# Root collection protocol (not executed by worker)

R02 repair requires a fresh exact-source collection. The supplied R02 reader
failure is historical evidence, not a PASS for the repaired candidate.
Keep every raw postsave/postload snapshot and returned Dictionary. In each
handler and OS pair the shared fixture now also emits writer-presave,
writer/reader-formal-model, expected-operation, operation-actual and
operation-comparison artifacts. Formal models come from the read-only normal
`SaveService.inspect_snapshot` API. `writer-checkpoint.var` remains the raw
postsave state; never replace it with the presave/formal model.
The checker reconstructs one source-defined notification from each actual
returned Dictionary and compares the complete expected typed/raw model.
Counts come from the saved model, not the historical 161/162 trace. Preserve
all artifacts on an unknown difference and record the checker difference
paths with the corresponding actual/expected files before another repair.
The collector and Runtime/SaveService/UI remain unchanged in this repair.

Read the fixed spec and condition matrix first. Freeze/commit through the
authorized Root workflow. The worker has not committed or run this procedure.
Use a clean checkout at the exact submitted HEAD, an installed native Godot,
and a new output directory **outside** the source checkout:

```sh
python3 tools/run_p08_normal_placement.py --collect \
  --project-root /absolute/frozen/checkout \
  --output /absolute/build/p08-normal-placement-evidence \
  --commit EXACT_FROZEN_HEAD --godot /absolute/Godot \
  --input-mode native_os
BUILD_OUTPUT_DIR=/absolute/build python3 tools/check_p08_normal_placement_evidence.py \
  --verify-only --project-root /absolute/frozen/checkout
```

`--input-mode handler` collects only the strict headless pair. Its index has
no OS proof and intentionally cannot pass the whole checker. `native_os`
first collects that same headless pair, then separately starts the passive
nonheadless writer/reader. Import and handler phases use unchanged
`execute_phase` guards, markers, owner/audio proof. OS phases reuse the
P08-02 `collect_native_os.py` / passive recorder protocol, read-only as reuse
sources, with P08-03 arguments and paths; no new OS automation framework.

Before native launch the controller checks live engines, exact HEAD, clean
checkout, copied source inventory, disk admission and default player.
Each OS role gets a UUID private profile. Writer receives the handler's
`pair/initial-formal`; reader receives the OS writer's `os-pair/formal`.
All four formal members are copied and SHA-checked. The staged project gets
only private-profile settings and is restored in finally. Only captured
Popen children are cleaned by `owned_outer.finish_captured`.

The repaired handler also saves only inside its private `user://` profile,
then exports `initial-formal` and `formal` to the evidence directory.
`formal.bak`, `*-slot-metadata.json` (verbatim manifest), and `*-export.json`
retain backup/metadata bytes, source paths and SHA pins. Initial backup absence
is recorded explicitly. Each role's `*-save-results.json` references actual
typed result JSON and SHA-pinned raw Variant files, including failed returns.
Inspect the full returned dictionaries and paths on the next native run.
The r01 dictionaries were never captured; do not reconstruct them or append
new results to the historical r01 raw evidence.

Actual argv is `[engine, --path, stage, --script, passive_os.gd]`, with no
headless flag or headless proof gate. `started.json`, `process-started.json`,
`ended.json`, raw engine log, actual profile/engine report, source/stage/default
player inventories and ordinary owner/audio records remain in the evidence.
Controller and recorder SHA appear in start/end documents. Each OS child
has a 900-second bound and each Root acknowledgement a 300-second bound.
Timeout/error preserves failure records and cleans only owned children.

## CUA request / read-only acknowledgement bridge

The collector prints `waiting_for_root_cua`; the recorder prints each exact
request filename and writes:
`os-pair/{writer|reader}-request-NNNN/request.json`.
It contains PID, sequence, action, target window, instructions and applicable
expected world cell, transformed viewport/screen coordinate, window/screen
scale. The recorder waits; it never clicks or changes Accessibility settings.

Root uses its existing CUA tool on the indicated PID/window. A request may
ask for normal palette scrolling, a button/cell click, ordinary non-Ctrl
wheel, normal manual load, or normal play/speed/pause until construction
finishes. Modal buttons include their own window ID and screen transform.
If a cell is clipped, the recorder first asks for ordinary zoom-out framing,
then recomputes coordinates. Do not substitute old pixels or injected input.
Capture real CUA screenshots before and after each request. Retain the raw
CUA result and tool-call identity; never manufacture a receipt to advance.

Root writes its own receipt file within the evidence directory. The bridge
envelope references that raw tool call and records:

```json
{
  "method": "native_os",
  "target_pid": 123,
  "timestamp_ns": 123456789,
  "collector_pid": 456,
  "tool_name": "actual CUA tool name",
  "tool_call_id": "actual tool call identity",
  "events": [{"type": "actual input event", "raw_receipt": "retained raw CUA result"}]
}
```

After completing the requested operation, Root writes `ack.json` beside
the request. All artifact references are relative to the evidence root:

```json
{
  "target_pid": 123,
  "sequence": 1,
  "request_sha256": "actual request file SHA-256",
  "input_receipt": "root-receipts/writer-0001.json",
  "screen_before": "root-receipts/writer-0001-before.png",
  "screen_after": "root-receipts/writer-0001-after.png"
}
```

These numbers/strings are format examples, never evidence. Recorder and
controller only **read** Root's acknowledgement/receipt files. The recorder
separately retains actual Godot input observations and world selection,
whole typed/Variant snapshots, displayed reasons and Runtime results.
The checker verifies request/ack hash and sequence/PID binding, raw input
presence, PNG structure/CRC, affine coordinate conversions, formal members,
model invariants, distinct processes, native lifecycle and real owner proof.
Independent review must match tool-call identities/raw CUA results and actual
screenshots; an integrity checker is not an OS attestation authority.

Keep final requests (including save/load) as well as row-specific requests.
Do not edit evidence after collection to force a pass. Correct source/input
defects through the fixed repair workflow. GDScript parsing, actual native
and OS success, full regression, review and integration are all pending.

R05 repair: cell requests now retain `viewport_to_screen` as six affine entries
`[a,b,c,d,tx,ty]`. Apply it to viewport `(x,y)` to obtain screen
`(a*x+c*y+tx, b*x+d*y+ty)`; retain the actual CUA coordinate in the raw receipt
and compare against screenshots/window geometry, including titlebar and stretch.
Do not multiply by canvas scale a second time. `guide_rect` is in viewport
coordinates and `guide_visible` records interception geometry. The unsupported
target is chosen by read-only production preview inspection outside that guide;
the failed R05 request is historical evidence and must remain preserved.