# Natural ordinary pack arrival validation

10 October 2026. Task0/5 checkpoint. The 5A1 receipt foundation, 5A2 passive observer and 5B owner-input foundation are implemented and verified within the boundaries below. A completed bounded five-cell campaign exposed an underlying stair-goal defect; its production repair is implemented and fresh acceptance remains in progress. Tasks3/4's staged native navigation, deterministic grace and matching network evidence remain separately recorded in `PACK_ADVANCE_VALIDATION.md` and `PACK_ACTIONS_VALIDATION.md`.

## Current work — remaining Task 5 campaign

The campaign implementation is in verification, based on accepted local commit `c912796`. An explicitly opted-in owner lease now supports bounded view rates and fire through actual camera/motor/weapon input, with shared manual/expiry/correction clearing and immediate held-fire release. Semi-auto fire retains its rising-edge rule. Separate scoped one-shot reload/switch/equipped-ability requests do not supply targets or damage. A disclosed owner-camera sensor publishes only currently viewport-visible, nearest-solid-verified body points; it is separate from passive enemy observation. No hidden actor metadata drives the input runner.

`Tools/Test-OrdinaryArrivalCampaign.ps1` runs the five prescribed cells through normal menu entry. It walks from authored spawn pads along supported measured paths; setup walking counts against the same three-attempt/720-active-second cell budget. Cluster means maximum accepted owner diameter at most10m; split means two stable subgroups, each at most10m diameter, with centres at least30m apart. The two-player subgroups each contain one owner. Qualification covers sampled host-accepted admission-to-contact intervals, rejecting gaps over1.25s, identity/correction discontinuities and layout drift. These are disclosed harness classifications, not gameplay tuning.

Qualified episodes, whole-export `Incomplete`/`NaturalQualified`, mechanical failures, missing size coverage and pending pixel review remain separate. Natural death or missing rare Large selection is incomplete rather than a hidden restart or fabricated pass. Every attempt and failed observation is retained. Reusable `Tools/Export-OrdinaryArrivalCampaignRoutes.cs` measures actual saved NavMesh paths through supported Editor queries; startup validates the route schema, code/build/network/source hashes and capture identity before accepting evidence.

Latest runtime evidence: **1,277 EditMode / 194 PlayMode pass**, zero failures or skips, including13 actual-physics terrain-support safety cases. The recorded three-member stair deadlock has a valid ordinary-brain RED followed by Normal and Large GREEN tests: each member travels over7m and descends through ordinary navigation. Production now grounds candidate Y against bounded static terrain before unchanged native2m/.5m projection, complete-path, current-origin, ranged6m spacing and occupancy checks. This is an underlying navigation repair, alongside the earlier canonical centre-prefix publication repair; owner-death receipts and actual-render capture checks are also part of the combined change. No map rebake or motion/contact/grace tuning was applied. Fresh normal/debug/release builds succeed with0errors and652/640/790warnings; development symbols are excluded from release, while the production grounding helper is present in all three variants. Normal/debug managedSHA256 is `6F82ABC62CC08435F4B29F3BC866A61241D59DE9759A8C3D2DE82635E2AD6CB4`. Matching network gates now pass; four campaign cells and final visual/human acceptance remain incomplete.

The preceding runtime passed1,264EditMode/192PlayMode, three zero-error builds,10menu phases,23progression phases, and a bounded four-player arena repeat with10gameplay passes, one intentional failure proof and three lifecycle passes. Those results do not validate the newest runtime. Its retained five-cell campaign has13attempts/39accepted captures: only four-player clustered meets cohort/size coverage, and46s/87s unheld stationary periods block overall movement acceptance. Earlier failures, the rejoin timeout and original three solo attempts remain retained. The user authorized one visible host with hidden peers, and genuine rendered captures were obtained; these older images cannot validate the newest stair repair. Fresh multiplayer checks and the bounded campaign are completed below; four cells and final actual-image review remain incomplete. Tooling now has106integrity/19qualification passes after correcting PowerShell integer-overload rounding in fractional setup input. Current campaign0c36bf7bd7e04562adbd215f27e7bc2d links both older parents and retains that original checkpoint, followed by the explicitly recorded bounded continuation below. Its corrected-input solo attempt reaches setup and produces one inspected actual terrain/weapon/HUD frame; enemies are distant, so this does not establish traversal readability or Large coverage. No optional extra-attempt exception had been used at that original15-attempt checkpoint; the separately recorded automated-first continuation below follows it.

Supported Editor authoring persists existing five-second defaults on Melee/Bombardier definitions; Ranged already serialized five. Unity also materializes nine projectile fields equal to their already-effective source defaults. No runtime tuning, GUID, manual scene, package, protocol or navigation-link change results.

### Repaired runtime campaign — 10 October

`ordinary-arrival-campaign-0c36bf7bd7e04562adbd215f27e7bc2d` links both preceding campaign parents. At this original checkpoint, all15 attempts were retained and each cell exhausted its original three-attempt allowance, with no additional-attempt exception. Every attempt ended naturally except the final four-player clustered attempt, which also met coverage. There were zero mechanical failures or cleanup errors.

| Cell | Attempts / active seconds | Best qualified cohorts in one attempt | Qualified Normal + Large | Actual captures | Result |
|---|---:|---:|---|---:|---|
| Solo | 3 / 118.66 | 1 | No | 1 | Incomplete |
| Two-player clustered | 3 / 240.28 | 3 | No | 8 | Incomplete |
| Two-player split | 3 / 326.86 | 1 | No | 8 | Incomplete |
| Four-player clustered | 3 / 268.12 | 5 | Yes | 9 | Coverage met |
| Four-player split | 3 / 262.44 | 2 | No | 8 | Incomplete |

All15 exports record zero proposed sustained-stall warnings; the maximum observed unheld stationary interval is4.909s, compared with the preceding runtime's approximately87s deadlock. This is bounded observed improvement, not a guarantee that every reachable encounter progresses. Two contact-deadline warnings remain: those actors travelled22.778m and41.673m before the owner-life stop censored their first contact. Neither was the previous stationary failure, and neither supplies completed contact proof. Peak active occupancy was11, with movement path queries at most8/frame; naturally observed16-actor pressure is not established by this campaign. Missing/censored tails and globally incomplete exports remain distinct from counted cohorts.

The first six attempts exposed a setup-driver numeric defect: `[Math]::Min(1, distance/5)` selected an integer overload and rounded movement to zero near the destination. Actual production-AST regressions retain78passes/3failures before the one-line double-operand correction, then81passes/0failures; qualification remains19/19. The remaining nine attempts used the correction under the same build, parent and caps. These driver results do not change gameplay movement authority or excuse earlier attempts. Both split layouts were subsequently established through ordinary owner movement.

There are34 accepted current-build owner-camera/HUD captures. Selected originals were inspected by the lead and independently for UX: current Normal and labelled Elite enemies are visible at the stair landing, and another frame shows an unobstructed approaching enemy, projectile trail and readable health/shield/reload/cooldown HUD. Overlapping enemy nameplates and distant silhouettes limit interpretation. Still images do not prove continuous traversal, precise foot placement or native size; the native-size claim comes from scoped navigation evidence. At that checkpoint the complete34-image review remained open; it is completed for visible content in the continuation below. Cover-grace/reacquisition readability, human feel and separate-network/hardware acceptance remain open. No source change is indicated by these selected frames.

Fresh normal-menu verification passes10phases with empty cleanup errors in `main-menu-cb9cac7a628c4a039158f031c29c0c2b`. Matching four-player arena verification passes10gameplay reports, one intentional failure proof and three lifecycle checks in `debug-arena-cc5bbb1aaeb14df281b3082989299374`. Two/four-player full-stage verification passes23phases at75/15/1 with empty cleanup errors in `encounter-polish-cb3c7604f59d44bd8ed8a325a93cc1ed`, including rewards, both travels, results retention and fresh rehost. Final Editor state is idle/clean Verdant with original background/reload options and zero console errors; all eight map hashes and unrelated ProBuilder settings are preserved, and no owned players remain. Task5 acceptance remains open because four campaign cells lack required coverage; the production navigation fixes and completed automated/build gates are independently reviewable.

### Automated-first bounded continuation — 10 October

The user requested automated evidence before manual playtests. The lead interpreted this as authorization for one bounded continuation, selected one additional attempt per incomplete case, and recorded that decision; the user did not specify the tool flag or numerical budget. Three independent technical/gameplay/UX reviews approved the tool-only contract. The default-off `AdditionalIncompleteAttempt` requires an explicit unique selection, the same retained build/map/network parent, exactly three earlier attempts, incomplete status, a visible host and remaining time. Each fourth attempt is capped at180active seconds within the unchanged720-second cumulative allowance. The exception and duration are persisted before player launch. No attempt was refunded, forced selection used or gameplay code changed. Policy/selection/runner regressions retain81passes/25RED failures before implementation, then106/106GREEN; qualification remains19/19. Earlier Unity/build/network gates remain valid without being repeated.

| Additional case | Active seconds | Qualified cohorts | Qualified Large coverage | New captures |
|---|---:|---:|---|---:|
| Solo | 32.77 | 0 | No | 1 |
| Two-player clustered | 54.80 | 2 | No | 2 |
| Two-player split | 113.65 | 0 | No | 4 |
| Four-player split | 63.10 | 1 | No | 3 |

All four attempts ended naturally with zero mechanical failures, cleanup errors, sustained-stall warnings or new contact-deadline warnings. No Large member was selected in these four runs. The continuation did not close the four incomplete matrix cells; four-player clustered remains the only covered cell. This concludes the bounded automated observation round, not overall Task5 acceptance. The repaired-runtime parent now retains19attempts/44captures. Original15-attempt results and both earlier runtime parents remain intact.

All44 capture hashes match their immutable manifests, and the lead inspected every frame for visible content/HUD/occlusion limitations using labelled QA contact sheets, with selected originals also inspected at full resolution. Per-image review catalogs are `TestResults/ordinary-arrival-original-capture-review.json` and `ordinary-arrival-continuation-capture-review.json`; the original34 also associate the rendered frame with nearby scoped member observations. That temporal association does not assert which tracked actors are visible. Frames show close melee and distant ranged combat, stairs/landings, projectile trails, damage/shield/reload/cooldown feedback and occasional substantial teammate occlusion. Nameplates overlap in dense groups; fine stair/body clearance and continuous movement cannot be determined from still frames. No new source defect was established by this review.

Manual playtests can now proceed on the repaired build. Focus on actual stair movement with Normal/Large enemies, five-second cover/peek/reacquisition, leaving cover from another side, and whether clustered combat feels readable and fair. Co-op split encounters and missing Natural/Large cases remain explicit targets when available. Automated functional gates are passed; missing natural samples, the two earlier moving-actor contact-deadline warnings, naturally observed16 pressure, human feel and separate-network/hardware acceptance remain distinct unresolved evidence. No further unbounded random continuation is planned.

### Task 5 requirement-to-evidence map

| Requirement | Functional evidence / acceptance boundary |
|---|---|
| Five-second authoring, missing-field migration, explicit zero | Current definition asset audit; `EnemyDefinition_DefaultIsFiveAndExplicitZeroIsPreserved` and `LegacyEnemyDefinitionJson_PreservesFiveWhileExplicitZeroRemainsZero` in `EnemyPackIntentTests` |
| All lose sight / one still sees / stale or nonvisual reports | `LastMemberLosesSight_HoldsUntilFiveSecondsFromPositiveSample`, `PeerStillSeesTarget_DoesNotStartGrace`, `NonvisualEvidenceAndGuidance_DoNotRenewOrRelabelActualContact`; native `RealActorSight_ReportsPeerEngageWithoutGrantingPersonalFire` |
| Peek before/at expiry and independent timers | `Peek_RearmsFullGraceOnNextLoss`, five-second boundary test, `MixedGrace_ExpiresIndependently`; native `RealLoss_MixedMemberGraceExpiresIndependentlyAndReacquires` proves actual0.25/15s motion and hold |
| Root/stun during grace, exit beyond retained cover | Existing `StunnedSightLoss_StillStartsGraceAndExpiryDoesNotRestoreQueuedWindup`; new `RootedSightLoss_GraceExpiresWithoutMotionAndOtherSideReacquires` passes1/1 in `ordinary-arrival-root-side-native` as staged functional verification |
| In-reach personally visible melee despite another hidden selected owner | Accepted real two-owner RED→GREEN and shield strike in `PACK_ACTIONS_VALIDATION.md`; no approach/lunge |
| Target death/disconnect / last living owner / recycled identity | `InvalidatedContact_BypassesGraceAndLeavesOtherGuidanceIntact`, `DownedLastGuidanceOwner_ImmediatelyClearsQueuedNativeAdvance`, `CoordinatedOwnerLeavingScene_ImmediatelyInvalidatesContactAndGuidance`, `DespawnedReporter_NewLifetimeStartsWithoutPersonalSightCache`; prior matching peer disconnect/rehost checks |
| Windup/bolt/shell/lunge cancellation and paid work | Existing native cancellation cases and runtime/render evidence in `PACK_ACTIONS_VALIDATION.md` |
| Both native sizes, 16 actors, Snare, peer progress, bounded queries | Accepted **staged** native/manual four-peer pressure in `PACK_ADVANCE_VALIDATION.md`; this does not establish naturally observed16 occupancy |
| Natural solo/two/four clustered/split ingress and size coverage | Original15 attempts plus four bounded continuation attempts completed; only four-player clustered meets coverage. Require two fully admitted, uniquely receipted Natural cohorts with genuine non-left-censored contact and member route/progress evidence, plus Normal/Large per cell |
| Control/AoE versus single-target builds, attack/damage overlap | Normal lobby build records and production ability requests; actual member control/slow/attack/launch/damage counters in exports. Submission alone is not a successful cast. Fresh exports record427projectile launches,172melee damage applications,104.019controlled actor-seconds and25.158slowed actor-seconds; these are summed actor durations, not elapsed time or successful-cast counts. No balance improvement claim |
| Full suites, three builds, release exclusion, matching network/menu/travel/rehost | Newest runtime1277EditMode/194PlayMode and three zero-error builds/release verification pass. Matching fresh menu10phases, arena10gameplay reports plus intentional failure proof/three lifecycle checks, and full-stage23phases pass; accepted5B and older-runtime results remain separate baselines |
| Actual player/HUD approach, combat, cover/grace/reacquisition | 44fresh host-owner PNGs/manifests are retained and all were inspected for visible content/limitations; selected stair/combat frames were independently reviewed. Continuous approach/grace/reacquisition and human readability remain open. Represented cohorts, verified sight observations and pixel visibility are distinct facts; remote player views remain unverified |
| Cover camping, moving-player feel, representative hardware, separate network | Human/performance acceptance remains explicitly unverified. Native clock/contact proofs do not close these experience gates |

## Latest accepted checkpoint — 5B complete

<!-- Task5's newer in-progress findings are below; the accepted5B foundation remains a distinct prior checkpoint. -->

Opt-in development players can submit exact-scoped normalized movement/sprint leases lasting at most one second through the existing owner motor. Focused manual intent takes precedence; expiry, blocks, correction and lifecycle changes clear the lease while preserving sequence watermarks. Reports distinguish acceptance, application, collision-resolved local motion and host-accepted poses. Release players exclude the input API.

Real delayed multiplayer checks exposed discarded remote movement funding. The separately reviewed production repair conserves bounded host-funded horizontal/vertical path credit across partial updates, preserves existing speed/step/allowance ceilings and rejects excess travel. Retained stationary samples remain valid after their original delivery window; new deliveries still require freshness. Source ticks cannot mint travel permission; action previews cannot spend or grant credit.

| Verification | Final evidence |
|---|---|
| Full EditMode / PlayMode | 1,238 / 184 passed, zero failures or skips; sequential saved TXT/XML agree |
| Normal/debug/release builds | Zero errors; 647/640/785 retained warnings |
| Release exclusion | Packed-asset guard passed; four input markers present in debug and absent from release |
| Strict two/four-owner movement | Seven/eleven phases at75/15/1; genuine expiry, replay/scope refusal, host-approved displacement, unchanged correction sequences, clean cleanup |
| Two/four-player warp settlement | Five cases each at350/15/0, including moving/jumping/downed correction cases; all-peer convergence and clean cleanup; `causalProof=false` |
| Four-player default-off arena | Eleven reports plus target disconnect, host loss and same-process rehost passed |
| Two/four-player normal progression | 23 phases at75/15/1 through Stage3, rewards/travel/results retention and fresh rehost; zero cleanup errors |
| Independent review | Technical, gameplay and actual-HUD UX reviews approve the bounded source and evidence |

Final result directories: `owner-arrival-input-f7ea638033074f25832d1afe44454802`, `owner-arrival-input-080ecc655e5c453b85ca0cc19bea88bf`, `warp-settlement-5bfbe531717a4248930bd7b706d0e14e`, `warp-settlement-d9348c193e8846e9830bc49858f71757`, `debug-arena-00bfee4b6b4d4a59a9c1e3037f681ae1` and `encounter-polish-d8f9b603c63c4666aeda5a88bdc66379`, under `TestResults/`. Failed/invalid earlier attempts remain retained below. Expected stale/scope/remote-fixture refusals and the deliberate arena failure are rejection proofs, not unexpected runtime errors.

5B closes as an automated/Editor/network owner-input and movement-validation foundation. Next is the five-cell solo/two/four-player clustered/split Natural-arrival campaign; Task5 and roster6–11 remain open. Wall-facing HUD captures do not establish arrival readability. Human feel, representative hardware and separate-network acceptance remain unverified. Manual terrain/GUIDs, pinned dependencies, protocol11, jump0 and the unrelated ProBuilder edit are preserved. The final Editor is idle on clean Verdant with original background/play-mode settings and zero console errors.

## Prior checkpoint — 5A2

The opt-in development observer reads production admission receipts, personal sight samples, cached routes and path-budget stamps. It records bounded progress, contact, control, formation and lifecycle evidence without selecting actors, issuing navigation queries or changing AI. Scoped assistance, missing measurements and incomplete cohorts remain explicit. Unique player/HUD captures own their session and operation; completion requires an actual rendered frame and finalized PNG.

Schema 3 exports `CircleCentre`, `CircleRadius` and `CircleKnown` from retained immutable circles. These fields are the JSON geometry contract. The legacy readonly `Circle` field serializes as `{}` and must not be treated as a zero circle. `RepresentedCohorts` lists observed live cohorts at render time; it does not prove those actors are visible in the image.

| Verification | Final evidence |
|---|---|
| EditMode | 1,160 passed, including 49 observer cases |
| PlayMode | 155 passed, including 27 observer cases |
| Normal/debug/release builds | 0 errors; 635/640/773 retained warnings |
| Release exclusion | Packed-asset guard passed; five observer markers present in debug and absent from release |
| Normal-menu production trace | `beaf8b3f1281481fba57c72c80fadedd`: 8 Natural receipts, 2 personal witnesses, 2 fully admitted contact cohorts, matching circle geometry, 3 completed player/HUD PNGs |
| Budget continuity | 1,706 fresh frames; peak 8 queries; 0 unknown, missing host or missing budget frames |
| Four-player default-off arena | `cc0b2018d78340cf91c23294c5ecd025`: 11 reports passed, including target disconnect, host loss and same-process rehost |
| Four-player stage regression | `b3aa9992232a404fb294ed472602fb65`: 12 phases passed through stage three, results retention, cleanup and fresh rehost |

The trace correctly exports `Incomplete=true` and `NaturalQualified=false`: its newest member lacks an initial cached route/native path when observation stops. Both full cohorts have genuine contact, but that does not erase missing member evidence. The actual captures show the player, weapon and HUD facing walls; no enemy arrival-readability claim follows. The earlier schema-2 trace `c72d6d0219ab41c9b5994173bc4d05c6` is preserved as deficient circle-geometry evidence, including its partial third cohort.

At this checkpoint, the next step was 5B's scoped owner motor-input lease, now completed above, followed by the solo/two/four-player clustered/split campaign. Natural moving-owner arrivals, Normal/Large coverage, human readability/feel, representative-hardware performance and separate-network acceptance remain open. Proposed stall/contact thresholds remain diagnostics rather than adopted balance gates. The preserved terrain, package pins, protocol11 and jump-across prohibition are unchanged; the unrelated ProBuilder edit remains untouched.

All three independent final reviews approve the bounded implementation, including the subsequent circle-export repair and actual HUD artifact inspection. The normal trace used normal menu/readiness/stage entry; the default-off arena and stage regressions used their existing staged fixtures at75ms delay,15ms jitter and1% loss. These are separate evidence categories. Final Editor6000.6.4f1 is idle on the clean manual Verdant scene with original background/play-mode settings; console errors are zero. Task5A2 is complete as an observer/export foundation. Task5 as a whole remains open.

## 10 October 5B implementation contract

Three independent technical/gameplay/UX pre-reviews approve the bounded owner-input slice. Lead owns the lease, player, probe, tests and orchestration; reviewers remain read-only. Use `ordinary-arrival-owner-input` and `ordinary-arrival-owner-input-clear`, dedicated `inputSequence`, `moveX`, `moveY`, `sprint`, and full manager/scene-handle/run/stage/owner/object/lifetime scope. Both the ordinary-arrival and legacy probe report/command pairs qualify with explicit `--probe-owner-arrival-input`; graphical players qualify without batch mode. Normal arrival-only dispatch retains its action prefix boundary.

Initial owner-input ruling: focused raw movement keys (including opposing keys), Space/Shift, finite nonzero look and existing combat/revive bindings take ownership before the motor, independent of component Update order. Keep physical collection focused; lease eligibility cannot enable keyboard/look/combat in an unfocused process. Clear on expiry, blocks, correction acceptance/application, disable/despawn/ownership and scope changes; preserve sequence watermarks. The lease adds no RPC, movement budget, authored speed, AI, balance or asset changes. The separately reviewed remote-validation prerequisite and conserved host-funded ledger are recorded below.

Ruling: command acceptance, last-applied input/frame, Dash override and local collision-resolved motor delta are distinct evidence. Only the host may label its sampled pose server accepted; remote reports explicitly mark that field unavailable and correlate with host observer evidence. Do not attribute teleport or Dash displacement to ordinary lease travel. 5B proof precedes the five-cell natural campaign; neither staged native tests nor this design review qualifies that campaign.

Execution evidence: `owner-arrival-input-red` records 0/43 before the foundation; `owner-arrival-native-red` records 0/21 before motor integration. The corrected lease suite `owner-arrival-input-green-final` passes 43/43. A real normal-scene local-owner command-file RED (`owner-arrival-probe-dispatch-red`) records absent motor application before the new dispatch handler. Earlier native attempts exposed test-fixture menu capture and teardown races; they are failed attempts, not runtime acceptance. The first integrated attempt's TXT/XML case details disagree and are not one coherent final result. Fixtures now capture the normal gameplay cursor, await the supported full `LeaveAsync` operation and old-owner disposal, and reset per-test references; production sequence rules were not relaxed. A later filtered request selected zero cases and is explicitly excluded from proof. Source is frozen for fresh full verification (180 PlayMode cases discovered), then builds and normal-menu two/four-owner motor smoke checks. 5B acceptance and the five-cell campaign remain open. Existing ProBuilder settings remain excluded.

Full verification passes **1,203 EditMode / 180 PlayMode**. Initial normal/debug/release builds succeed with0errors and644/640/922warnings; four input type/method/field markers are present in debug and absent from release. Final source reviewers approve the bounded motor/lease/report code. Gameplay's harness finding is repaired: require genuine `Expired` clear reason and unchanged same-owner/object/lifetime host correction sequence before attributing travel; retain censored attempts.

The matching75/15/1 smoke attempts are **not accepted**: two-player `1b04ad93a542418e947a4be013e7092f` applied/expired both owners but corrected the remote owner between leases; four-player `fbd833447ade4d7c99961505ce4a450c` clears c2's active lease as `Correction`. An idle diagnostic two-player run `0ced94884da8497aaa483dcc3984e861` reproduces the failure and retains a censored observer/HUD export. Its hostlog640 records2.324m of normal walking against0.03468895s at maximum8m/s, with stage/envelope valid and `plausible=false` (received tick575, host588). The old clock is reaccepted every host tick while reusing an unchanged received pose, leaving a one-tick window for a delayed moving sample. Lease clearing works as intended; this is a measured movement-validation prerequisite. Three independent pre-repair perspectives are running. No speed, one-second cap,0.75m allowance, correction deadline, authority or protocol change is authorized by this diagnosis. 5B/campaign acceptance remains open.

Reconciled clock prerequisite: all three independent pre-repair views approve consuming each fresh received pose tick once using **host elapsed time**. A duplicate still runs current finite/envelope/downed/Slipstream safeguards, but successful duplicate checks cannot notify movement, re-anchor the position or reset elapsed. A fresh stationary tick consumes the interval. Keep local-host cadence and read-only action checks unchanged; clear consumed-tick identity on spawn/lifetime/scope/correction reset and seed the already-accepted committed warp tick. Source-tick age remains delivery freshness, not travel permission; no broader tick-derived budget is added. Lead owns `MovementValidationClock`, the bounded player hooks and pure/staged-native regression tests. RED tests must precede the repair; real two/four-owner strict smoke remains the acceptance gate. The three correction runs remain mechanical failures whose affected displacement is censored, distinct from incomplete natural-arrival observations.

The fresh-sample repair passes10pure clock cases, consistent isolated native0/1RED→1/1GREEN, and full1,213EditMode/182PlayMode. Final-source builds pass0errors (normal146/debug500/release783warnings); release excludes the four input markers. Strict2peer `53a5b4a016a14b7caeab6d9801f3f2db` passes7phases with4.73m/7.10m host-approved displacement, no correction, actualHUD and clean disconnect. Strict4peer `e02967b069fc45ee835d4ffea10703ff` remains a mechanical failure: owner1/namedc3 receives a2.15065m catchup34.687ms after an earlier accepted partial. All leases expired, but the later correction correctly invalidates its travel proof. Resetting the clock after each fresh partial still discards unspent host funding. This two-peer success does not qualify four peers or the campaign.

Second pre-repair decision: use a bounded host-funded **path-credit ledger**, debiting actual horizontal and absolute vertical travel across moving partials. A whole-source-interval debit was rejected by a concrete long-idle/0.69m/2.15m counterexample: it would burn the funding needed by the next partial. Host time and then-authorized speed alone add credit; source ticks order samples and can drain represented stationary intervals, never mint permission. Capacity retains one second of current authorized horizontal travel plus0.75m living/0.05m downed and17m vertical. Tolerance is not reminted per packet. Speed increases fund only future host time; decreases clamp capacity; downing and lifecycle/correction/ownership fences discard old funding. Action previews remain neutral; correction recovery stays in `WarpTravelBudget`. This is bounded credit, not a claim of zero banking for indistinguishable tiny movement. Lead owns the new pure ledger, actor integration and RED/native tests; unchanged strict2/4 smokes remain required. No UI/RPC/protocol/assets/tuning changes.

The path ledger passes23pure RED→GREEN cases and a consistent exact native compressed-fragment0/1RED→1/1GREEN, including rejection of a later excessive step. Final integrated review identifies one idle-case defect before acceptance: delivery freshness was reapplied to identical already-committed poses. Pinned NGO `NetworkTransform.cs:2141–2157` explicitly suppresses synchronization at rest, so this would issue a false correction after the six-second delivery window. Lead verified the source finding; add pure/new-delivery and>6s native retained-idle/action/motion regressions, then apply delivery freshness only to new candidates. Retained duplicates must still be identical, finite, in the current envelope and safe for current state; they never commit or gain credit. Previous class-filtered zero-case requests remain excluded from evidence.

### Final 5B verification — 10 October

The retained-idle regression reproduced one false correction after 6.5 seconds before the fix. Fresh-only delivery validation now passes all 25 ledger cases and the native idle/action/resumed-motion case. Technical and gameplay reviewers close that finding. Fresh sequential full suites pass **1,238 EditMode / 184 PlayMode**, with zero failures or skips (`owner-arrival-final-sequential-editmode` and `owner-arrival-final-sequential-playmode`). The prior full PlayMode attempt with an external Unity AI relay process failure remains retained; a later accidentally overlapped suite attempt is preserved as `owner-arrival-ledger-idle-overlap-editmode` and excluded from acceptance.

Final normal/debug/release builds succeed with zero errors and 647/640/785 retained warnings (71.620/16.816/46.090 seconds). The release packed-asset guard passes; four owner-input markers are present in debug and absent from release (`owner-arrival-final-release-symbols.json`). Normal and debug share managed assembly SHA256 `301C152C362FB8274E991B17C80213DAE973B94F864941E6BD876D24A8C5AD70`. Player build GUID for the normal cohort is `365a62546f274d5da98add355f666715`; executable bootstrap hashes alone are insufficient to identify C# changes.

Strict normal-menu owner-motor checks at 75 ms delay / 15 ms jitter / 1% loss pass for two owners (`f7ea638033074f25832d1afe44454802`, seven phases) and four owners (`080ecc655e5c453b85ca0cc19bea88bf`, eleven phases). Every owner applies and expires both bounded leases; stale replay and wrong-owner commands are refused. Host-accepted displacement is 4.73/7.07 m for two owners and 4.73/7.09/4.23/7.12 m for four. Same-owner/object/lifetime correction sequences remain unchanged, build identities match, and cleanup errors are empty. These are final ledger builds; earlier fresh-clock success does not substitute for them.

Actual immutable HUD captures `ordinary-player-8c8c74e915e54cef8c305c90747220dd.png` and `ordinary-player-13cfbc1b2db1409a84ec44a3669cf517.png` live in those respective result directories. Lead and UX reviewer inspected both actual images and matching manifests: weapon, crosshair and HUD are rendered; four-player HUD includes three teammates. They face walls and do not prove arrival readability. Exports correctly retain `NaturalQualified=false`; the two-owner observation is incomplete. UX approves the bounded owner-input flow. Five-cell Natural arrival, human feel/readability, representative hardware and separate-network play remain separate gates.

Two-player warp settlement (`5bfbe531717a4248930bd7b706d0e14e`) and four-player settlement (`d9348c193e8846e9830bc49858f71757`) each pass all five cases at 350/15/0 with all-peer convergence and clean cleanup. This is settlement evidence; both scripts report `causalProof=false`. Four-player default-off arena (`00bfee4b6b4d4a59a9c1e3037f681ae1`) passes eleven reports and actual target disconnect, host loss, cleanup and same-process rehost at75/15/1. Its intentional failure report proves expected launcher rejection rather than an unexpected gameplay failure. Final normal two/four-player stage regression (`d8f9b603c63c4666aeda5a88bdc66379`) passes all23phases at75/15/1 with zero cleanup errors, rewards/travel through Stage3, cached results after host departure and fresh rehost. These checks close the final source-review conditions and bounded5B acceptance.

## Independent review decision

Technical, gameplay and UX reviewers independently recommend a bounded passive development-only admission receipt and arrival observer. Existing latest selector diagnostics and0.2s navigation caches cannot reconstruct registration-time hidden admission or distinguish the normal selector from debug overrides. Preserve `Update → TickOrdinaryAdmission(now,false) → TrySpawnDynamic`, original role/tier randomness, clock, population and map-owned20-exclusive/60-inclusive/6m rules. Do not qualify forced debug admissions, manually staged reservations/actors, direct damage, invulnerability or direct CharacterController.Move as natural production play.

Ruling: capture explicit admission provenance at the normal scheduler call, immutable living-owner accepted poses/forwards/production visibility immediately before instantiation, and actual member identity/position after successful registration. A receipt never controls admission or rolls back a valid spawn. Fixed storage, checked sequence and overflow/lifecycle fences make missing evidence incomplete. Observation reads existing intent/navigation/contact values and actual transforms; it never ticks selection/contact/guidance, draws RNG or issues NavMesh queries. First contact is a sampling interval unless an exact neutral receipt is warranted by the trace.

Ruling: run five cells—solo, two clustered, two split, four clustered, four split—with at least two fully admitted naturally selected cohorts reaching genuine contact in each. Preserve incomplete/censored cohorts and every real attempt. Require ordinary Normal/Large coverage per cell for the strong combined size/layout claim; report matrix-wide size coverage separately if this stronger gate remains incomplete. Do not force selections or conceal failed attempts. Use owner production input/combat after supported initial layout; the existing probe's `move-repeat` uses direct CharacterController.Move and is insufficient. Natural death/restart is recorded, never a hidden seed search.

Contact qualification follows the shared-contact design: at least one member must produce an actual personal sighting for the cohort; every admitted member's progress/holds/outcome remains observable, but all members need not personally see a player. First contact may precede final progressive admission. Record both times rather than changing cadence or requiring a simultaneous whole-pack arrival.

Ruling: proposed bounds are at most three genuine stage-one attempts or12minutes active observation per cell. Missing legal circles, complete cohorts or naturally selected Large actors returns incomplete. This is an observation budget, not gameplay tuning. Actual16-pressure is recorded only if naturally observed; existing staged16-actor evidence remains separate. Do not manipulate kills or clocks to manufacture that pressure.

## Proposed receipt and observer contract

- Scope: manager, scene, run/stage, cohort/reservation identity and actor target ID/lifetime/spawn identity; explicit natural/debug/explicit origin; frame/server time; chosen role/tier/definition/native type/filter; desired/admitted membership and closure outcome; circle, actual member point, selector seed/counters; original pacing/cap/interval; up to four living-owner pose/visibility proofs.
- Copy bounded values, not reused snapshot objects. Clear/fence on travel, owner change, despawn/recycled identity, disconnect/rehost and disposal. Output failure, truncation or missing per-frame budget access cannot produce acceptance.
- Sample actual actor/accepted owner positions each host frame. Read personal sampled sight separately from shared pack contact, guidance and memory; record grace/control/firing/budget/route holds separately. Record fixed-reference progress, spawn-to-contact interval, first route, native path availability, retry/wait/bypass transitions, moving centre/radius/separation and attack/damage overlap.
- Read existing shared path-budget usage after production work, without extra path queries; require≤8 each observed frame. Preserve wave≤16 and total≤17 only through the normal boss transition. Latest rejection reasons are not an exhaustive histogram; label counter availability truthfully.
- Use sparse unique actual ScreenCapture player/HUD frames and timestamped manifests for first visible arrival, subsequent approach/combat, and naturally occurring grace/reacquisition. F8 and elevated observer views explain geometry; they do not establish player-view readability. Label cloned player-pose world renders as HUD omitted.

## Proposed diagnostic thresholds and limits

Flag continuous stationary contact-free unheld native movement≤0.025m for>3s after a route becomes available. Fail sustained>5s without a recorded budget/geometry/control/lifecycle explanation; repeated denial remains visible rather than excluded forever. Record a fixed initial route reference and proposed contact deadline `max(30s,3*initial route length/authored speed)`, capped120s; owner kiting/control/replans are explicit episode conditions, not indefinite timer resets. These thresholds require checking the first trace before adoption and are not human balance targets.

Report formation p50/p95/max radius and time outside authored5/6m gathering radii; do not impose a hard radius gate on a deliberately soft formation. Preserve the existing enemy-driven six-metre ranged separation rule and distinguish owner encroachment. Proposed sustained capsule penetration gate is>0.05m for>0.5s while both actors are uncontrolled and advancing; report geometry/control conditions rather than treating every brief contact as failure. Record distinct circle identities/centres, revisits and rejection rates; observed variety is not a statistical distribution or human-approved improvement.

Required tests: natural provenance cannot be forged by public/debug spawn entry; exactly one receipt after successful registration and none on rollback; immutable owner data; checked overflow and reused-lifetime/run/stage fences; repeated observation leaves RNG, admission timing/caps, membership, deadlines, guidance/contact and query budget unchanged; release excludes evidence/observer behavior. Runtime hook owner, observer owner and lead orchestration ownership are assigned before implementation.

## Owner-input dependency discovered before implementation

`PrototypeFirstPersonPlayer.SetDebugMovementInput` requires the debug arena, automated scenario, local ownership and server authority. It cannot drive a normal remote owner. The minimal proposal is a development-only local-owner input lease feeding the existing `MoveOwner` normalized input/sprint branches. Require development support, explicit probe report/command arguments and `--probe-owner-arrival-input`, exact owner/combat lifetime/manager/run/stage/scene, active first-stage Verdant and living unblocked motor. Finite normalized input lasts strictly0–1s, with increasing nonzero sequence and no automatic extension. Expiry, modal/run block, correction, death, ownership/lifetime/scope changes clear it; no old movement resumes after a block. Preserve authored speed, sprint RPC, gravity, collision, Dash precedence and existing host movement validation. No positions, velocities, remote-other-owner input or new server RPC are injected.

Each standalone owner process receives only its own local command file. Use graphical development players for rendered evidence; batch mode is not an authorization requirement. A pre-existing Editor without probe command-line opt-in cannot qualify as an input-driven owner through this API, so the full normal-menu cohort should use matching standalone owners. Initial supported placement and observation setup remain separate from subsequent owner movement/combat. Receipt/observer/input tests must fail before implementing these hooks; no Task5 C# writes begin during TaskT live/build checks.

Final input design review requires exclusive motor input/sprint precedence, normal manual input taking ownership, and unchanged focused keyboard/jump collection. Broadening `canMove` for an unfocused lease must not enable physical Space/Shift/look/combat from another focused app. Record accepted command separately from last-applied frame/input and actual accepted displacement; collision may validly prevent travel. Clear before applying any post-correction input and require a fresh higher sequence. Call this opt-in owner motor input, not human input.

Real Snare/control/AoE/single-target owner actions may provide supporting scenarios; censored early kills and absent rare events stay explicit. Human moving-player formation feel, cover camping, attack readability, balance, representative performance and separate-network acceptance remain unverified.

## 9 October execution gate: split Task5 into two slices

Three fresh independent technical/gameplay/UX reviews reconcile on5A passive receipts/arrival observation first,5B opt-in owner motor input second, then the five-cell campaign. No Task5 C# is released until TaskT full-stage integration closes. No balance, admission cadence, AI, authority, assets or gameplay UI changes are proposed.

For5A, carry private explicit provenance through a private spawn core; public TrySpawn remains Explicit and the debug scheduler remains Debug even when it chooses randomly. Only the production false scheduler branch is Natural. Capture owner accepted pose/ServerAcceptedForward and visibility result during the existing HostEnemySpawnCircleWorld.CheckPoint loop. Copy the successful exact member/type proof before Instantiate, including deferred-route revalidation; never replay visibility queries. Append once after registration/bookkeeping succeeds, outside the broad spawn rollback catch or behind an isolated failure boundary. Missing/full/failed evidence must never despawn a valid actor. Record admission closure/expiry independently of personal contact. Use neutral TryGetPackIntent/TryGetAdvanceNavigation/DiagnosticStatus and explicit sampled-personal-contact peeks; TryGetIntent mutates invalid target state and is unsuitable. Budget reads must not refresh their frame; a mismatched stamp is missing evidence rather than zero queries.

For5B, one owner controls the player/probe/lease files. Add dedicated inputSequence/managerIdentity/sprint fields rather than overloading count/slot/holding. Preserve sequence watermarks through clear/correction; require fresh higher input after any block. Focused movement, jump, look or combat intent takes manual ownership before motor application. Separate keyboard Space/Shift/look/combat guards from unfocused lease eligibility; merely broadening MoveOwner.canMove is unsafe. Preserve Dash, gravity, collision, sprint RPC and the single existing motor.Move.

Keep unique completed player/HUD captures with immutable timestamped manifests; existing screenshot.png overwrites are insufficient. Reports distinguish personal sighting, full cohort admission and cohort outcome; observing/complete/censored/incomplete evidence are separate from mechanical failures. Adopt proposed stall/contact thresholds only after the first ordinary trace. Current review confidence is high on scope/hook risks, medium on accessor/measurement completeness until actual proof. No new runtime acceptance is claimed by this gate.
- TaskT integration closed and local checkpoint `bb780c1` exists. 5A1 receipt-first mini-plan is approved; the sole implementer owns encounter/selector/group neutral hooks, the new buffer in the existing Enemies/Debug folder, and focused tests. Only RED test authoring is released initially. No5A2 observer, owner input, balance or new UI is included in5A1; genuine positive Natural standalone acceptance waits5A2.
-5A1 RED evidence: `ordinary-admission-evidence-red` compiles and reports0passes/21missing-foundation failures; `ordinary-admission-evidence-native-red` compiles and reports0passes/5missing-integration failures before hosting. Receipt-only runtime implementation is released to the sole owner; observer/probe/motor input remain excluded. These RED contracts are new-feature specifications, not natural-arrival gameplay evidence.
- Pinned API compilation caught obsolete GetInstanceID and implicit SceneHandle→int usage. Identity strings now use full GetEntityId values; scene-handle schema is being migrated to ulong GetRawData without narrowing, including corresponding typed reflection fixtures/high-bit scope proof. These are compile/schema compatibility fixes, not gameplay or authority changes.
-5A1 pinned compilation is now clean. `ordinary-admission-evidence-green` passes22/22 storage tests, including the added full-width scene-handle mismatch case. The five native registration/provenance/failure-isolation tests are running; genuine Natural arrival acceptance remains unclaimed.
- First5A1 integrated review: fullEditMode1107/1107 passes, but technicalP2 finds metadata/copy capture still runs while observation is disabled and pre-registration diagnostic exceptions are not isolated. UX finds mid-cohort start can have cumulative FullyAdmitted counts with fewer stored receipts. Lead requests active capture gating, failure isolation and explicit observed/missing-member coverage, preserving real admission semantics. New meaningful RED contracts precede the bounded correction;5A1 is not accepted yet.
- Reconciled correction contract: gate all metadata/proof-copy work on active capture, isolate metadata and both copy boundaries, retain the original single visibility query/result and spawn behavior, and report MissingProof on diagnostic failure. Exported group coverage derives ObservedMembers/MissingMembers/CoverageComplete from unique matching receipts; FullyAdmitted continues to mean actual desired admission count. Missing coverage marks the returned snapshot incomplete without mutating production or sticky retained flags. Four pure/four native RED additions are released first (expected26/9); private diagnostic-only reader/export delegates provide fault injection without public gameplay authority.
- Correction RED is observed: `ordinary-admission-passive-coverage-red`22passes/4failures, including actual FullyAdmitted plus false Incomplete on missing coverage; `ordinary-admission-passive-coverage-native-red`5passes/4failures, including real mid-cohort capture falsely complete and missing private diagnostic fault seams. Bounded correction runtime is released; no tests/build/live work overlaps source writing.
- Correction GREEN: `ordinary-admission-passive-coverage-green`26/26 and `ordinary-admission-passive-coverage-native-green`9/9 pass with0failures/skips. The fresh technical reviewer closesP2; gameplay and UX approve corrected passive failure isolation and reporting coverage. No new findings. Final full suites/builds remain before5A1 checkpoint. This proves staged Debug/Explicit receipt integration only; positive Natural arrivals/contact/owner-input/player-HUD acceptance remains5A2/5B.
- Downstream qualification rule: Natural labels only the scheduler path.5A2 must separately exclude forced seeds, paused AI and other assistance, and require unique matching Natural receipts for every admitted member; complete coverage can still contain Debug/Explicit entries. FullyAdmitted means all desired members admitted, not arrival/contact success. Capture starting mid-cohort remains explicitly incomplete. Raw staged fixtures and passive copy checks cannot establish the five-cell campaign or player/HUD readability.
- Final5A1 full suites pass: `ordinary-admission-receipts-final-editmode`1111/1111 and `ordinary-admission-receipts-final-playmode`128/128,0failures/skips. Source remains frozen for normal/debug/release builds and matching four-player regressions; no genuine Natural campaign or observer/input acceptance is inferred.
-5A1 normal/debug/release builds succeed0errors,624/640/883warnings,53.213/16.705/42.333s. Release packed-asset guard passes; explicit managed-assembly symbol checks find the evidence type/start/copy/visibility-proof entries in debug and absent from release (`ordinary-admission-release-symbols.json`). Original background/Editor settings and manual scene remain clean. Matching four-player debug/full-stage default-off regressions are running before checkpoint.
- Matching four-player debug cohort `5a992ddc3c6c46b3bef5c6697b00289f` passes11scenario reports and lifecycle/reset/rehost acceptance at75/15/1 with observation disabled. The explicit expected-failure report is a launcher rejection proof, not an unexpected gameplay failure. Four-player normal full-stage regression is in progress.

## 5A1 accepted foundation checkpoint

Four-player normal-stage `encounter-polish-20b7eb9d1d4c48cfbbfa17c51e3debd0` passes12phases at75/15/1, including stage travel/scaling,82unique kills, results, host departure and clean rehost. Together with debug `5a992ddc3c6c46b3bef5c6697b00289f`11reports,26focused storage/9native, full1111EditMode/128PlayMode, zero-error normal/debug/release builds and release-symbol exclusion, this closes5A1 within its bounded receipt-only scope. Three independent final perspectives approve the corrected code and reporting.

No5A2 observer,5B motor lease, genuine Natural campaign/contact, per-frame arrival budget/progress or new player/HUD rendering acceptance is claimed. Next: passive arrival observer with scope/assistance/origin/coverage qualification, then production owner motor input and the five-cell campaign. Existing manual scene, pins, jump0 and unrelated ProBuilder settings remain preserved.

## 10 October 5A2 execution decision

Continue the already approved passive observer slice from5093ef2. Three independent technical/gameplay/UX reviews agree on neutral incremental receipt/group/header peeks, raw production personal-sample frame/time, unchanged budget reads and bounded online/time-weighted aggregates. Do not call full receipt CopySnapshot per frame, TryGetIntent, StatusSnapshot, navigation/contact ticks or extra physics/NavMesh queries. Freeze the first complete cached route reference;64-corner saturation and missing/stale data remain unknown. Stationarity uses episode-anchor/window displacement, never a0.025m per-frame cutoff.

Record sticky assistance across the applicable run/stage before observer start, including forced seed, pause toggles and unsafe probe mutations; disabling assistance does not restore eligibility. Existing pause fields are serialized in scenes, so property/backing tracking must preserve values with FormerlySerializedAs and native migration proof without editing scene/prefab files. Ordinary owner fire/ability requests remain legitimate gameplay. Natural receipt origin, full admission, complete coverage, unassisted eligibility, personal contact and export/capture completion remain separate facts.

Bounds remain17active actors/128retained cohorts/4096transitions/8192sparse poses at most once per actor per2s plus key transitions/64initial cached corners/720seconds. Every host frame updates bounded aggregates; no per-frame IO or allocation. Existing budget frame staleness cannot become a zero-use claim; any fresh diagnostic frame provenance must be written by production work, never refreshed by a reader. Capture state freezes on scope/lifetime/owner loss, retaining censored outcomes and exportable data.

Probe local host actions start/stop/export own one capture and cannot steal existing receipt/observer generations. Unique immutable artifacts publish only after atomic export or completed actual player/HUD capture; capture request acceptance is not completion. One actual standalone normal first-stage trace verifies production Natural admission/contact facts and reporting, with missing data/censoring retained. Five-cell/moving-owner/human/readability acceptance waits5B. Lead owns tools/docs/Unity integration; observer_technical is the sole C# writer, initially tests only after mini-plan approval.
-5A2 RED: `ordinary-arrival-observer-red`0passes/33expectedmissing-contract failures. First native run discovered0tests and is invalid evidence; actualnewnativeGUIDwas33hex, root repaired only never-imported newmeta to32hex and supportedreimport verified MonoScript/type. `ordinary-arrival-observer-native-imported-red` now0passes/19expectedmissing-integration failures. Runtime is released to the sole C#owner; no tests/build/live sessions overlap writes.
- First5A2 GREEN:33/33pure and18/20native. Both failures are migration fixtures using JSONoverwrite, not proven scene-data loss: bareEditorJSON ignored even currentfield, wrappedcurrent true loads butlegacyaliasdoesnot. Root isolated native JSON limitation withownedtemporarycomponent only. Fixture switches to documented EditorUtility.CopySerializedManagedFieldsOnly old-name mapping, preservingfalse/true/sticky assertions; no runtimeor savedasset changes. AddedPNGfinalization case is additional verification (native20), not misreported as original19RED.
- Focused5A2 proof now33/33evidence and20/20native GREEN (`ordinary-arrival-observer-native-migration-green`). Migration fixture repaired withUnityCopySerializedManagedFieldsOnly documentedold-name mapping; runtimeunchanged. Actualsamplerneutrality, PNGfinalization, normalflags/soleprobeownership andexportfailurecontracts pass. Fullsuites andfreshtechnical/gameplay/UX finalsource reviews are in progress; no actualNaturaltraceor visualacceptance claimed yet.
- Final5A2 reviewers requestchanges despitefocused33/20GREEN: pending screenshot scope race, process-wide assistance leaking into newruns, per-memberpersonalcontact overconstraint, missingroute/sample/nativepath flags ignoredqualification, missingforwardframe-gap detection, absentslowexposure, and actualrenderedframe/cohortmanifest association missing. RootcorrectedownPSinterpolation argument beforeexecution. C#frozenwhilefullPlayfinishes; implementerreturnsboundedcorrectionmini-plan/newRED beforeanyruntimefix. No acceptanceclaim.
- Existingfull5A2 suites1144EditMode/148PlayMode pass, but reviewfindings remainuncovered and blockacceptance. Reconciled boundedcorrection: immutablecaptureoperation/session ownership plusrefuseStartwhilepending; actualEndFrameAsTexture renderframe/time/cohortmanifest; scopedstickyassistance/newrun reset; one-witnesscohortqualification independentindividualcensoring; unresolvedmeasurementmissingness/integerframegapfences; cachedslowexposure. NewREDtestsreleasedonlyafterfullsuitecompleted. No runtimefixbeforeobservedRED; no gameplay/tuning/asset/inputscopechanges.

- Correction RED verified on the unchanged runtime: 46 EditMode cases (35 passed/11 failed) and 26 native cases (20 passed/6 failed). Failures reproduce one-witness qualification, unresolved versus transient measurement flags, scoped assistance, missing host/budget frame accounting, slow exposure, immutable capture operation/session ownership and rendered metadata. Runtime correction is released to the sole implementer; no acceptance or new gameplay behavior is claimed. The normal-entry harness now requires schema2 and a finalized actual player/HUD PNG with matching scope, rendered timestamps and represented cohort IDs.

- Correction GREEN verified: all46pure and26native cases pass after clean pinned6000.6.4f1 compilation. Pending capture restart refusal, immutable operation/session completion, own frozen manifest, actual rendered timestamps, one-witness qualification, resolving measurement flags, scoped history, frame gaps and slow exposure are covered. Three independent final rechecks and full suites are running; standalone capture remains unverified until the matching player run.

- Final source rechecks approve gameplay and UX corrections. Technical recheck confirms the three prior lifecycle/qualification issues resolved, but identifies boxed IReadOnlyList enumeration in the observer's existing neutral intent path. The indexed Living lookup is restored as a necessary allocation fix with identical behavior; clean compilation follows. Full1157 EditMode cases pass; full154 PlayMode suite is running on that final lookup. Captured RepresentedCohorts identifies current live observed cohorts at render time, not a pixel-visibility claim; actual PNG review remains required.

- Final technical recheck closes the indexed-lookup allocation finding and approves the bounded source. Final full suites pass1157 EditMode/154 PlayMode with0failures. All three reviewer perspectives approve source/dataflow within their stated limits. Matching normal/debug/release builds and actual normal-entry trace are next; no moving-owner, five-cell, human readability or performance acceptance follows from suite counts.

- First normal trace c72d6d0219ab41c9b5994173bc4d05c6 supports7Natural receipts,1non-left-censored personal witness,2full cohorts and3actual player/HUD PNGs (2withcohortmanifests). Peak8queries;4211freshbudgetframes,0unknown/missinghost/missingbudgetframes. Thirdcohort2/3retainsIncomplete=true/NaturalQualified=false. Capturesfacewalls; noenemy arrivalreadabilityclaim. ActualJSONexposedCircle:{} readonlyserializationdefect, so originalartifactis deficientforcirclegeometry/variety. Threeperspectivesapproveexport-onlyCircleCentre/Radius/Known copiedfromretainedimmutablecircle, schema3 and actualroundtripRED. No productioncircle/motor/AI change. Freshtrace requiredafterfix; oldattemptretained.

- Circle serialization RED49pure46pass/3fail andnative0/1(schema) retained; corrected schema3 full1160EditMode pass andactual native frozen/file circle test1/1pass. Allthree finalperspectives close the bounded export issue. Explicit CircleCentre/Radius/Known are canonical JSON geometry; legacy readonly Circle:{} remains compatibility-only, never zero-circle proof. Full155PlayMode/build3/freshnormaltrace pending.

- Final schema3 full suites pass1160EditMode/155PlayMode,0failures. Native suite includes all27observer cases; Edit suite includes49observer cases. Source is frozen with allthree finalperspectives approved. Finalmatchingbuilds are running before the freshnormaltrace and default-offfour-player regressions.

- Fresh schema3 normal-entry trace beaf8b3f1281481fba57c72c80fadedd passes boundedfoundationchecks:8Natural receipts,2genuine non-left-censored personal witnesses,2fullcontactcohorts(5/5and3/3),3completedactualplayer/HUDPNG,0capturefailures. Bothcentre/radius6circles survive allthreearrays and match exactly.1706freshbudgetframes,peak8,0unknown/hostgap/budgetgap. Incomplete=true/NaturalQualified=false remains truthful: newestmember8 lacksfirstcachedroute/nativepathatstop. No sustained>5s stall flag; capturesfacewalls soarrivalreadabilityremainsunverified. This is observer/exportfoundationevidence, notfive-cellacceptance. Finalbuilds0errors,635/640/773warnings,48.539/14.914/39.518s; fiveuniquediagnosticmarkerspresentdebug/absentrelease, packedassetguardpasses, ProBuilderhashpreserved. Four-playerdefault-offregressionrunning.

## 10 October genuine campaign findings and bounded repairs

Initial campaign `TestResults/ordinary-arrival-campaign-9e4cfef3fd40485d8ec7e815a98045ab` used build `e45b739cfe3d462a998de1419df59dbc`, managed SHA256 `08E8708EF71682044B8EB83403DC7C883E7A899C4443B8482042FED51D709419`. All three solo attempts are retained:117.1505s and35.5256s ended on natural owner-life loss;240.0222s stopped alive at the observation limit. The attempt cap was exhausted after392.6982 active seconds. Counts were0/0/1 separately qualifying cohorts, with no Large coverage. Natural peak16 was actually observed, but long unheld/contact-free stationary intervals13–203s prevent a positive ingress claim. No other cells ran on that defective version.

All inspected new actual-screen PNGs were uniformly black. Their files/manifests are retained as **invalid visual evidence**, despite the old capture code marking completion. The earlier5B HUD images remain actual visibly inspected terrain/weapon/HUD evidence for that older input-only checkpoint. Both launchers used Hidden; hidden-window causation is not established merely by that fact.

Three independent perspectives approve bounded prerequisite repairs, with RED→GREEN and final runtime gates:

- **Terrain:** saved native replay `ordinary-arrival-native-height-replay.txt` shows the frozen logical centre only6.9e-6m from the raw distant-corner chord but0.499614m below native floor2.009994m; a subsequent1ms step exceeds the unchanged0.5m projection guard. `EnemyPackNavigation` now consumes the already-paid canonical typed **local native prefix**, including its logical-to-supported connector within current3D allowance. Typed commits remain atomic; the original route cursor advances only after completing that prefix, and partial proof is retained. No extra query, speed, projection-height, admission, sight or balance change. Correct actual-brain/production-clock native RED stalls at `(28.18156,1.583331,14.36445)`; matching `ordinary-arrival-native-terrain-green` passes1/1, including crossing, current3D speed and≤8query checks. Earlier reproducer attempts with disabled ordinary brains or the wrong NGO elapsed clock are explicitly invalid fixture evidence and retained.
- **Owner life:** the production Refresh-before-observer order previously converted ordinary downing into sticky admission ScopeMismatch/MissingAdmissionProof. Tracked object/lifetime validation now precedes explicit OwnerLifeEnded/known OwnerDisconnected censoring. Real identity/lifetime/run/manager replacement and additional living owners still fence proof. Forced-order owner-death RED→GREEN1/1 and actual lifetime replacement/downing GREEN1/1 preserve this distinction; partial tails remain incomplete.
- **Capture:** `OwnerCameraRenderReceipt` requires an actual scoped owner-player-camera URP endCameraRendering callback for the current frame, plus a nonblack composed screenshot before ActualScreen/HudIncluded/completion. A separate LateUpdate watchdog fails pending operations after2s without relying on a blocked end-of-frame coroutine; callback hooks are removed on completion/timeout/disable/disposal. Read-only own-window visibility/minimization and simulation/render counters will diagnose the platform cause. Receipt/content10RED→10GREEN and independent watchdog native1/1 pass. Nonblack content is mechanical evidence only; actual PNG/HUD inspection remains mandatory.

Campaign rules preserve preceding valid episodes at expected life termination without hiding global observer incompleteness. They verify generation/manager/scene/full handle/run/stage/owner/lifetime/unique IDs before accepting completed or censored capture records. Automatic prior-manifest discovery links older software and refuses a fresh same-software attempt budget. Qualification19/19 and integrity26/26 pass after retained failure-stop, terminal, history and generation RED cases. `MaxAttemptsThisInvocation` can stop a run early for inspection without increasing the per-cell three-attempt/720s cap. Fresh corrected software must retain/link the original three attempts; it cannot be used as an unchanged-selection reroll.

Repaired source passes full1,264EditMode/192PlayMode. Fresh normal/debug/release builds succeed with0errors and652/640/939warnings (70.923/17.192/47.565s). Matching normal/debug managedSHA256 is D7E9A30E312C80FD422E0D73FF6F84C095C95DC1683CA9ADC5D14FAA7272698F; all six development evidence/control markers are present there and absent from release. The corrected five-cell campaign, actual render diagnostics and final matching network regressions remain pending. Technical/gameplay/UX final source/tool reviews have no remaining actionable findings, conditional on those runtime and actual-image gates. Task5 and roster6–11 remain open. No visible test window has been authorized or launched, no commit/push performed, and the unrelated ProBuilder edit remains untouched.

### Intended manual map changes and stair bake investigation — 10 October

The user confirmed the Cylinder collider removal was intentional. Preserve the current saved Verdant scene and its newly baked `Assets/_Project/Scenes/VerdantRelay/NavMesh-Verdant Relay*.asset` assets; do not restore the removed collider or obsolete HandAuthored navigation assets. Campaign walking routes were remeasured against these current meshes and source/meta identities.

Read-only navigation inventory found two PhysicsColliders/Children/Default-layer surfaces, no scene navigation links/obstacles/modifiers, and 23 individual stair MeshColliders. Normal radius/height/climb are0.5/2/0.75m; Large are0.9/3.3/0.4m, both45degrees. Default voxel sizes are approximately0.167/0.3m, HeightMesh is off, and jump-across remains zero. Centreline probes distinguish exposed treads from portions embedded under other map geometry. Across five sampled lanes, all4,427 exposed Normal points meet the diagnostic0.2m-horizontal/0.5m-height envelope and connect to pad0. Large has4,081/4,427 points within that envelope; every accepted Large point connects. This sampled evidence does not certify every point or explain the user's exact visual cut-out location.

Disposable in-memory bakes were mounted1000m away and removed in `finally`; no saved scene or NavMesh asset was changed. All ten bake variants retain complete, direct tested centreline crossings. Original-resolution Large approximation reaches0.58m vertical error over exposed treads; a0.167m voxel reduces maximum to0.46m,0.1m to0.27m, or HeightMesh alone at0.3m to0.27m. Normal maximum falls from0.39m to0.13m with HeightMesh. These are geometry/height-fidelity findings, not disconnected-path or gameplay success claims. Neither resolution nor HeightMesh has been applied to saved assets. A location-specific follow-up remains pending. See Unity's [NavMesh Surface reference](https://docs.unity3d.com/Packages/com.unity.ai.navigation@2.0/manual/NavMeshSurface.html) for resolution/HeightMesh behavior; pinned package2.0.14 remains unchanged.

Repeatable commands are outside Assets: `Tools/Inspect-VerdantStairNavigation.cs` and `Tools/Compare-VerdantStairBakes.cs`, executed through Unity_RunCommand. Artifacts: `TestResults/verdant-stair-navigation-inventory.txt`, `verdant-stair-mesh-faces.txt`, `verdant-stair-nav-centreline-probes.csv`, `verdant-stair-nav-probes.csv`, `verdant-stair-bake-comparison.csv`, and `verdant-stair-source-before.json`. Saved source hashes match after all experiments; Editor remains idle with a clean saved scene.

Fresh matching runtime progress: MainMenu `c9598b022e2741bd8627938a068bb210` passes all10phases with empty cleanup errors. Four-player arena `534390361514486bb325a5aec8616281` records nine passing gameplay reports plus one intentional failure proof and passing actual-target-disconnect/host-loss-to-menu checks, but the same-process rejoin times out after60s: client1/2 join, client3 remains busy at Joining your friend’s game with no reported error. Do not count this as a full arena pass. All owned processes were cleaned up. No session-source patch is justified by this evidence alone.

Corrected campaign parent `b99b2c9347e14f009cbf5c69a2b72a64` links the original three attempts. Solo attempt1 lasts25.01active seconds and ends MechanicalFailure: capture `9d2bd4156ade4801aea8e13f7c8f4900` is OwnerCameraRenderUnavailable (requested frame121898, rendered frame0, owner-camera callbacks0). Own window is found, not visible, not minimized. ActualScreen/HudIncluded remain false; the failure/export and empty cleanup errors are retained. Window visibility is a hypothesis, not a proven cause. One visible host has been requested under the Windows execution rule; no authorization or visible launch has occurred. Optional runner `VisibleHost` defaults off, affects only host launch style, records per-attempt visibility and preserves the same parent’s remaining two-attempt budget. No saved map or C# runtime change follows from this runner option.
The saved centreline samples also contain NavMesh positions below exposed tread faces: Normal minimum -0.183815m and Large minimum -0.151128m (maximums +0.39219m/+0.572513m). Thus depth-tested overlay clipping is a credible mechanism for apparent missing patches despite connected sampled paths; the precise reported location remains unconfirmed.
Final matching network checks: normal two/four progression513636144dd94dd782f38da155791282 passes23phases with empty cleanup errors. Identical bounded four-player arena repeat33347b7966e144838f7bbac0fe5a14b4 records10passing gameplay reports plus one intentional failure proof and three passing lifecycle checks, including same-process rejoin/combat; the preceding timeout remains a failed artifact with unproved cause. No session-source change or timeout relaxation was made. These checks do not qualify a genuine natural-arrival cohort or provide rendered HUD evidence.
Final bounded technical/gameplay/UX follow-up reviews approve source and launch tooling with no remaining actionable code findings. The lead closed the stale opening-summary wording and clarified report totals: the successful arena repeat has10passing gameplay reports, one correctly detected deliberate-failure proof, and three passing lifecycle checks. All live-arrival, actual HUD/PNG and human acceptance limits remain open. No visible launch authorization has been received.