TheTree_mock/docs/plans/original-completion-2026-10-02/execution/p08-03/CONDITION_MATRIX.md

P08-03 condition matrix — implementation submission, not acceptance

Repair13 current status (supersedes earlier submission status below)

Checker/test-only repair. Product, Runtime, Godot, collector, same31aa and rawR09 bytes are unchanged. Root supplied the read-only post-collection sips measurement of 138 images; this is not capture-time metadata. All measured screenshots are 1280×752 JPEG despite their .png names. Window content size 1280×720 is never used as screenshot dimensions.

The checker reads every image, checks SOI/EOI and bounded SOF0/SOF2 frame/scan structure, and compares its dimensions and recomputed SHA against the Root measurement and index. This is structural validation, not JPEG pixel decoding. The measurement's original_index_sha256 binds the recomputed index. Exact 69-request/138-image membership and before/after dimensions are checked; formal save thumbnails retain their separate existing member checks.

Collection pins bind the original index, runner receipts and both OS receipts; every indexed original/canonical artifact must be byte-identical. Owner proof is verified at ORIGINAL_ROOT/os-runs/{writer,reader}/teardown/control.json, retaining original absolute varbytes pins without rewriting them.

Reuse is restricted to same31aa (31aa7706d28a92e313c432d5a62e35d19503dcc3): all collected source/input hashes still match, except the two explicitly changed Python validator/test sources and the new synthetic Python image fixture. The old validator/test pins are checked against same31aa git objects; product, GDScript fixtures, engine, recorder, controller and marker pins remain exact. This exception does not confer gameplay or changed-product acceptance.

Current local Python results and final executed hashes are in repair13-local-validation.json, repair13-local-source-manifest.json and implementation.json. All 88 previous tests remain; 12 additional controls cover baseline/progressive parsing, malformed/truncated/non-JPEG bytes, SOF/measurement disagreement, before/after drift, missing/extra/duplicate entries, extra indexed screenshots, source SHA, stale index, collection pin and original/canonical divergence. Synthetic fixtures have no dependency on operational Root handoff documents.

All five conditions remain unaccepted. R09 local integrity validation is not the independent R09 re-check. Leave open: stair preview/domain-status disagreement for independent acceptance, Windows same-distribution/device, Root final175 after frozen submission, R09 re-check, independent Opus review, and integration/current verification/ledger. No OS steps were replayed.

Immutable specification: docs/spec/acceptance/P08-03.json, normalized SHA-256 7941da4edbd3c43a636a4a3d834d57c095b56da988fa3a056e55b22d3a5d50e9. Base HEAD: 12430ba89970bda349781e51157e72e48a4ac06f. Worker made no commit. This is one existing unit in 30 packages / 88 units, with no partial credit.

Condition	Implemented paths / diagnostic cases	Current evidence state
support_connection	Normal palette: unsupported standard room; supported/connected reception; supported stair with missing landing; lower/upper stair construction. Real preview and Runtime command results are retained.	Source and synthetic checker controls only; real handler/native/OS pending.
invalid_position_reason	Reception footprint crosses the boundary from an in-bounds origin; existing reception overlap. Exact displayed Japanese reason and report codes; whole typed before/after preservation.	Source and semantic corruption controls only; actual refusals pending.
demolish_rebuild	Palette demolition toggle, cell selection, confirmation/cancel, Runtime demolish_facility, synchronous/queued results. Lower landing refusal, cancellation, reception removal, same-cell reconstruction. Occupancy, operational/construction instances, costs/refund checked.	Implemented; Godot parsing, actual UI, audio ownership, Runtime results pending.
pan_zoom_world_identity	Move mode + non-Ctrl wheel; normal wheel zoom, 0.5/4.0 clamps; recomputed local/viewport/screen coordinates and actual selected cell. OS recorder requests CUA only.	Mock bridge/checker controls only; actual OS wheel/screenshot provenance pending.
separate_pid_resume	Formal four-member save; separate native writer/reader; normal load menu; whole typed/raw presave/formal identity and source-defined post-operation reconstruction, instance ID, cell and overlap judgement.	R02 diagnosed notification difference; repaired candidate requires fresh native/OS collection.

Original-matched diagnostic choices

BASELINE.txt §9.3 names reception/checkout in the lobby; current data/facilities/reception.tres is FRONT 4×2, cost read directly from the definition. §10.1 explicitly gives standard room 2×1 FRONT; current standard_room.tres matches and is used for unsupported-placement rejection. §8.4 names stairs; current infrastructure/guest_stairs.tres and tests/transport/test_runtime_stairs.gd expose ordinary two-floor stair construction and STAIR_LANDING_MISSING / STAIR_LANDING_IN_USE. All three IDs are in Main's existing normal palette and Runtime registry. These choices establish this diagnostic slice, never all30 acceptance.

The handler fixture computes any diagnostic resource top-up from the four planned positive construction definitions. It emits an initial formal save and a budget report explicitly tagged diagnostic. No production costs, services, balance values or definitions are changed. New art is unnecessary; the demolition button reuses Main's existing styling and audio.

r01 fixture repair (retained earlier submission)

The only failure authorities used are NATIVE_R01_FAILURE_AND_SCOPE.json and native-r01-writer-stderr.log. The r01 writer failed 13 expectations; its full SaveService return Dictionaries were not captured and remain absent. No past Dictionary was reconstructed and no historical raw evidence was edited.

The handler now changes a toggle button's pressed state, emitting the real production toggled connection before pressed. Repeated choose(id) leaves an already selected ID active. Production wiring is unchanged. Initial and normal saves use private user://saves/p08_initial and user://saves/manual_ui; separate handler readers SHA-copy the exported input into their own private profile before normal-menu load. The initial diagnostic package seeds the normal slot, so the actual normal save creates its backup. Exports retain all four members, the backup, and verbatim manifest slot metadata with SHA/byte lengths and actual paths. An absent initial backup is explicitly recorded. Every observed Runtime save/load result and direct SaveService diagnostic return is recorded as typed JSON and SHA-pinned raw Variant, with PID, requested/absolute paths and user-data directory.

The earlier 35 local checker tests remain synthetic controls. Their negative cases also cover missing backup members, slot metadata SHA, failed actual returns, and saves outside private profiles. The mock collector supplies a controlled disk-space input; the production disk-admission gate is unchanged. Current native/OS/full regression/review/integration remain pending.

r02 whole-model operation repair (retained earlier submission)

The retained submitted HEAD is c2b59f04f94dda0a61991ec3bb7f0e946196f995. NATIVE_R02_READER_OPERATION_DELTA.json and native-r02-reader-stderr.log are supplied historical evidence: reader PID 58430 failed the old whole postsave/postload equality assertion. Their observed 161/162 counts are diagnostic observations, never constants in the checker or scenario.

The fixture captures the complete writer model immediately before the normal save, leaves writer-checkpoint.var as the complete postsave snapshot, and uses SaveService.inspect_snapshot to decode the formal world read-only. Both writer and reader retain inspection returned Dictionaries and complete typed/raw formal models. The presave and formal models must match in full; the reader formal model must match the writer formal model in full.

For each role, the expected complete model starts from that formal model. Only one source_defined_notification is constructed using Runtime lines 4680–4720, StableIdGenerator.next_id, SimulationDomainEvent.to_dictionary and DomainEventStream.publish/create_snapshot. The payload is recomputed from the actual returned Dictionary, including optional selected/manifest fields and all timing fields. Event envelope, next ID, counter increment, sorted published IDs, existing history and the source's recent-event limit are derived independently. No fields or Runtime effects are removed, normalized away or copied from the observed notification as an expectation. The complete typed expectation and raw expected Variant must match the complete postsave/postload checkpoint. Read-only inspection must also leave the whole live model unchanged.

Each role exports *-expected-operation, *-operation-actual and *-operation-comparison.json alongside unchanged-format raw checkpoints, formal models and returned-result records. On unknown drift, these complete raw inputs remain and the checker reports the precise typed difference paths. No new native difference was observed by this worker; fresh native execution is pending, so the supplied R02 trace is not a PASS for these changed sources.

The current Python suite retains all 35 earlier tests and adds 14 semantic tests, including every notification payload/envelope field, type drift, counter/published-ID errors, extra or rewritten history, unrelated/unknown model drift, read-only formal mismatch and a non-trace-derived count with the source's history-limit behavior. These are synthetic controls only. Exact executed source/input SHAs and the current 49-test result are recorded in local-validation.json and implementation.json.

Evidence boundary

placement.gd contains the shared finite scenario and handler endpoints. passive_placement.gd overrides all input/setup/progression endpoints: button, reveal, click, wheel, load_menu, complete_build, setup, diagnostic_budget, save_initial_fixture, archive_formal. Its reachable scenario neither calls product handlers nor emits their signals, advances the clock, submits commands, resets Runtime or restores models. It reads snapshots/reports and archives evidence. Root performs all OS gameplay. Constructing/freeing the Main scene uses the existing ordinary cleanup helper.

The passive executable has a separate completion line. Only the handler UI suite adds one entry to the strict marker contract and one source-pinned ordinary cleanup policy. All previous marker/policy entries are retained. The native OS collector never routes its process through the headless gate.

Checker controls are synthetic, including fabricated engine, PID, typed-byte stand-ins, screenshots and weak-reference records. A positive local test validates the checker, not the game or OS. Controller tests replace Popen, engine probes, profiles and owner gate with mocks and launch no engine. See local-validation.json and implementation.json for the actual final executed source/input hashes and results.

Still required from Root / independent review

Freeze a clean exact candidate; collect guarded native handler and real CUA OS writer/reader evidence; run verify-only against that candidate; perform impact checks and final full regression after related sources are frozen; obtain independent Opus review of all five conditions; integrate and verify the current final source, then update the authoritative ledger. No reused P08-02 PASS is claimed for changed sources. P08-01 and the whole P08 package remain open. Windows same-distribution/device evidence remains open; Mac/Linux results cannot substitute for it. No outside-scope service defect or required permission change has been demonstrated by this worker.

r04 initial OS load oracle repair (retained earlier submission)

The supplied OS_R04_INITIAL_LOAD_ORACLE_FINDING.json and os-r04-writer-engine.log identify the bootstrap-only simple equality failure. The registered build contains 2153 files; its complete read-only inventory is recorded in registered-r04-evidence-manifest.json. Historical raw/PASS evidence is unchanged and no changed-source acceptance is inherited.

Passive setup now uses the existing verify_operation oracle with bootstrap- prefix. Complete typed JSON and raw Variant formal, checkpoint (postload), returned Dictionary, expected-operation and operation-actual files, plus a separate comparison JSON, remain distinct from writer/reader final proofs. The same source-defined notification logic checks all state, previous events, next event ID/counter and every payload field; no event masking or omissions. The checker binds bootstrap formal/returned models to the recorded read-only inspection and first Runtime return, reconstructs the expectation and checks whole typed state and raw expected/actual identity.

Static inspection within the allowed fixture/recorder scope found no other postload-versus-formal simple equality oracle. Remaining exact comparisons check presave/formal identity or read-only preservation and are intentional. Seven added semantic controls cover missing/extra notifications, counter, payload and unknown-field drift, missing raw and overwritten bootstrap raw; all 49 earlier tests remain. Final actual results and exact source/input hashes are recorded in local-validation.json and local-source-manifest.json. Only pure Python validation uses the ordinary 900-second subprocess timeout.

Root native/OS collection for this candidate, final full regression after freeze, separate Opus review and integration/current final verification remain open. All five conditions and the 30/88 denominator are unchanged. No Runtime, UI, SaveService, collector, specification or historical evidence edits.

R05 consolidated repair (historical submission)

The supplied ROOT_CHECKER_R05_INFRASTRUCTURE_ORACLE.json and ROOT_OS_R05_GUIDE_INTERCEPTION.json are failure authorities, not acceptance. The original failed OS request and all supplied raw files remain untouched. The complete gzipped reader checkpoint is copied byte-for-byte into the fixture suite with its provenance. Tests verify the decompressed 2120352 bytes and SHA 304d97de8051d5e74c6e32c4482a3cb183b0172d7671088fdc40469cc3448c0d. It is actual native input from candidate 4a17d0e0f5, not proof of acceptance for the changed candidate.

Runtime _on_facility_completed and FacilityInfrastructureProjector define the split: ordinary construction instances require operational membership; supported schema proxies require exact infrastructure membership. The checker preserves completed-job, occupation, demolition and refusal invariants, and now checks projection identity/cells/definition/fingerprint, managed ROUTE and connector membership, exact stair connector fields and lower landing, and projected walkable/path topology. Actual checkpoint corruption tests exercise missing, extra and incorrect topology, ordinary facility loss and proxy occupation loss. Whole-checker synthetic controls now represent stairs in the infrastructure projector and retain every earlier test.

The handler unsupported target is (4,4,0). The passive observer independently chooses a visible cell with the unchanged UNSUPPORTED predicate outside the opening guide rectangle after normal palette selection. It reads bounds, preview and guide geometry; it does not suppress the guide or mutate models. Cell requests include viewport-to-screen affine mapping derived from existing Godot transforms and current guide geometry. The engine matrix is separate from physical stretch and screenshot/window translation (R06 correction). The checker recomputes the mapping and rejects guide interception. Root must retain actual CUA coordinates, screenshots and raw receipts and check the mapping against the real window; no OS success is claimed by this worker.

Bootstrap repair, all five facets, product UI and driver progress are preserved. Python syntax/checker execution and exact source/input manifests are recorded in local-validation.json and implementation.json. Godot parsing, fresh native and OS collection, final full regression, independent review, integration/current verification and Windows device evidence remain pending. No context gap or outside-scope service defect has been demonstrated in this batch.

R06 targeted repair (preserved repair)

Only the OS per-child total wait changes from 900 to 2400 seconds, with truthful start/end receipt provenance. Per-request 300, provider 900, validation 180 and every source/acceptance guard remain unchanged. Product and fixtures are unchanged. Historical R06 native passes do not establish changed-source PASS.

R06 calibration correction (ROOT_NATIVE_R06_OS_TIMEOUT.json): the engine viewport_to_screen affine matrix [a,b,c,d,tx,ty] maps viewport (x,y) to (ax+cy+tx, bx+dy+ty) in engine coordinates. It reports identity in the real window and does not include physical stretch or the screenshot titlebar. Keep 1440x810 virtual coordinates separate from 1280x720 window content and 1280x752 screenshot coordinates. For this measured window, apply scale 8/9 (approximately 0.8889), then add 32 pixels to screenshot y for the titlebar. For modal controls, first apply the dialog offset reported by Godot, then physical stretch and titlebar. Desktop CUA coordinates additionally require the observed screenshot/window origin. Retain actual CUA coordinates, raw screenshots and window geometry; recalibrate whenever geometry changes. guide_rect remains in viewport coordinates. Preserve historical failed evidence: R06 request 33 was unacknowledged after PID 17863 ended and cannot count as evidence. Fresh guarded native/OS collection, full regression, independent review and integration remain pending.

Historical R06 local validation: syntax passed; 75 checker tests ran with one failure. The existing OS mock expects 900 rather than 2400. Blocked pending authority to update only that mock expectation in tools/test_p08_normal_placement_evidence.py and rerun local checks. No test was disabled or changed.

R06 authorized mock synchronization (current submission)

The independent literal expected2400 is asserted against the driver constant, actual wait argument and actual started/ended receipts for both writer and reader. The timeout case also checks its writer receipts and preserves owned child cleanup, project restoration and existing protection controls. All 75 checker tests are retained. Final local syntax/test results and exact source and input SHAs are recorded in local-validation.json, local-source-manifest.json and implementation.json. These are mocked Python controls, not native or OS acceptance. Root native, OS, final full regression, independent review and integration/current verification remain pending, including Windows device acceptance. Existing driver2400, calibration and earlier repair work is retained.

R07 actual-input observer repair (current submission)

Authority: ROOT_OS_R07_SELECTED_CELL_READBACK.json and its supplied raw writer actions/observations and screenshot. These historical failures remain unchanged: writer exit1, reader not started, and request64 is not current acceptance proof. The five condition records and acceptance denominator remain unchanged.

The passive read-only observer captures left-press viewport coordinates in _input before GUI side effects, inverse local coordinates, the actual converted world cell, bounds, cell dimensions, map origin, pan/zoom and both affine transforms. It also records the prior selection/occupant as separate dispatch fields. The action records the post-input selected entity and cell occupant separately. Later mouse-getter reads remain diagnostic only. The checker binds the action to the actual pressed event, independently recomputes its cell and transforms, and checks camera selection against complete-model occupancy. Requested center pixels remain distinct from actual event pixels; a press elsewhere within the same cell is valid.

All old tests remain; new whole-checker semantic controls cover missing dispatch, wrong actual cell, mismatched event coordinates, transform drift, wrong selected entity/occupancy and bypassed selection. A positive control demonstrates that a later diagnostic getter cannot change acceptance. Final syntax, test counts and source/input hashes are recorded in repair-r07-local-validation.json and repair-r07-local-source-manifest.json, referenced by implementation.json.

No product changes, Godot/native/OS/full regression, git writes, Runner actions or integration were performed by this worker. Driver receipt values remain 2400 seconds and all timeout cleanup guards remain. Root must collect actual native and OS evidence on the final candidate, perform verify-only and final full regression, then obtain a separate independent review of all five facets. Any proposed historical reuse requires exact source/input applicability and independent review; no changed-source PASS is inherited here.

Repair10 facility-only palette (current submission)

R07 candidate 1f0a2bcd failed test_main_dashboard.gd:132 after 147 suites passed; this historical run stopped strictly and is not final full-175 acceptance. ROOT_FULL_R07_* and ROOT_FULL_REGRESSION_R07_* raw proof files remain unchanged. BuildPalette now contains only the 23 registered facility buttons, with 23 columns. A single HBox is the scroll content; DemolitionButton is its sibling. The new semantic suite checks every facility membership, scroll/HBox topology, ordinary opening and scroll reachability. Existing operation/cleanup checks and the one strict completion marker are retained. No Runtime/domain/assets changes.

Exact current source and input hashes are in repair10-local-source-manifest.json and implementation.json; actual Python results are in repair10-local-validation.json. These local controls establish no Godot or OS acceptance. Root must first rerun test_main_dashboard and test_p08_normal_placement_ops natively, then freeze the final candidate for native writer/reader, real OS collection, verify-only and full-175 regression, followed by separate Opus review and integration/current verification/ledger. All five facets remain pending. Windows device acceptance remains open. All repair/inference/material caps stay null. No git writes, Runner operations, agents, integration or engine runs by the worker.

Final repair10 SHA-256 pins (local controls only):

• scenes/main/main.gd: 36316f9edc170ba965eb2f595a740ae7fcc8914e4090f0351c0cec181d6a7431
• tests/ui/test_p08_normal_placement_ops.gd: d3c246d34f8fd66f6ed237e42a86df89ebaf481bc9dee143b4de8d654ce0eb2e
• tests/fixtures/p08-03/placement.gd: 1ebaaa80784905d661954e255bfb8a96a3a963a57b9a38b19e7f91b90fb628b3
• docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json: 9eab2b529e11d00bb00a415f29135b5fe7d8df2a282564ecc37292c8bda64010
• tools/regression/suite-policy.json: a74dc701155b6207bc23095296d723928f62719fce14fda392b12f9947007fb1
• Complete source/input manifest: 9f3e7ddb8cecf53d668dd4556f504e4fba26b29fb81dfe4b583ab060c6e6a9c8
• Final local validation: ef88dee24a9796600d6d90c6a0ae563c8d06f039231dae6db01d1f96ede2055b (83 checker tests / 0 failures; four Python syntax checks passed).

Repair11 nullable RefCounted observer (current submission)

R08 writer PID 75240 failed before the initial manual load; its real palette click and raw failure proof are retained as historical diagnostics only. InputObserver.endpoint now accepts the RefCounted passive recorder and retains its null guard. Modal observers explicitly keep endpoint null, record null_modal_receipts_only in observed.json, queue_free and restore the root observer. No modal cell dispatch or product handler calls were added. Both placement fixtures were reread for typed assignments; no further Node/RefCounted mismatch was found by local inspection. Godot parsing remains pending.

Final source/input pins are in repair11-local-source-manifest.json and implementation.json. Only passive_placement.gd and the Python test source changed since Repair10. The passive fixture input SHA change invalidates native/OS evidence whose input map includes it; recollect the full5 set. R08 palette/UI4 proof is retained and may be reused only after exact actual source/input/engine/marker applicability checks; no blanket inherited PASS.

Root order: actual native startup with initial manual menu load, profile JSON and no SCRIPT ERROR; then full5 native/OS writer and reader with distinct PIDs; then mandatory frozen full175 regression. Separate Opus review, integration/current verification/ledger and Windows platform acceptance remain pending. All five conditions remain unaccepted. No Godot, native, full regression, git writes, Runner operations or agents were performed by this worker. Local Python syntax and checker results are recorded in repair11-local-validation.json.

Repair11 final pins and local results:

• passive_placement.gd: cdbd9a09b535d00a79aec7e2b7219f4daa4cf235449602b3cd02c6f12d9df88c
• test_p08_normal_placement_evidence.py: b8189b2b4bf15933d7e3e760495928b6a5a7ec5b0400a1c5198427d1cb0a3408
• Complete source/input manifest: 0d33515d9ef33656fe13aab3f417a18a2b602047d6eb013b3f6b896f0330edf6
• Local validation: 188d61cb4e23211646cc9808bfb924bc56fe66f1fb7ef0534584740dcfcd9561; 88 tests, 0 failures; four syntax checks passed. These controls establish no gameplay acceptance.

Repair13 final executed local pins

Final execution: 100 Python tests, 0 failures; 3 syntax checks passed. Actual R09 --verify-only: integrity pass, acceptance pending.

• tools/check_p08_normal_placement_evidence.py: 73bff1e00c319b8e681953fe64497eefb53ece168d2d18e0b60951e65f66279d
• tools/test_p08_normal_placement_evidence.py: 7e708a4429603166485b6f3267d887561d23bcf25b564d002473094e388476ca
• tests/fixtures/p08-03/repair13_images.py: 248a8d73ece3a60e601421fdd2ad53f8f8e971184fb1328c7155a71b8ed4ca53
• repair13-local-validation.json: f249c76c6d4c044c1a3c33ea09abc99f09a8c0ea6b0ade470d2af205eb4d89af
• repair13-local-source-manifest.json: 7d5a62155b7053398a5bc55879c9a92a07dcb3c5a0603e92d6f38eefba122ca1