TheTree_mock/docs/plans/original-completion-2026-10-02/execution/p13-02/CODE1_IMPLEMENTATION.md

P13-02-CODE1 implementation handoff

This is non-graphic state/reference/occupancy/save machinery only. It does not complete P13-02, grant partial credit, or change the original 30/88 denominator or formal 14/88 count. Native execution and acceptance are pending.

Declared scope and verification

Before editing, the worker declared the new service, bounded Runtime hooks, special tests, narrow runner, marker additions and this documentation. SaveService was conditional on an exact-key dependency; inspection found SupplyAutoPurchaseQuotePlans.valid_runtime_format has that dependency. Only allowed paths were edited. No asset, UI, content, model, policy, clock phase, or P04 change is involved.

The full ignored build/owner-handoff/ACTUAL_OPUS_RUN_DECISION.json was read and left untouched. Base HEAD is 1e8d4ea88876865a72547ff0edf43ed5b0e74c7e. The immutable spec was not edited. Its SHA-256 without the terminal newline is the registered 8ea65f2eefedc772c08170186f5cd03ac017432f4b069ade4f9210d4215c2d43; the on-disk file including that newline is 988d6e18a49372549863cd433432c2852c962fa64b138e490361c023e80249dc.

Worker verification: Python AST parsing/compilation only, without executing the runner or importing its dependencies; source/JSON/hash review. GDScript parsing, all tests, --prepare-only, native collection and regression were not run. No check totals or native success receipts are claimed. No git writes, commits, branches, other agents, integration or Runner operations were performed.

Service and commands

PeepingRoomService is a separate RefCounted service with no content or UI. All command executors use the existing Runtime queue; queue/history receipts remain normal Runtime behavior even for rejected/read-only domain commands.

Command	Preconditions and result
peeping_room_validate	origin: Vector3i, optional footprint: Vector2i (2x1), optional target_instance_id: String/StringName. Pure domain validation.
peeping_room_place	Always BUILD_DEFINITION_PENDING_D04; no occupancy, resource, room or ID mutation.
peeping_room_relink	Existing room_id, explicit nonempty target_instance_id; full geometry and ownership validation excluding only the room's exact own occupancy. Leaves LINKED, stopped, RELINKED_PENDING_RESUME.
peeping_room_record_evidence	Existing room_id, nonblank named source_event_key. Uses Runtime minute, never caller-supplied time. Checks stopped, target power, target closure/opening hours, completed construction authority, and lost target in that order. Otherwise rejects with RECORDER_ELIGIBILITY_PENDING_D04_D08_P16. Never writes the ledger.

Malformed command field types return INVALID_PAYLOAD. Missing/blank source keys return SOURCE_EVENT_KEY_REQUIRED before operational checks. Loss latches both TARGET_LOST and stopped, so collection after normal demolition returns STOPPED while the room's link/stop reason identifies TARGET_LOST. No resume command or automatic resume is defined. Power/closure guards read actual target conditions; they do not define special-room power demand, staffing or normal operation.

Placement is exactly 2x1 BACK, fully behind a single completed FRONT public_bath or adult_private_room. It checks bounds/excavation, both real FacilityService and ConstructionService ownership, FRONT cells, World occupancy, and both World walkability and PathService membership. Exact rejection families: WRONG_LAYER, WRONG_FOOTPRINT, OUT_OF_BOUNDS, NOT_EXCAVATED, TARGET_INCOMPLETE, TARGET_MISSING, PARTIAL_TARGET, MULTIPLE_TARGETS, TARGET_MISMATCH, TARGET_UNKNOWN, TARGET_NOT_ALLOWED, TARGET_WRONG_LAYER, CORRIDOR_CONFLICT, BACK_OCCUPIED. The named vip_suite request returns PENDING_P10_01; vip_private_salon is not an allowed substitute.

Any existing corridor cell conflicts. A proposed cut through a connected corridor is rejected before mutation, preserving the route; no reroute or bypass is invented. Accepted fixture cells were already nonwalkable and become occupied under special_peeping_room. No special-room construction weight/cost is assumed.

Runtime demolition and FacilityService unregistration latch loss. Collection also detects missing FRONT occupancy/identity. Rebuilding the same cells produces a different construction ID and never silently reattaches rooms. Relink is explicit.

CONTROLLED_FIXTURE boundary

Only service methods named controlled_fixture_place, controlled_fixture_set_stopped, and controlled_fixture_record_evidence create test rooms, enable fixture collection, or write evidence. They are labeled CONTROLLED_FIXTURE in code and tests. They have no command/palette registration, and no Runtime executor calls them. Test helpers disclose direct underground geometry setup and MIMI registration; those do not assert natural unlock/join or production eligibility. Target construction uses existing definitions/costs/times.

Room IDs come from the existing StableIdGenerator's peeping_room counter. Evidence IDs encode the UTF-8 lengths and hex bytes of the full (room_id, target_instance_id, source_event_key) tuple. This is injective rather than delimiter concatenation or a hash with possible collisions. Replays return the existing ID with duplicated=true and retain the first minute. Evidence is only IDs, source key and minute. Room target_history retains prior bindings so relink does not orphan existing opaque evidence.

Save invariants

Runtime versions remain 14 and 15, with version 15 only for existing v2 purchase history. Optional canonical StringName key special_peeping_rooms has section version 1 and exact keys version, rooms, evidence. Empty service state emits no key, preserving original snapshots. Absent sections restore empty only if no world occupancy uses the special kind or peeping_room. prefix. Thus removing the section from a current room-bearing save is rejected without a version bump.

Restore stages the entire section against staged world, path, facilities, construction and ID generator before committing any Runtime state. It checks canonical keys/types, version, duplicate room/evidence identities, deterministic evidence tuple encoding, bounds/geometry, room/occupancy correspondence in both directions, generator high-water mark, known historical facility IDs, present target definition/geometry, loss/stopped coherence, and evidence room/history/time references. Null/present-empty sections are invalid; absence is the only empty encoding. Existing pending command/reference and schema migration checks remain.

SaveService validates a present section through the same staged service validator, then supplies a shallow copy without this one key to the original purchase-format allowlist. No other keys are removed. The original format 1 (Runtime 1–14), format 2 (Runtime 15), manifest duplicate 15 and MIMI checks remain unchanged.

Verification handoff

Five strict suites cover geometry/corridor, removal/relink, evidence/guards, typed atomic save corruption and physical format 1, and Runtime commands plus physical MIMI format 2. Tests use var_to_bytes for whole Runtime atomicity and roundtrip checks. New marker rows carry final test source hashes; prior rows and policy are unchanged. A helper under tests/special/ is not a discovered suite.

tools/run_p13_reference_tests.py defaults to read-only verification of $BUILD_OUTPUT_DIR/p13-reference-native, failing closed without an absolute environment path. Explicit --output --collect is for Root only. The strict flag parser rejects abbreviations, repeated flags, positional inputs and = aliases. --prepare-only is non-native but was not executed by this worker.

The runner imports the existing P18 core by path. Since its three entry functions hardcode their label and seven/nine counts, a bounded AST adapter changes only protocol/runner identities, those explicit roster cardinalities, and diagnostic labels. It checks the exact adaptation-site counts and fails closed on drift. All confinement, inventory, JSON, sealing, source/engine/marker/policy binding, process, diagnostic, profile and cleanup gates are reused. It neither copies the whole runner nor modifies P18/helpers. The whole selected source map binds both runner sources. Phase count derives from len(ROSTER) + 2.

Roster includes all five new suites and existing construction/world/path/runtime construction, supply migration, transport save, Runtime weather, snapshot serialization, save lifecycle and MIMI purchase suites. Receipts retain formal_acceptance=false and original_unit_complete=false.

Root must perform serialized native collection with the allocation/private profile, then registered p13-reference validation, a separate actual Opus review, and the final exact-version required regression. Only those steps can establish execution results.

Still pending, without invented values

D04 build/upkeep/build minutes and other product numbers; recorder staffing and natural triggers/rates D04/D08/P16; VIP suite P10-01; D05 transaction decisions (no tick-phase changes here); P19 evidence use and P24 camera UI; normal palette registration/construction/operation and natural production evidence; whole P13 acceptance, final review/integration, and applicable native Windows conditions.