# P08-03 condition matrix — implementation submission, not acceptance

Immutable specification: `docs/spec/acceptance/P08-03.json`, normalized SHA-256
`7941da4edbd3c43a636a4a3d834d57c095b56da988fa3a056e55b22d3a5d50e9`.
Base HEAD: `12430ba89970bda349781e51157e72e48a4ac06f`. Worker made no commit.
This is one existing unit in 30 packages / 88 units, with no partial credit.

| Condition | Implemented paths / diagnostic cases | Current evidence state |
|---|---|---|
| support_connection | Normal palette: unsupported standard room; supported/connected reception; supported stair with missing landing; lower/upper stair construction. Real preview and Runtime command results are retained. | Source and synthetic checker controls only; real handler/native/OS pending. |
| invalid_position_reason | Reception footprint crosses the boundary from an in-bounds origin; existing reception overlap. Exact displayed Japanese reason and report codes; whole typed before/after preservation. | Source and semantic corruption controls only; actual refusals pending. |
| demolish_rebuild | Palette demolition toggle, cell selection, confirmation/cancel, Runtime `demolish_facility`, synchronous/queued results. Lower landing refusal, cancellation, reception removal, same-cell reconstruction. Occupancy, operational/construction instances, costs/refund checked. | Implemented; Godot parsing, actual UI, audio ownership, Runtime results pending. |
| pan_zoom_world_identity | Move mode + non-Ctrl wheel; normal wheel zoom, 0.5/4.0 clamps; recomputed local/viewport/screen coordinates and actual selected cell. OS recorder requests CUA only. | Mock bridge/checker controls only; actual OS wheel/screenshot provenance pending. |
| separate_pid_resume | Formal four-member save; separate native writer/reader; normal load menu; whole typed/raw presave/formal identity and source-defined post-operation reconstruction, instance ID, cell and overlap judgement. | R02 diagnosed notification difference; repaired candidate requires fresh native/OS collection. |

## Original-matched diagnostic choices

`BASELINE.txt` §9.3 names reception/checkout in the lobby; current
`data/facilities/reception.tres` is FRONT 4×2, cost read directly from the
definition. §10.1 explicitly gives standard room 2×1 FRONT; current
`standard_room.tres` matches and is used for unsupported-placement rejection.
§8.4 names stairs; current `infrastructure/guest_stairs.tres` and
`tests/transport/test_runtime_stairs.gd` expose ordinary two-floor stair
construction and `STAIR_LANDING_MISSING` / `STAIR_LANDING_IN_USE`.
All three IDs are in Main's existing normal palette and Runtime registry.
These choices establish this diagnostic slice, never all30 acceptance.

The handler fixture computes any diagnostic resource top-up from the four
planned positive construction definitions. It emits an initial formal save
and a budget report explicitly tagged diagnostic. No production costs,
services, balance values or definitions are changed. New art is unnecessary;
the demolition button reuses Main's existing styling and audio.

## r01 fixture repair (retained earlier submission)

The only failure authorities used are `NATIVE_R01_FAILURE_AND_SCOPE.json`
and `native-r01-writer-stderr.log`. The r01 writer failed 13 expectations;
its full SaveService return Dictionaries were not captured and remain absent.
No past Dictionary was reconstructed and no historical raw evidence was edited.

The handler now changes a toggle button's pressed state, emitting the real
production `toggled` connection before `pressed`. Repeated `choose(id)` leaves
an already selected ID active. Production wiring is unchanged.
Initial and normal saves use private `user://saves/p08_initial` and
`user://saves/manual_ui`; separate handler readers SHA-copy the exported input
into their own private profile before normal-menu load. The initial diagnostic
package seeds the normal slot, so the actual normal save creates its backup.
Exports retain all four members, the backup, and verbatim manifest slot
metadata with SHA/byte lengths and actual paths. An absent initial backup is
explicitly recorded. Every observed Runtime save/load result and direct
SaveService diagnostic return is recorded as typed JSON and SHA-pinned raw
Variant, with PID, requested/absolute paths and user-data directory.

The earlier 35 local checker tests remain synthetic controls. Their negative cases
also cover missing backup members, slot metadata SHA, failed actual returns,
and saves outside private profiles. The mock collector supplies a controlled
disk-space input; the production disk-admission gate is unchanged.
Current native/OS/full regression/review/integration remain pending.

## r02 whole-model operation repair (current candidate)

The retained submitted HEAD is `c2b59f04f94dda0a61991ec3bb7f0e946196f995`.
`NATIVE_R02_READER_OPERATION_DELTA.json` and `native-r02-reader-stderr.log`
are supplied historical evidence: reader PID 58430 failed the old whole
postsave/postload equality assertion. Their observed 161/162 counts are
diagnostic observations, never constants in the checker or scenario.

The fixture captures the complete writer model immediately before the normal
save, leaves `writer-checkpoint.var` as the complete postsave snapshot, and
uses `SaveService.inspect_snapshot` to decode the formal world read-only.
Both writer and reader retain inspection returned Dictionaries and complete
typed/raw formal models. The presave and formal models must match in full;
the reader formal model must match the writer formal model in full.

For each role, the expected complete model starts from that formal model.
Only one `source_defined_notification` is constructed using Runtime lines
4680–4720, `StableIdGenerator.next_id`, `SimulationDomainEvent.to_dictionary`
and `DomainEventStream.publish/create_snapshot`. The payload is recomputed
from the actual returned Dictionary, including optional selected/manifest
fields and all timing fields. Event envelope, next ID, counter increment,
sorted published IDs, existing history and the source's recent-event limit
are derived independently. No fields or Runtime effects are removed,
normalized away or copied from the observed notification as an expectation.
The complete typed expectation and raw expected Variant must match the
complete postsave/postload checkpoint. Read-only inspection must also leave
the whole live model unchanged.

Each role exports `*-expected-operation`, `*-operation-actual` and
`*-operation-comparison.json` alongside unchanged-format raw checkpoints,
formal models and returned-result records. On unknown drift, these complete
raw inputs remain and the checker reports the precise typed difference paths.
No new native difference was observed by this worker; fresh native execution
is pending, so the supplied R02 trace is not a PASS for these changed sources.

The current Python suite retains all 35 earlier tests and adds 14 semantic
tests, including every notification payload/envelope field, type drift,
counter/published-ID errors, extra or rewritten history, unrelated/unknown
model drift, read-only formal mismatch and a non-trace-derived count with
the source's history-limit behavior. These are synthetic controls only.
Exact executed source/input SHAs and the current 49-test result are recorded
in `local-validation.json` and `implementation.json`.

## Evidence boundary

`placement.gd` contains the shared finite scenario and handler endpoints.
`passive_placement.gd` overrides **all** input/setup/progression endpoints:
button, reveal, click, wheel, load_menu, complete_build, setup,
diagnostic_budget, save_initial_fixture, archive_formal. Its reachable
scenario neither calls product handlers nor emits their signals, advances
the clock, submits commands, resets Runtime or restores models. It reads
snapshots/reports and archives evidence. Root performs all OS gameplay.
Constructing/freeing the Main scene uses the existing ordinary cleanup helper.

The passive executable has a separate completion line. Only the handler UI
suite adds one entry to the strict marker contract and one source-pinned
ordinary cleanup policy. All previous marker/policy entries are retained.
The native OS collector never routes its process through the headless gate.

Checker controls are synthetic, including fabricated engine, PID, typed-byte
stand-ins, screenshots and weak-reference records. A positive local test
validates the checker, not the game or OS. Controller tests replace Popen,
engine probes, profiles and owner gate with mocks and launch no engine.
See `local-validation.json` and `implementation.json` for the actual final
executed source/input hashes and results.

## Still required from Root / independent review

Freeze a clean exact candidate; collect guarded native handler and real CUA
OS writer/reader evidence; run verify-only against that candidate; perform
impact checks and final full regression after related sources are frozen;
obtain independent Opus review of all five conditions; integrate and verify
the current final source, then update the authoritative ledger.
No reused P08-02 PASS is claimed for changed sources. P08-01 and the whole
P08 package remain open. Windows same-distribution/device evidence remains
open; Mac/Linux results cannot substitute for it. No outside-scope service
defect or required permission change has been demonstrated by this worker.