TheTree_mock/docs/plans/original-completion-2026-10-02/execution/p08-03/ROOT_COLLECTION.md

Root collection protocol (not executed by worker)

R02 repair requires a fresh exact-source collection. The supplied R02 reader failure is historical evidence, not a PASS for the repaired candidate. Keep every raw postsave/postload snapshot and returned Dictionary. In each handler and OS pair the shared fixture now also emits writer-presave, writer/reader-formal-model, expected-operation, operation-actual and operation-comparison artifacts. Formal models come from the read-only normal SaveService.inspect_snapshot API. writer-checkpoint.var remains the raw postsave state; never replace it with the presave/formal model. The checker reconstructs one source-defined notification from each actual returned Dictionary and compares the complete expected typed/raw model. Counts come from the saved model, not the historical 161/162 trace. Preserve all artifacts on an unknown difference and record the checker difference paths with the corresponding actual/expected files before another repair. The collector and Runtime/SaveService/UI remain unchanged in this repair.

Read the fixed spec and condition matrix first. Freeze/commit through the authorized Root workflow. The worker has not committed or run this procedure. Use a clean checkout at the exact submitted HEAD, an installed native Godot, and a new output directory outside the source checkout:

python3 tools/run_p08_normal_placement.py --collect \
  --project-root /absolute/frozen/checkout \
  --output /absolute/build/p08-normal-placement-evidence \
  --commit EXACT_FROZEN_HEAD --godot /absolute/Godot \
  --input-mode native_os
BUILD_OUTPUT_DIR=/absolute/build python3 tools/check_p08_normal_placement_evidence.py \
  --verify-only --project-root /absolute/frozen/checkout

--input-mode handler collects only the strict headless pair. Its index has no OS proof and intentionally cannot pass the whole checker. native_os first collects that same headless pair, then separately starts the passive nonheadless writer/reader. Import and handler phases use unchanged execute_phase guards, markers, owner/audio proof. OS phases reuse the P08-02 collect_native_os.py / passive recorder protocol, read-only as reuse sources, with P08-03 arguments and paths; no new OS automation framework.

Before native launch the controller checks live engines, exact HEAD, clean checkout, copied source inventory, disk admission and default player. Each OS role gets a UUID private profile. Writer receives the handler's pair/initial-formal; reader receives the OS writer's os-pair/formal. All four formal members are copied and SHA-checked. The staged project gets only private-profile settings and is restored in finally. Only captured Popen children are cleaned by owned_outer.finish_captured.

The repaired handler also saves only inside its private user:// profile, then exports initial-formal and formal to the evidence directory. formal.bak, *-slot-metadata.json (verbatim manifest), and *-export.json retain backup/metadata bytes, source paths and SHA pins. Initial backup absence is recorded explicitly. Each role's *-save-results.json references actual typed result JSON and SHA-pinned raw Variant files, including failed returns. Inspect the full returned dictionaries and paths on the next native run. The r01 dictionaries were never captured; do not reconstruct them or append new results to the historical r01 raw evidence.

Actual argv is [engine, --path, stage, --script, passive_os.gd], with no headless flag or headless proof gate. started.json, process-started.json, ended.json, raw engine log, actual profile/engine report, source/stage/default player inventories and ordinary owner/audio records remain in the evidence. Controller and recorder SHA appear in start/end documents. Each OS child has a 2400-second total wait recorded as timeout_seconds in start/end receipts, using the same value passed to process.wait. Each acknowledgement retains its 300-second bound; provider 900 and validation 180 remain unchanged. Timeout/error preserves failure records and cleans only owned children.

CUA request / read-only acknowledgement bridge

The collector prints waiting_for_root_cua; the recorder prints each exact request filename and writes: os-pair/{writer|reader}-request-NNNN/request.json. It contains PID, sequence, action, target window, instructions and applicable expected world cell, transformed viewport/screen coordinate, window/screen scale. The recorder waits; it never clicks or changes Accessibility settings.

Root uses its existing CUA tool on the indicated PID/window. A request may ask for normal palette scrolling, a button/cell click, ordinary non-Ctrl wheel, normal manual load, or normal play/speed/pause until construction finishes. Modal buttons include their own window ID and screen transform. If a cell is clipped, the recorder first asks for ordinary zoom-out framing, then recomputes coordinates. Do not substitute old pixels or injected input. Capture real CUA screenshots before and after each request. Retain the raw CUA result and tool-call identity; never manufacture a receipt to advance.

Root writes its own receipt file within the evidence directory. The bridge envelope references that raw tool call and records:

{
  "method": "native_os",
  "target_pid": 123,
  "timestamp_ns": 123456789,
  "collector_pid": 456,
  "tool_name": "actual CUA tool name",
  "tool_call_id": "actual tool call identity",
  "events": [{"type": "actual input event", "raw_receipt": "retained raw CUA result"}]
}

After completing the requested operation, Root writes ack.json beside the request. All artifact references are relative to the evidence root:

{
  "target_pid": 123,
  "sequence": 1,
  "request_sha256": "actual request file SHA-256",
  "input_receipt": "root-receipts/writer-0001.json",
  "screen_before": "root-receipts/writer-0001-before.png",
  "screen_after": "root-receipts/writer-0001-after.png"
}

These numbers/strings are format examples, never evidence. Recorder and controller only read Root's acknowledgement/receipt files. The recorder separately retains actual Godot input observations and world selection, whole typed/Variant snapshots, displayed reasons and Runtime results. The checker verifies request/ack hash and sequence/PID binding, raw input presence, PNG structure/CRC, affine coordinate conversions, formal members, model invariants, distinct processes, native lifecycle and real owner proof. Independent review must match tool-call identities/raw CUA results and actual screenshots; an integrity checker is not an OS attestation authority.

Keep final requests (including save/load) as well as row-specific requests. Do not edit evidence after collection to force a pass. Correct source/input defects through the fixed repair workflow. GDScript parsing, actual native and OS success, full regression, review and integration are all pending.

R06 calibration correction (ROOT_NATIVE_R06_OS_TIMEOUT.json): the engine viewport_to_screen affine matrix [a,b,c,d,tx,ty] maps viewport (x,y) to (ax+cy+tx, bx+dy+ty) in engine coordinates. It reports identity in the real window and does not include physical stretch or the screenshot titlebar. Keep 1440x810 virtual coordinates separate from 1280x720 window content and 1280x752 screenshot coordinates. For this measured window, apply scale 8/9 (approximately 0.8889), then add 32 pixels to screenshot y for the titlebar. For modal controls, first apply the dialog offset reported by Godot, then physical stretch and titlebar. Desktop CUA coordinates additionally require the observed screenshot/window origin. Retain actual CUA coordinates, raw screenshots and window geometry; recalibrate whenever geometry changes. guide_rect remains in viewport coordinates. Preserve historical failed evidence: R06 request 33 was unacknowledged after PID 17863 ended and cannot count as evidence. Fresh guarded native/OS collection, full regression, independent review and integration remain pending.