# P13-02-CODE1 implementation handoff

This is non-graphic state/reference/occupancy/save machinery only. It does not
complete P13-02, grant partial credit, or change the original 30/88 denominator
or formal 14/88 count. Native execution and acceptance are pending.

## Declared scope and verification

Before editing, the worker declared the new service, bounded Runtime hooks,
special tests, narrow runner, marker additions and this documentation. SaveService
was conditional on an exact-key dependency; inspection found
`SupplyAutoPurchaseQuotePlans.valid_runtime_format` has that dependency.
Only allowed paths were edited. No asset, UI, content, model, policy, clock phase,
or P04 change is involved.

The full ignored `build/owner-handoff/ACTUAL_OPUS_RUN_DECISION.json` was read and
left untouched. Base HEAD is `1e8d4ea88876865a72547ff0edf43ed5b0e74c7e`.
The immutable spec was not edited. Its SHA-256 without the terminal newline is
the registered `8ea65f2eefedc772c08170186f5cd03ac017432f4b069ade4f9210d4215c2d43`;
the on-disk file including that newline is
`988d6e18a49372549863cd433432c2852c962fa64b138e490361c023e80249dc`.

Worker verification: Python AST parsing/compilation only, without executing the
runner or importing its dependencies; source/JSON/hash review. GDScript parsing,
all tests, `--prepare-only`, native collection and regression were **not run**.
No check totals or native success receipts are claimed. No git writes, commits,
branches, other agents, integration or Runner operations were performed.

## Service and commands

`PeepingRoomService` is a separate RefCounted service with no content or UI.
All command executors use the existing Runtime queue; queue/history receipts
remain normal Runtime behavior even for rejected/read-only domain commands.

| Command | Preconditions and result |
| --- | --- |
| `peeping_room_validate` | `origin: Vector3i`, optional `footprint: Vector2i` (2x1), optional `target_instance_id: String/StringName`. Pure domain validation. |
| `peeping_room_place` | Always `BUILD_DEFINITION_PENDING_D04`; no occupancy, resource, room or ID mutation. |
| `peeping_room_relink` | Existing `room_id`, explicit nonempty `target_instance_id`; full geometry and ownership validation excluding only the room's exact own occupancy. Leaves `LINKED`, stopped, `RELINKED_PENDING_RESUME`. |
| `peeping_room_record_evidence` | Existing `room_id`, nonblank named `source_event_key`. Uses Runtime minute, never caller-supplied time. Checks stopped, target power, target closure/opening hours, completed construction authority, and lost target in that order. Otherwise rejects with `RECORDER_ELIGIBILITY_PENDING_D04_D08_P16`. Never writes the ledger. |

Malformed command field types return `INVALID_PAYLOAD`. Missing/blank source keys
return `SOURCE_EVENT_KEY_REQUIRED` before operational checks. Loss latches both
`TARGET_LOST` and stopped, so collection after normal demolition returns `STOPPED`
while the room's link/stop reason identifies `TARGET_LOST`. No resume command or
automatic resume is defined. Power/closure guards read actual target conditions;
they do not define special-room power demand, staffing or normal operation.

Placement is exactly 2x1 BACK, fully behind a single completed FRONT
`public_bath` or `adult_private_room`. It checks bounds/excavation, both real
FacilityService and ConstructionService ownership, FRONT cells, World occupancy,
and both World walkability and PathService membership. Exact rejection families:
`WRONG_LAYER`, `WRONG_FOOTPRINT`, `OUT_OF_BOUNDS`, `NOT_EXCAVATED`,
`TARGET_INCOMPLETE`, `TARGET_MISSING`, `PARTIAL_TARGET`, `MULTIPLE_TARGETS`,
`TARGET_MISMATCH`, `TARGET_UNKNOWN`, `TARGET_NOT_ALLOWED`, `TARGET_WRONG_LAYER`,
`CORRIDOR_CONFLICT`, `BACK_OCCUPIED`. The named `vip_suite` request returns
`PENDING_P10_01`; `vip_private_salon` is not an allowed substitute.

Any existing corridor cell conflicts. A proposed cut through a connected corridor
is rejected before mutation, preserving the route; no reroute or bypass is
invented. Accepted fixture cells were already nonwalkable and become occupied
under `special_peeping_room`. No special-room construction weight/cost is assumed.

Runtime demolition and FacilityService unregistration latch loss. Collection also
detects missing FRONT occupancy/identity. Rebuilding the same cells produces a
different construction ID and never silently reattaches rooms. Relink is explicit.

## CONTROLLED_FIXTURE boundary

Only service methods named `controlled_fixture_place`,
`controlled_fixture_set_stopped`, and `controlled_fixture_record_evidence` create
test rooms, enable fixture collection, or write evidence. They are labeled
CONTROLLED_FIXTURE in code and tests. They have no command/palette registration,
and no Runtime executor calls them. Test helpers disclose direct underground
geometry setup and MIMI registration; those do not assert natural unlock/join or
production eligibility. Target construction uses existing definitions/costs/times.

Room IDs come from the existing StableIdGenerator's `peeping_room` counter.
Evidence IDs encode the UTF-8 lengths and hex bytes of the full
`(room_id, target_instance_id, source_event_key)` tuple. This is injective rather
than delimiter concatenation or a hash with possible collisions. Replays return
the existing ID with `duplicated=true` and retain the first minute. Evidence is
only IDs, source key and minute. Room `target_history` retains prior bindings so
relink does not orphan existing opaque evidence.

## Save invariants

Runtime versions remain 14 and 15, with version 15 only for existing v2 purchase
history. Optional canonical StringName key `special_peeping_rooms` has section
version 1 and exact keys `version`, `rooms`, `evidence`. Empty service state emits
no key, preserving original snapshots. Absent sections restore empty only if no
world occupancy uses the special kind or `peeping_room.` prefix. Thus removing
the section from a current room-bearing save is rejected without a version bump.

Restore stages the entire section against staged world, path, facilities,
construction and ID generator before committing any Runtime state. It checks
canonical keys/types, version, duplicate room/evidence identities, deterministic
evidence tuple encoding, bounds/geometry, room/occupancy correspondence in both
directions, generator high-water mark, known historical facility IDs, present
target definition/geometry, loss/stopped coherence, and evidence room/history/time
references. Null/present-empty sections are invalid; absence is the only empty
encoding. Existing pending command/reference and schema migration checks remain.

SaveService validates a present section through the same staged service validator,
then supplies a shallow copy without this one key to the original purchase-format
allowlist. No other keys are removed. The original format 1 (Runtime 1–14),
format 2 (Runtime 15), manifest duplicate 15 and MIMI checks remain unchanged.

## Verification handoff

Five strict suites cover geometry/corridor, removal/relink, evidence/guards,
typed atomic save corruption and physical format 1, and Runtime commands plus
physical MIMI format 2. Tests use `var_to_bytes` for whole Runtime atomicity and
roundtrip checks. New marker rows carry final test source hashes; prior rows and
policy are unchanged. A helper under `tests/special/` is not a discovered suite.

`tools/run_p13_reference_tests.py` defaults to read-only verification of
`$BUILD_OUTPUT_DIR/p13-reference-native`, failing closed without an absolute
environment path. Explicit `--output --collect` is for Root only. The strict flag
parser rejects abbreviations, repeated flags, positional inputs and `=` aliases.
`--prepare-only` is non-native but was not executed by this worker.

The runner imports the existing P18 core by path. Since its three entry functions
hardcode their label and seven/nine counts, a bounded AST adapter changes only
protocol/runner identities, those explicit roster cardinalities, and diagnostic
labels. It checks the exact adaptation-site counts and fails closed on drift.
All confinement, inventory, JSON, sealing, source/engine/marker/policy binding,
process, diagnostic, profile and cleanup gates are reused. It neither copies the
whole runner nor modifies P18/helpers. The whole selected source map binds both
runner sources. Phase count derives from `len(ROSTER) + 2`.

Roster includes all five new suites and existing construction/world/path/runtime
construction, supply migration, transport save, Runtime weather, snapshot
serialization, save lifecycle and MIMI purchase suites. Receipts retain
`formal_acceptance=false` and `original_unit_complete=false`.

Root must perform serialized native collection with the allocation/private
profile, then registered `p13-reference` validation, a separate actual Opus
review, and the final exact-version required regression. Only those steps can
establish execution results.

## Still pending, without invented values

D04 build/upkeep/build minutes and other product numbers; recorder staffing and
natural triggers/rates D04/D08/P16; VIP suite P10-01; D05 transaction decisions
(no tick-phase changes here); P19 evidence use and P24 camera UI; normal palette
registration/construction/operation and natural production evidence; whole P13
acceptance, final review/integration, and applicable native Windows conditions.