# P08 施設寸法移行の事前確認

原本の上級客室4×1、従業員寮2×1、闇市場4×2に対し、現拡張定義は3×2、4×2、3×2。調査はfacility-dimension-preflight.json参照。

## 実装済み

`facility_resize_preview.gd` はWorldServiceと現施設の明示された旧占有を受け、変更後のセル、追加/削除セル、衝突、未掘削、境界外、地下制約、支持喪失を返す。現在定義から旧占有を推測せず、旧形または変更後の形と保存の占有所有者が一致することを要求する。別WorldServiceへ複製して検証するため、成功/失敗どちらでも元ワールドの占有と版番号を変更しない。90/270度では寸法軸を交換し、層を保持。

14項目PASS: 上級客室の3×2→4×1、重なり拒否、上階の支持喪失、旧占有の矛盾/重複/不正ID/回転拒否、裏層の回転した寮、地下闇市場の未掘削/掘削後/境界外を実WorldServiceで確認。証拠 `artifacts/facility-dimensions-2026-09-29/validation.json`。

## 適用前に必要な処理

この判定のgeometry_okは寸法とWorldServiceの抽象的支持モデルの部分判定であり、移行実行許可ではない。ready_to_applyは常にfalse。特に周辺施設の実定義別重量、経路と職員/客の位置、建設中ジョブ、FacilityService/Construction/Pathの相互参照、バックアップと原子的保存への接続は残る。全ゲートを省略してプレビュー結果を本番へ書き戻してはならない。

定義の寸法・既存セーブはまだ変更していない。次はRuntimeから実重量/経路/旧配置を捕捉する移行プレビューへ接続し、変更できない配置を元データを保ったまま示す。P08全体および原本30施設の通常建設対応は未完了。


## 実重量とRuntimeへの接続

WorldService.validate_supportへ任意の占有者別重量を追加した。指定のない既存呼出は従来どおり。未登録ID・負/非整数重量は拒否し、支持モデルと保存状態を変更しない。闇市場の拡張で、従来の簡略重量では合格するが隣接施設の実重量を加えると容量超過になる例を検証した。

Runtime.preview_facility_dimension_migrationは完成施設と現定義を読み、全完成施設のweight_per_cellで判定する。削除予定セルにいる客/職員と建設ジョブを報告し、実状態は変更しない。形状・支持のプレビューが通ってもready_to_applyはfalseで、移動経路/建設中/保存取引のゲートが残る。

試験は既存の拡張定義を明示登録し、受付を通常建設した上に旧3×2の上級客室を通常コマンドで建設。最初は地上専用施設をロビー階へ置いて拒否されたため配置を修正した。削除セル上の職員検出は、通常通行できない旧座標を診断入力として設定した限定試験。通常歩行・配置移行の受入とは区別する。初回の建設失敗と通行不能セルへの登録失敗ログも保持。

実重量/Runtime14項目、WorldService60、Construction105、Runtime建設37項目がPASS。証拠 weighted-final-validation.json。施設定義の寸法と既存セーブは未変更。次は経路と実占有の事前検証、UI、適用トランザクションへ接続する。

## Construction migration candidate (2026-09-29)

Added prepare_construction_candidate: validate source, copy world, resize ownership, update facility and source-job cells together, then validate via ConstructionService.restore_snapshot. Active jobs are supported; costs, progress and timestamps are retained. Runtime preview exposes the candidate. No live state or disk write occurs.

Validation: Runtime 22 checks and geometry 14 checks PASS. Initial retry changed world revision; fixed by skipping occupancy replacement when already resized. Initial failure log retained. Active-job fixture covers progress zero only; partially built continuation remains unverified.

Remaining: valid actor relocation and routes, other Runtime crosslinks, partial-job continuation, backup and atomic application, UI and canonical dimensions. This is not full migration acceptance.

## Partial construction and full snapshot candidate (2026-09-29)

Runtime now assembles world, construction and operational facility geometry into a copied full snapshot. Actors on removed cells require relocation before assembly. ready_to_apply remains false: caller still needs isolated validation, route/actor checks and disk backup/atomic commit.

Focused suite: 33 checks PASS; geometry suite: 14 PASS. Partial construction now advances 7 minutes before migration, restores, rejects duplicate work for the saved minute, completes exactly once, preserves original cost/start/duration and restores after completion. Full snapshot candidate for an unoccupied premium room restores through a separate Runtime with the fixture expansion registry. This is one fixture, not all-facility or route relocation acceptance.

Evidence: full-snapshot-candidate.log and full-candidate-geometry.log. Canonical definitions, normal palette registration, actor relocation, route continuation and disk migration are still incomplete.

## Route preservation gate (2026-09-29)

prepare_facility_dimension_snapshot now restores its candidate into an isolated Runtime using the source definition registry. It compares entrance access, guests targeting the facility and staff workplace access using production route queries. Loss of existing reachability rejects the candidate; moving guests with a changed destination require explicit retargeting. No live actor relocation or disk write occurs.

40 focused checks PASS; make check exits 0. Controlled topology cases prove that removing an upper facility row can lose access even when the path graph itself is unchanged, and that an alternative entrance still requires updating the moving guest target. The first fixture omitted the vertical connector, causing two expected-reachability failures; explicit connector setup fixes the fixture. Initial failure retained. Controlled graph/guest edits are route-unit fixtures, not normal UI play evidence. The earlier valid full Runtime restore is tested separately.

Still pending: staff commute/task and elevator-in-flight migration acceptance, real actor relocation, automatic route retargeting, disk backup/atomic commit/UI, canonical definition changes and all-30 normal construction acceptance. The gate does not turn these remaining items into completion.

## Candidate guest retargeting (2026-09-29)

Added an all-or-nothing replan batch for isolated candidate guests. Every guest must still be MOVING with the expected old destination, a reachable replacement and no active elevator trip. Only path_handle target and graph revision change. Position, wallet, service state and movement credit remain untouched. Runtime candidate preparation applies the batch, captures/restores the resulting candidate again, and repeats access comparison. Live source and disk are unchanged.

46 focused checks PASS, 91 existing Runtime path/traffic checks PASS, make check exit0. Controlled topology fixture checks invalid second replan rollback, stale-plan rejection, retained guest fields and production movement toward the replacement lower entrance. This is not normal construction/UI or a full moving-guest save migration scenario; those remain unverified. No in-flight EV retargeting or physical actor relocation is claimed.

## Canonical dimensions applied (2026-09-29)

Changed expansion definitions: premium_room 4x1 FRONT, staff_dormitory 2x1 BACK, black_market 4x2 FRONT underground, matching original chapter 10. Costs, duration and other fields unchanged. These expansion definitions are still outside the normal palette registry; normal all-30 construction remains incomplete.

The old premium_room resource is archived under tests/fixtures/legacy_premium_room.tres. Migration tests reserve using this explicit old resource, then switch to current definitions before progress, candidate generation and restore. Thus legacy occupancy is tested against corrected definitions instead of leaving production data at old sizes. Existing saves are not rewritten.

New-construction tests use real WorldService/ConstructionService and a funded test budget. All three definitions at four rotations reserve, finish, pay once and restore:63 checks PASS. Legacy Runtime migration:47 PASS. Definition registry:266 PASS. Content catalog:212 PASS. make check exits0. Migration/geometry/new-dimension tests are now included in make test-s1. Earlier preflight records are historical evidence of the old mismatch.

Remaining: normal palette and role integration, all30 original facilities, actor relocation, staff tasks/EV migration, full moving-guest save acceptance, backup/atomic application and UI. Canonical dimension correction alone does not complete P08.

## Verified disk migration (2026-09-29)

SaveService.replace_snapshot_with_backup reuses the existing package migration transaction for same-format domain changes. It requires a valid candidate and an exact expected-source match, checksum-verifies candidate and backup, and atomically promotes using the existing recovery protocol. Repeated identical migration preserves the initial backup. Different package versions require their format migration first.

Runtime.migrate_facility_dimensions_at_path loads an explicit path into an isolated Runtime, prepares/validates the dimension candidate and routes, then replaces the package with backup. It does not change live Runtime. Tests use unique disposable user save paths, not production saves.

56 focused checks PASS,127 SaveService regression checks PASS; make check passed before the final format guard, and final Godot suites compiled that guard. Tests prove backup snapshot/bytes, repeat migration, stale-source and invalid-candidate rejection, separate-Runtime reload and live-state preservation. Existing save regression covers interruption/failed migration paths.

This completes the explicit disk API for accepted candidates, not the whole migration user flow. Actor relocation, EV/tasks, normal UI invocation and post-migration load flow, all30 normal construction remain incomplete.

## Staff rest and assigned-task migration gates (2026-09-29)

Route preservation now includes off-duty workers whose selected rest facility is resized, even without a workplace assignment. Pending/assigned tasks targeting the facility or its rescue destination must retain exact state and a valid destination in the resized facility access cells. Assigned-task reachability uses normal staff routing; rescue tasks use the same backyard restriction as production movement. Changed task destinations require coordinated migration and are rejected for now rather than silently retained.

25 focused checks PASS in dormitory-migration-tasks.log. A HEAD-version legacy4x2 dormitory fixture is built through normal construction and service stairs, then registry switches to canonical2x1. A worker resting on the valid upper stair landing preserves position through full snapshot migration and physically descends to the new lower entrance after resume. Blocking the lower entrance rejects migration without changing source. An old-upper-entry task rejects with TASK_DESTINATION_CHANGED. A retained-entry task assigned through StaffService preserves its exact snapshot after candidate restore. This covers an assigned/reserved task, not every working logistics/rescue case.

Existing premium/disk migration56 checks PASS; make check exit0. Remaining: physical actors on removed cells, coordinated task retargeting, in-flight elevator/rescue/logistics acceptance, migration UI/load flow, all30 normal facility acceptance. No production save changed.

## Whole-save completed-facility batch (2026-09-29)

migrate_facility_dimensions_at_path now accepts an omitted facility ID to migrate all mismatched completed facilities. It loads once into an isolated Runtime, prepares/restores each candidate there, and commits only the final snapshot through one verified backup transaction. Already-canonical facilities are skipped. Failed candidate restores the isolated original and leaves disk/live state untouched. Active legacy construction is explicitly reported as requiring migration, not silently skipped.

23 batch checks PASS (batch-save-final.log): premium room and dormitory old definitions built normally, one backup retains both originals, final full Runtime restores both corrected sizes, repeat preserves initial backup. A valid task at the second facility's removed entrance rejects the batch after the first candidate; rollback and unchanged formal save/live state/previous backup are verified. Existing single-facility/disk suite56 PASS. make check passed before final unchanged-shape skip; final Godot batch compiles and exercises that change.

Remaining: active-job full Runtime migration, joint spatial rearrangements requiring coordinated ordering, actor relocation/task retargeting/in-flight transport, normal UI/load flow and all30 facility acceptance. Sequential candidate validation is not a general simultaneous layout solver. Tests use disposable saves; production saves untouched.

## Active construction included in Runtime/disk batch (2026-09-29)

Active legacy jobs now join the batch target list. Their world reservations and construction snapshots are converted by the existing geometry/weight gate, then validated in an isolated full Runtime before promotion. They do not fabricate an operating facility before completion. Paid cost, work units, progress and timestamps are retained.

active-job-runtime.log:63 checks PASS. A normally started legacy premium-room job advances7minutes, is saved to a disposable package and batch-migrated with backup. The full migrated Runtime restores the four-cell reservation with original progress/cost, advances normally to an operating4x1 room, and restores after completion. Original partial-job backup remains exact. Completed batch23 and dormitory rest/task25 regression checks PASS; make check exit0.

The earlier ACTIVE_CONSTRUCTION_MIGRATION_REQUIRED limitation is removed for candidates accepted by these gates. This evidence covers the premium partial-job fixture, not every mixed-job/actor/transport layout. Remaining: coordinated spatial ordering, actors on removed cells and lost task destinations, in-flight transport/rescue/logistics, normal migration UI/load flow and all30 facility acceptance.

## Migration review and load UI (2026-09-29)

The bottom toolbar now provides 読込 ▾ → 旧寸法を修正して読み込む. Preview loads the saved package into an isolated Runtime, validates the complete candidate, and lists affected facilities and target sizes before confirmation. Cancel clears the pending token. Confirmation requires the original preview digest; a changed save is rejected before migration. Successful promotion retains the source backup and strictly loads the migrated formal save, without falling back to an old backup while claiming migration success. Ordinary load retains its existing recovery behavior.

Native macOS rendered UI handler flow:13 checks PASS, including cancel, changed-source rejection, original backup equality, corrected live room and already-current handling. Screenshot migration-dialog.png visually inspected: facility name,4×1 target, backup and unsaved-progress explanation, cancel/confirm buttons readable. Dashboard regression136 and batch-save regression23 checks PASS. These are rendered UI signal-handler tests using a controlled legacy fixture; OS pointer input and Windows execution were not tested. Makefile test-ui includes the new flow.

Remaining: coordinated spatial ordering, actors on removed cells, task retargeting, in-flight transport/rescue/logistics, all30 facilities and Windows acceptance. P08 remains in progress.