": "tests/special/test_peeping_room_reference.gd",
+    "owner_sha256": "188b00a60f7aefda69dc4973f1de9c14447a0d4bcdd1257a2eabe7c4782e4caf",
+    "file_type": "regular",
+    "bytes": 20,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      99,
+      110,
+      110,
+      111,
+      110,
+      53,
+      119,
+      111,
+      117,
+      102,
+      117,
+      114,
+      112,
+      10
+    ],
+    "sha256": "db8bfa98b7943dba15858ccaa6681bc430efd43f40f57de99117dc19c51ac417",
+    "text": "uid://cnnon5woufurp\n"
+  },
+  "tests/special/test_peeping_room_runtime.gd.uid": {
+    "owner": "tests/special/test_peeping_room_runtime.gd",
+    "owner_sha256": "924efd34414c12a325a1b700f799aef0396de9f15441fd88a3608292ff221657",
+    "file_type": "regular",
+    "bytes": 19,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      52,
+      110,
+      53,
+      119,
+      101,
+      108,
+      113,
+      102,
+      104,
+      100,
+      113,
+      103,
+      10
+    ],
+    "sha256": "b742bb8e4077f111e0f7b4d9039261a06fe6deaad8ea308ba3b89c7b5a4a9069",
+    "text": "uid://4n5welqfhdqg\n"
+  },
+  "tests/special/test_peeping_room_save.gd.uid": {
+    "owner": "tests/special/test_peeping_room_save.gd",
+    "owner_sha256": "ba0e7644277477c1821135cae6d6fd533651799c6f9bd8c43ccf45e63b96c63c",
+    "file_type": "regular",
+    "bytes": 19,
+    "raw_bytes": [
+      117,
+      105,
+      100,
+      58,
+      47,
+      47,
+      56,
+      117,
+      121,
+      116,
+      109,
+      112,
+      106,
+      117,
+      112,
+      56,
+      113,
+      52,
+      10
+    ],
+    "sha256": "005561b37df9051e618d4714b2a91a82f4a48ec63c841cdf27c251bcd2865505",
+    "text": "uid://8uytmpjup8q4\n"
+  }
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-local-20261017/ACTUAL_STATIC_UID_CONTROLS.json

@@ -0,0 +1,13 @@
+{
+  "S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "argv": [
+    "/Users/korizatou114/Antigravity/\u74b0\u5883\u69cb\u7bc9/agent-control/.venv/bin/python",
+    "-B",
+    "tests/special/test_p13_uid_policy.py"
+  ],
+  "started_unix_ns": 1792225317277353000,
+  "ended_unix_ns": 1792225317417668000,
+  "exit_code": 0,
+  "stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "stderr_sha256": "c8904f75939074499eaa0d8a5add9f1fd5007a4e4e5e75cc9b1ce324d8f4b69c"
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-local-20261017/ACTUAL_STATIC_UID_STDERR.log

@@ -0,0 +1,5 @@
+.......
+----------------------------------------------------------------------
+Ran 7 tests in 0.053s
+
+OK

docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-local-20261017/CURRENT_ACCEPTANCE_STATUS.json

@@ -0,0 +1,88 @@
+{
+  "at_jst": "2026-10-17T17:28:02.473746+09:00",
+  "plan_id": "P13-02",
+  "batch": "P13-02-CODE1",
+  "original_packages": 30,
+  "original_units": 88,
+  "formally_completed": 14,
+  "new_credit": 0,
+  "S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "source_backup_branch": "codex/p13-02-reference",
+  "source_on_main": false,
+  "normal_integration_candidate": null,
+  "runner_state_after_registered_validation": "review_pending",
+  "repairs": 4,
+  "max_repairs": null,
+  "implementation_models": "Astra selected by Opus for coupled save schema; Sol selected by Opus for UID policy and exact queue-event oracle corrections",
+  "actual_narrow": {
+    "suites": 15,
+    "checks": 863,
+    "parse_files": 329,
+    "phases": 17,
+    "actual_PIDs": [
+      63523,
+      63619,
+      63653,
+      63684,
+      63709,
+      63723,
+      63751,
+      63773,
+      63789,
+      63815,
+      63830,
+      63854,
+      63870,
+      63896,
+      63919,
+      63933,
+      63993
+    ],
+    "passed": true,
+    "all_owned_engines_ended": true,
+    "guard_errors": [],
+    "cleanup_errors": [],
+    "finite_UID_set": 7,
+    "game_body_changed_by_latest_fix": false
+  },
+  "test_oracle_correction": "Direct rejected placement full typed Runtime unchanged; queued placement keeps world/economy/room/non-event IDs unchanged and verifies exactly1 COMMAND_FAILED domain-event ID/cause receipt. No blanket normalization or event suppression.",
+  "current_next_gate": "Full standard regression with finite native UID metadata extension must preserve all standard generated-report/audio/diagnostic/process/profile/source/marker gates; actual Opus plan requested before collection, formal independent review then ordinary integration/final remain.",
+  "whole_original_unit": "not accepted; pending ordinary construction/recorder/natural collection triggers/approved values/VIP/UI/content/Windows and all P13 conditions unchanged",
+  "P04_priority": "Next formal closure P04-01, existing D05 questions pending, no repeated questions or fake approval",
+  "previous_failures_retained": [
+    "p13-reference-native-e930a1d-import-failed",
+    "p13-reference-native-uid-corrected-27fc5f0-runtime-failed"
+  ],
+  "evidence": [
+    {
+      "path": "ACTUAL_NATIVE_ENDED.json",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native-uid-corrected/runner-ended.json",
+      "bytes": 469751,
+      "sha256": "4694cc13c0e0c309adf1f5c3c3885fc2d54efa8dc8ec63319ce016e48d2d66a5"
+    },
+    {
+      "path": "ACTUAL_NATIVE_INPUT.json",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native-uid-corrected/runner-input.json",
+      "bytes": 320481,
+      "sha256": "c899b3463fdc8925a98f5dd288eea5cca1d41b3591bc17d29394ec90da0b1094"
+    },
+    {
+      "path": "ACTUAL_RETAINED_UIDS.json",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native-uid-corrected/accepted-uids.json",
+      "bytes": 4198,
+      "sha256": "6a6987d53b93387aaa0f8cae268c96eb4bf326fa4599eea4e837af00384e3c38"
+    },
+    {
+      "path": "ACTUAL_STATIC_UID_CONTROLS.json",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/audit-support/p13-root-native-a7e3069/static-uid-controls.json",
+      "bytes": 493,
+      "sha256": "d9f4acac3e7f0ed869ece76bc5ef3e9dbe96314e893f1d7a2081a39d97b66053"
+    },
+    {
+      "path": "ACTUAL_STATIC_UID_STDERR.log",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/audit-support/p13-root-native-a7e3069/static-uid-controls.stderr.log",
+      "bytes": 105,
+      "sha256": "c8904f75939074499eaa0d8a5add9f1fd5007a4e4e5e75cc9b1ce324d8f4b69c"
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-e930a1d-native-import-20261017/ACTUAL_IMPORT_RECEIPT.json

@@ -0,0 +1,252 @@
+{
+  "phase": "import",
+  "test": null,
+  "passed": false,
+  "failed": true,
+  "validation_error": null,
+  "profile_startup_name": "TheTree-PCK-tests-974717b708984f0d81f24d8164fe7bc3-standard-startup-import",
+  "private_project_sha256": "f825875e910e090ce57fc0527f34b55386a77123c1784d6916718113139a3673",
+  "private_project_fields": 2,
+  "source_sha256": null,
+  "command": [
+    "/Applications/Godot.app/Contents/MacOS/Godot",
+    "--headless",
+    "--path",
+    "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage",
+    "--editor",
+    "--import",
+    "--quit",
+    "--verbose",
+    "--log-file",
+    "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+  ],
+  "logical_script": null,
+  "starter_sha256": null,
+  "controlled_environment": {},
+  "native_process": {
+    "argv": [
+      "/Applications/Godot.app/Contents/MacOS/Godot",
+      "--headless",
+      "--path",
+      "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage",
+      "--editor",
+      "--import",
+      "--quit",
+      "--verbose",
+      "--log-file",
+      "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+    ],
+    "pid": 55035,
+    "started_utc": "2026-10-17T08:05:39.153436+00:00",
+    "ended_utc": "2026-10-17T08:05:54.328314+00:00",
+    "wall_seconds": 15.174453041981906,
+    "exit_code": 0,
+    "helper_exit_code": 0,
+    "timed_out": false,
+    "stdout_sha256": "a7044e250290690749e344039a98595963550e89777a727da0532dd975c95778",
+    "stderr_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "error_lines": [],
+    "owned_popen_ended": true,
+    "old_helper_engine_ended": true,
+    "start_receipt_written": true,
+    "end_receipt_written": true,
+    "lifecycle_error": null,
+    "old_helper_lifecycle_error": null,
+    "actual_start_binding": {
+      "scope": "isolated diagnostic owned child",
+      "event": "ENGINE_STARTED",
+      "actual_pid": 55035,
+      "owner_pid": 53623,
+      "command": [
+        "/Applications/Godot.app/Contents/MacOS/Godot",
+        "--headless",
+        "--path",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage",
+        "--editor",
+        "--import",
+        "--quit",
+        "--verbose",
+        "--log-file",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+      ],
+      "monotonic_ns": 2836045348628125,
+      "pid": 55035,
+      "argv": [
+        "/Applications/Godot.app/Contents/MacOS/Godot",
+        "--headless",
+        "--path",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage",
+        "--editor",
+        "--import",
+        "--quit",
+        "--verbose",
+        "--log-file",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+      ],
+      "started_utc": "2026-10-17T08:05:39.153436+00:00",
+      "current_process_identity": {
+        "pid": 55035,
+        "ppid": 53623,
+        "pgid": 55035,
+        "args": "/Applications/Godot.app/Contents/MacOS/Godot --headless --path /Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage --editor --import --quit --verbose --log-file /Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+      },
+      "live_identity_exact": true,
+      "tracked_child_ended_before_initial_probe": false,
+      "signal_scope": "tracked Popen child only; no external group signal"
+    },
+    "actual_end_binding": {
+      "scope": "isolated diagnostic owned child",
+      "event": "ENGINE_ENDED",
+      "actual_pid": 55035,
+      "owner_pid": 53623,
+      "command": [
+        "/Applications/Godot.app/Contents/MacOS/Godot",
+        "--headless",
+        "--path",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage",
+        "--editor",
+        "--import",
+        "--quit",
+        "--verbose",
+        "--log-file",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+      ],
+      "monotonic_ns": 2836060496050750,
+      "exit_code": 0,
+      "actual_process_exit_code": 0,
+      "engine_ended": true,
+      "timed_out": false,
+      "lifecycle_error": null,
+      "start_receipt_written": true,
+      "pid": 55035,
+      "argv": [
+        "/Applications/Godot.app/Contents/MacOS/Godot",
+        "--headless",
+        "--path",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/stage",
+        "--editor",
+        "--import",
+        "--quit",
+        "--verbose",
+        "--log-file",
+        "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log"
+      ],
+      "ended_utc": "2026-10-17T08:05:54.320361+00:00",
+      "signal_scope": "tracked Popen child only; no external group signal"
+    },
+    "strict_native_diagnostics": {
+      "errors": [],
+      "banner_count": 1,
+      "known_unicode_diagnostic_count": 0,
+      "unrecognized_unicode_diagnostic_count": 0,
+      "exit_leak_diagnostic_lines": []
+    },
+    "external_process_or_group_signals": 0,
+    "owned_child_process_helper_sha256": "c007e712c281573254faa1233c2ac92e100ab87393256a6dc096b35283e43037",
+    "adapter_owned_cleanup": {
+      "owned_child_created": true,
+      "engine_ended": true,
+      "actual_process_exit_code": 0,
+      "attempts": [
+        {
+          "attempt": 1,
+          "kill_attempted": false,
+          "wait_timeout_seconds": 5,
+          "wait_completed": true,
+          "errors": [],
+          "poll_before": 0,
+          "wait_returned_code": 0,
+          "poll_after": 0
+        }
+      ],
+      "errors": []
+    },
+    "adapter_error": null,
+    "old_helper_bytes_preserved": true,
+    "helper_wait_None_maps_to_actual_timeout_seconds": 5,
+    "explicit_helper_wait_timeouts_preserved": true,
+    "additional_cleanup_wait_timeout_seconds": 5,
+    "additional_cleanup_max_attempts": 3
+  },
+  "outer_actual_capture": {
+    "actual_captured_pids": [
+      55035
+    ],
+    "cleanup": [
+      {
+        "pid": 55035,
+        "cleanup": {
+          "owned_child_created": true,
+          "engine_ended": true,
+          "actual_process_exit_code": 0,
+          "attempts": [
+            {
+              "attempt": 1,
+              "kill_attempted": false,
+              "wait_timeout_seconds": 5,
+              "wait_completed": true,
+              "errors": [],
+              "poll_before": 0,
+              "wait_returned_code": 0,
+              "poll_after": 0
+            }
+          ],
+          "errors": []
+        },
+        "outer_cleanup_errors": [],
+        "engine_ended": true,
+        "outer_maximum_helper_invocations": 3,
+        "helper_maximum_waits": 3,
+        "per_wait_timeout_seconds": 5,
+        "foreign_process_or_group_signals": 0
+      }
+    ],
+    "adapter_exception": null,
+    "all_captured_ended": true,
+    "outer_cleanup_errors": [],
+    "foreign_process_or_group_signals": 0,
+    "all_cleanup_before_outer_receipt": true,
+    "outer_receipt_written": true,
+    "outer_receipt_error": null,
+    "passed": true
+  },
+  "actual_pid": 55035,
+  "engine_ended": true,
+  "exit_code": 0,
+  "log": "import/combined-raw.log",
+  "log_sha256": "a7044e250290690749e344039a98595963550e89777a727da0532dd975c95778",
+  "raw_native_log": {
+    "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import/engine-native.log",
+    "bytes": 119669,
+    "sha256": "9e66d1295be17e1bfa9052e78e06e7cf9bfee7fe5624ea97226529209404b8ed"
+  },
+  "finite_original_diagnostic_review": {
+    "verified": true,
+    "original_NUL_fixture_contract_applied": false,
+    "producer_source_sha256": null,
+    "actual_transport_counts": {
+      "stdout": 0,
+      "stderr": 0,
+      "native_file": 0
+    },
+    "actual_complete_diagnostic_sequences": {
+      "stdout": [],
+      "stderr": [],
+      "native_file": []
+    },
+    "unknown_or_error_or_leak_lines": {
+      "stdout": [],
+      "stderr": [],
+      "native_file": []
+    },
+    "raw_lines_deleted_or_rewritten": 0,
+    "contract_sha256": "22fd41c59eb13e0af397984bed418870c55fa8942524c377490a90a2aca8dedd",
+    "allowed_e31_error_lines": []
+  },
+  "whole_startup_profile_after": {
+    "path": "/Users/korizatou114/Library/Application Support/TheTree-PCK-tests-974717b708984f0d81f24d8164fe7bc3-standard-startup-import",
+    "files": {},
+    "fresh_before_engine": true
+  },
+  "guard_error": "AssertionError: complete source/UID/generated report set"
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-e930a1d-native-import-20261017/ACTUAL_WORKER_RESULT.json

@@ -0,0 +1,10 @@
+{
+  "task_id": "P13-02-CODE1",
+  "commit": "1e8d4ea88876865a72547ff0edf43ed5b0e74c7e",
+  "status": "submitted",
+  "summary": "許可範囲内で非描写サービス、Runtime・保存連携、5試験、専用検証スクリプト、マーカー・説明書を追加。Python構文とマーカーSHA整合を確認。エンジン・試験・Runner操作・git書込みは未実施。正式検証と独立レビュー待ちで、P13受入への加算はありません。",
+  "acceptance_ids": [
+    "P13-02-CODE1"
+  ],
+  "findings": []
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-e930a1d-native-import-20261017/CURRENT_ACCEPTANCE_STATUS.json

@@ -0,0 +1,85 @@
+{
+  "at_jst": "2026-10-17T17:09:16.053627+09:00",
+  "plan_id": "P13-02",
+  "batch": "P13-02-CODE1",
+  "original_packages": 30,
+  "original_units": 88,
+  "formally_completed": 14,
+  "new_credit": 0,
+  "source_submitted": "e930a1dedff7ab4c4a94d274a2e0c55fc2b95829",
+  "source_backup_branch": "codex/p13-02-reference-e930a1d",
+  "normal_integration_candidate": null,
+  "source_on_main": false,
+  "worker_model": "gpt-6-astra",
+  "model_selection": "actual Opus19f00667 after examining coupled14/15 save paths; earlier Sol was proposal only",
+  "repairs_before_current_correction": 2,
+  "max_repairs": null,
+  "worker_run": "b3af838ff79b4f3fafe7b68040a89079",
+  "worker_terminal": "submitted",
+  "source_change_summary": "12 files/1015 additions, service plus bounded Runtime/save/5suite/harness wiring; no mandatory numbers or normal palette invented",
+  "native": {
+    "import_actual_pid": 55035,
+    "engine_ended": true,
+    "exit_code": 0,
+    "diagnostic_errors": 0,
+    "accepted": false,
+    "guard_failure": "exactly7 native-generated UID sidecars undeclared in complete source/UID/generated set",
+    "suite_count": 0,
+    "all15_suites_unexecuted": true,
+    "all329_parse_unexecuted": true,
+    "default_player_changed": false,
+    "cleanup_errors": []
+  },
+  "next": "actual Opus decision for precise UID artifact handling; do not waive source/UID/process/profile guard or rerun full regression now",
+  "P04_priority": "Next original unit to close remains P04-01; owner D05 answers pending, this batch is independent work",
+  "required_remaining": [
+    "UID correction then exact narrow/impact verification with strict raw evidence",
+    "separate actual Opus independent code/evidence review",
+    "required final exact-source full regression, normal integration/final and ledger update for backend batch",
+    "whole original P13-02 normal build/production/content/roles/approved D04/D05/D08 values/VIP/UI/Windows and all original conditions remain unaccepted"
+  ],
+  "manifest": [
+    {
+      "path": "ACTUAL_OPUS_MODEL_AND_BRIEF.json",
+      "original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/19f00667226d42dd8e9b3a4ae99aaa68/result.json",
+      "sha256": "1afa4b721f45c10cabeb10830db1c8b064d29c55000c3c6fbf5802ec0474c533",
+      "bytes": 11457
+    },
+    {
+      "path": "ACTUAL_WORKER_RESULT.json",
+      "original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p13-02-reference/runs/b3af838ff79b4f3fafe7b68040a89079/result.json",
+      "sha256": "e38129543ab8796c51b6f1c56fba7417a6f7efe8d4cff338d1a0b074bbf23dd1",
+      "bytes": 538
+    },
+    {
+      "path": "ACTUAL_IMPORT_RECEIPT.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/import-receipt.json",
+      "sha256": "cfa6b72b59f8df394eb22adfe1e73babbca31fb0c2a9caed9190dcc80b52d8f1",
+      "bytes": 9333
+    },
+    {
+      "path": "ACTUAL_NATIVE_ENDED.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/runner-ended.json",
+      "sha256": "9f13934d7844e4ceba72e87a7c5dc88e7e2ebdea5de1c556c5f19d90092917c3",
+      "bytes": 167969
+    },
+    {
+      "path": "ACTUAL_NATIVE_INPUT.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-reference-native/runner-input.json",
+      "sha256": "6018a3d83835317a46aee69188d5f3ca0e01977212e36b030a751894cb3284dc",
+      "bytes": 320355
+    },
+    {
+      "path": "ROOT_REVIEW_CHECKLIST.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/coordinator-start-20261017/ROOT_REVIEW_CHECKLIST.json",
+      "sha256": "32079bede7a4da3defabbdc4fca7eaf96a03ffc12344cfd7631c2d5c5e22e7c7",
+      "bytes": 1440
+    },
+    {
+      "path": "EXACT_FAILURE_FACTS.json",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-implement/build/owner-handoff/native-import-failure/ROOT_EXACT_FAILURE_FACTS.json",
+      "sha256": "a7c906d0df05003be005e8d7160ae8c104dbdb00388bd57b87696f1dd425de86",
+      "bytes": 1782
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-e930a1d-native-import-20261017/EXACT_FAILURE_FACTS.json

@@ -0,0 +1,54 @@
+{
+  "S": "e930a1dedff7ab4c4a94d274a2e0c55fc2b95829",
+  "actual_engine_pid": 55035,
+  "exit_code": 0,
+  "owned_engine_ended": true,
+  "diagnostic_errors": 0,
+  "actual_suites": 0,
+  "new_stage_files": [
+    {
+      "path": "tests/special/peeping_room_fixture.gd.uid",
+      "sha256": "a74e5ef6d8959826919a648e8b5d82e96d1c73ff22cd6c1f216be8b5c4060a8a",
+      "bytes": 20,
+      "text": "uid://b0c3ouuq42ycg\n"
+    },
+    {
+      "path": "tests/special/test_peeping_room_runtime.gd.uid",
+      "sha256": "f7276000bd3b4c3429c72612f791ca2ed6bb04dde1de8e278cb1a055ae4ce743",
+      "bytes": 20,
+      "text": "uid://dkc1kiqioypih\n"
+    },
+    {
+      "path": "tests/special/test_peeping_room_save.gd.uid",
+      "sha256": "005561b37df9051e618d4714b2a91a82f4a48ec63c841cdf27c251bcd2865505",
+      "bytes": 19,
+      "text": "uid://8uytmpjup8q4\n"
+    },
+    {
+      "path": "tests/special/test_peeping_room_geometry.gd.uid",
+      "sha256": "391b78806bc0bf759f00c778cb25dfaa97d47f6e309c3b302412c38123c5440c",
+      "bytes": 19,
+      "text": "uid://4r40f1kpjmvj\n"
+    },
+    {
+      "path": "tests/special/test_peeping_room_evidence.gd.uid",
+      "sha256": "26bbc1435bcda963b5866327b887096f798b1629c7984768c85bfb6175648ec5",
+      "bytes": 20,
+      "text": "uid://dftsky13pe0uj\n"
+    },
+    {
+      "path": "tests/special/test_peeping_room_reference.gd.uid",
+      "sha256": "db8bfa98b7943dba15858ccaa6681bc430efd43f40f57de99117dc19c51ac417",
+      "bytes": 20,
+      "text": "uid://cnnon5woufurp\n"
+    },
+    {
+      "path": "scripts/special/peeping_room_service.gd.uid",
+      "sha256": "3f045afc3c140886c70ec8494d6dcb012e6da645e8a3ff3c6488442ce63a9353",
+      "bytes": 20,
+      "text": "uid://bi36fvp1jiiiv\n"
+    }
+  ],
+  "guards_not_waived": true,
+  "whole_acceptance": false
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-e930a1d-native-import-20261017/ROOT_REVIEW_CHECKLIST.json

@@ -0,0 +1,13 @@
+{
+  "scope": "Root-derived review checklist within the immutable original P13-02 state/reference/save conditions. Not extra product rules, test results, or implementation directions.",
+  "created_unix_ns": 1792223589246621000,
+  "checks": [
+    "Retain prior evidence identities/history after target loss and explicit relink; a new target does not turn old evidence into a different event or silently discard it. Check roundtrip after this combined history.",
+    "Relink may ignore only the same room own occupancy, never another room or corridor conflict. A rebuilt different facility ID cannot silently revive the link.",
+    "Ordinary production commands cannot reach CONTROLLED_FIXTURE entry points or bypass missing build/recorder approvals; rejection leaves whole typed Runtime unchanged.",
+    "Optional section absence is valid only for truly empty state; orphan world occupancy or owned IDs cannot be accepted by dropping the section. Other existing exact schema key allowlists remain strict.",
+    "Failed section restore or later-system failure restores original whole Runtime including clock, ID generator, commands, facilities, ledger and new service references; var_to_bytes evidence, no JSON normalization.",
+    "Source/marker/policy/engine/input/environment identities and actual owned process endings cover the final tested version; local test numbers never substitute whole-unit acceptance."
+  ],
+  "formal_credit": 0
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/057-ARCHIVAL-RECOVERY.json

@@ -0,0 +1,29 @@
+{
+  "archive_sha256": "f962d3622f5da562c3c07c4afed84bf4f1042a2470f555c16148d450e70453ff",
+  "drive_archive_id": "1F6MYrZ7begmlNaZkjMOlJT5y9uMcSVwM",
+  "drive_restore_kit_id": "1eT98KWt71v62IGhxyBSjmf4FEoTvFMxA",
+  "views": [
+    {
+      "original": "/Users/korizatou114/Library/Application Support/TheTree-PCK-tests-cb0e908014ed4be48b1cc74787337f66-standard-runtime-057",
+      "files": 2792,
+      "logical_bytes": 1839108706,
+      "verified_all_bytes_before_retirement": true,
+      "restore_view": "original",
+      "absent_after": true
+    },
+    {
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/P13-02-CODE1/build/p13-full-controller/run/profiles/057/runtime",
+      "files": 1535,
+      "logical_bytes": 861302992,
+      "verified_all_bytes_before_retirement": true,
+      "restore_view": "failed-copy",
+      "absent_after": true
+    }
+  ],
+  "free_before": 894099456,
+  "free_after": 2749599744,
+  "time_ns": 1792229099545221000,
+  "original_full_attempt_passed": false,
+  "receipt_bytes_unmodified": true,
+  "actual_free_gain_bytes": 1855500288
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/CLOSED_P13_READONLY_RETIREMENT.json

@@ -0,0 +1,28 @@
+{
+  "removed": [
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-final-b0291970",
+      "head": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "git_files": 4919,
+      "byte_equal_review_duplicate_files": 0
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-integration-15cc1271",
+      "head": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "git_files": 4919,
+      "byte_equal_review_duplicate_files": 0
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/P13-02-CODE1-review-e6fc1237",
+      "head": "a7e3069b167511b3194242b3403fbcc35244a526",
+      "git_files": 4894,
+      "byte_equal_review_duplicate_files": 16049
+    }
+  ],
+  "full_restore_proof": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/coordinator-start-20261017/CLOSED_P13_READONLY_FULL_RESTORE_PROOF.json",
+  "free_before": 3651289088,
+  "free_after": 4381392896,
+  "all_unique_evidence_preserved": true,
+  "time_ns": 1792232004526885000,
+  "actual_free_gain": 730103808
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/CURRENT_RESOURCE_AND_ACCEPTANCE_STATUS.json

@@ -0,0 +1,77 @@
+{
+  "at_jst": "2026-10-17T18:34:28.900674+09:00",
+  "plan_id": "P13-02",
+  "batch": "P13-02-CODE1",
+  "S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "original_packages": 30,
+  "original_units": 88,
+  "formally_completed": 14,
+  "new_credit": 0,
+  "original_full_attempt_passed": false,
+  "failure": "ENOSPC while copying ended native5374check P08 migration runtime profile; incomplete original runner-ended preserved",
+  "causal_measurements": {
+    "single_runtime_profile_files": 2792,
+    "single_runtime_logical_bytes": 1839108706,
+    "partial_duplicate_whole_files": 1534,
+    "partial_duplicate_zero_byte_fragment": 1
+  },
+  "recovery": "Exact full archive plus original partial-copy view and fragment retained; every member SHA verified locally, remote complete archives fetched and streamed SHA verified before retiring only verified uncompressed profiles. No test log or acceptance data erased.",
+  "archives": [
+    {
+      "drive_id": "1F6MYrZ7begmlNaZkjMOlJT5y9uMcSVwM",
+      "url": "https://drive.google.com/file/d/1F6MYrZ7begmlNaZkjMOlJT5y9uMcSVwM/view",
+      "purpose": "current057 full profile"
+    },
+    {
+      "drive_id": "1eT98KWt71v62IGhxyBSjmf4FEoTvFMxA",
+      "url": "https://drive.google.com/file/d/1eT98KWt71v62IGhxyBSjmf4FEoTvFMxA/view",
+      "purpose": "current057 restore kit with exact original and failed-copy views"
+    },
+    {
+      "drive_id": "1_HFt31YEAs6ak7Z2BiX9xOCQJkYBjovE",
+      "url": "https://drive.google.com/file/d/1_HFt31YEAs6ak7Z2BiX9xOCQJkYBjovE/view",
+      "purpose": "previous ended P23 full179 runtime profile, full restore metadata embedded"
+    },
+    {
+      "drive_id": "1tR_3rlst7AshVskaVxG6JFvQxF5OP5ow",
+      "url": "https://drive.google.com/file/d/1tR_3rlst7AshVskaVxG6JFvQxF5OP5ow/view",
+      "purpose": "older ended P08 phase profile, full restore metadata embedded; failed whole attempt remains failed"
+    }
+  ],
+  "proof_records": {
+    "DRIVE_FULL_ARCHIVE_READBACK.json": {
+      "bytes": 221,
+      "sha256": "36a59d70bb6b67b20c89a26bc5bc1bae3e16f1e4cdc34faf8690cb8d47f4ea55",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/storage-profile-recovery-20261017/DRIVE_FULL_ARCHIVE_READBACK.json"
+    },
+    "DRIVE_RESTORE_KIT_READBACK.json": {
+      "bytes": 219,
+      "sha256": "29119b49b58bdaed54b672bab4629fd17f56c33b5cb6961ce2061f222a0897e3",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/storage-profile-recovery-20261017/DRIVE_RESTORE_KIT_READBACK.json"
+    },
+    "057-ARCHIVAL-RECOVERY.json": {
+      "bytes": 1110,
+      "sha256": "220aa68ceb8195b1ac3358118b4ea652750cafc4a421b9f277026ccfadb76722",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/storage-profile-recovery-20261017/057-ARCHIVAL-RECOVERY.json"
+    },
+    "PREVIOUS_P23_PROFILE057_DRIVE_AND_RETIREMENT.json": {
+      "bytes": 785,
+      "sha256": "6633575fcf6cba529d72c3fc652fffc082128114e20cdf9f0fd0a223ff5d9c8e",
+      "original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/storage-profile-recovery-20261017/PREVIOUS_P23_PROFILE057_DRIVE_AND_RETIREMENT.json"
+    }
+  },
+  "current_free_bytes": 4153327616,
+  "next_full_scope": "Import and329parse plus original58 suites qualified; remaining126 require unchanged native per-phase gates, exact input equality, all cross-segment checks, separate actual Opus review, normal integration/final. No restart of accepted native phases.",
+  "admission_required_bytes": 3467374666,
+  "P04_next_formal_unit": "P04-01 pending actual owner D05 choices, no fake approval",
+  "whole_original_acceptance": false,
+  "later_archival_result": "Additional1.838GB logical old profile preserved remotely with full readback SHA. Immediate measured free gain153612288B; logical size is not claimed as physical space recovered.",
+  "subsequent_verified_copy_retirements": {
+    "P13_ended3_copies_actual_gain_bytes": 730103808,
+    "P04_ended9_validation_copies_actual_gain_bytes": 1304444928,
+    "P04_preserved_remote_source": "codex/p04-01-preserved-2dde759",
+    "all_tracked_blobs_verified": true,
+    "all_unique_central_native_review_evidence_retained": true
+  },
+  "last_capacity_observation_jst": "2026-10-17T19:39:39.105864+09:00"
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/DRIVE_FULL_ARCHIVE_READBACK.json

@@ -0,0 +1,7 @@
+{
+  "drive_id": "1F6MYrZ7begmlNaZkjMOlJT5y9uMcSVwM",
+  "bytes": 97976496,
+  "sha256": "f962d3622f5da562c3c07c4afed84bf4f1042a2470f555c16148d450e70453ff",
+  "full_remote_readback": true,
+  "time_ns": 1792229035052351000
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/DRIVE_RESTORE_KIT_READBACK.json

@@ -0,0 +1,7 @@
+{
+  "drive_id": "1eT98KWt71v62IGhxyBSjmf4FEoTvFMxA",
+  "bytes": 216139,
+  "sha256": "8517b61a253141a76e3bde5bab81f3971ca91989b37b2c89e95a5ee42c010cda",
+  "full_remote_readback": true,
+  "time_ns": 1792229078775515000
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/ENDED_P04_VALIDATION_CHECKOUT_RETIREMENT.json

@@ -0,0 +1,65 @@
+{
+  "at_unix_ns": 1792232721652518000,
+  "removed": [
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-3ca36075",
+      "head": "d393e4d90f068faa82fde40ca1ecd411ff7f2c1f",
+      "files": 3022,
+      "logical_bytes": 137851869
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-998f2af8",
+      "head": "55f1fb49aaefa5c1b86de1c3eda72392ef6b58f2",
+      "files": 3025,
+      "logical_bytes": 137889196
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-a2c2024a",
+      "head": "7af6fafaf00cffbb731f6a4765e5891457c51bda",
+      "files": 3024,
+      "logical_bytes": 137863410
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-b191eb70",
+      "head": "8418560aaf2f0f9ed3977ca477b5601ffebcbbda",
+      "files": 3021,
+      "logical_bytes": 137848317
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-b85d6800",
+      "head": "b543c26c95a1d634b8d7efdf127cc55eba55611a",
+      "files": 3013,
+      "logical_bytes": 137734675
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-e0a2d54f",
+      "head": "4ab7ab8712cc3b3d8bb0514ebb4b2c0927456443",
+      "files": 3025,
+      "logical_bytes": 137887158
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-e0f78b8f",
+      "head": "fb8b7919dbecba9a9de2a28dc2a25ce5cd73e9c6",
+      "files": 3027,
+      "logical_bytes": 137898418
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-e61af951",
+      "head": "2dde7596a87c43f7bf0bf704b7479f2fa06a5b1c",
+      "files": 3031,
+      "logical_bytes": 138115695
+    },
+    {
+      "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-validation-f79a151b",
+      "head": "16207d353ae4a2bb180793325cba9aec9ef68d66",
+      "files": 3015,
+      "logical_bytes": 137746167
+    }
+  ],
+  "free_before_bytes": 3734835200,
+  "free_after_bytes": 5039280128,
+  "observed_gain_bytes": 1304444928,
+  "all_source_blobs_verified": true,
+  "all_unique_runtime_evidence_preserved": true,
+  "restore_manifest": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/coordinator-storage-20261017/ENDED_VALIDATION_CHECKOUT_FULL_GIT_RESTORE_PROOF.json"
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/OLDER_P08_PROFILE057_DRIVE_AND_RETIREMENT.json

@@ -0,0 +1,18 @@
+{
+  "drive_id": "1tR_3rlst7AshVskaVxG6JFvQxF5OP5ow",
+  "remote_bytes": 98084260,
+  "remote_sha256": "79879544b1351706d96e072f77a5b893aced99204c3c8fa83c216279b2cef011",
+  "full_remote_readback": true,
+  "all_original_bytes_verified_before_retirement": true,
+  "original": "/Users/korizatou114/Library/Application Support/TheTree-PCK-tests-4c87cfdfbfff41fd85a9686027d4b109-standard-runtime-057",
+  "files": 2792,
+  "archive": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/storage-profile-recovery-20261017/p08-older-ended-profile057-lossless.tar.gz",
+  "archive_contains_full_manifest": true,
+  "original_full_attempt_passed": false,
+  "phase_passed_and_ended": true,
+  "time_ns": 1792230632135468000,
+  "free_before": 3985821696,
+  "original_absent": true,
+  "free_after": 4139433984,
+  "actual_free_gain": 153612288
+}

docs/plans/original-completion-2026-10-02/execution/p13-02/root-full-resource-recovery-20261017/PREVIOUS_P23_PROFILE057_DRIVE_AND_RETIREMENT.json

@@ -0,0 +1,16 @@
+{
+  "drive_id": "1_HFt31YEAs6ak7Z2BiX9xOCQJkYBjovE",
+  "remote_bytes": 98141942,
+  "remote_sha256": "0cdfb0eb3dc7b5bced24f209bd024436db5450926dae74885d658bcdcf407ed5",
+  "full_remote_readback": true,
+  "all_original_bytes_verified_before_retirement": true,
+  "original": "/Users/korizatou114/Library/Application Support/TheTree-PCK-tests-4572ef90efe94bc59f24b8e3d80452d0-standard-runtime-057",
+  "files": 2792,
+  "archive": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p13-02-reference/.runtime/storage-profile-recovery-20261017/p23-previous-full179-profile057-lossless.tar.gz",
+  "archive_contains_full_manifest": true,
+  "time_ns": 1792229606376983000,
+  "free_before": 2652545024,
+  "original_absent": true,
+  "free_after": 4500942848,
+  "actual_free_gain": 1848397824
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/IMPLEMENTATION_REPORT.md

@@ -0,0 +1,125 @@
+# P19-03 実装提出報告
+
+提出状態。受入は未確定。原受入「7名×3ルートの到達表があり、未制作内容は欠損として残る。」を維持する。14/88は変更しない。
+
+## 変更範囲
+
+Repair 1開始点e0420d57a381a1644357f0590536e1d47c9bca9fから、このディレクトリの指定5ファイルのみを変更した。原本、原子要件、work packages、decisions、TASK_SPEC、選定記録、frozen pins、ゲーム入力、marker registryは変更していない。git書込み、他worker起動、Runner操作、ゲーム起動は行っていない。素材追加なし。
+
+## 要件と検査の対応
+
+|TASK_SPEC implementation_requirements順|成果物|検査|
+|---|---|---|
+|1: 原7名×3ルート|REACHABILITY_TABLE.json / .md|expectedのPEOPLE/ROUTES、原本118–124行、atomic entityと21セルの完全一致。test_exact_cell_product|
+|2: 8カテゴリ、共通/人物固有の分離|JSON common_rules / cells.categories|CATEGORIES全件のcanonical比較。test_categories_and_citations|
+|3: 原本本文・行・status・anchorのsource SHA・owner|JSONの各共通項目/人物固有項目、catalog_evidence|expected.evidence/cite、verify。test_stale_record_evidence / test_owner_and_status|
+|4: 欠損、理由、担当、未知値pending|各character_specific、pending、natural_route_complete=false|test_no_invented_values_or_completion。D05/D08は未回答のまま|
+|5: docs内stdlibチェッカー/自己試験|check_reachability_table.py / test_reachability_table.py|stdlib importsのみ。選択対象外のdocs内配置|
+|6: read-only --check、厳密な表/Markdown|verify / verify_records / markdown|test_json_and_types / test_markdown_drift。--checkは書込み分岐を通らない|
+|7: 全frozen source mapと各identity|binding / selection|1368選択ファイルの完全map、marker/policy/engine、184-suite roster、329 .gd、baseline、spec→pins SHA。test_full_frozen_map_and_identities / test_real_source_and_baseline_changes|
+|8: UI/Runtime/save/Windowsの適用性|JSON route_support、MDルート別適用性|各ルートをcanonical比較。汎用UIラベル、原本登録Runtime、専用snapshotの限定証拠をcommon_rulesで参照|
+|9: 有意な負例と3種の正例|test_reachability_table.py|欠落/重複/誤人物/誤route/カテゴリ/引用/古い本文・SHA/値創作/誤完成/owner・status/JSON型/Markdown、実ファイル読込差替え、map差分とpins/marker/policy/engine改変。全3statusを含む正例|
+|10: P13パターン・原文保全|checkerのexpected/verify/markdown、原資料のbase blob照合|tools/check_p13_content_difference.pyのcanonical生成・厳密比較・read-only Git blob証拠パターンを参照。元ファイルは無変更|
+|11: 報告・残課題・外部gate|本報告、JSON accounting|正式試験・全単位独立レビュー・統合/finalは未実行と明記|
+
+原子要件はB-7.1〜B-7.6をsource_group_idsに含む61件の完全レコードを読込対象とし、JSON authority_snapshotsに保持する。人物キーと原名はそのentityから確認し、原本§6の順で並べた。原本§6は114–135行、§7は136–161行であり、実際の見出しと本文を照合した。人物別の原本仕様がない部分を共通ルールから創作していない。中断/保存の人物固有手順は原本に定義されず、work_packagesのP19-02受入が所有する欠損として残した。
+
+指定されたoriginal_relationship_state.gdには7名のrosterはなく、汎用subject_id等の明示入力検証のみがある。既存unique catalogのヒロインはheroine_anriのみ。監査IDには既存atomic entity.key（anri/fine/tomari/amelia/liz/mimi/satsuki）を使い、他6名の実装catalog ID、ライバル対応、初期値を創作していない。この実装欠損は表の欠損であり、原7名を削減する理由にしていない。
+
+## Repair 1: 4指摘の対応
+
+編集前に build/owner-handoff/p19-review-r01/ の ACTUAL_OPUS_REPAIR_DIRECTION.json、ACTUAL_WHOLE_UNIT_REVIEW.json、SPEC_HASH_REPRESENTATIONS.json を読んだ。
+
+- MEDIUM: coassignment_attack / zero_break / love_actions / threshold_route_loss と旧UIのlegacy_evidenceを追加。固定anchorの実際の本文・行・Git blob OID・file-bytes SHA-256を保持する。原本準拠statusはmissing、旧実装分類はlegacy_not_originalに統一。P18-01は一対一変換を禁止し、旧数値・日次制限は原本として未承認と明記した。UI定数は実際には98–101行であり、89–97行の無関係なラベルを除いた。共通ルール参照により各該当セルへ結び付けた。所有者・原本欠損・natural_route_complete=falseを維持。
+- LOW 独立試験: validate_legacyは候補とcanonicalの比較とは独立に、git showで固定anchorのソースを読み、引用行本文とgit rev-parseによるblob OID、現ファイルとの一致を検査する。test_independent_legacy_source_evidenceは実際のJSONと実ファイルを開き、git hash-object --stdin（書込みなし）でOIDを独立計算し、関数名とshield_broken/EXCLUSIVE_LOCKEDも確認。test_legacy_evidence_required_independentlyは対象全項目の証拠削除・空配列・無条件not implemented・古いOID/本文を拒否する。
+- LOW 中断参照: 全21セルのinterruption_cancellationに原本148・153行の本文とbaseline hash、および343–355行のconfirm_route_lockをlegacy_not_originalとして追加。人物固有欠損と担当は維持。
+- LOW ハッシュ表示: 263a01b943d8056727335fb76977c010298e1c229077f8da76e48683ba2e89bb は TASK_SPEC.json file-bytes SHA-256。3af3d9b931edc5449796662ad69bb6f67c80b48827a86565b1952931db68dd15 は Runner git-show stripped-UTF-8 contract spec_sha256。上記SPEC_HASH_REPRESENTATIONS.jsonのunchanged_file=trueが証拠であり、両者は同じ無変更ファイルを表す。checker定数と出力にも区別を反映。Git blob OIDは別のgit_blob_oidフィールドでありfile-bytes SHA-256とは区別する。
+
+## Repair 1の実行記録（過去のローカル確認）
+
+以下は正式Runner実行ではない。記録済み修復指示に基づき3登録コマンドをローカル実行した。
+
+生成 — exit 0
+
+```sh
+python3 -B /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement --write
+```
+
+p19-table — exit 0
+
+```sh
+python3 -B /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement --check
+```
+
+p19-negative — exit 0
+
+```sh
+python3 -B /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement/docs/plans/original-completion-2026-10-02/execution/p19-03/test_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement
+```
+
+p19-source-binding — exit 0
+
+```sh
+python3 -B /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement --source-binding-only
+```
+
+--writeの実際の呼出しは同一checkout内で相対スクリプトパスと --project-root . を使用（上記は絶対パス表記）。--checkはMarkdownのバイト完全一致を確認。自己試験は12件OK。source bindingは1368ファイル一致、file_equality=true、actual_commit=e0420d57a381a1644357f0590536e1d47c9bca9f、native_evidence_reuse_accepted=false。git diff --checkはexit 0。構文は上記Python実行で確認。最初の編集用here-documentは一時ファイル作成制限でexit 1、変更は行われず、python3 -cで再実行してexit 0。native full・ゲーム起動・git書込み・Runner操作・他エージェント起動は行っていない。
+
+## 残る親成果・ゲームの欠損
+
+- P18-01: 原本3軸/盾の通常UI、承認済み初期値、本来の全単位受入。P18-02/03: 同配置・軽減・ブレイク・接触・閾値・確定遷移。既存旧汎用モデルの閾値を原本へ転用しない。
+- P19-01/02: 原本行動と全3種決闘、勝敗・費用・盾/履歴の一度だけ反映、通常入口、停止/取消/離脱/保存再開。原本状態保持のbackendを自然ルート完成としない。
+- P20-01/02/03: スキル/章・全エンド・図鑑と新規からの通常到達。P26-01/02/03: 人物別必要内容、状態接続、完成資産と制作受入。人物固有イベント/条件/履歴/立ち絵差分は欠損。
+- D05、D08はpending。未知の閾値・率・初期値もpendingのまま。P04の既存D05選択、P13の4件の制作followupも未解決。
+- この文書単位のnative GUI/Windows実行は適用外。global same-Windows、held gestures、全ゲーム受入はopen。固定入力一致から既存native証拠の正式再利用承認を推定していない。
+- Runnerの3 validator、原本§6–7と元受入に対する実装者から独立したwhole-unit Opus review、その後の通常prepare-integration/finalが必要。どの完了数・元台帳も変更していない。
+
+
+## Repair 2: BASE定義projectionと台帳更新の分離
+
+開始点Sは806de25068bc423136063791afcea811d251ee1b。編集前にACTUAL_OPUS_REPAIR2_DIRECTION.jsonとACTUAL_FAILED_INTEGRATION.json、immutable TASK_SPECと既存チェッカーを確認。最新run指示に従い、実マージ候補の作成・検証は実装担当では行わない。指定5ファイルのみを変更する。Repair 1の4修正を保持し、任意の低3指摘は延期したまま。
+
+### 実差分とallowlistの根拠
+
+git showによるBASE 8ca9263とmain 6e17caeのkey-level比較を行った。candidate 1875b03のwork_packages.jsonは6e17caeと完全一致。差分は次だけ（配列index 19=P19、remaining_deliverables index 2=P19-03）:
+
+|JSON path|差分|
+|---|---|
+|/19/current_summary|変更|
+|/19/updated_at_jst|変更|
+|/19/remaining_deliverables/2/current_execution|TASK_SPEC.jsonからROOT_CURRENT_ACCEPTANCE_STATUS.jsonへの参照更新|
+|/19/remaining_deliverables/2/current_summary|変更|
+|/19/remaining_deliverables/2/progress_summary|変更|
+|/19/remaining_deliverables/2/remaining_gaps/0, /1|通常integration/final待ちの進捗説明へ更新|
+|/19/remaining_deliverables/2/evidence|1件から2件|
+|/19/remaining_deliverables/2/submitted_commit|806de25068bc423136063791afcea811d251ee1bを追加|
+|/19/remaining_deliverables/2/updated_at_jst|変更|
+
+package allowlistはstate / legacy_state / current_summary / updated_at_jst。unit allowlistはstate / current_execution / remaining_gaps / updated_at_jst / submitted_commit / current_summary / progress_summary / evidence。state系は通常進捗遷移として明示的に許可し、同じ実registerに既存のキーだけを採用した。通常finalの完了時刻・source-ref用に、BASEの他unitで既に使われるcompleted_at_jst（P13-03）、implementation_commit（P13-03）、integrated_commit（P13-02）、integration_commit（P13-03）、normal_integration_candidate（P04-01）だけをunit階層で追加許可した。キーのprefixや任意のtimestamp/source_refキーは許可しない。allowlistの値は進捗メタデータとしてprojectionから全体を除外する。
+
+それ以外の全キーは未知キーを含め再帰的な値・型・有無を保ち、BASE projectionと比較する。30 package / 88 unitのID・順序・件数、全title/work/acceptance、phase/parent/depends_on/requirement_ids/decisions/supplement_ids/owner_roles/state_scope等を固定する。atomic_requirements.jsonとdecisions.jsonは実main差分なしのため引き続きbyte-exact。D05/D08のstatus/answerは変更不可。selection recordもbyte-exact。
+
+所有者集合・原子要件・authority_snapshotsはBASE blobのみから読む。各snapshotはanchored_base_commit、BASE blobのsha256、projected recordsを保持する。work packagesは全30/88定義を保持し、進捗を除外した。表の21セル、共通ルール・引用・status・owner・欠損・pending/null値は変更していない。Markdownには固定参照の説明だけを追加した。--writeは1回実行、--checkは読込み専用。
+
+### Repair 2 ローカル実行
+
+cwdとproject-rootは /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement。
+以下は正式Runner試験ではない。実際の呼出しは各scriptをdocs/plans/original-completion-2026-10-02/execution/p19-03/配下の相対パスで指定し、--project-rootには上記実絶対パスを指定した。
+
+- python3 -B docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement --write: exit 0。
+- p19-table: python3 -B docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement --check: exit 0。
+- p19-source-binding: python3 -B docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement --source-binding-only: exit 0。
+
+上記3呼出しのstdoutはaudit_integrity=pass、formal_acceptance=pending_runner_and_independent_review、actual_commit=806de25068bc423136063791afcea811d251ee1b、selected_files=1368、anchor=1b07b87d3736e777932315a4bdde8b70cbf9cb23、file_equality=true、native_evidence_reuse_accepted=false。spec file-bytesとRunner contractの両hashも従来値のまま。
+
+実mainおよび失敗candidateの実blobをPath.read_bytes差替えで読ませる自己試験は、生成JSONとMarkdownのbyte完全一致を検証する。実registerの書換え・一時worktree・mergeは不要。合成完了/source-ref例も同じ検査を通す。各定義フィールドの変更・削除、package/unit objectの未知キー追加、package/unit/各定義listの件数/順序変更、D05/D08承認、atomic/decisions/selectionの変更を個別subtestで拒否する。既存12テストは維持。
+
+実merged-candidate確認: **Root preflight pending**。新S提出と通常validation後、Rootが最新main上の実Sについてラベル付き非正式isolated preflightで同じ3チェッカーを実行する。その後に別Opus whole-original re-review、通常prepare-integration/finalが必要。今回のローカル成功やworker exit 0は受入ではない。正式進捗14/88は維持。native GUI/Windowsは本単位に適用外、global Windowsとゲーム受入はopen。
+
+自己試験の探索版2回は全recordや深い履歴データの同型フィールドまで反復走査して時間がかかったため中断（各exit 130、KeyboardInterrupt）。package/unitの異なる定義キーごとに変更・削除を検査し、ネストした定義値は全体を比較する形へ整理した。BASE blobを一度実読込して負例ループ内で再利用し、各負例ごとのgit show起動を省いた。検査対象・既存controlは削除していない。shell here-documentを用いた初回の読取り差分確認は環境の一時ファイル制約で失敗（exit 1）、python3 -cで同じ確認を実行した。
+
+最終p19-negative呼出し: python3 -B docs/plans/original-completion-2026-10-02/execution/p19-03/test_reachability_table.py --project-root /Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-implement
+
+exit 0、出力: Ran 16 tests in 16.285s / OK。実main/candidate正例、合成final正例、全package/unit定義フィールド負例と既存controlを含む。git diff --checkもexit 0。最終差分は指定5ファイルのみ。生成前後のJSONを比較しauthority_snapshots以外の全フィールドが一致することも静的確認した。
+
+同じp19-tableコマンドを絶対scriptパスで再確認（exit 0、同じpass出力）。呼出し前後にこのディレクトリの全通常ファイルSHA-256 mapを比較し一致: Read-only byte determinism: pass。最終git diff --checkもexit 0。

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_ACTUAL_NONFORMAL_MAIN_PREFLIGHT_903A2C5.json

@@ -0,0 +1,18 @@
+{
+  "purpose": "Nonformal Root diagnostic actual S+latestMain; not usual prepare-integration candidate, not owner-approved, no original credit",
+  "S": "903a2c566e73cebc874a6499410a1243bc190a63",
+  "M": "6e17cae5c9f0133fc3eb19e58572977f4151de7c",
+  "preflight_commit": "7f9b63b0c281d57be4abec1c576e5abef273ca78",
+  "preflight_tree": "5fd36ac7825980524f7d14137434a7866dd114ac",
+  "source": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-root-preflight-5343471e",
+  "root_pid": 49701,
+  "time_ns": 1792235765159907000,
+  "normal_integration_or_final_satisfied": false,
+  "passed": true,
+  "all3_original_checks_passed": true,
+  "actual_report": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/66089140e92a48b2bc96ea67ca597b58-root-preflight.json",
+  "time_end_ns": 1792235786176952000,
+  "new_native_runs": 0,
+  "whole_original_acceptance": false,
+  "task_state_unchanged": "review_pending"
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_CURRENT_ACCEPTANCE_STATUS.json

@@ -0,0 +1,127 @@
+{
+  "at_jst": "2026-10-17T20:29:39.555420+09:00",
+  "plan_id": "P19-03",
+  "registered_task": "P19-03-TABLE",
+  "project": "the-tree-p19-03-reachability",
+  "S": "903a2c566e73cebc874a6499410a1243bc190a63",
+  "implementation_model": "gpt-6.1-sol",
+  "actual_model_decision": "c767de1cd89d40e5a23964f2e62ce4c6",
+  "state": "completed_original_P19_03",
+  "original_acceptance": "7名×3ルートの到達表があり、未制作内容は欠損として残る。",
+  "original_units": 88,
+  "formally_completed": 15,
+  "new_credit": 1,
+  "registered_validation": {
+    "passed": true,
+    "artifact": "ROOT_FORMAL_VALIDATION_903A2C5.json",
+    "checks": [
+      "p19-table",
+      "p19-negative",
+      "p19-source-binding"
+    ],
+    "self_tests": 16
+  },
+  "actual_reviewer": {
+    "id": "565d4f21c12b451da2d5a7dd462d099b",
+    "status": "finished_pass"
+  },
+  "reviewer_model": "claude-opus-5-5",
+  "full_game_input_equality": {
+    "files": 1368,
+    "markers_policy_engine_roster_parse_default_player_same": true,
+    "full184_21903_329parse_186ended_reuse_qualified": true,
+    "new_native_runs": 0,
+    "artifact": "ROOT_EXACT_GAME_INPUT_REUSE_903A2C5.json"
+  },
+  "required_before_acceptance": [],
+  "source_gaps_preserved": [
+    "Six missing productioncatalog IDs are not fabricated; table audit uses existing original atomic entity keys",
+    "D05/D08 and unknown values/content remain missing or pending; backend/generic labels are not natural route completion",
+    "Global Windows/game/content conditions stay open; this audit adds no product OS behavior"
+  ],
+  "execution_issues_preserved": [
+    "Initial registered {worktree} invocation failed before scripts opened; exact-root adapter madeactual3sameSchecks run, repairs0/source/config/policy unchanged",
+    "Initial full inline review rejected beforeinference at actual1milliontoken providerlimit; completefile/diff sourceviews retainalloriginalbytes, no file/bytecaps, sameOpus5.5/sourceS"
+  ],
+  "normal_integration_candidate": "8e4f1d92fc2a2e8f1dd187e661cf52b13e4e51d4",
+  "repairs": 2,
+  "repair_cap": null,
+  "whole_original_review": {
+    "run_id": "565d4f21c12b451da2d5a7dd462d099b",
+    "status": "pass",
+    "critical_high_medium": 0,
+    "low": 3,
+    "artifact": "ROOT_WHOLE_REVIEW_903A2C5.json"
+  },
+  "actual_repair_worker": {
+    "id": "bf8a86e053044bfea0051253fefb2ec7",
+    "status": "finished"
+  },
+  "repair_scope": "Same5Docfiles: legacy presence vsoriginalconformance for4clauses, independent source-presence/evidence-loss tests, route-ending interruption crossrefs, precise hash labels. No game/values/pins/roster changes.",
+  "actual_preflight": {
+    "passed": true,
+    "source": "903a2c566e73cebc874a6499410a1243bc190a63",
+    "preflight_commit": "7f9b63b0c281d57be4abec1c576e5abef273ca78",
+    "main": "6e17cae5c9f0133fc3eb19e58572977f4151de7c",
+    "normal_integration_or_final_satisfied": false,
+    "artifact": "ROOT_ACTUAL_NONFORMAL_MAIN_PREFLIGHT_903A2C5.json"
+  },
+  "previous_actual_integration_failure": {
+    "commit": "1875b032b7f6a8525fb6ccec0574e21769943c95",
+    "reason": "Checker incorrectly froze mutable workpackages metadata; now definition projection remainsfailclosed, originalfactsunchanged",
+    "artifact": "ROOT_FAILED_FORMAL_INTEGRATION_806DE25.json"
+  },
+  "table_fact_comparison": {
+    "only_changed": "authority_snapshots representation",
+    "all21cells_rules_statuses_owners_gaps_unchanged": true,
+    "artifact": "ROOT_TABLE_FACT_COMPARISON_806_TO_903.json"
+  },
+  "registered_task_state": "completed",
+  "normal_main_base": "e7acd530c5d43313534d0b6ee23c915aba3cf70a",
+  "source_on_main": true,
+  "normal_final": {
+    "passed": true,
+    "commit": "8e4f1d92fc2a2e8f1dd187e661cf52b13e4e51d4",
+    "artifact": "ROOT_NORMAL_FINAL_C8E4F1D9.json"
+  },
+  "whole_original_P19_03_accepted": true,
+  "whole_game_accepted": false,
+  "related_open_work": [
+    "P18/P19-01/P19-02/P20/P26 natural gameplay, all7character-specific content and6productioncatalogIDs",
+    "D05/D08 and unapproved initial/threshold/rate values remain unanswered or missing",
+    "SameWindows/globalgame acceptance and heldgestures stillopen; docaudit OSexecution notapplicable"
+  ],
+  "normal_final_pending": false,
+  "closure_evidence": [
+    {
+      "path": "ROOT_WHOLE_REVIEW_903A2C5.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/565d4f21c12b451da2d5a7dd462d099b/result.json",
+      "bytes": 5470,
+      "sha256": "779e58c3d31556ea25ae3fe134dccc0335a8ab14dd675ea80f97c51768223550"
+    },
+    {
+      "path": "ROOT_NORMAL_INTEGRATION_C8E4F1D9.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/83e6d08d9ac245d6b35941ac165d3318-integration.json",
+      "bytes": 854,
+      "sha256": "aa6148bc06f9ab9f9ef28364d8511b6beca4a5d4a4b6d1299f7d769bb9b44f78"
+    },
+    {
+      "path": "ROOT_NORMAL_FINAL_C8E4F1D9.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/213aafebe6254110bf349c25b6036d92-final.json",
+      "bytes": 848,
+      "sha256": "4c5ec540ff0b527d37454b16cb392b14aff1ae598c445722d9625b30b91d8ea6"
+    },
+    {
+      "path": "ROOT_RUNNER_COMPLETED_TRACEABILITY.json",
+      "actual_original": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/traceability/P19-03-TABLE.json",
+      "bytes": 5090,
+      "sha256": "b433a6b52bb722fa8e9cdc2a161abbca71693f45926bb5c7bf1b00716d3d7f5a"
+    },
+    {
+      "path": "ROOT_EXACT_C8E4F1D9_QUALIFICATION.json",
+      "actual_original": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/.runtime/coordinator-start-20261017/EXACT_C8E4F1D9_P19_QUALIFICATION.json",
+      "bytes": 2584,
+      "sha256": "f15125c39a2cf2b42618dfbd9c9a9834f5c32c6b8f256b245de80a7b460ebcc0"
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_DEFERRED_LOW_NOTES_806DE25.json

@@ -0,0 +1,18 @@
+{
+  "actual_review": "38eaaacdb31b4c76bcf982987816a391",
+  "findings": [
+    {
+      "severity": "low",
+      "message": "Most data-level negative tests still compare the document against the same expected() canonical. The independent semantic checks name only three markers: restore_shield, shield_broken and EXCLUSIVE_LOCKED. Citations such as the preview service's contact/shield-candidate lines, and the 6850, 1039 and 1047 call sites, are checked only for text and blob equality, not for a function-name marker. Consider asserting a marker for every legacy entry."
+    },
+    {
+      "severity": "low",
+      "message": "The run log in IMPLEMENTATION_REPORT.md reports source binding actual_commit=e0420d5. That comes from the pre-commit local run. The Runner output correctly binds 806de25, but the report should mark that line as the pre-submission local value."
+    },
+    {
+      "severity": "low",
+      "message": "The snapshot_container evidence range (relationship_service.gd 423–479) starts mid-function and cuts off inside restore_snapshot. It is accurate as evidence, but a range aligned to function boundaries would be clearer for downstream owners (P18-01, P19-02)."
+    }
+  ],
+  "disposition": "Low severity optional hardening/clarity notes, not original audit blockers. Formal Runner output pins806de25; worker report e0420d5 is a pre-submission local-run HEAD, not the final accepted version."
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_DEFERRED_LOW_NOTES_903A2C5.json

@@ -0,0 +1,25 @@
+{
+  "actual_review": "565d4f21c12b451da2d5a7dd462d099b",
+  "findings": [
+    {
+      "severity": "low",
+      "message": "test_actual_main_and_candidate_metadata names commits by abbreviated SHA (6e17cae, 1875b03). The test only works where those objects exist. That holds in the current repository, but full SHAs, or a clear explanation of the dependency, would make it more reproducible."
+    },
+    {
+      "severity": "low",
+      "message": "Three low notes from the previous review (806de25) are still deferred: (1) per-entry function-name markers for every legacy citation, (2) the label on the Repair 1 local actual_commit line, (3) aligning the snapshot_container range to function boundaries. This deferral is allowed. Item (2) is already addressed by the 「過去のローカル確認」 label."
+    },
+    {
+      "severity": "low",
+      "message": "Most data-level negative tests still compare the document against the same expected() canonical. The checker's hardcoded facts (statuses, owners) are therefore protected from tampering by self-comparison, not proven correct by the tests. I separately confirmed in the actual source and work_packages that the classifications and owners are correct."
+    }
+  ],
+  "disposition": "Optional nonblocking hardening/clarity only. All required original audit conditions passed independent semantic review and normal integration/final.",
+  "preserved_reproduction_fixture": {
+    "full_commit": "1875b032b7f6a8525fb6ccec0574e21769943c95",
+    "remote_branch": "codex/p19-03-integration-fixture-1875b03",
+    "fetch_if_single_branch_clone": "git fetch origin refs/heads/codex/p19-03-integration-fixture-1875b03:refs/remotes/origin/codex/p19-03-integration-fixture-1875b03",
+    "other_required_commit": "6e17cae5c9f0133fc3eb19e58572977f4151de7c",
+    "no_main_adoption_of_failed_fixture": true
+  }
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_EXACT_C8E4F1D9_QUALIFICATION.json

@@ -0,0 +1,51 @@
+{
+  "S": "903a2c566e73cebc874a6499410a1243bc190a63",
+  "C": "8e4f1d92fc2a2e8f1dd187e661cf52b13e4e51d4",
+  "M": "e7acd530c5d43313534d0b6ee23c915aba3cf70a",
+  "candidate_worktree": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p19-03-reachability/P19-03-TABLE-integration-69419f96",
+  "all1368_game_inputs_marker_policy_engine_roster_parse_default_player_identical": true,
+  "all8_reviewed_doc_artifacts_byte_identical": {
+    "docs/plans/original-completion-2026-10-02/execution/p19-03/ACTUAL_OPUS_NEXT_ORIGINAL_UNIT_SELECTION.json": {
+      "bytes": 5614,
+      "sha256": "c3c8d7367d67c6f8b74ae620357de631f8e4a158940c4d019f71e897900a1c29"
+    },
+    "docs/plans/original-completion-2026-10-02/execution/p19-03/FROZEN_GAME_INPUT_PINS.json": {
+      "bytes": 234047,
+      "sha256": "6c778226a4cc6d0b0d682500759e7d4229c926a27bd2e247b00b9c3e5f1a2fb0"
+    },
+    "docs/plans/original-completion-2026-10-02/execution/p19-03/IMPLEMENTATION_REPORT.md": {
+      "bytes": 16909,
+      "sha256": "07ec5fd2a50c328ac01859807913315023e4e8b550f11457fc8345b4606573b9"
+    },
+    "docs/plans/original-completion-2026-10-02/execution/p19-03/REACHABILITY_TABLE.json": {
+      "bytes": 1609120,
+      "sha256": "9904095c19742bac2871ea62347543cfc6169771454bc7419fccc2ac1e95779c"
+    },
+    "docs/plans/original-completion-2026-10-02/execution/p19-03/REACHABILITY_TABLE.md": {
+      "bytes": 133432,
+      "sha256": "afb99eede4c8b4a9aca4bf3113c88acc02998f0aec3c8f89ebd6179042b4f887"
+    },
+    "docs/plans/original-completion-2026-10-02/execution/p19-03/TASK_SPEC.json": {
+      "bytes": 8290,
+      "sha256": "263a01b943d8056727335fb76977c010298e1c229077f8da76e48683ba2e89bb"
+    },
+    "docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py": {
+      "bytes": 23419,
+      "sha256": "d2b78349ee95dcdd30d2aa7d1f2be41d8d82abd14bbe73f4394e3227fd1a2b43"
+    },
+    "docs/plans/original-completion-2026-10-02/execution/p19-03/test_reachability_table.py": {
+      "bytes": 14770,
+      "sha256": "d6cc4ceb770e9e329d0f2087a7fdf973ef8470a6f98072f2c37118f9ed8c6901"
+    }
+  },
+  "exact_184_21903_329parse_186ended_native_evidence_reuse_qualified": true,
+  "actual_independent_whole_original_review": "565d4f21c12b451da2d5a7dd462d099b",
+  "critical_high_medium": 0,
+  "low": 3,
+  "normal_candidate_integration_passed": true,
+  "new_native_runs": 0,
+  "normal_final_pending": true,
+  "original_unit_credit": 0,
+  "authority": "Existing explicit human main-update+commit/push authorization; no new SHA-specific human speech is claimed",
+  "time_ns": 1792236328462308000
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_EXACT_GAME_INPUT_REUSE_806DE25.json

@@ -0,0 +1,31 @@
+{
+  "artifact_S": "806de25068bc423136063791afcea811d251ee1b",
+  "existing_product_C": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "old_actual_native_S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "all1368_selected_source_settings_assets_tests_tools_byte_equal": true,
+  "marker_policy_engine_roster_parse_default_player_equal": true,
+  "scope": "All source_refs keys exactly equal; no file set was narrowed or omitted. New doc-only audit helpers are outside this unchanged pre-existing selection algorithm.",
+  "native_full_evidence_reuse_qualified": true,
+  "new_native_runs": 0,
+  "existing_full": {
+    "actual_suites": 184,
+    "missing_marker_paths": [],
+    "remaining_unexecuted_tests": [],
+    "available_marker_checks": 21903,
+    "actual_all_roster_checks": 21903,
+    "strict_accepted_checks": 21903,
+    "verified": true,
+    "composed": true,
+    "original_full_attempt_passed": false,
+    "whole_original_acceptance": false,
+    "parse_checks": 329,
+    "setup_phases": 2,
+    "owned_ended": 186,
+    "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "engines_started": 0,
+    "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+  },
+  "previous_actual_whole_backend_Opus_review": "ead8e74b9683404d8cf3d97bca118726",
+  "P19_whole_original_acceptance": "pending actual independent semantic review of full original §6–7, all21cells and all source/status/owner/gap claims, then normalintegration/final",
+  "time_ns": 1792234414270856000
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_EXACT_GAME_INPUT_REUSE_903A2C5.json

@@ -0,0 +1,31 @@
+{
+  "artifact_S": "903a2c566e73cebc874a6499410a1243bc190a63",
+  "existing_product_C": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "old_actual_native_S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "all1368_selected_source_settings_assets_tests_tools_byte_equal": true,
+  "marker_policy_engine_roster_parse_default_player_equal": true,
+  "scope": "All source_refs keys exactly equal; no file set was narrowed or omitted. New doc-only audit helpers are outside this unchanged pre-existing selection algorithm.",
+  "native_full_evidence_reuse_qualified": true,
+  "new_native_runs": 0,
+  "existing_full": {
+    "actual_suites": 184,
+    "missing_marker_paths": [],
+    "remaining_unexecuted_tests": [],
+    "available_marker_checks": 21903,
+    "actual_all_roster_checks": 21903,
+    "strict_accepted_checks": 21903,
+    "verified": true,
+    "composed": true,
+    "original_full_attempt_passed": false,
+    "whole_original_acceptance": false,
+    "parse_checks": 329,
+    "setup_phases": 2,
+    "owned_ended": 186,
+    "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "engines_started": 0,
+    "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+  },
+  "previous_actual_whole_backend_Opus_review": "ead8e74b9683404d8cf3d97bca118726",
+  "P19_whole_original_acceptance": "pending actual independent semantic review of full original §6–7, all21cells and all source/status/owner/gap claims, then normalintegration/final",
+  "time_ns": 1792235874948502000
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_EXACT_GAME_INPUT_REUSE_E0420D5.json

@@ -0,0 +1,31 @@
+{
+  "artifact_S": "e0420d57a381a1644357f0590536e1d47c9bca9f",
+  "existing_product_C": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+  "old_actual_native_S": "a7e3069b167511b3194242b3403fbcc35244a526",
+  "all1368_selected_source_settings_assets_tests_tools_byte_equal": true,
+  "marker_policy_engine_roster_parse_default_player_equal": true,
+  "scope": "All source_refs keys exactly equal; no file set was narrowed or omitted. New doc-only audit helpers are outside this unchanged pre-existing selection algorithm.",
+  "native_full_evidence_reuse_qualified": true,
+  "new_native_runs": 0,
+  "existing_full": {
+    "actual_suites": 184,
+    "missing_marker_paths": [],
+    "remaining_unexecuted_tests": [],
+    "available_marker_checks": 21903,
+    "actual_all_roster_checks": 21903,
+    "strict_accepted_checks": 21903,
+    "verified": true,
+    "composed": true,
+    "original_full_attempt_passed": false,
+    "whole_original_acceptance": false,
+    "parse_checks": 329,
+    "setup_phases": 2,
+    "owned_ended": 186,
+    "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "engines_started": 0,
+    "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+  },
+  "previous_actual_whole_backend_Opus_review": "ead8e74b9683404d8cf3d97bca118726",
+  "P19_whole_original_acceptance": "pending actual independent semantic review of full original §6–7, all21cells and all source/status/owner/gap claims, then normalintegration/final",
+  "time_ns": 1792233062748520000
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_FAILED_FORMAL_INTEGRATION_806DE25.json

@@ -0,0 +1,26 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "1875b032b7f6a8525fb6ccec0574e21769943c95",
+  "kind": "integration",
+  "checks": [
+    {
+      "id": "p19-table",
+      "exit_code": 1,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/3dff1e2121844313a07c39c5f8d57842",
+      "passed": false
+    },
+    {
+      "id": "p19-negative",
+      "exit_code": 5,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/07a0ef3637d64512b6338f4b21dbfbad",
+      "passed": false
+    },
+    {
+      "id": "p19-source-binding",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/0d2aac5d24564ab6ab517bad0d3eca74",
+      "passed": true
+    }
+  ],
+  "passed": false
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_FORMAL_VALIDATION_806DE25.json

@@ -0,0 +1,26 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "806de25068bc423136063791afcea811d251ee1b",
+  "kind": "validation",
+  "checks": [
+    {
+      "id": "p19-table",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/8d14038fd19c4277a2ab9d430bf2dbd0",
+      "passed": true
+    },
+    {
+      "id": "p19-negative",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/ad32d058245d45c6a0554ca92e0f46dd",
+      "passed": true
+    },
+    {
+      "id": "p19-source-binding",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/fec4a9beda95427d89b4050e07a771e9",
+      "passed": true
+    }
+  ],
+  "passed": true
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_FORMAL_VALIDATION_903A2C5.json

@@ -0,0 +1,26 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "903a2c566e73cebc874a6499410a1243bc190a63",
+  "kind": "validation",
+  "checks": [
+    {
+      "id": "p19-table",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/de99282b6b4049f4932747d96ae9acae",
+      "passed": true
+    },
+    {
+      "id": "p19-negative",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/471595c34bc84eab924953516ee8642d",
+      "passed": true
+    },
+    {
+      "id": "p19-source-binding",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/24589f23e8884d268bf37fb86b05ed46",
+      "passed": true
+    }
+  ],
+  "passed": true
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_FORMAL_VALIDATION_E0420D5.json

@@ -0,0 +1,26 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "e0420d57a381a1644357f0590536e1d47c9bca9f",
+  "kind": "validation",
+  "checks": [
+    {
+      "id": "p19-table",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/1c501211989843c190f0ee1eb6d4674b",
+      "passed": true
+    },
+    {
+      "id": "p19-negative",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/bc25ca3804ad4aa796ba7a2cf6d9a197",
+      "passed": true
+    },
+    {
+      "id": "p19-source-binding",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/3e07aaa43f84446aa0f375264e8d2d51",
+      "passed": true
+    }
+  ],
+  "passed": true
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_NORMAL_FINAL_C8E4F1D9.json

@@ -0,0 +1,26 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "8e4f1d92fc2a2e8f1dd187e661cf52b13e4e51d4",
+  "kind": "final",
+  "checks": [
+    {
+      "id": "p19-table",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/3e87d070e02045d3b10f1ac05a864fc7",
+      "passed": true
+    },
+    {
+      "id": "p19-negative",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/d73482521c484f1595cfae5b0abb0dba",
+      "passed": true
+    },
+    {
+      "id": "p19-source-binding",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/2a9d3970f4b8415cb784a4a556729219",
+      "passed": true
+    }
+  ],
+  "passed": true
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_NORMAL_INTEGRATION_C8E4F1D9.json

@@ -0,0 +1,26 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "8e4f1d92fc2a2e8f1dd187e661cf52b13e4e51d4",
+  "kind": "integration",
+  "checks": [
+    {
+      "id": "p19-table",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/8387e3805df94f448d9eaefae379cb4c",
+      "passed": true
+    },
+    {
+      "id": "p19-negative",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/4c9f9b10eb3b497b960137c50f1053b6",
+      "passed": true
+    },
+    {
+      "id": "p19-source-binding",
+      "exit_code": 0,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/bc9693db775f42c99ee06d53ee169755",
+      "passed": true
+    }
+  ],
+  "passed": true
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_RUNNER_COMPLETED_TRACEABILITY.json

@@ -0,0 +1,122 @@
+{
+  "contract": {
+    "id": "P19-03-TABLE",
+    "title": "P19-03 分岐の到達性：原7名×3ルートの全到達表と未制作欠損監査",
+    "requirement_ids": [
+      "P19-03"
+    ],
+    "acceptance_ids": [
+      "P19-03"
+    ],
+    "spec_ref": "docs/plans/original-completion-2026-10-02/execution/p19-03/TASK_SPEC.json",
+    "base_commit": "8ca9263fee1ec4374d97c01fda82b95e1df6a977",
+    "worker": "codex",
+    "allowed_paths": [
+      "docs/plans/original-completion-2026-10-02/execution/p19-03/**"
+    ],
+    "depends_on": [],
+    "resource_locks": [
+      "p19-route-reachability-audit"
+    ],
+    "validation_ids": [
+      "p19-table",
+      "p19-negative",
+      "p19-source-binding"
+    ],
+    "max_repair_attempts": null,
+    "spec_sha256": "3af3d9b931edc5449796662ad69bb6f67c80b48827a86565b1952931db68dd15"
+  },
+  "implementation_commit": "903a2c566e73cebc874a6499410a1243bc190a63",
+  "integration_commit": "8e4f1d92fc2a2e8f1dd187e661cf52b13e4e51d4",
+  "owner": "このチャットのユーザーの既存明示指示「mainの更新を明示的に許可します」「コミットすべき内容をコミットして。その上でpushして」に基づく継続許可。原P19-03の全条件レビュー合格と実C/M検証に対象を拘束し、新しいSHA指定の人間発言は主張しない。全ゲーム/他原成果の完了を意味しない。",
+  "evidence": [
+    {
+      "id": 1,
+      "task_id": "P19-03-TABLE",
+      "kind": "validation",
+      "commit_sha": "e0420d57a381a1644357f0590536e1d47c9bca9f",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/239449693d9a4172a4feee317c184b6d-validation.json",
+      "passed": 0
+    },
+    {
+      "id": 2,
+      "task_id": "P19-03-TABLE",
+      "kind": "validation",
+      "commit_sha": "e0420d57a381a1644357f0590536e1d47c9bca9f",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/bf963f060c934169ae0ef366b28fcd3f-validation.json",
+      "passed": 1
+    },
+    {
+      "id": 3,
+      "task_id": "P19-03-TABLE",
+      "kind": "review",
+      "commit_sha": "e0420d57a381a1644357f0590536e1d47c9bca9f",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/d4e70e7f48f549b085692962f88531a8/result.json",
+      "passed": 0
+    },
+    {
+      "id": 4,
+      "task_id": "P19-03-TABLE",
+      "kind": "validation",
+      "commit_sha": "806de25068bc423136063791afcea811d251ee1b",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/406baca45e5f41c294ea45d380c945fc-validation.json",
+      "passed": 1
+    },
+    {
+      "id": 5,
+      "task_id": "P19-03-TABLE",
+      "kind": "review",
+      "commit_sha": "806de25068bc423136063791afcea811d251ee1b",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/38eaaacdb31b4c76bcf982987816a391/result.json",
+      "passed": 1
+    },
+    {
+      "id": 6,
+      "task_id": "P19-03-TABLE",
+      "kind": "integration",
+      "commit_sha": "1875b032b7f6a8525fb6ccec0574e21769943c95",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/be88ab416157401d97718dc80f68fd51-integration.json",
+      "passed": 0
+    },
+    {
+      "id": 7,
+      "task_id": "P19-03-TABLE",
+      "kind": "validation",
+      "commit_sha": "903a2c566e73cebc874a6499410a1243bc190a63",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/c3ed2fa3df3145fa97a037c574b6e228-validation.json",
+      "passed": 1
+    },
+    {
+      "id": 8,
+      "task_id": "P19-03-TABLE",
+      "kind": "root-preflight",
+      "commit_sha": "7f9b63b0c281d57be4abec1c576e5abef273ca78",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/66089140e92a48b2bc96ea67ca597b58-root-preflight.json",
+      "passed": 1
+    },
+    {
+      "id": 9,
+      "task_id": "P19-03-TABLE",
+      "kind": "review",
+      "commit_sha": "903a2c566e73cebc874a6499410a1243bc190a63",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/565d4f21c12b451da2d5a7dd462d099b/result.json",
+      "passed": 1
+    },
+    {
+      "id": 10,
+      "task_id": "P19-03-TABLE",
+      "kind": "integration",
+      "commit_sha": "8e4f1d92fc2a2e8f1dd187e661cf52b13e4e51d4",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/83e6d08d9ac245d6b35941ac165d3318-integration.json",
+      "passed": 1
+    },
+    {
+      "id": 11,
+      "task_id": "P19-03-TABLE",
+      "kind": "final",
+      "commit_sha": "8e4f1d92fc2a2e8f1dd187e661cf52b13e4e51d4",
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/213aafebe6254110bf349c25b6036d92-final.json",
+      "passed": 1
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_TABLE_FACT_COMPARISON_806_TO_903.json

@@ -0,0 +1,34 @@
+{
+  "from": "806de25068bc423136063791afcea811d251ee1b",
+  "to": "903a2c566e73cebc874a6499410a1243bc190a63",
+  "changed_top_level_keys": [
+    "authority_snapshots"
+  ],
+  "identical_top_level_keys": [
+    "task_id",
+    "schema_version",
+    "identity_policy",
+    "source_anchor",
+    "common_rules",
+    "cells",
+    "catalog_evidence",
+    "pending",
+    "route_support",
+    "acceptance",
+    "accounting"
+  ],
+  "current_keys": [
+    "task_id",
+    "schema_version",
+    "identity_policy",
+    "source_anchor",
+    "common_rules",
+    "cells",
+    "authority_snapshots",
+    "catalog_evidence",
+    "pending",
+    "route_support",
+    "acceptance",
+    "accounting"
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_WHOLE_REVIEW_806DE25.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "806de25068bc423136063791afcea811d251ee1b",
+  "status": "pass",
+  "summary": "I re-reviewed the whole P19-03 unit at 806de25, read-only. I checked it against BASELINE §6 (lines 114–135) and §7 (lines 136–161), the work_packages P19-03 record, the 61 B-7.x atomic records snapshotted in the JSON, the immutable TASK_SPEC, and the frozen game source. I did not edit or run anything.\n\n**Original acceptance (「7名×3ルートの到達表があり、未制作内容は欠損として残る。」)**\n- The acceptance text is identical to work_packages.json:16100.\n- The table has 21 cells: the seven original names × 純愛/NTR/堕落.\n  - The names アンリ/フィーネ/トマリ/アメリア/リズ/ミミ/サツキ match BASELINE lines 118–124.\n  - The IDs are the existing atomic keys AR.heroine.<key>.route.{love,ntr,corruption}.\n  - No character or route was invented or substituted.\n- The catalog has only heroine_anri, and original_relationship_state.gd has no roster. So using the atomic keys, and leaving the six missing catalog IDs as explicit gaps, is honest and invents no IDs.\n- Each cell has all 8 categories. Common rules are kept separate from character-specific content.\n- Every character-specific item is recorded as 欠損 / 原本未定義 / D08 pending. Each carries a reason, an owner from the real work_packages deliverables (P18-02, P19-01, P19-02, P20-02, P26-01, P26-02), the citations [138–161] plus the character's own line, and natural_route_complete=false.\n- D05, D08, thresholds, rates and initial values all stay pending, with no invented numbers. The original's undefined per-character content therefore stays as gaps, which is what this audit acceptance allows. It is not game acceptance.\n\n**Previous findings from the e0420d5 review**\n1. MEDIUM, missing legacy evidence: fixed.\n   - coassignment_attack, zero_break, love_actions, threshold_route_loss and legacy_event_ui now carry legacy_evidence: path, anchor 1b07b87, git blob OID, file SHA-256, line range and quoted text.\n   - I checked every range against the real source:\n     - relationship_service.gd: restore_shield 246–261, apply_shield_attack 264–312 (includes shield_broken), request_route_lock 315–340, confirm_route_lock 343–355.\n     - simulation_runtime.gd: command registration 342–343 and the apply_shield_attack call at 6850.\n     - event_service.gd: lines 1039 and 1047.\n     - placement_risk_preview_service.gd: _contact_summary 536–565 and _shield_attack_candidates 619–640.\n     - main.gd: 98–101 is EVENT_CHOICE_NAMES. The correction from 89–101 is right, because 89–97 are unrelated excavation labels.\n   - These clauses all use the same rule: original status missing, classified legacy_not_original, with the P18-01 reason. The main.gd label constant is no longer credited as partial.\n2. LOW, independent tests: addressed.\n   - validate_legacy reads the anchored blobs via git show / rev-parse and is enforced by --check.\n   - The self-tests compute the blob OID independently with git hash-object, assert function and text markers, and reject evidence that is dropped, emptied, marked \"not implemented\", or has a stale OID or text, for every legacy clause.\n3. LOW, interruption cross-references: addressed. All 21 cells' interruption_cancellation entries now cite lines 148 and 153 (exact text plus baseline hash) and the legacy confirm_route_lock as legacy_not_original.\n4. LOW, hash labels: addressed in the checker constants, the checker output and the report.\n\n**Scope:** the diff touches only the 5 allowed files under execution/p19-03/. TASK_SPEC, the frozen pins, the selection record, the original registers and the game files are unchanged.\n\n**Validation:** all 3 registered checks ran on 806de25 and exited 0.\n- p19-table: --check output binds actual_commit 806de25, 1368 selected files, file_equality true.\n- p19-negative: 12 tests OK.\n- p19-source-binding: passed.\n\nThe earlier failed invocations were unexpanded `{worktree}` placeholders that never opened a script; no failure was turned into a pass.\n\nOnly low-severity notes remain, and they do not block the audit acceptance. Integration/final and the other gates are still required before the count moves from 14 to 15; I give no credit before those.",
+  "acceptance_ids": [
+    "P19-03"
+  ],
+  "findings": [
+    {
+      "severity": "low",
+      "message": "Most data-level negative tests still compare the document against the same expected() canonical. The independent semantic checks name only three markers: restore_shield, shield_broken and EXCLUSIVE_LOCKED. Citations such as the preview service's contact/shield-candidate lines, and the 6850, 1039 and 1047 call sites, are checked only for text and blob equality, not for a function-name marker. Consider asserting a marker for every legacy entry."
+    },
+    {
+      "severity": "low",
+      "message": "The run log in IMPLEMENTATION_REPORT.md reports source binding actual_commit=e0420d5. That comes from the pre-commit local run. The Runner output correctly binds 806de25, but the report should mark that line as the pre-submission local value."
+    },
+    {
+      "severity": "low",
+      "message": "The snapshot_container evidence range (relationship_service.gd 423–479) starts mid-function and cuts off inside restore_snapshot. It is accurate as evidence, but a range aligned to function boundaries would be clearer for downstream owners (P18-01, P19-02)."
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_WHOLE_REVIEW_903A2C5.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "903a2c566e73cebc874a6499410a1243bc190a63",
+  "status": "pass",
+  "summary": "I re-reviewed the whole original P19-03 unit at 903a2c5, read-only. I did not edit or run anything.\n\n**Original acceptance (「7名×3ルートの到達表があり、未制作内容は欠損として残る。」)**\n- The acceptance text is identical to work_packages.json:9021.\n- I read BASELINE §6 (114–135) and §7 (136–161) directly. The 7 names in REACHABILITY_TABLE.md (アンリ/フィーネ/トマリ/アメリア/リズ/ミミ/サツキ) match lines 118–124 in order. Each cell cites its own character line (118…124).\n- The 21 cell IDs map to existing atomic records AR.heroine.<key>.route.{love,ntr,corruption}. I checked anri.route.love directly: B-7.1, entity key and original_name match.\n- Every cell has all 8 categories: entry events, state conditions, duel win/loss, route/selection effects, interruption/cancellation, save, history/marks, current reachability.\n- Common rules are kept separate from per-character content. All 23 common rules cite exact original line text plus the baseline hash, and the quoted text matches the BASELINE file.\n- Every per-character item is recorded as 欠損 / 原本未定義 / D08 pending, with a reason, an owner and natural_route_complete=false. The owners are P18-02, P19-01, P19-02, P20-02, P26-01 and P26-02, and they match those deliverables' titles and work in work_packages.\n- D05, D08, thresholds, rates and initial values all stay pending/null, with no invented numbers.\n\n**Checked against the actual game source**\n- data/characters/mvp_unique_characters.json contains only heroine_anri and rival_rai. None of the other six names appear anywhere under data/.\n- original_relationship_state.gd only validates and holds generic fields; it has no roster. So \"implemented\" is limited to that narrow storage, and \"partial\" to the affection/shield-max invariant, the snapshot container and the identity check.\n- There is no duel, history or pregnancy code anywhere in autoload/scripts/scenes. lust and netorare appear only in state validation, never in updates. The \"missing\" statuses are honest.\n- Legacy shield, route-lock and UI-label code is cited with blob OIDs and labelled legacy_not_original, never credited as an original route. Backend support is not called a completed natural route. Using atomic keys while leaving the six missing catalog IDs as explicit gaps is the honest choice and invents nothing.\n\n**Repair 2 (projection)**\n- PACKAGE_MUTABLE and UNIT_MUTABLE allow only progress, reference, evidence and time fields that already exist in BASE.\n- Every other field, including id/title/work/acceptance/depends_on/requirement_ids/decisions/owner_roles, is compared exactly against the BASE 8ca9263 projection. Type is preserved via json.dumps, so True does not compare equal to 1.\n- atomic_requirements.json, decisions.json and the selection record stay byte-exact against BASE.\n- test_every_register_definition_field changes or removes each distinct definition key, adds unknown keys, and alters list counts and order. D05 and D08 flipping to approved is rejected, and the real main 6e17cae and candidate 1875b03 registers are accepted as positive cases.\n- The fact comparison shows only authority_snapshots changed. I confirmed the 21 cells, common rules, statuses, owners and gaps are unchanged from the previously passed 806de25.\n\n**Scope and validation**\n- The diff touches only the 5 allowed files under execution/p19-03/.\n- All 3 registered checks ran on 903a2c5 and exited 0. p19-table binds actual_commit 903a2c5, 1368 selected files, file_equality true. p19-negative ran 16 tests, OK.\n- The Root non-formal preflight on S plus latest main (7f9b63b) also passed all 3 checks. It is not normal integration or final.\n- The earlier failed integration (1875b03) was recorded honestly and fixed without changing any original definition. No test was deleted or disabled.\n\n**Open items**\n- D08 and per-character content, P18–P20/P26 gameplay, and global Windows/game acceptance all stay open.\n- No credit before normal prepare-integration/final and the ledger update. Only then can the count move from 14/88 to 15/88.",
+  "acceptance_ids": [
+    "P19-03"
+  ],
+  "findings": [
+    {
+      "severity": "low",
+      "message": "test_actual_main_and_candidate_metadata names commits by abbreviated SHA (6e17cae, 1875b03). The test only works where those objects exist. That holds in the current repository, but full SHAs, or a clear explanation of the dependency, would make it more reproducible."
+    },
+    {
+      "severity": "low",
+      "message": "Three low notes from the previous review (806de25) are still deferred: (1) per-entry function-name markers for every legacy citation, (2) the label on the Repair 1 local actual_commit line, (3) aligning the snapshot_container range to function boundaries. This deferral is allowed. Item (2) is already addressed by the 「過去のローカル確認」 label."
+    },
+    {
+      "severity": "low",
+      "message": "Most data-level negative tests still compare the document against the same expected() canonical. The checker's hardcoded facts (statuses, owners) are therefore protected from tampering by self-comparison, not proven correct by the tests. I separately confirmed in the actual source and work_packages that the classifications and owners are correct."
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_WHOLE_REVIEW_E0420D5.json

@@ -0,0 +1,27 @@
+{
+  "task_id": "P19-03-TABLE",
+  "commit": "e0420d57a381a1644357f0590536e1d47c9bca9f",
+  "status": "changes_requested",
+  "summary": "Independent read-only whole-unit review of P19-03 at e0420d5 against BASELINE §6 (lines 114–135) and §7 (136–161), the B-7.x atomic records, work_packages and the immutable TASK_SPEC.\n\nWhat passes:\n- Scope: the diff adds only the 5 required files under execution/p19-03/**. TASK_SPEC, pins, selection record, original registers and game files are unchanged.\n- Roster and routes: exactly 7 original names (アンリ, フィーネ, トマリ, アメリア, リズ, ミミ, サツキ, matching BASELINE lines 118–124 and atomic entity keys AR.heroine.<key>.route.{love,ntr,corruption}) × 純愛/NTR/堕落 gives 21 cells. I confirmed the catalog has only heroine_anri/rival_rai and that original_relationship_state.gd has no roster, so using atomic keys and keeping the other six as gaps is honest and invents no IDs.\n- Gaps: every cell keeps 8 categories, separates common rules from character-specific content, marks character-specific content 欠損/D08 pending with a plausible owner (P18-02/P19-01/P19-02/P20-02/P26-01/P26-02), and sets natural_route_complete=false. Thresholds, rates, initial values and D05/D08 stay pending. Original citations quote exact line text with the baseline hash. Implemented/partial evidence carries path+SHA, bound to anchor 1b07b87 by blob equality.\n- Validation: the 3 registered checks ran on the same commit and exit 0 (10 self-tests OK; source binding 1368 files, file_equality true). The 3 initial exit-2 runs were literal `{worktree}` placeholders that never opened a script; no failure was converted to PASS.\n- Under the original acceptance wording the table structurally exists and missing content stays as gaps.\n\nWhat fails:\n- The 'audit existing support' requirement is not met, and several statuses are inaccurate. The audit marks coassignment_attack, zero_break, love_actions (shield recovery) and threshold_route_loss as \"not implemented\" with no source path. But the frozen game source has live legacy mechanisms for exactly these clauses:\n  - relationship_service.gd: apply_shield_attack (reports shield_broken), restore_shield, request_route_lock/confirm_route_lock (irreversible route lock).\n  - simulation_runtime.gd registers request_route_lock/confirm_route_lock as commands; line 6850 calls apply_shield_attack.\n  - event_service.gd lines 1039/1047 apply these as event effects.\n  - placement_risk_preview_service.gd computes heroine/rival contact intervals and _shield_attack_candidates.\n- Meanwhile a legacy UI label constant in main.gd is credited as 'partial'. Treating legacy support inconsistently undermines the audit's accuracy for downstream owners.\n\nThe legacy mechanisms need not count as original support (P18-01 forbids one-to-one conversion), but they must be listed with path+SHA and a stated reason for not crediting them. The 'not implemented' entries for the affected clauses are wrong as written.",
+  "acceptance_ids": [
+    "P19-03"
+  ],
+  "findings": [
+    {
+      "severity": "medium",
+      "message": "Existing-support audit is incomplete and inconsistent. coassignment_attack, zero_break, love_actions (shield recovery) and threshold_route_loss are recorded as implementation \"not implemented\", but frozen source at anchor 1b07b87 has live legacy mechanisms for them: scripts/relationship/relationship_service.gd apply_shield_attack (264–312, reports shield_broken), restore_shield (246–261), request_route_lock/confirm_route_lock (315–355); autoload/simulation_runtime.gd registers request_route_lock/confirm_route_lock as commands (342–343) and calls apply_shield_attack (6850); scripts/events/event_service.gd applies them as event effects (1039, 1047); scripts/relationship/placement_risk_preview_service.gd computes heroine/rival contact and _shield_attack_candidates (536, 619). Meanwhile a legacy main.gd label constant (89–101) is credited as 'partial'. Fix: record these legacy mechanisms per clause with exact path+SHA+lines at the anchor. Classify each as partial/legacy-not-original (or keep missing for the original model) with an explicit reason, e.g. P18-01 forbids one-to-one conversion and the numbers/daily limits are not approved originals. Keep owners and gaps unchanged. Regenerate the MD and add a self-test that rejects dropping this evidence."
+    },
+    {
+      "severity": "low",
+      "message": "Most data-level negative tests (wrong character/route, owner, status, stale text) mutate the document and compare it to a canonical built by the same expected() function. They only prove equality with hard-coded facts, not that those facts are correct. Source/baseline/blob/pin corruption tests are real. Consider adding independent assertions, e.g. that every 'missing' item's semantic claim is cross-checked against grep-able absence or presence in the cited source files, so mislabeled statuses like the one above are caught."
+    },
+    {
+      "severity": "low",
+      "message": "interruption_cancellation maps only §6.5 departure (line 135). The route-terminating clauses — duel loss 'ヒロインを即座に強奪' (153) and '純愛ルート完全消失' (148) — and legacy route_lock irreversibility are not cross-referenced as interruption/cancellation authorities. The character-specific gap covers it, but the common enumeration of interruption handling required by the original work is thin."
+    },
+    {
+      "severity": "low",
+      "message": "The checker's SPEC_HASH (263a01b9…) is the TASK_SPEC.json file-byte hash. It differs from the contract spec_sha256 (3af3d9b9…), presumably because the contract hashes a different serialization. The runner pass confirms the file is unchanged from base, but the report should say which representation each hash covers."
+    }
+  ]
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/TASK_SPEC.json

@@ -0,0 +1,108 @@
+{
+  "id": "P19-03-TABLE",
+  "original_plan_id": "P19-03",
+  "title": "分岐の到達性",
+  "original_work": "人物ごとの3ルートに必要なイベント・条件・中断処理を列挙する。",
+  "original_acceptance": "7名×3ルートの到達表があり、未制作内容は欠損として残る。",
+  "original_denominator": {
+    "packages": 30,
+    "units": 88,
+    "completed_at_start": 14,
+    "partial_credit": false
+  },
+  "whole_original_unit_review_required": true,
+  "scope": "Whole original documentation/audit unit P19-03. Neutral non-graphic state/event IDs and exact source citations only; never create intimate content, narrative events, per-character mechanics or product numbers. Does not implement or accept route gameplay, content, endings, Windows or the whole game.",
+  "authority": [
+    {
+      "path": "docs/traceability/original/BASELINE.txt",
+      "sha256": "75e4bdbdeb379c9269553f0c776bdb9cc96e01f2d6aa5ca650d132c63a8aeb1a",
+      "sections": "Original §6 seven-character catalog; §7 lines136–161 three routes and relation/duel/action/history rules. Read actual full relevant lines, do not trust line numbers without matching text."
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/work_packages.json",
+      "unit": "P19-03",
+      "acceptance_exact": true
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/atomic_requirements.json",
+      "requirements": "B-7.1 through B-7.6 and relevant character/route clauses; inspect complete selected entries."
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/decisions.json",
+      "rule": "Only approved decisions may fill specifications. D08 pending cells remain 原本未定義/D08 pending 欠損."
+    }
+  ],
+  "actual_opus_selection": "dc342e4d69154660bef7e688a70fd783",
+  "frozen_game_input_pins_sha256": "6c778226a4cc6d0b0d682500759e7d4229c926a27bd2e247b00b9c3e5f1a2fb0",
+  "audit_source_anchor": "1b07b87d3736e777932315a4bdde8b70cbf9cb23",
+  "implementation_requirements": [
+    "Build REACHABILITY_TABLE.json plus deterministic REACHABILITY_TABLE.md with exactly7 canonical character IDs/names from original §6, existing catalog and scripts/relationship/original_relationship_state.gd, crossed with3 original routes 純愛/NTR/堕落. No invented or substituted character/route.",
+    "Every one of21 cells enumerates applicable entry/required events, source-defined state conditions, duel win/loss and route/selection effects, interruption/cancellation and save handling, history/marks and current reachability. Distinguish common baseline rules from character-specific content undefined by the original.",
+    "Every listed event/condition/handling item carries exact original line range+text/hash authority, concrete implementation status implemented/partial/missing, exact existing source path+SHA at the audited source anchor (or explicit not implemented with no fake path), and owning remaining original deliverable. Do not call backend model support a completed natural route.",
+    "Unproduced or undefined character-specific events/conditions/interruption/save/history content remains explicitly 欠損 with reason and owning remaining original item. Missing content is allowed by the unchanged original audit acceptance; it is never game acceptance. Preserve unknown numeric thresholds/rates/initial values as pending; use neutral abstract state IDs only.",
+    "Implement stdlib check_reachability_table.py and test_reachability_table.py under this documentation directory. This placement is inside actual Opus proposed docs/** scope and preserves the exact1368 selected native-game input set. Do not add new files under tools, game scripts, data, tests, marker registry or other game-selected paths.",
+    "Checker verifies exact7×3 unique complete cell set, canonical IDs, original pinned source+line text, no uncited item, exact current source SHA+anchor binding, valid status/owner and explicit gaps, no fabricated thresholds/unsupported completion, and byte-for-byte deterministic Markdown regeneration. --check must be read-only; optional --write may regenerate view during implementation.",
+    "Source binding enforces complete frozen selected-source map, no missing/new/changed selected files, marker/policy/engine/roster/parse identity and baseline hash. Validate FROZEN_GAME_INPUT_PINS.json against this immutable spec SHA field. Code source evidence may cite published audited anchor; checker output binds actual current commit and proves exact file equality. Do not fabricate a future self-containing commit SHA.",
+    "Cross-cutting UI/Runtime/save/Windows applicability is explicit: audit existing support and missing mechanisms per route; this documentation-only unit introduces no product OS behavior, so audit-unit native GUI/Windows execution is not applicable. Global/other-unit Windows and game acceptance remain open.",
+    "Self-tests meaningfully reject missing/duplicate cell, wrong character/route, missing category/citation, stale source/baseline text/hash, invented numeric threshold, missing content falsely marked complete, wrong owning deliverable/status, malformed JSON/types, or Markdown drift; include valid implemented/partial/missing controls. No test-count padding.",
+    "Reuse existing completed P13-03 content-audit checker pattern as guidance. Preserve all current game files, original text, decisions, frozen pins, immutable TASK_SPEC and selection record. Do not revise acceptance or invent D05/D08 answers.",
+    "Provide concise implementation report with all requirements mapped to files/checks, actual invocations/results and remaining parent/game gaps. No worker claim or exit0 substitutes for independent whole-unit review and normal gates."
+  ],
+  "required_outputs": [
+    "REACHABILITY_TABLE.json",
+    "REACHABILITY_TABLE.md",
+    "check_reachability_table.py",
+    "test_reachability_table.py",
+    "IMPLEMENTATION_REPORT.md"
+  ],
+  "validation_interface": [
+    {
+      "id": "p19-table",
+      "argv": [
+        "{python}",
+        "{worktree}/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py",
+        "--project-root",
+        "{worktree}",
+        "--check"
+      ]
+    },
+    {
+      "id": "p19-negative",
+      "argv": [
+        "{python}",
+        "{worktree}/docs/plans/original-completion-2026-10-02/execution/p19-03/test_reachability_table.py",
+        "--project-root",
+        "{worktree}"
+      ]
+    },
+    {
+      "id": "p19-source-binding",
+      "argv": [
+        "{python}",
+        "{worktree}/docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py",
+        "--project-root",
+        "{worktree}",
+        "--source-binding-only"
+      ]
+    }
+  ],
+  "workflow": [
+    "Register fixed original acceptance P19-03 once; actual Opus confirms next registered run and chooses Sol6.1 default/Astra only justified. One managed worker, no duplicate task.",
+    "Worker local static+checker+self-tests only; do not run native full during implementation.",
+    "Required full native evidence may be reused only after independent exact candidate input equality against frozen C/S source/settings/markers/policy/engine/test inputs/roster/applicability. Doc helpers live outside selected source set; no narrowed equality definition. If equality fails do not claim reuse or launch an uncontrolled full.",
+    "Separate actual Opus whole-original P19-03 review against full original §6–7 and exact acceptance. Reviewer decides whether explicit D08/content gaps satisfy audit acceptance; fail honestly if not, never redefine it.",
+    "Normal prepare-integration, actual C/M exact equality, existing real main permission only (no fabricated new human speech), normal final, ledger+push. Only then original P19-03 may add1 to14/88."
+  ],
+  "pending_not_waived": [
+    "P04 existing D05 owner choices",
+    "D08 production chapter/route/content scope",
+    "P19-01/02 Runtime and normal route gameplay",
+    "P20/P26 content/endings/encyclopedia",
+    "P13 four low production followups",
+    "Global same-Windows acceptance and held gestures remain open"
+  ],
+  "model_proposal": {
+    "codex_model": "gpt-6.1-sol",
+    "actual_opus_decision": "dc342e4d69154660bef7e688a70fd783"
+  }
+}

docs/plans/original-completion-2026-10-02/execution/p19-03/check_reachability_table.py

@@ -0,0 +1,367 @@
+#!/usr/bin/env python3
+"""Read-only, stdlib P19-03 documentation validator; never accepts gameplay."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import sys
+
+OUT = 'docs/plans/original-completion-2026-10-02/execution/p19-03/'
+PLAN = 'docs/plans/original-completion-2026-10-02/'
+BASELINE = 'docs/traceability/original/BASELINE.txt'
+ANCHOR = '1b07b87d3736e777932315a4bdde8b70cbf9cb23'
+BASE = '8ca9263fee1ec4374d97c01fda82b95e1df6a977'
+BASE_HASH = '75e4bdbdeb379c9269553f0c776bdb9cc96e01f2d6aa5ca650d132c63a8aeb1a'
+SPEC_FILE_BYTES_SHA256 = '263a01b943d8056727335fb76977c010298e1c229077f8da76e48683ba2e89bb'
+# Proof: build/owner-handoff/p19-review-r01/SPEC_HASH_REPRESENTATIONS.json
+# Both hashes describe the same unchanged TASK_SPEC.json.
+RUNNER_CONTRACT_SPEC_SHA256 = '3af3d9b931edc5449796662ad69bb6f67c80b48827a86565b1952931db68dd15'
+PINS_HASH = '6c778226a4cc6d0b0d682500759e7d4229c926a27bd2e247b00b9c3e5f1a2fb0'
+ROUTES = {'love': '純愛', 'ntr': 'NTR', 'corruption': '堕落'}
+PEOPLE = [('anri', 'アンリ'), ('fine', 'フィーネ'), ('tomari', 'トマリ'),
+          ('amelia', 'アメリア'), ('liz', 'リズ'), ('mimi', 'ミミ'), ('satsuki', 'サツキ')]
+CATEGORIES = ('entry_required_events', 'state_conditions', 'duel_effects',
+              'route_selection_effects', 'interruption_cancellation', 'save_handling',
+              'history_marks', 'current_reachability')
+STATE = 'scripts/relationship/original_relationship_state.gd'
+SERVICE = 'scripts/relationship/relationship_service.gd'
+RUNTIME = 'autoload/simulation_runtime.gd'
+CATALOG = 'data/characters/mvp_unique_characters.json'
+
+EVENT = 'scripts/events/event_service.gd'
+PREVIEW = 'scripts/relationship/placement_risk_preview_service.gd'
+LEGACY_REASON = 'P18-01 forbids one-to-one conversion; legacy numbers/daily limits are not approved originals.'
+LEGACY_RANGES = {
+ 'coassignment_attack': [(SERVICE,264,312),(RUNTIME,6850,6850),(EVENT,1039,1039),(PREVIEW,536,565),(PREVIEW,619,640)],
+ 'zero_break': [(SERVICE,264,312),(RUNTIME,6850,6850),(EVENT,1039,1039)],
+ 'love_actions': [(SERVICE,246,261)],
+ 'threshold_route_loss': [(SERVICE,315,340),(SERVICE,343,355),(RUNTIME,342,343),(EVENT,1047,1047)],
+ 'legacy_event_ui': [('scenes/main/main.gd',98,101)],
+}
+
+
+def validate_legacy(root, document):
+    rules = {r['id']: r for r in document['common_rules']}
+    for identity, ranges in LEGACY_RANGES.items():
+        rule = rules[identity]
+        require(rule['status'] == 'missing' and rule['legacy_classification'] == 'legacy_not_original',
+                'legacy/original classification')
+        require(rule['implementation'] == 'original conformance missing; see legacy_evidence'
+                and rule['legacy_reason'] == LEGACY_REASON, 'unqualified legacy absence')
+        entries = rule.get('legacy_evidence')
+        require(type(entries) is list and len(entries) == len(ranges), 'missing legacy evidence')
+        for entry, (path, start, end) in zip(entries, ranges):
+            data = blob(root, ANCHOR, path)
+            oid = subprocess.check_output(['git','rev-parse',ANCHOR+':'+path],cwd=root).decode().strip()
+            require(entry == {'path':path,'anchor':ANCHOR,'git_blob_oid':oid,
+                'sha256':sha(data),'lines':[start,end],
+                'text':'\n'.join(data.decode().splitlines()[start-1:end])}, 'legacy text/blob/range')
+            require(data == (root/path).read_bytes(), 'legacy current source mismatch')
+
+
+def sha(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def require(value, message):
+    if not value:
+        raise ValueError(message)
+
+
+def decode(data):
+    def unique(pairs):
+        result = {}
+        for k, v in pairs:
+            require(k not in result, 'duplicate JSON key: ' + k)
+            result[k] = v
+        return result
+    return json.loads(data, object_pairs_hook=unique,
+                      parse_constant=lambda s: (_ for _ in ()).throw(ValueError(s)))
+
+
+def blob(root, commit, path):
+    return subprocess.check_output(['git', 'show', commit + ':' + path], cwd=root)
+
+
+def selection(root):
+    paths = [p for folder in ('autoload', 'scripts', 'scenes', 'data', 'tests', 'assets', 'tools')
+             for p in (root / folder).rglob('*')
+             if p.is_file() and p.name != '.DS_Store' and '__pycache__' not in p.parts]
+    paths += [root / p for p in ('project.godot', 'export_presets.cfg', 'Makefile', 'AGENTS.md')]
+    require(all(not p.is_symlink() for p in paths), 'selected source aliases refused')
+    return {p.relative_to(root).as_posix(): {'bytes': p.stat().st_size, 'sha256': sha(p.read_bytes())}
+            for p in sorted(paths)}
+
+
+def binding(root):
+    raw = lambda p: (root / p).read_bytes()
+    require(sha(raw(OUT + 'TASK_SPEC.json')) == SPEC_FILE_BYTES_SHA256, 'immutable spec changed')
+    spec = decode(raw(OUT + 'TASK_SPEC.json'))
+    require(sha(raw(OUT + 'FROZEN_GAME_INPUT_PINS.json')) == spec['frozen_game_input_pins_sha256'] == PINS_HASH,
+            'frozen pins SHA differs from immutable spec')
+    pins = decode(raw(OUT + 'FROZEN_GAME_INPUT_PINS.json'))
+    require(pins['audited_game_source_anchor_commit'] == spec['audit_source_anchor'] == ANCHOR, 'anchor identity')
+    actual = selection(root)
+    require(actual == pins['source_files'], 'full selected-source map: missing/new/changed file')
+    for key in ('marker_contract', 'policy', 'engine'):
+        require(sha(Path(pins[key + '_path']).read_bytes() if key == 'engine' else raw(pins[key + '_path']))
+                == pins[key + '_sha256'], key + ' identity')
+    require(sha(raw(BASELINE)) == pins['baseline_sha256'] == BASE_HASH, 'baseline hash')
+    require(len(raw(BASELINE)) == pins['baseline_bytes'], 'baseline bytes')
+    roster = ['tests/run_tests.gd'] + sorted(p.relative_to(root).as_posix()
+        for p in (root / 'tests').rglob('test*.gd') if 'export' not in p.relative_to(root).parts
+        and p.relative_to(root).as_posix() != 'tests/s0/test_kernel_and_save.gd')
+    require(roster == pins['roster'], 'roster identity')
+    require(sum(p.endswith('.gd') for p in actual) == pins['parse_files'], 'parse selection identity')
+    # Audit evidence is bound to published blobs, never a future self-containing commit.
+    for p in (STATE, SERVICE, RUNTIME, CATALOG):
+        require(raw(p) == blob(root, ANCHOR, p), 'stale audited source: ' + p)
+    return {'actual_commit': subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=root).decode().strip(),
+            'selected_files': len(actual), 'anchor': ANCHOR, 'file_equality': True,
+            'native_evidence_reuse_accepted': False,
+            'TASK_SPEC_file_bytes_sha256': SPEC_FILE_BYTES_SHA256,
+            'Runner_git_show_stripped_UTF8_contract_spec_sha256': RUNNER_CONTRACT_SPEC_SHA256}
+
+
+# Exact key-level BASE -> 6e17cae/1875b03 diff; no prefix/wildcard exclusions.
+PACKAGE_MUTABLE = frozenset(("state", "legacy_state", "current_summary", "updated_at_jst"))
+UNIT_MUTABLE = frozenset((
+    "state", "current_execution", "remaining_gaps", "updated_at_jst",
+    "submitted_commit", "current_summary", "progress_summary", "evidence",
+    # Normal final/source references: these names already occur in BASE units.
+    "completed_at_jst", "implementation_commit", "integrated_commit",
+    "integration_commit", "normal_integration_candidate",
+))
+
+
+def definition_projection(register):
+    require(type(register) is list, "package register must be a list")
+    projected = []
+    for package in register:
+        require(type(package) is dict, "package must be an object")
+        record = {k: v for k, v in package.items() if k not in PACKAGE_MUTABLE}
+        units = record.get("remaining_deliverables")
+        require(type(units) is list, "deliverables must be a list")
+        require(all(type(unit) is dict for unit in units), "unit must be an object")
+        record["remaining_deliverables"] = [
+            {k: v for k, v in unit.items() if k not in UNIT_MUTABLE} for unit in units]
+        projected.append(record)
+    return projected
+
+
+def validate_register(root, name, current):
+    anchored = blob(root, BASE, PLAN + name)
+    if name == "work_packages.json":
+        # JSON serialization preserves types (True must not compare equal to 1).
+        encode = lambda value: json.dumps(definition_projection(decode(value)),
+                                          ensure_ascii=False, sort_keys=True)
+        require(encode(current) == encode(anchored),
+                "original definition changed: " + name)
+    else:
+        require(current == anchored, "original register changed: " + name)
+    return anchored
+
+
+def expected(root):
+    raw = lambda p: (root / p).read_bytes()
+    require(sha(raw(BASELINE)) == BASE_HASH, 'baseline changed')
+    anchored = {name: validate_register(root, name, raw(PLAN + name))
+                for name in ('atomic_requirements.json', 'work_packages.json', 'decisions.json')}
+    require(raw(OUT + 'ACTUAL_OPUS_NEXT_ORIGINAL_UNIT_SELECTION.json') ==
+            blob(root, BASE, OUT + 'ACTUAL_OPUS_NEXT_ORIGINAL_UNIT_SELECTION.json'), 'selection record changed')
+    lines = raw(BASELINE).decode().splitlines()
+    def cite(start, end=None):
+        end = end or start
+        return {'path': BASELINE, 'lines': [start, end],
+                'text': '\n'.join(lines[start - 1:end]), 'baseline_sha256': BASE_HASH}
+    def evidence(path, start, end):
+        data = blob(root, ANCHOR, path)
+        require(data == raw(path), 'stale source ' + path)
+        return {'path': path, 'sha256': sha(data), 'anchor': ANCHOR,
+                'lines': [start, end], 'text': '\n'.join(data.decode().splitlines()[start - 1:end])}
+    def item(identity, start, end, note, owner, status='missing', source=None):
+        return {'id': identity, 'authority': cite(start, end), 'status': status,
+                'implementation': source or 'original conformance missing', 'owner': owner,
+                'observation': note, 'gap': None if status == 'implemented' else '欠損: ' + note}
+    # Only narrow storage facts are implemented; simulation/route completion never follows.
+    rules = [
+        item('state_fields', 138, 143, '原本3値と盾の明示値の検証・保持のみ。初期値と更新方針は未定。',
+             'P18-01', 'implemented', evidence(STATE, 4, 34)),
+        item('affection_max_invariant', 140, 140, '入力時の最大値一致検証のみ。通常操作の回復・更新は欠損。',
+             'P18-01', 'partial', evidence(STATE, 20, 30)),
+        item('snapshot_container', 138, 143, '専用状態と旧値の分離保存・復元。人物別ルート進行保存を意味しない。',
+             'P18-01', 'partial', evidence(SERVICE, 423, 479)),
+        item('identity_registration', 138, 138, 'Runtimeは登録済み人物・相互対応を検証。既存カタログのヒロインはアンリのみ。通常ルート入口ではない。',
+             'P19-01', 'partial', evidence(RUNTIME, 6791, 6812)),
+        item('legacy_event_ui', 154, 157, '既存UIには汎用関係イベントの確認/保留ラベルがある。原本の行動・決闘選択・自然ルート到達は欠損。',
+             'P19-01', 'partial', evidence('scenes/main/main.gd', 98, 101)),
+    ]
+    clauses = [
+        ('defense_reduction', 141, 141, 'P18-02'), ('post_break_metric', 142, 143, 'P18-02'),
+        ('barrier_block', 143, 143, 'P18-02'), ('coassignment_attack', 145, 145, 'P18-02'),
+        ('zero_break', 146, 146, 'P18-02'), ('contact_after_break', 147, 147, 'P18-02'),
+        ('threshold_route_loss', 148, 148, 'P18-03'), ('duel_types', 150, 151, 'P19-01'),
+        ('duel_win', 152, 152, 'P19-01'), ('duel_loss', 153, 153, 'P19-01'),
+        ('love_actions', 155, 155, 'P19-01'), ('ntr_actions', 156, 156, 'P19-01'),
+        ('corruption_actions', 157, 157, 'P19-01'), ('history_fields', 159, 159, 'P19-02'),
+        ('history_cycle_parentage', 160, 160, 'P19-02'), ('portrait_marks', 161, 161, 'P26-02'),
+        ('route_skills', 132, 132, 'P20-01'), ('departure', 135, 135, 'P19-02')]
+    for identity, start, end, owner in clauses:
+        rules.append(item(identity, start, end,
+            '原本の共通要求。専用原本モデルにはこの更新・表示の実装なし。旧汎用モデルの数値やルートを代用しない。', owner))
+    for rule in rules:
+        if rule['id'] in LEGACY_RANGES:
+            rule.update(status='missing', implementation='original conformance missing; see legacy_evidence',
+                        legacy_classification='legacy_not_original', legacy_reason=LEGACY_REASON)
+            rule['gap'] = '欠損: ' + rule['observation'] + ' ' + LEGACY_REASON
+            rule['legacy_evidence'] = []
+            for path, start, end in LEGACY_RANGES[rule['id']]:
+                entry = evidence(path, start, end)
+                entry['git_blob_oid'] = subprocess.check_output(
+                    ['git','rev-parse',ANCHOR+':'+path],cwd=root).decode().strip()
+                rule['legacy_evidence'].append(entry)
+    # Read complete selected atomic records, not only their condition strings.
+    atoms = decode(anchored['atomic_requirements.json'])['requirements']
+    atoms = [x for x in atoms if set(x.get('source_group_ids', [])) & {'B-7.' + str(i) for i in range(1, 7)}]
+    owners = {x['id'] for p in decode(anchored['work_packages.json']) for x in p.get('remaining_deliverables', [])}
+    require(all(r['owner'] in owners for r in rules), 'unknown original owner')
+    for key, name in PEOPLE:
+        for route in ROUTES:
+            require(any(x['id'] == 'AR.heroine.' + key + '.route.' + route and
+                        x['entity'] == {'kind': 'heroine', 'key': key, 'original_name': name} for x in atoms),
+                    'canonical atomic character/route missing')
+    require(all(name in lines[117 + i] for i, (_, name) in enumerate(PEOPLE)), 'original character names')
+    cells = []
+    for i, (key, name) in enumerate(PEOPLE):
+        for route, route_name in ROUTES.items():
+            refs = {
+                'entry_required_events': ['identity_registration', route + '_actions'],
+                'state_conditions': ['state_fields', 'affection_max_invariant', 'defense_reduction',
+                    'post_break_metric', 'barrier_block', 'coassignment_attack', 'zero_break', 'contact_after_break'],
+                'duel_effects': ['duel_types', 'duel_win', 'duel_loss'],
+                'route_selection_effects': ['threshold_route_loss', route + '_actions', 'route_skills'],
+                'interruption_cancellation': ['departure', 'threshold_route_loss', 'duel_loss'], 'save_handling': ['snapshot_container'],
+                'history_marks': ['history_fields', 'history_cycle_parentage', 'portrait_marks'],
+                'current_reachability': ['identity_registration', 'threshold_route_loss']}
+            categories = {}
+            for category in CATEGORIES:
+                owner = {'entry_required_events': 'P26-01', 'state_conditions': 'P18-02',
+                         'duel_effects': 'P19-01', 'route_selection_effects': 'P26-02',
+                         'interruption_cancellation': 'P19-02', 'save_handling': 'P19-02',
+                         'history_marks': 'P19-02', 'current_reachability': 'P20-02'}[category]
+                gap = item(key + '_' + route + '_' + category, 138, 161,
+                    '原本未定義/D08 pending: 人物固有のイベント列・条件・中断取消・進行保存・履歴と通常到達は未制作/未証明。共通要求から固有仕様を創作しない。', owner)
+                gap['character_authority'] = cite(118 + i)
+                categories[category] = {'common_rule_refs': refs[category], 'character_specific': gap}
+                if category == 'interruption_cancellation':
+                    categories[category].update(route_termination_authorities=[cite(148),cite(153)],
+                        legacy_classification='legacy_not_original', legacy_reason=LEGACY_REASON,
+                        legacy_evidence=[e for r in rules if r['id']=='threshold_route_loss'
+                                         for e in r['legacy_evidence'] if e['path']==SERVICE and e['lines']==[343,355]])
+
+            cells.append({'character_id': key, 'name': name, 'route_id': route, 'route': route_name,
+                          'natural_route_complete': False, 'categories': categories})
+    return {'task_id': 'P19-03-TABLE', 'schema_version': 1,
+            'identity_policy': '原本§6の名前とatomic entity.keyを監査IDに使用。実装IDを捏造しない。カタログにはheroine_anriのみ。OriginalRelationshipStateはsubject_idを保持し7名の列挙はしない。',
+            'source_anchor': ANCHOR, 'common_rules': rules, 'cells': cells,
+            'authority_snapshots': {PLAN + name: {
+                'sha256': sha(data), 'anchored_base_commit': BASE,
+                'records': definition_projection(decode(data)) if name == 'work_packages.json'
+                else decode(data) if name == 'decisions.json' else atoms}
+                for name, data in anchored.items()},
+            'catalog_evidence': evidence(CATALOG, 1, 32),
+            'pending': {'D05': 'pending', 'D08': 'pending', 'thresholds': None, 'rates': None, 'initial_values': None},
+            'route_support': {r: {'UI': '欠損: 原本行動・3種決闘・原本3軸/盾の通常操作なし。既存汎用関係UIを原本ルートとしない。',
+                'Runtime': 'partial: 原本明示状態の登録・identity検証のみ。共通更新と通常ルート到達は欠損。',
+                'save': 'partial: 専用状態/旧値コンテナ保存あり。人物固有進行・中断再開は欠損。',
+                'Windows': '未受入: global same-Windows acceptanceはopen。文書単位のnative GUI/Windows実行は適用外。',
+                'evidence_refs': ['legacy_event_ui', 'identity_registration', 'snapshot_container', 'state_fields'],
+                'missing_mechanisms': [x[0] for x in clauses]} for r in ROUTES.values()},
+            'acceptance': '7名×3ルートの到達表があり、未制作内容は欠損として残る。',
+            'accounting': '14/88 unchanged; formal Runner validation, independent whole-unit Opus review and normal integration/final required; no game acceptance'}
+
+
+def verify(candidate, canonical, root=None):
+    require(type(candidate) is dict, 'document must be an object')
+    if root is not None:
+        validate_legacy(root, candidate)
+    # Exact canonical equality also rejects additions, type coercion, invented numbers,
+    # owner/status promotion and unsupported completion, including nested metadata.
+    require(json.dumps(candidate, ensure_ascii=False, sort_keys=True) ==
+            json.dumps(canonical, ensure_ascii=False, sort_keys=True), 'table differs from pinned canonical audit')
+
+
+def verify_records(candidate, canonical, markdown_bytes):
+    verify(candidate, canonical)
+    require(markdown_bytes == markdown(canonical).encode(), 'Markdown drift')
+
+
+def markdown(d):
+    lines = ['# P19-03 到達表', '', d['acceptance'], '', d['identity_policy'], '',
+             '共通原本ルールと人物固有欠損を分離する。implementedは狭い保持処理だけで、自然ルート完成ではない。', '',
+             '|人物ID|原名|ルート|現在の到達性|', '|---|---|---|---|']
+    for c in d['cells']:
+        lines.append('|%s|%s|%s|欠損・通常到達未証明|' % (c['character_id'], c['name'], c['route']))
+    lines += ['', '## 共通原本ルール', '']
+    for r in d['common_rules']:
+        lines += ['### ' + r['id'], '', r['status'] + ' / owner: ' + r['owner'], '',
+                  r['observation'], '', '原本 %s:%s–%s' % (BASELINE, *r['authority']['lines']), '',
+                  '```text', r['authority']['text'], '```', '',
+                  '実装証拠: ' + json.dumps(r['implementation'], ensure_ascii=False, sort_keys=True), '']
+        if 'legacy_evidence' in r:
+            lines += ['旧実装: ' + r['legacy_classification'] + ' / ' + r['legacy_reason'], '',
+                      '旧証拠 (git_blob_oid: Git blob OID; sha256: file-bytes SHA-256): ' +
+                      json.dumps(r['legacy_evidence'], ensure_ascii=False, sort_keys=True), '']
+    for c in d['cells']:
+        lines += ['## ' + c['character_id'] + ' / ' + c['name'] + ' / ' + c['route'], '']
+        for category, record in c['categories'].items():
+            g = record['character_specific']
+            lines += ['- ' + category + ': 共通 [' + ', '.join(record['common_rule_refs']) +
+                      '] / missing / ' + g['gap'] + ' / owner: ' + g['owner'] +
+                      ' / 原本 ' + str(g['authority']['lines']) + '・人物 ' + str(g['character_authority']['lines'])]
+            if category == 'interruption_cancellation':
+                lines += ['  原本中断参照: ' + json.dumps(record['route_termination_authorities'], ensure_ascii=False),
+                          '  旧確定ロック legacy_not_original: ' + json.dumps(record['legacy_evidence'], ensure_ascii=False)]
+        lines.append('')
+    lines += ['## ルート別適用性', '']
+    for route, support in d['route_support'].items():
+        lines += ['### ' + route, '']
+        lines += ['- ' + k + ': ' + v for k, v in support.items() if isinstance(v, str)]
+        lines += ['- 欠損機構: ' + ', '.join(support['missing_mechanisms']), '']
+    lines += ['Authority snapshots: anchored_base_commit=' + BASE +
+              '; JSON retains anchored blob SHA-256 and projected definition records.', '']
+    lines += ['D05/D08、閾値・率・初期値はpending。完全な出典本文・SHA・原子要件全レコードはJSONに保持する。', '', d['accounting'], '']
+    return '\n'.join(lines)
+
+
+def main():
+    p = argparse.ArgumentParser(description=__doc__)
+    p.add_argument('--project-root', type=Path, required=True)
+    mode = p.add_mutually_exclusive_group(required=True)
+    mode.add_argument('--check', action='store_true')
+    mode.add_argument('--write', action='store_true')
+    mode.add_argument('--source-binding-only', action='store_true')
+    args = p.parse_args()
+    try:
+        root = args.project_root.resolve()
+        result = binding(root)
+        if not args.source_binding_only:
+            canonical = expected(root)
+            validate_legacy(root, canonical)
+            if args.write:
+                (root / OUT / 'REACHABILITY_TABLE.json').write_text(json.dumps(canonical, ensure_ascii=False, indent=2) + '\n', encoding='utf-8')
+                (root / OUT / 'REACHABILITY_TABLE.md').write_text(markdown(canonical), encoding='utf-8')
+            else:
+                validate_legacy(root, decode((root / OUT / 'REACHABILITY_TABLE.json').read_bytes()))
+                verify_records(decode((root / OUT / 'REACHABILITY_TABLE.json').read_bytes()), canonical,
+                               (root / OUT / 'REACHABILITY_TABLE.md').read_bytes())
+        print(json.dumps({'audit_integrity': 'pass', 'formal_acceptance': 'pending_runner_and_independent_review', **result}))
+        return 0
+    except (ValueError, OSError, KeyError, TypeError, subprocess.CalledProcessError) as e:
+        print(json.dumps({'audit_integrity': 'fail', 'error': str(e)}))
+        return 1
+
+
+if __name__ == '__main__':
+    sys.exit(main())

docs/plans/original-completion-2026-10-02/execution/p19-03/test_reachability_table.py

@@ -0,0 +1,284 @@
+#!/usr/bin/env python3
+"""Meaningful in-memory controls; no product, Git or fixture writes."""
+import argparse
+import copy
+from pathlib import Path
+import unittest
+from unittest.mock import patch
+import check_reachability_table as audit
+
+ROOT = None
+
+
+class AuditTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.canonical = audit.expected(ROOT)
+
+    def reject(self, mutate):
+        changed = copy.deepcopy(self.canonical)
+        mutate(changed)
+        with self.assertRaises(ValueError):
+            audit.verify(changed, self.canonical)
+
+    def register_output(self, data):
+        original = Path.read_bytes
+        def read(path):
+            return data if path == ROOT / audit.PLAN / "work_packages.json" else original(path)
+        with patch.object(Path, "read_bytes", read):
+            document = audit.expected(ROOT)
+        import json
+        self.assertEqual(json.dumps(document, ensure_ascii=False, indent=2) + "\n",
+                         (ROOT / audit.OUT / "REACHABILITY_TABLE.json").read_text())
+        self.assertEqual(audit.markdown(document).encode(),
+                         (ROOT / audit.OUT / "REACHABILITY_TABLE.md").read_bytes())
+
+    def test_actual_main_and_candidate_metadata(self):
+        for commit in ("6e17cae", "1875b03"):
+            with self.subTest(commit=commit):
+                self.register_output(audit.blob(ROOT, commit, audit.PLAN + "work_packages.json"))
+
+    def test_final_ledger_metadata(self):
+        import json
+        register = audit.decode(audit.blob(ROOT, audit.BASE, audit.PLAN + "work_packages.json"))
+        package = next(p for p in register if p["id"] == "P19")
+        unit = next(u for u in package["remaining_deliverables"] if u["id"] == "P19-03")
+        package.update(state="completed", legacy_state="completed",
+                       current_summary="ledger completion", updated_at_jst="2026-10-17")
+        unit.update({key: "synthetic final reference" for key in audit.UNIT_MUTABLE})
+        unit["evidence"] = [{"path": "docs/final.json", "sha256_at_integration": "0" * 64}]
+        unit["remaining_gaps"] = []
+        self.register_output(json.dumps(register).encode())
+
+    def test_every_register_definition_field(self):
+        import json
+        base = audit.decode(audit.blob(ROOT, audit.BASE, audit.PLAN + "work_packages.json"))
+        # Independently mutate/remove every package and unit definition field.
+        # Compare full nested values; unknown additions fail at both record levels.
+        def visit(value, path=(), level="packages"):
+            if isinstance(value, list):
+                yield path, "count"
+                if len(value) > 1:
+                    yield path, "order"
+                for i, child in enumerate(value):
+                    yield from visit(child, path + (i,),
+                                     "package" if not path else "unit" if path[-1] == "remaining_deliverables" else "nested")
+            elif isinstance(value, dict):
+                yield path, "unknown"
+                excluded = audit.PACKAGE_MUTABLE if level == "package" else audit.UNIT_MUTABLE if level == "unit" else ()
+                for key, child in value.items():
+                    if key in excluded:
+                        continue
+                    yield path + (key,), "change"
+                    yield path + (key,), "remove"
+                    if key == "remaining_deliverables":
+                        yield from visit(child, path + (key,), "units")
+                    elif isinstance(child, list):
+                        yield path + (key,), "count"
+                        if len(child) > 1 and child[0] != child[1]:
+                            yield path + (key,), "order"
+
+        seen = set()
+        anchored = audit.blob(ROOT, audit.BASE, audit.PLAN + "work_packages.json")
+        for path, operation in visit(base):
+            # Each distinct definition key/structural path once; repeated records
+            # use the same schema, so do not pad by testing it 30/88 times.
+            shape = tuple("*" if type(part) is int else part for part in path)
+            if (shape, operation) in seen:
+                continue
+            seen.add((shape, operation))
+            changed = copy.deepcopy(base)
+            target = changed
+            for key in path[:-1]:
+                target = target[key]
+            value = target[path[-1]] if path else changed
+            if operation == "change":
+                target[path[-1]] = {"altered_definition": True}
+            elif operation == "remove":
+                del target[path[-1]]
+            elif operation == "unknown":
+                value["unknown_metadata"] = "must fail"
+            elif operation == "count":
+                value.append({})
+            else:
+                value[0], value[1] = value[1], value[0]
+            with self.subTest(path=path, operation=operation), patch.object(audit, 'blob', return_value=anchored), self.assertRaises(ValueError):
+                audit.validate_register(ROOT, "work_packages.json", json.dumps(changed).encode())
+
+    def test_atomic_decision_and_selection_integrity(self):
+        import json
+        for name in ("atomic_requirements.json", "decisions.json"):
+            data = audit.blob(ROOT, audit.BASE, audit.PLAN + name)
+            with self.subTest(name=name), self.assertRaises(ValueError):
+                audit.validate_register(ROOT, name, data + b" ")
+            changed = audit.decode(data)
+            if name == "atomic_requirements.json":
+                changed["requirements"][0]["id"] = "changed_atomic_requirement"
+                with self.assertRaises(ValueError):
+                    audit.validate_register(ROOT, name, json.dumps(changed).encode())
+        decisions = audit.decode(audit.blob(ROOT, audit.BASE, audit.PLAN + "decisions.json"))
+        def flip(value, identity):
+            if isinstance(value, dict):
+                if value.get("id") == identity:
+                    value["status"] = "approved"
+                    return True
+                return any(flip(v, identity) for v in value.values())
+            if isinstance(value, list):
+                return any(flip(v, identity) for v in value)
+            return False
+        for identity in ("D05", "D08"):
+            changed = copy.deepcopy(decisions)
+            self.assertTrue(flip(changed, identity))
+            with self.subTest(identity=identity), self.assertRaises(ValueError):
+                audit.validate_register(ROOT, "decisions.json", json.dumps(changed).encode())
+        original = Path.read_bytes
+        target = ROOT / audit.OUT / "ACTUAL_OPUS_NEXT_ORIGINAL_UNIT_SELECTION.json"
+        def corrupt(path):
+            return original(path) + (b" " if path == target else b"")
+        with patch.object(Path, "read_bytes", corrupt), self.assertRaises(ValueError):
+            audit.expected(ROOT)
+
+    def test_valid_implemented_partial_missing(self):
+        # All three legitimate status classes must survive serialization and the
+        # exact same verifier used by --check, without status promotion.
+        import json
+        value = audit.decode(json.dumps(self.canonical))
+        self.assertEqual({r['status'] for r in value['common_rules']}, {'implemented', 'partial', 'missing'})
+        audit.verify(value, self.canonical)
+
+    def test_independent_legacy_source_evidence(self):
+        import subprocess
+        document = audit.decode((ROOT / audit.OUT / 'REACHABILITY_TABLE.json').read_bytes())
+        audit.validate_legacy(ROOT, document)
+        for rule in document['common_rules']:
+            for entry in rule.get('legacy_evidence', []):
+                data = subprocess.check_output(['git', 'show', audit.ANCHOR + ':' + entry['path']], cwd=ROOT)
+                self.assertEqual(data, (ROOT / entry['path']).read_bytes())
+                self.assertEqual(entry['git_blob_oid'], subprocess.check_output(
+                    ['git','hash-object','--stdin'], input=data, cwd=ROOT).decode().strip())
+                start, end = entry['lines']
+                self.assertEqual(entry['text'], '\n'.join(data.decode().splitlines()[start-1:end]))
+        rules = {r['id']: r for r in document['common_rules']}
+        self.assertIn('func restore_shield', rules['love_actions']['legacy_evidence'][0]['text'])
+        self.assertIn('shield_broken', rules['zero_break']['legacy_evidence'][0]['text'])
+        self.assertIn('EXCLUSIVE_LOCKED', rules['threshold_route_loss']['legacy_evidence'][1]['text'])
+
+    def test_legacy_evidence_required_independently(self):
+        for identity in audit.LEGACY_RANGES:
+            for mutation in ('drop', 'empty', 'absence', 'blob', 'text'):
+                changed = copy.deepcopy(self.canonical)
+                rule = next(r for r in changed['common_rules'] if r['id'] == identity)
+                if mutation == 'drop':
+                    rule.pop('legacy_evidence')
+                elif mutation == 'empty':
+                    rule['legacy_evidence'] = []
+                elif mutation == 'absence':
+                    rule['implementation'] = 'not implemented'
+                else:
+                    rule['legacy_evidence'][0]['git_blob_oid' if mutation == 'blob' else 'text'] = 'stale'
+                with self.subTest(identity=identity, mutation=mutation), self.assertRaises(ValueError):
+                    audit.validate_legacy(ROOT, changed)
+
+    def test_exact_cell_product(self):
+        mutations = {
+            'missing': lambda d: d['cells'].pop(),
+            'duplicate': lambda d: d['cells'].append(copy.deepcopy(d['cells'][0])),
+            'wrong_character': lambda d: d['cells'][0].update(character_id='unregistered'),
+            'wrong_route': lambda d: d['cells'][0].update(route='unregistered'),
+        }
+        for name, mutate in mutations.items():
+            with self.subTest(name=name):
+                self.reject(mutate)
+
+    def test_categories_and_citations(self):
+        self.reject(lambda d: d['cells'][0]['categories'].pop('save_handling'))
+        self.reject(lambda d: d['common_rules'][0].pop('authority'))
+        self.reject(lambda d: d['cells'][0]['categories']['state_conditions']['character_specific'].pop('character_authority'))
+
+    def test_stale_record_evidence(self):
+        for field in ('text', 'baseline_sha256'):
+            with self.subTest(field=field):
+                self.reject(lambda d: d['common_rules'][0]['authority'].update({field: 'stale'}))
+        for field in ('text', 'sha256', 'anchor'):
+            with self.subTest(field=field):
+                self.reject(lambda d: d['common_rules'][0]['implementation'].update({field: 'stale'}))
+
+    def test_real_source_and_baseline_changes(self):
+        original = Path.read_bytes
+        for target in (audit.BASELINE, audit.STATE):
+            def corrupt(path):
+                value = original(path)
+                return value + b'\nchanged' if path == ROOT / target else value
+            with self.subTest(target=target), patch.object(Path, 'read_bytes', corrupt):
+                with self.assertRaises(ValueError):
+                    audit.expected(ROOT)
+        actual_blob = audit.blob
+        def corrupt_blob(root, commit, path):
+            value = actual_blob(root, commit, path)
+            return value + b'\nchanged' if path == audit.STATE else value
+        with patch.object(audit, 'blob', side_effect=corrupt_blob):
+            with self.assertRaises(ValueError):
+                audit.expected(ROOT)
+
+    def test_no_invented_values_or_completion(self):
+        self.reject(lambda d: d['pending'].update(thresholds=50))
+        self.reject(lambda d: d['common_rules'][5].update(status='implemented'))
+        self.reject(lambda d: d['cells'][0].update(natural_route_complete=True))
+        self.reject(lambda d: d['cells'][0]['categories']['entry_required_events']['character_specific'].update(status='implemented', gap=None))
+
+    def test_owner_and_status(self):
+        self.reject(lambda d: d['common_rules'][0].update(owner='P99-01'))
+        self.reject(lambda d: d['common_rules'][0].update(owner='P19-02'))
+        self.reject(lambda d: d['common_rules'][0].update(status='complete'))
+
+    def test_json_and_types(self):
+        for data in ('{', '{"x":1,"x":2}', '{"x":NaN}'):
+            with self.subTest(data=data), self.assertRaises(ValueError):
+                audit.decode(data)
+        for value in ([], None, 'table'):
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                audit.verify(value, self.canonical)
+        self.reject(lambda d: d.update(cells={}))
+        self.reject(lambda d: d.update(schema_version=True))
+
+    def test_markdown_drift(self):
+        expected = audit.markdown(self.canonical).encode()
+        audit.verify_records(self.canonical, self.canonical,
+                             (ROOT / audit.OUT / 'REACHABILITY_TABLE.md').read_bytes())
+        with self.assertRaises(ValueError):
+            audit.verify_records(self.canonical, self.canonical, expected + b'\nchanged')
+
+    def test_full_frozen_map_and_identities(self):
+        audit.binding(ROOT)  # Valid frozen-map control; no native execution.
+        actual_selection = audit.selection(ROOT)
+        for kind in ('missing', 'new', 'changed'):
+            changed = copy.deepcopy(actual_selection)
+            key = next(iter(changed))
+            if kind == 'missing':
+                del changed[key]
+            elif kind == 'new':
+                changed['scripts/invented.gd'] = {'bytes': 0, 'sha256': '0' * 64}
+            else:
+                changed[key]['sha256'] = '0' * 64
+            with self.subTest(kind=kind), patch.object(audit, 'selection', return_value=changed):
+                with self.assertRaises(ValueError):
+                    audit.binding(ROOT)
+        original = Path.read_bytes
+        pins = audit.decode(original(ROOT / audit.OUT / 'FROZEN_GAME_INPUT_PINS.json'))
+        targets = [ROOT / audit.OUT / 'FROZEN_GAME_INPUT_PINS.json', ROOT / pins['marker_contract_path'],
+                   ROOT / pins['policy_path'], Path(pins['engine_path'])]
+        for target in targets:
+            def corrupt(path):
+                value = original(path)
+                return value + b'\nchanged' if path == target else value
+            with self.subTest(target=str(target)), patch.object(Path, 'read_bytes', corrupt):
+                with self.assertRaises(ValueError):
+                    audit.binding(ROOT)
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--project-root', type=Path, required=True)
+    args, rest = parser.parse_known_args()
+    ROOT = args.project_root.resolve()
+    unittest.main(argv=[__file__] + rest)

docs/plans/original-completion-2026-10-02/execution/p24-02/normal-os-case-20261017/AUTHORITATIVE_NARROW_CASE_CLARIFICATIONS.json

@@ -0,0 +1,49 @@
+{
+  "scope": "Authoritative limited-case factual clarification after separate Opus review. Original primary files kept unchanged, no new gameplay/OS execution",
+  "source": {
+    "S": "fe44f550750acbf5c510346e7cacbea2ccbdd184",
+    "M": "565fd805079d8c446f29e30c57979242561113ea",
+    "Q": "42989fd90f5f83db86f846eb42b5cf2d847461a5",
+    "T": "905d844d523529862259d1b7a210fd1e7964f054"
+  },
+  "actual_review_run": "b4160dbc2bca407598d2fc2e22bff24f",
+  "actual_pause_seconds": 89.116049,
+  "actual_clock_samples": 824,
+  "sample_count_scope": "824 clock/paused-state samples, not 847 (which was sequence span); none of the per-sample rows contains a full-model digest",
+  "model_identity_scope": {
+    "checkpoints": {
+      "paused_before_menu": 2254,
+      "new_slot_dialog": 2565,
+      "cancelled": 2797
+    },
+    "digest": "077b7b8106f2448586e2ca9617e7c5525f7a7f90a71d12928a089cbe7ef1d633",
+    "binary_sha256": "7a166acfe98c39dc4432058b054e66aaa5f28485dc78ae9b406d8fa2b35204f3",
+    "continuous_model_identity_not_proven": true
+  },
+  "focus_scope": {
+    "root_viewport_focus_owner_unchanged": "/root/Main/@MarginContainer@13/@VBoxContainer@14/TopBar/@HBoxContainer@15/@Button@42",
+    "dialog_label_focused_on_open": true,
+    "dialog_label_unfocused_after_cancel": true,
+    "restoration_mechanism_proven": false
+  },
+  "input_scope": {
+    "actual_CUA_clicks": 7,
+    "root_mouse_rows": 7,
+    "embedded_popup_and_dialog_native_mouse_rows": false,
+    "embedded_action_evidence": "Actual tool-time windows + actual production menu3/cancel callbacks, not a native-parent mouse ACK",
+    "CUA_log": "exact semantic transcription after close, not a machine-emitted CUA log; first6 before hashes null; after hashes preserved; CUA screen byte files not in local material",
+    "independent_pixels": "five actual viewport PNGs inspected by Opus, never claimed as CUA images"
+  },
+  "schema_scope": {
+    "original8_denominator_unchanged": true,
+    "whole_verify": "honest incomplete rejection at placement group, no modal coverage loop inside fullverify",
+    "supported_record_primitives": "Root checked nonopaque fields/provenance/monotonic receipt range; later exact pointer probe documented separately",
+    "correction_file": "SUPPLEMENT_ACTUAL_POINTER_PROBE.json"
+  },
+  "private_data_scope": "empty pending queue; fresh-profile manual package absent; no existing-save preservation or nonempty pending case inferred",
+  "normal_exit": "owned syntax21759 and OS21770 exited0, all reader/source/default-player/cleanup guards0; both fresh profiles fully retained then cleaned",
+  "remaining_original_conditions": "all8 unaccepted; whole formal review/full roster/normal integration-final/Windows and all unexecuted cases stay required",
+  "original_formal_units": 14,
+  "new_credit": 0,
+  "at_unix_ns": 1792221809906511000
+}

docs/plans/original-completion-2026-10-02/execution/p24-02/normal-os-case-20261017/CURRENT_AND_NEXT.md

@@ -0,0 +1,17 @@
+# 現在と次の成果単位（2026-10-17）
+
+正式完了は14／88成果、30パッケージ。今回の限定ケースによる完了加算は0。
+
+P24-02はin_progress、Runner提出fe44f550750acbf5c510346e7cacbea2ccbdd184、通常統合候補なし。実main565fd805との準備合成Q42989fd9／T905d844dで通常OS操作を採取した。Qは証拠採取用で、正式統合候補ではない。
+
+通常メニューから別名保存ダイアログを開き、取消して再開し、通常ウィンドウ終了した。824回の時刻・停止サンプル（89.116049秒）で停止を確認し、3節目のモデルが一致した。独立Claude Opus5.5セッションb4160dbc2bca407598d2fc2e22bff24fはこの限定範囲でpass、critical/high/medium0。全8原条件のレビューではなく、フォーカス復元機構・既存保存・非空コマンド列の保全は証明していない。厳密な限界は同梱のAUTHORITATIVE_NARROW_CASE_CLARIFICATIONS.jsonを正とする。
+
+P24残件は全8原条件、配置と無効ドロップ、確認・復元、IME、倍率、ダイアログ背後の有効対象、吹出し・ログ・代替操作、重要警告の自然発生、最終全回帰・正式独立レビュー・通常統合final・同一Windows等。重要警告はP18/P19/P21等の実装に依存するため、限定プローブだけを積み増さない。原条件を縮小しない。
+
+次の優先候補はOpus実判断6004541957cd42cf9bae1868df1a31c8が選定したP04-01「同時発生の更新規約」。閉店・停電・破壊・退出・課金・交代・00:00決算の全7領域について、停止中課金0・二重精算0・孤立予約0を満たし、全15条件＋EVの版付き証拠、必要検証、独立した全体レビュー、通常統合final、台帳反映まで必要。P06等の基盤で既存証拠が多い点を選定理由とする。
+
+選定判断に含まれたaccd時点の不足推定を現状態へ読み替える。実Runner再確認ではP04提出は2dde7596、repair29、未稼働、worktree差分0。登録validationはpassでも正式レビュー275d1fd6はD05残4規則未確定などにより不合格。再修正や再試験はまだ起動していない。最新29の実差分と原条件をOpusへ提示し、既修正箇所を再実装せず、残4規則の必須性・具体的選択肢・独立して進める残修正を再判断中。既存2承認を維持し、未回答を承認扱いにしない。
+
+古いP04文書の13／88や旧mainは作成時点の履歴であり、現時点の正式数・適用版として再利用しない。全条件が揃うまでP04も完了加算しない。
+
+最新再判断ea12167c：raw結合・getter・HEAD fixture等は既に修正29までに是正済み。重複修正を起動しない。残る規則の具体的選択肢をユーザーへ提示した。回答後に破壊根拠pin/承認記録/現況説明を1回にまとめて通常修正し、必要な最終ゲートへ進む。回答を推定せず、記録のみによる完了加算もしない。

docs/plans/original-completion-2026-10-02/execution/p24-02/normal-os-case-20261017/EVIDENCE_MANIFEST.json

@@ -0,0 +1,34 @@
+{
+  "created_unix_ns": 1792222099990910000,
+  "files": [
+    {
+      "file": "AUTHORITATIVE_NARROW_CASE_CLARIFICATIONS.json",
+      "source": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p24-02-operations/.runtime/coordinator-os-scenario-20261017-r01/AUTHORITATIVE_NARROW_CASE_CLARIFICATIONS.json",
+      "sha256": "fd83e2edd4ac00bc9f8c568f6283ee47af43f91ef06336d36d775508a96682a5",
+      "bytes": 2833
+    },
+    {
+      "file": "ACTUAL_OPUS_LIMITED_REVIEW.json",
+      "source": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p24-02-operations/.runtime/coordinator-os-scenario-20261017-r01/ACTUAL_ONE_SCENARIO_INDEPENDENT_REVIEW_RESULT_MIRRORED_R02.json",
+      "sha256": "f9feeb5b18d3e67c2b6bd72d130068e856c9145cde89951519169549c2985e16",
+      "bytes": 141526
+    },
+    {
+      "file": "ACTUAL_OPUS_NEXT_UNIT_SELECTION.json",
+      "source": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p24-02-operations/runs/6004541957cd42cf9bae1868df1a31c8/result.json",
+      "sha256": "777c7f73e43df8801adfc29b9b0facb0474dba79fc5e8f11883d79e6ab3a8c92",
+      "bytes": 7523
+    },
+    {
+      "file": "FRESH_BINDING_AND_SOURCE_APPLICABILITY.json",
+      "source": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p24-02-operations/.runtime/coordinator-os-scenario-20261017-r01/FRESH_BINDING_AND_SOURCE_APPLICABILITY.json",
+      "sha256": "f01469d2d8a985750ca4103591067b63db7a319c015b493ad6635640247a3102",
+      "bytes": 307105
+    }
+  ],
+  "raw_capture_preserved_at": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p24-02-operations/.runtime/P24-02/build/audit-support/p24-os-normal-r01/capture",
+  "formal_credit": 0,
+  "original_packages": 30,
+  "original_units": 88,
+  "original_complete": 14
+}

docs/plans/original-completion-2026-10-02/execution/p26-01/IMPLEMENTATION_REPORT.md

@@ -0,0 +1,75 @@
+# P26-01 全必要内容の台帳 — 修復提出
+
+対象は P26-01 / AC-P26-01。原作業「全章、7名の3ルート、全エンド、台詞、立ち絵、音声の必要枠と条件を確定する。」、原受入「原本で要求された未制作内容を欠損として記録し、架空の完成数を置かない。」を保持する。自己受入せず、30パッケージ / 88単位、正式完了15、今回加算0、partial_credit=false、whole_unit_accepted=falseを維持する。
+
+変更は契約の5成果物のみ。TASK_SPEC、Opus選択、frozen pins、原本・AR・計画・決定・修復回数は変更しない。git書込み、他エージェント、Runner操作、native/full run、ゲーム・素材・設定・権限・API変更は行っていない。新規素材の導入はない。
+
+## 引継ぎと決定の版
+
+build/owner-handoff/p26-repair3/ の ACTUAL_WHOLE_REVIEW.json、ACTUAL_OPUS_REPAIR3.json、D05_ACTUAL_HUMAN_APPROVAL.json、D05_APPROVAL_SOURCE_BINDING.json を編集前に全文読み、データとして照合した。開始時に存在した前回blocked報告の承認出典不足は、この4資料により解消している。
+
+監査アンカーは f4f85bc54c39361f9efcd16f67a17835559ca70c、原計画定義ベースは 379a1ba8fd25b5ad24226178a2492f91761dc31d。この両時点ではD05の残質問は未解決として登録されていた、という歴史的事実のみを保存する。現在のD05が未回答だとは記述しない。
+
+現在の実承認は a13f7c0b791dd385ff8113c3d321c0e3fe7d7c94 の docs/plans/original-completion-2026-10-02/execution/p04-01-owner-approval-20261018/D05_ACTUAL_HUMAN_APPROVAL.json、SHA256 cd365ded1b777a0327d090709f0a4161f5005562819183455d9f2e106fba3e96。チェッカーはこのgit objectのhashを照合し、4回答の原レコードを台帳に保存する。質問IDは call_5fa8987f83284eb58b685002499cb9df。破壊/完了、日付境界、停止理由、退出順序の承認であり、P04への製品採用・内容完成・P26受入ではない。D08/D09は未解決。
+
+## 修復5: 証拠のAR別帰属
+
+今回の変更前に build/owner-handoff/p26-support-attribution-repair/ACTUAL_OPUS_ASTRA_ATTRIBUTION_DIRECTION.json と ACTUAL_WHOLE_REVIEW_DA80360A.json を全文読了し、D05の上記4資料も再確認した。修復5は証拠帰属に限定する。
+
+結合した引用文のキーワードからpartialを付ける処理を削除した。SUPPORT_POLICYは証拠種別→許容ARの閉じた対応表である。関係状態は21ルートと感情3軸/盾最大値の明示状態・保存だけ、覗きは記録係/観察/証拠収集に関する列挙ARの停止中コンテナだけ、夜間は2 ARの欲求入力だけ、赤字は終端計算ARだけを支援する。人物のidentity/技能や任意のrelationship/route_action全域へは拡張しない。視点・角度・介入そのものを支援する証拠とはしない。
+
+各行のscoped_supportは対象AR・証拠種別・限定範囲・content_status=missingを明記する。unsupported_atomic_requirement_idsはその行で基盤支援がない残りのARを列挙する（用途行の既存placeholder/code-drawingは従来どおり別記）。L9は21ルートのコンテナだけpartialで、全エンド/図鑑/所要時間は未支援。L257とclause.productionは観察工程のコンテナだけpartialで、ボイス収録/実装を含む他ARは未支援。voice.all、endings全3行、encyclopedia.allはmissing、証拠なし。声に関するどのARも対応表に入れない。行数・AR対応・引用・制作数量は増減させない。
+
+verify_authorityはexpectedやcanonicalを呼ばず、提出された各claimのARと行の種類、固定出典・抜粋全文、支援/未支援ARの分割、状態と範囲文を検査する。有効なSHAでも無関係な証拠、無根拠なpartial、声への同一引用行の観察証拠の流用は拒否する。負例はmissingの音声/立ち絵/エンド/図鑑への証拠注入、混合行内の支援AR拡張、正しい夜間支援への無関係な証拠追加を含む。route、L65、L53の実際のpartialを正例にする。既存負例は維持し、AR削除負例だけ新しい分割フィールドも整合して削除する。
+
+矛盾した「no dedicated support established; …only」の連結を廃止した。任意LOWのL226はAR.ui.cut_duel/cut_defenseの対象外理由にP24 UIカットインを明記した。owner決定用content ARの追加分類は、既存の原典リンクと所有先を狭める別の判断が必要なため今回はdeferred。ownerは引き続き引用ARのprimary_packageに基づく追跡先で、専任制作担当の確定ではない。
+
+## whole-unit対応と残存不足
+
+| 対象 | 実際の記録・修復 | 残存不足 |
+| --- | --- | --- |
+| 全章 | chapters.all、原本内容行、対応AR | 章名・章数・順序・シーン列は未定義。仕様書章番号を物語章数に転用しない |
+| 7名×3ルート | 原名の21 route行、人物別AR、P19セルの版固定と関係状態ソース | 共通状態・保存のみpartial。固有イベント列・自然到達・台詞・素材・終点はmissing、D08未決 |
+| 全エンド | endings.all / bad / game_overとAR | 全3行missing、全集合/本数は未定義。赤字終端の処理はoriginal.line.72の該当ARだけpartial |
+| 台詞/立ち絵/音声/図鑑 | 各総括行、原文個別行、人物/用途AR、P22全614枠 | 完成本文・画像・ボイス・項目集合の完成証拠なし。汎用BGM/UI音は声の代用にしない |
+| 原本欠落の修復 | original.line.13 / 53 / 65 / 196 / 221 / 222、各原文全文・行・SHAとAR | イベント/台詞/CG/音声/専用操作内容はmissing。個別場面数はundefined |
+| 独立網羅 | 原本テキストの内容語彙・節見出しとARドメイン/condition/source_anchorsから選択 | 機械的な保守的選択方針を明記し、独立レビューが原単位網羅を判定 |
+| AR独立確認 | atomic_dispositionsで全ARに原レコード引用・所管原P単位・明示処置 | 旧view_results/statusを転記せず、未再制作/未定義を完成に昇格しない |
+| 所有と状態 | 引用ARのprimary_package/work_packagesと原P単位定義に結合 | 複数原P単位から特定制作担当を推測しない。owner_assignmentに担当未定義を明記 |
+| 負例 | 省略イベント行、AR欠落/未知/処置欠落、AR不一致owner、route/usage状態、stale AR/原文/usage SHA、partial誤完成 | 正式実行はRunner |
+
+現在の生成物は762行（既存651行を保持し、選択した原文111行を追加）、関連AR675件。これは監査レコードの数であり、制作数量・完成数・受入分母ではない。全required_count/completed_countはnull。ARの関連選択外は追加施設契約/財布・採用等の別単位条件または独立メカニクスとして理由と原所有先を保持し、製品上の適用外/受入済みとはしない。
+
+各行はatomic_requirement_idsを持つ。対応ARがない原文も消さず、所有先undefinedとして残す。ownerは引用ARのprimary_package、owner_deliverable_refsは固定参照の原P単位定義を指す。ARごとのowning_deliverablesにはprimary_packageとwork_packagesの各パッケージの元のid/title/work/acceptanceを保存する。特定の1単位が専任と原本で決まっていない場合、候補定義全体と担当未定義を示す。clause.*を一律P26-03に割り当てる旧処理を除いた。
+
+## 現物の部分支援と欠損
+
+scripts/relationship/original_relationship_state.gd の明示値検証と relationship_service.gd の保存コンテナを直接参照する。route行と対応する原文行はpartialであり、content_status=missingを別記する。更新・攻撃・閾値・固有物語を実装済みとはしない。
+
+scripts/special/peeping_room_service.gd:127–162 と autoload/simulation_runtime.gd:10860–10880 を直接引用する。停止・対象参照・証拠キーの基盤はあるが、製品配置はBUILD_DEFINITION_PENDING_D04、記録はRECORDER_ELIGIBILITY_PENDING_D04_D08_P16で止まる。閉じた対応表にあるARのscoped_supportだけがこの基盤を指し、視界、専用画面、スクリーンショット、介入や制作イベントを証明しない。L13の自律観察/介入、L53の専用視点、L222の角度/介入にはこの証拠を帰属させない。
+
+scripts/guest/guest_service.gd:355–360 は夜間の欲求入力の切替のみ。L65のNTRイベント内容の制作証拠ではない。scripts/operations/operations_coordinator.gd:1183–1195 の赤字連続による終端計算は存在するが、完成シナリオ/画像/声ではない。L196の専用代物弁済イベントは現物制作証拠なしとしてmissing。数量/シーン列はundefinedのまま。
+
+P19/P22の旧状態をそのまま合否にしない。P19の正確な21セルと自然到達未完成の事実を版固定し、現在の関係ソースも独立参照する。P22全614用途レコードと全296mediaを保存し、表現先の現物SHAを監査アンカーへ再結合する。表現型からcode-drawing / placeholder / missingを区別し、歴史的inventoryのSHAと現在アンカーのSHAを別々に保持する。全assetsのパス/SHAも保存する。P22-03はdraft/unaccepted reference only。
+
+P22の公開入力は137639773c9017f9ee7733d78e37179b687f965cのaccepted-p22-01-inputs/、manifest SHA256 90b5a69d5f364012edabe5a68b8c7613f5f5ca47bc189d435dd2e69b8dd8c915 に固定。元artifacts別名が存在すれば同一バイト必須、なければ公開git objectを読む。
+
+## 検査の構造と実行状況
+
+check_content_ledger.py はstdlibのみ。--checkは読取専用の台帳/出典/入力/Markdown検査、--source-binding-onlyは出典結合と台帳検査、--writeは指定JSON/Markdown生成。JSON重複キー・非有限値は拒否する。
+
+authorities()は提出行や旧監査の合否を使わず、BASELINE本文の内容語彙/節見出し、ARのドメイン/condition/source_anchorsから必要行・ARを導く。選択条件はcoverage_policyに公開する。verify_authority()はcanonicalを引数に取らず、必要行とARの網羅、原文全文/行/hash、AR自身のrecord、所有原P単位、状態と表現pin、部分支援と内容欠損を検査する。canonical完全一致は追加のdrift検査として残す。原計画定義はベースへのprojectionで固定し、明示した進捗メタデータ以外の変更を拒否する。
+
+負例には従来の章/route/全エンド/category欠落、架空数、schema/type、重複ID、不正JSON、Markdown drift、原計画改変、公開manifest改変、ゲーム入力追加/欠落/改変を保持する。新しいindependent_rejectは正例も負例もverify_authorityだけを呼び、canonical一致に頼らずAR網羅・owner・状態・hash不正を捕捉する。各mutationに有効な提出資料のcontrolを置く。
+
+このworkerはJSON/Markdownの生成処理と読取による実装確認だけを行った。p26-ledger / p26-negative / p26-source-binding、--check、--source-binding-only、unittestは実行していない。PASSは主張しない。正式試験はRunnerが契約の3コマンドを実行する。
+
+修復5の生成後の読取比較では762行、1309 AR処置、675関連ARを保持し、全行のID・引用・ARリンクは開始時と同一。全required_count/completed_countはnull。JSONの変更した最上位領域はrowsとatomic_dispositionsのみで、D05の4回答を含む他の領域は同一。JSONとMDはexpected/markdownによる決定的生成であり、試験実行結果ではない。生成後に変更したcheckerの独立検証と負例はRunnerでの実行待ち。
+
+## 新Sと受入の残ゲート
+
+FROZEN_GAME_INPUT_PINS.json SHA256 6c778226a4cc6d0b0d682500759e7d4229c926a27bd2e247b00b9c3e5f1a2fb0 と、全1368 selected game inputs・settings・assets・tests・tools・marker・policy・engine・roster・329parse・default player identityの照合処理は保持する。docs helpersは対象ゲーム集合外。TASK_SPEC raw SHAは8026040345de6b7d06cfce40beac9150bfe9ad303d6b26c11bd94e66b1080b29、strip表現は1fedc9ade42a04722846daa9ac8ec26f821fb4efbce8dbbb53e3e76e31f38d02。
+
+旧SでのRoot source/input equality結果を新Sへ流用しない。workerはgit書込みを禁止されており、新Sの確定/Root qualificationはRunner・Rootの担当で未実行。新Sが存在した後に改めて全入力一致を資格確認する必要がある。
+
+native 184 suites / 21903 checks / 329 parse / 186 owned-endedは履歴のみ。新規native/full runなし。exact S/Cの独立適用性確認前に再利用を承認しない。whole-unit独立Opusレビュー、prepare-integration、exact C/M、normal final、Rootの台帳/main pushも未実行。P26-02/03・上流制作、D08/D09、held gestures、same-Windows、global acceptanceは未完/未受入であり、これらの完了は主張しない。15/88から16/88への加算は行わない。

docs/plans/original-completion-2026-10-02/execution/p26-01/TASK_SPEC.json

@@ -0,0 +1,102 @@
+{
+  "id": "P26-01-LEDGER",
+  "original_plan_id": "P26-01",
+  "title": "全必要内容の台帳",
+  "original_work": "全章、7名の3ルート、全エンド、台詞、立ち絵、音声の必要枠と条件を確定する。",
+  "original_acceptance": "原本で要求された未制作内容を欠損として記録し、架空の完成数を置かない。",
+  "original_denominator": {
+    "packages": 30,
+    "units": 88,
+    "completed_at_start": 15,
+    "partial_credit": false
+  },
+  "whole_original_unit_review_required": true,
+  "actual_opus_selection": "6b9bb7f7a8474689b4094efbfcde2eef",
+  "audit_source_anchor": "f4f85bc54c39361f9efcd16f67a17835559ca70c",
+  "scope": "Original documentation/audit unit only. Record content requirements, neutral abstract IDs, source traceability and missing/undefined production content. Do not author narrative, dialogue or intimate content or invent values. No game/asset code changes.",
+  "authority": [
+    {
+      "path": "docs/traceability/original/BASELINE.txt",
+      "sha256": "75e4bdbdeb379c9269553f0c776bdb9cc96e01f2d6aa5ca650d132c63a8aeb1a",
+      "scope": "Read all applicable original clauses, including chapters,7characters,3routes,endings,dialogue,portraits,voice and encyclopedia. Exact original citations, no invented counts."
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/work_packages.json",
+      "unit": "P26-01",
+      "original_definition_must_remain_exact": true
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/atomic_requirements.json"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/decisions.json",
+      "scope": "Only approved decisions apply; unresolved D08/D09 and other decisions remain explicit missing/undefined."
+    }
+  ],
+  "frozen_game_input_pins_sha256": "6c778226a4cc6d0b0d682500759e7d4229c926a27bd2e247b00b9c3e5f1a2fb0",
+  "reusable_sources": [
+    "docs/plans/original-completion-2026-10-02/execution/p19-03/REACHABILITY_TABLE.json",
+    "artifacts/original-completion-2026-10-02/p22-01-usage-contract-candidate-r02/",
+    "docs/plans/original-completion-2026-10-02/execution/p22-03/production_backlog.json"
+  ],
+  "implementation_requirements": [
+    "Produce CONTENT_LEDGER.json and deterministic CONTENT_LEDGER.md covering every original-required chapter/route/end/dialogue/portrait/voice/encyclopedia slot or explicit undefined scope.7originalcharacters crossed3originalroutes must retain exact identity. Enumerate original-defined end categories without inventing missing counts or scene lists.",
+    "Each requirement has exact original citation text/line/hash, required condition, current evidence/status, explicit source or asset path+SHA at audit anchor or explicit missing, reason, and owning remaining original deliverable/decision. Distinguish produced versus placeholder/code drawing/partial/missing/undefined. An existing generic/backend asset never proves all original content produced.",
+    "Reuse completed P19-03 route audit and P22-01 usage inventory with exact source pins. P22-03 backlog is draft/unaccepted reference only. Independently verify actual available content, do not just copy old statuses. Preserve known evidence and distinguish approved scope from unapproved candidate scope.",
+    "All unproduced or undefined content remains missing with reason and ownership; no fabricated quantity, threshold, completion count or D05/D08/D09 approval. The audit does not complete content/gameplay/Windows/global acceptance.",
+    "Implement stdlib checker check_content_ledger.py (--check read-only, --source-binding-only, optional --write) plus test_content_ledger.py under this docs directory only. Verify exact original full clause coverage; closed row/schema/unique IDs; source citation/pin integrity; truthful completion/unknown values and exact deterministic view. Do not use tautological generated facts as sole verification.",
+    "Meaningful negative tests for omitted original chapter/route/ending/category, fabricated count, missing item falsely produced, invalid owner/status/type, stale original/source/hash, malformed JSON and Markdown drift, with valid controls. No test inflation or native game runs.",
+    "Preserve immutable TASK_SPEC, selection and frozen pins. Anchor planning definitions to immutable base and keep all original30/88/acceptance/dependency definitions failclosed while allowing only explicit existing metadata progress fields; do not freeze entire mutable progress docs. Avoid prior P19 integration bug. All other source evidence exact and type-preserving.",
+    "Prove complete frozen1368 game inputs/settings/assets/tests/tools/marker/policy/engine/roster/parse/default player identity. No omitted/new/changed selected input; docs helpers stay outside selected game set. Reuse native184/21903/329parse/186ended only when applicability independently proven at exactS/C. No new uncontrolled full run.",
+    "Provide IMPLEMENTATION_REPORT.md mapping entire original unit to actual evidence and remaining gaps. Whole-unit independent Opus review must decide original acceptance; if pending scope prevents it, fail honestly with no credit. Normal prepare-integration/exactC-M/final then Root ledger/main push required before16/88."
+  ],
+  "required_outputs": [
+    "CONTENT_LEDGER.json",
+    "CONTENT_LEDGER.md",
+    "check_content_ledger.py",
+    "test_content_ledger.py",
+    "IMPLEMENTATION_REPORT.md"
+  ],
+  "validations": {
+    "p26-ledger": {
+      "argv": [
+        "{python}",
+        "-B",
+        "docs/plans/original-completion-2026-10-02/execution/p26-01/check_content_ledger.py",
+        "--project-root",
+        ".",
+        "--check"
+      ]
+    },
+    "p26-negative": {
+      "argv": [
+        "{python}",
+        "-B",
+        "docs/plans/original-completion-2026-10-02/execution/p26-01/test_content_ledger.py",
+        "--project-root",
+        "."
+      ]
+    },
+    "p26-source-binding": {
+      "argv": [
+        "{python}",
+        "-B",
+        "docs/plans/original-completion-2026-10-02/execution/p26-01/check_content_ledger.py",
+        "--project-root",
+        ".",
+        "--source-binding-only"
+      ]
+    }
+  },
+  "pending_not_waived": [
+    "P04 existing D05 questions",
+    "D08/D09 unresolved scopes",
+    "P26-02/03 and upstream production content",
+    "held gestures and sameWindows acceptance"
+  ],
+  "model_proposal": {
+    "codex_model": "gpt-6.1-sol",
+    "reason": "This is a documentation audit with a stdlib checker, following the proven P13-03/P19-03 pattern. P19-03 used Sol and closed with 2 repairs. It needs no game code, no native GUI and no new reasoning about game rules, so Astra's extra cost and usage isn't worth it."
+  },
+  "normal_OS_applicability": "Documentation audit introduces no product interaction. Existing route/save/UI support and missing requirements are audited; global and other-unit OS acceptance stays open."
+}

docs/plans/original-completion-2026-10-02/execution/p26-01/check_content_ledger.py

@@ -0,0 +1,617 @@
+#!/usr/bin/env python3
+"""P26 documentation audit. Stdlib only; --check never writes or runs Godot."""
+import argparse
+from functools import lru_cache
+import hashlib
+import json
+import re
+from pathlib import Path
+import subprocess
+import sys
+
+OUT = 'docs/plans/original-completion-2026-10-02/execution/p26-01/'
+PLAN = 'docs/plans/original-completion-2026-10-02/'
+BASELINE = 'docs/traceability/original/BASELINE.txt'
+BASE = '379a1ba8fd25b5ad24226178a2492f91761dc31d'
+ANCHOR = 'f4f85bc54c39361f9efcd16f67a17835559ca70c'
+BASE_HASH = '75e4bdbdeb379c9269553f0c776bdb9cc96e01f2d6aa5ca650d132c63a8aeb1a'
+PINS_HASH = '6c778226a4cc6d0b0d682500759e7d4229c926a27bd2e247b00b9c3e5f1a2fb0'
+SPEC_HASH = '1fedc9ade42a04722846daa9ac8ec26f821fb4efbce8dbbb53e3e76e31f38d02'
+P22 = 'artifacts/original-completion-2026-10-02/p22-01-usage-contract-candidate-r02/'
+PUBLISHED = '137639773c9017f9ee7733d78e37179b687f965c'
+ARCHIVE = OUT + 'accepted-p22-01-inputs/'
+MANIFEST_HASH = '90b5a69d5f364012edabe5a68b8c7613f5f5ca47bc189d435dd2e69b8dd8c915'
+P19 = PLAN + 'execution/p19-03/REACHABILITY_TABLE.json'
+BACKLOG = PLAN + 'execution/p22-03/production_backlog.json'
+PEOPLE = [('anri', 'アンリ'), ('fine', 'フィーネ'), ('tomari', 'トマリ'),
+          ('amelia', 'アメリア'), ('liz', 'リズ'), ('mimi', 'ミミ'), ('satsuki', 'サツキ')]
+ROUTES = {'love': '純愛', 'ntr': 'NTR', 'corruption': '堕落'}
+STATUSES = {'produced', 'placeholder', 'code-drawing', 'partial', 'missing', 'undefined'}
+AR_PATH = PLAN + 'atomic_requirements.json'
+CONTENT_WORDS = re.compile(r'章|ストーリー|シナリオ|ルート|エンド|図鑑|台詞|会話|立ち絵|ボイス|音声|CG|スチル|モーション|アニメ|差分|イベント|覗|記録係|脅迫|介入|カメラ|アングル|スクリーンショット|代物弁済|破産|履歴|妊娠|刻印|衣装|キャラクター|ヒロイン')
+CONTENT_DOMAINS = ('AR.heroine.', 'AR.asset.', 'AR.art.', 'AR.narrative.',
+                   'AR.observation.', 'AR.route_action.', 'AR.progression.')
+APPROVAL_COMMIT = 'a13f7c0b791dd385ff8113c3d321c0e3fe7d7c94'
+APPROVAL_PATH = PLAN + 'execution/p04-01-owner-approval-20261018/D05_ACTUAL_HUMAN_APPROVAL.json'
+APPROVAL_HASH = 'cd365ded1b777a0327d090709f0a4161f5005562819183455d9f2e106fba3e96'
+
+# Closed attribution policy: membership means only the named backend fragment,
+# never the whole AR, its content, or other ARs sharing its source line.
+SUPPORT_POLICY = {
+    'relationship-container': {
+        'ars': frozenset({'AR.relationship.three_emotions',
+                         'AR.relationship.affection_shield_max'} |
+                        {'AR.heroine.' + p + '.route.' + r for p, _ in PEOPLE for r in ROUTES}),
+        'sources': [('scripts/relationship/original_relationship_state.gd', None),
+                    ('scripts/relationship/relationship_service.gd', None)],
+        'scope': 'shared explicit relationship state/validation/save container only; no updates, attacks, thresholds, authored content or natural route completion'},
+    'peeping-container': {
+        'ars': frozenset({'AR.observation.recorder', 'AR.underground.observation',
+                         'AR.underground.blackmail', 'AR.route_action.observation_progress',
+                         'AR.ui.observation_camera_entry', 'AR.ui.observation_capture',
+                         'AR.schedule.B-14.3.observation'}),
+        'sources': [('scripts/special/peeping_room_service.gd', (127, 162)),
+                    ('autoload/simulation_runtime.gd', (10860, 10880))],
+        'scope': 'stopped room/target reference and fixture evidence-key container only; production placement/recorder eligibility pending; no view, camera UI, screenshot, intervention, transaction or authored content'},
+    'night-input': {
+        'ars': frozenset({'AR.events.ntr_night_peak', 'AR.guest.need_sexual_night_peak'}),
+        'sources': [('scripts/guest/guest_service.gd', (355, 360))],
+        'scope': 'night-dependent guest need input only; no event production or peak-frequency implementation'},
+    'bankruptcy-bookkeeping': {
+        'ars': frozenset({'AR.progression.three_deficits_gameover'}),
+        'sources': [('scripts/operations/operations_coordinator.gd', (1183, 1195))],
+        'scope': 'bankruptcy terminal bookkeeping only; no authored ending'},
+}
+
+
+def support_family(row):
+    # Content summaries cannot inherit support from neighbouring schedule ARs.
+    return (row['kind'] == 'route' or row['id'].startswith('original.line.') or
+            row['id'] in {'clause.route_rules', 'clause.production', 'clause.scope'})
+
+
+def support_pins(root, kind):
+    return [excerpt(root, path, *span) if span else source(root, path)
+            for path, span in SUPPORT_POLICY[kind]['sources']]
+
+
+def authorities(root):
+    """Selection reads authority text, never generated rows or old audit statuses.
+
+    All non-heading content-bearing lines plus whole narrative/character/art
+    sections are conservative audit scope. Every AR receives a disposition;
+    unrelated mechanics are explicitly outside this documentation unit.
+    """
+    require(sha((root / BASELINE).read_bytes()) == BASE_HASH, 'authority BASELINE hash')
+    require((root / AR_PATH).read_bytes() == blob(root, BASE, AR_PATH), 'authority AR hash')
+    lines = (root / BASELINE).read_text().splitlines()
+    required = set()
+    section_content = False
+    for n, text in enumerate(lines, 1):
+        if text.startswith('# '):
+            section_content = bool(re.search(r'世界観|ユニークキャラクター|恋愛|デザイン|アセット|ロードマップ', text))
+        if text.strip() and not text.startswith('#') and (section_content or CONTENT_WORDS.search(text)):
+            required.add(n)
+    records = decode((root / AR_PATH).read_bytes())['requirements']
+    relevant = {a['id'] for a in records if atomic_lines(a) and (a['id'].startswith(CONTENT_DOMAINS)
+        or CONTENT_WORDS.search(a['condition']) or any(
+            s['path'] == BASELINE and required.intersection(s['lines'])
+            for s in a['source_anchors']))}
+    required.update(n for a in records if a['id'] in relevant for n in atomic_lines(a))
+    packages = decode(blob(root, BASE, PLAN + 'work_packages.json'))
+    return lines, required, {a['id']: a for a in records}, relevant, {p['id']: p for p in packages}
+
+
+def atomic_lines(record):
+    return {n for s in record['source_anchors'] if s['path'] == BASELINE for n in s['lines']}
+
+
+def owning_units(record, packages):
+    # Preserve the actual definitions; do not invent a uniquely assigned unit
+    # where the original package has several remaining deliverables.
+    return [{'package': p, 'primary': p == record['primary_package'],
+             'deliverables': [{k: u[k] for k in ('id', 'title', 'work', 'acceptance')}
+                              for u in packages[p]['remaining_deliverables']]}
+            for p in dict.fromkeys([record['primary_package']] + record['work_packages'])]
+
+
+def require(ok, message):
+    if not ok:
+        raise ValueError(message)
+
+
+def sha(raw):
+    return hashlib.sha256(raw).hexdigest()
+
+
+def decode(raw):
+    def unique(pairs):
+        result = {}
+        for key, value in pairs:
+            require(key not in result, 'duplicate JSON key: ' + key)
+            result[key] = value
+        return result
+    return json.loads(raw, object_pairs_hook=unique,
+                      parse_constant=lambda s: (_ for _ in ()).throw(ValueError(s)))
+
+
+def encoded(value):
+    return json.dumps(value, ensure_ascii=False, sort_keys=True, allow_nan=False)
+
+
+@lru_cache(maxsize=None)
+def blob(root, commit, path):
+    return subprocess.check_output(['git', 'show', commit + ':' + path], cwd=root)
+
+
+PACKAGE_MUTABLE = {'state', 'legacy_state', 'current_summary', 'updated_at_jst'}
+UNIT_MUTABLE = {'state', 'current_execution', 'remaining_gaps', 'updated_at_jst',
+    'submitted_commit', 'current_summary', 'progress_summary', 'evidence',
+    'completed_at_jst', 'implementation_commit', 'integrated_commit',
+    'integration_commit', 'normal_integration_candidate'}
+
+
+def projection(packages):
+    require(type(packages) is list, 'package register type')
+    result = []
+    for package in packages:
+        require(type(package) is dict, 'package type')
+        row = {k: v for k, v in package.items() if k not in PACKAGE_MUTABLE}
+        require(type(row.get('remaining_deliverables')) is list, 'deliverables type')
+        row['remaining_deliverables'] = [{k: v for k, v in unit.items()
+            if k not in UNIT_MUTABLE} for unit in row['remaining_deliverables']]
+        result.append(row)
+    return result
+
+
+def selection(root):
+    paths = [p for folder in ('autoload', 'scripts', 'scenes', 'data', 'tests', 'assets', 'tools')
+        for p in (root / folder).rglob('*') if p.is_file() and p.name != '.DS_Store'
+        and '__pycache__' not in p.parts]
+    paths += [root / p for p in ('project.godot', 'export_presets.cfg', 'Makefile', 'AGENTS.md')]
+    require(all(not p.is_symlink() for p in paths), 'selected symlink')
+    return {p.relative_to(root).as_posix(): {'bytes': p.stat().st_size,
+        'sha256': sha(p.read_bytes())} for p in sorted(paths)}
+
+
+def binding(root):
+    raw = lambda p: (root / p).read_bytes()
+    spec_raw = raw(OUT + 'TASK_SPEC.json')
+    require(sha(spec_raw) == '8026040345de6b7d06cfce40beac9150bfe9ad303d6b26c11bd94e66b1080b29', 'raw spec SHA')
+    require(sha(spec_raw.decode().strip().encode()) == SPEC_HASH, 'immutable spec')
+    require(spec_raw == blob(root, BASE, OUT + 'TASK_SPEC.json'), 'raw immutable spec')
+    spec = decode(spec_raw)
+    require(spec['audit_source_anchor'] == ANCHOR, 'audit anchor')
+    require(sha(raw(OUT + 'FROZEN_GAME_INPUT_PINS.json')) == PINS_HASH ==
+        spec['frozen_game_input_pins_sha256'], 'frozen pins')
+    require(raw(OUT + 'ACTUAL_OPUS_NEXT_ORIGINAL_UNIT_SELECTION.json') ==
+        blob(root, BASE, OUT + 'ACTUAL_OPUS_NEXT_ORIGINAL_UNIT_SELECTION.json'), 'selection')
+    require(sha(raw(BASELINE)) == BASE_HASH, 'original source')
+    for name in ('work_packages.json', 'atomic_requirements.json', 'decisions.json'):
+        current, original = raw(PLAN + name), blob(root, BASE, PLAN + name)
+        if name == 'work_packages.json':
+            require(encoded(projection(decode(current))) == encoded(projection(decode(original))),
+                    'original definitions')
+        else:
+            require(current == original, 'original register: ' + name)
+    pins = decode(raw(OUT + 'FROZEN_GAME_INPUT_PINS.json'))
+    actual = selection(root)
+    require(encoded(actual) == encoded(pins['source_files']), 'selected game set: missing/new/changed')
+    require(len(actual) == 1368, 'selected game cardinality')
+    for key in ('marker_contract', 'policy', 'engine'):
+        path = Path(pins[key + '_path']) if key == 'engine' else root / pins[key + '_path']
+        require(sha(path.read_bytes()) == pins[key + '_sha256'], key + ' identity')
+    roster = ['tests/run_tests.gd'] + sorted(p.relative_to(root).as_posix()
+        for p in (root / 'tests').rglob('test*.gd') if 'export' not in p.relative_to(root).parts
+        and p.relative_to(root).as_posix() != 'tests/s0/test_kernel_and_save.gd')
+    require(roster == pins['roster'], 'roster')
+    require(sum(p.endswith('.gd') for p in actual) == pins['parse_files'] == 329, 'parse set')
+    # Every selected file, including settings and default player identity, is bound
+    # to both the immutable source map and the exact published game audit anchor.
+    for path in actual:
+        require(sha(blob(root, ANCHOR, path)) == actual[path]['sha256'], 'audit source: ' + path)
+    return {'selected_files': len(actual), 'parse_files': 329,
+        'source_anchor': ANCHOR, 'native_reuse_accepted': False,
+        'native_reuse_reason': 'Exact game equality is checked; external native proof and exact S/C applicability remain independent review gates.'}
+
+
+def read_source(root, path):
+    if path.startswith(P22):
+        archived = blob(root, PUBLISHED, ARCHIVE + path[len(P22):])
+        if (root / path).exists():
+            require((root / path).read_bytes() == archived, 'P22 alias changed: ' + path)
+        return archived
+    return (root / path).read_bytes()
+
+
+def source(root, path):
+    raw = read_source(root, path)
+    anchor = PUBLISHED if path.startswith(P22) else ANCHOR
+    archived_path = ARCHIVE + path[len(P22):] if path.startswith(P22) else path
+    anchored = blob(root, anchor, archived_path)
+    require(raw == anchored, 'stale evidence: ' + path)
+    return {'path': path, 'sha256': sha(raw), 'bytes': len(raw),
+        'anchor': anchor, 'anchor_path': archived_path}
+
+
+def excerpt(root, path, start, end):
+    pin = source(root, path)
+    return dict(pin, lines=[start, end], text='\n'.join(
+        read_source(root, path).decode().splitlines()[start-1:end]))
+
+
+def expected(root):
+    """Independent original clauses plus pinned actual evidence, not ledger-derived facts."""
+    lines = (root / BASELINE).read_text().splitlines()
+    require(sha((root / BASELINE).read_bytes()) == BASE_HASH, 'baseline')
+    manifest_raw = blob(root, PUBLISHED, ARCHIVE + 'ROOT_MATERIAL_PRESERVATION_MANIFEST.json')
+    require(sha(manifest_raw) == MANIFEST_HASH, 'published P22 manifest')
+    for entry in decode(manifest_raw)['files']:
+        raw = read_source(root, entry['original_path'])
+        require(len(raw) == entry['bytes'] and sha(raw) == entry['sha256'], 'published P22 file pin')
+    def cite(start, end=None):
+        end = end or start
+        return {'path': BASELINE, 'lines': [start, end],
+            'text': '\n'.join(lines[start-1:end]), 'sha256': BASE_HASH}
+    rows = []
+    def add(identity, kind, spans, condition, owner, status='undefined', evidence=None,
+            reason='欠損: 個別ID・必要量・完成内容は原本未定義。D08/D09未決。', identity_data=None):
+        rows.append({'id': identity, 'kind': kind, 'identity': identity_data,
+            'citations': [cite(*span) for span in spans], 'required_condition': condition,
+            'status': status, 'required_count': None, 'completed_count': None,
+            'evidence': evidence or [], 'missing': 'original production content missing or undefined',
+            'reason': reason, 'owner': owner})
+    add('chapters.all', 'chapter', [(8,), (26,), (27,30), (256,)],
+        'メインストーリー全章。原本の仕様書章番号をシナリオ章と混同しない。章名・章数・順序・場面一覧は未定義。', 'D08')
+    add('endings.all', 'ending', [(9,), (135,)],
+        '全エンドを要求。個別エンドID・本数・到達条件は未定義。', 'D08', 'missing')
+    add('endings.bad', 'ending', [(135,)],
+        '特定バッドエンド確定時の敵/背景オブジェクト化。カテゴリのみ原本定義、対象人物/場面/数は未定義。', 'P26-02', 'missing')
+    add('endings.game_over', 'ending', [(72,)],
+        '赤字決算3回連続のゲームオーバー。物語エンド数への換算不可。', 'P26-02', 'missing',
+        [],
+        '欠損: 経済処理の既存コードは存在するが終点のシナリオ・画像・音声・全受入を証明しない。')
+    add('encyclopedia.all', 'encyclopedia', [(9,)],
+        '図鑑コンプ。対象集合・項目ID・解放条件・必要項目数は未定義。', 'D08', 'missing')
+    add('dialogue.all', 'dialogue', [(155,), (230,), (256,)],
+        '会話/イベント用台詞とシナリオ。本文・話者・行数・場面単位は未定義。UI通知文を完成脚本に数えない。', 'P26-02')
+    add('portraits.all', 'portrait', [(160,161), (230,), (235,), (242,)],
+        'メイン/サブ人物の表情・衣装・破損・汚れ・刻印・妊婦外見・ルート別描き分け。差分枚数未定義。', 'P26-03', 'missing')
+    add('voice.all', 'voice', [(252,), (257,)],
+        'キャラクターボイスの収録・実装。話者/台詞/クリップ数/担当未定義。BGMやUI音は代用不可。', 'P26-03', 'missing')
+    # All applicable full clauses are retained even where the original defines no finite scene list.
+    for key, spans, condition in [
+        ('world', [(27,30)], '舞台・主人公・7人物の3運命を保つ。'),
+        ('scope', [(31,34)], '原本表現要求と今回の非露骨な監査範囲との差異を残す。'),
+        ('route_skills', [(132,), (134,135)], 'ルートによる技能・衣装補正・離脱条件。'),
+        ('route_rules', [(138,161)], '3軸/盾・侵食・3種決闘・プレイヤー行動・履歴/外見の全共通条件。'),
+        ('art', [(229,230), (234,235)], '原本のマップ/SD/立ち絵・モーションと描き分け。'),
+        ('cg', [(242,243)], '人物立ち絵およびルート別CG/差分/モブ汎用スチル。'),
+        ('motion', [(245,246)], '待機・歩行・作業・気絶・原本必須モーションと効果。'),
+        ('production', [(252,), (255,258)], '原本のシナリオ/素材量産/音声制作と受入は未完。')]:
+        add('clause.' + key, 'category', spans, condition, 'P26-03', 'missing')
+    table = decode((root / P19).read_bytes())
+    table_pin = source(root, P19)
+    cells = {(c['character_id'], c['route_id']): c for c in table['cells']}
+    for i, (person, name) in enumerate(PEOPLE):
+        require(name in lines[117+i], 'original identity')
+        for route, route_name in ROUTES.items():
+            cell = cells[(person, route)]
+            require(cell['name'] == name and cell['route'] == route_name and
+                cell['natural_route_complete'] is False, 'P19 route identity/status')
+            add('route.' + person + '.' + route, 'route', [(118+i,), (30,), (132,), (138,161)],
+                '人物固有の入口・イベント列・分岐・終点・台詞・立ち絵・音声・履歴/保存と通常到達。',
+                'P26-02', 'missing', [dict(table_pin, cell=[person, route])],
+                '欠損: P19共通モデル/保存の部分実装は人物別制作/到達ではない。人物固有条件・場面列はD08未決。',
+                {'character_id': person, 'original_name': name, 'route_id': route, 'route_name': route_name})
+    # Preserve every existing usage record (614 usage groups, never 614 finished assets).
+    usage_inputs = ['facility_usage_slots.json', 'character_usage_slots.json',
+                    'other_usage_slots.json', 'state_usage_groups.json']
+    usage_snapshots = {}
+    for filename in usage_inputs:
+        path = P22 + filename
+        records = decode(read_source(root, path))
+        usage_snapshots[path] = {'source': source(root, path), 'records': records}
+        for record in records:
+            anchors = record['source_anchors']
+            for a in anchors:
+                require(a['sha256'] == BASE_HASH and a['text'] == lines[a['line']-1], 'P22 citation')
+            representations = []
+            for rep in record.get('representations', []):
+                pin = source(root, rep['path'])
+                representations.append(dict(pin, historical_inventory=rep,
+                    current_bytes_equal_inventory=pin['sha256'] == rep['sha256']))
+            kind = record.get('kind', 'usage')
+            status = 'missing'
+            if representations:
+                status = 'code-drawing' if all(r['historical_inventory']['representation'] == 'code_drawn'
+                    for r in representations) else 'placeholder'
+            slot_id = record.get('slot_id', record.get('group_id'))
+            add('usage.' + slot_id, kind, [(a['line'],) for a in anchors],
+                record['usage_condition'], 'P26-03', status, representations,
+                '欠損: 利用枠/用途群。既存表現の現物SHAを再取得。汎用描画/仮素材は固有人物・必須差分の完成証明ではない。D09数量/品質/担当未決。',
+                {'usage_source': path, 'slot_id': slot_id})
+    references = {p: source(root, p) for p in [P19, BACKLOG] +
+        [P22 + n for n in ['contract.json', 'source_pins.json', 'current_media_inventory.json']]}
+    actual_support = [excerpt(root, 'data/characters/mvp_unique_characters.json', 1, 32),
+        excerpt(root, 'scripts/relationship/original_relationship_state.gd', 4, 34),
+        excerpt(root, 'autoload/simulation_runtime.gd', 6791, 6812),
+        excerpt(root, 'scripts/relationship/relationship_service.gd', 423, 479),
+        excerpt(root, 'scripts/ui/pixel_people.gd', 4, 18)]
+    media = decode(read_source(root, P22 + 'current_media_inventory.json'))
+    current_media = [dict(source(root, m['path']), historical_inventory=m) for m in media]
+    pins = decode((root / OUT / 'FROZEN_GAME_INPUT_PINS.json').read_bytes())
+    available_assets = {p: v for p, v in pins['source_files'].items() if p.startswith('assets/')}
+    original_lines, required_lines, atoms, relevant, packages = authorities(root)
+    # A separate row for every selected original clause prevents a broad category
+    # citation from concealing an omitted event/control requirement.
+    for n in sorted(required_lines):
+        add('original.line.' + str(n), 'original-clause', [(n,)],
+            '原本の必要条件。個別の脚本/台詞/CG/音声/場面数は定義しない。',
+            'undefined', 'missing', reason='原本条件を保存。専用制作内容は欠損、場面ID・数量は未定義。下記AR所有先で残作業を追跡。')
+    relationship_paths = ['scripts/relationship/original_relationship_state.gd',
+                          'scripts/relationship/relationship_service.gd']
+    # Direct source inspection is limited to explicit state/container support.
+    # These excerpts never assert authored scenes, usable observation controls,
+    # or a naturally reachable character route.
+    require('class_name OriginalRelationshipState' in read_source(root, relationship_paths[0]).decode(),
+            'relationship class evidence')
+    peep_pin = excerpt(root, 'scripts/special/peeping_room_service.gd', 127, 162)
+    peep_runtime_pin = excerpt(root, 'autoload/simulation_runtime.gd', 10860, 10880)
+    require('RECORDER_ELIGIBILITY_PENDING_D04_D08_P16' in peep_pin['text'] and
+            'BUILD_DEFINITION_PENDING_D04' in peep_runtime_pin['text'], 'peeping backend boundary')
+    dispositions = {}
+    for row in rows:
+        cited = {n for c in row['citations'] for n in range(c['lines'][0], c['lines'][1] + 1)}
+        matches = sorted(a for a in relevant if cited.intersection(atomic_lines(atoms[a])))
+        if row['kind'] == 'route':
+            matches = ['AR.heroine.' + row['identity']['character_id'] + '.route.' + row['identity']['route_id']]
+        row['atomic_requirement_ids'] = matches
+        owners = sorted({atoms[a]['primary_package'] for a in matches})
+        row['owner'] = '/'.join(owners) if owners else 'undefined'
+        row['owner_deliverable_refs'] = owners
+        row['owner_assignment'] = 'original package deliverables; specific production assignee undefined'
+        row['content_status'] = row['status']
+        row['support_scope'] = 'no dedicated support established'
+        row['scoped_support'] = []
+        for kind, policy in SUPPORT_POLICY.items():
+            supported = sorted(set(matches) & policy['ars']) if support_family(row) else []
+            if supported:
+                row['scoped_support'].append({'kind': kind, 'atomic_requirement_ids': supported,
+                    'scope': policy['scope'], 'content_status': 'missing'})
+                row['evidence'] += support_pins(root, kind)
+        supported_ids = {a for claim in row['scoped_support'] for a in claim['atomic_requirement_ids']}
+        row['unsupported_atomic_requirement_ids'] = sorted(set(matches) - supported_ids)
+        if row['scoped_support']:
+            row['status'] = 'partial'
+            row['support_scope'] = '; '.join(c['scope'] for c in row['scoped_support'])
+            row['reason'] += ' scoped_supportに列挙したARの基盤断片のみpartial。他のARは未支援、全制作内容は欠損。'
+        if row['id'].startswith('clause.'):
+            row['reason'] += ' 所有先は引用ARのprimary_packageと原P単位定義。包括P26-03への割当はしない。'
+    for identity, atom in atoms.items():
+        linked = [r['id'] for r in rows if identity in r['atomic_requirement_ids']]
+        dispositions[identity] = {
+            'record': {k: atom[k] for k in ('id', 'condition', 'source_anchors',
+                'source_sha256', 'primary_package', 'work_packages')},
+            'rows': linked,
+            'disposition': 'covered-by-row' if identity in relevant else 'out-of-scope-with-reason',
+            'reason': ('原本条件・欠損は各行に記録。ARの旧監査合否は転記しない。'
+                       if identity in relevant else 'L226カットイン警告・決闘/防衛演出はP24 UIの所管。制作/受入済みを意味しない。'
+                       if identity in {'AR.ui.cut_duel', 'AR.ui.cut_defense'} else
+                       '原本内容行に結合しない追加施設契約/採用・財布条件、または内容語彙/対象節/内容ARドメインに該当しない独立メカニクス。製品受入は当該原P単位の責任。'),
+            'owning_deliverables': owning_units(atom, packages)}
+    approval_raw = blob(root, APPROVAL_COMMIT, APPROVAL_PATH)
+    require(sha(approval_raw) == APPROVAL_HASH, 'published D05 approval')
+    approval = {'commit': APPROVAL_COMMIT, 'path': APPROVAL_PATH,
+                'sha256': APPROVAL_HASH, 'record': decode(approval_raw),
+                'scope': 'actual approval received; P04 product adoption remains outside P26'}
+    return {'task_id': 'P26-01-LEDGER', 'schema_version': 1, 'source_anchor': ANCHOR,
+        'definition_base': BASE, 'rows': rows, 'usage_snapshots': usage_snapshots,
+        'coverage_policy': {'line_selector': CONTENT_WORDS.pattern,
+            'whole_sections': '世界観|ユニークキャラクター|恋愛|デザイン|アセット|ロードマップ',
+            'ar_domains': list(CONTENT_DOMAINS), 'selected_original_lines': sorted(required_lines),
+            'relevant_ar_ids': sorted(relevant)},
+        'atomic_authority': source(root, AR_PATH), 'atomic_dispositions': dispositions,
+        'owning_package_definitions': {p: {'title': v['title'],
+            'remaining_deliverables': [{k: u[k] for k in ('id', 'title', 'work', 'acceptance')}
+                for u in v['remaining_deliverables']]} for p, v in packages.items()},
+        'current_D05_approval': approval,
+        'published_material': {'anchor': PUBLISHED, 'manifest_sha256': MANIFEST_HASH,
+            'manifest_path': ARCHIVE + 'ROOT_MATERIAL_PRESERVATION_MANIFEST.json'},
+        'references': references, 'P22_03_authority': 'draft/unaccepted reference only',
+        'actual_support': actual_support,
+        'support_interpretation': 'Explicit state/identity/container support only; generic pose has no original character-specific appearance. No finished chapter/dialogue/portrait/voice/encyclopedia inferred.',
+        'current_media_reaudit': current_media,
+        'available_asset_source_set': available_assets,
+        'pending': {'D05': 'Historical register only: unresolved as of audit anchor f4f85bc54c39361f9efcd16f67a17835559ca70c and base 379a1ba8fd25b5ad24226178a2492f91761dc31d. Current actual approval is separately pinned; P04 adoption pending outside P26.',
+                    'D08': 'unresolved', 'D09': 'unresolved'},
+        'accounting': {'packages': 30, 'units': 88, 'completed': 15, 'credit': 0,
+            'partial_credit': False, 'whole_unit_accepted': False},
+        'native_evidence': {'reuse_accepted': False, 'new_full_run': False,
+            'historical_only': {'suites': 184, 'checks': 21903, 'parse': 329, 'owned_ended': 186},
+            'reason': 'Runner must independently establish exact S/C applicability; no native result claimed here.'}}
+
+
+def verify_authority(candidate, root):
+    """Non-canonical coverage/ownership/citation checks, callable on their own."""
+    lines, required, atoms, relevant, packages = authorities(root)
+    seen_lines, seen_atoms = set(), set()
+    row_ids = {r['id'] for r in candidate['rows']}
+    for row in candidate['rows']:
+        require(set(row) == {'id', 'kind', 'identity', 'citations', 'required_condition',
+            'status', 'required_count', 'completed_count', 'evidence', 'missing', 'reason',
+            'owner', 'atomic_requirement_ids', 'owner_deliverable_refs', 'owner_assignment',
+            'content_status', 'support_scope', 'scoped_support',
+            'unsupported_atomic_requirement_ids'}, 'closed row schema')
+        require(row['status'] in STATUSES, 'invalid row status')
+        require(row['required_count'] is None and row['completed_count'] is None, 'invented quantity')
+        require(type(row['atomic_requirement_ids']) is list, 'AR ID list')
+        ids = row['atomic_requirement_ids']
+        require(set(ids) <= relevant, 'unknown or unrelated AR ID')
+        owners = sorted({atoms[a]['primary_package'] for a in ids})
+        require(row['owner'] == ('/'.join(owners) if owners else 'undefined') and
+                row['owner_deliverable_refs'] == owners, 'AR owner mismatch')
+        cited = set()
+        for c in row['citations']:
+            lo, hi = c['lines']
+            require(type(lo) is int and type(hi) is int and 1 <= lo <= hi <= len(lines), 'citation lines')
+            require(c['path'] == BASELINE and c['sha256'] == BASE_HASH and
+                    c['text'] == '\n'.join(lines[lo-1:hi]), 'original citation integrity')
+            cited.update(range(lo, hi + 1))
+        require(all(cited.intersection(atomic_lines(atoms[a])) for a in ids), 'AR citation correspondence')
+        seen_lines.update(cited)
+        seen_atoms.update(ids)
+        require(row['content_status'] in STATUSES and row['content_status'] != 'produced', 'unsupported content production')
+        require(row['status'] != 'produced', 'partial support falsely produced')
+        # Inspect submitted claims and pins directly, without expected() or a
+        # generated row. The policy is a normative compatibility table, not a
+        # keyword classifier. A valid hash alone cannot establish relevance.
+        claims = row['scoped_support']
+        require(type(claims) is list, 'support claims type')
+        claimed_ids, kinds, allowed_pins = set(), set(), []
+        for claim in claims:
+            require(set(claim) == {'kind', 'atomic_requirement_ids', 'scope', 'content_status'},
+                    'closed support claim')
+            kind = claim['kind']
+            require(kind in SUPPORT_POLICY and kind not in kinds, 'unknown/duplicate support kind')
+            policy = SUPPORT_POLICY[kind]
+            require(support_family(row), 'support incompatible with requirement family')
+            targets = claim['atomic_requirement_ids']
+            require(type(targets) is list and targets and len(targets) == len(set(targets)) and
+                    set(targets) <= set(ids) & policy['ars'], 'support incompatible with AR')
+            require(claim['scope'] == policy['scope'] and claim['content_status'] == 'missing',
+                    'support scope/content mismatch')
+            kinds.add(kind)
+            claimed_ids.update(targets)
+            for path, span in policy['sources']:
+                pin = source(root, path)
+                if span:
+                    pin.update(lines=list(span), text='\n'.join(
+                        read_source(root, path).decode().splitlines()[span[0]-1:span[1]]))
+                allowed_pins.append(pin)
+        require(row['unsupported_atomic_requirement_ids'] == sorted(set(ids) - claimed_ids),
+                'unsupported AR partition')
+        require((row['status'] == 'partial') == bool(claims),
+                'route support/content distinction' if row['kind'] == 'route' else 'unqualified partial support')
+        if claims:
+            require(row['support_scope'] == '; '.join(c['scope'] for c in claims) and
+                    row['content_status'] == 'missing', 'support summary/content mismatch')
+        else:
+            require(row['support_scope'] == 'no dedicated support established', 'unsupported scope text')
+        if not row['id'].startswith('usage.'):
+            if row['kind'] == 'route':
+                allowed_pins.insert(0, dict(source(root, P19), cell=[
+                    row['identity']['character_id'], row['identity']['route_id']]))
+            require(encoded(row['evidence']) == encoded(allowed_pins), 'unrelated or unscoped support evidence')
+        else:
+            require(not claims, 'usage cannot inherit backend support')
+        if row['kind'] in {'voice', 'ending', 'encyclopedia'}:
+            require(row['status'] == row['content_status'] == 'missing' and not row['evidence'],
+                    'unsupported content family')
+        for pin in row['evidence']:
+            require(encoded({k: pin[k] for k in ('path', 'sha256', 'bytes', 'anchor', 'anchor_path')}) ==
+                    encoded(source(root, pin['path'])), 'row evidence integrity')
+        if row['id'].startswith('usage.'):
+            reps = row['evidence']
+            status = ('code-drawing' if all(p['historical_inventory']['representation'] == 'code_drawn'
+                      for p in reps) else 'placeholder') if reps else 'missing'
+            require(row['status'] == status and row['content_status'] == status, 'usage representation status')
+        if row['kind'] == 'route':
+            require(row['status'] == 'partial' and row['content_status'] == 'missing', 'route support/content distinction')
+            identity = row['identity']
+            require((identity['character_id'], identity['original_name']) in PEOPLE and
+                    ROUTES.get(identity['route_id']) == identity['route_name'], 'original route identity')
+            require(ids == ['AR.heroine.' + identity['character_id'] + '.route.' + identity['route_id']], 'route AR identity')
+    require(required <= seen_lines, 'independent original line coverage')
+    require(relevant <= seen_atoms, 'independent AR coverage')
+    require(set(candidate['atomic_dispositions']) == set(atoms), 'AR disposition set')
+    for identity, atom in atoms.items():
+        entry = candidate['atomic_dispositions'][identity]
+        require(entry['record'] == {k: atom[k] for k in entry['record']} and
+                set(entry['record']) == {'id', 'condition', 'source_anchors', 'source_sha256', 'primary_package', 'work_packages'},
+                'stale AR record')
+        require(entry['owning_deliverables'] == owning_units(atom, packages), 'AR owning deliverables')
+        require(entry['reason'] and entry.get('disposition') == (
+                'covered-by-row' if identity in relevant else 'out-of-scope-with-reason'), 'missing AR disposition')
+        require(set(entry['rows']) <= row_ids and set(entry['rows']) == {
+            r['id'] for r in candidate['rows'] if identity in r['atomic_requirement_ids']}, 'AR row linkage')
+        require(identity not in relevant or entry['rows'], 'AR without content row')
+
+
+def verify(candidate, canonical, root=None):
+    require(type(candidate) is dict, 'closed document object')
+    require(type(candidate.get('rows')) is list, 'closed rows list')
+    rows = candidate['rows']
+    ids = [r['id'] for r in rows]
+    require(len(ids) == len(set(ids)), 'duplicate row ID')
+    require(set(ids) == {r['id'] for r in canonical['rows']}, 'original clause/slot coverage')
+    for row in rows:
+        require(row['status'] in STATUSES, 'invalid status')
+        require(row['required_count'] is None and row['completed_count'] is None, 'invented quantity')
+        require(row['status'] != 'produced', 'unsupported completion')
+        require(row['citations'] and row['reason'] and row['missing'], 'missing traceability')
+    require(root is not None, 'independent authority root required')
+    verify_authority(candidate, root)
+    require(encoded(candidate) == encoded(canonical), 'ledger differs from original/source-bound audit')
+
+
+def markdown(document):
+    # A lossless deterministic human view, including exact citations and source hashes.
+    lines = ['# P26-01 全必要内容の台帳', '',
+        '15/88、今回加算0。未制作/未定義は欠損。利用枠数は完成数ではない。', '',
+        'D05の過去未解決記録はf4f85bc/379a1ba時点。現行承認は別途固定。D08/D09未解決。P22-03は未受入参考。', '']
+    for row in document['rows']:
+        lines += ['## ' + row['id'], '', '- 種別: ' + row['kind'],
+            '- 識別: ' + encoded(row['identity']),
+            '- 状態: ' + row['status'], '- 所管: ' + row['owner'],
+            '- 内容状態: ' + row['content_status'], '- 部分支援範囲: ' + row['support_scope'],
+            '- AR: ' + encoded(row['atomic_requirement_ids']),
+            '- AR別部分支援（列挙ARの基盤断片のみ、制作内容はmissing）: ' + encoded(row['scoped_support']),
+            '- 基盤支援なしのAR: ' + encoded(row['unsupported_atomic_requirement_ids']),
+            '- 所管単位: ' + encoded(row['owner_deliverable_refs']) + ' (固定参照の原P単位定義を参照)',
+            '- 条件: ' + (row['required_condition'] if isinstance(row['required_condition'], str)
+                else encoded(row['required_condition'])), '- 理由: ' + row['reason'],
+            '- 必要数/完成数: 未定義 / 未計数', '- 欠損: ' + row['missing'], '']
+        for c in row['citations']:
+            lines += [f"原本 `{c['path']}:{c['lines'][0]}-{c['lines'][1]}` SHA256 `{c['sha256']}`", '',
+                      '```text', c['text'], '```', '']
+        lines += ['証拠（空配列は明示的欠損）:', '', '```json',
+                  json.dumps(row['evidence'], ensure_ascii=False, indent=2), '```', '']
+    lines += ['## 固定参照・監査境界', '', '```json',
+        json.dumps({k: v for k, v in document.items() if k != 'rows'}, ensure_ascii=False, indent=2), '```', '']
+    return '\n'.join(lines)
+
+
+def check_view(raw, document):
+    require(raw == markdown(document).encode(), 'Markdown drift')
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--project-root', type=Path, default=Path('.'))
+    mode = parser.add_mutually_exclusive_group(required=True)
+    mode.add_argument('--check', action='store_true')
+    mode.add_argument('--source-binding-only', action='store_true')
+    mode.add_argument('--write', action='store_true')
+    args = parser.parse_args()
+    root = args.project_root.resolve()
+    try:
+        result = binding(root)
+        canonical = expected(root)
+        if args.write:
+            (root / OUT / 'CONTENT_LEDGER.json').write_text(json.dumps(canonical, ensure_ascii=False, indent=2) + '\n')
+            (root / OUT / 'CONTENT_LEDGER.md').write_text(markdown(canonical))
+        else:
+            document = decode((root / OUT / 'CONTENT_LEDGER.json').read_bytes())
+            verify(document, canonical, root)
+            if args.check:
+                check_view((root / OUT / 'CONTENT_LEDGER.md').read_bytes(), document)
+        print(json.dumps({'documentation_check': 'pass', **result}, ensure_ascii=False))
+        return 0
+    except (ValueError, KeyError, TypeError, OSError, subprocess.CalledProcessError) as error:
+        print('P26 audit rejected: ' + str(error), file=sys.stderr)
+        return 1
+
+
+if __name__ == '__main__':
+    sys.exit(main())

docs/plans/original-completion-2026-10-02/execution/p26-01/test_content_ledger.py

@@ -0,0 +1,243 @@
+#!/usr/bin/env python3
+"""Runner negative controls for P26; no fixture writes and no native execution."""
+import argparse
+import copy
+from pathlib import Path
+import unittest
+from unittest.mock import patch
+import check_content_ledger as audit
+
+
+class LedgerTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.canonical = audit.expected(ROOT)
+        cls.submitted = audit.decode((ROOT / audit.OUT / 'CONTENT_LEDGER.json').read_bytes())
+
+    def reject(self, mutate):
+        audit.verify(self.submitted, self.canonical, ROOT)
+        value = copy.deepcopy(self.submitted)
+        mutate(value)
+        with self.assertRaises((ValueError, TypeError, KeyError)):
+            audit.verify(value, self.canonical, ROOT)
+
+    def test_valid_submitted_and_independent_source_control(self):
+        audit.verify(self.submitted, self.canonical, ROOT)
+        audit.verify(copy.deepcopy(self.canonical), self.canonical, ROOT)
+        audit.check_view((ROOT / audit.OUT / 'CONTENT_LEDGER.md').read_bytes(), self.submitted)
+
+    def test_required_sets_are_independent_of_submitted_rows(self):
+        ids = {r['id'] for r in self.canonical['rows']}
+        self.assertTrue({'chapters.all', 'endings.all', 'endings.bad', 'endings.game_over',
+            'dialogue.all', 'portraits.all', 'voice.all', 'encyclopedia.all'} <= ids)
+        self.assertEqual({r['id'] for r in self.canonical['rows'] if r['kind'] == 'route'},
+            {'route.' + p + '.' + r for p, _ in audit.PEOPLE for r in audit.ROUTES})
+
+    def test_omitted_original_categories_and_route(self):
+        for identity in ['chapters.all', 'route.satsuki.corruption', 'endings.all',
+                'endings.bad', 'endings.game_over', 'dialogue.all', 'voice.all',
+                'portraits.all', 'encyclopedia.all', 'clause.route_rules']:
+            with self.subTest(identity=identity):
+                self.reject(lambda d: d.update(rows=[r for r in d['rows'] if r['id'] != identity]))
+
+    def test_missing_usage_slot(self):
+        self.reject(lambda d: d.update(rows=[r for r in d['rows'] if r['id'] !=
+            next(x['id'] for x in d['rows'] if x['id'].startswith('usage.'))]))
+
+    def test_fabricated_quantity_and_false_completion(self):
+        self.reject(lambda d: d['rows'][0].update(required_count=8))
+        self.reject(lambda d: d['rows'][0].update(completed_count=0))
+        self.reject(lambda d: d['rows'][0].update(status='produced', missing=None))
+
+    def test_closed_schema_owner_status_type_and_duplicates(self):
+        for field, value in [('owner', 'P99-99'), ('status', 'pass'), ('kind', 'invented'),
+                             ('required_count', False), ('citations', []), ('extra', True)]:
+            with self.subTest(field=field):
+                self.reject(lambda d: d['rows'][0].update({field: value}))
+        self.reject(lambda d: d['rows'].append(copy.deepcopy(d['rows'][0])))
+        self.reject(lambda d: d.update(schema_version=True))
+
+    def test_exact_route_identity(self):
+        self.reject(lambda d: next(r for r in d['rows'] if r['kind'] == 'route')
+            ['identity'].update(original_name='別人'))
+
+    def test_stale_original_and_source(self):
+        self.reject(lambda d: d['rows'][0]['citations'][0].update(text='stale'))
+        self.reject(lambda d: d['rows'][0]['citations'][0].update(sha256='0' * 64))
+        self.reject(lambda d: d['references'][audit.P19].update(sha256='0' * 64))
+        self.reject(lambda d: d.update(source_anchor='HEAD'))
+
+    def test_malformed_json_duplicate_keys_and_nonfinite(self):
+        self.assertEqual(audit.decode('{"rows": []}'), {'rows': []})
+        for raw in ['{', '{"x":1,"x":2}', '{"x":NaN}', '{"x":Infinity}']:
+            with self.subTest(raw=raw), self.assertRaises(ValueError):
+                audit.decode(raw)
+
+    def test_markdown_drift(self):
+        view = audit.markdown(self.submitted).encode()
+        audit.check_view(view, self.submitted)
+        with self.assertRaises(ValueError):
+            audit.check_view(view + b'\n', self.submitted)
+
+    def test_definition_projection_allows_only_progress(self):
+        packages = audit.decode(audit.blob(ROOT, audit.BASE, audit.PLAN + 'work_packages.json'))
+        changed = copy.deepcopy(packages)
+        changed[0]['state'] = 'progress-only-control'
+        changed[0]['remaining_deliverables'][0]['evidence'] = ['progress-only-control']
+        self.assertEqual(audit.encoded(audit.projection(packages)), audit.encoded(audit.projection(changed)))
+        for field in ['acceptance', 'work', 'depends_on', 'requirement_ids']:
+            changed = copy.deepcopy(packages)
+            changed[0][field] = 'mutated definition'
+            self.assertNotEqual(audit.encoded(audit.projection(packages)), audit.encoded(audit.projection(changed)))
+
+    def test_published_source_changed_bytes_rejected(self):
+        original = audit.blob
+        def stale(root, anchor, path):
+            raw = original(root, anchor, path)
+            return raw + b' ' if path == audit.ARCHIVE + 'ROOT_MATERIAL_PRESERVATION_MANIFEST.json' else raw
+        with patch.object(audit, 'blob', stale), self.assertRaises(ValueError):
+            audit.expected(ROOT)
+
+    def test_selected_input_mutation_rejected(self):
+        actual = audit.selection(ROOT)
+        # Valid map control comes from frozen independent pins, not a second selection call.
+        pins = audit.decode((ROOT / audit.OUT / 'FROZEN_GAME_INPUT_PINS.json').read_bytes())
+        self.assertEqual(audit.encoded(actual), audit.encoded(pins['source_files']))
+        for mode in ('missing', 'new', 'changed', 'wrong_type'):
+            changed = copy.deepcopy(actual)
+            key = 'project.godot'
+            if mode == 'missing':
+                del changed[key]
+            elif mode == 'new':
+                changed['data/unapproved.json'] = {'bytes': 0, 'sha256': '0' * 64}
+            elif mode == 'changed':
+                changed[key]['sha256'] = '0' * 64
+            else:
+                changed[key]['bytes'] = str(changed[key]['bytes'])
+            with self.subTest(mode=mode), patch.object(audit, 'selection', return_value=changed), self.assertRaises(ValueError):
+                audit.binding(ROOT)
+
+    def independent_reject(self, mutate, message):
+        # The positive control and rejection invoke only the independent layer:
+        # no canonical document/equality can make these tests pass.
+        audit.verify_authority(self.submitted, ROOT)
+        value = copy.deepcopy(self.submitted)
+        mutate(value)
+        with self.assertRaisesRegex(ValueError, message):
+            audit.verify_authority(value, ROOT)
+
+    def test_omitted_review_event_clauses(self):
+        for n in (13, 53, 65, 196, 221, 222):
+            with self.subTest(line=n):
+                self.reject(lambda d: d.update(rows=[r for r in d['rows']
+                    if r['id'] != 'original.line.' + str(n)]))
+        # Remove a line from every citation (including broad category ranges),
+        # preserving other lines, AR links and IDs: authority coverage must fail.
+        def omit(d):
+            for row in d['rows']:
+                row['citations'] = [c for c in row['citations']
+                                    if not c['lines'][0] <= 65 <= c['lines'][1]]
+        self.independent_reject(omit, 'AR citation correspondence|independent original line coverage')
+
+    def test_atomic_coverage_unknown_and_missing_disposition(self):
+        identity = 'AR.events.ntr_night_peak'
+        def remove(d):
+            for row in d['rows']:
+                if identity in row['atomic_requirement_ids']:
+                    row['atomic_requirement_ids'].remove(identity)
+                    if identity in row['unsupported_atomic_requirement_ids']:
+                        row['unsupported_atomic_requirement_ids'].remove(identity)
+                    for claim in row['scoped_support']:
+                        if identity in claim['atomic_requirement_ids']:
+                            claim['atomic_requirement_ids'].remove(identity)
+                    atoms = audit.authorities(ROOT)[2]
+                    owners = sorted({atoms[a]['primary_package'] for a in row['atomic_requirement_ids']})
+                    row.update(owner='/'.join(owners) if owners else 'undefined', owner_deliverable_refs=owners)
+        self.independent_reject(remove, 'independent AR coverage')
+        self.independent_reject(lambda d: d['rows'][0]['atomic_requirement_ids'].append('AR.unknown'), 'unknown or unrelated AR ID')
+        self.independent_reject(lambda d: d['atomic_dispositions'][identity].pop('disposition'), 'disposition')
+
+    def test_owners_route_usage_and_partial_truth(self):
+        for prefix in ('route.', 'usage.', 'original.line.65'):
+            with self.subTest(prefix=prefix):
+                self.independent_reject(lambda d: next(r for r in d['rows']
+                    if r['id'].startswith(prefix)).update(owner='P26-03'), 'AR owner mismatch')
+        self.independent_reject(lambda d: next(r for r in d['rows'] if r['kind']=='route')
+            .update(status='missing'), 'route support/content distinction')
+        self.independent_reject(lambda d: next(r for r in d['rows'] if r['id'].startswith('usage.') and r['evidence'])
+            .update(status='missing'), 'usage representation status')
+        self.independent_reject(lambda d: next(r for r in d['rows'] if r['status']=='partial')
+            .update(status='produced'), 'partial support falsely produced')
+
+    def test_stale_atomic_original_and_usage_pins(self):
+        identity = 'AR.events.ntr_night_peak'
+        self.independent_reject(lambda d: d['atomic_dispositions'][identity]['record']
+            .update(source_sha256='0'*64), 'stale AR record')
+        self.independent_reject(lambda d: d['rows'][0]['citations'][0]
+            .update(sha256='0'*64), 'original citation integrity')
+        self.independent_reject(lambda d: next(r for r in d['rows'] if r['id'].startswith('usage.') and r['evidence'])
+            ['evidence'][0].update(sha256='0'*64), 'row evidence integrity')
+
+    def test_closed_support_attribution_independent_controls_and_injection(self):
+        rows = {r['id']: r for r in self.submitted['rows']}
+        audit.verify_authority(self.submitted, ROOT)
+        for identity, kind in [('route.anri.love', 'relationship-container'),
+                               ('original.line.65', 'night-input'),
+                               ('original.line.53', 'peeping-container')]:
+            with self.subTest(control=identity):
+                self.assertEqual(rows[identity]['status'], 'partial')
+                self.assertEqual(rows[identity]['content_status'], 'missing')
+                self.assertIn(kind, {c['kind'] for c in rows[identity]['scoped_support']})
+        for identity in ('voice.all', 'portraits.all', 'endings.all', 'encyclopedia.all'):
+            self.assertEqual(rows[identity]['status'], 'missing')
+            self.assertEqual(rows[identity]['evidence'], [])
+            # Valid pins + the old textual qualifier must not confer support.
+            def inject(d):
+                row = next(r for r in d['rows'] if r['id'] == identity)
+                row.update(status='partial', support_scope='backend only',
+                           evidence=copy.deepcopy(rows['original.line.53']['evidence']))
+            self.independent_reject(inject, 'unqualified partial support')
+        # Even a well-formed observation claim linked on the SAME source line
+        # cannot be attached to a voice summary.
+        def voice_claim(d):
+            voice = next(r for r in d['rows'] if r['id'] == 'voice.all')
+            mixed = rows['original.line.257']
+            for key in ('status', 'support_scope', 'scoped_support', 'evidence'):
+                voice[key] = copy.deepcopy(mixed[key])
+        self.independent_reject(voice_claim, 'support incompatible with requirement family')
+        # An original-clause row is an eligible family, but its debt-settlement
+        # ARs still cannot receive a peeping-container claim.
+        def content_claim(d):
+            row = next(r for r in d['rows'] if r['id'] == 'original.line.196')
+            donor = rows['original.line.53']
+            for key in ('status', 'support_scope', 'scoped_support', 'evidence'):
+                row[key] = copy.deepcopy(donor[key])
+            row['scoped_support'][0]['atomic_requirement_ids'] = row['atomic_requirement_ids'][:]
+            row['unsupported_atomic_requirement_ids'] = []
+        self.assertEqual(rows['original.line.196']['status'], 'missing')
+        self.independent_reject(content_claim, 'support incompatible with AR')
+        # Mixed rows retain missing voice/end/encyclopedia ARs; an attacker
+        # cannot expand a valid backend claim to those ARs.
+        for identity, atom in [('original.line.257', 'AR.schedule.B-14.3.voice_record'),
+                               ('clause.production', 'AR.asset.character_voice'),
+                               ('original.line.9', 'AR.progression.all_endings'),
+                               ('original.line.9', 'AR.progression.encyclopedia_complete')]:
+            with self.subTest(mixed=identity, atom=atom):
+                self.assertIn(atom, rows[identity]['unsupported_atomic_requirement_ids'])
+                def expand(d):
+                    row = next(r for r in d['rows'] if r['id'] == identity)
+                    row['scoped_support'][0]['atomic_requirement_ids'].append(atom)
+                    row['unsupported_atomic_requirement_ids'].remove(atom)
+                self.independent_reject(expand, 'support incompatible with AR')
+        # A valid claim does not license an additional, unrelated pinned file.
+        self.independent_reject(lambda d: next(r for r in d['rows'] if r['id']=='original.line.65')
+            ['evidence'].extend(copy.deepcopy(rows['original.line.53']['evidence'])),
+            'unrelated or unscoped support evidence')
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--project-root', type=Path, default=Path('.'))
+    args, remaining = parser.parse_known_args()
+    ROOT = args.project_root.resolve()
+    unittest.main(argv=[__file__] + remaining)

docs/plans/original-completion-2026-10-02/plan_validation.json

@@ -205,8 +205,8 @@
   "remaining_delivery_units": 88,
   "current_package_state_counts": {
     "completed": 1,
-    "in_progress": 27,
-    "planned": 2
+    "in_progress": 28,
+    "planned": 1
   },
   "initial_snapshot_checked": false,
   "historical_source_bytes_compared": false,
@@ -244,7 +244,7 @@
     "facility_value_contracts_validation.json": "bf490a9ca585c48fc318e76c4a069ef244827d828d46e6415399f7710590dd16",
     "performance_audit.json": "0b630b15a392c3e0366f1362bfe4ddacb968f915f54549f82e4d6fa315384762",
     "progress_contract.json": "ccbdfce8c8365d5c13f59531955708834cce45acd0e136561c95295dfdb5df77",
-    "progress_snapshot.json": "d929905fac7089ad359154fdaa9f4d65e323becf7a6b46c8cadd2ba6d1719a9c",
+    "progress_snapshot.json": "332dd0b3ba2e58c6801fdebf0ce42b672f7085479b6c4842b109c4e921b09686",
     "progress_validator_guard_checks.json": "72ee513fcf1cad85c24bfd0a4b472f425f6acf117928ece0f6b41e29018da627",
     "progress_validator_guard_checks.r01.json": "14c26adffa5a1938241db4912e50ea54b660641ee6fee2e412d467dce14d0519",
     "requirement_coverage.json": "03b10e4da367579db502d0671a6e0dda36fd385111c6f1c0084acaff7605f593",
@@ -254,6 +254,6 @@
     "validate_facility_value_contracts.py": "91640e2a76cd6cc9186f7b85c0bf379b24b6cac0d48962815235ee628e7ae43e",
     "validate_plan.py": "23678227d9b3c556f1bd903f4b5b3147c4a82ce5085e10055481026803451b80",
     "validator_update_checks.json": "f997d0f3de2cea29550840b1d5cb23647d64f81329de46758551e2b6c8fecc27",
-    "work_packages.json": "238c01a360ac9d8554d7f12586f3b34925b37365a04aacc477877b807e76c16a"
+    "work_packages.json": "9cac178af50d3320287c64aa518f6ec704fc71139a481c858f45b707eaf9f8ad"
   }
 }

docs/plans/original-completion-2026-10-02/progress_snapshot.json

@@ -152,13 +152,13 @@
   },
   "current_package_state_counts": {
     "completed": 1,
-    "in_progress": 27,
-    "planned": 2
+    "in_progress": 28,
+    "planned": 1
   },
   "current_delivery_state_counts": {
-    "completed": 14,
-    "in_progress": 23,
-    "planned": 51
+    "completed": 15,
+    "in_progress": 24,
+    "planned": 49
   },
   "completed_current_deliveries": [
     "P00-01",
@@ -9713,7 +9713,7 @@
     "execution": "the-tree-p06-01 Runner; recorded Claude decision, one Codex implementer",
     "current_gate_status": "not implemented or executed; formal completion not accepted"
   },
-  "next_closure_plan_id": "P24-02",
+  "next_closure_plan_id": "P04-01",
   "p24_03_formal_closure": "docs/plans/original-completion-2026-10-02/execution/p24-03-formal-closure-r01/closure.json",
   "new_engine_run_scope": "Supplemental positive metadata diagnostic r01 failed cleanup preparation/log isolation; r02 passed17checks unchanged source and entire default profile. No duplicated full game regression.",
   "current_closure_targets": {
@@ -10422,5 +10422,104 @@
     "source": "fe44f550750acbf5c510346e7cacbea2ccbdd184",
     "original_unit_credit_added": 0,
     "all8_accepted": false
-  }
+  },
+  "current_p13_02_backend_local_progress": {
+    "observed_at_jst": "2026-10-17T17:28:02.473746+09:00",
+    "source": "a7e3069b167511b3194242b3403fbcc35244a526",
+    "evidence": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-local-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+    "source_adopted_on_main": false,
+    "whole_original_accepted": false,
+    "new_credit": 0,
+    "local_suites": 15,
+    "local_checks": 863,
+    "full_regression": false,
+    "formal_independent_review": false,
+    "prior_delivery_counts_before_P13_started": {
+      "completed": 14,
+      "in_progress": 23,
+      "planned": 51
+    },
+    "scope": "Corrects planned→in_progress only; no formal completion or source adoption",
+    "full_scope_native": {
+      "actual_suites": 184,
+      "missing_marker_paths": [],
+      "remaining_unexecuted_tests": [],
+      "available_marker_checks": 21903,
+      "actual_all_roster_checks": 21903,
+      "strict_accepted_checks": 21903,
+      "verified": true,
+      "composed": true,
+      "original_full_attempt_passed": false,
+      "whole_original_acceptance": false,
+      "parse_checks": 329,
+      "setup_phases": 2,
+      "owned_ended": 186,
+      "tested_source": "a7e3069b167511b3194242b3403fbcc35244a526",
+      "engines_started": 0,
+      "verifier_sha256": "d00bf46bfcc0e0bb197edd284a3ae14610ca710507831e18e071a79461946e8a"
+    },
+    "latest_full_status": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+    "formal_review": {
+      "state": "terminal_pass",
+      "run_id": "ead8e74b9683404d8cf3d97bca118726",
+      "model": "claude-opus-5-5",
+      "critical_high_medium": 0,
+      "low": 4,
+      "artifact": "ACTUAL_INDEPENDENT_OPUS_REVIEW.json"
+    },
+    "formal_credit": 0,
+    "backend_batch_state": "completed",
+    "normal_integration_candidate": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+    "normal_final": {
+      "passed": true,
+      "commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+      "artifact": "FORMAL_FINAL.json"
+    },
+    "whole_original_acceptance": false
+  },
+  "current_p19_03_reachability": {
+    "state": "completed",
+    "spec": "docs/plans/original-completion-2026-10-02/execution/p19-03/TASK_SPEC.json",
+    "actual_opus": "dc342e4d69154660bef7e688a70fd783",
+    "original_unit_credit": 1,
+    "source_anchor": "1b07b87d3736e777932315a4bdde8b70cbf9cb23",
+    "P04_existing_questions": "preserved; no duplicate question or fake answer",
+    "S": "903a2c566e73cebc874a6499410a1243bc190a63",
+    "actual_reviewer": {
+      "id": "565d4f21c12b451da2d5a7dd462d099b",
+      "role": "reviewer",
+      "status": "finished",
+      "pid": 51196,
+      "artifact": "/Users/korizatou114/Library/Application Support/agent-control/the-tree-p19-03-reachability/runs/565d4f21c12b451da2d5a7dd462d099b"
+    },
+    "current_status": "docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_CURRENT_ACCEPTANCE_STATUS.json",
+    "whole_review": {
+      "run_id": "565d4f21c12b451da2d5a7dd462d099b",
+      "status": "pass",
+      "critical_high_medium": 0,
+      "low": 3,
+      "artifact": "ROOT_WHOLE_REVIEW_903A2C5.json"
+    },
+    "actual_repair_worker": {
+      "id": "bf8a86e053044bfea0051253fefb2ec7",
+      "status": "finished"
+    },
+    "nonformal_actual_main_preflight": {
+      "passed": true,
+      "source": "903a2c566e73cebc874a6499410a1243bc190a63",
+      "preflight_commit": "7f9b63b0c281d57be4abec1c576e5abef273ca78",
+      "main": "6e17cae5c9f0133fc3eb19e58572977f4151de7c",
+      "normal_integration_or_final_satisfied": false,
+      "artifact": "ROOT_ACTUAL_NONFORMAL_MAIN_PREFLIGHT_903A2C5.json"
+    },
+    "C": "8e4f1d92fc2a2e8f1dd187e661cf52b13e4e51d4",
+    "M": "e7acd530c5d43313534d0b6ee23c915aba3cf70a",
+    "normal_final": {
+      "passed": true,
+      "commit": "8e4f1d92fc2a2e8f1dd187e661cf52b13e4e51d4",
+      "artifact": "ROOT_NORMAL_FINAL_C8E4F1D9.json"
+    },
+    "whole_game_acceptance": false
+  },
+  "next_closure_note": "P04-01 remains first upon existing D05 answers; actual Opus will select next independent original work without duplicate worker or invented values."
 }

docs/plans/original-completion-2026-10-02/work_packages.json

@@ -3598,7 +3598,7 @@
     },
     "legacy_state": "in_progress",
     "state_scope": "package-level; completed means whole package accepted; partial implementation is not completion",
-    "current_summary": "現行1338sourceでS1/S2a/S2b/S3実測と正式復元を収集済み。実Opus/Astra18が動的raw収集/各series検証を実装し、Rootも実data・新規拒否fixture・既存Cをfile-onlyで各exit0再確認、既存Cブロック全bytes不変。担当が全体未達を理由にblocked応答したため未commitコードを全保持し通常repair19へ継続、goal停止なし。残3条件は停電/18:00の既存raw参照と保存getter型説明・厳密適用性を補正し、A実HEAD/tree/FS結合・旧fixture整合を実装する。getter追加APIの配列型差分を旧説明が網羅していなかった点はnoticeで訂正、正式全Runtime型付き復元一致の実測は保持。全原15+EV/7領域/安全性3結果/30-88/部分点0、必須whole・独立wholereview・通常integration/final未達、原成果加点0。",
+    "current_summary": "次に閉じる優先候補。実Runnerは提出2dde7596・修正29・repair_pending・未稼働、worktree差分0。実Opus ea12167cが最新29を再監査し、旧台帳のraw結合/getter/HEAD fixture等は既修正と確認、重複repairを起動しない。登録validationはpassでも正式レビュー275d1fd6はD05規則未確定等で不合格。破壊順序・00:00売上帰属と理由表示/退出の明文化を具体案で確認中。既承認2規則維持。全15+EV/7領域/安全性3結果/全条件・必須最終全回帰・独立wholeレビュー・通常integration/finalは維持。正式14/88、今回加算0。",
     "remaining_deliverables": [
       {
         "id": "P04-01",
@@ -3851,38 +3851,41 @@
             "sha256_at_integration": "dfd9665ec1a8922201ce325c70505e7bf2d880a044daa49dddd92241007a438f",
             "scope": "S3 bounded raw proof only; six actual native cases/formal22 slots/176phase pairs/16clock replay pairs; no whole original credit",
             "linked_at_jst": "2026-10-16T04:54:54.811581+09:00"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+            "sha256": "908111f64a3d6c206504e26e76c721a0a97864238f6f6bb6604ac7b8e31ce7bf",
+            "scope": "Actual latest29 state and Opus re-audit supersede stale repair19 remaining work; zero formal credit"
           }
         ],
-        "current_summary": "現行1338sourceでS1/S2a/S2b/S3実測と正式復元を収集済み。実Opus/Astra18が動的raw収集/各series検証を実装し、Rootも実data・新規拒否fixture・既存Cをfile-onlyで各exit0再確認、既存Cブロック全bytes不変。担当が全体未達を理由にblocked応答したため未commitコードを全保持し通常repair19へ継続、goal停止なし。残3条件は停電/18:00の既存raw参照と保存getter型説明・厳密適用性を補正し、A実HEAD/tree/FS結合・旧fixture整合を実装する。getter追加APIの配列型差分を旧説明が網羅していなかった点はnoticeで訂正、正式全Runtime型付き復元一致の実測は保持。全原15+EV/7領域/安全性3結果/30-88/部分点0、必須whole・独立wholereview・通常integration/final未達、原成果加点0。",
+        "current_summary": "次に閉じる優先候補。実Runnerは提出2dde7596・修正29・repair_pending・未稼働、worktree差分0。実Opus ea12167cが最新29を再監査し、旧台帳のraw結合/getter/HEAD fixture等は既修正と確認、重複repairを起動しない。登録validationはpassでも正式レビュー275d1fd6はD05規則未確定等で不合格。破壊順序・00:00売上帰属と理由表示/退出の明文化を具体案で確認中。既承認2規則維持。全15+EV/7領域/安全性3結果/全条件・必須最終全回帰・独立wholeレビュー・通常integration/finalは維持。正式14/88、今回加算0。",
         "remaining_conditions": [
-          "原7種更新順序・証拠対応の原本/承認済み仕様への全条件適合性と規約凍結を最終独立受入する",
-          "承認D05の依存先休業pause/resume日跨ぎと正式SaveService/別PID復元はmain5f6bc11で実測済み。既存証拠と残の原7領域全条件への適合性・独立whole受入を残す。直接休業D-034と区別する。",
-          "承認18:00完了後交代/同分再送/実00:00決算、夜番不在/残業に加え、停電+直接休業/退出/元忍耐自然枯渇/破壊の原残境界と正式22slot再生をS3 accdで収集済み。全原条件raw結合・適用性・独立whole受入は未達。",
-          "既存39証拠等の適用版・入力・設定・環境を照合して不足境界だけ検証。全条件独立受入と通常統合/final/台帳反映。D05他領域は具体的根拠を確認し一括解決/一括停止にしない"
+          "owner choices for destruction order and midnight-sale day, plus explicit disposition of reason label and command/AI exit",
+          "after actual answers, normal batched checker destruction-authority pin / registry / approval record / stale current metadata correction",
+          "final gates as listed; previous full178 f5 receipt is not full final checker a61 evidence; no relabeling"
         ],
-        "progress_summary": "現行1338sourceでS1/S2a/S2b/S3実測と正式復元を収集済み。実Opus/Astra18が動的raw収集/各series検証を実装し、Rootも実data・新規拒否fixture・既存Cをfile-onlyで各exit0再確認、既存Cブロック全bytes不変。担当が全体未達を理由にblocked応答したため未commitコードを全保持し通常repair19へ継続、goal停止なし。残3条件は停電/18:00の既存raw参照と保存getter型説明・厳密適用性を補正し、A実HEAD/tree/FS結合・旧fixture整合を実装する。getter追加APIの配列型差分を旧説明が網羅していなかった点はnoticeで訂正、正式全Runtime型付き復元一致の実測は保持。全原15+EV/7領域/安全性3結果/30-88/部分点0、必須whole・独立wholereview・通常integration/final未達、原成果加点0。",
+        "progress_summary": "次に閉じる優先候補。実Runnerは提出2dde7596・修正29・repair_pending・未稼働、worktree差分0。実Opus ea12167cが最新29を再監査し、旧台帳のraw結合/getter/HEAD fixture等は既修正と確認、重複repairを起動しない。登録validationはpassでも正式レビュー275d1fd6はD05規則未確定等で不合格。破壊順序・00:00売上帰属と理由表示/退出の明文化を具体案で確認中。既承認2規則維持。全15+EV/7領域/安全性3結果/全条件・必須最終全回帰・独立wholeレビュー・通常integration/finalは維持。正式14/88、今回加算0。",
         "remaining_gaps": [
-          "既存CとS1/S2a/S2b/S3のraw収集/各series検証は実装済み、Root実data/新fixture/C各exit0。停電はS3実power flagと復旧前後、18:00はnative-first-current actual-nativeの正しい生証拠へ結合する。全原15+EV適用性を揃える。",
-          "save_restoreの正式全Runtime var_to_bytes一致は保持。追加API rawgetterに既存source _to_snapshot_variantが配列型制約も変換する点を旧説明が見落としたため、原frozen条件とsource定義のcanonical契約へ厳密に照合し訂正する。JSON-only/盲目的正規化/原基準緩和は禁止。",
-          "Aの実候補HEAD/tree/FS照合、旧MAIN/metadata数固定とcandidate_tree自己申告の穴、旧negative/applicability fixture失敗を直す。C全bodyと改ざん拒否は保持。",
-          "原7領域/安全性3結果/全条件と必須whole検証・別セッション独立wholeレビュー・通常integration/final・台帳反映を完結する。原成果加点0。"
+          "owner choices for destruction order and midnight-sale day, plus explicit disposition of reason label and command/AI exit",
+          "after actual answers, normal batched checker destruction-authority pin / registry / approval record / stale current metadata correction",
+          "final gates as listed; previous full178 f5 receipt is not full final checker a61 evidence; no relabeling"
         ],
-        "updated_at_jst": "2026-10-16T05:25:51.943207+09:00",
-        "current_recheck": "execution/p04-01-current-recheck-20261015/CURRENT_ACCEPTANCE_STATUS.json",
-        "policy_candidate": "execution/p04-01-current-recheck-20261015/D05_POLICY_CANDIDATE.md",
+        "updated_at_jst": "2026-10-17T16:30:38.746525+09:00",
+        "current_recheck": "execution/p04-01-current-recheck-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+        "policy_candidate": "execution/p04-01-current-recheck-20261017/D05_REMAINING_ORDER_CANDIDATE.md",
         "owner_policy_update": {
           "approved": true,
           "reference": "docs/plans/original-completion-2026-10-02/execution/p04-01-current-recheck-20261015/D05_OWNER_APPROVAL.json",
           "scope": "two owner policy selections only; no acceptance credit",
           "remaining": "condition-specific evidence applicability, missing boundaries, independent review, ordinary integration/final",
-          "actual_commander": "execution/p04-01-current-recheck-20261015/OPUS_REPAIR18_FULL_INPUT_CONTINUATION_DECISION.json",
-          "runner_state": "repair_ready",
-          "repairs": 19,
-          "worker_model": "gpt-6-astra",
+          "actual_commander": "execution/p04-01-current-recheck-20261017/ACTUAL_OPUS_LATEST29_DECISION.json",
+          "runner_state": "repair_pending",
+          "repairs": 29,
+          "worker_model": null,
           "model_selected_by": "actual Claude Opus 5.5 run decision",
-          "run_decision": "execution/p04-01-current-recheck-20261015/OPUS_REPAIR18_FULL_INPUT_CONTINUATION_DECISION.json",
-          "submitted": "accd07c91d4e34d9b7c7fc20e389df2424b167e1",
-          "registered_validation": "0689f0070bd54d4f8b5849bb63bb36a8",
+          "run_decision": null,
+          "submitted": "2dde7596a87c43f7bf0bf704b7479f2fa06a5b1c",
+          "registered_validation": "91d92e164b164bb091ae90e384da5636",
           "root_work_continues": true,
           "native_shift_proof": "execution/p04-01-current-recheck-20261015/ROOT_APPROVED_SHIFT_CURRENT_RESULT.json",
           "incomplete_checkpoint": "execution/p04-01-current-recheck-20261015/REPAIR7_PRESERVED_WORK.json",
@@ -3891,7 +3894,7 @@
           "formal_dependency_proof": "execution/p04-01-current-recheck-20261015/ROOT_APPROVED_DEPENDENCY_FORMAL_RESULT.json",
           "timeout_adapter": "execution/p04-01-current-recheck-20261015/OWNER_P04_LLM_TIMEOUT_ADAPTER.json",
           "actual_run": null,
-          "current_scope": "Preserved executable R; next actual Opus direction for missing raw joins/getter type correction and real candidate A/fixtures. No new registered validation of unchanged accd.",
+          "current_scope": "Latest29 audited; no worker or repair launched. Owner D05 answers pending; normal bounded authority/record correction only after actual answer. Existing two approvals unchanged.",
           "paid_shift_midnight_formal_proof": "execution/p04-01-current-recheck-20261015/ROOT_PAID_SHIFT_MIDNIGHT_FORMAL_RESULT.json",
           "same_minute_formal_proof": "execution/p04-01-current-recheck-20261015/ROOT_SAME_MINUTE_RESEND_FORMAL_RESULT.json",
           "corrected_c_bundle": "execution/p04-01-current-recheck-20261015/ROOT_CORRECTED_C_BUNDLE_LOCAL_PASS.json",
@@ -3902,9 +3905,21 @@
             "execution/p04-01-current-recheck-20261015/ROOT_S2B_NATIVE_R02_RESULT.json",
             "execution/p04-01-current-recheck-20261015/ROOT_S2B_NATIVE_R01_RESULT.json",
             "execution/p04-01-current-recheck-20261015/ROOT_S2A_NATIVE_R03_RESULT.json"
-          ]
+          ],
+          "historical_runner_context_before_current_reaudit": {
+            "runner_state": "repair_ready",
+            "repairs": 19,
+            "submitted": "accd07c91d4e34d9b7c7fc20e389df2424b167e1",
+            "registered_validation": "0689f0070bd54d4f8b5849bb63bb36a8",
+            "worker_model": "gpt-6-astra",
+            "actual_commander": "execution/p04-01-current-recheck-20261015/OPUS_REPAIR18_FULL_INPUT_CONTINUATION_DECISION.json",
+            "run_decision": "execution/p04-01-current-recheck-20261015/OPUS_REPAIR18_FULL_INPUT_CONTINUATION_DECISION.json",
+            "current_scope": "Preserved executable R; next actual Opus direction for missing raw joins/getter type correction and real candidate A/fixtures. No new registered validation of unchanged accd."
+          }
         },
-        "historical_initial_recheck": "execution/p04-01-current-recheck-20261015/recheck.json"
+        "historical_initial_recheck": "execution/p04-01-current-recheck-20261015/recheck.json",
+        "submitted_commit": "2dde7596a87c43f7bf0bf704b7479f2fa06a5b1c",
+        "normal_integration_candidate": null
       },
       {
         "id": "P04-02",
@@ -7996,7 +8011,7 @@
     },
     "legacy_state": "planned",
     "state_scope": "package-level; completed means whole package accepted; partial implementation is not completion",
-    "current_summary": "P13-03「内容差異の記録」を正式完了。提出bd3a97e、原8条件を別Opusレビュー、実統合/最終e80c6c0で確認。全7施設/84利用枠/6分類、33拒否+代替正常系、固定原30/88・部分点なし。記録1件のみ、内容/素材/P13パッケージ/原子/ゲーム完成の加点0。P13-01/02とD08/D09・未制作内容は未完了。",
+    "current_summary": "P13-03は原成果として完了済み。P13-02の限定CODE1のみ通常最終ゲートまで完了し、元P13-02全条件は引き続き未達。限定backend CODE1は提出a7e3069→通常統合C65f07bf/M191ea3bでRunner completed。厳密15/863登録検証、全184/21903・329構文・186実PID終了の正確合成証明、別Opus全CODE1レビュー合格（重大/高/中0・低4を後続記録）、実候補の全1368入力等値照合、通常integration/finalを完了。元ENOSPC全回帰の失敗記録と全量可逆退避は保持。親P13-02の通常建設・記録係・承認値・自然収集・VIP/完成素材/Windows等は未達、原正式14/88から加算0。",
     "remaining_deliverables": [
       {
         "id": "P13-01",
@@ -8011,8 +8026,44 @@
         "title": "背面条件と対象参照",
         "work": "覗き部屋の対象背面、通路寸断、対象喪失と証拠IDを状態として実装する。",
         "acceptance": "対象撤去、重複収集、停止、途中保存で状態と参照が整合する。",
-        "state": "planned",
-        "evidence": []
+        "state": "in_progress",
+        "evidence": [
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_TASK_SPEC.json",
+            "sha256": "988d6e18a49372549863cd433432c2852c962fa64b138e490361c023e80249dc",
+            "scope": "Actual Opus-selected bounded implementation contract preparation; no tests or whole acceptance credit"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-e930a1d-native-import-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+            "sha256": "87122b4256cafac78f5fe0efe3253f5d59bbda5e8bfdf727c177bb354050207c",
+            "scope": "Actual submitted backend and failed owned import guard evidence; no passing suites or formal credit"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-local-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+            "sha256": "6635dfeaa73fe69f3395e8d03bc9ae5f8506a04259e8682917a3cf11b0f8575a",
+            "scope": "Actual15/863 local and329 parse with all17 owned engines ended and exact UID policy; no whole-original acceptance or credit"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+            "sha256": "9a37598317771097232be1f92bba4b7b21fd399ec2d173abb115662d8ba5c310",
+            "scope": "Actual qualified composed184/21903/329parse/186ended; original failed full not overwritten; formal independent review and integration/final pending, original credit0"
+          }
+        ],
+        "progress_summary": "限定backend CODE1は提出a7e3069→通常統合C65f07bf/M191ea3bでRunner completed。厳密15/863登録検証、全184/21903・329構文・186実PID終了の正確合成証明、別Opus全CODE1レビュー合格（重大/高/中0・低4を後続記録）、実候補の全1368入力等値照合、通常integration/finalを完了。元ENOSPC全回帰の失敗記録と全量可逆退避は保持。親P13-02の通常建設・記録係・承認値・自然収集・VIP/完成素材/Windows等は未達、原正式14/88から加算0。",
+        "current_summary": "限定backend CODE1は提出a7e3069→通常統合C65f07bf/M191ea3bでRunner completed。厳密15/863登録検証、全184/21903・329構文・186実PID終了の正確合成証明、別Opus全CODE1レビュー合格（重大/高/中0・低4を後続記録）、実候補の全1368入力等値照合、通常integration/finalを完了。元ENOSPC全回帰の失敗記録と全量可逆退避は保持。親P13-02の通常建設・記録係・承認値・自然収集・VIP/完成素材/Windows等は未達、原正式14/88から加算0。",
+        "updated_at_jst": "2026-10-17T19:05:57.762697+09:00",
+        "current_execution": "docs/plans/original-completion-2026-10-02/execution/p13-02/root-a7e3069-full-20261017/CURRENT_ACCEPTANCE_STATUS.json",
+        "remaining_gaps": [
+          "Whole original P13-02 normal construction/recorder/natural triggers/approved quantities/VIP/UI/assets/Windows and all original conditions remain unaccepted; CODE1 has no new original-unit credit",
+          "Four low severity future-production defensive/migration/coverage observations retained from actual Opus review; no observed ordinary production path and no critical/high/medium finding",
+          "P04-01 remains next original formal closure when existing D05 owner choices arrive; independent next original-unit selection will be requested from actual Opus"
+        ],
+        "submitted_commit": "a7e3069b167511b3194242b3403fbcc35244a526",
+        "normal_integration_candidate": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+        "worker_model": "gpt-6-astra",
+        "model_selected_by_actual_opus": "19f00667226d42dd8e9b3a4ae99aaa68",
+        "integrated_commit": "65f07bf5eaa759a8e2e17c7bdbbbdbceb24ee373",
+        "backend_batch_state": "completed"
       },
       {
         "id": "P13-03",
@@ -8076,7 +8127,7 @@
     ],
     "cross_cutting_acceptance_scope": "Completion requirements only, not achieved results. Apply each to relevant slices; non-applicable views require a recorded reason.",
     "initial_revision_state": "planned",
-    "updated_at_jst": "2026-10-15T20:07:06.405550+09:00"
+    "updated_at_jst": "2026-10-17T19:05:57.762697+09:00"
   },
   {
     "id": "P14",
@@ -8936,7 +8987,7 @@
       "D07",
       "D08"
     ],
-    "state": "planned",
+    "state": "in_progress",
     "supplement_ids": [],
     "owner_roles": {
       "implementation": "実装担当（担当者未割当）",
@@ -8945,7 +8996,7 @@
     },
     "legacy_state": "planned",
     "state_scope": "package-level; completed means whole package accepted; partial implementation is not completion",
-    "current_summary": "一般イベント基盤はあるが原本の決闘・人物行動の全接続は未着手。",
+    "current_summary": "P19-03分岐到達表の原成果を正式完了。P19-01/02のゲーム内行動・決闘・履歴等は未完。原P19-03を正式完了。S903a2c5→通常C8e4f1d9/Me7acd53、元受入7名×3ルート21セルと全8カテゴリ・23共通ルール・未制作欠損を実Opus565d全条件レビュー合格。登録3検証/16自己試験・実候補integration/final合格、レビュー済8文書と1368ゲーム入力の完全等値照合。原本/定義/未承認事項を保ち進捗メタだけ分離。原正式14→15/88（本件+1、部分点なし）。全ルート実装/完成素材/Windows等の全ゲーム完了は別未達。",
     "remaining_deliverables": [
       {
         "id": "P19-01",
@@ -8968,8 +9019,30 @@
         "title": "分岐の到達性",
         "work": "人物ごとの3ルートに必要なイベント・条件・中断処理を列挙する。",
         "acceptance": "7名×3ルートの到達表があり、未制作内容は欠損として残る。",
-        "state": "planned",
-        "evidence": []
+        "state": "completed",
+        "evidence": [
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p19-03/TASK_SPEC.json",
+            "sha256": "263a01b943d8056727335fb76977c010298e1c229077f8da76e48683ba2e89bb",
+            "scope": "Actual Opus-selected original unit contract preparation; no acceptance credit"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_CURRENT_ACCEPTANCE_STATUS.json",
+            "sha256": "02c474558fbd32e99ebb8069e5cfa3318048d8d7b72f12887e885bc37c294da2",
+            "scope": "Actual registered3checks+selftests10 PASS; exact game-input reuse qualified; whole semantic review/integration/final pending, original credit0"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_RUNNER_COMPLETED_TRACEABILITY.json",
+            "sha256": "b433a6b52bb722fa8e9cdc2a161abbca71693f45926bb5c7bf1b00716d3d7f5a",
+            "scope": "Whole original P19-03 acceptance, independent review, normal exactC/M integration/final, existing real authorization; originalcredit1 only; no gamecompletion"
+          }
+        ],
+        "current_summary": "原P19-03を正式完了。S903a2c5→通常C8e4f1d9/Me7acd53、元受入7名×3ルート21セルと全8カテゴリ・23共通ルール・未制作欠損を実Opus565d全条件レビュー合格。登録3検証/16自己試験・実候補integration/final合格、レビュー済8文書と1368ゲーム入力の完全等値照合。原本/定義/未承認事項を保ち進捗メタだけ分離。原正式14→15/88（本件+1、部分点なし）。全ルート実装/完成素材/Windows等の全ゲーム完了は別未達。",
+        "progress_summary": "原P19-03を正式完了。S903a2c5→通常C8e4f1d9/Me7acd53、元受入7名×3ルート21セルと全8カテゴリ・23共通ルール・未制作欠損を実Opus565d全条件レビュー合格。登録3検証/16自己試験・実候補integration/final合格、レビュー済8文書と1368ゲーム入力の完全等値照合。原本/定義/未承認事項を保ち進捗メタだけ分離。原正式14→15/88（本件+1、部分点なし）。全ルート実装/完成素材/Windows等の全ゲーム完了は別未達。",
+        "updated_at_jst": "2026-10-17T20:29:39.555420+09:00",
+        "current_execution": "docs/plans/original-completion-2026-10-02/execution/p19-03/ROOT_CURRENT_ACCEPTANCE_STATUS.json",
+        "remaining_gaps": [],
+        "submitted_commit": "903a2c566e73cebc874a6499410a1243bc190a63"
       }
     ],
     "estimate_person_days_historical_2026_09_29": [
@@ -8989,7 +9062,8 @@
       "要件別ログとソースハッシュを保存"
     ],
     "cross_cutting_acceptance_scope": "Completion requirements only, not achieved results. Apply each to relevant slices; non-applicable views require a recorded reason.",
-    "initial_revision_state": "planned"
+    "initial_revision_state": "planned",
+    "updated_at_jst": "2026-10-17T20:29:39.555420+09:00"
   },
   {
     "id": "P20",
@@ -16235,7 +16309,7 @@
     },
     "legacy_state": "in_progress",
     "state_scope": "package-level; completed means whole package accepted; partial implementation is not completion",
-    "current_summary": "提出bd3a134（修正使用済み4・上限なし）を同一Runnerで正式提出し保持branchへpush。GUI成果を保持してOpus判断でCodex6.1-solへ非UIのみ引継ぎ、countによる必須roster欠損容認とenv偽HEADを修正。実compile/保全/diff確認合格、局所9試験は実exit0+3入力SHA一致で再利用。別Opus限定静的review95cffd7 pass、重大/高/中0・low5、全8受入の加点0。実合成Q4bf9a1b/treea0667b9（M51e8657）を実4競合のS内容で準備、source1368/必須roster180はいずれも未実行。厳密Root合成契約・条件別artifact対応・実UI/OS/警告上流・最終全回帰/全8review/通常統合/Windowsが残る。 P24-03既完了とP24全体の完成は別。",
+    "current_summary": "提出fe44f55保持。実main565/Q429/T905で通常OSメニュー→別名保存→取消→再開→通常終了を採取。824停止サンプル89.116049秒、3節目モデル一致、実Opus b416限定review pass（重大/高/中0）。既存保存・非空待機列・focus復元機構・全8は未証明。原成果加算0。上流未実装に依存する警告等を残し、次に閉じる優先候補をP04-01へ切替。",
     "remaining_deliverables": [
       {
         "id": "P24-01",
@@ -16388,10 +16462,15 @@
             "path": "docs/plans/original-completion-2026-10-02/execution/p24-02/root-readiness-repair6-20261017/CURRENT_ACCEPTANCE_AND_NEXT_GATE.json",
             "sha256": "ad38069fb28ca3218b31bc75673a308ee29b49ac1e30eefb4009d94e0d3b26c4",
             "scope": "Current source6 limited review/actual S-Q post-submit reproduction/native import326parse/3 affected suites; all8 unaccepted, no unit credit"
+          },
+          {
+            "path": "docs/plans/original-completion-2026-10-02/execution/p24-02/normal-os-case-20261017/AUTHORITATIVE_NARROW_CASE_CLARIFICATIONS.json",
+            "sha256": "fd83e2edd4ac00bc9f8c568f6283ee47af43f91ef06336d36d775508a96682a5",
+            "scope": "One real normal-OS case / limited separate Opus review only; all8 unaccepted, no unit credit"
           }
         ],
-        "updated_at_jst": "2026-10-17T15:19:09.416187+09:00",
-        "progress_summary": "提出fe44f55（同一Runner・修正6・上限なし）を保持branchへpush。Opus選定AstraがmovingHEAD基準と非OS証拠/段階循環の2中指摘を修正。実Sと実Qの各2局所試験を提出後に実行し全0、別Opus3cd2285限定レビューpass（重大/高/中0、low5）。実合成M54/Qefd/T1cでimport・326構文・影響3スイート171チェック合格、所有5PID終了、保全/cleanupエラー0。全8は未受入、正式加算0。実通常OS/型付き証拠のend-to-end・上流生産トリガ・最終全回帰/全8review/通常integration-finalが残る。",
+        "updated_at_jst": "2026-10-17T16:30:38.746525+09:00",
+        "progress_summary": "提出fe44f55保持。実main565/Q429/T905で通常OSメニュー→別名保存→取消→再開→通常終了を採取。824停止サンプル89.116049秒、3節目モデル一致、実Opus b416限定review pass（重大/高/中0）。既存保存・非空待機列・focus復元機構・全8は未証明。原成果加算0。上流未実装に依存する警告等を残し、次に閉じる優先候補をP04-01へ切替。",
         "remaining_gaps": [
           "placement_and_invalid_drop: Local native coverage passed. Ordinary OS valid/invalid placement and assignment/drop, actual explanation, valid-target behind-modal attempts and click equivalence with model/ledger/selection proof remain.",
           "modal_and_pause_resume: Defense visibility callback and native operation/pause/cancel checks passed. Real valid-target positive control, all required normal modal/focus/pending/save identity and distinct-process continuity remain.",
@@ -16402,7 +16481,7 @@
           "japanese_input_and_scale: Current ordinary OS IME composition/cancel/confirm/invalid input, Japanese persisted save, distinct-process load and required scale/focus/clipping remain. Same Windows release device requirements remain explicitly separate and unaccepted.",
           "final_validation_review: Source/composition guard and twoMedium corrections passed limited review; actual newS/Q post-submit stdlib proof and native import/326parse/3 affected suites passed. Real typed OS/runtime/command/roster artifact assembly and schema end-to-end positive, exact final full180-or-current roster once, whole8 formal Opus review, normal candidate/integration/final remain. Rebind actual current M/Q before formal gates; oldQ is never relabelled."
         ],
-        "current_execution": "docs/plans/original-completion-2026-10-02/execution/p24-02/root-readiness-repair6-20261017/CURRENT_ACCEPTANCE_AND_NEXT_GATE.json",
+        "current_execution": "docs/plans/original-completion-2026-10-02/execution/p24-02/normal-os-case-20261017/CURRENT_AND_NEXT.md",
         "submitted_commit": "fe44f550750acbf5c510346e7cacbea2ccbdd184",
         "normal_integration_candidate": null
       },

scripts/core/save_service.gd

@@ -1048,6 +1048,13 @@ static func _snapshot_package_format(snapshot: Dictionary) -> int:
 	if not runtime_data is Dictionary: return FORMAT_VERSION # no owned Runtime authority
 	var version: Variant = runtime_data.get(&"runtime_schema_version", 1)
 	if typeof(version) != TYPE_INT: return -1
+	if runtime_data.has(&"special_peeping_rooms"):
+		var section_clock: Variant = snapshot.get(&"clock")
+		if not section_clock is Dictionary or typeof(section_clock.get(&"absolute_minute")) != TYPE_INT: return -1
+		if not preload("res://scripts/special/peeping_room_service.gd").valid_runtime_section(runtime_data, section_clock[&"absolute_minute"]): return -1
+		# Keep PurchaseQuotePlansV2's exact original allowlist and all format rules.
+		runtime_data = runtime_data.duplicate()
+		runtime_data.erase(&"special_peeping_rooms")
 	if version >= 1 and version <= 14:
 		return -1 if PurchaseQuoteV2.has_history(runtime_data) else FORMAT_VERSION
 	if version != 15: return -1

scripts/special/peeping_room_service.gd

@@ -0,0 +1,271 @@
+class_name PeepingRoomService
+extends RefCounted
+
+## Non-graphic state/reference machinery; production definitions remain pending.
+const SECTION_VERSION := 1
+const ALLOWED_TARGETS := [&"public_bath", &"adult_private_room"]
+const OCCUPANCY_KIND := &"special_peeping_room"
+const ID_PREFIX := &"peeping_room"
+const ROOM_KEYS := [&"room_id", &"origin", &"footprint", &"cells", &"target_instance_id", &"target_definition_id", &"target_history", &"link_state", &"stopped", &"stop_reason"]
+const EVIDENCE_KEYS := [&"evidence_id", &"room_id", &"target_instance_id", &"source_event_key", &"minute"]
+
+var _rooms: Dictionary = {}
+var _evidence: Dictionary = {}
+var _world: WorldService
+var _facilities: FacilityService
+var _construction: ConstructionService
+var _path: PathService
+var _ids: StableIdGenerator
+
+func configure(world: WorldService, facilities: FacilityService, construction: ConstructionService, path: PathService, ids: StableIdGenerator) -> void:
+	_world = world
+	_facilities = facilities
+	_construction = construction
+	_path = path
+	_ids = ids
+
+static func result(reason: StringName = &"OK") -> Dictionary:
+	return {&"ok": reason == &"OK", &"reason": reason}
+
+func is_empty() -> bool:
+	return _rooms.is_empty() and _evidence.is_empty()
+
+func get_room(room_id: StringName) -> Dictionary:
+	return (_rooms.get(room_id, {}) as Dictionary).duplicate(true)
+
+## Pure validation. own_room is supplied internally only for explicit relink/restore.
+func validate_placement(origin: Vector3i, footprint: Vector2i = Vector2i(2, 1), target_id: StringName = &"", own_room: StringName = &"") -> Dictionary:
+	if origin.z != WorldService.LAYER_BACK: return result(&"WRONG_LAYER")
+	if footprint != Vector2i(2, 1): return result(&"WRONG_FOOTPRINT")
+	if target_id == &"vip_suite": return result(&"PENDING_P10_01")
+	var cells := _world.cells_for_footprint(origin, footprint)
+	var targets: Array[StringName] = []
+	var missing := false
+	for cell: Vector3i in cells:
+		if not _world.is_in_bounds(cell): return result(&"OUT_OF_BOUNDS")
+		if cell.y < 0 and not _world.is_excavated(cell): return result(&"NOT_EXCAVATED")
+		var front := Vector3i(cell.x, cell.y, WorldService.LAYER_FRONT)
+		if _world.get_occupant_kind(front) == &"construction": return result(&"TARGET_INCOMPLETE")
+		var occupant := _world.get_occupant(front)
+		if occupant.is_empty(): missing = true
+		elif occupant not in targets: targets.append(occupant)
+	if targets.size() > 1: return result(&"MULTIPLE_TARGETS")
+	if missing: return result(&"TARGET_MISSING" if targets.is_empty() else &"PARTIAL_TARGET")
+	var resolved_id := targets[0]
+	if not target_id.is_empty() and target_id != resolved_id: return result(&"TARGET_MISMATCH")
+	var target := _facilities.get_instance(resolved_id)
+	if target == null: return result(&"TARGET_UNKNOWN")
+	if target.definition_id not in ALLOWED_TARGETS: return result(&"TARGET_NOT_ALLOWED")
+	if target.origin.z != WorldService.LAYER_FRONT: return result(&"TARGET_WRONG_LAYER")
+	var built := _construction.get_facility(resolved_id)
+	if built.is_empty(): return result(&"TARGET_INCOMPLETE")
+	if built.get(&"definition_id") != target.definition_id: return result(&"TARGET_MISMATCH")
+	for cell: Vector3i in cells:
+		var front := Vector3i(cell.x, cell.y, WorldService.LAYER_FRONT)
+		if front not in target.occupied_cells or front not in built[&"occupied_cells"]: return result(&"PARTIAL_TARGET")
+		# Reject cutting an existing corridor; never construct an implicit bypass.
+		if _world.is_walkable(cell) or _path.has_cell(cell): return result(&"CORRIDOR_CONFLICT")
+	var occupancy := _world.validate_occupancy(cells)
+	if not occupancy[&"ok"]:
+		if own_room.is_empty() or _world.get_entity_cells(own_room) != cells or _world.get_entity_kind(own_room) != OCCUPANCY_KIND:
+			return result(&"BACK_OCCUPIED")
+	var report := result()
+	report.merge({&"cells": cells, &"target_instance_id": resolved_id, &"target_definition_id": target.definition_id})
+	return report
+
+## CONTROLLED_FIXTURE: tests only. No Runtime executor or palette calls this.
+func controlled_fixture_place(origin: Vector3i, target_id: StringName = &"") -> Dictionary:
+	var report := validate_placement(origin, Vector2i(2, 1), target_id)
+	if not report[&"ok"]: return report
+	var room_id := _ids.next_id(ID_PREFIX)
+	if room_id.is_empty(): return result(&"ID_EXHAUSTED")
+	if not _world.occupy(room_id, report[&"cells"], OCCUPANCY_KIND): return result(&"BACK_OCCUPIED")
+	_rooms[room_id] = {&"room_id": room_id, &"origin": origin, &"footprint": Vector2i(2, 1),
+		&"cells": report[&"cells"].duplicate(), &"target_instance_id": report[&"target_instance_id"],
+		&"target_definition_id": report[&"target_definition_id"],
+		&"target_history": [report[&"target_instance_id"]], &"link_state": &"LINKED",
+		&"stopped": true, &"stop_reason": &"CONTROLLED_FIXTURE"}
+	report[&"room_id"] = room_id
+	return report
+
+func target_removed(target_id: StringName) -> void:
+	for room: Dictionary in _rooms.values():
+		if room[&"target_instance_id"] == target_id:
+			room[&"link_state"] = &"TARGET_LOST"
+			room[&"stopped"] = true
+			room[&"stop_reason"] = &"TARGET_LOST"
+
+func detect_target_loss() -> void:
+	for room: Dictionary in _rooms.values():
+		if room[&"link_state"] == &"TARGET_LOST": continue
+		if not _target_still_present(room): target_removed(room[&"target_instance_id"])
+
+func _target_still_present(room: Dictionary) -> bool:
+	var target := _facilities.get_instance(room[&"target_instance_id"])
+	if target == null or target.definition_id != room[&"target_definition_id"]: return false
+	for cell: Vector3i in room[&"cells"]:
+		if _world.get_occupant(Vector3i(cell.x, cell.y, WorldService.LAYER_FRONT)) != target.instance_id: return false
+	return true
+
+func relink(room_id: StringName, target_id: StringName) -> Dictionary:
+	if not _rooms.has(room_id): return result(&"ROOM_MISSING")
+	if target_id.is_empty(): return result(&"TARGET_MISSING")
+	var room: Dictionary = _rooms[room_id]
+	var report := validate_placement(room[&"origin"], room[&"footprint"], target_id, room_id)
+	if not report[&"ok"]: return report
+	room[&"target_instance_id"] = target_id
+	room[&"target_definition_id"] = report[&"target_definition_id"]
+	if target_id not in room[&"target_history"]: room[&"target_history"].append(target_id)
+	room[&"link_state"] = &"LINKED"
+	room[&"stopped"] = true
+	room[&"stop_reason"] = &"RELINKED_PENDING_RESUME"
+	return result()
+
+func _collection_precondition(room_id: StringName, source_event_key: StringName, minute: int) -> Dictionary:
+	if String(source_event_key).strip_edges().is_empty(): return result(&"SOURCE_EVENT_KEY_REQUIRED")
+	if minute < 0: return result(&"INVALID_MINUTE")
+	if not _rooms.has(room_id): return result(&"ROOM_MISSING")
+	detect_target_loss()
+	var room: Dictionary = _rooms[room_id]
+	# Required precedence: stopped, power, closed, construction, lost target.
+	if room[&"stopped"]: return result(&"STOPPED")
+	var target := _facilities.get_instance(room[&"target_instance_id"])
+	if target != null:
+		if not target.power_available: return result(&"NO_POWER")
+		if not target.operator_open or not target.is_within_opening_hours(minute): return result(&"CLOSED")
+		if _construction.get_facility(target.instance_id).is_empty(): return result(&"UNDER_CONSTRUCTION")
+	if room[&"link_state"] == &"TARGET_LOST" or target == null: return result(&"TARGET_LOST")
+	return result()
+
+func record_evidence(room_id: StringName, source_event_key: StringName, minute: int) -> Dictionary:
+	var report := _collection_precondition(room_id, source_event_key, minute)
+	return report if not report[&"ok"] else result(&"RECORDER_ELIGIBILITY_PENDING_D04_D08_P16")
+
+## CONTROLLED_FIXTURE: explicit test state, never a production resume command.
+func controlled_fixture_set_stopped(room_id: StringName, stopped: bool) -> bool:
+	if not _rooms.has(room_id): return false
+	detect_target_loss()
+	var room: Dictionary = _rooms[room_id]
+	if not stopped and room[&"link_state"] == &"TARGET_LOST": return false
+	room[&"stopped"] = stopped
+	room[&"stop_reason"] = &"CONTROLLED_FIXTURE" if stopped else &""
+	return true
+
+## CONTROLLED_FIXTURE: sole ledger write entry point, opaque event keys only.
+func controlled_fixture_record_evidence(room_id: StringName, source_event_key: StringName, minute: int) -> Dictionary:
+	var report := _collection_precondition(room_id, source_event_key, minute)
+	if not report[&"ok"]: return report
+	var target_id: StringName = _rooms[room_id][&"target_instance_id"]
+	var evidence_id := _evidence_id(room_id, target_id, source_event_key)
+	var duplicated := _evidence.has(evidence_id)
+	if not duplicated:
+		_evidence[evidence_id] = {&"evidence_id": evidence_id, &"room_id": room_id,
+			&"target_instance_id": target_id, &"source_event_key": source_event_key, &"minute": minute}
+	return {&"ok": true, &"reason": &"OK", &"evidence_id": evidence_id, &"duplicated": duplicated}
+
+static func _evidence_id(room_id: StringName, target_id: StringName, event_key: StringName) -> StringName:
+	# Length-prefixed UTF-8 hex is injective; delimiters in input cannot alias.
+	var pieces: Array[String] = []
+	for value: StringName in [room_id, target_id, event_key]:
+		var bytes := String(value).to_utf8_buffer()
+		pieces.append("%d:%s" % [bytes.size(), bytes.hex_encode()])
+	return StringName("peeping_evidence:" + ":".join(pieces))
+
+func create_snapshot() -> Dictionary:
+	var rooms: Array[Dictionary] = []
+	var evidence: Array[Dictionary] = []
+	var keys := _rooms.keys()
+	keys.sort()
+	for key: StringName in keys: rooms.append(_rooms[key].duplicate(true))
+	keys = _evidence.keys()
+	keys.sort()
+	for key: StringName in keys: evidence.append(_evidence[key].duplicate(true))
+	return {&"version": SECTION_VERSION, &"rooms": rooms, &"evidence": evidence}
+
+static func _exact(value: Variant, keys: Array) -> bool:
+	if not value is Dictionary or value.size() != keys.size(): return false
+	for key: Variant in value:
+		if typeof(key) != TYPE_STRING_NAME or key not in keys: return false
+	return true
+
+## Save format 15 has a fixed purchase-key allowlist outside this task's scope.
+## Validate this independent section before passing only the original keys to it.
+static func valid_runtime_section(data: Dictionary, minute: int) -> bool:
+	if not data.get(&"special_peeping_rooms") is Dictionary: return false
+	for key: Variant in data:
+		if key == &"special_peeping_rooms" and typeof(key) != TYPE_STRING_NAME: return false
+	for key: StringName in [&"world", &"path", &"facilities", &"construction", &"id_generator"]:
+		if not data.get(key) is Dictionary: return false
+	var world := WorldService.new()
+	var path := PathService.new()
+	var facilities := FacilityService.new()
+	var ids := StableIdGenerator.new()
+	if not world.restore_snapshot(data[&"world"]) or not path.restore_snapshot(data[&"path"]) or not facilities.restore_snapshot(data[&"facilities"]) or not ids.restore_snapshot(data[&"id_generator"]): return false
+	var construction := ConstructionService.new(world)
+	if not construction.restore_snapshot(data[&"construction"]): return false
+	var service := PeepingRoomService.new()
+	service.configure(world, facilities, construction, path, ids)
+	return service.restore_section(data[&"special_peeping_rooms"], minute)
+
+## Staged restore validates both directions of world ownership before committing.
+func restore_section(section: Variant, minute: int) -> bool:
+	var rooms: Dictionary = {}
+	var evidence: Dictionary = {}
+	if section != null:
+		if not _exact(section, [&"version", &"rooms", &"evidence"]): return false
+		if typeof(section[&"version"]) != TYPE_INT or section[&"version"] != SECTION_VERSION: return false
+		if not section[&"rooms"] is Array or not section[&"evidence"] is Array: return false
+		if section[&"rooms"].is_empty(): return false # absence represents empty state
+		var known: Array = _facilities.create_snapshot()[&"known_instance_ids"]
+		for raw: Variant in section[&"rooms"]:
+			if not _exact(raw, ROOM_KEYS): return false
+			for key: StringName in [&"room_id", &"target_instance_id", &"target_definition_id", &"link_state", &"stop_reason"]:
+				if typeof(raw[key]) != TYPE_STRING_NAME: return false
+			var room_id: StringName = raw[&"room_id"]
+			var suffix := String(room_id).trim_prefix("peeping_room.")
+			if suffix.length() != 12 or not suffix.is_valid_int() or int(suffix) <= 0 or String(room_id) != "peeping_room.%012d" % int(suffix): return false
+			if int(suffix) > _ids.get_counter(ID_PREFIX) or rooms.has(room_id): return false
+			if typeof(raw[&"origin"]) != TYPE_VECTOR3I or typeof(raw[&"footprint"]) != TYPE_VECTOR2I: return false
+			if raw[&"origin"].z != WorldService.LAYER_BACK or raw[&"footprint"] != Vector2i(2, 1): return false
+			var cells := _world.cells_for_footprint(raw[&"origin"], raw[&"footprint"])
+			if not raw[&"cells"] is Array or raw[&"cells"] != cells: return false
+			for cell: Variant in raw[&"cells"]:
+				if typeof(cell) != TYPE_VECTOR3I: return false
+			if _world.get_entity_cells(room_id) != cells or _world.get_entity_kind(room_id) != OCCUPANCY_KIND: return false
+			for cell: Vector3i in cells:
+				if _world.is_walkable(cell) or _path.has_cell(cell): return false
+			if raw[&"target_definition_id"] not in ALLOWED_TARGETS: return false
+			if typeof(raw[&"stopped"]) != TYPE_BOOL or not raw[&"target_history"] is Array: return false
+			var history := {}
+			for target: Variant in raw[&"target_history"]:
+				if typeof(target) != TYPE_STRING_NAME or String(target) not in known or history.has(target): return false
+				history[target] = true
+			if not history.has(raw[&"target_instance_id"]): return false
+			var current_target := _facilities.get_instance(raw[&"target_instance_id"])
+			if current_target != null and current_target.definition_id != raw[&"target_definition_id"]: return false
+			if raw[&"link_state"] == &"TARGET_LOST":
+				if not raw[&"stopped"] or raw[&"stop_reason"] != &"TARGET_LOST" or _target_still_present(raw): return false
+			elif raw[&"link_state"] == &"LINKED":
+				if not validate_placement(raw[&"origin"], raw[&"footprint"], raw[&"target_instance_id"], room_id)[&"ok"]: return false
+				if _facilities.get_instance(raw[&"target_instance_id"]).definition_id != raw[&"target_definition_id"]: return false
+				if raw[&"stopped"]:
+					if raw[&"stop_reason"] not in [&"CONTROLLED_FIXTURE", &"RELINKED_PENDING_RESUME"]: return false
+				elif raw[&"stop_reason"] != &"": return false
+			else: return false
+			rooms[room_id] = raw.duplicate(true)
+		for raw: Variant in section[&"evidence"]:
+			if not _exact(raw, EVIDENCE_KEYS): return false
+			for key: StringName in [&"evidence_id", &"room_id", &"target_instance_id", &"source_event_key"]:
+				if typeof(raw[key]) != TYPE_STRING_NAME or raw[key].is_empty(): return false
+			if String(raw[&"source_event_key"]).strip_edges().is_empty(): return false
+			if typeof(raw[&"minute"]) != TYPE_INT or raw[&"minute"] < 0 or raw[&"minute"] > minute: return false
+			if not rooms.has(raw[&"room_id"]) or raw[&"target_instance_id"] not in rooms[raw[&"room_id"]][&"target_history"]: return false
+			var expected := _evidence_id(raw[&"room_id"], raw[&"target_instance_id"], raw[&"source_event_key"])
+			if expected != raw[&"evidence_id"] or evidence.has(expected): return false
+			evidence[expected] = raw.duplicate(true)
+	for occupied: Dictionary in _world.create_snapshot()[&"occupancies"]:
+		if occupied[&"kind"] == OCCUPANCY_KIND or String(occupied[&"entity_id"]).begins_with("peeping_room."):
+			if not rooms.has(occupied[&"entity_id"]): return false
+	_rooms = rooms
+	_evidence = evidence
+	return true

tests/special/peeping_room_fixture.gd

@@ -0,0 +1,59 @@
+extends SceneTree
+
+## CONTROLLED_FIXTURE. No production placement, recorder or eligibility claim.
+const Rooms := preload("res://scripts/special/peeping_room_service.gd")
+var checks := 0
+var failures := 0
+var fixtures: Array[Dictionary] = []
+
+func _initialize() -> void:
+	call_deferred("_run")
+
+func expect(ok: bool, label: String) -> void:
+	checks += 1
+	if not ok:
+		failures += 1
+		push_error(label)
+
+func fixture(build_bath := true) -> Dictionary:
+	var clock: Variant = load("res://autoload/game_clock.gd").new()
+	var state: Variant = load("res://autoload/game_state.gd").new()
+	var runtime: Variant = load("res://autoload/simulation_runtime.gd").new()
+	clock.reset(1, 6, 0)
+	state.reset()
+	expect(runtime.initialize(clock, state, 1302)[&"valid"], "CONTROLLED_FIXTURE real Runtime initializes")
+	clock.set_paused(true)
+	runtime.configure_save_policy({&"enabled": false, &"daily_checkpoint_enabled": false})
+	var f := {&"clock": clock, &"state": state, &"runtime": runtime, &"target": &"", &"origin": Vector3i(-6, 1, 1)}
+	fixtures.append(f)
+	if build_bath:
+		var built: CommandResult = runtime.submit_command(&"build_facility", {&"definition_id": &"public_bath", &"origin": Vector3i(-6, 0, 0)})
+		expect(built.is_success(), "real paid public bath construction")
+		clock.advance_minutes(runtime.definition_registry.get_facility(&"public_bath").build_minutes)
+		for target: FacilityInstance in runtime.facility_service.get_instances():
+			if target.definition_id == &"public_bath": f[&"target"] = target.instance_id
+		expect(not f[&"target"].is_empty(), "completed FRONT target has real stable identity")
+	return f
+
+func place(f: Dictionary, origin: Variant = null) -> StringName:
+	var report: Dictionary = f[&"runtime"].peeping_room_service.controlled_fixture_place(f[&"origin"] if origin == null else origin)
+	expect(report[&"ok"], "CONTROLLED_FIXTURE only room placement: " + String(report[&"reason"]))
+	return report.get(&"room_id", &"")
+
+func enable_fixture(f: Dictionary, room: StringName) -> void:
+	var runtime: Variant = f[&"runtime"]
+	expect(runtime.peeping_room_service.controlled_fixture_set_stopped(room, false), "CONTROLLED_FIXTURE explicitly enables ledger exercise")
+	expect(runtime.facility_service.set_operational_status(f[&"target"], {&"power_available": true, &"operator_open": true}, f[&"clock"].absolute_minute).is_success(), "CONTROLLED_FIXTURE target conditions")
+
+func rejects_atomically(runtime: Variant, snapshot: Dictionary) -> bool:
+	var before := var_to_bytes(runtime.create_snapshot())
+	return not runtime.restore_snapshot(snapshot) and before == var_to_bytes(runtime.create_snapshot())
+
+func finish(label: String) -> void:
+	for f: Dictionary in fixtures:
+		f[&"runtime"].free()
+		f[&"clock"].free()
+		f[&"state"].free()
+	fixtures.clear()
+	print("%s: %d checks, %d failures" % [label, checks, failures])
+	quit(1 if failures else 0)

tests/special/test_p13_uid_policy.py

@@ -0,0 +1,96 @@
+"""Static UID policy cases; no engine, native worker or regression invocation."""
+import importlib.util
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+
+sys.dont_write_bytecode = True
+TOOLS = Path(__file__).resolve().parents[2] / 'tools'
+sys.path.insert(0, str(TOOLS))
+spec = importlib.util.spec_from_file_location('p13_uid_policy', TOOLS / 'run_p13_reference_tests.py')
+runner = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(runner)
+
+
+class UIDPolicyTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.stage = Path(self.tmp.name)
+        self.owner = 'tests/special/example.gd'
+        self.other = 'scripts/special/peeping_room_service.gd'
+        for name in (self.owner, self.other):
+            self.write(name, b'extends RefCounted\n')
+        self.write('project.godot', b'[application]\n')
+        self.write('scripts/existing.gd.uid', b'uid://existing\n')
+        self.source = runner.shared.inventory(self.stage, stage=True)
+        self.plan = runner.uid_plan(self.source)
+        self.write(self.owner + '.uid', b'uid://first\n')
+        self.write(self.other + '.uid', b'uid://second\n')
+
+    def write(self, name, raw):
+        path = self.stage / name
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_bytes(raw)
+
+    def snapshot(self):
+        return runner.uid_snapshot(self.stage, self.source, self.plan)
+
+    def test_accept_and_owner_seal(self):
+        accepted = self.snapshot()
+        self.assertEqual(set(accepted), {self.owner + '.uid', self.other + '.uid'})
+        pin = accepted[self.owner + '.uid']
+        self.assertEqual(pin['raw_bytes'], list(b'uid://first\n'))
+        self.assertEqual(pin['text'], 'uid://first\n')
+        self.assertEqual(pin['owner_sha256'], self.source[self.owner]['sha256'])
+        self.assertEqual(pin['sha256'], runner.shared.sha(self.stage / (self.owner + '.uid')))
+
+    def test_unknown_and_extra(self):
+        for name in ('scripts/unknown.gd.uid', 'extra.txt'):
+            with self.subTest(name=name):
+                self.write(name, b'uid://extra\n')
+                with self.assertRaises(AssertionError):
+                    self.snapshot()
+                (self.stage / name).unlink()
+
+    def test_missing(self):
+        (self.stage / (self.owner + '.uid')).unlink()
+        with self.assertRaises(AssertionError):
+            self.snapshot()
+
+    def test_malformed(self):
+        for raw in (b'uid://UPPER\n', b'uid://first', b'uid://first\nextra',
+                    b'uid://12345678901234\n', b'uid://\n', b'uid://first\r\n'):
+            with self.subTest(raw=raw):
+                self.write(self.owner + '.uid', raw)
+                with self.assertRaises(AssertionError):
+                    self.snapshot()
+
+    def test_duplicate_and_existing_collision(self):
+        for raw in (b'uid://second\n', b'uid://existing\n'):
+            with self.subTest(raw=raw):
+                self.write(self.owner + '.uid', raw)
+                with self.assertRaises(AssertionError):
+                    self.snapshot()
+
+    def test_modified_original(self):
+        for name in (self.owner, 'project.godot', 'scripts/existing.gd.uid'):
+            with self.subTest(name=name):
+                path = self.stage / name
+                original = path.read_bytes()
+                path.write_bytes(original + b'tamper')
+                with self.assertRaises(AssertionError):
+                    self.snapshot()
+                path.write_bytes(original)
+
+    def test_symlink(self):
+        path = self.stage / (self.owner + '.uid')
+        path.unlink()
+        path.symlink_to(self.stage / (self.other + '.uid'))
+        with self.assertRaises(AssertionError):
+            self.snapshot()
+
+
+if __name__ == '__main__':
+    unittest.main()

tests/special/test_peeping_room_evidence.gd

@@ -0,0 +1,40 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var room := place(f)
+	var other := place(f, Vector3i(-4, 1, 1))
+	var service: Variant = runtime.peeping_room_service
+	var minute: int = f[&"clock"].absolute_minute
+	expect(service.record_evidence(room, &"", minute)[&"reason"] == &"SOURCE_EVENT_KEY_REQUIRED", "named source key required first")
+	expect(service.controlled_fixture_record_evidence(room, &"fixture.event", minute)[&"reason"] == &"STOPPED", "initial stopped state rejects even fixture ledger")
+	enable_fixture(f, room)
+	enable_fixture(f, other)
+	var target: FacilityInstance = runtime.facility_service.get_instance(f[&"target"])
+	target.power_available = false
+	target.operator_open = false
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"NO_POWER", "power rejection precedes closed")
+	target.power_available = true
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"CLOSED", "closed target rejects")
+	target.operator_open = true
+	# CONTROLLED_FIXTURE temporarily omit construction authority, leaving live target.
+	var empty_construction := ConstructionService.new(runtime.world_service)
+	service.configure(runtime.world_service, runtime.facility_service, empty_construction, runtime.path_service, runtime.id_generator)
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"UNDER_CONSTRUCTION", "uncompleted construction authority rejects collection")
+	service.configure(runtime.world_service, runtime.facility_service, runtime.construction_service, runtime.path_service, runtime.id_generator)
+	var before := var_to_bytes(service.create_snapshot())
+	expect(service.record_evidence(room, &"fixture.event", minute)[&"reason"] == &"RECORDER_ELIGIBILITY_PENDING_D04_D08_P16", "production collection never invents eligibility")
+	expect(before == var_to_bytes(service.create_snapshot()), "production collection leaves ledger unchanged")
+	var first: Dictionary = service.controlled_fixture_record_evidence(room, &"fixture.event", minute)
+	var replay: Dictionary = service.controlled_fixture_record_evidence(room, &"fixture.event", minute + 1)
+	expect(first[&"ok"] and not first[&"duplicated"] and replay[&"duplicated"] and replay[&"evidence_id"] == first[&"evidence_id"], "tuple replay returns exactly one stable ID")
+	var second: Dictionary = service.controlled_fixture_record_evidence(other, &"fixture.event", minute)
+	var third: Dictionary = service.controlled_fixture_record_evidence(room, &"fixture:event:日本語", minute)
+	expect(second[&"evidence_id"] != first[&"evidence_id"] and third[&"evidence_id"] != first[&"evidence_id"], "different room/key distinct, delimiter and UTF-8 input supported")
+	expect(service.create_snapshot()[&"evidence"].size() == 3, "replay adds no ledger record")
+	var snapshot: Dictionary = runtime.create_snapshot()
+	expect(runtime.restore_snapshot(snapshot), "active fixture evidence restores")
+	var restored: Dictionary = runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.event", minute)
+	expect(restored[&"duplicated"] and restored[&"evidence_id"] == first[&"evidence_id"], "evidence stable across restore")
+	finish("Peeping room evidence")

tests/special/test_peeping_room_geometry.gd

@@ -0,0 +1,62 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var service: Variant = runtime.peeping_room_service
+	var origin: Vector3i = f[&"origin"]
+	var before := var_to_bytes(runtime.create_snapshot())
+	expect(service.validate_placement(origin)[&"ok"], "public bath entirely behind one completed FRONT target")
+	expect(service.validate_placement(Vector3i(-6, 1, 0))[&"reason"] == &"WRONG_LAYER", "FRONT room rejected")
+	expect(service.validate_placement(origin, Vector2i(1, 2))[&"reason"] == &"WRONG_FOOTPRINT", "rotated footprint rejected")
+	expect(service.validate_placement(origin, Vector2i(2, 1), &"vip_suite")[&"reason"] == &"PENDING_P10_01", "VIP unavailable, never substituted")
+	expect(service.validate_placement(Vector3i(-1, 1, 1))[&"reason"] == &"PARTIAL_TARGET", "partial target rejected")
+	expect(service.validate_placement(Vector3i(8, 1, 1))[&"reason"] == &"TARGET_MISSING", "missing target rejected")
+	expect(service.validate_placement(origin, Vector2i(2, 1), &"missing")[&"reason"] == &"TARGET_MISMATCH", "named reference must match FRONT occupant")
+	expect(before == var_to_bytes(runtime.create_snapshot()), "geometry validation is pure across whole Runtime")
+	# Complete real second bath; the 2x1 footprint at the boundary spans targets.
+	expect(runtime.submit_command(&"build_facility", {&"definition_id": &"public_bath", &"origin": Vector3i(0, 0, 0)}).is_success(), "second paid target starts")
+	expect(service.validate_placement(Vector3i(0, 1, 1))[&"reason"] == &"TARGET_INCOMPLETE", "construction reservation is not a completed target")
+	f[&"clock"].advance_minutes(runtime.definition_registry.get_facility(&"public_bath").build_minutes)
+	expect(service.validate_placement(Vector3i(-1, 1, 1))[&"reason"] == &"MULTIPLE_TARGETS", "multiple FRONT target footprints rejected")
+	# A real path joining both sides through the proposed footprint must survive.
+	for x in range(-7, -3): runtime.world_service.set_walkable(Vector3i(x, 1, 1), true)
+	expect(runtime.rebuild_path_graph_from_world(), "CONTROLLED_FIXTURE corridor graph rebuild")
+	var path_before: Array = runtime.path_service.find_path(Vector3i(-7, 1, 1), Vector3i(-4, 1, 1))
+	expect(not path_before.is_empty(), "proposed footprint lies across a connected corridor")
+	expect(service.validate_placement(origin)[&"reason"] == &"CORRIDOR_CONFLICT", "would disconnect BACK corridor: reject with no bypass")
+	expect(runtime.path_service.find_path(Vector3i(-7, 1, 1), Vector3i(-4, 1, 1)) == path_before, "rejected cut preserves route")
+	for x in range(-7, -3): runtime.world_service.set_walkable(Vector3i(x, 1, 1), false)
+	expect(service.validate_placement(origin)[&"reason"] == &"CORRIDOR_CONFLICT", "stale path authority also rejects conflict")
+	expect(runtime.rebuild_path_graph_from_world(), "corridor fixture removed explicitly")
+	var room := place(f)
+	expect(service.validate_placement(origin)[&"reason"] == &"BACK_OCCUPIED", "dedicated room occupancy blocks overlap")
+	expect(runtime.world_service.get_entity_kind(room) == Rooms.OCCUPANCY_KIND, "dedicated cross-reference occupancy kind")
+	_private_geometry()
+	finish("Peeping room geometry")
+
+func _private_geometry() -> void:
+	var f := fixture(false)
+	var runtime: Variant = f[&"runtime"]
+	# CONTROLLED_FIXTURE underground geometry only: no unlock/normal palette claim.
+	var bounds: Dictionary = runtime.world_service.get_bounds()
+	bounds[&"min_y"] = -1
+	expect(runtime.world_service.expand_bounds(bounds), "CONTROLLED_FIXTURE underground bounds")
+	var definition: FacilityDefinition = runtime.definition_registry.get_facility(&"adult_private_room")
+	for x in range(2):
+		var cell := Vector3i(x, -1, 0)
+		runtime.world_service.set_excavated(cell, true)
+		runtime.world_service.set_support(cell, definition.weight_per_cell, true)
+	var started: CommandResult = runtime.construction_service.start_construction(definition, Vector3i(0, -1, 0))
+	expect(started.is_success(), "CONTROLLED_FIXTURE paid real adult_private_room definition")
+	f[&"clock"].advance_minutes(definition.build_minutes)
+	var service: Variant = runtime.peeping_room_service
+	expect(service.validate_placement(Vector3i(0, -1, 1))[&"ok"], "adult_private_room valid completed geometry")
+	var target_id: StringName = runtime.world_service.get_occupant(Vector3i(0, -1, 0))
+	var target: FacilityInstance = runtime.facility_service.get_instance(target_id)
+	if target != null:
+		target.definition_id = &"vip_private_salon"
+		expect(service.validate_placement(Vector3i(0, -1, 1))[&"reason"] == &"TARGET_NOT_ALLOWED", "salon is not VIP suite substitute")
+		target.definition_id = &"adult_private_room"
+		runtime.facility_service.unregister_instance(target_id)
+		expect(service.validate_placement(Vector3i(0, -1, 1))[&"reason"] == &"TARGET_UNKNOWN", "world occupant without actual FacilityService target rejected")

tests/special/test_peeping_room_reference.gd

@@ -0,0 +1,37 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var room := place(f)
+	enable_fixture(f, room)
+	var old_target: StringName = f[&"target"]
+	var old_evidence: Dictionary = runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.event", f[&"clock"].absolute_minute)
+	expect(old_evidence[&"ok"], "fixture evidence before removal")
+	expect(runtime.submit_command(&"demolish_facility", {&"instance_id": old_target}).is_success(), "real Runtime demolition")
+	var lost: Dictionary = runtime.peeping_room_service.get_room(room)
+	expect(lost[&"link_state"] == &"TARGET_LOST" and lost[&"stopped"], "target removal immediately marks lost and stopped")
+	expect(runtime.peeping_room_service.record_evidence(room, &"fixture.after_loss", f[&"clock"].absolute_minute)[&"reason"] == &"STOPPED", "collection rejected after loss with prescribed stopped precedence")
+	expect(not runtime.peeping_room_service.controlled_fixture_set_stopped(room, false), "lost target cannot resume even through fixture")
+	var lost_snapshot: Dictionary = runtime.create_snapshot()
+	expect(runtime.restore_snapshot(lost_snapshot), "lost reference roundtrip retains historical identity")
+	expect(var_to_bytes(lost_snapshot) == var_to_bytes(runtime.create_snapshot()), "lost snapshot exact typed roundtrip")
+	expect(runtime.submit_command(&"build_facility", {&"definition_id": &"public_bath", &"origin": Vector3i(-6, 0, 0)}).is_success(), "rebuild at same geometry starts")
+	f[&"clock"].advance_minutes(runtime.definition_registry.get_facility(&"public_bath").build_minutes)
+	var new_target: StringName = runtime.world_service.get_occupant(Vector3i(-6, 0, 0))
+	expect(new_target != old_target, "rebuild receives different target identity")
+	expect(runtime.peeping_room_service.get_room(room)[&"target_instance_id"] == old_target, "no implicit relink on geometry reuse")
+	var rejected: CommandResult = runtime.submit_command(&"peeping_room_relink", {&"room_id": room, &"target_instance_id": old_target})
+	expect(not rejected.is_success(), "explicit old target relink rejected")
+	expect(runtime.submit_command(&"peeping_room_relink", {&"room_id": room, &"target_instance_id": new_target}).is_success(), "explicit new target full validation")
+	var linked: Dictionary = runtime.peeping_room_service.get_room(room)
+	expect(linked[&"stopped"] and linked[&"stop_reason"] == &"RELINKED_PENDING_RESUME", "explicit relink never auto resumes")
+	f[&"target"] = new_target
+	enable_fixture(f, room)
+	var new_evidence: Dictionary = runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.event", f[&"clock"].absolute_minute)
+	expect(new_evidence[&"ok"] and new_evidence[&"evidence_id"] != old_evidence.get(&"evidence_id"), "same room/event on different target never aliases")
+	var linked_snapshot: Dictionary = runtime.create_snapshot()
+	expect(runtime.restore_snapshot(linked_snapshot) and var_to_bytes(linked_snapshot) == var_to_bytes(runtime.create_snapshot()), "relinked ledger keeps both historical target bindings")
+	expect(runtime.facility_service.unregister_instance(new_target).is_success(), "equivalent FacilityService removal path")
+	expect(runtime.peeping_room_service.get_room(room)[&"link_state"] == &"TARGET_LOST", "unregister signal also invalidates target")
+	finish("Peeping room reference")

tests/special/test_peeping_room_runtime.gd

@@ -0,0 +1,91 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	# Direct executor invocation distinguishes read-only domain state from queue receipts.
+	var validation := SimulationCommand.new()
+	validation.command_type = &"peeping_room_validate"
+	validation.payload = {&"origin": f[&"origin"]}
+	var before := var_to_bytes(runtime.create_snapshot())
+	expect(runtime._execute_peeping_room(validation).is_success(), "read-only validator executor")
+	expect(before == var_to_bytes(runtime.create_snapshot()), "validator changes no whole Runtime bytes")
+	var public_validation: CommandResult = runtime.submit_command(&"peeping_room_validate", validation.payload)
+	expect(public_validation.is_success(), "registered validation command runs through real queue")
+	var placement := SimulationCommand.new()
+	placement.command_type = &"peeping_room_place"
+	placement.payload = validation.payload.duplicate(true)
+	var placement_before := var_to_bytes(runtime.create_snapshot())
+	var direct_unavailable: CommandResult = runtime._execute_peeping_room(placement)
+	expect(not direct_unavailable.is_success() and direct_unavailable.details[&"reason"] == &"BUILD_DEFINITION_PENDING_D04", "direct production placement unavailable with precise reason")
+	expect(placement_before == var_to_bytes(runtime.create_snapshot()), "direct placement adds no room, occupancy, cost or ID in whole typed Runtime")
+	var domain_before := var_to_bytes([runtime.world_service.create_snapshot(), runtime.economy_service.create_snapshot(), runtime.peeping_room_service.create_snapshot()])
+	var ids_before: Dictionary = runtime.id_generator.create_snapshot()
+	var counters_before: Dictionary = ids_before["counters"]
+	var event_counter_before: int = counters_before.get("domain_event", 0)
+	var event_ids_before := {}
+	for event: SimulationDomainEvent in runtime.domain_events.recent_events():
+		event_ids_before[event.event_id] = true
+	var unavailable: CommandResult = runtime.submit_command(&"peeping_room_place", validation.payload)
+	expect(not unavailable.is_success() and unavailable.details[&"reason"] == &"BUILD_DEFINITION_PENDING_D04", "production placement unavailable with precise reason")
+	expect(domain_before == var_to_bytes([runtime.world_service.create_snapshot(), runtime.economy_service.create_snapshot(), runtime.peeping_room_service.create_snapshot()]), "queued placement adds no room, occupancy or cost")
+	var ids_after: Dictionary = runtime.id_generator.create_snapshot()
+	var counters_after: Dictionary = ids_after["counters"]
+	expect(ids_before["version"] == ids_after["version"], "queued placement preserves ID generator version")
+	for prefix: Variant in counters_before:
+		if prefix != "domain_event":
+			expect(counters_after.has(prefix) and counters_after.get(prefix) == counters_before[prefix], "queued placement consumes no non-event ID or removes prefix: %s" % prefix)
+	for prefix: Variant in counters_after:
+		if prefix != "domain_event":
+			expect(counters_before.has(prefix), "queued placement adds no non-event ID prefix: %s" % prefix)
+	expect(counters_after.has("domain_event") and counters_after["domain_event"] == event_counter_before + 1, "queued placement allocates exactly one normal receipt event ID")
+	var new_events: Array[SimulationDomainEvent] = []
+	for event: SimulationDomainEvent in runtime.domain_events.recent_events():
+		if not event_ids_before.has(event.event_id):
+			new_events.append(event)
+	expect(new_events.size() == 1, "queued placement publishes exactly one new receipt event")
+	if new_events.size() == 1:
+		var receipt: SimulationDomainEvent = new_events[0]
+		expect(receipt.event_id == StringName("domain_event.%012d" % (event_counter_before + 1)), "placement receipt uses the next domain event ID")
+		expect(receipt.event_type == &"COMMAND_FAILED", "unavailable placement receipt is COMMAND_FAILED")
+		expect(receipt.causation_command_id == unavailable.command_id, "placement receipt causation matches rejected command")
+	var room := place(f)
+	enable_fixture(f, room)
+	var blocked: CommandResult = runtime.submit_command(&"peeping_room_record_evidence", {&"room_id": room, &"source_event_key": &"fixture.command"})
+	expect(not blocked.is_success() and blocked.details[&"reason"] == &"RECORDER_ELIGIBILITY_PENDING_D04_D08_P16", "registered evidence command cannot reach ledger")
+	var missing: CommandResult = runtime.submit_command(&"peeping_room_record_evidence", {&"room_id": room})
+	expect(not missing.is_success() and missing.details[&"reason"] == &"SOURCE_EVENT_KEY_REQUIRED", "public command requires named key")
+	var malformed: CommandResult = runtime.submit_command(&"peeping_room_validate", {&"origin": [0, 1, 1]})
+	expect(not malformed.is_success() and malformed.details[&"reason"] == &"INVALID_PAYLOAD", "wrong payload type safely rejected")
+	expect(runtime.peeping_room_service.create_snapshot()[&"evidence"].is_empty(), "commands cannot inject arbitrary content events")
+	var fixture_command: CommandResult = runtime.submit_command(&"controlled_fixture_place", validation.payload)
+	expect(not fixture_command.is_success(), "no fixture command registration")
+	_mimi_format(f)
+	finish("Peeping room runtime")
+
+func _mimi_format(f: Dictionary) -> void:
+	var runtime: Variant = f[&"runtime"]
+	const Quote := preload("res://scripts/supply/supply_purchase_quote_v2.gd")
+	expect(runtime.submit_command(&"build_facility", {&"definition_id": &"warehouse", &"origin": Vector3i(2, 0, 1)}).is_success(), "paid warehouse for independent existing MIMI format path")
+	f[&"clock"].advance_minutes(runtime.definition_registry.get_facility(&"warehouse").build_minutes)
+	var warehouse: StringName = &""
+	for facility: FacilityInstance in runtime.facility_service.get_instances():
+		if facility.definition_id == &"warehouse": warehouse = facility.instance_id
+	expect(not warehouse.is_empty(), "completed real warehouse")
+	var mimi := StaffRuntime.new().configure(Quote.MIMI, &"porter", {&"employment_kind": StaffRuntime.EmploymentKind.UNIQUE})
+	expect(runtime.staff_service.register_staff(mimi).is_success(), "CONTROLLED_FIXTURE existing MIMI unique registration, no natural join claim")
+	expect(runtime.submit_command(&"set_staff_work_assignment", {&"staff_id": Quote.MIMI, &"facility_id": warehouse, &"template_id": &"NIGHT"}).is_success(), "existing persistent MIMI assignment")
+	expect(runtime.submit_command(&"purchase_supplies", {&"warehouse_id": warehouse, &"item_id": SupplyCatalog.RAW_FOOD, &"quantity": 1}).is_success(), "existing real v2 paid purchase")
+	var snapshot: Dictionary = runtime.create_snapshot()
+	expect(snapshot[&"systems"][&"runtime"][&"runtime_schema_version"] == 15 and snapshot[&"systems"][&"runtime"].has(&"special_peeping_rooms"), "v2 purchase history and special section coexist")
+	expect(runtime.restore_snapshot(snapshot) and var_to_bytes(snapshot) == var_to_bytes(runtime.create_snapshot()), "v15 optional section exact typed restore")
+	var directory := "user://tests/p13_reference_mimi_%d" % OS.get_process_id()
+	expect(SaveService.save_snapshot(directory, snapshot)[&"ok"], "physical v15 save accepts validated extension without loosening purchase allowlist")
+	var loaded := SaveService.load_snapshot(directory)
+	expect(loaded[&"ok"], "physical MIMI section save loads")
+	if loaded[&"ok"]:
+		expect(loaded[&"manifest"]["format_version"] == 2 and loaded[&"manifest"]["runtime_schema_version"] == 15, "format2 manifest still exactly15")
+		expect(runtime.restore_snapshot(loaded[&"snapshot"]), "MIMI package restore reaches same staged section validator")
+	var bad := snapshot.duplicate(true)
+	bad[&"systems"][&"runtime"][&"special_peeping_rooms"][&"version"] = 2
+	expect(not SaveService.save_snapshot(directory + "_bad", bad)[&"ok"], "save-format adapter rejects malformed optional section")

tests/special/test_peeping_room_save.gd

@@ -0,0 +1,66 @@
+extends "res://tests/special/peeping_room_fixture.gd"
+
+func _run() -> void:
+	var f := fixture()
+	var runtime: Variant = f[&"runtime"]
+	var empty: Dictionary = runtime.create_snapshot()
+	expect(not empty[&"systems"][&"runtime"].has(&"special_peeping_rooms"), "empty service does not alter existing snapshot keys")
+	expect(runtime.restore_snapshot(empty) and var_to_bytes(empty) == var_to_bytes(runtime.create_snapshot()), "pre-extension v14 absence exact roundtrip")
+	var legacy := empty.duplicate(true)
+	legacy[&"systems"][&"runtime"][&"runtime_schema_version"] = 13
+	legacy[&"systems"][&"runtime"].erase(&"auto_purchase_plans")
+	expect(runtime.restore_snapshot(legacy) and runtime.peeping_room_service.is_empty(), "genuine v13 absent section migrates empty")
+	expect(runtime.restore_snapshot(empty), "restore canonical baseline before controlled room")
+	var room := place(f)
+	enable_fixture(f, room)
+	expect(runtime.peeping_room_service.controlled_fixture_record_evidence(room, &"fixture.save", f[&"clock"].absolute_minute)[&"ok"], "controlled evidence before mid-state save")
+	expect(runtime.submit_command(&"peeping_room_relink", {&"room_id": room, &"target_instance_id": f[&"target"]}, &"player", room, 0, f[&"clock"].absolute_minute + 1).is_success(), "future explicit relink remains pending at checkpoint")
+	var snapshot: Dictionary = runtime.create_snapshot()
+	expect(snapshot[&"systems"][&"runtime"][&"runtime_schema_version"] == 14, "extension never bumps Runtime version")
+	expect(runtime.restore_snapshot(snapshot) and var_to_bytes(snapshot) == var_to_bytes(runtime.create_snapshot()), "exact typed room/evidence whole Runtime roundtrip")
+	var directory := "user://tests/p13_reference_save_%d" % OS.get_process_id()
+	var saved := SaveService.save_snapshot(directory, snapshot)
+	expect(saved[&"ok"], "actual SaveService writes section in format 1")
+	var loaded := SaveService.load_snapshot(directory)
+	expect(loaded[&"ok"], "actual SaveService reads section")
+	if loaded[&"ok"]:
+		expect(loaded[&"manifest"]["format_version"] == 1, "existing format mapping unchanged")
+		expect(runtime.restore_snapshot(loaded[&"snapshot"]), "loaded physical package reaches Runtime validation")
+		expect(var_to_bytes(snapshot) == var_to_bytes(runtime.create_snapshot()), "physical save retains all typed fields")
+	for mutation in range(18):
+		var bad := snapshot.duplicate(true)
+		var data: Dictionary = bad[&"systems"][&"runtime"]
+		var section: Dictionary = data[&"special_peeping_rooms"]
+		match mutation:
+			0: data.erase(&"special_peeping_rooms")
+			1: data[&"special_peeping_rooms"] = null
+			2: section[&"version"] = 2
+			3: section[&"version"] = 1.0
+			4: section[&"unknown"] = true
+			5: section.erase(&"evidence")
+			6: section[&"rooms"].append(section[&"rooms"][0].duplicate(true))
+			7: section[&"evidence"].append(section[&"evidence"][0].duplicate(true))
+			8: section[&"rooms"][0][&"target_instance_id"] = &"missing.target"
+			9: section[&"rooms"][0][&"target_definition_id"] = &"adult_private_room"
+			10: section[&"rooms"][0][&"origin"] = Vector3i(8, 1, 1)
+			11: section[&"rooms"][0][&"stopped"] = 1
+			12: section[&"evidence"][0][&"room_id"] = &"peeping_room.999999999999"
+			13: section[&"evidence"][0][&"source_event_key"] = &"aliased.event"
+			14: section[&"evidence"][0][&"minute"] = f[&"clock"].absolute_minute + 1
+			15: data[&"id_generator"]["counters"]["peeping_room"] = 0
+			16:
+				section.erase(&"version")
+				section["version"] = 1
+			17:
+				section[&"rooms"][0][&"link_state"] = &"TARGET_LOST"
+				section[&"rooms"][0][&"stopped"] = true
+				section[&"rooms"][0][&"stop_reason"] = &"TARGET_LOST"
+		expect(rejects_atomically(runtime, bad), "malformed/current missing/reference/duplicate rejection atomic case %d" % mutation)
+	var orphan := empty.duplicate(true)
+	orphan[&"systems"][&"runtime"][&"world"] = snapshot[&"systems"][&"runtime"][&"world"].duplicate(true)
+	expect(rejects_atomically(runtime, orphan), "world-owned room without any section rejects atomically")
+	var removed_world := snapshot.duplicate(true)
+	removed_world[&"systems"][&"runtime"][&"world"] = empty[&"systems"][&"runtime"][&"world"].duplicate(true)
+	expect(rejects_atomically(runtime, removed_world), "section-owned room without world occupancy rejects atomically")
+	expect(runtime.restore_snapshot(empty) and runtime.peeping_room_service.is_empty(), "absent legacy section clears previous nonempty service on valid load")
+	finish("Peeping room save")

tools/run_p13_reference_tests.py

@@ -0,0 +1,283 @@
+#!/usr/bin/env python3
+"""P13 reference evidence: read-only verification by default; collection is Root-only."""
+import argparse
+import ast
+import inspect
+import json
+import os
+import re
+import stat
+import types
+from pathlib import Path
+import shutil
+import sys
+
+sys.dont_write_bytecode = True
+import run_all_tests as shared
+
+PROTOCOL = 'guarded-p13-reference-v1'
+CANONICAL_EVIDENCE = 'p13-reference-native-uid-corrected'
+NEW_TESTS = [
+    'tests/special/test_peeping_room_geometry.gd',
+    'tests/special/test_peeping_room_reference.gd',
+    'tests/special/test_peeping_room_evidence.gd',
+    'tests/special/test_peeping_room_save.gd',
+    'tests/special/test_peeping_room_runtime.gd',
+]
+ROSTER = NEW_TESTS + [
+    'tests/s1/test_construction_service.gd',
+    'tests/s1/test_world_service.gd',
+    'tests/s1/test_path_service.gd',
+    'tests/s1/test_runtime_world_construction.gd',
+    'tests/supply/test_supply_save_migration.gd',
+    'tests/transport/test_transport_save.gd',
+    'tests/environment/test_runtime_weather.gd',
+    'tests/s6/test_runtime_snapshot_serialization.gd',
+    'tests/s6/test_runtime_save_lifecycle.gd',
+    'tests/supply/test_mimi_purchase_quote.gd',
+]
+
+
+def uid_plan(refs):
+    return {name + '.uid': {'owner': name, 'owner_sha256': pin['sha256'],
+                             'file_type': 'regular'}
+            for name, pin in sorted(refs.items())
+            if name.endswith('.gd') and name + '.uid' not in refs
+            and (name.startswith('tests/special/')
+                 or name == 'scripts/special/peeping_room_service.gd')}
+
+
+def uid_snapshot(stage, source, plan):
+    """Accept exactly the source inventory and finite native UID plan."""
+    actual = shared.inventory(stage, stage=True)
+    shared.require(set(actual) == set(source) | set(plan), 'exact source and planned UID set')
+    shared.require({n: actual[n] for n in source} == source, 'original source/settings unchanged')
+    seen = set()
+    for name in source:
+        if name.endswith('.uid'):
+            raw = (stage / name).read_bytes().rstrip(b'\r\n')
+            shared.require(raw not in seen, 'existing project UID collision')
+            seen.add(raw)
+    result = {}
+    for name, binding in plan.items():
+        path = stage / name
+        shared.require(stat.S_ISREG(path.lstat().st_mode) and not path.is_symlink()
+                       and path.stat().st_nlink == 1, 'ordinary generated UID')
+        raw = path.read_bytes()
+        shared.require(re.fullmatch(rb'uid://[a-z0-9]{1,13}\n', raw) is not None,
+                       'complete canonical UID bytes')
+        shared.require(raw.rstrip(b'\n') not in seen, 'generated UID collision')
+        seen.add(raw.rstrip(b'\n'))
+        shared.require(stat.S_ISREG((stage / binding['owner']).lstat().st_mode)
+                       and shared.sha(stage / binding['owner']) == binding['owner_sha256'],
+                       'UID owner content binding')
+        result[name] = dict(binding, bytes=len(raw), raw_bytes=list(raw),
+                            sha256=shared.sha(path), text=raw.decode('ascii'))
+    return result
+
+
+def install_uid_policy(namespace):
+    """Specialize private globals; shared and P18 functions remain untouched."""
+    original_collect, original_seal = namespace['collect'], namespace['seal']
+    state = {}
+
+    def reports(stage, expected, previous, requested):
+        shared.require(not requested and not previous, 'P13 has no generated reports')
+        snapshot = uid_snapshot(stage, state['source'], state['plan'])
+        if state['accepted'] is None:
+            shared.require(state['phase'] == 'import', 'UID generation only during import')
+            state['accepted'] = snapshot
+            expected.update({n: {'bytes': p['bytes'], 'sha256': p['sha256']}
+                             for n, p in snapshot.items()})
+        shared.require(snapshot == state['accepted'], 'sealed UID bytes unchanged')
+        return shared.declared_reports(stage, expected, previous, requested)
+
+    phase_globals = dict(vars(shared), declared_reports=reports)
+    execute = types.FunctionType(shared.execute_phase.__code__, phase_globals)
+
+    def phase(*args):
+        stage, out, label = args[1:4]
+        state['phase'] = label
+        if label == 'import':
+            shared.require(shared.inventory(stage, stage=True) == state['source'],
+                           'original stage before import')
+            before = {}
+            shared.write(out / 'uid-plan.json', state['plan'])
+        else:
+            before = uid_snapshot(stage, state['source'], state['plan'])
+            shared.require(before == state['accepted'], 'UID set before phase unchanged')
+        row = execute(*args)
+        after = uid_snapshot(stage, state['source'], state['plan'])
+        shared.require(after == state['accepted'], 'UID set after phase unchanged')
+        shared.write(out / (label + '-uids.json'), {'before': before, 'after': after})
+        return row
+
+    namespace['shared'] = types.SimpleNamespace(**dict(vars(shared), execute_phase=phase))
+
+    def collect(args, root, out, refs, *rest):
+        state.update(source=namespace['content_map'](refs), plan=uid_plan(refs), accepted=None)
+        return original_collect(args, root, out, refs, *rest)
+
+    def seal(out, refs, engine, contract_sha):
+        shared.write(out / 'accepted-uids.json', state['accepted'])
+        return original_seal(out, refs, engine, contract_sha)
+
+    def retained(stage, source, out):
+        plan = namespace['read_json'](out / 'uid-plan.json')
+        shared.require(plan == uid_plan(source), 'independently derived exact UID plan')
+        accepted = uid_snapshot(stage, source, plan)
+        shared.require(namespace['read_json'](out / 'accepted-uids.json') == accepted,
+                       'retained raw UID bytes and owner bindings')
+        for label in ['import', 'parse'] + [str(i).zfill(3) for i in range(len(ROSTER))]:
+            shared.require(namespace['read_json'](out / (label + '-uids.json')) ==
+                           {'before': {} if label == 'import' else accepted, 'after': accepted},
+                           'all phase UID before/after seals')
+        return True
+
+    namespace.update(collect=collect, seal=seal, uid_retained=retained)
+
+
+def protocol_core():
+    """Reuse P18's complete guarded core without editing or copying its runner.
+
+    P18 predates configurable protocol/roster constants. Specialize its three
+    entry functions' identity literals and explicit roster cardinalities, plus
+    one retained-stage comparison for the finite UID policy. The local phase
+    adapter retains every original shared gate and seals its accepted sidecars.
+    Fail closed if an upstream function changes any of these adapter sites.
+    Both runner sources remain bound by the whole selected source map.
+    """
+    core = shared.module('p13_p18_core', shared.HERE / 'run_p18_relationship_tests.py')
+    namespace = dict(vars(core), ROSTER=ROSTER, __file__=__file__)
+    replacements = {
+        'guarded-p18-v2': PROTOCOL,
+        'tools/run_p18_relationship_tests.py': 'tools/run_p13_reference_tests.py',
+        'exact seven unique tests': 'exact unique P13 roster',
+        'exact nine phases': 'exact P13 phase count',
+        'all nine captured engines': 'all P13 captured engines',
+    }
+    cardinalities = {
+        'len(set(ROSTER)) == 7': 'len(set(ROSTER)) == len(ROSTER)',
+        'len(phases) == 9': 'len(phases) == len(ROSTER) + 2',
+        "len(tests) == 7": 'len(tests) == len(ROSTER)',
+    }
+
+    class Specialize(ast.NodeTransformer):
+        def __init__(self):
+            self.identities = 0
+            self.counts = 0
+            self.summary = 0
+
+        def visit_Constant(self, node):
+            if isinstance(node.value, str) and node.value in replacements:
+                self.identities += 1
+                return ast.copy_location(ast.Constant(replacements[node.value]), node)
+            return node
+
+        def visit_Compare(self, node):
+            expression = ast.unparse(node)
+            if expression in cardinalities:
+                self.counts += 1
+                return ast.copy_location(ast.parse(cardinalities[expression], mode='eval').body, node)
+            return self.generic_visit(node)
+
+        def visit_Dict(self, node):
+            for index, key in enumerate(node.keys):
+                if isinstance(key, ast.Constant) and key.value == 'actual_suites':
+                    shared.require(isinstance(node.values[index], ast.Constant)
+                                   and node.values[index].value == 7, 'upstream suite summary unchanged')
+                    node.values[index] = ast.parse('len(ROSTER)', mode='eval').body
+                    self.summary += 1
+            return self.generic_visit(node)
+
+    expected = {'collect': (2, 0, 0), 'seal': (1, 0, 0), 'verify': (6, 3, 1)}
+    for name, counts in expected.items():
+        adapter = Specialize()
+        tree = adapter.visit(ast.parse(inspect.getsource(getattr(core, name))))
+        shared.require((adapter.identities, adapter.counts, adapter.summary) == counts,
+                       'unchanged upstream adaptation sites: ' + name)
+        if name == 'verify':
+            old = "shared.inventory(confined(out, 'stage'), stage=True) == source"
+            matches = [node for node in ast.walk(tree)
+                       if isinstance(node, ast.Compare) and ast.unparse(node) == old]
+            shared.require(len(matches) == 1, 'unchanged retained-stage UID adapter site')
+
+            class Retained(ast.NodeTransformer):
+                def visit_Compare(self, node):
+                    if ast.unparse(node) == old:
+                        return ast.copy_location(ast.parse(
+                            "uid_retained(confined(out, 'stage'), source, out)", mode='eval').body, node)
+                    return self.generic_visit(node)
+
+            tree = Retained().visit(tree)
+        exec(compile(ast.fix_missing_locations(tree), str(shared.HERE / 'run_p18_relationship_tests.py'), 'exec'), namespace)
+    install_uid_policy(namespace)
+    return namespace
+
+
+def main(argv=None):
+    argv = list(sys.argv[1:] if argv is None else argv)
+    parser = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
+    parser.add_argument('--output')
+    modes = parser.add_mutually_exclusive_group()
+    modes.add_argument('--collect', action='store_true', help='Root only; fresh native collection')
+    modes.add_argument('--prepare-only', action='store_true')
+    seen, index = set(), 0
+    while index < len(argv):
+        flag = argv[index]
+        shared.require(flag in ('--output', '--collect', '--prepare-only', '--help')
+                       and flag not in seen, 'unknown, duplicate or malformed flag')
+        seen.add(flag)
+        if flag == '--output':
+            index += 1
+            shared.require(index < len(argv) and argv[index] and not argv[index].startswith('--'), 'output value required')
+        index += 1
+    args = parser.parse_args(argv)
+    shared.require(not args.collect or args.output is not None, 'Root collection requires explicit --output')
+    if args.output is None:
+        base = os.environ.get('BUILD_OUTPUT_DIR')
+        shared.require(bool(base) and Path(base).is_absolute(), 'absolute BUILD_OUTPUT_DIR required')
+        args.output = str(Path(base) / CANONICAL_EVIDENCE)
+    args.timeout = 1200  # unchanged guarded core timeout; not a product value
+    core = protocol_core()
+    root = shared.HERE.parent
+    out = core['plain_path'](args.output)
+    refs = shared.source_refs(root)
+    shared.require(len(set(ROSTER)) == len(ROSTER) and set(ROSTER).issubset(shared.roster(root)), 'complete unique discovered roster')
+    markers = shared.module('p13_exact_markers', shared.HERE / 'strict_test_markers.py')
+    contract_path = root / 'docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json'
+    contract_sha = shared.sha(contract_path)
+    contracts = markers.load_contracts(contract_path)
+    shared.require(all(name in contracts for name in ROSTER), 'complete marker roster')
+    policy = shared.read(shared.SUPPORT / 'suite-policy.json')
+    shared.policy_coverage(ROSTER, refs, policy)
+    for test in ROSTER:
+        shared.phase_policy(test, Path(refs[test]['path']), policy['suite_policies'])
+    for test in NEW_TESTS:
+        shared.require(contracts[test]['source_sha256_at_schema_audit'] == refs[test]['sha256'], 'new strict source-hashed marker')
+    parse_paths = ['res://' + name for name in sorted(refs) if name.endswith('.gd')]
+    if args.prepare_only:
+        ancestor = out.parent
+        while not ancestor.exists():
+            ancestor = ancestor.parent
+        free = shutil.disk_usage(ancestor).free
+        size = sum(pin['bytes'] for pin in refs.values())
+        print(json.dumps(dict(protocol=PROTOCOL, roster=ROSTER, source_files=len(refs),
+            source_bytes=size, free_bytes=free, conservative_required_bytes=size + shared.MIN_SPACE,
+            capacity_available=free >= size + shared.MIN_SPACE, parse_paths=len(parse_paths),
+            future_native_phases=len(ROSTER) + 2, actual_checks=None, engines=0, stages=0,
+            formal_acceptance=False, original_unit_complete=False)))
+        return 0
+    if args.collect:
+        shared.require(not out.exists() and out.parent.is_dir(), 'fresh output with existing parent required')
+        shared.require(not out.is_relative_to(root), 'private collection outside source tree')
+        return core['collect'](args, root, out, refs, markers, contracts, policy, contract_path, contract_sha, parse_paths)
+    return core['verify'](out, refs, markers, contracts, policy, contract_sha, parse_paths)
+
+
+if __name__ == '__main__':
+    try:
+        raise SystemExit(main())
+    except (AssertionError, OSError, ValueError, KeyError, TypeError) as error:
+        print(type(error).__name__ + ': ' + str(error), file=sys.stderr)
+        raise SystemExit(1)