# Enemy AI implementation plan

> **14 October workflow amendment (prospective):** use the current
> [workflow](../../AGENT_WORKFLOW.md) for Sol 6.1 / Ultra leadership, Sol 6.1 / Medium
> delegated test execution, playable-implementation ASAP/end human-playtesting timing and Ponytail checks
> within existing post-review. Its scoped automatic local-commit policy supersedes older
> generic no-commit defaults for future authorized slices. Historical no-commit statements
> and evidence remain intact; accumulated dirty work is not authorized for blanket staging.
> Explicit newer task restrictions, pending human gates and separate push authorization remain.

13–14 October 2026. Original approved plan; M0 prerequisites required by M1–M5 and isolated M1–M5 implementation/automated proof complete. M5B local investigation was authorized 14 October and is being implemented/verified below. M5/M5B human combat/readability judgement, final M5B gate, later M0 work and M6–M17 remain open.

> **For agentic workers:** execute one milestone at a time using `superpowers:executing-plans`, or an explicitly selected delegated implementation workflow. ProjectI's review and model policy takes precedence over generic skill defaults. One writer owns integration; reviewers are read-only. Checkboxes track implementation and evidence, not confidence or historical completion. Do not commit, push, install packages or start implementation merely because this plan exists.

**Goal:** build readable, useful, server-authoritative enemy AI for solo through four-player combat on the hand-authored first stage, using Unity Behavior and preserving the retained combat, spawning, rewards and session foundation.

**Architecture:** Unity Behavior graphs select meaningful individual actions through explicit capability interfaces. Enemies compose cohesive attack, movement, support and defense modules, using shallow inheritance only for genuinely shared implementation. Each module owns its state, execution and cleanup; shared services own encounter assignments, observations, navigation queries and launched effects. Clients display replicated movement and cues; runtime state never lives in shared graph assets.

**Tech stack:** Unity 6000.6.4f1, C#, Unity Behavior 1.0.16, AI Navigation 2.0.14, NGO 2.13.3, URP 17.6.0, Test Framework 1.8.0. Preserve the resolved dependency lockfile and existing multiplayer stack.

**Primary designs:** [replacement scenarios](../../Design/Enemies/2026-10-13-ai-replacement-scenarios.md) and [Unity Behavior integration](../../Design/Enemies/2026-10-13-unity-behavior-rework.md). Read both with this plan. The decisions below resolve some of their open questions; their remaining constraints still apply.

## 1. Player goals and completion levels

Players should see enemies keep contributing when the party moves or takes cover, understand dangerous attacks before they resolve, and gain real openings from dodging, flanking, controlling enemies and killing specialists. Enemies must use the same supported ground, stairs and bridges that the level actually provides.

Developers should be able to add an enemy that combines existing capabilities through authoring, and add a genuinely new capability through one cohesive implementation and its tests. Neither should require distributing role-specific branches across the entity, graph host, encounter director and unrelated attacks. Extensibility is part of completion, demonstrated with the planned melee and Keeper roles rather than an extra production enemy.

Completion has three distinct levels:

- [ ] **First playable slice:** one ordinary shooter works in an isolated fixture, including cover, movement, status interruption and host/client separation (M0–M5, including the M5B investigation follow-up).
- [ ] **Feature implementation:** moving pressure, melee, Bombardier, Keeper, Lancer, Bulwark, Splinterbeast and boss behavior work together, with lifecycle and safety proof (M6–M14).
- [ ] **First-stage acceptance:** integrated suites/builds and actual co-op scenarios pass; human combat/readability and representative hardware checks are recorded separately (M15–M17).

Passing the first level does not complete the roster. Passing automated checks does not complete human or separate-network acceptance.

## 2. Starting point and decisions

### Inspected baseline

Repository checkpoint: `codex/enemy-ai-rebuild`, HEAD `1b6eac4e3bca629f1c98b3f8fc657c8b6d90d2c6`, inspected 13 October 2026. Existing local edits affect `Packages/manifest.json`, `Packages/packages-lock.json` and `ProjectSettings/Packages/com.unity.probuilder/Settings.json`; preserve them.

- Manifest and lockfile now both specify Unity Behavior **1.0.16**; the package cache is present. This supersedes the designs' earlier “user will install” note. Editor import, compilation and runtime compatibility still need verification.
- `PrototypeEnemy` retains health, identity, damage/status/Scan, delayed death cleanup and network lifecycle. It deliberately starts its navigation agent stopped, with speed zero.
- `PrototypeEncounterDirector` retains safe admission, population/pacing, kill credit and boss/stage plumbing. `EnemyProjectileService` retains bolt and ballistic launch primitives.
- `EnemyDefinition` no longer contains the old decision/attack configuration. Old brains, positioning, pack behavior and specialist capabilities were removed. Their prefabs/art are not proof that those mechanics still work. The old Bulwark shield-only collision was disabled during teardown.
- The foundation assembly currently has no `Unity.Behavior` reference. Add only references required by the integration.
- `PassiveEnemyLifecycleTests` asserts stationary enemies/no attacks. Preserve its retained health/status/credit/reset assertions using an explicitly passive fixture when production enemies become active; do not simply delete this protection.

### Choices confirmed for this plan

| Topic | Decision |
| --- | --- |
| Ordinary melee | Track a valid visible target during windup, then lock lunge direction. Terrain stops travel; a miss still incurs recovery. No late snap toward the dodging player. |
| Bombardier evidence | Personal visual sightings permit remembered bombardment. Squad reports can guide repositioning but cannot authorize a bombardment location or refresh its memory. |
| Ally-less Keeper | After bounded support reassignment, a separate support rule may allow unseen retirement even if players are reachable. No rewards, visible disappearance or immediate replacement. |
| Close ordinary shooting | Preferred distance guides positioning. Distance alone does not prohibit a close shot if muzzle clearance, physical collision and all other existing weapon rules permit it. No emergency melee weapon. |
| Blocked boss | Preserve its health and required defeat; diagnose the blocked encounter for level/navigation repair. No automatic teleport, respawn, deletion or free progression. |
| Numerical tuning | Propose explicit starting values and measure/tune them. These values are provisional, not established commercial-game values or accepted balance. |
| Extensibility | Use explicit interfaces at capability boundaries, composition for enemy variants, shallow inheritance for shared lifecycle implementation, and cohesive ownership of each mechanic. Prove extension without central enemy-type dispatch or edits to unrelated role implementations. |

### Chosen implementation approach

Use **incremental playable slices**: prove the graph adapter and one shooter, then expand the same ownership model to other roles. A complete roster rewrite in one step would postpone useful evidence and make failures harder to isolate. Recreating the retired state machine or building a new behavior-tree framework would contradict the selected direction. There is no need to choose among those approaches again.

## 3. Global constraints and review focus

- Host/server owns decisions, movement requests, damage, claims, admissions, retirement and progression. Validate session, stage, actor identity, target lifetime and authority at execution boundaries.
- No pack-wide cover freeze, routine teleport, health reset, hidden speed compensation, unsupported gap crossing, emergency weapons, instant replacement or invented faction abilities.
- Guidance, personal sight, squad reports, hearing and remembered positions are distinct. Guidance never supplies a hidden player's exact aim location.
- Graph transitions cannot refund paid costs, renew pursuit/memory, retarget committed attacks or erase already launched effects. Root, slow and stun retain different meanings.
- Preserve projectile flight/collision, ordinary versus boss/custom ownership, specialist counterplay, reward rules and development-only diagnostic exclusion.
- Preserve MainMenu → VerdantRelay, manual terrain, current saved NavMeshes, unsaved authoring, GUIDs and assets/metas. Use supported Editor APIs/UI for graphs, prefabs and data. Do not hand-edit serialized graph/prefab YAML or run destructive arena rebuild/bake menus.
- Keep the first stage as the scope. No new weapons, production art, paid generation, dependency upgrades, host migration, permanent progression or unrelated refactoring.
- Keep role behavior out of central enemy-type switches. Shared entity, graph, encounter and service code must depend on capability contracts or explicit policy data; roster IDs remain legitimate for authoring, identity, admission and preserved progression rules.
- Keep each mechanic's configuration, state, execution and cleanup together under its owning module. File splitting must follow responsibilities and real reuse, with no parallel writable state or circular dependencies between roles.

Five failure conditions receive explicit tests:

1. **Pre-spawn/client graph execution:** zero decisions and damage before authorized initialization or on a client (M1/M5/M16).
2. **Recycled identities and late callbacks:** old observations, charges, claims or split callbacks cannot act on a new lifetime (M1/M2/M9–M14).
3. **Budget starvation and blocked terrain:** deferred work preserves safe routes and never establishes failure/retirement (M3/M7).
4. **Branch changes during paid actions:** cooldown, commitment and recovery survive interruption; launches resolve at most once (M4/M8–M12).
5. **Multiplayer visibility and simultaneous threats:** no visible retirement, misleading warnings, excessive precision overlap or omniscient rescue punishment (M7/M9/M11/M16–M17).

## 4. Compact task packet and execution rules

**Intent:** useful moving pressure with readable role-specific counterplay.

**Observed baseline:** enemies are passive after intentional teardown. Claims that the replacement will feel better remain untested.

**Hypothesis:** separating evidence and validated execution from graph action selection will keep enemies useful around cover and moving players without omniscience, infinite chase, refunded attacks or cross-client decisions. A repeatable cover freeze, hidden tracking, renewed chase allowance, unsafe movement or unreadable attack contradicts it.

**Risk/ownership:** future runtime work is high risk: authority, lifecycle, rewards and broad coupling. Lead implements/integrates, or assigns one writer. Obtain independent technical, gameplay and design/UX perspectives **before each consequential slice and against its integrated result**. Use compact delta rechecks after fixes. This planning task is lead-owned documentation and does not launch implementation agents.

**Review/model policy:** follow [AGENT_WORKFLOW](../../AGENT_WORKFLOW.md), including fresh review context and explicit model selection (`gpt-6.1-sol`, medium reasoning for substantial reviews). Escalate model unavailability before substitution. Review does not reduce test scope.

**Evidence:** record commit plus dirty-file/source/asset/settings identity, resolved packages, fixture/graph versions, exact selection, final manifests, builds, network profile and cleanup. The [teardown evidence](2026-10-13-enemy-ai-removal.md) is historical retained-subsystem evidence; it is not replacement AI proof.

**Duration:** unknown until M1 and the first shooter slice establish graph authoring, native test and integration costs. Record actual elapsed time per milestone and estimate the remaining work after M5. Human/hardware scheduling is separate. Do not infer a delivery date from historical test runtimes.

**Escalation:** client execution, stale-lifetime damage, required navigation/terrain edits, changed weapon/progression contracts, unsolved graph interruption, exceeded budgets or inconsistent remote cues stop the affected slice. Record the cause and proposed resolution before expanding.

**Stop condition:** stop each milestone at its stated gate. Freeze integrated source before broad verification and repeat only invalidated checks. At final delivery distinguish “implemented,” “automatically verified,” and “human accepted.”

**Progress record:** append a compact entry here per completed milestone: files/identity; focused results; three review outcomes; actual gameplay observations; omissions; keep/tune/revert decision; next milestone. Do not create a separate plan and status document with duplicate checklists.

### M0/M1 execution packet — 13 October 2026

- Checkpoint: `codex/enemy-ai-rebuild`, HEAD `1b6eac4e3bca629f1c98b3f8fc657c8b6d90d2c6`.
  Existing edits: PROJECT_PLAN, manifest/lock (Behavior 1.0.16), ProBuilder settings,
  and this untracked approved plan. Preserve all. Work in the user-selected checkout;
  isolation is fixture assets and tests, not a second checkout with missing local pins.
- Intent/hypothesis: a native counter graph starts only after valid server entity and
  capability initialization; two actors sharing its source stay independent; invalidated
  contexts never authorize another effect. Any unauthorized count or surviving old callback
  contradicts the slice. No combat/feel acceptance is implied.
- Sole writer/Editor owner: lead. High lifecycle/authority risk. Three independent
  pre-reviews (`gpt-6.1-sol`, medium): technical, gameplay and design/UX conditionally
  approve. Reconciled requirements: null agent graph through Awake (disabled is insufficient),
  validate full spawn/session/stage and startup generation, invalidate before graph End,
  unwind even the partially initialized throwing module, immediate death/hostile-cleanup
  shutdown, explicit restart, informative slot failures and distinct root/slow/stun facts.
- M0 readiness: Unity MCP confirms `C:/IndieGameProject/ProjectI/Assets`, 6000.6.4f1,
  stopped, not compiling/importing, Console errors/asserts/exceptions zero. Active saved
  `PlayTestScene.unity`, dirty false. CLI finds Editor PID 22380 but Pipeline is unreachable;
  use connected MCP supported Editor operations. Never start another Editor or save/rebuild
  normal content. Manifest/lock pins match the plan. No package changes authorized.
- Files: lifecycle contracts/context/host; minimal PrototypeEnemy hooks; assembly references;
  Editor-authored counter graph and prefab in Debug/EnemyBehavior; native lifecycle tests.
  Normal scenes/prefabs, terrain, saved NavMeshes and GUIDs remain untouched.
- Ownership walkthrough: host owns startup/stop and slot registry; each capability owns
  its cleanup; immutable actor context references identity/status owners. Future melee
  implements attack and uses movement; weaponless Keeper implements support; Bulwark
  composes melee and defense. Their future graph nodes consume the respective contracts.
  No role switch, sibling-role dependency or duplicate timer/state is needed in the host.
- Deferred M0: full removed-roster tuning/provenance inventory (M4/M8–M14), shooter
  requirements and pre-reviews for M2–M5, movement/attack/support contracts until their
  first consumers. This entry does not close all of M0.
- Checks: meaningful native RED then exact focused M1 leaves, retained passive lifecycle,
  relevant status/resistance/spawn identity/authority/session rules; genuine reload separately.
  Full M16, production promotion/build/co-op combat, human/hardware/separate-network checks
  omitted for this isolated counter milestone. Duration unknown; record elapsed at gate.
  Stop on readiness/ownership failure or unauthorized/stale execution; stop scope at M1 gate.

**M1 implementation complete:** lifecycle contracts/context/host, typed authored
bindings, private graph startup, immediate lethal/cleanup shutdown and counter fixture
are implemented. Behavior 1.0.16 calls `Init` in `Awake` even when disabled, so the agent
has no graph until validated startup. `Init` clones and calls node setup before binding;
our node setup does no work. `Start/Update` start/tick the private graph, `End` interrupts
running nodes but does not reset the agent's started flag, and disable alone does not
end the graph. The host explicitly invalidates, disables, ends/releases and unwinds.
Stun uses explicit End/Restart; root/slow do not blanket-stop decisions. No selector
preemption is assumed.

Three fresh post-slice reviews and compact delta rechecks found their source blockers
resolved: independent RunId/StageId checks and typed capability compatibility now have
native RED regressions. Native review-RED `enemy-behavior-m1-review-red-20261013e`
(`ee3d66457eac4ef29d77706dabc8ce41`) had 17 passes, these two intended failures, and
one separate client fixture failure. After fixes, `enemy-behavior-m1-green-20261013f`
(`540cd4b0de234b7d8dbf7a2670d32ee2`) had 23 passes/1 client setup failure, zero skips.
These are intermediate evidence; the final M1 gate is recorded below. Other retained failed setup
runs remain in TestResults; no failed run is labelled GREEN.

Fixture repairs: register in `sceneLoaded` before practice-host Start, use a plain
container root to prevent NGO auto-registration, register its enemy child only for the
owned session, and save/restore scene-management and scene-object visibility for the
in-process peer. Editor APIs restored the default prefab list exactly (13 entries,
native/unsandboxed git has no diff); fixture GUID is preserved. Some sandbox reads
retain stale Editor-written bytes, so use native/unsandboxed reads for final asset/evidence
audits. Client-only native proof is now GREEN: `enemy-behavior-m1-client-20261013j`
(`cfe49861ce854e02a1f89b4991030ac8`), 1/1 exact leaf, zero failures/skips. It proves
dynamic enemy replication/authority with scene management disabled and host scene
infrastructure hidden; it does not prove normal scene synchronization. Frozen focused
run, retained rules and bounded actual reload proof subsequently passed below. Normal terrain/NavMeshes/
scenes and production bindings are unchanged.

The user's inspection request added a package authoring view to `LifecycleCounter.asset`
around the existing runtime object/GUID. Unity's Behavior window now shows Start → M1
lifecycle counter. The private Self/Context runtime bindings were revalidated after
rebuilding. Open `Assets/_Project/Debug/EnemyBehavior/LifecycleCounter.asset` in Unity
to inspect or edit Start → M1 lifecycle counter in the Behavior window. This fixture is
not assigned to normal-stage enemies.

The first release audit built successfully but found three counter MonoScript records
(no fixture graph/prefab). The fixture was moved to a separate test assembly, explicitly
referenced by Editor/tests, with `UNITY_EDITOR` guards. Unity rejects serializing an
Editor-only component into a prefab; the native PlayMode-test assembly classification
allows authoring and standard builds exclude it. Final exclusion audit passed below.

Genuine active-session script reload `enemy-behavior-m1-reload-20261013n`
(`cdf86e7d38f7451c9bcc81eebfe733fa`) observed one reload but failed on existing NGO,
player, encounter and run-state null references after reload. Host cleanup occurred;
the failed scenario is retained and does not establish safe live-session hot reload.
Technical delta review recommends the bounded stopped-session proof: run a real graph,
stop it with exactly one End/cleanup, despawn without destroying the stopped object,
finish owned session cleanup, then request genuine reload and verify no stale resumption.
Corrected stopped-object proof `enemy-behavior-m1-reload-20261013q`
(`749080921dcf4d06984b9b75eaa4ed27`) is GREEN: 1 passed, zero failed/skipped,
one observed reload and matched terminal/identity. It checks unchanged historical counts,
including after host re-enable. Its normally stopped NGO transform and manager are disposed
before reload; the unspawned graph host remains for inspection. Failed refinements `o`/`p`
remain retained (historical-count assumption and NGO teardown errors). The original
script-compilation preference (1) was restored; Editor stopped/idle confirmed afterward.
Active NGO session preservation through hot reload remains unsupported by this slice;
no package or unrelated session changes are authorized.

**Frozen final checks:** source/assets/settings SHA-256
`730C57364154391747D22D644A0A2D7787EC44BCA59F1725CD3682F60378861D`.
Exact native discovery, zero skipped/inconclusive/missing leaves, no ownership conflict
and matched terminal/unchanged identity are required by each GREEN manifest.

| Check | Actual evidence | Outcome |
| --- | --- | --- |
| Genuine stopped-object reload | [q manifest](../../../TestResults/foundation-runs/enemy-behavior-m1-reload-20261013q-749080921dcf4d06984b9b75eaa4ed27/result.json) | 1/1; one observed reload; 84 seconds discovery/execution/publication |
| M1 lifecycle + passive lifecycle | [r manifest](../../../TestResults/foundation-runs/enemy-behavior-m1-final-20261013r-a3b6cb2c024e41609de639e10f7c1865/result.json) | 24/24; 57 seconds; normal no-domain-reload options |
| Status, resistance, spawn identity, authority, session lifecycle/roster rules | [s manifest](../../../TestResults/foundation-runs/enemy-behavior-m1-rules-20261013s-96bbd4de209e48a5897d718b28b4ebb5/result.json) | 38/38; 23 seconds |
| Standard Windows release/exclusion | [t audit](../../../Builds/M1-Lifecycle-20261013t/verification.txt) and `packed-assets.txt` | Succeeded; zero errors, 669 warnings; 111 seconds; no fixture paths (including MonoScripts), graph, prefab or fixture assembly; matching before/after source identity |

Final compiled dependency identities are recorded separately: EditMode
`C91AD146D1AC859FC9A1AF48FEE7ED763EFEE4FEBD05DF3603BE028C1DCCEE4E`, PlayMode
`194AE2B80ECB38741C3BFB6B972D43BA1CE06DCC260D7640FECBAF17F58740DB`.
The native peer/lifetime start/tick/end output is in each run's `results.xml`.

Changed implementation files (plus Editor-created `.meta` companions):

- `E/Behavior/EnemyBehaviorHost.cs`, `EnemyBehaviorContext.cs`, and
  `Contracts/{IEnemyCapability,EnemyActorContext,EnemyShutdownReason}.cs`.
- `E/PrototypeEnemy.cs` lifecycle hooks and `Assets/_Project/ProjectI.Foundation.asmdef`.
- `Assets/_Project/Debug/EnemyBehavior/{EnemyBehaviorCounter,EnemyBehaviorCounterAction,IEnemyBehaviorCounter}.cs`,
  `ProjectI.EnemyBehavior.Fixtures.asmdef`, `LifecycleCounter.asset` and `LifecycleCounter.prefab`.
- `Assets/_Project/Editor/EnemyBehaviorFixtureBuilder.cs` and `ProjectI.Foundation.Editor.asmdef`.
- `T/PlayMode/{EnemyBehaviorLifecycleTests,EnemyBehaviorLifecycleProbe}.cs`,
  `T/EditMode/EnemyBehaviorDomainReloadTests.cs`, and both test assembly definitions.
- This existing plan, `Docs/PROJECT_PLAN.md` and `Docs/TEST_CATALOGUE.md`.

Three independent pre- and post-slice perspectives (`gpt-6.1-sol`, medium; clean,
read-only technical/gameplay/design contexts) plus bounded delta rechecks found no
remaining source blockers. The latest technical check accepts the stopped-session
boundary and unchanged-counter assertion; design/gameplay explicitly exclude active
session hot reload and human combat/feel acceptance. One design delta attempt hit model
capacity; retry used the same approved model and completed, without model substitution.
No historical runtime proof closes these fresh gates. No human gameplay was performed.

Omissions: M2+ perception/navigation/actions/combat, M8/M10/M12 extension demonstrations,
full M16 suites/build variants/cohorts, actual two/four-player combat/latency/disconnect
and normal-stage promotion, all-down native scenario (cleanup path source-traced),
hardware/human/separate-network acceptance. The real in-process client proves dynamic
enemy authority only; scene synchronization is disabled for that owned fixture session.
No purchases or upgrades. Verification ended without commits/pushes; the user subsequently
authorized committing and pushing this completed slice. M0 later-role inventory and later pre-reviews
remain explicitly open. Next authorized milestone after this gate is M2, under its own
pre-slice requirements; this task stops at M1.

**Decision/gate:** keep the isolated foundation; M1 is complete within the stated
stopped-session reload and loopback-fixture limits. Normal enemies remain passive.
No perception, movement or attacks were added. First native RED began 01:31:06 UTC;
the final build audit completed after 04:06 UTC (over 2 h 35 min of iterative verification
and tooling work). Total task elapsed before that first request was not measured.
Final selected native runs total about 164 seconds; release build 111 seconds, excluding
earlier failures, import/reload/connection recovery and review time. These durations do
not add up to the full wall-clock task. Stop here; next milestone is M2.

Final preservation audit: exact XML leaves equal manifest discovery (q 1, r 24, s 38),
no duplicate/missing leaves and matching source identity through the release audit.
Editor is stopped/idle, saved PlayTestScene clean; enter-play options restored enabled/3,
script-reload preference restored to 1, default network-prefab list remains 13 with no diff.
Normal scenes/prefabs/terrain/navigation have no diff. A scene initially mistaken for an
owned UTF temporary was found to be tracked during commit preparation; its original
scene and `.meta` were restored exactly from HEAD. It is outside the runner's
`Assets/_Project` source-identity inventory and the selected build scenes; this restoration
does not change the recorded M1 checkpoint. The native `Unity.Behavior.BehaviorWindow`
is open as `LifecycleCounter`, without unsaved changes. Console retains the deliberately
expected cleanup exception from the passing unwind test; compilation and build have no
errors. Documentation whitespace and new plan/brief links pass; the catalogue's pre-existing
retired `Tools/OrdinaryArrivalCampaignRules.ps1` link is outside this slice.

### M2 execution packet — 13 October 2026 (complete within isolated gate)

- Checkpoint verified: `codex/enemy-ai-rebuild`, `fcd44866815dbaeea7be6bd0283d2be8cd63ac8e`, clean working tree. C: checkout absent; current CLI and connected MCP both identify E:/IndieGameProject/ProjectI, Unity 6000.6.4f1. Saved PlayTestScene clean, stopped/imported/compiled, runner idle, Console error/assert/exception count zero. Pins unchanged.
- Lead is sole writer and Editor owner. High authority/lifetime risk. Independent technical, gameplay and design/UX pre- and post-reviews (`gpt-6.1-sol`, medium, clean read-only contexts) approve the isolated result within the limits below. Temporary post-review capacity errors were retried on the same model without substitution. Technical/design delta rechecks accept the diagnostic correction.
- Intent/hypothesis: cover and unseen relocation preserve old personal evidence; reports/hearing never supply personal sight or reaction readiness; all invalid target lifetimes are rejected immediately. Any hidden position refresh, foreign peer admission or inherited memory contradicts M2.
- M0 required inventory: player combat owns monotonic SpawnLifetime, vitals owns living/settled accepted state, authoritative ConnectedClients owns exact PlayerObject; stage/run owners supply scope. Existing EnemyTargetingRules provides conservative nearest-hit body rays, independent of muzzle sensing. Accepted single/held gun shots converge on ResolveAcceptedShotServer; scheduled shots retain EventTimeServer. No weapon damage/scaling, specialist or progression behavior changes are needed. Full roster preservation inventory, M3–M5 pre-reviews and later capability contracts remain deferred.
- Policy: current personal sight > personal memory > scoped report > coarse hearing. Equal-quality incumbent preference lasts 1.5 s; better evidence or invalidation overrides it; thereafter nearest observed position wins with deterministic identity ties. No damage aggro/reset hooks, reachability claims or action state. Sustained sampled sight earns .25 s reaction (normally .30 s at .15 s sampling); unearned acquisition resets on loss, earned readiness survives brief occlusion only within the 3 s personal evidence window, measured from the last personal observation. At exact expiry readiness resets. Tuning captures at capability initialization. Perception continues through stun independently of graph selection; shutdown clears state/subscriptions. Additional provisional fixture inputs: 40 m sight, 180° field of view, 35 m hearing, 12 m sound cells. None is accepted balance.
- Files: Perception contracts/rules/selection/component/definition and accepted gun event hook; narrow read-only run participant query; isolated M2 fixture and Editor development view; rule/native tests; this record/catalogue. Normal scenes/prefabs/defaults, manual terrain, NavMeshes, GUIDs and existing M1 fixture preserved. No M3 movement, M4 attacks, M6 transport or later roster scaffolding.
- Proof route completed: meaningful rule/native RED→GREEN; exact runner discovery; M2 plus retained M1/passive native cases; full EditMode once after source freeze, including affected combat/authority/session rules and one genuine stopped-session reload; normal/debug/release compilation and packed exclusion. Final gates below are fresh; M1 records provide provenance only, not substitute passes. Active NGO hot reload remains unsupported.

**Frozen verification checkpoint:** HEAD `fcd44866815dbaeea7be6bd0283d2be8cd63ac8e` plus the then-uncommitted M2 delta. Source/assets/settings/package SHA-256 `04779BE4EBC7229B7F80DCBBFC4008A70042B4FA05D43C0C24CB15BD5E098189` matches both final native manifests and all three build audits. Each build audit also records its application GUID and complete executable/UnityPlayer/data fingerprint. Verification ended without committing or pushing; the user subsequently authorized a scoped M2 commit and push. No package change.

| Check | Immutable evidence | Actual outcome |
| --- | --- | --- |
| M2 + retained M1/passive native | [i manifest](../../../TestResults/foundation-runs/enemy-m2-final-native-20261013i-938d28f874924d6e8f51c27d03ec7152/result.json) | 39/39: 15 M2 + 24 lifecycle/passive; zero failures/skips/inconclusive; 33.72 s execution, 37.58 s request span |
| Full current EditMode assembly | [j manifest](../../../TestResults/foundation-runs/enemy-m2-final-editmode-20261013j-0f20f82b36d8449eac7d419378d75838/result.json) | 1,074/1,074, including 13 M2 rules and one genuine stopped-session reload; zero failures/skips/inconclusive; 73.16 s execution, 77.25 s request span |
| Normal Windows development | [k audit](../../../Builds/M2-Observations-20261013k/NormalDevelopment/audit.json) | Succeeded, zero errors, 587 warnings; 88.30 s; matching source identity, no fixture assets/assemblies |
| Debug Windows development | [l audit](../../../Builds/M2-Observations-20261013l/DebugDevelopment/audit.json) | Succeeded, zero errors, 640 warnings; 17.91 s; matching source identity, no M1/M2 test fixture assets/assemblies |
| Windows release/exclusion | [m audit](../../../Builds/M2-Observations-20261013m/Release/audit.json) and `packed-assets.txt` | Succeeded, zero errors, 724 warnings; 60.09 s; matching source identity; no fixture assets/MonoScripts/assemblies, Editor view or development inspection method markers |

All final native XML leaves match exact manifest discovery, without duplicates/missing leaves, ownership conflict or source drift. PlayMode compiled identity is `34D1510E7D12A8D2614172321E63CB9C5C5879611B9A44784CB7878358E0C593`; EditMode is `527F7F009AA7FE5603FF9207391B1854DE8511AFD2B26E84D86BCF276CC87243`.

Retained intermediate evidence: rule RED `a` (5 pass/6 fail), genuine-sight native RED `b` (0/1), rule GREEN `c` (13/13), native `d` (1/1), `e` (11/11), `f` (13/13). These are not combined into final-checkpoint proof. Post-review identified that the view called selection: [g RED](../../../TestResults/foundation-runs/enemy-m2-view-red-20261013g-7c67f5a4c3d24d96baf8e7fd41558e52/result.json) reproduced the reason mutation; [h GREEN](../../../TestResults/foundation-runs/enemy-m2-view-green-20261013h-239cfc3b0c59445c99f19e21f0b8038c/result.json) and final `i` verify read-only inspection. Expired history is labelled and its markers omitted. Initial build-command wrapper compile/namespace failures ran no build; corrected public-API builds emitted saved successful BuildReports. MCP labelled their warning-heavy output partial/error; the native reports, packed audits and matching before/after identities establish the actual build outcomes.

Coverage: K01/K03 physical cover and bounded memory; K02 sustained acquisition/earned reaction rules; K04 real accepted unseen relocation; K05 report admission without personal sight; K06 accepted single/held gun events with captured coarse region/original scheduled time; K07 independent A/B records; G05 actual alternating two-player damage without counter-action restart; G06 immediate downed exclusion and ordinary visible living-B selection; L02 real disconnect/despawn, same NGO object ID with a new player lifetime, foreign-manager replica/stage refusal, and run-stage context invalidation. These establish M2 observation/selection inspectability, not movement, firing, a real revive channel or attack commitment acceptance.

Changed files (with Editor-created metas): `E/Perception/{EnemyTargetKey,EnemyObservation,EnemyObservationRules,EnemyTargetSelection,EnemyTargetRules,EnemyPerceptionDefinition,EnemyPerceptionSnapshot,EnemyPerception,EnemyCombatNoise}.cs`; `PrototypePlayerCombat.cs` accepted-shot emission; `PrototypeRunDirector.cs` read-only participant query; `Editor/{EnemyPerceptionFixtureBuilder,EnemyPerceptionWindow}.cs`; `Debug/EnemyBehavior/Perception.{asset,prefab}`; the two M2 test fixtures; catalogue/current brief/this plan. The host, common enemy/entity/context, M1 graph/prefab, normal scenes/prefabs/default registration, terrain, saved NavMeshes and package/settings pins have no diff. Observation state has one per-enemy owner and no blackboard copy or role switch.

Inspection: **ProjectI > Debug > Enemy AI > Observation view**, choose a running `M2 Perception Observer` (or select it and use the button), and optionally enable scene markers. The Editor-only view displays all stored target lifetimes, original source/age, sampled visibility, reaction readiness, personal deadline, selection reason and preference. Native scenarios are in `EnemyBehaviorPerceptionTests`; pause a scenario for inspection. These tests load PlayTestScene and spawn temporary observers; no persistent manual M2 observer is installed in a scene, and pressing Play alone does not activate M2. Closing the window stops diagnostics. Fixture tuning is in `Debug/EnemyBehavior/Perception.asset`; production assets remain passive. The view's real Editor refresh is automated; rendered usability and human readability have not been accepted.

Omissions/limits: full PlayMode/M16, built two/four-player combat/latency/disconnect cohorts, normal-stage promotion, human feel/balance/readability, hardware and separate-network acceptance. The actual two-peer fixture disables scene synchronization and hides host scene infrastructure; it is dynamic authority/eligibility proof only. Hearing currently emits accepted gun discharges, not abilities/explosions. Report intake trusts authoritative callers supplying genuine captured personal evidence; M6 must add scoped squad transport and producer admission. Full roster weapon/scaling/specialist preservation inventory, M3–M5 pre-reviews and later capability contracts stay open. No movement, attacks, coordination, specialist restoration or active-session reload repair.

**Decision/stop:** keep the isolated M2 implementation for the next slice; M2's inspectability gate is complete. No human gameplay was performed. Timing is recorded per final operation above; total task time before the first RED was not measured. The evidence span begins 04:40:03 UTC and ends with the release audit's recorded UTC time; import/review/tool recovery and overlapping phases are not summed as gameplay/performance evidence. Stop here. Next is **M3 positioning, claims and physical movement**, after its own scoped prerequisites/reviews.

Final preservation check: connected E: project at 6000.6.4f1, stopped/not compiling/importing, compile failure false, runner idle, saved PlayTestScene clean, enter-play options enabled/3. Console error/assert/exception count zero. Current script-compilation preference is 0; the genuine reload fixture restored its captured value (the historical M1 preference was 1, not assumed current). Exact final XML/discovery and all seven new evidence links pass; documentation whitespace passes. Source fingerprint remains unchanged after documentation updates.

### M3 execution packet — 13 October 2026 (complete within isolated gate)

- Verified checkpoint: `codex/enemy-ai-rebuild`, HEAD `7a1180e7592f4b2ee72dce736781c6194169db58`, clean tree. C: checkout absent. CLI/MCP identify E:/IndieGameProject/ProjectI, 6000.6.4f1; pins unchanged. Editor initially playing, saved PlayTestScene clean, runner idle and Console error/assert/exception count zero; stop before import/authoring/tests. Lead owns all writing and Editor operations.
- Intent/hypothesis: bounded evidence-based positioning finds several supported useful lanes, safely transits stairs/bridges and resumes after temporary obstruction. Hidden relocation changing exact planning inputs, overlap/void crossing, stale claim ownership or deferred-as-failure contradicts M3. Normal enemies remain passive; no attack/retirement/coordination implementation or production navigation bake.
- High authority/lifetime/shared-claim risk. Three independent read-only pre/post perspectives use `gpt-6.1-sol`, medium, fresh contexts. Review focus: action generation on same-lifetime restart; reservation cleanup; complete native routes and actual capsule support; clearance above range preference; fairness and safety independent of decision budget.
- M0 consumed inventory: retained `EnemyAttackDefinition` owns attackRange/clearanceRadius; ordinary `Ranged Drone attack.asset` has 24 m range/.08 m clearance and no hard minimum. `EnemyTargetingRules` owns origin clearance and nearest-hit body sweeps; projectile launch independently rechecks origin. M3 captures an authored local muzzle offset and clearance/range definition for lane scoring only, no firing. `PrototypeEnemy` owns native agent/physical footprint, current status and collision-safe `TryDisplaceServer`; initialize/death/despawn writes and forced displacement remain its lifecycle boundary. No retained base movement speed survives teardown; fixture-authored speed is provisional. Full roster/scaling/specialist inventory and M4/M5 pre-reviews remain deferred.
- Smallest implementation/files: matching contracts in Behavior/Contracts and Navigation; per-enemy `EnemyPositioning` owns bounded candidate selection and action sequence, `EnemyMovementExecutor` owns accepted normal/attack-style travel, `EnemyPositionClaims` owns token-scoped destinations, `EnemyQueryBudget` owns a bounded fair FIFO decision query allowance separate from admission. Shared immutable Navigation definition captures 6 candidates/8 queries, 1.5 s claims, .5–1 s yields, 8–14 m preference. Explicit component/service bindings, one state owner, no host/entity role dispatch or speculative later interfaces. One meaningful movement graph action and fixture bindings; no second general scheduler.
- Planning consumes validated M2 snapshots (personal/report/heard keep original precision/age), or fixture-authored coarse sector; no live hidden player transform. Physical safety revalidates outside the expensive path-query allowance. Keep safe accepted movement while Deferred; unsafe routes stop and release their own claim. Requests capture finite speed/distance/duration ceilings; current slow/root/stun remain authoritative.
- Proof sequence: behavioral RED then focused rule/native GREEN; independently prove Ready/Deferred/NoPath/NoLegalPosition/InvalidContext; actual stairs, bridge, disconnected islands, normal/large native meshes, void/occupancy/claim invalidation, death, close cliff escape, budget starvation, wrong-owner and stale callbacks, same-lifetime restart and M2 knowledge preservation. Freeze integrated source then full EditMode plus focused native M3/M1/M2/passive/status/authority/admission regressions; normal/debug/release builds with packed fixture/diagnostic exclusion. Exact discovery/manifests and cleanup required. Do not run M16/full multi-hour PlayMode.
- Reuse/limits: historical M1/M2 records provide provenance, not fresh M3 proof. Unchanged production defaults and accepted progression/network scenarios may reuse compatible teardown/M2 evidence with explicit scope; dynamic peer fixture is narrower than normal scene synchronization. Human feel/readability, hardware, separate-network and full combat remain open. Duration unknown; record operation durations. Escalate ownership/readiness, changed weapon contract, unsafe movement or production terrain need. Stop at M3's gate; temporary automated fixtures are not a ready manual sandbox.

Integrated source frozen at SHA-256 `F61E63557CBD0A92C4C2FA727FEBEDDAADB891FE47D7A0168F94192390512C71` (frozen HEAD `7a1180e7592f4b2ee72dce736781c6194169db58` plus the then-uncommitted M3 delta). Focused [native ad](../../../TestResults/foundation-runs/enemy-m3-focused-native-20261013ad-68eda26d0b534790a8934e7080f43837/result.json) passes 38/38 in 66.76 s; focused [rules ae](../../../TestResults/foundation-runs/enemy-m3-focused-rules-20261013ae-aee55863502b40fc891421162018eef0/result.json) passes 9/9 in 3.95 s. Both have exact positive discovery, matched terminal, unchanged identity and zero skips/failures/inconclusive. Three independent pre/post perspectives plus compact delta rechecks accept the isolated slice, with moderate confidence and the explicit limits below. Their remaining integrated-proof conditions are satisfied by the frozen final checks. Temporary model-capacity failures were retried on the same approved model; no substitution or reviewer writes/Editor operations.

Native iteration retained meaningful RED evidence for missing decision/movement/graph work, thin-obstacle tunnelling, stale pending target/claims, invalid foreign clock/FIFO calls, malformed owned status, stage bounds, expired-token reacquisition and bridge nudges renewing yields. Ramp corrections were based on measured native height-detail, support/normal and zero-distance capsule contacts; no geometry/assertion/deadline was relaxed to pass. Full-capsule overlap/sweeps retain thin-wall, tall-wall and same-MeshCollider ramp/vertical-face negatives. Speed is explicitly planar after slow, native climb is separate, actual 3D travel/duration remain capped. Current supported destinations/footprints must fit the captured stage definition's envelope. Queries are bounded per request/frame with FIFO age retention and abandoned-grant cleanup; Deferred remains pending, never failure/retirement. Physical safety checks run independently of the CalculatePath allowance. Combined admission/decision performance and human feel are not established.

Fixture corrections preserved the intended contract: completion waits for the actual action end rather than a nearby-distance threshold; following bridge actors use the real seek graph to replan when the front actor occupies a former destination. Failed intermediate manifests remain retained (including budget `f`, review `u`, direct expiry `y`, ramp `z`/`aa`/`ab`/`ac`); labels containing "green" do not override a failed manifest. The final pass is `ad` and the integrated gate below.

| Frozen final check | Immutable evidence | Actual outcome |
| --- | --- | --- |
| Full current EditMode assembly | [af manifest](../../../TestResults/foundation-runs/enemy-m3-integrated-editmode-20261013af-43301a917f834b63a1304ffc2a1473f7/result.json) | 1,083/1,083; one genuine stopped-session reload; 79.97 s execution; zero failed/skipped/inconclusive |
| M3 + retained M1/M2/passive native | [ag manifest](../../../TestResults/foundation-runs/enemy-m3-integrated-native-20261013ag-13789bab04fe48bda5063566480c3955/result.json) | 77/77: 38 M3 + 39 retained; 81.48 s execution; zero failed/skipped/inconclusive |
| Normal Windows development | [verification](../../../Builds/M3-Navigation-20261013/NormalDevelopment-589241d339da4e2998db3cb3068cba6b/verification.json) | Succeeded, zero errors, 587 warnings; 70.43 s; matching source; fixtures/test/Editor assemblies excluded |
| Debug Windows development | [verification](../../../Builds/M3-Navigation-20261013/DebugDevelopment-6fa3085d75ae4957b9bce46a090668e1/verification.json) | Succeeded, zero errors, 640 warnings; 18.28 s; matching source; fixtures/test/Editor assemblies excluded |
| Windows release/exclusion | [verification](../../../Builds/M3-Navigation-20261013/Release-9c029d04464e49e2af8bdbf25ebf237b/verification.json) | Succeeded, zero errors, 724 warnings; 48.17 s; matching source; fixture assets/MonoScripts/assemblies, debug authoring/scene and development inspection markers excluded |

Each final test manifest has exact discovery/terminal coverage, no duplicates/missing leaves, no ownership conflict and unchanged source identity. Full EditMode covers affected status/resistance, authority/session, spawn/admission and displacement rules; native passive cases preserve actual admission/damage/status/credit/reset behavior. The M3 four-peer case proves server-only acceptance and remote movement through three real loopback clients, with scene synchronization disabled and remote in-process NPC colliders disabled to avoid artificial duplicate bodies. It establishes no combat/latency/separate-network acceptance. Build folders retain raw native `audit.json`, `LastBuild.buildreport`, scenes/packed assets and complete `fingerprints.json`; final `verification.json` records before/after source identity, build GUID, native-report/manifest hashes and release checks. The same runner hash/EditorSettings normalization was reproduced in PowerShell before/after builds because the MCP command does not allow reflection. Temporary audit-command compilation/namespace errors occurred before any build started; warning-heavy MCP build responses are distinguished from the successful native reports. No broad run was repeated after passing.

Changed files, with Editor-created `.meta` companions:

- `E/Behavior/Contracts/EnemyActionToken.cs` and `E/Behavior/Nodes/EnemySeekPositionAction.cs`.
- `E/Navigation/{EnemyPlanStatus,EnemyMoveLimits,EnemyMovePlan,IEnemyMovementExecution,EnemyApproachSector,EnemyPositionClaim,EnemyPositionClaims,EnemyPositionScore,EnemyQueryBudget,EnemyNavigationDefinition,EnemyNavigationSafety,EnemyPositioning,EnemyMovementExecutor}.cs`.
- `Assets/_Project/Editor/EnemyNavigationFixtureBuilder.cs` and `Assets/_Project/Debug/EnemyBehavior/{Navigation.asset,Navigation.prefab,SeekPosition.asset}`.
- `T/EditMode/EnemyBehaviorPositionTests.cs`, `T/PlayMode/EnemyBehaviorNavigationTests.cs`, this plan, `Docs/PROJECT_PLAN.md` and `Docs/TEST_CATALOGUE.md`.

M0 inventory consumed only movement necessities: actual retained ordinary presentation muzzle is local `(.55,.82,.25)` and is bound in the prefab; discriminating native lip tests explicitly author `(0,.9,.55)` and do not certify production muzzle behavior. Retired `161f6ab` shooter provenance used that presentation muzzle/fallback AimPoint and candidate-facing offset; retained projectile `trackingStopDistance = 2` is a tracking cutoff, not a minimum shot/movement distance. Current 24 m/.08 m weapon rules remain definitions for hypothetical lane scoring; M4 still owns actual release validation. Full roster weapon/scaling, specialist preservation and later capability/pre-review prerequisites remain open.

**Actual startup/manual access:** run exact `ProjectI.Tests.EnemyBehaviorNavigationTests` through the supported Test Runner or `FoundationTestRunner.RunFixtures` in PlayMode. It loads saved PlayTestScene, temporarily creates terrain/stairs/ramp/bridge/islands and native Normal/Large NavMeshData at `(400,0,400)`, injects shared claims/budget, spawns the fixture child and restores the runtime stage clone/session/navigation on cleanup. `Navigation.prefab` defaults to the M1 counter graph; explicit graph scenarios select `SeekPosition.asset` before spawn. No persistent M3 observer/services/navigation or convenient manual sandbox is installed. Opening PlayTestScene and pressing Play remains passive. Definition tuning is serialized/inspectable; transient result/stop/query/claim/yield state is available through C# debugger properties, without a combined rendered M3 view. The M2 opt-in observation view remains separate. No human gameplay was performed.

**Preservation/reuse/omissions:** historical M1/M2 evidence supplies provenance only; affected cases and all three builds were freshly rerun. Production scenes/prefabs/manual terrain/saved NavMeshes, DefaultNetworkPrefabs, packages/settings and M1/M2 runtime files have no diff. All new assets/scripts retain their new Editor-generated GUID/metas. Final Editor: E: project, pinned 6000.6.4f1, stopped/compiled/imported, runner idle, saved PlayTestScene clean, play options enabled/3 and captured script preference 0 restored; Console errors/asserts/exceptions zero after builds. No upgrades. Verification ended without a commit/push; the user subsequently authorized committing and pushing this completed slice. M16/full PlayMode, built combat/normal-stage promotion, human readability/balance, representative hardware, combined host cost and separate-network latency/disconnect checks are omitted because this isolated slice leaves normal defaults passive and has no attacks. Active NGO hot reload remains unsupported. These remain later acceptance, not fresh or reused M3 proof.

**Decision/stop:** keep; M3's isolated gate is complete. Useful movement resumes after obstruction clears, safe routes survive budget deferral, unsafe movement stops, claims remain owner-scoped, and native tests cover overlap/void/loop/starvation hazards. Opposing actors submit a fresh explicit plan after death; that is movement-contract proof, not M6/M7 autonomous recovery policy. First RED request began 06:17:16 UTC; final operation timestamps are in the linked manifests/audits. Full task time before first RED was not measured, and iterative tooling/reviews are not gameplay/performance evidence. Stop at M3. Next milestone is **M4 ordinary shooter attack and graph**, with its remaining scoped M0 prerequisites and independent pre-reviews; M4 attacks, M5 diagnostics, M6 coordination, M7 retirement and later roster behavior are not implemented.

### M4 execution packet — 13–14 October 2026 (complete within isolated automated gate)

- Verified checkpoint: clean `codex/enemy-ai-rebuild`, local/recorded remote `8a1a32ea97e7c43c0592fe364b18cdc9572d01d0`. Connected MCP: E:/IndieGameProject/ProjectI, 6000.6.4f1, stopped/compiled/imported, clean saved PlayTestScene, runner idle, Console errors zero. Preserve normal defaults, all production terrain/navigation and package pins. Lead owns writing/Editor; fixture isolation in this checkout.
- Intent/hypothesis: a personally sighted ordinary shooter pays preparation once, releases only validated shots, retains recovery across graph cancellation, and finds useful supported angles around cover/stairs. Hidden aim updates, refunded recovery, repeated shot identity, unbounded assignment or a seek branch blocking combat falsify the slice.
- High authority/lifetime risk. Independent clean read-only technical/gameplay/design pre-reviews (`gpt-6.1-sol`, medium) support proceeding. Reconcile: preparation-start payment; immutable target/commitment; fresh personal qualification plus actual eye/muzzle validation; bounded one-shot-per-tick burst with no catch-up; finite definition validation; bounded seek completion; independent service flight. Post-reviews required before freeze.
- Scoped M0 inventory: current ordinary asset 6 damage, 24 m range, 1.5 s cooldown, .35 s preparation, .08 m clearance; nonboss 3-shot/.12 s uniform solid-angle 7.5-degree cone (5-degree spread is retired boss single-shot only). Normal tuning gives 4.2 damage before resistance, 1.95 s cooldown, 8 m/s, 60 degrees/s, full-flight tracking; elite retains 6 base damage (9 after elite resistance), 1.5 s, 24 m/s, 20 degrees/s, .6 s tracking/2 m tracking stop. Retained wave/jitter 8 degrees/2 Hz and 2 degrees/7 Hz, flight lifetime 3 s. Service owns normal scaling and outgoing resistance. Retired `161f6ab:PrototypeEnemy` captured `stageDamage` on spawn and `AttackDamage` multiplied it once before service capture; M4 restores that entity-owned snapshot and one service multiplication. `RunRules.DamageScale` is min(3,1.08^(stage-1)); stage 2 native values are 4.536 normal / 9.72 elite. Participant count affects health, not bolt damage. Bolt captures a private immutable-use definition clone at initialization; no shared asset is mutated. Retained muzzle local (.55,.82,.25); close preference/tracking stop are no minimum firing range. Other roster inventory deferred.
- Files/owner: lead adds matching attack status/request/interface/commitment, cohesive bolt executor, generic attack node, bounded existing seek plus finite assignment fallback, fixture graph/profile/prefab and reusable native conformance/shooter tests. No shared execution base, new scheduler, later-role interfaces or M5 diagnostic system.
- Proof: native meaningful RED→GREEN, focused attack rules/conformance/shooter plus M1–M3/passive/projectile/status/authority/lifecycle/admission and real loopback peers. Freeze before full EditMode and affected native integrated run; normal/debug/release builds and exclusions. No full M16. Historical evidence is provenance until explicit compatible reuse. Duration unknown; operation times recorded. Human/hardware/separate-network acceptance remains open. Stop at isolated M4 gate; automated temporary setup is not a manual sandbox.

Payment/commitment contract: successful preparation admission pays the captured 1.95/1.5 s deadline immediately, before any capacity admission. Preparation follows verified personal sight of the captured target; each shot then captures its own immutable aim/target/shot index, with release on a subsequent graph tick. Release rechecks actor/action/stage and target lifetime, earned reaction/personal sight, actual eye and muzzle/body corridor, maximum range and stun. Reports/hearing cannot authorize fire. Refused/blocked/overdue release cancels the remaining tail, consumes no replacement identity and retains paid recovery; no catch-up queue. Cancellation never calls global projectile cleanup. Death stops new emission; service flight continues independently until collision/lifetime/encounter cleanup. Root only constrains voluntary movement.

One generic graph/interface tick advances attack; there is no attack Update. Native Repeat/Try In Order selects attack, bounded existing seek (which already investigates distinct captured personal/report/heard evidence), then bounded assignment wait/failure. M4 uses one fixture-seeded `EnemyApproachSector`, never renews it and has no M6 transport. Natural .5 s seek reassessment preserves safe executor-owned travel and Deferred FIFO/evidence; actual interruption cancels only owned work. M3's standalone graph retains its null-profile continuous behavior. The added generic `EnemyBehaviorContext.IssueActionTokenServer` issues an independent lease, without invalidating movement tokens; affected M1–M3 consumers are in integrated proof. No execution base/subgraphs/later-role interfaces added.

Pre/post technical, gameplay and design/UX reviews and compact delta rechecks clear runtime source to freeze. Technical review found derived-value overflow/underflow and a committed-tail overdue bypass; meaningful rule `h` (4 failures) and native `i` (1 failure) reproduced them, then fixes passed focused `j` (36 native) / `k` (13 rules). Gameplay/design found synthetic planner muzzle and aggregate cover attribution gaps; authored muzzle is now retained and an isolated shooter must itself uncover/fire. Actual blocked stair-lip graph proof, separate actual twelve-riser stair transit/close fire, unseen alternate exit, target switching, stage scaling and peer checks pass `j`. Temporary model capacity failures retried the same approved model. Final verification-only delta strengthens B's Completed status and adds four-peer attack authority, with no runtime changes.

Retained failures are not GREEN: `a` missing capability; `b` seven expected rejecting-shell failures; `d` eight missing field-validation failures; `e` missing graph plus cross-case capture leak; `f` one flight-contact fixture timing failure (8 m/s needs >.5 s to travel five metres); `g` 29/31, remote CharacterController incorrectly disabled while motor ticked and an unbounded commitment wait/new duplicate NPC collision. Fixtures now disable remote motors before duplicate colliders, isolate newly replicated NPCs, assert admission and bound waits. No error suppression or increased NUnit timeout. `j` is 36/36, `k` 13/13; exact final frozen evidence is recorded below after integrated gates.

Timing limit: per-shot commitment adds a graph tick. .12 s remains minimum burst spacing, not a claim of exact cadence. Constrained 20 Hz manual interface ticks in `j` measured .20599/.20314 s between releases, with three distinct emissions and no catch-up. This is neither actual low-FPS hardware profiling nor proof of human-readable dodge windows.

Integrated source freeze: `FF53A42593E79671FBC2A618A3FDA77D98BE4BA885870A9B1772A2B2664C83FB`, HEAD `8a1a32e` plus M4 working-tree delta. Broad checks/builds pending; M4 gate remains open until their evidence is reconciled.

Integrated `m` discovered/executed exactly 168 leaves with matched terminal/no conflict and unchanged frozen identity. It is **not GREEN**: 113 passed (all 37 M4, 23 M1, 15 M2, 38 M3), 55 failed. First projectile case completed its body but failed cleanup after restoring PlayTestScene started another practice host; 53 subsequent projectile cases and passive startup then cascaded through that leaked session. Execution was 1,012.49 s, not product performance evidence. Terminal/Editor stopped/idle were confirmed before further work. A transient read-only progress-observer attempt rejected its stale owned ID after completion, registered no callback and started no execution.

Technical delta review confirms the test-only repair: scope a sceneLoaded restoration handler to the exact restored scene, disable its temporary PlaytestSceneController before Start, remove the handler in finally and retain all shutdown/active-enemy assertions. No scene asset is saved and the next passive case loads a fresh normally enabled controller. M4 runtime/assets/settings remain unchanged. Review permits explicit compatible reuse of the preceding 113 passes and full EditMode `l` (1,096 cases/one genuine reload): the sole subsequent source delta is this unrelated tracer-fixture cleanup, not invoked by those checks. They must retain their original FF53 identity and must never be presented as a fresh GREEN 168-case checkpoint. The public runner cannot mix an exact method with fixtures; affected boundary recheck therefore selects full Navigation (38), Projectile (54), Passive (1), rather than adding/changing a shared runner API for a 56-leaf mixed selection. Its exact final manifest and new source identity remain required.

**M4 final evidence/gate:** final source/assets/settings/package SHA-256 `CC077CA87FDDAE75EDA162062C6B7063499ED7598E9FAB35708B4D30F9FA6CD2`, HEAD `8a1a32ea97e7c43c0592fe364b18cdc9572d01d0` plus uncommitted M4. The only post-FF53 source delta is the tracer test cleanup above. Runtime/assets/settings remain unchanged. Every listed test has exact XML/discovery equality, unique leaves, matched terminal, no conflict and zero skips/inconclusive. Failed overall evidence remains failed.

| Check | Immutable evidence | Actual result / limits |
| --- | --- | --- |
| Focused M4 native / rules | [j native](../../../TestResults/foundation-runs/enemy-m4-review-green-native-20261013j-af5ce3cf69fd4beebbae13cff7351966/result.json), [k rules](../../../TestResults/foundation-runs/enemy-m4-focused-rules-20261013k-46ac69e9aab2401aa6e8cb747a114c7f/result.json) | GREEN 36/36 in 95.86 s and 13/13 in 4.43 s at 34D08BB6…F976; subsequent verification-only four-peer/B assertion is covered in m |
| Full EditMode and genuine stopped-session reload | [l manifest](../../../TestResults/foundation-runs/enemy-m4-integrated-editmode-20261013l-cbc4ebd4bf04479da301738084bdf046/result.json) | GREEN 1,096/1,096; one observed reload; 203.02 s; FF53 identity, explicitly compatible reuse after unrelated test-only tracer cleanup |
| Retained failed native cohort | [m manifest](../../../TestResults/foundation-runs/enemy-m4-integrated-native-20261013m-b5398469ad784fc59414eb8690461a28/result.json) | 113 pass / 55 fail, 1,012.49 s at FF53. All 37 M4 + 23 M1 + 15 M2 + 38 M3 passed. Only unchanged M4/M1/M2 subset (75) is reused for final coverage; navigation is freshly repeated below. This is not GREEN168 |
| Navigation → projectile → passive boundary | [n manifest](../../../TestResults/foundation-runs/enemy-m4-projectile-boundary-20261014n-ad013d0e69ae44dba5de7d3d29aa2d63/result.json) | GREEN 93/93 = 38 navigation + 54 projectile + 1 passive; 119.06 s; final CC077CA8…6CD2 identity; genuine saved-scene startup/cleanup passes |
| Normal Windows development | [verification](../../../Builds/M4-Shooter-20261013/NormalDevelopment-7c3a2abcfc8a45e091147c0bdc9c4226/verification.json) | Succeeded, 0 errors / 587 warnings, 118.71 s; matching final source, 461 fingerprinted files; fixture assets and test/Editor/fixture assemblies excluded |
| Debug Windows development | [verification](../../../Builds/M4-Shooter-20261013/DebugDevelopment-8e4c3d17eaa4445794650eb36db20e54/verification.json) | Succeeded, 0 errors / 640 warnings, 27.28 s; matching final source, 464 fingerprinted files; same fixture exclusions |
| Windows release/exclusion | [verification](../../../Builds/M4-Shooter-20261013/Release-11cb716b49f54f848baf490bac277285/verification.json) | Succeeded, 0 errors / 724 warnings, 71.09 s; matching final source, 266 fingerprinted files; fixture assets/MonoScripts/assemblies, debug authoring/scene and development inspection markers excluded |

Each build retains native `audit.json`, `LastBuild.buildreport`, scene/packed-asset lists, executable/UnityPlayer/data fingerprints, GUID and report hashes. Warning-heavy MCP responses were partial/error although native builds succeeded. The build-wrapper int/uint compilation mismatch started no build and was corrected in temporary tooling. The M3 hashing/exclusion algorithm is reused as tooling, not historical build proof. No pre-task M1–M3/teardown runtime evidence closes M4; retired `161f6ab` supplies ordinary weapon/scaling provenance only. Current-task compatible reuse above is independently reviewed, not a fresh single-checkpoint 168-case pass.

Changed files, with new Editor-generated metas: `E/Attacks/Shared/{IEnemyAttackExecution,EnemyAttackRequest,EnemyAttackCommitment}.cs`, `E/Attacks/Bolt/EnemyBoltExecution.cs`; `E/Behavior/{EnemyBehaviorProfile,Contracts/EnemyActionStatus,Nodes/ExecuteEnemyAttackAction,Nodes/RequestEnemyAssignmentAction}.cs`; existing `EnemyBehaviorContext`, `Nodes/EnemySeekPositionAction`, `Perception/EnemyPerception`, `PrototypeEnemy`, `Attacks/Projectiles/EnemyProjectileService`; `Editor/EnemyShooterFixtureBuilder.cs`; `Debug/EnemyBehavior/OrdinaryShooter.{asset,prefab}`, `OrdinaryShooterProfile.asset`; `T/EditMode/EnemyBehaviorAttackTests.cs`, `T/PlayMode/{EnemyBehaviorCapabilityContractTests,EnemyBehaviorShooterFixture,EnemyBehaviorShooterTests}.cs`; retained `EnemyTracerCollisionTests` teardown; this plan/current brief/catalogue. `BoltAttackDefinition` has no semantic diff; validation stays bolt-owned, preserving service fallback. No package, production prefab/scene/terrain/saved NavMesh/default-registration changes or upgrades. Verification ended without committing or pushing; the user subsequently authorized a scoped M4 commit and push.

**Actual startup/manual access:** select `ProjectI.Tests.EnemyBehaviorShooterTests` or the capability fixture with the supported PlayMode runner. Tests load saved PlayTestScene and temporarily create terrain/stairs/lip/bridge, Normal/Large NavMeshData, explicit claims/query services at (400,0,400), and a runtime stage-definition clone. They register the child of OrdinaryShooter.prefab only for their owned session and restore owned state. The authored prefab points to `OrdinaryShooter.asset`: native Repeat → Try In Order → generic attack / bounded seek-investigation / bounded assignment wait-failure. Direct capability cases select LifecycleCounter.asset, avoiding another attack tick. Planner and executor retain the real muzzle; finite coarse sectors are seeded once where required. No persistent fixture host/services or convenient manual shooter sandbox is installed. PlayTestScene/Play alone and normal stages remain passive. M2 observation view remains separate; no M5 combined diagnostic/scenario system was added.

Three independent pre/post technical, gameplay and design/UX perspectives (`gpt-6.1-sol`, medium, read-only fresh contexts) and compact delta rechecks clear runtime source. Final technical cleanup recheck accepts n and compatible reuse. Human gameplay/readability was not performed. Real two/four-peer cases prove interface authority, dynamic movement/cues and server releases with scene synchronization disabled and duplicate in-process physics isolated; they do not establish normal scene synchronization, built-player dodge timing, four-player balance or separate-network fairness.

Final preservation: E: project/6000.6.4f1, stopped/unpaused/compiled/imported, runner idle; saved PlayTestScene clean, enter-play options true/3, captured script preference 0 restored; Console errors/asserts/exceptions zero after builds. Source fingerprint unchanged. First native RED began 13 October 09:27:03 UTC; release audit finalized 13 October 13:35:23 UTC (14 October local), a measured verification/review/tool span of about 4 h 8 m. Time before the first request is unknown. Failed/import/review/tool costs are retained, not summed as gameplay performance.

**Decision/stop:** keep the isolated M4 shooter; its automated gate is complete. One native graph selects legal attacks and useful cover/stair movement, with validated releases, preserved paid recovery and independent launched flight. Stop at M4. Next is **M5 first-playable validation/diagnostics**, including actual human combat/readability. Full M16, built normal-stage combat/progression cohorts, hardware, separate-network latency/disconnect acceptance, manual sandbox/promotion, M6 coordination, M7 recovery/retirement and later roles remain open. Full M0 roster/specialist inventory stays deferred; only ordinary-shooter prerequisites were completed here.

### M5 execution packet — 14 October 2026

- Verified handoff: clean `codex/enemy-ai-rebuild`, `a783c6541f78c0abce005305f0f6dce5f581d4cb`, configured upstream 0/0. Connected MCP confirms E:/IndieGameProject/ProjectI, Unity 6000.6.4f1, stopped/compiled/imported, clean saved PlayTestScene, runner idle and Console errors zero. C: checkout absent. Pins unchanged. Task start recorded at first tool invocation; exact operation timing will be retained below.
- Intent/hypothesis: an explicitly launched runtime-only Editor sandbox makes real M4 cover/stair/close combat repeatable without changing normal-stage defaults. Independent manual input, owner-based observational diagnostics and reset of all old fixture work must survive repeated launches. Hidden aim updates, script steering in manual mode, old claims/emissions after reset or client authority contradict the slice.
- Lead is sole writer/Editor owner. High lifecycle/shared-state risk. Three independent read-only pre-reviews (`gpt-6.1-sol`, medium: technical, gameplay, design/UX) recommend proceeding with explicit ownership, truthful partial stubs and human acceptance limits. Post-review and compact delta checks remain required.
- Smallest slice: Editor-only launcher/window and fixture-assembly scenario driver/diagnostic capture; reuse OrdinaryShooter assets and M4 temporary geometry pattern. Temporary navigation only. Separate manual one/three-shooter combat from five explicit scripted cases. Reset composes retained player vitals/ammo/cooldown reset with accepted fixture placement and real actor/service cleanup. The enabled baseline controller retains practice/menu identity while an explicitly acquired development fixture owner suspends its spawn/reset ticks. Standard host practice-reset requests route to that same owner. No production debug channel, later policies, execution base, new subgraphs, tuning or upgrades.
- Files/owners: new Debug/EnemyBehavior driver and diagnostics, Editor launcher, diagnostic/scenario tests; narrow development-only owner inspection/cancellation attribution where missing. Existing plan/brief/catalogue updated in place. All production bindings, manual terrain/saved NavMeshes and source GUIDs preserved.
- Proof: meaningful RED then diagnostic purity/native five scenarios, independent instances, manual handoff/reset/startup cleanup and actual loopback host/client movement/cues/projectile receipt with zero client authority. Freeze source, full EditMode and affected M1–M4/navigation/projectile/passive regressions once; normal/debug/release builds with fixture/type/marker exclusion. Exact positive discovery and immutable final manifests required. Full M16 is excluded. Compatible unchanged historical proof will be identified explicitly, never called fresh GREEN168.
- Duration estimate unknown until new fixture launch/reset is exercised. Escalate failed ownership/readiness, unsafe terrain, changed weapon/progression contracts or release exposure. Stop at M5 implementation/automated evidence; human combat/readability, hardware and separately controlled network acceptance remain pending unless observed. Pursuit expiry proves finite assignment only (partial M6); disconnected ground proves current bounded refusal only (partial M7).

**Manual startup/reset (Editor only):** with the compiled Editor stopped and Test Runner idle, open **ProjectI > Debug > Enemy AI > Shooter sandbox**. Choose **Manual: one shooter** or **Manual: small group (3)**; wait for **Manual ready**, then focus Game view. The launcher temporarily selects saved PlayTestScene as the Play Mode start scene and uses a genuine stopped-session reload; it restores the prior start scene and enter-play settings on exit. This avoids both original-scene auto-host races and retained NGO test-provider state. Do not compile/reload an active NGO session. Pressing Play alone does not install this sandbox or activate ordinary shooter defaults.

WASD/mouse, LMB fire, RMB aim, Shift sprint, Space jump, R reload, 1/2 weapons, Q/F/C actives, Z ultimate, V melee, Escape menu, Tab inspection retain their existing controls. The player starts at `(400,0,403)`; shooters are across the central cover toward negative Z (turn toward them). Cover has left/right exits; actual stairs and an alternate ramp lead to the upper landing toward positive Z; the narrow bridge is toward positive X. Rush/flank manually; no automation moves or aims for the player after manual setup. **F5**, the panel's **Reset current fixture**, and the existing host practice-reset button restore the selected population plus health/ammo/cooldowns/accepted fixture position, even while downed. Manual buttons cancel a running scripted case and report cancellation. Use **Stop sandbox / restore Editor scenes** for confirmed NGO shutdown then restoration; ordinary Editor Stop also passed a separate smoke check. No saved terrain/navigation/scene edits are needed.

Choose a **Scripted case**, then **Run selected scripted case** only when wanted. Scripted setup can place the player or create/remove obstacles and seed one finite coarse sector; graphs still select their own actions, and only genuine perception supplies attack evidence. **Observe live owners** is independently opt-in; closing diagnostics does not select targets, sample sight, spend queries, purge leases or advance execution. It shows active state separately from last query/cancellation/commitment history, original observation source/age, accepted route and unpurged claim lease. Sampled visibility/reaction is explicitly not release permission; Deferred is waiting, not unreachable. The existing M2 observation view remains available.

**Five situation assertions:** wall/alternate exit retains original hidden evidence and withholds new releases through physical cover, then removes the scripted wall to prove sight-based correction/release; it does not establish human alternate-exit counterplay. Stairs requires vertical/forward travel over twelve real risers and a legal close landing shot. Bottleneck uses two independent graphs/shared services, invalidates an actually accepted destination, checks old claim release, then measures resumed bridge throughput and separation. Pursuit expiry is **PARTIAL — M6 pending**: finite sector expiry, bounded stopped travel, no renewal/hidden aim/fire and retained prior damage. Disconnected recovery is **PARTIAL — M7 pending**: native NoPath, no unsupported travel/warp/healing/retirement; existing legal ranged opportunities are not prohibited. Neither stub implements future coordination/recovery policy.

**Dependency/state-owner walkthrough:** `PrototypeEnemy` owns identity/health/status/scaling; host/context own validated lifecycle and typed bindings, with no bolt fields. Perception owns real evidence/reaction/selection; positioning owns captured inputs/pending queries/results; movement owns accepted routes and the sole normal movement write; fixture-owned claims/budget own leases/FIFO allowance. Bolt alone owns preparation, immutable commitment, payment/deadline, shot identity and cancellation. Projectile service alone owns launched flight/collision/damage. Driver owns setup/events/reset generation; diagnostics own display/history only. Trace: generic node captures genuine personal evidence/token → bolt validates and pays preparation once → later graph tick captures commitment → following tick revalidates target/sight/captured lane and consumes shot identity before admission → service owns independent flight → completion/cancel invalidates only that action and retains recovery → host invalidates before End/unwind. Fixture reset shuts down/despawns old actors before cancelling encounter-owned flight. No execution-base extraction, unrelated role fields/interfaces, subgraphs or production binding/default changes; M8 remains the second-implementation reuse gate.

**Review/iteration:** independent pre/post technical/gameplay/design-UX reviews plus compact deltas identified and cleared acquisition-before-validation cleanup, incomplete failure unwind/readiness, release-retained diagnostic expressions, loss of practice-menu identity, stale cancellation display and shutdown-task-versus-network termination. The new failure regression reproduced Ready incorrectly remaining true before its fix. First native run b passed 8/9, d passed 12/13; remaining peer failures were fixture setup (duplicate in-process physics, then unsupported scene-service spawning without scene sync). A new Editor-authored standalone `ProjectileService.prefab` binds the actual retained service for this peer test only; tests restore the encounter binding after shutdown. Focused peer e passes 1/1. Actual launcher g failed on late scene loading/NGO retained-provider state; h passed one/three actors, independent manual control, panel Stop, ordinary Stop and clean relaunch/restoration. These failed attempts remain retained and are not GREEN. No tuning was performed.

**Final frozen verification:** source/assets/settings/package SHA-256 `CA49B3E2D96B000A08A9AB88189ADC1A3A855D8B2EF2DB873D556E74509375BB`, HEAD `a783c6541f78c0abce005305f0f6dce5f581d4cb` plus this uncommitted M5 slice. The original integrated checkpoint was `7C0F021B833D041D01F851BFAC96AF09EC8801ED88C79FAFE4146D96718DC391`. Its 182-case request had **181 passes/one failure**, in the retained M2 held-fire prerequisite: the newly included debug-reset fixture returns through MainMenu, restoring the user's saved nonautomatic first weapon (observed local preference 3/1). Focused j reproduced it. The sole final delta explicitly equips/waits for the automatic weapon needed by that test, preserving every held-fire assertion. No runtime/assets/settings changed. In-memory removal of those four test lines reproduces the entire original 7C source hash exactly. Technical review accepts compatible reuse of the other 166 unchanged leaves, with 16 reset/perception leaves freshly rerun; this is **not fresh GREEN182**.

| M5 gate/evidence | Actual result and identity/limits |
| --- | --- |
| [Original integrated native i](../../../TestResults/foundation-runs/enemy-m5-integrated-native-20261014i-8a30325bec354d6b895fe3254d15b2f8/result.json) | 181 pass/1 fail, 182 exact discovered leaves, 200.14 s, 7C source. All 13 M5 cases pass, as do 37 M4, 23 M1, 38 navigation, 54 projectile, passive and debug reset. Overall request remains failed |
| [Fresh reset → perception k](../../../TestResults/foundation-runs/enemy-m5-reset-perception-20261014k-ebfbf79075194c40b1e598d1414b6d34/result.json) | GREEN16/16, 24.14 s, final CA49 source; actual debug-reset return precedes all 15 perception cases |
| [Final native coverage manifest](../../../TestResults/enemy-m5-final-coverage-20261014-8ec9aecde95540ce8e4dd575b4e0297f/coverage.json) and [source replay](../../../TestResults/enemy-m5-final-coverage-20261014-8ec9aecde95540ce8e4dd575b4e0297f/source-replay.json) | 182 unique required leaves covered by 166 compatible unchanged passes from i + 16 fresh k; exact XML/discovery, no duplicates/missing/skips, matched terminals, no ownership conflict. Source replay proves only the test prerequisite changed |
| [Full EditMode l](../../../TestResults/foundation-runs/enemy-m5-integrated-editmode-20261014l-afd44c174d8d4a2c9c52e315fabdfe3e/result.json) | GREEN1,097/1,097, 93.28 s, final CA49 source; one genuine stopped-session reload. No full PlayMode/M16 claim |
| [Actual manual launcher h](../../../TestResults/enemy-m5-manual-smoke-20261014h/one-ready.txt), [group](../../../TestResults/enemy-m5-manual-smoke-20261014h/group-ready.txt), [panel Stop](../../../TestResults/enemy-m5-manual-smoke-20261014h/after-panel-stop.txt), [toolbar Stop](../../../TestResults/enemy-m5-manual-smoke-20261014h/after-toolbar-stop.txt) | One/three actors ready, three private graphs, manual motor enabled, practice identity retained; clean relaunch; both Stop routes restore original clean PlayTestScene, true/3 enter-play options, empty start-scene override, zero driver/temporary terrain and unchanged 13 authored prefabs. Game-view capture inspected; no human combat/readability judgement |
| [Normal Windows development](../../../Builds/M5-Validation-20261014/NormalDevelopment-e3e6b64d92dd51095567d59a8fb7d785/verification.json) | Succeeded, zero errors/604 warnings, 58.66 s, 428 fingerprinted files; final CA49 source before/after; project fixture assets and fixture/test/Editor assemblies excluded |
| [Debug Windows development](../../../Builds/M5-Validation-20261014/DebugDevelopment-d87495ccefbafddd11be5a6c98a96f22/verification.json) | Succeeded, zero errors/640 warnings, 16.90 s, 431 fingerprinted files; final CA49 source before/after; same project fixture/assembly exclusions |
| [Windows release/exclusion](../../../Builds/M5-Validation-20261014/Release-0d4b0a8842c4f13a987532edb8c2ab51/verification.json) | Succeeded, zero errors/741 warnings, 39.99 s, 236 fingerprinted files; final CA49 source before/after; fixture assets/MonoScripts/assemblies, development authoring/scenes and all new compiled diagnostic accessor/attribution markers excluded |

Each build retains native `audit.json`, `LastBuild.buildreport`, scene/packed-asset inventory, full executable/UnityPlayer/data fingerprints and report/fingerprint hashes. Warning-heavy MCP replies were partial/error despite successful native reports; tool status alone is not build proof. Temporary wrapper compilation errors (nested audit type, integer counts, unavailable JSON dependency) started no build. A scheduled callback was positively found pending with no build/output and removed by exact owned method before direct execution. The first normal audit erroneously matched package Editor metadata; [its retained rejection](../../../Builds/M5-Validation-20261014/NormalDevelopment-e3e6b64d92dd51095567d59a8fb7d785/initial-audit-rejection.json) explains the corrected project-owned exclusion scope. No actual build was repeated.

The M4 evidence earlier in this record is preserved with its original checkpoints and limits; it is not folded into the M5 native manifest. Older M4/teardown records supply unchanged-boundary provenance only, not new M5 proof or a fresh GREEN168. New source/runtime/fixture behavior, all 13 M5 cases and relevant normal passive reset are covered by this task's native checkpoints; final EditMode and builds are fresh. Full multi-hour M16/PlayMode, built normal-menu/progression/combat cohorts and latency/disconnect campaigns were not rerun: there is no production promotion/default binding change, and this slice's loopback authority proof remains explicitly narrower than independently controlled built network play.

**Changed files (plus Editor-generated metas for new assets/scripts):** new `Debug/EnemyBehavior/{EnemyBehaviorScenarioDriver,EnemyBehaviorDiagnostics}.cs`, `ProjectileService.prefab`, `Editor/EnemyBehaviorSandboxWindow.cs`, `T/EditMode/EnemyBehaviorDiagnosticTests.cs`, `T/PlayMode/EnemyBehaviorScenarioTests.cs`; modified fixture asmdef (existing Input System reference), `E/Attacks/Bolt/EnemyBoltExecution.cs` development observation/counters/history, `E/Navigation/{EnemyPositionClaims,EnemyPositioning,EnemyQueryBudget}.cs` read-only development inspection, `Features/Debugging/PlaytestSceneController.cs` acquired fixture reset/spawn ownership, `Features/Combat/PrototypePlayerCombat.cs` development-only host reset routing, the retained perception test prerequisite above, this plan/current brief/catalogue. `E`/`T` abbreviations retain section 5's meaning. No generic host/context/node/attack contract/profile/weapon/scaling changes. OrdinaryShooter graph/prefab/profile and all production scenes/prefabs/manual terrain/saved NavMeshes/default registration/GUIDs/packages/settings have no diff. No commit/push or purchases.

**Actual time/estimate:** first new source file was written at 01:18:50 AEDT on 14 October; final source froze at 02:15:29 (56 m 39 s of implementation/review/iteration, including overlapping tests/tool waits). Final release audit completed at 02:30:12: measured file-write-to-final-audit span **1 h 11 m 22 s**. Preflight reading/review before that first file was not timed. Ten retained test requests total 457.29 s of execution; three builds total 115.55 s: **9 m 32.84 s** of serialized measured test/build execution, excluding discovery/publication/import, manual reload/smoke, hashing and review. The final selected proof consumes 200.14 s original native + 24.14 s affected repair + 93.28 s EditMode + 115.55 s builds. These overlapping wall-clock/operation figures must not be added as separate task totals or gameplay performance. Remaining M6–M16 engineering/automated verification estimate: roughly **40–80 hours**, low confidence, based on the recorded milestone spans and remaining coordination/recovery/role/integration boundaries; refine at each scoped slice. M17 human/hardware/separate-network scheduling remains unknown; this is not a delivery date.

**Decision/stop:** **keep for further manual testing**. M5 implementation, scripted/diagnostic/native/build proof and all three independent source review perspectives are complete within the recorded checkpoint/reuse/loopback limits. No numerical tuning occurred. The complete M5 human gate remains **pending**: play cover/alternate exits, actual stairs and close rushes with one/three shooters; judge whether cover gives understandable safety, shot cues are readable and movement has purpose. Representative hardware, independently controlled two/four-player combat and separate-network fairness also remain pending. Stop at M5; the next implementation milestone is **M6 moving pressure and squads**, after the human keep/tune decision. No M6 coordination/reassignment, M7 recovery/retirement, melee/later roles or production promotion was implemented.

Final [Editor readiness/preservation](../../../TestResults/enemy-m5-final-coverage-20261014-8ec9aecde95540ce8e4dd575b4e0297f/final-editor-readiness.txt): E: project/6000.6.4f1, stopped/unpaused/not compiling/importing/building, runner idle, saved PlayTestScene clean, original true/3 play options and script-compilation preference 0 restored, empty start-scene override, no manual fixture owner/driver, default prefab list 13. Console error/assert/exception count zero. Final native `git ls-remote` confirms remote branch still at `a783c65`; HEAD is unchanged. Source fingerprint remains CA49 after documentation updates. Whitespace/preservation checks pass; packages/settings, production content and existing GUIDs have no diff.

#### M5 human cover feedback — corrective slice, 14 October 2026

- Actual manual observation: the user reported initial seeking followed by stationary behavior after returning behind cover. [Untouched live snapshot](../../../TestResults/enemy-m5-live-cover-20261014-210841-8303e1ad7cc648fb9b961e3e29dd2996/snapshot.txt), [FOV/geometry](../../../TestResults/enemy-m5-live-cover-20261014-210841-8303e1ad7cc648fb9b961e3e29dd2996/fov-and-geometry.txt) and [natural peek/cover trace](../../../TestResults/enemy-m5-live-cover-20261014-210841-8303e1ad7cc648fb9b961e3e29dd2996/transition-trace.tsv) preserve the reproduction. While sight was lost but its three-second memory remained fresh, queries repeatedly returned Ready, planning calls rose 966→1021, movement reported Completed with zero travel, and actor position/facing did not change. At expiry it correctly exhausted evidence; that later M6 boundary does not explain the preceding wasted investigation window.
- Root cause: personal memory was scored as a currently useful firing lane to the old point; `lane && current` repeatedly selected zero-distance plans. The lane evaluator assumed facing toward evidence, but the real executor never turned the actor. No claim/query-budget lock, authority failure or Console error was observed.
- Hypothesis/smallest correction: preserve stationary firing holds only for current sampled sight; remembered personal evidence must produce supported progress or a useful new angle toward its captured location, or an explicit bounded failure/arrival. Turn gradually along actual accepted route movement and finish facing the captured personal point in the existing movement owner, with a captured provisional 180°/s ceiling. Keep original evidence expiry, actual clearance/reaction, root/stun, tokens/lifetimes, commitment/payment/scaling and independent flight. No hidden-player polling, memory extension, assignment renewal or M6 policy.
- Lead remains sole writer/Editor owner. Three read-only technical/gameplay/design-UX pre-delta reviews (`gpt-6.1-sol`, medium) support the correction and its bounded scope. User authorized stopping the captured session; Editor subsequently confirmed already stopped, clean, pinned, imported/compiled and runner idle before source edits. Preserve all existing M5 edits plus the new user-owned `Assets/_Recovery` files. No active-session hot reload.
- RED proof: new actual retained-cover/zero-travel, hidden-relocation comparison and visible-hold regression; add status/expiry/facing admission proof as needed. Then focused M3/M4/M5 native checks, source freeze, fresh affected native/full EditMode and necessary three builds/exclusion. Earlier CA49 automated/build results remain historical for their checkpoint; a runtime correction invalidates their affected behavior proof. Human retest remains required. Duration unknown; stop at the corrected M5 boundary.
- Implemented in the existing positioning/movement owners: personal evidence permits hypothetical lane evaluation to its captured point; captured sampled sight alone permits the current-position hold. Remembered candidates need a supported noncurrent clear angle or ≥0.5 m progress when no lane exists. Accepted route yaw follows validated actual planar displacement; immutable optional `EnemyMovePlan.ArrivalFacingPoint` then realizes the captured personal orientation assumed by lane scoring. Coarse/hearing/direct plans default to no arrival-facing point. Startup-captured authored `maximumTurnDegreesPerSecond` is provisionally 180°/s (finite >0 and ≤360). The same owner validates finite arrival input and renews its matching claim during bounded arrival yaw. Root pauses translation/yaw; stun cancels; original evidence deadline still stops unfinished turning. Diagnostics explicitly label captured intent/arrival history and withhold any release permission. No weapon/profile/scaling or production binding changes.
- Focused proof: [m RED](../../../TestResults/foundation-runs/enemy-m5-cover-red-20261014m-0169d9d8af544f1688e69414f053c103/result.json) is 1 pass/2 expected failures on old behavior; both failed on missing useful memory travel. [n](../../../TestResults/foundation-runs/enemy-m5-cover-green-20261014n-96f8edef026943f8964a16ab608fcf71/result.json) passes all five corrected cases (15.71 s). Review requested a genuine second engagement: [o](../../../TestResults/foundation-runs/enemy-m5-cover-repeat-20261014o-5852bab5d7194d2abdd034b23dec7a6d/result.json) remains failed fixture timing evidence (yaw compared against the following frame's delta). Capturing the executed LateUpdate frame allowance fixes attribution without changing the bound or runtime. [p](../../../TestResults/foundation-runs/enemy-m5-cover-repeat-20261014p-eeba0719a7114ef8b25f1884fe6ecdfd/result.json) passes the two-peek case (6.64 s).
- Regression-driven refinements: [q](../../../TestResults/foundation-runs/enemy-m5-cover-integrated-native-20261014q-6b1cb01794554f32ac8d715e622a0a15/result.json) remains **184 pass/3 fail**, 187 exact leaves, 201.58 s at 6DE source. [Read-only stair trace](../../../TestResults/enemy-m5-cover-validation-20261014-fc281548288ffae051230b5e67/stair-facing-trace.txt) confirms lateral arrival at `(403.88,0,407)`, forward +X, Completed 3.88 m, zero actions/releases and expired sight to `(400,4.68,419)`; [r](../../../TestResults/foundation-runs/enemy-m5-stair-facing-trace-20261014r-977c0d6955744d3ab0fde739da9bb520/result.json) retains that product failure. Arrival-facing fixes stair-lip firing. [s](../../../TestResults/foundation-runs/enemy-m5-cover-arrival-native-20261014s-0b5b579980a24b8cabcb3f27a802c416/result.json) remains **71 pass/2 fail**, 73 leaves, 120.69 s at 2477 source: cover detours still needed the noncurrent hypothetical lane distinction; strict distance-only usefulness was reverted. [Group owner trace](../../../TestResults/enemy-m5-cover-validation-20261014-fc281548288ffae051230b5e67/group-owner-trace.txt) shows actual allied Body/Head occlusion at 1.4/1.6 m. Same group geometry/positions/fairness/distinct-arrival assertions are retained; current-visible holds keep the original <0.3 m stability assertion, while occluded actors must select >0.3 m investigation, with both branches required. `Saw` now requires a visible sample newer than its authored rotation. No skip, hidden visibility, deadline relaxation or terrain change.
- [w group](../../../TestResults/foundation-runs/enemy-m5-group-occlusion-20261014w-102793048d394bc4bf380dc1e244b1fb/result.json) and [x retained cover](../../../TestResults/foundation-runs/enemy-m5-cover-detour-20261014x-ce2b820365054742897220001e9342f5/result.json) each pass at 7029 source. Failed t/u attempts are diagnostic instrumentation errors (M3 has an optional unassigned eye and no bolt component), retained separately from product proof; v uses actual M3 owners/fallback and confirms physical occlusion. Three independent final post-delta perspectives and compact rechecks clear source. Final integrated source froze at `BDFC4E3A72876C86E570C58F79072D77D4068743547E62A691977DAE35D2F1C8` at 21:50:00 UTC / 08:50:00 AEDT. Fresh final proof follows below; historical CA49/6DE/2477/7029 results retain their original attribution.

| Final corrective proof — all BDFC source | Actual result |
| --- | --- |
| [Native y](../../../TestResults/foundation-runs/enemy-m5-cover-final-native-20261014y-733f77761ed942dcb66fca07cca5d405/result.json) | **GREEN190/190**, 203.34 s. Exact discovery/XML, zero skips/failures/conflicts, matched terminal. Eight investigation, 13 M5, 10 capability, 27 shooter, 23 lifecycle, 15 perception, 38 navigation, 54 projectile, passive and debug-reset leaves. Includes real local host/client and four-peer authority; no independently controlled network claim |
| [Full EditMode z](../../../TestResults/foundation-runs/enemy-m5-cover-final-editmode-20261014z-8b988577fd5245e291eab2ea210861da/result.json) | **GREEN1,103/1,103**, 15.52 s; one genuine stopped-session reload, full current assembly, unchanged true/3 play settings |
| [Normal development](../../../Builds/M5-Cover-Validation-20261014/NormalDevelopment-db30a93f1405f70bcd88e431f142f0f6/verification.json) | Succeeded, zero errors/604 warnings, 58.45 s, 457 fingerprinted files; fixture assets/Editor/test/fixture assemblies excluded |
| [Debug development](../../../Builds/M5-Cover-Validation-20261014/DebugDevelopment-0659d75c5d7a7ef3fb4e2ddd0af45c71/verification.json) | Succeeded, zero errors/640 warnings, 15.62 s, 460 fingerprinted files; same project exclusions |
| [Release](../../../Builds/M5-Cover-Validation-20261014/Release-e08af08be1523b0e5cf5f4e9089d5e39/verification.json) | Succeeded, zero errors/741 warnings, 37.48 s, 262 fingerprinted files; fixture/development assets and all audited diagnostic markers excluded |

[Final coverage/timing manifest](../../../TestResults/enemy-m5-cover-validation-20261014-fc281548288ffae051230b5e67/coverage.json) validates exact final leaves and all three native reports/fingerprints. These 190 native leaves are fresh at BDFC; **zero historical affected-leaf reuse**. Earlier CA49 M5 coverage and M4 checkpoints retain their own identities/limits. Full M16, built normal-stage campaigns, latency/disconnect, representative hardware and separately controlled network play remain omitted for the same isolated-scope reasons above. Public `BuildPipeline.BuildPlayer` ran once per build; the first wrapper's prohibited Reflection namespace import was rejected before any build. The working wrapper uses external measured SHA-256 immediately before/after the native operation, preserving source attribution without private Editor reflection. Warning-heavy MCP replies remain partial despite native success; no build was repeated. Native reports, packed-asset/scene inventories and complete player/backup fingerprints are retained.

Corrective files: new `T/PlayMode/EnemyBehaviorInvestigationTests.cs`/meta; modified `E/Navigation/{EnemyMovePlan,EnemyMovementExecutor,EnemyNavigationDefinition,EnemyPositioning}.cs`, existing M5 diagnostics, `T/EditMode/EnemyBehaviorPositionTests.cs`, `T/PlayMode/EnemyBehaviorNavigationTests.cs`, plan/brief/catalogue. Bolt/weapon/profile/scaling, generic host/context/nodes and production content have no additional corrective changes. All earlier M5 dirty work and user-owned `Assets/_Recovery` remain preserved; no commit/push. [Stopped Editor preservation](../../../TestResults/enemy-m5-cover-validation-20261014-fc281548288ffae051230b5e67/final-stopped-editor.txt) confirms E: / 6000.6.4f1, stopped/unpaused/compiled/imported/not building, runner idle, saved PlayTestScene clean, true/3 options, empty start-scene override, script-compile preference 0 and zero fixture drivers before manual relaunch. Console errors zero.

Actual corrective timing: first regression file at 21:23:28 UTC, final release audit at 21:59:32 UTC: **36 m 4 s** file-to-audit wall span, including implementation/review/import/verification waits. Live investigation and user waiting before that first file were not timed as engineering. Fourteen retained requests total **617.99 s** execution (including failed product/fixture/instrumentation attempts); three builds total **111.55 s**, **12 m 9.54 s** serialized measured execution. Final selected proof consumes 203.34 s native + 15.52 s EditMode + 111.55 s builds. Do not add nested wall and execution durations or treat them as gameplay performance.

Decision: **keep for further human testing**. The original zero-travel loop is corrected; distance-only investigation was refined to retain useful lateral angles, and route-only facing was refined to finish at the captured arrival orientation. Retain provisional 180°/s pending feel/readability feedback; do not tune memory/weapon values without a new recorded hypothesis. Relaunch using the unchanged menu route above; F5 resets. Retest two peek/hide cycles, an unseen opposite exit, lateral cover approach, actual stair landing and close rushes with one/three shooters. Cover must withhold new shots until genuine reacquisition; hidden relocation must initially mislead investigation. Staying hidden beyond three seconds still exhausts evidence: M6 pressure/reassignment and M7 recovery remain partial, unimplemented boundaries. Human retest/readability, hardware and separate-network acceptance remain **pending**. Stop at M5; M6 is next only after the human keep/tune decision.

Manual handoff: [supported one-shooter relaunch](../../../TestResults/enemy-m5-cover-validation-20261014-fc281548288ffae051230b5e67/manual-reopened.txt) confirms the corrected E: project in Play, Ready, generation 1, one actor with its actual graph running and runner idle. This is startup evidence, not human acceptance. Session remains open for the user's retest; no active-session source edits or reload were performed.

#### M5 native visual graph — 14 October 2026

User requested native authoring/live-tree access after the runtime-only shooter graph could not open in Unity's visual debugger. Hypothesis: native Start (nonrepeating) → Repeat → Try In Order (attack, bounded seek, assignment wait), native profile variables and generated node/authoring IDs preserve behavior while exposing actual private-instance node statuses. Keep existing graph GUID/runtime file ID/prefab reference, Context/Self privacy, .5 s profile values, all prior dirty work/user Recovery and normal-stage defaults. No active NGO reload, custom tree viewer, tuning, M6+, packages, commit or push.

Lead owns writing/Editor; three independent read-only technical/gameplay/design-UX pre-reviews (`gpt-6.1-sol`, medium) support conversion and require profile rebuild parity, compiler X-order, debugger instance linkage and source preservation. Uncertain compiled asset/binding/state ownership risk uses all three pre/post perspectives. Files: existing shooter builder, two custom node profile declarations/access, OrdinaryShooter asset/meta main-object identity only, existing sandbox UI, focused graph authoring/native inspection tests and docs. Supported Editor asset APIs plus the established M1 pinned-package reflection pattern; no package edits.

Proof/stop: meaningful RED authoring/profile contract; native compile, save/reimport/second rebuild with GUID/reference/profile/order assertions; freeze then full EditMode and affected shooter/investigation/scenario/navigation/lifecycle proof, necessary builds/exclusion; actual native graph open/attach/switch/reset and observed node mapping, no graph restart/control side effects. Reuse only compatible unchanged proof explicitly. Duration unknown. Stop with native graph and convenient live inspection, leaving human combat/hardware/separate-network judgement pending.

Native graph access: launch the usual one/three-shooter sandbox, choose **Live graph target**, then **Open live Behavior graph**. The native toolbar should show **Debug (Sandbox host shooter …)**. Enable **Auto-Connect Debugger** in its Debug control if disabled, or choose the desired host actor there. Its six node visuals show actual execution states; inactive/unvisited nodes may have no status icon. Select another target/open again to switch. Reset creates new object/spawn identities, so choose/open the replacement actor again. Owner diagnostics remain useful for evidence, commitments and cancellation. Authoring is editable with the session stopped; keep active NGO source/graph rebuild unsupported. OrdinaryShooter.asset is now the visual main asset, with the original runtime graph retained as subasset and prefab source reference unchanged.

Focused evidence: [a RED](../../../TestResults/foundation-runs/enemy-m5-native-graph-red-20261014a-e90c2c01541c4dd19a4fe09201688395/result.json) fails all three intended native/main/profile contracts. First conversion stopped after native Start creation because `Position` is a field, not a property; explicit owned one-Start resume preserves the partial asset/GUID rather than recreating it. [b](../../../TestResults/foundation-runs/enemy-m5-native-graph-green-20261014b-9d4e9b5646cf4f39bfea782c67cab122/result.json) is 2 pass/1 fixture assertion failure (Slot was compared as a variable wrapper rather than its Value; native value was already `attack`). [c](../../../TestResults/foundation-runs/enemy-m5-native-graph-rebuild-20261014c-10575f2fe26e43059c04b562404f428a/result.json) is GREEN3/3 after second native rebuild/save/reimport, preserving graph GUID `fbc1f652f677fea44b886305a47f05c8`, runtime file ID `11400000`, prefab reference, profiles/order/cadence/private bindings and native debug IDs. The meta's main-object file ID intentionally changes to the authoring subasset; GUID/runtime ID stay fixed.

[A attachment/purity](../../../TestResults/enemy-m5-native-graph-20261014-62837c8d6452673f4ca5e9ebe9494fb1/attach-a-purity.txt), [A seek](../../../TestResults/enemy-m5-native-graph-20261014-62837c8d6452673f4ca5e9ebe9494fb1/native-ui-a.txt), [B assignment wait](../../../TestResults/enemy-m5-native-graph-20261014-62837c8d6452673f4ca5e9ebe9494fb1/native-ui-b.txt), [reset actual preparation](../../../TestResults/enemy-m5-native-graph-20261014-62837c8d6452673f4ca5e9ebe9494fb1/reset-preparing.txt) and [new actor attack](../../../TestResults/enemy-m5-native-graph-20261014-62837c8d6452673f4ca5e9ebe9494fb1/native-ui-reset-attack.txt) confirm native unique target labels, selected private graphs, all six matching visual/runtime IDs/status classes and positive layout bounds. Paused A/B differ in their real active branch; generation 2/new spawn 6 shows attack Running during genuine Preparation. Opening A leaves the same graph, actions/releases/planning-call counters and accepted plan unchanged in the same frame. Public SerializedObject/UI queries supply this proof; a blocked Reflection-based probe was replaced with those public APIs, and no private UI module pointer or screenshot workaround was used. Early probes guessed a popup toggle in the root and the wrong GUID namespace/enum/label; those diagnostic-only errors started no build or gameplay action. Source/evidence review accepts the stronger public correlation; this is native UI linkage proof, not pixel/human readability acceptance.

Final source froze after stopped-session restoration and closing the owned native window: `6D6F3A14D40384CCC7784803FB3C1E53DAC35BDA004201E647E8C1C1DA0D007C`, 22:34:23 UTC / 09:34:23 AEDT. All three post-reviews clear source; compact UX evidence recheck clears actual live linkage. Fresh affected native/full EditMode/build proof follows. Unity's generated authoring asset contains its normal empty-string trailing spaces; C#/docs whitespace is checked separately, with no hand-edited YAML cleanup.

| Final native-authoring proof — all 6D6F source | Actual result |
| --- | --- |
| [Affected native d](../../../TestResults/foundation-runs/enemy-m5-native-graph-integrated-20261014d-3a375e28483e40f1a994af8a956bb5b6/result.json) | **GREEN86/86**, 139.56 s: full shooter 27, investigation 8, scenario 13 and navigation 38 fixtures. Exact discovery/XML, zero failures/skips/conflicts, matched terminal; actual local host/client movement/cues/projectiles and independent graph/reset proof |
| [Full EditMode e](../../../TestResults/foundation-runs/enemy-m5-native-graph-editmode-20261014e-21c7c5e7c605419ca21b5839bb75975b/result.json) | **GREEN1,106/1,106**, 16.08 s, one genuine stopped-session reload; full current assembly including three native authoring contracts |
| [Normal development](../../../Builds/M5-NativeGraph-Validation-20261014/NormalDevelopment-b32839101086426e28fcffca62499d27/verification.json) | Succeeded, zero errors/604 warnings, 51.07 s, 457 fingerprinted files; project fixture assets/Editor/test/fixture assemblies excluded |
| [Debug development](../../../Builds/M5-NativeGraph-Validation-20261014/DebugDevelopment-f905a29382e8212ba903d2f48a08985c/verification.json) | Succeeded, zero errors/640 warnings, 15.11 s, 460 fingerprinted files; same project exclusions |
| [Release](../../../Builds/M5-NativeGraph-Validation-20261014/Release-3248b679d60c53ffad28f8d52fee629c/verification.json) | Succeeded, zero errors/741 warnings, 38.46 s, 262 fingerprinted files; native authoring fixture/development assets and audited diagnostic markers excluded |

[Final coverage/reuse/timing manifest](../../../TestResults/enemy-m5-native-graph-20261014-62837c8d6452673f4ca5e9ebe9494fb1/coverage.json) keeps 86 fresh leaves separate from **104 compatible unchanged leaves** in BDFC [native y](../../../TestResults/foundation-runs/enemy-m5-cover-final-native-20261014y-733f77761ed942dcb66fca07cca5d405/result.json): capability 10, counter lifecycle 23, perception 15, projectile 54, passive 1 and debug reset 1. Those selected source/asset/contracts do not execute the changed seek/assignment nodes or the shooter graph; their boundary proof remains compatible. This is not fresh GREEN190. Current graph execution/private-state/reset/remote behavior is established by d, with fresh full EditMode/builds. The initial final-summary timing filter matched no requests; its rejected artifact is retained beside the corrected exact five-request summary. Full M16, unchanged built-stage campaigns, human combat/pixel readability, representative hardware and separately controlled networking remain omitted/open. Warning-heavy MCP build replies were partial, but each native report/audit succeeded once with external frozen before/after source attribution.

Changed files: native `OrdinaryShooter.asset`/meta; existing `EnemyShooterFixtureBuilder.cs`, `EnemyBehaviorSandboxWindow.cs`, `EnemyBehaviorScenarioDriver.cs` (debug actor naming only), `E/Behavior/Nodes/{EnemySeekPositionAction,RequestEnemyAssignmentAction}.cs` (native profile variable inputs/access); new `T/EditMode/EnemyBehaviorGraphAuthoringTests.cs`/meta; plan/brief/catalogue. No prefab/weapon/profile/tuning/normal scene/navigation/package/settings diff from this slice; runtime object/GUID and prefab reference preserved. Prior dirty M5 work/user Recovery retained; HEAD remains `a783c6541f78c0abce005305f0f6dce5f581d4cb` on `codex/enemy-ai-rebuild`, no commit/push. C#/docs/asmdef whitespace checks pass; generated native YAML whitespace retained as emitted by Unity.

Actual time: first regression file at 22:15:05 UTC, final release audit at 22:42:04 UTC: **26 m 59 s** file-to-audit wall span, including implementation/review/import/native UI observation and verification waits. Earlier package/API preflight was not timed. Five retained runner requests total **164.59 s** execution; three builds **104.63 s**, **4 m 29.22 s** serialized measured execution. Final selected proof is 139.56 s native + 16.08 s EditMode + 104.63 s builds. Do not sum nested wall/execution timing or infer gameplay performance.

Decision: **keep native authoring/live debugging**, with behavior parity established within these automated/local-peer limits. Reopen the one-shooter sandbox and attach the native graph for user inspection. The graph is now editable through Unity's standard visual editor; edit/recompile only while stopped. M5 human combat/readability, hardware and separate-network acceptance remain pending; no M6+ behavior, promotion or complete human-gate claim. Next implementation milestone remains M6 after the human keep/tune decision.

Final [restored stopped Editor](../../../TestResults/enemy-m5-native-graph-20261014-62837c8d6452673f4ca5e9ebe9494fb1/final-stopped-editor.txt), [one-shooter relaunch](../../../TestResults/enemy-m5-native-graph-20261014-62837c8d6452673f4ca5e9ebe9494fb1/manual-reopened-native.txt) and [live native graph handoff](../../../TestResults/enemy-m5-native-graph-20261014-62837c8d6452673f4ca5e9ebe9494fb1/native-ui-final-live.txt) confirm E: / 6000.6.4f1, clean saved PlayTestScene and original true/3 options before launch, then Ready/playing/unpaused, one real graph and native target label/six matching node states. Console errors zero; opening the native window leaves frozen 6D6F source unchanged. Session and graph remain open for the user. Dock the native graph beside Game view to watch decisions while retaining player input; no active-session source/graph rebuild was performed.

### M5 human follow-up — route-facing and cover, 14 October 2026

The user reported that the live one-shooter fixture stopped seeking after they returned behind cover, then suggested that walking orientation turns its view away. Read-only observation preserved the running, unpaused manual session and all source/assets. [Retained trace and analysis](../../../TestResults/enemy-m5-live-followup-20261014-c29706e7fd70ff5fcb11fe9795f67548/analysis.json) includes the initial expired-state snapshot, an incomplete first recorder (900 samples ended before the requested peek; no onset proof), and the successful second natural peek/hide trace (1,023 samples, 32 visible, 00:08:22–00:09:15 UTC). No scripted player placement, fresh perception queries, behavior inputs, reset or pause were supplied.

The successful trace distinguishes two losses. At server time 957.424 the stationary shooter loses sight while the player is about 6.7 degrees from its facing; turning did not cause this first loss. It starts moving by 957.529, briefly reacquires personal sight at 957.852, then turns toward its route. The player reaches roughly 103 degrees from recorded root facing at 957.991, beyond the authored 90-degree half-FOV; the next sampled state is invisible at 958.043. `EnemyMovementExecutor` turns along actual route displacement and faces the captured observation only at arrival; `EnemyPerception` uses that root facing when no eye is assigned, as in this prefab. This coupling therefore excludes the player during part of transit. Rounded planar trace geometry establishes FOV exclusion; historical LOS rays were not captured, so occlusion may also contribute.

Seeking was not skipped: sampled travel after the first loss totals about 8.27 m across the lateral route and subsequent approach, including about 0.55 s facing the captured point at arrival. The last personal observation remains 957.852 and subsequent route deadlines remain 960.852. At 960.874, observation age 3.022 s, movement ends with `Movement limit`, no claim/pending work and `NoLegalPosition`; the player stayed alive and root/stun remained false. Paid recovery did not block seeking. The original three-second evidence deadline explains this stop; absent M6 assignment explains continued waiting afterward. Neither explains away the earlier route-facing limitation. Independent read-only technical review agrees with this distinction.

Decision: keep the fixture/native-debugging infrastructure; **human combat/readability acceptance remains pending, with a concrete facing/transit concern recorded**. No tuning or runtime change was made during this follow-up, and no tests/builds were rerun for read-only observation/documentation. A focused movement-facing follow-up must preserve captured evidence and real sight rather than track a hidden player's current position; M6 continuation remains separately scoped. User/generated `ProjectSettings/BehaviorSettings.asset` and Recovery files are preserved; the new settings asset is outside the previous 6D6F aggregate freeze, so that historical build identity is not asserted for the entire current working tree.

### M5 short-seek facing and perception tuning — 14 October 2026

**Authorized human follow-up:** short seeks should keep looking toward the player; increase memory to six seconds and sight to ±105 degrees. Hypothesis: facing captured personal evidence throughout a local seek prevents route yaw from throwing an otherwise visible player out of the cone, while finite memory and genuine occlusion preserve unseen-relocation counterplay. The movement owner now faces the immutable `ArrivalFacingPoint` during short travel, under its existing 180°/s, root/stun, ownership, support and deadline gates. Longer/nonpersonal routes retain travel-facing. Whole three-dimensional route length, including origin/destination tails, is classified once on acceptance; shrinking remaining distance cannot change mode. No hidden live position, extra writable blackboard, attack permission or M6 policy was added.

The lead's initial 4 m cutoff excluded an authored 4 m sidestep because native height offsets add endpoint tails: a 3.99 m endpoint measured 4.046663 m overall. Final configurable cutoff is therefore **4.25 m**, captured at startup; the native short-seek test now exercises the actual 4 m endpoint, with a 4.5 m long-route control. Below/equal/above whole-route thresholds, native U-shaped detours, startup capture, cleanup, root/stun and different hidden destinations are covered. This cutoff is provisional tuning, not a user-specified acceptance boundary.

`OrdinaryShooterPerception.asset` is a new isolated clone bound to the existing shooter prefab: **6 s memory / 210° total sight cone**, retaining .15 s samples and .25 s reaction. The shared M2 `Perception.asset` remains 3 s/180°. Builder creation preserves this separation. Real ±104°/±106° samples on both sides and an inside-cone physical blocker prove the widened boundary still requires actual clearance. Original six-second expiry, blocked releases, repeated natural peeks, captured aim, close fire, paid recovery and independent flight remain enforced. Diagnostics identify captured facing during short travel/arrival versus arrival only. Normal stages/Play alone remain passive; no production navigation or scene changed.

All three independent pre/post technical, gameplay and design/UX reviewers (`gpt-6.1-sol`, medium, read-only) clear the final source and measured-cutoff delta. Technical review independently checks final XML/discovery/identity. Lead alone wrote/integrated/operated the Editor. [Coverage, retained attempts, reviews and timing](../../../TestResults/enemy-m5-strafe-tuning-20261014-71a57a1695c24852b7ec0bb9d6f077e0/coverage.json) and [final freeze](../../../TestResults/enemy-m5-strafe-tuning-20261014-71a57a1695c24852b7ec0bb9d6f077e0/freeze-final.json) identify **E45BC1079CBDE05D2037E4FCD17AC790A7F52941626CEE7086D109CDDBD549DE**. Existing dirty M5 work, Recovery and user-generated BehaviorSettings are preserved; no commit/push/package upgrade.

| Final E45B proof | Actual result |
| --- | --- |
| [Native h](../../../TestResults/foundation-runs/enemy-m5-strafe-final-native-20261014h-f633da824427433f968650b03edde418/result.json) | **91/91**, 143.75 s: investigation 13, shooter 27, scenario 13, navigation 38; real local host/client cues/projectiles and four-peer authority remain covered |
| [Full EditMode i](../../../TestResults/foundation-runs/enemy-m5-strafe-final-editmode-20261014i-10db58dc8a804a24ab4e424e65b6e9c6/result.json) | **1,114/1,114**, 16.71 s, one genuine stopped-session reload |
| [Normal development](../../../Builds/M5-Strafe-Validation-20261014/NormalDevelopment-2d4adb54789ea4ba5d88f11b3de2ae94/verification.json) | Succeeded, 0 errors/605 warnings, 52.04 s; identity/exclusions and 461 file fingerprints verified |
| [Debug development](../../../Builds/M5-Strafe-Validation-20261014/DebugDevelopment-7a37b16e0b4266fabf277bcba5f946a7/verification.json) | Succeeded, 0 errors/640 warnings, 15.26 s; identity/exclusions and 464 file fingerprints verified |
| [Release](../../../Builds/M5-Strafe-Validation-20261014/Release-8b1b47cb08eaf833b1296a21146cf316/verification.json) | Succeeded, 0 errors/742 warnings, 38.50 s; fixture/development exclusions, diagnostic-marker absence and 266 file fingerprints verified |

All final tests have exact unique discovery/XML equality, zero failures/skips/conflicts and matched terminal ownership. Separately reuse **16 unchanged leaves** from [earlier g](../../../TestResults/foundation-runs/enemy-m5-strafe-integrated-20261014g-1a8be0f3698f422b8bb30dbcefa182dd/result.json), source `5CB9E985625002043C14F034064FBBC884AB456BD9CAEEDC9CD0E911B50D5506`: M2 perception 15 and passive 1 consume no navigation definition. Its full 107 pass at the earlier cutoff is not final fresh GREEN107. Earlier full EditMode f is superseded by i. RED a/b failed for the intended facing/shared-asset assertions; c/d retain the demonstrated endpoint-distance fixture mistake, e the corrected boundary pass. The measured cutoff change justified repeating affected proof only. Warning-heavy MCP build replies were partial; native reports and external frozen-source audits establish each successful build.

Changed source/assets: `E/Navigation/{EnemyMovementExecutor,EnemyNavigationDefinition}.cs`; debug `Navigation.asset`, `OrdinaryShooter.prefab`, new `OrdinaryShooterPerception.asset`/meta and `EnemyBehaviorDiagnostics.cs`; existing `EnemyShooterFixtureBuilder.cs`; investigation and position tests; plan/brief/catalogue. Graph identity, weapon/scaling, production bindings/terrain/NavMeshes remain preserved. Packet-baseline to final build audit: **28 m 59 s**, including implementation/review/import/testing. Nine retained runner requests total **382.41 s**, three builds **105.79 s**; final selected execution is 143.75 + 16.71 + 105.79 = **266.25 s**. Pre-packet preflight and final documentation/handoff were not included in that wall span; execution is not hardware performance evidence.

**Decision: keep for human retest.** [Manual handoff](../../../TestResults/enemy-m5-strafe-tuning-20261014-71a57a1695c24852b7ec0bb9d6f077e0/manual-handoff.txt) confirms E:/6000.6.4f1, Ready/manual/one shooter, playing/unpaused, live native graph attached, runtime memory 6 and authored FOV 210/cutoff 4.25; opening it leaves E45B unchanged and Console errors zero. Route remains **ProjectI > Debug > Enemy AI > Shooter sandbox → Manual: one shooter / small group (3)**; **F5** resets, **Open live Behavior graph** reattaches after reset, and **Stop sandbox / restore Editor scenes** safely exits. Retest short strafing, retained cover/alternate exit, close rush, long stair transit and group pressure. Human combat/readability, hardware and separately controlled networking remain pending. Full M16/unaffected normal-stage campaigns were omitted; no M6/M7 continuation or later role was implemented. Six-second expiry can still leave a waiting shooter until M6 supplies useful reassignment; next milestone remains M6 after the human keep/tune decision.

### M5 Scene observation overlay — 14 October 2026

The user requested a visual indication of remembered player evidence and intended movement. The existing Editor-only `EnemyPerceptionWindow` now draws **green sampled personal sight**, **amber remembered personal sight**, **grey expired history**, and a **cyan accepted move destination/full planned route**. Labels include target identity, original age and remaining memory; expiry takes precedence over sampled visibility. The full route includes travelled corners and is labelled accordingly. Reports remain crosses and hearing remains region boxes. The plan's immutable captured facing point is listed separately from latest personal evidence. These are observations of actual owners, not the hidden player's live position or new attack permission.

Use **Shooter sandbox → Inspected shooter → Show memory and move destination (Scene view)**. This selects the existing observer window and explicitly enables its markers. Keep **Scene** beside **Game**, then click Game to control the player. **Frame observer and markers** changes only the Scene camera; refreshing never frames automatically. Disable **Show Scene view markers** or close Enemy observations to remove the overlay. After **F5/reset**, choose the new actor and open observations again. A cyan destination exists only while the movement executor holds an accepted plan; grey history does not mean an active pursuit. Normal gameplay defaults remain unchanged.

Only four Editor/test source files changed: `EnemyPerceptionWindow.cs`, `EnemyBehaviorSandboxWindow.cs`, `EnemyBehaviorDiagnosticTests.cs` and `EnemyBehaviorInvestigationTests.cs`. Immutable ephemeral marker descriptions are shared by rendering, framing and tests; raw inspection snapshots and `AcceptedPlan` are read without selection, sensing, planning, lease purging or execution calls. Handles colour/depth and callback subscriptions are restored/removed. All three independent read-only technical/gameplay/design-UX pre/post reviews (`gpt-6.1-sol`, medium) clear this medium-risk observer boundary.

Final frozen source is **E69E73BFC2FB505B5CDB5CB13ABD14E2E058464B7B60F5FEDE6D7C94998D2C13**. [Final coverage/recovery record](../../../TestResults/enemy-m5-scene-observation-20261014-3713896d27a34c7f91ab70a284c4332a/coverage-delivery.json) retains six runner attempts: initial a had an unshown test-window teardown error masking assertions; corrected b produced the intended two RED assertions; c passed all three focused EditMode diagnostics. Fresh final [native d](../../../TestResults/foundation-runs/enemy-m5-scene-observer-native-20261014d-f36763cbc3444a89845d709067e857c8/result.json) passes the real hidden-memory/accepted-destination, eight-refresh/frame purity, cancellation, six-second expiry and despawn case (**1/1**, 11.14 s). [M2 view regression e](../../../TestResults/foundation-runs/enemy-m5-scene-observer-regression-20261014e-e57b590bfcaf46888f97759ea58f2230/result.json) passes **1/1**, 1.57 s. [Full EditMode f](../../../TestResults/foundation-runs/enemy-m5-scene-observer-integrated-20261014f-3e7891b7cc7c42fd99e9df2540bbf381/result.json) passes **1,116/1,116**, 17.25 s, one genuine stopped-session reload. Final discovery/XML/identity/terminal ownership is exact, with zero failures/skips/conflicts; independently audited by the technical reviewer.

[Player-input comparison](../../../TestResults/enemy-m5-scene-observation-20261014-3713896d27a34c7f91ab70a284c4332a/player-reuse.json) establishes an exclusively Editor/test delta. Reuse the preceding **E45B normal/debug/release builds and exclusion audits**, with their original identities/paths above; each retained project player DLL fingerprint was rechecked unchanged. No player build or unaffected combat/navigation suite was rerun, and none is presented as fresh E69B proof.

The [actual rendered overlay layer](../../../TestResults/enemy-m5-scene-observation-20261014-3713896d27a34c7f91ab70a284c4332a/scene-render-target.png) shows genuine remembered evidence plus an accepted route, paused only for inspection. UX review finds the amber dotted knowledge line and cyan ring/solid route legible and distinct. This black render-layer capture does not establish terrain-composite readability, green/grey or crowded multi-target rendering; those remain human checks, separate from native data assertions. A temporary latch harness initially used the wrong Editor callback delegate and registered no execution; the corrected harness is retained. Resuming/resetting the paused rendering session then timed out on accepted fixture placement. That primary harness/session failure is retained; no runtime repair was made. Confirmed stop and a fresh manual launch recovered the session. [Final handoff](../../../TestResults/enemy-m5-scene-observation-20261014-3713896d27a34c7f91ab70a284c4332a/manual-handoff.txt) proves Ready/manual/one shooter, playing/unpaused, live graph and overlay attached, Console errors zero. A later native graph authoring save changed only `OrdinaryShooter.asset`; it is preserved and separately attributed in the delivery record (source `923E52B08645C2D6B24D45517980A951EC0837BEDE8249222830B5DF179FE320`). Overlay/test/runtime C# and player-packed inputs remain unchanged. Read-only inspection confirms Start/Repeat/Try In Order with attack, seek and assignment order/bindings; this is not a fresh full-suite claim for the saved graph. Six runner requests total **31.94 s** execution; the final record includes packet-to-handoff wall time, excluding initial preflight/final prose. Decision: **keep for human testing**. M5 human combat/readability, hardware, separate-network acceptance and M6+ remain open; no commit/push, package change, production scene or navigation edit.

## 5. Extensible architecture, file map and contracts

Paths below are relative to the repository. New paths are proposals until their milestone creates them. `E` means `Assets/_Project/Features/Enemies`; `T` means `Assets/_Project/Tests`. Existing namespaces remain under `ProjectI.Enemies`; use matching PascalCase filenames and four-space C#.

### Composition, inheritance and cohesion

1. **Compose enemy capabilities.** An ordinary shooter has bolt attack and movement; melee has melee attack and movement; Bulwark combines melee with shield/generator defense; Keeper combines support and movement without a dummy weapon. Boss graphs bind their own attack implementations through the same execution contract. Enemy identity/faction/tier does not select behavior through a growing runtime switch.
2. **Use interfaces where consumers need interchangeable behavior.** Graph actions call attack, movement or support contracts; they do not cast to `EnemyMeleeExecution`, inspect `EnemyArchetype`, or know each attack's phases. Do not create an interface for every rules helper or add an unused service-locator/DI framework.
3. **Keep inheritance shallow.** Concrete attack definitions extend the retained `EnemyAttackDefinition` where appropriate. A single optional `EnemyAttackExecutionBase` can implement common token checks, paid-recovery bookkeeping and idempotent cancellation once the bolt and melee implementations demonstrate identical behavior. Keep weapon-specific targeting, commitment, release and status restrictions in concrete implementations. Do not make a `BaseEnemy -> RangedEnemy -> EliteRangedEnemy -> Lancer` hierarchy or force incompatible attacks into a base with many flags/no-op overrides.
4. **Give each capability one state owner and one lifecycle entry point.** The attack implementation owns its commitment, paid deadline and pending emission; Keeper owns its links; the shield module owns protection/generator state. A small internal state/helper type is acceptable when it clarifies that owner, but must not become a separately ticking or independently writable copy. A graph branch selects/cancels work; it does not own that work's timers.
5. **Keep collaboration explicit.** Perception supplies observation snapshots, positioning supplies a plan/claim, and attacks submit movement requests through the movement contract. The movement executor remains the sole normal NavMesh writer, including lunge requests. Distinct duties may cross modules; one mechanic's mutable state must not be scattered across them. Launched flight remains owned by the projectile service by its existing contract.
6. **Keep shared components small in purpose.** `PrototypeEnemy` retains entity health/status/identity and forwards lifecycle notifications. `EnemyBehaviorHost` binds capabilities and owns graph startup/shutdown; it contains no role logic. `EnemyBehaviorContext` exposes typed bindings and read-only snapshots, not a bag of every role's writable fields. Supply explicit dependencies at initialization; prohibit arbitrary component searches/service lookup on each tick and concrete sibling-role dependencies.
7. **Wire capabilities once and validate authoring.** Unity prefab bindings may use serialized component references, resolved and checked against interfaces during initialization. Graph actions use a stable authored capability slot, allowing a boss to have several attacks without a concrete-type switch. Reject missing, duplicate or incompatible bindings before starting the graph; do not silently choose the first component. Shared profile assets contain only shared tuning/bindings; melee, shell, support and shield fields belong to their own definitions.
8. **Keep an understandable file boundary.** Put each new mechanic's definition, executor and private helpers in its feature folder. Add another helper only for a distinct responsibility or actual reuse; do not split trivial operations into chains of forwarding classes. Existing retained files/GUIDs do not need a cosmetic reorganization. Reviewers must be able to trace begin → commit → release → cancel/cleanup from the module's entry point without following role branches across unrelated systems.

### Capability interfaces and state ownership

These are actual C# interface requirements, not just method names on concrete classes. Add each contract when its first consumer exists (M1 lifecycle, M3 movement, M4 attack, M10 support); the remaining later contracts are planning definitions, not scaffolding to build in M1. One public interface per matching file, beside the owning feature's shared boundary.

| Contract / planned path | Members and consumer | Ownership and result semantics |
| --- | --- | --- |
| `IEnemyCapability`, `E/Behavior/Contracts/IEnemyCapability.cs` | `void InitializeServer(EnemyActorContext actor)`; `void ShutdownServer(EnemyShutdownReason reason)`; called by the host | `EnemyActorContext` provides validated actor/session/stage identity and read-only status access, not mutable state from other roles. Define shutdown reasons for death, despawn, reset, stage end and initialization failure. Shutdown is idempotent; partial startup unwinds already initialized modules. |
| `IEnemyAttackExecution : IEnemyCapability`, `E/Attacks/Shared/IEnemyAttackExecution.cs` | `EnemyActionStatus TryBeginServer(EnemyAttackRequest request, double now)`; `EnemyActionStatus TickServer(double now)`; `void CancelServer(EnemyActionToken token)`; used by the generic attack graph node | Request is an immutable captured token/target/evidence/aim input, validated again by the implementation. Status is `Running`, `Completed`, `Deferred`, `Rejected` or `Cancelled`; deferral is not a paid release/failure. The module retains commitment/cooldown/recovery and validates authority even when invoked directly. |
| `IEnemyMovementExecution : IEnemyCapability`, `E/Navigation/IEnemyMovementExecution.cs` | `EnemyPlanStatus TryAccept(EnemyMovePlan plan)`; `void Cancel(EnemyActionToken token)`; used by navigation actions and movement-based attacks | Executor owns normal agent writes, current accepted plan and physical/status restrictions. Plan includes bounded speed/travel constraints required for a lunge; it is not unrestricted transform access. Cancel affects only the matching owner token. |
| `IEnemySupportExecution : IEnemyCapability`, `E/Capabilities/Support/IEnemySupportExecution.cs` | `EnemyActionStatus TickServer(double now)`; `bool HasUsefulContribution { get; }`; used by the support graph action | Support owns beneficiary selection/link state and cleanup. Contribution is a validated current fact, not permission to retire. Shared recovery/retirement continues to enforce visibility, timing and authority. |

`EnemyActorContext`, `EnemyShutdownReason`, `EnemyActionStatus` and `EnemyAttackRequest` each get a matching file under the owning boundary (`Behavior/Contracts/` for lifecycle/status types; `Attacks/Shared/` for the request). Mutable runtime state is constructed per enemy. Define dependencies on projectile, observation, reservation and movement services explicitly on the consuming module, never through a universal `GetService<T>()` method.

Use one authoritative tick owner per operation: graph actions advance their selected execution through the interface; modules do not also tick the same attack in `Update`. Durable recovery deadlines are checked against server time on every entry and survive graph cancellation. Host shutdown reaches every registered capability even when its graph branch is inactive. Keeper cleanup/protection validity and other continuing effects must retain their explicitly assigned lifetime owner while a graph selects movement; graph selection cannot be the only source of correctness checks for an ongoing effect.

| Boundary | Proposed files / existing integration points | Single owner of state |
| --- | --- | --- |
| Graph integration | New `E/Behavior/EnemyBehaviorHost.cs`, `EnemyBehaviorContext.cs`, `EnemyBehaviorProfile.cs`, lifecycle contracts above; shared data types below each in a matching file beside their owning feature; modify `E/PrototypeEnemy.cs`, `Assets/_Project/ProjectI.Foundation.asmdef` | Host owns graph lifecycle and validated bindings; context references each state owner without duplicating its state. Profile is immutable shared tuning. |
| Evidence | New `E/Perception/EnemyPerception.cs`, `EnemyObservationRules.cs`, `EnemyTargetSelection.cs` | Per-enemy records indexed by player object and spawn lifetime. |
| Pressure/squads | New `E/Coordination/EnemyPressureDirector.cs`, `EnemySquadAssignments.cs`, `EnemyPursuitState.cs`; integrate `E/Encounters/PrototypeEncounterDirector.cs` | Encounter owns coarse assignments; squads own scoped membership/report sharing. |
| Position/movement | New `E/Navigation/EnemyPositioning.cs`, `EnemyPositionClaims.cs`, `EnemyMovementExecutor.cs`, `EnemyQueryBudget.cs` | Claims have an owner/action/lifetime; movement executor is the sole normal navigation writer. |
| Actions | New attack contract/request and `EnemyAttackCommitment.cs` under `E/Attacks/Shared/`; `E/Attacks/Bolt/EnemyBoltExecution.cs`; cohesive `Melee/`, `Bombardier/`, `Lancer/` and `Bosses/` modules; optional shared `EnemyAttackExecutionBase.cs` after M8's reuse check | Each concrete executor owns its action phase, commitment and paid recovery; retained projectile service owns launched flight. Shared base never dispatches by enemy type. |
| Support/defense/splitting | New support contract above and `E/Capabilities/Keeper/`, `Bulwark/`, `Splinter/` modules in M10–M13 | Keeper owns links; Bulwark shield owns generator/protection state with a generator hit adapter; Splinter owns lineage/death response. No role-state fields on the common entity/context. |
| Recovery | New `E/Coordination/EnemyRecoveryPolicy.cs`, `EnemyRetirementService.cs` | Server retirement path, separate from lethal damage/kill credit. |
| Graph nodes/assets | New `E/Behavior/Nodes/` and `E/Authoring/Behavior/`; graphs named `OrdinaryShooter`, `OrdinaryMelee`, `Bombardier`, `Keeper`, `Lancer`, `Bulwark`, `Splinterbeast`, `PulseWarden`, `SiegeWarden` | Graphs choose actions; reusable subgraphs only after a second actual consumer exists. |
| Fixtures/diagnostics | New `T/EditMode/EnemyBehavior*Tests.cs`, `T/PlayMode/EnemyBehavior*Tests.cs`, `Assets/_Project/Debug/EnemyBehavior/`, `Tools/Test-EnemyBehavior.ps1` | Development-only scenario setup and observation; no hidden production control channel. |

### Shared data and service boundary

Freeze these project-owned contracts in M1–M4 before dependent roles begin; package APIs are kept inside `EnemyBehaviorHost` and custom nodes.

- `EnemyTargetKey`: network object ID plus `PrototypePlayerCombat.SpawnLifetime`; validate network manager and stage separately. Enemy keys reuse `EnemyIdentity` and retain the full spawn identity where required by existing credit logic.
- `EnemyObservation`: target key, observed position, original server timestamp, source identity and kind (`PersonalVisual`, `SquadVisualReport`, `HeardRegion`). Imported reports never change the original timestamp. Heard regions cannot be consumed as exact attack observations.
- `EnemyPressureAssignment`: assignment ID, stage generation, coarse region/approach sector, expiry and pursuit episode ID. It contains no exact player aim transform.
- `EnemyActionToken`: enemy identity, stage generation and action sequence. All outstanding callbacks and action-owned reservations validate it; cleanup is idempotent.
- `EnemyPlanStatus`: `Ready`, `Deferred`, `NoPath`, `NoLegalPosition`, `InvalidContext`. These results must not collapse into one generic graph failure.
- `EnemyBehaviorHost.InitializeServer(PrototypeEnemy owner)` and `ShutdownServer()` start/stop the adapter only after valid entity initialization; duplicate shutdown is safe.
- `EnemyPerception.SampleServer(double now)` updates genuine observations. `TryGetPersonalObservation(EnemyTargetKey target, double now, out EnemyObservation observation)` never substitutes guidance/report data.
- `EnemyPositioning.TryPlan(EnemyBehaviorContext context, double now, out EnemyMovePlan plan)` returns `EnemyPlanStatus`; `EnemyMovePlan` captures native agent type, destination, route validity, claim, token and bounded movement constraints. Consumers call `IEnemyMovementExecution.TryAccept`; its concrete executor revalidates before movement. `EnemyMoveLimits.Speed` bounds planar navigation per frame after current slow; native supported step height is checked separately. `TravelDistance` counts actual three-dimensional travel and `Seconds` bounds server-clock duration. Terrain projection cannot bypass these limits.
- `IEnemyAttackExecution` consumes the captured request described above and pays the action at its declared boundary. Each implementation preserves paid recovery and launched work on ticking/cancellation; graph nodes cannot mutate those fields.
- `EnemyRetirementService.TryRetireServer(EnemyBehaviorContext context, double now)` independently rechecks eligibility and all-player visibility; a graph cannot destroy an actor directly.

Graph blackboard bindings: `Self` and the context component reference, plus short-lived action results. Target/cooldown/pursuit/commitment state has no second writable blackboard copy and is never `Shared`. Actions recheck authority even if invoked outside the graph.

### Extension procedure and acceptance

For an enemy assembled from existing capabilities, author its definitions/profile, prefab bindings and graph using existing nodes. For a new attack, add its definition/executor and focused tests in one module folder, implement `IEnemyAttackExecution`, then bind the module through the existing attack node. For a genuinely new capability family, introduce its narrow contract and one meaningful graph action; do not broaden the attack interface to make every mechanic resemble a weapon.

M8 must demonstrate the second attack (melee) using the existing attack graph node and generic host, without modifying the bolt executor, perception, pressure director or unrelated roles to recognize melee. M10 must demonstrate weaponless support through its own contract, without fake attack methods on Keeper or Keeper branches in attack code. M12 must compose existing melee with defense. These demonstrations use required roster work, not speculative extra enemies.

Record the touched-file list and dependency walkthrough for these gates. New module files, tests, assets, deliberate registration/binding and the documented M8 shared-base extraction are expected. Changes to a genuinely incomplete shared contract must be explained, reviewed and exercised against **all** existing consumers; they cannot be hidden as routine new-enemy work. Existing roster/credit policy changes remain separately scoped. Passing behavior tests alone does not prove this extension requirement.

## 6. Provisional tuning and measurable expectations

These are proposed experiment inputs authorized for tuning, not final acceptance of their feel. Keep them in role/behavior profiles, validate finite ranges, and capture relevant values when an episode/action starts so live edits cannot slide deadlines.

| Parameter | Starting point | Observation that requires tuning |
| --- | --- | --- |
| `PerceptionInterval` | 0.15 s, staggered per actor | Excessive reaction delay or sensor cost; safety checks still run at release. |
| `VisualReactionDelay` | 0.25 s from sustained qualifying sight | Every peek receives an apparently instant shot, or enemies feel unresponsive. Brief occlusion must not endlessly restart an already earned reaction. |
| `GuidanceCellSize` / `GuidanceRefreshInterval` | 12 m cells / 1 s | Guidance follows unseen relocation too precisely, or groups remain irrelevant. Use valid region/route anchors, not a cell center in a void. |
| `TargetHoldSeconds` | 1.5 s minimum preference, immediately invalidated by death/disconnect | Bullet-by-bullet aggro swaps or persistent focus despite a substantially better reachable threat. Commitment always overrides selection. |
| `InvestigationSeconds` | 6 s for the M5 ordinary shooter; shared M2 fixture remains 3 s, measured from last personal observation | Enemies search forever or cannot be misled by an unseen exit. Reports do not count as new personal sight. |
| `FieldOfView` | M5 ordinary shooter 210° total (±105°); shared M2 fixture 180° | Flanks lose useful counterplay or local route turning prevents genuine reacquisition. Real geometry clearance remains required. |
| `MaximumEvidenceFacingRouteLength` | 4.25 m whole accepted route, including native endpoint tails | Authored 4 m sidesteps turn away; longer transit looks unnatural. Captured once at acceptance; no hidden live tracking. |
| `BombardierMemorySeconds` | 3 s from last personal sight | Cover pressure lasts too long or offers no useful role. At exactly expiry, no new remembered attack starts. |
| `PursuitEpisodeMaxSeconds` | 12 s | Renamed tasks create an endless chase or reasonable routes expire too early. Meaningful reassignment is required at expiry. |
| `NoProgressSeconds` / `ProgressDistance` | 3 s / 1 m route-distance improvement | Small oscillations reset recovery or genuine short useful repositioning is misclassified. Valid attacks/support count as contribution, not route distance alone. |
| `DestinationClaimSeconds` / `BottleneckYieldSeconds` | 1.5 s renewable while valid / 0.5–1 s staggered | Permanent reservations, constant swaps or rear actors stop throughput. Yield is capped and reassessed. |
| `RecoveryAttempts` / `RecoveryObservationSeconds` | 3 completed alternatives over at least 8 s | Retirement occurs during a transient obstruction or failures loop indefinitely. Deferred queries and status-restricted time are excluded. |
| `KeeperAllylessSeconds` | 10 s of eligible, unsuccessful support reassignment | Keepers vanish during brief ally churn or persist without a purpose. Visibility and all ordinary lifecycle guards remain mandatory. |
| `ShooterPreferredRange` | 8–14 m as an initial positioning band | Enemies backpedal indefinitely or refuse stairs. No additional hard minimum firing range. |
| `PositionCandidateLimit` / `DecisionPathQueriesPerFrame` | 6 per request / 8 globally for the new decision service | Query age grows without bound or host cost spikes. This is separate from the retained admission budget; measure the combined load. |

M1 initially uses the package's native graph tick, with expensive sensing/planning staggered and budgeted in C#. Do not introduce a second scheduler until profiling justifies it. Native movement, status enforcement and attack release must remain timely when planning is deferred.

Existing attack damage, burst, tracking, cooldown and tier/stage scaling are the starting combat baseline; do not replace them with the numbers above. For removed specialist tuning, M0 records the accepted contract/provenance before restoration. Target hardware and a final frame-time budget remain open; M17 cannot mark hardware acceptance without them.

## 7. Implementation milestones

Every runtime milestone follows: specify observable assertions → discover/run the focused test and retain the meaningful failure → implement → rerun focused proof → review the integrated delta. Do not create tests that merely mirror names/source text when behavior can be exercised. Full suites belong at integration gates, not after every small edit.

### M0 — Freeze the baseline and prepare the first slice

**Goal:** make the first shooter experiment reproducible without touching normal-stage defaults. **Dependencies:** none.

**Files:** this plan; inspected packages/settings; existing enemy, encounter, projectile and test sources; future fixture under `Assets/_Project/Debug/EnemyBehavior/`.

- [x] Re-read current instructions/status/diff and record the actual execution checkpoint, including existing local edits.
- [x] Verify the actual connected checkout, Unity 6000.6.4f1, stopped/idle state, import/compile readiness and Console. M2/M3 verify `E:\IndieGameProject\ProjectI`; C: is absent. The historical M1 record does not override current readiness checks.
- [x] Preserve active/unsaved scenes, manual terrain/NavMeshes and original prefab bindings before creating the isolated fixture.
- [ ] Inventory retained versus removed capabilities for each roster entry; record exact weapon/scaling, Keeper eligibility, precision reservation, shield and split/reward contracts from source and specifically relevant retained history. Flag a conflicting or absent accepted value rather than inventing a preservation claim.
- [x] Record which production assets remain untouched until promotion; use fixture-specific graph/profile/prefab bindings, not a global default switch.
- [x] Map each planned capability's state owner, dependencies, lifecycle entry points and graph consumer using section 5. Walk through adding melee, weaponless Keeper and Bulwark defense; reject designs requiring central role switches or duplicate ownership before implementing the foundation.
- [x] Obtain the three independent pre-slice reviews for M1 and reconcile findings in the progress record.
- [x] Obtain the three independent pre-slice reviews for M2–M5 before those slices; each scoped record above identifies its independent perspectives and conditions.

**Gate:** reviewable shooter packet, preserved baseline, exact package identity and no unresolved ownership conflict. Stop if package resolution or Editor ownership is uncertain.

### M1 — Prove server-only Unity Behavior integration

**Goal:** a graph runs only for a valid authoritative enemy and stops reliably. **Dependencies:** M0.

**Files:** new `E/Behavior/EnemyBehaviorHost.cs`, `EnemyBehaviorContext.cs`, `Contracts/IEnemyCapability.cs`, `Contracts/EnemyActorContext.cs`, `Contracts/EnemyShutdownReason.cs`; modify `E/PrototypeEnemy.cs`, `Assets/_Project/ProjectI.Foundation.asmdef`; new `T/PlayMode/EnemyBehaviorLifecycleTests.cs` and a counter-only fixture graph.

- [x] Inspect installed `BehaviorGraphAgent.Init`, `Start`, `Update`, `End`, graph instance acquisition, custom-node completion and interruption. Record the actual semantics; do not assume selector reevaluation/preemption.
- [x] Add and pass native tests `BeforeSpawn_DoesNotDecide`, `Client_DoesNotDecide`, `TwoInstances_DoNotShareState`, `Shutdown_EndsRunningActionOnce`, and `OldCallback_AfterRespawn_IsRejected` against the final authored graph.
- [x] Bind a validated per-instance set of `IEnemyCapability` modules before graph startup. Test `MissingCapability_RejectsStartup`, `DuplicateSlot_RejectsStartup`, `PartialInitialization_UnwindsOwnedModules` and `InactiveBranch_ShutdownCleansCapability`; graph host must not name concrete enemy roles.
- [x] Add the `Unity.Behavior` assembly reference and only additional references demonstrated necessary by compilation; preserve other pins/references. Compilation also required `Unity.Behavior.SerializableGUID`.
- [x] Author the Behavior Agent disabled in fixture prefabs. Initialize context after `PrototypeEnemy` has initialized health, lifetime, encounter and navigation; bind/validate the private graph instance before enabling execution on the server.
- [x] Use explicit lifecycle shutdown on death, reset, stage cleanup and despawn: invalidate tokens, stop graph, disable automatic updates, release owned claims/subscriptions. Verify disabled/re-enabled objects and genuine stopped-session domain reload do not resume stale work. Active NGO hot reload remains unsupported (section 4).
- [x] Test root/stun/slow constraints at the adapter boundary and establish how an interrupt reaches a running node without waiting for a selector to finish.
- [x] Run the focused native fixture and capture graph start/tick/end counts by peer and enemy lifetime. Final `r`: 24/24 including retained passive lifecycle; separate reload `q`: 1/1; retained rules `s`: 38/38. Exact selections and identities are recorded in section 4.

**Gate:** zero unauthorized ticks/actions; independent instances; repeatable shutdown and restart. Package ownership filtering is defense in depth, never the authority boundary.

### M2 — Add observations and stable target selection

**Goal:** enemies act on what they know, and cover can mislead them. **Dependencies:** M1. **Scenarios:** K01–K07, G05–G06, L02.

**Files:** new perception files from section 5; new `T/EditMode/EnemyBehaviorObservationTests.cs`, `T/PlayMode/EnemyBehaviorPerceptionTests.cs`.

- [x] Test distinct personal sight, report, remembered position and heard region; assert an unseen player's movement cannot update stored aim position.
- [x] Implement scoped living-player enumeration from host-accepted state; reject downed, disconnected, foreign-session/stage and recycled targets.
- [x] Sample sight with occlusion, independent of muzzle clearance; retain separate timestamped records for A and B.
- [x] Add target stability/reaction rules; invalidation is immediate but damage from a different player does not restart every action.
- [x] Add coarse hearing only from explicitly emitted combat events; capture the event region/time, never poll a hidden source transform. No stealth system expansion.
- [x] Test `Report_DoesNotBecomePersonalSight`, `SeeingB_DoesNotRefreshA`, `DownedPlayer_IsNotNewTarget`, and `UnseenAlternateExit_PreservesOldEvidence`. Rule/native cases include these names or their explicit extended native variants; see the packet.
- [x] Show observation source/age and selected-target reason in an opt-in development view.

**Gate:** K01–K07 are inspectable in the fixture; no exact hidden aim updates. Squad transport of reports is added in M6, using these same semantics.

### M3 — Add useful positioning, claims and physical movement

**Goal:** select reachable useful positions and handle deferred work safely. **Dependencies:** M1–M2. **Scenarios:** M01–M08, G01.

**Files:** new navigation files from section 5; new `T/EditMode/EnemyBehaviorPositionTests.cs`, `T/PlayMode/EnemyBehaviorNavigationTests.cs`.

- [x] Test the five planning results independently, including deferred budget, complete-path failure and invalid context.
- [x] Generate bounded candidates around an approach sector or observed target. Score firing clearance/usefulness before preferred range; enforce the actor's native agent type and physical footprint.
- [x] Separate perception LOS from muzzle/trajectory clearance. Reject routes through unsupported gaps and destinations in voids or occupied capsules.
- [x] Claim destinations using enemy/action/lifetime ownership; release only the owning action's claim on completion, invalidation or cancellation.
- [x] Implement one normal movement writer, applying current speed/slow/root/stun constraints and respecting existing collision-safe displacement ownership.
- [x] Expose that writer through `E/Navigation/IEnemyMovementExecution.cs`. Exercise bounded normal-travel and attack-movement requests through the same contract, including ownership cancellation, invalid token and status rejection; callers cannot write the agent/transform directly.
- [x] Permit safe stair/ramp transit inside the preferred range. Remove no retained physical safety constraint; do not reintroduce the retired universal six-metre movement exclusion as a new weapon rule.
- [x] Add bounded bottleneck yielding and alternatives; preserve a still-safe route when planning is deferred. Stop it if it becomes unsafe, even when no new query is available.
- [x] Test actual stairs, narrow bridge, disconnected islands, normal/large agents, claimed destination invalidation, death freeing a claim, close escape beside a cliff, and starvation fairness.

**Gate:** useful movement resumes after obstruction clears; no overlap/void crossing, unbounded query loops or deferred-as-failure accounting. Fixture navigation may be authored explicitly; production navigation is not rebaked.

### M4 — Restore the ordinary shooter attack and graph

**Goal:** deliver one readable combat loop: attack when legal, reposition when useful, investigate/reassign when knowledge expires. **Dependencies:** M1–M3. **Scenarios:** K01–K05, M01–M04, R01, R10, L01–L02.

**Files:** new `E/Behavior/EnemyBehaviorProfile.cs`, `E/Behavior/Contracts/EnemyActionStatus.cs`, `E/Attacks/Shared/IEnemyAttackExecution.cs`, `EnemyAttackRequest.cs`, `EnemyAttackCommitment.cs` in that shared attack folder, and `E/Attacks/Bolt/EnemyBoltExecution.cs`; new custom nodes `ExecuteEnemyAttackAction.cs`, `SeekEnemyPositionAction.cs`, `InvestigateEnemyEvidenceAction.cs`, `RequestEnemyAssignmentAction.cs`; fixture `OrdinaryShooter` graph/profile; new `T/EditMode/EnemyBehaviorAttackTests.cs`, `T/PlayMode/EnemyBehaviorShooterTests.cs`, `T/PlayMode/EnemyBehaviorCapabilityContractTests.cs`.

- [x] Define preparation, commitment, release and recovery transitions, including the exact point cooldown is paid. Once paid, branch changes/cancellation cannot refund it.
- [x] Implement bolt execution behind `IEnemyAttackExecution` and bind it by an authored capability slot. Keep burst state, pending shots, commitment and paid recovery owned by that executor; common host/context and the generic attack graph node contain no bolt-specific fields or type casts.
- [x] Create reusable capability conformance tests that invoke the real implementation through its interface: unauthorized start is rejected, wrong-token cancel leaves current work intact, matching cancel is idempotent, paid recovery survives reentry, and separate instances stay independent. Run these for bolt now and every added attack later; weapon-specific hit/cue tests remain separate.
- [x] Bind the existing `BoltAttackDefinition` and `EnemyProjectileService.LaunchServer` contract. Preserve projectile tracking/terrain collision and scaling exactly once.
- [x] Before each unreleased shot, validate authority, lifetime, living target, range/clearance and status. A blocked shot is withheld/cancelled; no shot through the wall.
- [x] Allow legal close shots; preferred range remains a movement score. Preserve any actual maximum range and physical attack restrictions.
- [x] Build meaningful action nodes and graph control flow. A failed query chooses a bounded next action; deferred work waits/retries without clearing knowledge or the good route.
- [x] For this isolated slice, seed one finite coarse assignment from the fixture host. Assignment expiry returns an explicit bounded wait/failure to the fixture; do not pretend the full encounter reassignment service exists before M6 or substitute an exact hidden-player transform.
- [x] Test sight loss during preparation, commitment, burst spacing and recovery; target switch; root versus stun; death before release; death after launch; projectile-capacity refusal; repeated node entry.
- [x] Assert one release per paid action/shot identity, no cooldown reset, no post-death new emission, and independent launched flight until its own end/encounter cleanup.

**Gate:** an isolated shooter can fight around cover and stairs without a pack-freeze mechanism or a second behavior runtime.

### M5 — Validate the first playable slice before extending it

**Goal:** decide keep/tune/revert from actual shooter behavior. **Dependencies:** M4.

**Files:** new `Assets/_Project/Debug/EnemyBehavior/EnemyBehaviorScenarioDriver.cs`, `EnemyBehaviorDiagnostics.cs`; new `T/EditMode/EnemyBehaviorDiagnosticTests.cs`; fixture bindings and this record.

- [x] Run five scripted fixture situations: wall/alternate exit; stairs/close transit; bottleneck/destination invalidation; pursuit expiry stub; disconnected-ground recovery stub. Mark the latter two as partial until M6–M7 exist.
- [x] Capture action, observation age/source, aim commitment, route/claim, query result and cancellation cause without granting debug actions to release clients.
- [x] Exercise two graph instances and a real host/client pair; verify the remote peer displays movement/projectiles but records zero authoritative decisions/damage execution.
- [x] Play the cover/stair/close-rush cases and record whether cover grants safety, shots are understandable and movement is purposeful. User accepted M5/M5B, including the subsequent ramp/stair corrections, on 15 October. Keep human judgement separate from native assertions.
- [x] Obtain technical, gameplay and design/UX post-slice reviews; fix and recheck only affected results.
- [x] Review the actual dependency/state-owner map against section 5. Trace the bolt from begin through release and cleanup; reject duplicate timer ownership, role logic in shared services, a profile containing unrelated role fields, or unnecessary forwarding classes. Defer shared execution-base extraction until M8 provides a real second implementation.
- [x] Record actual implementation/testing time and revise the remaining estimate. User decision on 15 October is keep/accepted, including the subsequent ramp/stair corrections.

**Gate:** shooter slice approved for further development; normal-stage defaults remain unchanged. No claim of complete pursuit, retirement, roster or four-player acceptance yet.

**Current gate status, 15 October:** **keep/accepted**, including the later ramp/stair corrections. Fresh full EditMode/reload (1,129), full affected native union (261), normal/development/release builds and exclusion audits, packaged two/four-peer loopback and ten-phase normal MainMenu all pass. M5/M5B closure is complete within the explicit hardware/network/tooling limits in the [closure record](2026-10-15-firing-position-ramp-fix.md#m5m5b-final-closure--authorized-15-october); scoped local commit authorized, no push. No M6 or normal-stage promotion is implied.

### M5B — Bounded local investigation with per-enemy search strength

**Status/date:** implemented; original automated gate complete within the coverage and tooling limits recorded below, 14 October 2026. Lead executed B1–B6 with independent technical, gameplay and design/UX reviews before/after and bounded delta reviews. The user accepted M5/M5B and subsequent ramp/stair corrections on 15 October; final closure is in the [closure record](2026-10-15-firing-position-ramp-fix.md#m5m5b-final-closure--authorized-15-october). Earlier ledger entries retain their original checkpoint meaning. No M6, production promotion, dependency upgrade or terrain/saved-navigation rebuild. The later user request authorizes a scoped local commit after final verification, with no push.

**Goal:** after a player ducks behind nearby cover, an enemy deliberately inspects plausible hiding space, can be fooled by unseen movement, and stops when its evidence or search allowance runs out. Different enemy prefabs can use different search radius, duration, thoroughness and movement-direction bias without code branches by enemy type.

**Architecture:** retain perception as the owner of observed facts, positioning as the owner of investigation decisions, and the existing executor as the sole voluntary movement/facing writer. Add a small private investigation episode per remembered target and a shared immutable investigation definition. Keep the current native Behavior graph's attack → seek/investigate → assignment-wait structure; graph transitions do not own or refresh search memory.

**Design basis:** the user's cover clip and follow-up decisions in this chat: replace the blanket “don't stand still” rule; allow assumptions about nearby hiding places; do not reveal the hidden player's actual location; make enemy search strength adjustable. Apply the primary replacement designs linked at the top of this plan. This is a bounded extension of individual M2–M5 behavior, not an encounter-coordination replacement.

#### M5B.1 — Evidence, boundary and task packet

- **Observed:** sampled frames from the preserved [M5B cover-oscillation clip](../../Evidence/EnemyAI/2026-10-14-m5b-cover-oscillation.mp4) show repeated nearby reversals with the player behind a wall. The byte-identical project copy comes from the user's `Desktop 2026.10.14 - 13.00.37.01.mp4` recording (12.68 seconds; 28,892,785 bytes); its exact runtime source/build identity is not established. Source inspection finds actor-relative candidate regeneration, priority for lanes to the old point, and no persistent checked-viewpoint history. The recording has no captured decision trace sufficient to establish the exact cause of every reversal.
- **Hypothesis:** replanning against the same sighting makes a previous position attractive again; forbidding the current position forces movement without measuring new information. Stable candidate identity plus checked-space memory and purposeful observation should remove A→B→A cycles on unchanged evidence. If a traced reversal instead follows genuine new sight, collision recovery or another owner, repair that boundary rather than hiding it with a cooldown.
- **M5B scope:** personal-sight loss, local hypotheses, local viewpoint choice/inspection, bounded episode state, authoring and observation diagnostics, isolated shooter fixture and affected proof. Existing hearing/report/coarse-assignment semantics remain distinct.
- **M6 scope:** squad transport, coarse encounter assignments, moving/split-party relevance and pursuit budgets. M5B exports a finite local outcome; it does not implement those policies. **M7 scope:** stranded eligibility, recovery and hidden retirement. An exhausted investigation is never proof of being stranded.
- **Risk/reviews:** high for implementation because target lifetimes, persistent per-actor state, graph interruption, perception and movement interact. Before runtime work and after the integrated slice, obtain independent read-only technical, gameplay and design/UX reviews under the canonical model policy. This planning-only request needs no implementation agents. One lead writer integrates; no concurrent Editor operations or shared-file writers.
- **Preservation:** no production-stage activation, terrain/NavMesh rebuild, dependency upgrade, weapon change, hidden-position feed, squad search, general probability-map framework, automatic commit/push or paid service. Preserve all existing dirty work, graph GUID/file IDs, manual authoring and asset/meta pairs.
- **Duration:** runtime implementation and verification duration is unknown until the traced reproduction and candidate-generation probe establish costs. Record actual task timings and revise the remaining estimate after B1/B3; human playtesting remains separately scheduled. Do not inherit earlier automated counts as current results.
- **Stop:** finish at the M5B automated gate and report human keep/tune/revert separately. M6 should follow the combined M5/M5B human decision. Escalate if useful cover search requires level annotation, larger budgets, movement/attack ownership changes, or a broader geometry system than this bounded sampler.

#### M5B.2 — Decisions and invariants

1. **Replace forced movement atomically.** Remove the remembered-sight `current && !visibleHold` exclusion only when investigation scoring/state is connected. Keep visible-target firing-position behavior. A current position is legal if it can inspect unexamined space; otherwise finish or choose a useful destination. Do not restore the old clear-lane stationary loop as an intermediate delivered state.
2. **Belief is not perception.** A hypothesis is “the player might be behind this cover.” It is never an `EnemyObservation`, a sight refresh, a target transform or permission to fire. Actual target acquisition and every ordinary-shot release still use existing real sight, reaction, muzzle, status and lifetime validation.
3. **Fairness:** with identical admitted observations, world geometry, actor state and scheduling, two different hidden player routes produce identical initial hypotheses/scores/choices. Hidden actor colliders must not influence hypothetical visibility scoring. Actual physical collision and a genuine new sight/sound can subsequently change behavior.
4. **Finite clock:** anchor the allowance to the last genuine personal sighting, not to when a graph happens to request a search. `deadline = min(lastPersonalObservedAt + maximumSearchSeconds, PersonalExpiresAt)`. Reassessment, query deferral, arrival, root/stun, target switching and search assumptions never extend it. Search duration is a maximum elapsed allowance, not a guaranteed number of moving seconds.
5. **Finite distance/effort:** search hypotheses remain within the authored region around the immutable last-seen anchor. Cumulative actual travel, admitted viewpoint attempts and completed inspections have episode limits; issuing another route cannot reset them. Backtracking along a necessary detour is allowed, but repeating an exhausted destination is not useful progress.
6. **No blanket anti-reversal rule.** Reversal may be correct after new evidence, a blocked route or a necessary path corner. Reject repetition of already exhausted viewpoint/coverage state; preserve useful committed travel. Do not ban all negative movement along an axis or enforce straight-line distance reduction.
7. **Evidence sources remain separate.** M5B starts only from personal visual evidence. New accepted hearing or a squad report can use the existing coarse route after personal investigation is exhausted, with its own original provenance/expiry. They cannot renew or reconstruct the same personal episode. Before M6, assignment fallback is still a finite fixture stub.

#### M5B.3 — Authoring and tuning contract

Create `E/Investigation/EnemyInvestigationDefinition.cs` as a ScriptableObject referenced by `EnemyPositioning`; `E/` means `Assets/_Project/Features/Enemies/`, and `T/` below means `Assets/_Project/Tests/`. One immutable definition may be shared; each actor snapshots validated values at server initialization. Different prefabs reference different definitions. Edits take effect after sandbox reset/respawn, not halfway through an active episode. A null definition disables personal investigation safely; it must not silently select the old oscillating fallback. Visible-target positioning and existing coarse evidence remain available.

All values below are **provisional shooter starting values**, not balance acceptance. Inspector fields need units, tooltips, validation and grouped presentation. Keep commonly tuned strength controls prominent; sampling and scoring controls can be an advanced foldout. Structural/safety bounds are implementation limits, explicitly distinct from balance defaults.

| Field / owner | Initial value | Meaning and validation |
| --- | --- | --- |
| `searchRadius` / investigation | 6 m | Maximum horizontal distance of a hypothesis from the last-seen feet anchor; finite, >0. Fixed for this episode, never centered on hidden movement. |
| `maximumSearchSeconds` / investigation | 6 s | Wall-clock allowance from last personal sight; finite, >0, bounded by evidence expiry as above. |
| `investigationSeconds` / existing perception | 6 s for shooter; shared default remains 3 s | Existing evidence lifetime, retained under its serialized name. Label/help text must distinguish evidence retention from active search time. Warn when active search is capped by shorter evidence memory; don't silently extend either value. |
| `maximumSearchTravelDistance` / investigation | 18 m | Cumulative actual voluntary travel for this episode, >0. Existing executor per-route travel/time caps also apply. |
| `maximumViewpointAttempts` / investigation | 4 | Cap admitted destinations, including routes that later fail; 1–16. Budget deferral/claim contention before admission does not consume an attempt. |
| `maximumViewpointsToInspect` / investigation | 3 | Completed viewpoint inspections; 1–`maximumViewpointAttempts`. Early exhaustion remains possible. |
| `inspectionSeconds` / investigation | 0.45 s | Desired dwell after facing a hypothesis; >=0. Must also receive a new real perception sample taken in the required orientation; a timer alone cannot mark a space checked. Deadline still wins. |
| `observationFacingToleranceDegrees` / investigation | 10° | Allowed yaw error to start/continue an inspection, >0 and <=90. Reuse executor turn speed and actual perception FOV. |
| `maximumVerticalOffset` / investigation | 2 m | Maximum hypothesis/viewpoint height difference from anchor after projection; >=0. Prevent accidental selection of a different floor; supported ramps/stairs within the bound remain legal. |
| `viewpointStandOff` / investigation | 1.5 m | Additional horizontal extent allowed for a viewing position outside the belief region; >=0. Belief itself remains inside `searchRadius`; route travel is separately bounded. |
| `viewpointMergeDistance` / investigation | 0.75 m | Merge nearly identical projected viewpoints and identify completed/failed destinations; >0. Smaller than radius. |
| `maximumHypotheses` / investigation | 8 | Maximum fixed ground samples in the belief region, 1–16. Increasing thoroughness never bypasses shared scheduling limits. |
| `maximumViewpointCandidates` / investigation | 16 (initially 12) | Maximum stable viewpoint candidates including the current view, 1–24; raised/exposed at the user's request in the cover extension. Separate from the existing six-point visible/coarse positioning sampler and actual attempt/inspection limits. |
| `directionSampleMaximumGap` / investigation | 0.5 s | Maximum gap between two successful sight samples used to estimate movement; >0. No estimate across an occlusion gap. |
| `directionMinimumDisplacement` / investigation | 0.2 m | Ignore smaller horizontal movement as noise, >=0. Use consistently sampled feet, not changing head/torso aim points. |
| `directionPredictionSeconds` / investigation | 0.75 s | Cap extrapolation from observed movement, >=0; zero disables prediction. Clip projected hypothesis to radius and legal ground. |
| `maximumInferredSpeed` / investigation | 12 m/s | Reject implausible sample deltas (including discontinuities), >0; do not extrapolate teleports. |
| `nearCoverWeight` / investigation | 2 | Additional preference for plausible occluded space close to the last sighting; finite, >=0. Retains a “stopped behind cover” hypothesis even with motion bias. |
| `observedDirectionWeight` / investigation | 1 | Additional preference for samples aligned with captured movement; finite, >=0. Zero gives symmetric search when evidence is ambiguous. |
| `travelCostWeight` / investigation | 0.25 | Cost of normalized full route length against new-space gain; finite, >=0. Preferred weapon range is only a later tie-break for search. |
| `minimumInformationGain` / investigation | 0.1 | Minimum new unexamined hypothesis weight visible from a candidate, normalized by initial total weight; >0 and <=1. Don't renormalize residual weight after each inspection. |
| `blockedViewpointRetrySeconds` / investigation | 1 s | Minimum delay before reconsidering a route blocked after admission, >0. Retry also requires changed feasibility; time alone is insufficient and original attempt/time limits remain. |

Keep movement speed, turn speed, preferred combat range, planning cadence, short-route evidence-facing cutoff, eye/FOV/range and reaction delay in their existing owning definitions; do not duplicate them in the investigation asset. Advanced scoring cannot override safety, checked-space exclusions, evidence expiry or minimum useful gain.

Author three **fixture-only** comparison definitions: weak (3 m / 3 s / 1 inspection / 2 attempts / 9 m travel), ordinary (table above), and persistent (9 m / 9 s / 4 inspections / 6 attempts / 27 m travel). Pair their fixture perception memories with at least their search durations; production/shared perception assets stay unchanged. These are comparison presets, not a commitment to three roster types. Confirm that greater allowance can improve coverage without promising guaranteed reacquisition or monotonically faster choices in every geometry.

Expose shared search-visibility work allowance in the sandbox's service configuration, initially 16 probe grants per frame, using a separate `EnemyQueryBudget` instance from the existing path-query budget (currently 8). It is a shared service limit, not a per-enemy strength multiplier. Admit at most one probe per requester per frame under existing FIFO rules. Preserve explicit finite queue/candidate capacities and report saturation as Deferred/unknown, never “searched and empty.” No new general scheduler.

#### M5B.4 — Evidence and episode ownership

**Perception facts:** extend the existing per-target observation owner to retain the last two contiguous successful personal sight samples of accepted feet position and time. Capture feet only after actual sight succeeds. Publish immutable optional previous/current samples through `EnemyPerceptionSnapshot`; don't alter shared report or hearing precision. Missing, stale, equal-time, discontinuous, cross-lifetime or implausible samples yield no direction. Losing sight invalidates continuity for the next velocity estimate, while retaining the frozen pair for this investigation.

**Private episode:** `EnemyInvestigationEpisode` is a bounded plain state object owned by `EnemyPositioning`, not a new Update loop or graph blackboard owner. Store target/lifetime, anchor and sight timestamp, deadline, captured optional direction, immutable candidate IDs, initial hypothesis weights, inspected-sample bits, completed/failed viewpoints, active action token, actual travel charged, attempt/inspection counts, status and reason. Retain at most the supported four valid player entries per actor; prune invalid/expired identities. Capacity exhaustion refuses new work, not replacement of a live owner's state.

Key an episode by actor lifetime, target lifetime and original personal observation timestamp. Create it once when that sighting becomes nonvisible. Keep an exhausted marker for the same evidence so Repeat/Try In Order cannot recreate it. Ordinary graph reassessment and cancellation release owned pending queries/routes without wiping episode history. Target switching retains each target's clock/history; same-target return cannot earn a fresh allowance. A strictly newer genuine personal sighting may supersede the episode, but a newer report, sound, graph action or assignment ID may not. Personal reacquisition returns to normal reaction/attack rules and removes the old search commitment.

**Transitions:** `Planning → Travelling → Inspecting → Planning`, then `Exhausted`, `Expired`, or `Reacquired`. Planning may remain Deferred without changing state/history. No-route candidates are unverified, not checked-empty. Interrupted travel charges actual progress once; stale/duplicate outcomes cannot double-charge or mark a space checked. Root/stun obey existing movement/facing rules and do not pause the deadline. Death, reset, despawn, invalid target, stage/session change and initialization failure clear owned state, claims and queries through existing lifecycle paths.

**Completion seam:** add a typed immutable terminal movement result keyed by `EnemyActionToken` (completed/cancelled/blocked/expired/invalidated plus actual travelled distance) to the executor's existing completion path. Positioning consumes only its matching result once. Preserve `LastStop` for diagnostics; never parse it as gameplay state. Keep final-result retention bounded to the current owner's needs. Continuous travel charging and terminal charging must share one monotonic accounted-distance value per token so neither interruption nor a graph tick loses/doubles distance.

**Inspection seam:** add an explicit bounded observation-facing request to the existing movement executor, using the same token/claim/status/turn-rate rules. Positioning supplies an immutable hypothesis look point and original deadline. Executor remains the only transform writer. Positioning observes real perception sample time/orientation to decide inspection success. Do not represent stationary inspection as an endless sequence of zero-length travel plans, or add a second facing MonoBehaviour.

The current executor invalidates its travel token on completion. Consume that matching completion before issuing a fresh observation token and acquiring the stationary claim; do not revive the invalidated token. Both actions retain the same episode identity/deadline. Clamp each route's distance to `min(existingPerRouteLimit, episodeTravelRemaining)` and time to `min(existingPerRouteSeconds, deadline - now)`. A claim failure/deferral does not count as an inspection. The initial current-view inspection can clear visible sample cells after a real post-loss perception sample and the required facing/dwell. Historical visibility alone does not prove emptiness; once inspected, the old empty sighting cannot repeatedly count as new coverage.

#### M5B.5 — Bounded candidate and information-gain algorithm

Use deterministic sampled geometry first; avoid a new authored-cover database or a complete map of every cover edge.

1. **Freeze the local frame.** Derive anchor feet, horizontal axis from reliable captured movement (otherwise last visible observer-to-target direction), and its perpendicular. Store them for the episode. Replanning uses this frame, never an axis recomputed from the enemy's new position. Use the same target/actor identity for stable tie-breaking; no hidden data or fresh random side choice each tick.
2. **Build hypotheses once.** Try the anchor, the bounded predicted point when available, then interleaved directions on rings at half/full search radius until the configured cap is reached. Near-anchor candidates retain priority; direction bias affects weights, not deletion of all other sides. Project to the relevant supported NavMesh surface with the existing native agent filter, recheck horizontal/vertical bounds, deduplicate and reject unsupported or disconnected ground. Fractions for ring construction are fixed sampling structure, not undocumented enemy-strength knobs. Record a blocked/invalid anchor as such; don't project it through a floor into unrelated space.
3. **Weight plausible space.** Give every legal hypothesis a baseline weight of one. Add normalized near-anchor-and-occluded preference times `nearCoverWeight`, and positive alignment with the frozen observed direction times `observedDirectionWeight`. Occlusion here is world geometry relative to the captured observer view, not hidden target presence. Normalize by initial total weight once. This is a ranking heuristic, not a calibrated probability or certainty that the player remained inside the radius.
4. **Build stable viewpoints.** Include the episode's starting viewpoint, legal hypothesis locations, then angular samples around the anchor out to `searchRadius + viewpointStandOff`, interleaved across both sides until the cap. Reuse native projection, stage bounds, support and full-route validation. A viewpoint near a cover edge is useful because it reveals sampled space, not because a wall collider's bounding-box corner is assumed walkable. Normal and Large agents use their own filters/footprints. Deduplicate projected positions; never regenerate the same IDs around the moving actor.
5. **Measure potential new visibility.** From each hypothetical eye position/orientation, world-geometry rays to hypothesis torso samples determine unexamined coverage. Use the actual eye offset, sight range and FOV; ignore player/enemy colliders for this hypothetical score. Blocked rays reveal nothing; saturated results are unknown and deferred/rejected conservatively. Geometry visibility can rank a viewpoint, but only actual perception can reacquire the player. Account each probe in the shared search budget and each native path calculation in the existing path budget; retain partial evaluation and FIFO ownership across frames/reassessment. One candidate evaluation must not hide an unbounded ray/path loop behind a single grant. Geometry/profile changes invalidate affected cached visibility and routes; a blocked actual inspection cannot clear cells using an earlier hypothetical result.
6. **Choose useful gain before combat comfort.** Exclude exhausted/duplicate viewpoints, insufficient gain, unsafe routes and routes exceeding remaining travel/time allowances. Score remaining candidates by new weighted coverage minus `travelCostWeight × normalized route length`. Resolve ties by lower route cost, then combat-range penalty, then stable candidate ID. A lane to the old sighting gets no privileged search score. If the current viewpoint wins on real unexamined coverage, inspect in place. If nothing gains information, finish with `NoUsefulViewpoint`; movement is not required for its own sake.
7. **Commit and inspect.** Acquire the existing destination claim and execute the bounded route. Regular attack reassessment preserves useful search travel; fresh actual sight may interrupt it. At arrival, face the highest-weight newly revealable sample, dwell, and require a real perception sample in that orientation before marking only actually visible sample cells checked. Samples outside FOV/range or still occluded remain unchecked. Clearing sampled cells means “not found during this inspection,” not proof the entire area is empty or cannot be re-entered. Continue with the next useful candidate under the same episode budget.
8. **Handle failure without cycling.** Blocked-after-admission viewpoints retain their outcome and consume an attempt. They may be reconsidered after the configured delay only if a budgeted feasibility recheck establishes change, with remaining attempts/deadline. Completed viewpoints stay exhausted for unchanged evidence. A physical detour may pass through an earlier position without counting as a new inspection. If no alternative is useful, wait finitely or finish; do not alternate between two failed destinations.

Full view generation must demonstrate revealing the far side of the wall in the supplied case. If the bounded sampler cannot produce useful candidates for that geometry, record the limitation and revise candidate construction before tuning weights. Do not increase radius/time blindly or loosen “new information” checks until the fixture passes.

#### M5B.6 — Files, interfaces and ownership map

| File (new unless marked existing) | Responsibility |
| --- | --- |
| `E/Investigation/EnemyInvestigationDefinition.cs` | Immutable authored strength/scoring/sampling configuration and validation. |
| `E/Investigation/EnemyInvestigationEpisode.cs` | Private bounded state, transition/accounting rules, stable evidence identity and checked history; no scene queries or transform writes. |
| `E/Investigation/EnemyInvestigationPlanner.cs` | Cohesive bounded hypothesis/viewpoint generation and scoring using captured facts and budgeted geometry adapters; no target transform reads. |
| Existing `E/Perception/EnemyObservationRules.cs`, `EnemyPerceptionSnapshot.cs`, `EnemyPerception.cs` | Capture/publish contiguous verified feet samples; retain current evidence provenance and expiry. |
| Existing `E/Navigation/EnemyPositioning.cs` | Own episodes and coordinate visible positioning, personal investigation and existing coarse evidence without cross-renewal. |
| Existing `E/Navigation/EnemyMovementExecutor.cs`, `EnemyMovePlan.cs`, `IEnemyMovementExecution.cs` | Typed token-owned completion/accounting and stationary observation-facing, preserving sole movement ownership. |
| Existing `E/Behavior/Nodes/EnemySeekPositionAction.cs` | Drive investigation ticks during accepted travel/inspection and across reassessment; preserve safe movement and history. The current early return on accepted travel must not prevent accounting, expiry or observation processing. |
| Existing `Assets/_Project/Editor/EnemyShooterFixtureBuilder.cs`, `EnemyBehaviorSandboxWindow.cs` | Author/bind definitions via supported Editor APIs, configure shared probe service, choose weak/ordinary/persistent fixture presets and reset to apply tuning. |
| Existing `Assets/_Project/Debug/EnemyBehavior/EnemyBehaviorDiagnostics.cs`, `EnemyBehaviorScenarioDriver.cs`; `Assets/_Project/Editor/EnemyPerceptionWindow.cs` | Read-only episode inspection, repeatable scenarios and trace capture. No diagnostic target feed into decisions. |
| New fixture definitions under `Assets/_Project/Debug/EnemyBehavior/` and existing `OrdinaryShooter.prefab` | Definition references and per-preset perception data; Editor-generated assets/metas. Preserve native graph identity, existing bindings and runtime isolation. |
| `T/EditMode/EnemyInvestigationRulesTests.cs`, `T/PlayMode/EnemyInvestigationSearchTests.cs` | New pure/actual-native search proof; extend existing perception/navigation/investigation/graph/diagnostic fixtures where their contracts change. |

Implement these explicit seams (small records/enums may stay beside their owning type; do not create an interface hierarchy just for this plan):

- Immutable `EnemyObservedMotionSample`: accepted feet `Vector3 Position`, `double ObservedAt`; current and optional previous exposed by perception snapshot, gated by verified personal sight.
- Actual seam: `EnemyInvestigationEpisode.TryBegin(EnemyPerceptionSnapshot snapshot, EnemyInvestigationSettings settings, Vector3 start, Vector3 forward, double now, out EnemyInvestigationEpisode episode)` rejects visible, expired, mismatched or malformed evidence. Positioning validates observation source/spawn ownership and retains consumed episodes; validated immutable settings are captured at actor initialization.
- `EnemyInvestigationPlanner.TryPlan(EnemyInvestigationEpisode episode, EnemyBehaviorContext context, double now, out EnemyMovePlan plan)` uses existing `EnemyPlanStatus` for Ready/Deferred/NoPath/NoLegalPosition/InvalidContext. Keep investigation phase/outcome separate so NoLegalPosition cannot mean “player absent.”
- `EnemyPositioning.TickInvestigation(EnemyBehaviorContext context, double now)` advances accounting, evidence transitions and stationary inspection even when the movement executor already has a route; idempotent for repeated same-frame calls.
- Typed `EnemyMovementOutcome` carries `EnemyActionToken Token`, a stop-reason enum and `float Travelled`; `IEnemyMovementExecution.TryConsumeOutcome(EnemyActionToken token, out EnemyMovementOutcome outcome)` is owner-specific and at-most-once.
- `IEnemyMovementExecution.TryObserve(EnemyActionToken token, Vector3 lookPoint, double deadline)` accepts a bounded stationary-facing request at the actor's actual supported position under existing ownership/status rules. Its claim is acquired/renewed consistently and released on every terminal path. It cannot invalidate another owner's travel.

These seams were reconciled against existing callers in B1. No snapshot exposes a live player transform to the investigation planner.

#### M5B.7 — Implementation tasks and discriminating proof

**Execution ledger (14 October):** baseline HEAD `a783c6541f78c0abce005305f0f6dce5f581d4cb`, branch `codex/enemy-ai-rebuild`, with pre-existing dirty M5 graph/sandbox/navigation/observation work retained. Unity MCP confirms `E:/IndieGameProject/ProjectI`, 6000.6.4f1, compiled/imported and idle runner; clean saved PlayTestScene was playing the sandbox and was stopped for exclusive verification. CLI WindowsApps launcher is inaccessible, so supported MCP is used. No dependency, saved navigation or terrain changes are authorized. Lead-only writes; reviewers `m5b_technical_pre`, `m5b_gameplay_pre`, `m5b_design_pre` use canonical `gpt-6.1-sol` / medium / clean context, read-only and no Editor operations.

Pre-review reconciliation: preserve terminal token identity after invalidation and monotonic travel charging; tick before seek early returns and on attack entry; record real perception eye pose/time for inspection rather than testing current facing against a historical sample; capture accepted feet only inside successful sight; geometry-only belief projection/scoring ignores actor occupancy, while actual movement retains collisions; preserve stable FIFO requester and bounded history. UI separates evidence retention from active search, selected/active preset and assumptions/checked/unknown. Supplied four-metre wall must expose far-side space; existing twenty-metre wall-removal scenario remains a separate reacquisition contract. No unresolved design approval needed. Duration remains unknown pending B1/B3. B1 exact discovery is saved at `TestResults/m5b-discovery/b1.txt`; deliberate RED request `0c59502044b14a97b6f63a49509769c6` is running under label `m5b-b1-red-01`. No runtime replacement has been edited.

B1 result: exact two leaves completed, 0 passed / 2 intended assertion failures / 0 skips, terminal matched and no conflict. Source `DB49E5FB6C36CE3FF291799AADA674DD7872BEF58A00A9EA5914A0DF80270B19`, compiled `08A473F6D73023AD03F5D3401D0A0233DD1E2598D681210FA5F4FD98CC1C07F6`; manifest `TestResults/foundation-runs/m5b-b1-red-01-0c59502044b14a97b6f63a49509769c6/result.json`. Traces `TestResults/m5b-b1-trace-c7ac9c75a6894480856f3fc250dd2a1b/wall.csv` and `TestResults/m5b-b1-trace-6e9a77c5676e432582c6c3e59e7c6abe/wall.csv` show unrenewed personal sight, repeated completed destinations near `(404.15,0,399.13)` / `(407.27,0,399.07)` and no far-side exposure. First test records four repeats. Native actor movement was never manufactured. The clip SHA256 is `70D7F2552BB5C53D7022620FDC060A8E322D19757ACB605CE7A9600EA7D08BFF`; its runtime identity remains unknown. Confirmed mechanism: actor-relative regeneration plus forced movement and old-point lane preference, without checked history. One movement implementation, seek/interface consumer, navigation fixtures and serialized capability bindings; no alternative movement mock found. B1 complete; B2 RED request `813c4629e26344ada26d93dca3908281` completed four intended missing-definition/motion assertions, no skips. B2 now implements validated immutable tuning capture and genuine feet/sample-pose publication; GREEN pending.

B2–B4 progress: B2 first GREEN `9eda49fd16fd47aca67f0fa239d1f66b` passed 17 rules/observation leaves. Editor-created fixture presets are weak 3m/3s/9m travel/2 attempts/1 inspection, ordinary 6m/6s/18m/4/3, persistent 9m/9s/27m/6/4, paired with 3/6/9s memories. Compact technical review found the short-memory continuity edge; deliberate RED `a59a0bec7d504d4f83ae8aebd8fd1382` caught it, and expiry now breaks continuity before accepting a new sight sample. Authored gap/speed/noise validation remains in the investigation owner. Revised real episode rules plus observation fixture pass 23 leaves in `15ab8bdf073b4b93a549ed1c45e8fdf2`.

B3 uses frozen feet/axis, fixed weighted samples/viewpoints, separate FIFO visibility grants, actor-excluding world masks before geometry buffers, per-ray/per-native-path accounting, conservative saturation and geometry-signature invalidation. A bounded two-leg native route through the immutable anchor handles physically added cover absent from fixture NavMesh; both legs and combined full route are validated. No saved navigation/terrain changes. Compact review corrected ranked claim alternatives, authored eye rotation and partial-weight invalidation. B4 deliberate RED `2c2ebd923a16443285022297d8688405` reached missing terminal-result plus original wall assertions (3 failures). Typed outcome/monotonic accounting, fresh stationary observation token, sample pose/oriented dwell, tick-before-seek/attack and max-four private episode history are integrated. Initial native GREEN `4b4191e6ccf74b6190a63f2924239f49` passes all 3 wall/outcome leaves (source `4CF44FA1C8027D3BE2F334657B0011BE390C10766FF378B2A25C0093EA8A57D7`, compiled `9DE8C6FC53A13D4D395095555468AFAAA75B33AC6A3FC9DC8882B75FE985E149`). Subsequent 9-leaf attempt `e1a5cc0377c14a52aaac656602a9ebd3` passed 8 and failed stress-fixture real sight acquisition before budget assertions. Its actor lanes/target lifetime setup was corrected; failure retained, not a product pass.

B5 provides reset-applied presets, captured-definition controls, distinct evidence/search diagnostics, scene markers and scripted comparisons. Scripted cases are not human acceptance. Reviews corrected inspection cleanup, eye-facing yaw and geometry-only hypothesis scoring. The superseded `8b3bc4a4882a48c89070303fdd6b400a` and `a2acddd982244cecb97695aa8a9f7789` requests retain their five failures each. A later broader search candidate `14666b4d4bee4a45be2d7cd08a5340e0` retained one reset-assertion failure (40/41); the corrected sandbox fixture then passed 17/17 in `36e40cfdf0f842bc8263e6cbdee177bc`. See the latest reconciliation below for the frozen native/EditMode results and packaged players. Allocation reporting was corrected to “unavailable” because the Editor counter returned zero for a known retained allocation; no zero-allocation claim is made.

For every runtime task: add the named failing tests, discover the exact leaves, run and retain deliberate RED, implement the smallest coherent change, rerun focused proof, then obtain the relevant compact review/delta check. Never change asserted fairness, geometry or deadlines to obtain GREEN. After required reviews and agreed checks pass, create a scoped local commit of that task's owned changes under the [current closure policy](../../AGENT_WORKFLOW.md#slice-closure-and-local-commits); preserve source/evidence identity, unrelated work and open acceptance gates. No automatic push, amend or blanket staging.

**Earlier checkpoint (superseded by the final automated checkpoint below):** the frozen [affected native manifest](../../../TestResults/foundation-runs/m5b-integrated-native-08-7566ce53b0ef428eb8f762b1eb170ad5/result.json) is GREEN, 225/225 with zero failures/skips; the [full EditMode manifest](../../../TestResults/foundation-runs/m5b-integrated-editmode-09-56d2bcf75d524a24aa27b58fe7b62ccf/result.json) is GREEN, 1,127/1,127 including a genuine stopped-session reload. The later geometry/search fixture is GREEN, 21/21 (`f944691082d74af0aa9a35ac7b42a215`), and the corrected complete sandbox fixture is GREEN, 17/17 (`36e40cfdf0f842bc8263e6cbdee177bc`). Earlier invalid/failed attempts remain historical; the 40/41 search candidate is not being recast as GREEN.

The same packaged development build passed [two-peer](../../../TestResults/m5b-built-2-bba43e479fa54fc09be7786a96652cfb/result.json) and [four-peer](../../../TestResults/m5b-built-4-48bc3fbc85334303abc645cc4f4fe1a8/result.json) loopback runs. Both report build ID `7b787fc479a244c59ae202309ede031d`, source identity `F760F417EDE0C15521D659CDC5EC2106BE6933CA976DFEFAF1F05A0F1CAF9D0F`, graph identity `fbc1f652f677fea44b886305a47f05c8/11400000`, and no cleanup error. They exercise remote search movement/presentation, zero client authority, target disconnect during search, launched-flight reset and host transport shutdown. They use one process and loopback clients; independent processes/networks, latency, unexpected host-process loss, hardware and human acceptance remain outside this proof. The latest chat says normal and release builds plus exclusion audit remain; the development player is already built. The allocation counter is unavailable in this Editor, so profiling still needs its measurable query/timing/service-age results and an honest allocation limitation. Three independent post-reviews have returned and cleared the corrected seam/fixture. Final promotion remains open for the normal/release variants and exclusion, remaining contract/diagnostic checks, profiling, and human keep/tune/revert.

**Earlier build-seam checkpoint (superseded below):** `EnemyInvestigationBuildHarness`, `EnemyInvestigationFixtureAssets` and `EnemyInvestigationBuild` are authored for the explicit development-only `--m5b-search` launch flag, and packaged fixture inputs/identities are recorded by the build helper. All three independent perspectives reviewed the seam; cleanup/session ownership, per-client authority and reconnect-before-host-shutdown fixes are recorded. Packaged two/four-peer development runs now pass as detailed above. Normal/release build exclusion is still pending. Both packaged cohorts use one process and loopback clients; they do not prove independent-process, separate-network, latency, hardware, human acceptance or unexpected host-process loss. Geometry-change normalization, Normal/Large projected-region/floor bounds and cached-route deadline handling have passing focused evidence. Final normal/release builds, exclusion, profiling and human keep/tune/revert remain open.

#### M5B final automated checkpoint — 14 October 2026

This checkpoint supersedes earlier “running/pending” ledger entries. Final normalized source/assets/settings identity is `F760F417EDE0C15521D659CDC5EC2106BE6933CA976DFEFAF1F05A0F1CAF9D0F`. The original 225-case native gate used `5AE89EE67793912EC23B39C143510644D51517A1906D6ADB9DFDB661B349D8AA`. After that gate, only the scenario driver, packaged harness and scenario test file changed: [file snapshot](../../../TestResults/m5b-final-gate-1791953765557/before-files.json). **209 unchanged native leaves are compatible retained proof; the final 17-case scenario fixture supersedes its earlier 16 leaves.** These are separate manifests, not a fabricated single-source 242-case run. Runtime search/perception/movement, their tests, authored assets, packages and saved scenes/navigation remain byte-identical across that delta. The native gate is complete affected-fixture coverage, not the full PlayMode assembly.

| Gate | Actual evidence and result |
| --- | --- |
| Complete affected native selection, including capability/projectile contracts | [225/225 manifest](../../../TestResults/foundation-runs/m5b-integrated-native-08-7566ce53b0ef428eb8f762b1eb170ad5/result.json), 329.19 s execution; includes all 27 search leaves. No failures/skips/inconclusive/conflict. Reuse only the 209 unchanged leaves as described above. |
| Final complete sandbox fixture | [17/17 manifest](../../../TestResults/foundation-runs/m5b-fixture-final-12-36e40cfdf0f842bc8263e6cbdee177bc/result.json), 47.88 s execution, final source; includes actual remote search/disconnect and interrupted placement restoration. [Per-file baseline](../../../TestResults/m5b-final-gate-1791953765557/before-fixture12-files.json); no observed drift. |
| Full final EditMode assembly | [1,127/1,127 manifest](../../../TestResults/foundation-runs/m5b-final-editmode-13-0860370e3939482bbc6e6b970d1e566b/result.json), 20.93 s execution, one genuine reload; final source, zero failures/skips/inconclusive/conflict. |
| Scoped development build | [Audit](../../../TestResults/m5b-final-gate-1791953765557/DebugDevelopment-verified/audit.json), GUID `7b787fc479a244c59ae202309ede031d`; 0 errors / 507 warnings, 30.43 s. Native report, packed inputs/assets and full executable/UnityPlayer/data fingerprints retained beside the audit. |
| Packaged two/four peers | [Two-peer report](../../../TestResults/m5b-built-2-bba43e479fa54fc09be7786a96652cfb/result.json), [identity/timing](../../../TestResults/m5b-built-2-bba43e479fa54fc09be7786a96652cfb/evidence.json); [four-peer report](../../../TestResults/m5b-built-4-48bc3fbc85334303abc645cc4f4fe1a8/result.json), [identity/timing](../../../TestResults/m5b-built-4-48bc3fbc85334303abc645cc4f4fe1a8/evidence.json). Same final source/build/graph; every required predicate passes, no primary/identity/cleanup errors, owned process exits confirmed. |
| Normal development build | [Audit](../../../TestResults/m5b-final-gate-1791953765557/NormalDevelopment-verified/audit.json), GUID `70670ec4a65a4648be297996d4084c92`; 0 errors / 640 warnings, 21.26 s. Normal packed-asset inventory is unavailable because this existing builder does not request DetailedBuildReport; native report/full built bytes are retained. |
| Release build and exclusion | [Final audit](../../../TestResults/m5b-final-gate-1791953765557/ReleaseExclusion-verified/audit-final.json), GUID `12d5aa95134b4653b581f654589965f9`; 0 errors / 752 warnings, 63.48 s. M5B executable fixture/diagnostic types and profiling fields absent; no fixture scene/prefab/data assets packed. Existing legacy debug entry predicates compile to `ldc.i4.0; ret`. Seven inert MonoScript metadata records are distinguished from executable types. Initial overbroad audit and a method-body API wrapper failure are retained; neither counted as passing exclusion. |
| Fresh normal-menu regression | [Report](../../../TestResults/main-menu-dc6ed96df75447919da700a4c94222a8/result.json): ten phases pass with 75 ms delay / 15 ms jitter / 1% loss, two/four-player loadout/admission/entry, normal host loss/rehost and owned cleanup. Executable SHA256 matches the normal audit. This is separate from search-active host-loss/latency acceptance. |

**Implemented behavior:** validated immutable per-actor strength settings; frozen genuine feet/motion/observer pose; bounded world-only hypothesis/viewpoint sampling, new-information scoring and native route validation; persistent checked/completed/failed history; separate FIFO path/probe budgets; typed at-most-once movement outcomes and monotonic distance; real oriented stationary dwell plus a new perception sample; original evidence/deadline, target lifetime, status, authority, attack and sole movement-owner rules. A null definition disables personal search safely. Existing visible commitments/attacks and hearing/report semantics are retained. Ordinary tuning remains provisional: 6 m / 6 s / 18 m cumulative travel / 4 attempts / 3 inspections; Weak is 3/3/9/2/1 and Persistent 9/9/27/6/4, paired with 3/6/9 s personal memories. No weight/balance acceptance is inferred.

**Packaged scope:** one development process hosts actual NGO loopback managers, with duplicate client physics and scene synchronization isolated. All one/three original clients observe movement, preparation and projectile presentation with zero graph/planning/attack/projectile simulation/damage authority. Disconnect interrupts an actual admitted remote-target search after **stationary-target occlusion and a controlled accepted 0.3 s stun**, through normal status/perception owners and unchanged clocks. This is lifecycle proof, not spontaneous moving-remote-player cover acceptance. Reset requires the same active flight slot/generation observed by every intended connected peer before clearing it; rejoin restores the exact cohort before host transport shutdown. Transport shutdown is not unexpected search-active host-process loss. All four trace hashes and peer identities were independently audited by `m5b_technical_post`.

**Profiling:** native [one](../../../TestResults/m5b-profile-cf57dbbece2c4caeb5668fb2193e8e94/queries.csv), [three](../../../TestResults/m5b-profile-8a1952ae657e473bbf1efb6fe764b0e1/queries.csv) and [six](../../../TestResults/m5b-profile-2a500f6c43e149b99ad31d3e658b11c7/queries.csv) actor cases pass shared caps (8 path / 16 probe grants; six-actor contention 2/2), require every qualified actor's participation and empty cleanup queues. Maximum serviced age is 0.00810 s; first-admission latencies are approximately 0.47–0.70 s. Observed combined query windows peak at 0.151/0.234/0.309 ms respectively; per-actor maxima span a larger measurement window. These fixtures use one viewpoint candidate, not a worst-case default/full-game benchmark. Managed allocation measurement is **unavailable**: this Editor returned zero for a retained 1 MiB calibration allocation. Default-off instrumentation calibrates and labels that limitation rather than claiming zero allocation. Native/whole-game costs and representative hardware remain unmeasured. Final build and automated durations above are measured separately; no complete task-duration measurement is claimed.

**Editor inspection and handoff:** [native camera render](../../Evidence/EnemyAI/2026-10-14-m5b-editor-wall-final.png) and [same paused owner/marker state](../../../TestResults/m5b-final-gate-1791953765557/editor-wall-inspection.txt) show the retained wall and a real admitted Ordinary investigation. Camera rendering omits Editor Handles; marker coordinates/labels come from the actual observation view. The native Behavior window was opened with the current host selected; human debugger icons/readability remain a manual check. [Ready-state record](../../../TestResults/m5b-final-gate-1791953765557/human-ready.txt): Editor playing, unpaused, one Ordinary shooter, player alive, profiling off, visibility budget 16, no old claims/search queue. Opening/resetting never rebuilt saved terrain/navigation.

**Review/preservation:** all six pre/post reviewers used canonical `gpt-6.1-sol` / medium / clean context, read-only. Lead alone wrote and owned Editor operations. Technical/gameplay/design delta reviews cleared accounting, sample pose, query admission, eye yaw, claim alternatives, geometry cache invalidation, final cached-route feasibility, diagnostics, fixture cancellation, build ownership and evidence corrections. Snapshot comparison confirms only the three fixture files changed after the 225-case gate. Original dirty M5 work, graph/prefab identities and asset/meta pairs are preserved. Build warnings are retained package/analyzer/shader/mesh notices; no warning cleanup or dependency upgrade was attempted.

**Retained failures/limits:** earlier RED/fixture/compile/identity failures remain failed artifacts. Cached-route deliberate RED attempt 06 (`3e1a431b3d7f4e5fa2f8a270ac01a7e1`) caught a 3.386 s cached route with only 0.695 s remaining; final feasibility filtering is restored and passes. Attempts labelled RED01–05 did not expose that regression and are not counted as deliberate RED proof. Requests `709fd7246c6f446aae65dee91ad230dd` and `9f8fabd269104c2cb305fba370f1b446` had identity drift and are excluded; the final ready/imported fixture run passed with a per-file watcher. Packaged setup failures cover registration-before-host, restricted-shell networking, remote teleport invalidation and valid visible-route reacquisition before the search prerequisite; all preserve cleanup. Unrestricted local-network execution resolved shell admission. A positive retry after a failed admitted viewpoint and changed world geometry is source-reviewed rather than separately isolated; actor-only obstruction movement conservatively does not trigger that retry. World-cover authoring must use non-actor layers. Complex arbitrary/U-shaped cover is not guaranteed to yield a useful flank; finite honest failure remains legal. No natural-arrival campaign or M6/M7 qualification is claimed.

**Human retest:** use **ProjectI > Debug > Enemy AI > Shooter sandbox**. Select **Ordinary** in **Search preset (next reset)**, launch/reset **Manual: one shooter**, and confirm active Ordinary. Click Game view, face the wall/shooter, earn sight by peeking, then hide and stop; repeat left, right, silent double-back and an escape outside radius without firing. Check purposeful movement/brief observation, fair wrong guesses, no repeated completed A→B→A on unchanged evidence, and finite cessation. Use **Reset current fixture (F5)** between attempts. After every reset select the replacement actor in **Inspected shooter**, then reopen **Show memory and move destination (Scene view)** and **Open live Behavior graph**; the old observation window reference does not follow the replacement. Enable **Observe live owners** and Auto-Connect Debugger or choose that host in the graph debugger. Compare Weak/Persistent on the same geometry/actions; selecting or editing an asset takes effect on reset/respawn. Only after one actor is readable, try **Manual: small group (3)**. Record keep/tune/revert separately for movement, fairness and diagnostics. **Stop sandbox / restore Editor scenes** performs owned teardown and restores prior Play settings. Human feel/readability, independent-process/search-active latency/separate-network/hardware and unexpected search-active host-process-loss acceptance remain pending; no M6 until the M5/M5B human decision.

**B1 — Establish the defect and freeze the integration contract.** Files: existing scenario driver, diagnostics and native investigation fixture; this section.

- [x] Capture a reproducible wall case with actual perception/graph/movement, matching the clip's relative geometry; record sight timestamps, candidate IDs/scores, routes, terminal reasons and actor positions. Do not move the actor manually to manufacture arrival.
- [x] Add `UnchangedSighting_DoesNotAlternateCompletedViewpoints` and `WallLoss_InspectsNewlyExposedSpaceOrReportsBoundedFailure`; show which assertion fails on the current code. Distinguish renewed sightings from same-evidence cycling.
- [x] Trace capability/interface callers, fixture service ownership and graph cancellation before finalizing B2–B4 seams. Record pre-implementation technical/gameplay/design review findings and the agreed red-case identity. If the hypothesis is contradicted, revise the plan before runtime changes.

**B2 — Author strength and trustworthy observed movement.**

- [x] Validate and capture immutable per-actor strength; capture only contiguous verified feet/eye samples; preserve serialized personal-evidence retention and unrelated defaults. Eleven investigation rules and retained perception rules pass in full EditMode.
- [x] Author/import Weak/Ordinary/Persistent assets with preserved GUIDs; verify all three memory pairings, private startup settings, null-definition behavior and reset-to-apply. Private actor-owned episode collections and distinct actor participation were inspected; no mutable state lives in shared definitions.

**B3 — Persistent episode and useful viewpoint selection.**

- [x] Implement frozen local hypotheses/viewpoints, normalized initial weights, new-information scoring, stable history and geometry-only projection/visibility. Actual tests consolidate the proposed case names: same-evidence reentry, target return, current-view checked coverage, ambiguous direction, and retained hidden-endpoint equality of hypotheses/weights/choice/destination/facing.
- [x] Verify no eligible ground, all useful routes blocked, projected radius/height limits on actual stacked native floors for Normal/Large, merged samples/viewpoints, claim alternatives, native physical-cover corner detour, saturated unknown probes and geometry-change normalization.
- [x] Verify stable partial/FIFO requests, exact per-ray/per-path grants, original expiry, final cached-route time feasibility and one/three/six-actor participation/caps. Fixed arrays and bounded per-target history are source-reviewed; allocation measurement remains unavailable as recorded above.
- [x] Verify failed/cancelled admitted travel consumes an attempt/distance and marks no checked cells; completed current viewpoints do not repeat. Positive retry following changed world geometry is source-reviewed rather than separately isolated, and actor-only obstruction changes conservatively do not qualify.
- [x] Supplied-wall native traces reveal far-side space before original expiry; actual final owner/candidate/marker state and native geometry render are retained before human weight/balance tuning. Forced-current rejection is removed atomically; visible holds/coarse evidence are preserved.

**B4 — Execute, inspect and terminate under one owner.**

- [x] Implement/verify typed at-most-once terminal outcomes, monotonic actual travel, owned stationary facing, oriented dwell/new sample, deadline/budget retention and tick-before-seek/attack integration. Real graph wall trials and explicit reentry preserve history; no parallel test brain or manufactured arrival.
- [x] Verify root/stun, authored eye yaw, cancelled travel, ordinary forced displacement, native corners/route tails, claim release and cached-route feasibility. Geometry/status interruptions do not refund or extend search.
- [x] Verify hearing/report nonrenewal, expired same-evidence refusal, genuine reacquisition through existing sight/attack rules, recycled target lifetime/stale outcome, peer target death, reset/flight cleanup and actual status-assisted remote-target disconnect. Generic actor shutdown/lifecycle contracts cover the shared shutdown path; no claim of an exhaustive new search-specific death matrix.
- [x] Complete affected native capability/projectile/shooter/perception/navigation/lifecycle/passive contracts. No weapon damage/recovery changes or normal-stage activation.

**B5 — Tuning workflow, observability and human comparison.**

- [x] Deliver grouped strength inspector, reset-applied presets, selected/active labels, actual evidence/search deadline distinction, candidates/hypotheses/checked/unknown/commitment diagnostics and five scripted hide comparisons.
- [x] Verify preset transitions, repeated/downed reset, interrupted remote placement, diagnostic/marker purity, actual graph/asset bindings and development/release exclusion. Open the native graph and observation windows against the current sandbox actor.
- [ ] Human left/right, stopped, silent double-back, unseen escape and Weak/Ordinary/Persistent comparisons; one actor before three. Automated scripted placements/render/inspection do not supply keep/tune/revert or marker/debugger readability acceptance.

**B6 — Frozen integrated proof and M5B decision.**

- [x] Freeze identities and complete the focused/full affected native, full EditMode/reload, normal/development/release/exclusion and two/four-peer packaged gates in the final table. Reuse only the 209 compatible unchanged native leaves; final 17-case fixture replaces the earlier 16. Retain failures and exact source/build/graph attribution.
- [x] Run the fresh ten-phase normal-menu regression after confirmed cohort cleanup. Record query/timing/service-age measurements and unsupported allocation measurement; no natural-arrival campaign.
- [x] Obtain/reconcile independent technical, gameplay and design/UX pre/post/delta reviews under canonical model policy. Independent final evidence audit confirms exact discovery, every peer predicate, trace hashes and cleanup.
- [x] Update catalogue/current brief and preserve existing dirty work, assets/metas, terrain/navigation, pins and development-only isolation. No commit/push, M6 or production promotion.
- [x] Leave the verified unpaused one-Ordinary-shooter sandbox ready with current observations/native graph; record exact human retest controls.
- [x] Record the user's human keep/tune/revert: keep/accepted on 15 October, including ramp/stair corrections. Representative hardware, separate-network/search-active latency and unexpected host-process-loss qualification remain explicitly unverified; the human decision prerequisite for M6 is satisfied, but M6 is a separate task.

#### M5B cover-sampling extension — 14 October 2026

User-authorized focused follow-up: angled world-geometry probes should find plausible
cover pockets between the original markers, including slopes and stacked floors. A later
explicit request raises Ordinary's candidate cap from 12 to 16 and makes it prominent in
the Inspector; the existing adjustable 1–24 range remains. Later requests expose fan
density, metre radius and degree half-angle in that same Inspector, while retaining the
prediction-location cap. No hidden target positions, M6, normal-stage activation, dependency
changes, terrain/navigation rebuilds or commits. Lead owns all writes and Editor operations.
Medium bounded planning risk, with all three independent pre/post perspectives explicitly
requested. Canonical reviewers are `gpt-6.1-sol`, Medium, clean context, read-only.

Hypothesis: a bounded fan aimed from the captured observer into supported ground around
the frozen predicted region adds useful occluded samples missed by cardinal rings. Same
captured evidence and geometry must produce the same samples and first choice regardless
of hidden player position. A wall hit alone never establishes standable ground or occupancy.

Ruling: use a finite set of fan endpoints and retain only genuinely occluded, supported,
anchor-connected ground; reserve at most half the existing hypothesis capacity, then fill
with original guesses. Trace local ground height from the anchor for fan endpoints rather
than projecting onto a roof. Freeze samples before weighting/inspection, preserve pending
sampling across budget deferral, and reset only unfinished generation on geometry change.
Terrain crests can occlude a body, so walkable normals identify support during grounding;
they are not a blanket reason to ignore an actual body-height sight obstruction.

Files: planner/episode/definition, common Inspector controls, narrowly height-aware navigation projection/route sampling, native
cover/search tests, observation legend, this packet/current brief/catalogue. Existing presets,
deadline, history, claims, real-sight attacks and sole movement writer stay authoritative.
PRE technical/gameplay/design reviews concur; key constraints are reserved capacity,
correct-floor selection, per-query grants, stable sample identities and sample-only labels.

Proof: failing native wall-pocket and close-floor cases first, focused new wall/uphill/downhill/
Normal+Large stacked-floor/hidden-position equivalence, complete affected search/investigation/
navigation/shooter/scenario fixtures once after source freeze, full EditMode including genuine
stopped-session reload, necessary normal/scoped-development/release builds and exclusion,
two/four-peer packaged search, and existing one/three/six query-cap profiles. Reuse unchanged
normal-menu/session/progression proof from the preceding checkpoint with explicit identities;
no new unrelated campaign. Estimate tens of minutes, dependent on compile/test/build latency.
Escalate new authority/lifecycle changes or failing relevant contracts; stop at a clean affected
automated gate and ready Ordinary sandbox. Human keep/tune/revert remains separate.

Implementation at the automated checkpoint: four diagonal half-radius fan endpoints
(±45°/±135°), at most half the existing hypothesis capacity. Each local support step and body-height occlusion
ray spends one shared probe grant; up to 32 half-metre support steps per endpoint.
Nearest local world obstruction gates a sample; a hit is not a new movement command.
Investigation projection favours the expected support height. Route interpolation uses
that same height preference so an overhead floor cannot steal a lower-floor route.
Other projection callers retain their prior default; complete navigation regression is
included because route sampling is shared. Projection keeps its own hit buffer because
nested support checks overwrite the original navigation buffer.

Preflight: dirty-work snapshot [before-files](../../../TestResults/m5b-cover-1791959440555/before-files.json),
Editor stopped/compiled/idle, 6000.6.4f1, no Console errors. RED01 is retained invalid
compiled-identity/setup evidence; the downhill placement at the landing edge was invalid.
RED02 [manifest](../../../TestResults/foundation-runs/m5b-cover-red-02-0a82be8cf41b4d818cef01fa4dfcb448/result.json)
is exact six intended assertion failures, no skips/conflict, terminal matched. Cardinal
samples miss real occluded diagonal space; close overhead floors leave zero lower-floor
hypotheses; uphill/downhill miss supported diagonal cover. This confirms the sampling
and height-projection mechanisms before replacement.

GREEN03 and trace04 retain three passes/three failures. Trace showed the two sequential
fairness plans had equal samples/weights but unequal remaining time: a 13 m route was
affordable at the first decision and correctly refused at the second. The comparison
now uses a stricter identical 9 m route envelope, preserving the original deadline.
The 2 m slope fixture put every proposed diagonal within the wall clearance; its corrected
3 m region and 0.4 m wall offset provide genuinely supported standable far-side ground.
These fixture corrections do not alter human presets, production limits or assertions.
Post technical/gameplay/design source reviews found no blocking source defect; final
evidence and compact fixture recheck remain pending. Earlier final checkpoint is the
preserved baseline, not fresh proof for this delta.

GREEN07 passed all six new cases at `18025E49B6AA0777402E837414E17BAC8C49F529F21F51F5AB620166596D6A9C`.
The final slope fixture uses an owned 6 m ramp / 4 m sample region / 0.7 m wall offset,
with no change to the shared fixture's default 3 m ramp or saved navigation. Frozen
hypotheses/weights are compared exactly across hidden positions. First choice uses a
fresh genuinely earned sighting with equal anchor/observer/velocity and the same 9 m
route envelope, avoiding a false comparison after the original clock has run down.

Integrated08 completed exact 232 leaves, 229 passed / 3 failed / no skips, valid terminal
and identity. A real regression filled the candidate cap with hypothesis-derived views,
crowding out useful lateral views. Trace09 established stationary inspection followed by
NoUsefulViewpoint on the retained wall. Reserving both lateral standoff views after the
starting view fixed it: GREEN10 passed the unchanged movement >1 m / releases >=3 case.
No scoring/safety privilege or extra candidates are granted to those reserved views.

Other Integrated08 failures were fixture assumptions: Persistent's authored duration
changed from 9 to 20 seconds during RED01 (unowned edit, preserved; memory remains 9),
and InvalidGround blocked all new physical probes before expecting a ground proof. The
preset assertion now checks captured authored duration; the unsupported-ground case
defers PATH work while allowing probes, retaining its exact terminal/zero-attempt/zero-
inspection assertions. The external preset edit is included in subsequent frozen identity.
All three final source/delta reviews clear these corrections and the requested cap16 UI.
The final automated checkpoint is complete **before the later Inspector controls**;
no earlier failed checkpoint is called GREEN. Immutable summary:
[automated-pre-controls](../../../TestResults/m5b-cover-1791959440555/automated-pre-controls.json).

- Native11 [manifest](../../../TestResults/foundation-runs/m5b-cover-final-native-11-5c43f52e514447ff9c148e85db98e331/result.json): exact 232 leaves, 231 passed / one unsupported-ground fixture setup failure / no skips, source `2D959D64EFA92DFC54F4259F7E5CBB71CBC78BA9396A5825BCF5C8188E0974CB`. The unsupported-ground helper still sought an initial graph route after removing ground. It now captures real ready sight loss while deferring path admission; assertions remain unchanged.
- Only `EnemyInvestigationSearchTests.cs` changed after Native11, confirmed by [delta](../../../TestResults/m5b-cover-1791959440555/search12-delta.json). Complete Search12 [manifest](../../../TestResults/foundation-runs/m5b-cover-final-search-12-fda79f13902a4606af5e3c2fbd514b08/result.json): all 27 passed / zero skips at `CA36682920F078AA4FB033E892D86523F04A2B30115A9DA46113C1BA09E03348`. Coverage is 205 compatible retained leaves plus 27 fresh search leaves, **not a single fresh GREEN232 run**.
- Full Edit13 [manifest](../../../TestResults/foundation-runs/m5b-cover-final-edit-13-dfc70b16298d43bfaafa9e123fd1d6c3/result.json): 1,127 passed / zero failures or skips, one genuine stopped-session reload at that CA366 source.
- Normal/development/release builds succeeded with zero native errors, respectively 618/640/612 warnings. GUIDs: `758742ad741841188196ee51a7422149`, `7d0e58eac7d74cf6a5f850cf8d570eef`, `fee0d82f3ab647c4bd4539f245d9e2c1`. [Normal](../../../TestResults/m5b-cover-1791959440555/Normal/audit.json), [development](../../../TestResults/m5b-cover-1791959440555/Development/audit.json) and [release](../../../TestResults/m5b-cover-1791959440555/Release/audit.json) audits pass. Release excludes diagnostic/profiling types and fixture data; seven inert script metadata entries are distinguished from executable types. Build tool warning wrappers reported UNEXPECTED_ERROR; native summaries/BuildReports establish successful builds. A first release request hit the idle guard while the owned sandbox was playing; it started no build. The sandbox was stopped before the successful release operation.
- Packaged [two-peer](../../../TestResults/m5b-built-2-2d0ad69d9a1b4d278cff5d05000fb391) and [four-peer](../../../TestResults/m5b-built-4-e4573a705dc845339229d57ec112fdba) search/lifecycle runs pass every recorded predicate on the same development build/source; owned processes exited, no primary/cleanup errors. Real NGO loopback peers share a process with isolated physics; status-assisted remote disconnect setup remains explicit. This is not separate-process/network, latency or hardware acceptance.
- One/three/six-actor query profiles at the fresh Search12 checkpoint retain the shared 8-path/16-probe caps; six-actor stress uses caps 2/2. Maximum serviced ages were 0.0151 s path / 0.02142 s probe. First-plan latency was 0.877 s / 0.782–0.896 s / 1.285–1.561 s, combined query windows 0.1865 / 0.2211 / 0.5493 ms. CSVs: [one](../../../TestResults/m5b-profile-25fe523401064c75bd7077dcbad2d189/queries.csv), [three](../../../TestResults/m5b-profile-3d76a8c2212b4646bdbffc20dea01807/queries.csv), [six](../../../TestResults/m5b-profile-8280e55ee8b048e6897e0c78df6508d8/queries.csv). Allocation measurement is unsupported, not zero. These cap-one-view profiles do not establish default-16-view performance on representative hardware.

The preceding M5B normal-menu/session/progression evidence is reused only under its
unchanged identity/requirements predicates. No unrelated campaign was rerun or promoted.
Independent technical/gameplay/design POST and compact delta reviews clear source,
fixture corrections and Inspector bindings; reviews do not replace tests or human feel.
The final controls [review ledger](../../../TestResults/m5b-cover-1791959440555/controls-review-ledger.md)
records model/role selections and degree-control PRE/POST findings.

**Later Inspector request and explicit no-new-tests boundary:** after all proof above,
the user requested editable density/radius, then clarified degree spread while keeping
metre radius. They expressly forbade new tests after exposure. Final controls compile,
bind through `SerializedObject`, validate/capture and have all three independent pre/post
source reviews; **no tests, builds or scripted scenarios were run after these changes**.
Current canonical source `1F44F1BF0AF6CE183A8C8CC9DA4D02C4E35F7B1B62020137FB9437F50536F9C1`
therefore has compile/binding/source-review evidence, not the earlier automated gate's identity.

| Common Inspector control | Range / meaning |
| --- | --- |
| Maximum prediction locations | Existing `maximumHypotheses`, 1–16 total anchor/motion/ring/cover assumptions; current presets 8. |
| Cover Fan Sample Count | 0–16 attempted directions, default 4; 0 disables fan. Default four retains ±45°/±135°. |
| Cover fan radius (m) | 0–100 horizontal metres about frozen predicted centre, effective min(value, Search Radius), clipped to anchored region; 0 disables fan. |
| Cover fan half-angle (°) | 0–180 actual 3D grounded-torso ray limit from captured observer toward frozen predicted centre. 45→90° opening; 90→180°; 180→360° and bypasses filtering; 0 disables fan. Separate from sight FOV. |
| Maximum Viewpoint Candidates | Existing 1–24 considered viewing positions, including start; Ordinary 16. Attempts/inspections remain separate ceilings. |

These settings are captured at spawn: reset/respawn to apply. The angle **filters existing
endpoints**, rather than redistributing them into the cone; narrow angles can yield no
extra sample and still spend grounding probes. Fan admissions remain limited to half
the prediction cap, available geometry/merging, shared budgets and original time/travel.
Higher density changes angular layout and may hit the admission cap early, so it does
not guarantee denser coverage everywhere. Sample markers are assumptions; a checked
marker does not prove all space between markers clear. No actual hidden-player marker
is injected. Slope continuity, expected-floor projection, support/clearance and complete
anchor-connected routes still decide admissibility.

Final binding inspection: Weak count4 / radius1.5 / angle180 / predictions8 / candidates12 /
seconds3; Ordinary 4 / 3 / 180 / 8 / 16 / 6; Persistent 4 / 1 / 180 / 8 / 20 / 20.
Persistent's externally edited radius1, candidate20 and seconds20, and Ordinary's merge
distance0.25 are preserved. Persistent evidence retention still caps active search at9 s.
[Controls inspection](../../../TestResults/m5b-cover-1791959440555/angle-controls-inspection.txt),
[source identity](../../../TestResults/m5b-cover-1791959440555/angle-controls-source-identity.txt)
and [preservation](../../../TestResults/m5b-cover-1791959440555/angle-controls-preservation.json)
record the current checkpoint. No missing prior files, existing meta/GUID changes, package
changes or saved scene/navigation changes; owned temporary build folder absent.

**Human handoff:** one Ordinary shooter launched, unpaused, genuine running host/graph,
living player, idle Test Runner, query profiling off, probe cap16, captured radius6 / fan3 /
count4 / angle180 / predictions8 / candidate16. Observations and native graph opened for
this replacement instance. This readiness inspection is not a scripted/human playtest.
No keep/tune/revert acceptance has been claimed.
The final handoff read found that manual session stopped; only after confirming the
same stopped/compiled/idle ProjectI Editor was it reopened. Its final readiness is recorded
in [handoff inspection](../../../TestResults/m5b-cover-1791959440555/final-human-ready-inspection.txt).

Retest: open **ProjectI > Debug > Enemy AI > Shooter sandbox**, use Ordinary / Manual:
one shooter; tune `Assets/_Project/Debug/EnemyBehavior/OrdinaryInvestigation.asset`, then
F5 or Host reset to capture edits and reselect the current inspected shooter. First compare
count4/radius3/angle180 with the same wall pocket; try angle45 (90° opening), then count8
while keeping other limits fixed. Check disappearance between markers, uphill/downhill,
close stacked floors, stationary useful look, interrupted/reacquired search, and an escape
outside the radius. Expect useful bounded exploration or explicit finite failure, no repeated
unchanged A→B→A, no hidden turn correction, roof jump or hidden shot. Repeat with Manual:
small group (3) for contention. Stop/relaunch if the player dies. Record keep/tune/revert;
representative hardware, separate-network/search-active latency and unexpected host-process
loss remain unverified. The requested illustrated guide covers all 24 investigation variables.

#### M5B shared query batching — 14 October 2026

Intent: remove the artificial one-check-per-request/frame delay between visible prediction
markers and movement selection. The user authorizes larger batches and adjustable shared
Inspector budgets, a ready manual sandbox, and explicitly **no new tests**. This is a
bounded scheduler change with high review risk because the query service is shared by
investigation and ordinary/coarse navigation. Lead owns all writes; technical/gameplay/
design reviewers are independently read-only `gpt-6.1-sol` / Medium under canonical policy.

Source trace: markers appear during hypothesis admission, before weighting and exhaustive
viewpoint coverage/path evaluation. The old `spent` set denied each request a second grant
in the same frame, even with unused shared capacity. Eight hypotheses across sixteen
views can require 128 probe frames for one coverage pass, plus grounding and refinement.
No universal fixed sight-loss delay was found. A genuinely useful current viewpoint may
still inspect in place, requiring facing, dwell and fresh sight. This diagnosis is from
source; the user's exact pause was not reproduced or timed.

Implementation: remove only the per-request `spent` set/guard. Successful repeated requests
rejoin the FIFO tail and may consume spare grants; existing queued reservations and
`grants.Count + UsedThisFrame` enforce the same global ceiling. Token validation,
64-request queue bound, abandonment, cancellation, original evidence/deadlines, claims,
attack and movement owners remain. A first caller can spend spare capacity before another
caller arrives; this is queued FIFO protection, not equal per-frame shares or parallel jobs.

The existing `EnemyBehaviorScenarioDriver` Inspector now exposes **Shared path queries per
frame** (8) and **Shared investigation probes per frame** (16), each 1–32 and shared by all
sandbox shooters. Both are captured/clamped together on F5/manual reset, **after** old
actor/request/claim cleanup checks and **before** replacement actors spawn. The sandbox
window exposes the same next-reset fields, reflects Inspector edits, shows actual active
caps separately, and has **Inspect shared planning budgets**. Its supported Stop button
preserves authored budgets for relaunch. Generic Play-stop persistence is not claimed.
No per-enemy definition, authored strength, saved terrain/navigation, GUID, dependency,
normal-stage activation or M6 change is part of this slice.

Files: `EnemyQueryBudget.cs`, `EnemyBehaviorScenarioDriver.cs`,
`EnemyBehaviorSandboxWindow.cs`, the existing duplicate-request budget expectation in
`EnemyBehaviorPositionTests.cs`, catalogue/current brief/this packet. The existing test
is renamed and expects repeated spare grants, unchanged ceiling and protection of an old
waiter's reserved grant; **it was not executed and no test case was added**.

All three independent PRE and POST source reviews clear the actual delta. Fresh evidence
is compilation/import, Inspector binding and manual-launch readiness only; no tests,
benchmarks, scripted scenarios, builds or packaged cohorts. The previous automated gate
predates batching and cannot establish its performance, fairness or integrated gameplay.
Evidence/snapshot directory: `TestResults/m5b-batching-05f955afa4444deab5ab2fc0bc296a1f`.
Final compile, preservation and readiness details are recorded there after import.
Final source: `AE643FAE5778ABF8F2A90A2D1CE3DFF7003AEDC6BDECD475D346876EE4F674C6`.
Compilation/import succeeded, stopped-session Console inspection returned zero errors,
and `SerializedObject` binds both fields at8/16. Preserved user's selected Persistent
preset and one-shooter setup; player alive, host/graph running, driver ready/not busy,
Test Runner idle, profiling off, active shared caps8/16. Observations/native graph opened
for the replacement shooter; shared-budget driver selected in Inspector. Editor was
paused at final inspection: unpause for play/F5. [Readiness](../../../TestResults/m5b-batching-05f955afa4444deab5ab2fc0bc296a1f/human-ready.txt),
[reviews](../../../TestResults/m5b-batching-05f955afa4444deab5ab2fc0bc296a1f/reviews.md),
[preservation](../../../TestResults/m5b-batching-05f955afa4444deab5ab2fc0bc296a1f/preservation.json)
and [delivery](../../../TestResults/m5b-batching-05f955afa4444deab5ab2fc0bc296a1f/delivery.json)
record the handoff. Exactly four source/test files changed from this slice's dirty-work
snapshot; no missing files, existing meta/GUID changes, package or saved scene/navigation changes.

Human retest: **ProjectI > Debug > Enemy AI > Shooter sandbox > Inspect shared planning
budgets**, or select **M5 opt-in shooter sandbox** in the Hierarchy. Start with path8 /
probes16, then probes32; press F5/reset after each change. Compare the same cover loss and
watch time spent in Planning versus a legitimate stationary Inspecting phase. Use Manual:
small group (3) to compare shared-cap contention and frame smoothness. No specific speed
gain or hardware frame-time result is claimed. Human keep/tune/revert and affected native/
network/hardware verification remain pending. Stop at a compiled ready sandbox; no commit/push.

#### M5B wall-crossing cone — 14 October 2026

Intent: replace only the extra cover ring with rays from the captured observer aimed at
the frozen predicted torso centre. The user approved implementation, requested editable
cone size/ray density and downward floor grounding, including walls at ramp/stair tops.
Hypothesis: guesses just beyond actual cover improve near-wall investigation without
reading hidden positions; a repeated near-wall failure would contradict it.

Bounded medium-risk geometry slice; lead writes, three independent read-only technical,
gameplay and design/UX reviewers use `gpt-6.1-sol` / Medium. PRE requires real far-side
geometry, appropriate supported floor, conservative projection/clearance, original caps,
resumable shared-query spending and accurate angle/count/reach labels. Main hypotheses,
host ownership, movement/attack owners, evidence/deadlines/history and authored presets
remain. No saved scene, terrain, NavMesh, GUID or dependency changes.

Mini-plan: planner uses deterministic cone directions and bounded quarter-metre reverse
segments to locate exterior faces beyond an actual wall hit, then traces local support
and casts down at candidate feet. Missing/ambiguous ground, unsafe projections and
unreachable candidates reject. Retain the latest exit while seeking character clearance;
a reverse miss never proves empty space. Finite steps can skip sub-step pockets and depend
on outward-facing collision surfaces; no global backface switch or job owner is introduced.
Definition/Inspector explain retained serialized ray-count/half-angle fields and local
probe reach. Ordinary/Weak's former 180° ring-filter value is deliberately migrated to
15° half-angle (30° cone opening); other tuning and Persistent's disabled probes remain.
Episode stores resumable ray/exit
and grounding progress. Observation labels remain assumptions, never hidden-player truth.

User explicitly authorized **focused cone/ramp/stair tests**, superseding the earlier
no-new-tests limit for this scope only. Add a near-wall RED first, then run complete focused
cover sampling (including retained hidden-position, ramp and stacked-floor cases), plus
focused settings/control checks if affected. Builds, full suites, packaged/network/hardware
and human feel remain omitted. Estimate 15–30 minutes plus Editor latency; escalate owner
changes or unsupported geometry requiring a wider system. Stop at reviewed compiled source
and focused proof; no commit/push or production promotion.

Evidence directory: `TestResults/m5b-wall-cone-7a4079cddea24a5e9f3240ce461156a3`.
Initial Editor: pinned 6000.6.4f1, stopped, imported/compiled, clean saved PlayTestScene,
Test Runner idle, zero Console errors. Dirty-work file hashes are preserved there.
Result and exact evidence identities are recorded below after verification.

Final implementation additionally requires the originally struck collider to establish
the first exit. Nearby adjoining pieces may extend its clearance boundary only within
`max(0.75 m, 2 × agent radius + 0.25 m)` beyond that first exit. Projection may drift at
most 0.2 m vertically from physical support and remains near the sampled ray on its far
side. Rays whose first entry is outside the local probe region are conservatively rejected.
Local support tracing limits vertical jumps; arbitrary overlapping-floor identity is not
guaranteed. Exact Normal/Large stacked-floor and ramp/stair cases below establish only
their tested geometries. All three POST perspectives and compact delta reviews clear source.

Evidence (all retained separately):
- `m5b-cone-red01-0ded67d66f06480485c94ea68ef55739`: one failure at the intended assertion,
  but later found to mix world and fixture coordinates. **Invalid regression proof**;
  not a claimed product RED. Runtime trace still records the prior 3 m ring point.
- `m5b-cone-green02-46163d58ea954f5186490f47e16c5244`: 7 pass / 5 fail / zero skips.
  Four failures are that same new assertion coordinate bug despite valid 1.75–2 m marker
  traces; one new ramp placement was on the tilted ramp/landing seam. These are retained
  fixture failures. Correct coordinates and z17.5 clear-landing placement preserve the
  original tolerances and requirements; retained uphill/downhill cases cover slope travel.
- `m5b-cone-negative03-be99bfa65d12432e80e50db2ceb3a291`: corrected near-wall assertion
  deliberately fails with cover count zero; exact one leaf, zero skips/conflicts, matched
  terminal. This is the valid disabled-feature negative control, not the old sampler's RED.
  Count is restored to one before final verification. An independent full-capsule physics
  assertion closes the compound-wall clearance gap; open-space coverage is added.
- [Final04 manifest](../../../TestResults/foundation-runs/m5b-cone-final04-9de065b9cde542a8aaa6b8052ef1b59c/result.json):
  exact **13 passed / 0 failed / 0 skipped**, valid matched terminal/no conflict, 22.187 s
  execution. Source `B5F9CD7B3B5BFE8512C231AB85AB6745A8C5201752840097E45E721F9B4941F5`;
  compiled `EF33703BAC3BF334A245542089911A87AEC5A2293E16DA44FEED1376EE7675A7`.

Focused proof covers near-wall box/nonconvex-mesh/adjoining wall clearance, ramp/stair-top
landing grounding, missing floor, open space, retained uphill/downhill, Normal/Large stacked
floors, actual useful pocket movement and frozen-hidden-position equivalence. No earlier
full-suite/build/network proof is presented as current cone proof. Broad EditMode/native,
normal/debug/release builds, multiplayer, representative hardware and human keep/tune/revert
remain omitted under the user's focused-only authorization. No production promotion or
commit/push. Final binding/readiness/preservation files are in the evidence directory above.
Final readiness confirms stopped/imported/compiled Editor, idle Test Runner, clean saved
PlayTestScene and zero Console errors. All three serialized controls bind and capture:
Ordinary 4 rays / 15° half-angle / 3 m reach; Weak 4 / 15° / 1.5 m; Persistent 0 / 180° /
0 m (disabled). Ordinary is selected for Inspector tuning; reset/respawn applies changes.
Independent canonical hash recomputation matches Final04. The dirty-work snapshot shows
exactly ten intended files changed, no missing files or meta changes; other existing work
is preserved. Scoped documentation whitespace checks pass. Whole-workspace `git diff
--check` reports pre-existing OrdinaryShooter graph YAML whitespace; that asset is untouched.

#### Cone integrated verification follow-up — 14 October 2026

The user now explicitly requests the more complete testing suite, superseding the earlier
focused-only/no-build limit for this follow-up. Verification-only medium scope; lead owns
all writes and exclusive Editor/player operations. Independent technical gate selection and
build/gameplay audit use the existing `gpt-6.1-sol` / Medium reviewers; the design reviewer
checks control coverage. The earlier three-perspective source reviews remain attributed.

Plan: add bounded cone-control snapshot/angular-distribution and shared-budget reset
contract assertions, then freeze source; exact discovery, full EditMode including genuine
stopped-session reload, eleven full affected PlayMode fixtures, normal/scoped-development/
release builds with exclusion audits, and two/four-peer packaged investigation checks.
Search fixture includes one/three/six-actor budget profiles; prior batching/control proof
cannot substitute for fresh integrated coverage. No normal enemy activation, scene rebuild,
NavMesh bake, dependency changes or unrelated natural-arrival campaign. Product fixes,
if required by observed failures, get focused proof and independent delta review before
invalidated gates repeat. Preserve original failures, immutable identities and owned cleanup.

Affected fixtures (`ProjectI.Tests`): EnemyCoverSamplingTests, EnemyInvestigationSearchTests,
EnemyBehaviorInvestigationTests, EnemyBehaviorPerceptionTests, EnemyBehaviorNavigationTests,
EnemyBehaviorShooterTests, EnemyBehaviorScenarioTests, EnemyBehaviorLifecycleTests,
PassiveEnemyLifecycleTests, EnemyBehaviorCapabilityContractTests, EnemyTracerCollisionTests.
This selection is not the whole PlayMode assembly. Unchanged normal-stage proof may be
reused only after compatibility audit; human/hardware/separate-network/unexpected-host-loss
acceptance remains separate. UI Stop/relaunch and rendered control acceptance are not
established by driver reset tests. Estimate 20–45 minutes, dependent on tests/builds;
escalate ambiguous ownership/infrastructure rather than reroll; stop at complete affected
automated gates or explicit tooling limits, no commit/push.

Evidence root: `TestResults/cone-integrated-20261014-c72516dd30ad4b1b874fdb23f370aa64`.
Initial Editor: 6000.6.4f1, stopped/compiled/imported, no Console errors, clean saved
PlayTestScene, Test Runner idle/no external request. Dirty-work hashes preserved there.
**Result: affected automated gates pass; keep for further human testing.** Final canonical
source is `AB41AC5C644B123684432E4C33759B2A6586FD26B81BAD0EFD008C9EAE8DF6B2`.
This follow-up changes only `EnemyInvestigationRulesTests.cs`, `EnemyBehaviorScenarioTests.cs`
and documentation. Runtime, authored presets, shared fixtures, GUIDs, terrain/navigation,
dependencies and original build configuration are preserved.

- [Edit03](../../../TestResults/foundation-runs/cone-integrated-edit03-4a7ffe6f9b3d4fd58a8a42db8307b28c/result.json):
  full **1,129 pass / zero fail/skip**, one genuine reload, matched terminal/no conflict,
  31.632 s execution at final source. Earlier Edit01 also passed 1,129 at `6A301648…674AAC`.
- [Native02](../../../TestResults/foundation-runs/cone-integrated-native02-618df1dd82f44e61b8b1e8c4ec794fd3/result.json)
  remains **239 pass / one fail / zero skip**, 240 exact leaves, 351.388 s at
  `6A301648BFBDA573DB499C4BC581786F4C4F89DFB37870AE22782E7008674AAC`. The preset-reset
  test hard-coded radius9/attempts6, whereas the user's unchanged Persistent asset already
  authored radius5/attempts12 (before/current SHA256 `390CA259…53C17A`). The reset correctly
  captured those values. The test now captures all relevant authored strength/perception
  settings before reset and verifies them afterward, retaining selection, immutability,
  cleanup and actual search assertions. No authored value or runtime behavior was changed.
- [Scenario04](../../../TestResults/foundation-runs/cone-integrated-scenarios04-ef71deded52c4e729bf952bd73f1f569/result.json):
  all **18 pass / zero fail/skip**, valid terminal/no conflict, 52.704 s at final source.
  Coverage is **222 compatible unchanged Native02 leaves plus 18 fresh Scenario leaves**,
  not one fresh GREEN240 run. All Native02 Scenario leaves are excluded from reuse.
  Runtime/assets/settings/shared fixtures and the other ten selected fixture bodies are
  unchanged; only the Scenario assertion changed after Native02. Independent delta and
  manifest audits accept this attribution. The full PlayMode assembly is 297 leaves;
  the remaining unrelated fixtures were not selected.

| Fresh Windows variant | Native build GUID | Errors / warnings | Native duration |
| --- | --- | --- | --- |
| Normal | `e73f3f72d96b43d792ed811ed078320f` | 0 / 618 | 63.843 s |
| Scoped development | `c943dd42eed74290bf3accdcd2abed64` | 0 / 640 | 19.056 s |
| Release | `2a7628ced6ee4e55b5b3666b7a78f148` | 0 / 752 | 46.204 s |

All native reports and build fingerprints are archived under the evidence root. Release
executable/profiling types, constant-false development guards and fixture data/scenes pass
exclusion; inert script metadata is recorded separately. Development records base source,
graph/original prefab and temporary derivative input hashes. All temporary assets are removed.
The nested build restored scenes in memory but left its temporary PlayTestScene entry on
disk; supported `SaveAssets` flushed the restored list. Original build-settings SHA256
`713CB4…10ACC1` and final canonical source match exactly. The pre-flush development audit
is retained; `Development/final-audit.json` captures restored identity and links its hash.

Tool recovery is separate from product evidence: the Unity CLI alias was inaccessible in
the sandbox. Connected MCP built the players; one uniquely identified owned delayed callback
was resumed directly after proving no build/test was active. Warning-bearing MCP wrappers
reported errors, while fresh native reports establish the successful zero-error builds.
No unrelated callbacks/work or authoring were cancelled or saved.

- Restricted [two-peer attempt](../../../TestResults/m5b-built-2-848933a8b46d45ff86d75e587c148f1c/launcher-result.json)
  remains failed infrastructure/admission evidence, before search, with confirmed cleanup.
  Low-integrity/DNS restrictions are recorded; the exact socket cause was not instrumented.
  Changing only execution environment to normal networking produced the following passes.
- [Two-peer](../../../TestResults/m5b-built-2-91497ceca28c4e70bece482fe35fc2c8/result.json) and
  [four-peer](../../../TestResults/m5b-built-4-16a0855017c44383ad543f9b55051304/result.json)
  packaged checks pass all predicates on the same audited `c943…bed64` build/final base source.
  Exact peer counts, per-peer presentation/zero client authority, target disconnect,
  active-flight reset, host transport shutdown, identity rechecks, scenario trace hashes
  and owned-process exit pass; no primary/cleanup/identity errors. These are real NGO peers
  in **one built process**, not separate-process/network search or unexpected host loss.
- [Normal-menu regression](../../../TestResults/main-menu-2d019c6533fd4197a918eef4dba2c8ab/result.json)
  passes all **10 phases**, including separate-process two/four-player ready/run/loadouts,
  results/return, controlled host loss and recovery; cleanup is clean. Native normal-build
  provenance and unchanged executable/managed/full-built-data/player-source fingerprints
  are recorded separately because this legacy report does not publish runtime build GUID.
  Requested simulator defaults are 75 ms / 15 ms jitter / 1% loss; this is not search-active
  latency or human control proof. No unrelated full-stage/natural-arrival campaign was run.

Fresh Native02 one/three/six-query profiles pass shared caps8/16,8/16,2/2. Maximum serviced
path/probe ages are 0/6.08 ms,0/6.58 ms,11.44/25.45 ms; first admissions 455 ms,314–418 ms,
547–953 ms. Raw profiles: `m5b-profile-61246b17a186496fbf26f4a053af3070`,
`m5b-profile-c0346b48e361478aa477daa81cb4428e`, `m5b-profile-fc896ec5c0a84d00911416ca1e13ae5f`.
These use one candidate/three-second searches, not full16-candidate hardware performance.
Allocation counters are unavailable, not zero; sampled combined frame totals are not a
reliable absolute worst-frame bound. Human keep/tune/revert, rendered controls/actual UI
Stop/relaunch, representative hardware, separate-network/search-active latency and unexpected
search-active host-process loss remain open. Editor ends stopped, compiled/imported, clean
saved PlayTestScene, idle Test Runner, zero Console errors. No commit/push or promotion.

#### Independent radial density and cone ray overlay — 14 October 2026

User requests a separate density for non-cover radial guesses and actual hit/missed cone
rays in **Show memory and move destination**, explicitly **no tests**. Medium bounded
sampling/Editor change; lead writes Definition/Settings, Episode, Planner, definition
Inspector and observation window. Technical, gameplay and design/UX reviewers
(`gpt-6.1-sol`, Medium) independently reviewed PRE and will inspect the integrated delta.

Hypothesis: an independently captured 0–16 radial attempt count makes ordinary search
density tunable without changing cone directions; retained executed rays explain which
cone directions hit geometry or missed without confusing hits with admitted predictions.
Preserve anchor/motion, current radial order/radii, primary→cover→radial priority, shared
1–16 prediction ceiling, cover half-ceiling, budgets and frozen evidence. Default radial
count16; zero disables radial only. Per-direction Editor-only records retain actual
forward-query results, including truthful saturation/rejected-hit outcomes; drawing does
no physics and records reset with generation/episode ownership. No asset tuning changes.

Verification: supported stopped-session import/compilation, Console, serialized property
and captured default inspection, scoped source/diff review and three POST perspectives.
No tests, builds, scripted scenarios or benchmarks: latest explicit user restriction wins.
Earlier integrated gates prove their recorded source, not this delta. Rendered readability,
behavioral acceptance and invalidated automated gates remain open. Estimate 10–20 minutes;
escalate new authority/lifecycle scope or ownership ambiguity; stop after compile/bindings
and review or concrete tooling limit. No commit/push. Dirty-work/script/asset baselines:
`TestResults/radial-ray-overlay-20261014-f918675be488482680402468f7a20765/before.json`.
Initial manual Play session was clean and idle; stopped deliberately before script import.

Result: implemented, keep for further human testing. All three independent POST source
reviews clear the slice; the design wording correction aligns the miss legend with
`DrawDottedLine`. Default16 preserves radial positions/order, but extends the old attempt
bound: primary plus16 can fill slots left empty after earlier rejected samples and costs
additional bounded planning work. Shared caps/deadlines remain unchanged; no parity claim.
Only the five named C# files and current brief/task record change in this follow-up.
Editor6000.6.4f1 imports/compiles successfully; zero Console errors, stopped/imported,
idle Test Runner and clean saved PlayTestScene. Read-only serialized binding/capture
inspection finds all common Inspector fields: radial16 in Ordinary/Weak/Persistent;
total caps8/8/5 and cone counts4/4/5, reaches3/1.5/.16. Current user tuning is retained.
Preset assets, scene and build-settings bytes match `before.json`; source whitespace
checks pass. Evidence: `readiness.txt`, `preservation.json`, `source-identity.txt` beneath
the unique root above. Canonical source:
`16C78C438DC4ED6E244F1C1B86139BE2DAC3000C1D59C35360D30A1B908EE64D`.
No tests/builds/scripted gameplay/benchmarks run or test code changed. Prior full evidence
is historical only for the changed sampling/diagnostic boundary; no automated or rendered
acceptance is inferred from compilation/source review. Manual relaunch/respawn is needed
to capture edits; use Show memory and move destination to inspect actual executed rays.

**Prediction source labels, subsequent user request:** add "Wall-hit prediction" versus
"Normal search prediction" to each admitted prediction, retaining assumption/checked
status and weight. Bounded medium diagnostic-only delta in Episode, Planner and observation
window; lead writes, independent technical reviewer (`gpt-6.1-sol`, Medium) checks PRE/POST.
No solver, asset, authority or lifecycle changes, so additional gameplay review adds little.
Provenance is captured from the pending generation method only after successful admission,
under `UNITY_EDITOR`; merged duplicates retain their first admitted source. No extra query.
Preserve current no-tests/no-builds boundary; import/compile/Console and scoped source
review only, stop after those checks. Estimate under5 minutes; rendered readability remains
human acceptance. Baselines/evidence:
`TestResults/prediction-source-labels-20261014-8f8bfd5731e24f518ae2431db5174287`.
Result: implemented; independent PRE/POST review clears source truth and Editor exclusion.
Unity6000.6.4f1 imported/compiled the three scripts; new accessor binding confirms compiled
availability, Console errors0, stopped/imported/idle and clean saved PlayTestScene.
Scoped whitespace checks pass; no tests/builds/gameplay scenarios or test-code edits.
Actual rendered readability remains unverified. No commit/push or authored asset changes.

#### Wall-entry rejection fix — 14 October 2026

User observes actual
wall-hit rays but no far-side predictions. Read-only live snapshot proves eight wall
entries5.26–5.51m from frozen prediction centre versus reach5; `nearest < start` rejects
them before exit scanning. Seven admitted hypotheses are normal search, phaseTravelling.
Intent: permit a ray's first wall entry before the local region while retaining all final
floor bounds/support/clearance/reachability, clipped endpoint, 32 quarter-metre exit steps
and continuation limits. One-predicate fix plus reach-tooltip correction; lead writes
Planner/Definition and one focused regression in EnemyCoverSamplingTests. Medium bounded
physics fix; all three existing independent `gpt-6.1-sol`/Medium reviewers approve PRE.

User now allows tests but requests the smallest useful scope, superseding the no-tests
limit for this bug. RED new native case, then GREEN new case and existing box-wall,
ramp-top and stair-top cases only. The regression isolates the boundary with a genuine
captured stationary sighting before a temporary wall appears; no motion is needed to
trigger this predicate. Assert actual entry outside local reach and admitted far-side
floor inside both radii with wall provenance, not just a larger marker count. No builds,
broad suite, assets/tuning changes or NavMesh rebake. Saved PlayTestScene/manual authoring
preserved; stop manual sandbox for import/test ownership. Evidence root:
`TestResults/cone-entry-boundary-20261014-6ae9ceb428c84e289447f47833b9d3c9`.
Estimate5–10 minutes; escalate new solver failure or ambiguous runner ownership; stop
after focused results and three POST deltas. Broad/release/human acceptance stays open.

Result: fixed the evidenced entry predicate; all three POST reviews clear the limited
delta. Fresh focused proof passes **4/4, zero failed/skipped**, exact discovered native
leaves and matched terminal/no conflict at frozen source
`54DF2E589E96241484D54F1698FF28BFDC61AC249FE9DE0D00B4236BB98A89E4`:

- New entry-before-region regression: [manifest](../../../TestResults/foundation-runs/cone-entry-green-94fbb920040d42f591417734a7a40fca/result.json), 6.543s.
- Existing box-wall far side: [manifest](../../../TestResults/foundation-runs/cone-entry-wall-40f234f223fb4a2fbe0048b1a968225c/result.json), 4.258s.
- Existing ramp-top landing: [manifest](../../../TestResults/foundation-runs/cone-entry-ramp-05d90eab4ba447cab64be38bca4ee1f6/result.json), 4.316s.
- Existing stair-top landing: [manifest](../../../TestResults/foundation-runs/cone-entry-stair-905359fa44f3443ba816e12038fd4e0c/result.json), 4.351s.

The [initial diagnostic attempt](../../../TestResults/foundation-runs/cone-entry-red-166c1eac21714c6e89a7542bcc969a49/result.json)
failed the intended missing-wall-prediction assertion, but is **invalid**, not valid RED:
the user's Persistent half-angle changed30→20 during that run. Preserve its primary
failure/identity error; no source attribution or acceptance inferred. The new angle is
retained in the GREEN freeze. Scene, preset assets, Editor/build settings and dependency
pins match their appropriate before/frozen baseline. Final Editor is stopped/imported/
compiled, Test Runner idle, zero Console errors and clean saved PlayTestScene.
No builds, broad suites, other native cases, authored tuning edits or rebakes. The live
geometry explanation and targeted reproduction establish this bug; human retest and
broader/release acceptance remain separate. No commit/push.

#### M5B.8 — Verification selection, human gate and delivery

**Historical planning check:** the original design-only pass inspected Markdown and performed no Unity operations. Implementation was separately authorized on 14 October; the execution ledger and final manifests below own implementation proof.

**Execution prerequisites:** read `Docs/SETUP.md`, relevant Unity skills and current `Docs/TESTING.md`; confirm connected project/version, Play Mode, compilation/import readiness, Console and exclusive Editor ownership. Re-read version pins/lockfile. Discover new fixtures positively after script import/metas; proposed names below are not proof of present discovery. Unique evidence labels include M5B task and attempt; verify requested/discovered/executed identity and terminal cleanup.

Focused runner pattern, only after positive exact discovery, in a supported Editor command:

```csharp
ProjectI.Editor.FoundationTestRunner.RunFixtures("m5b-rules-<unique-attempt>",
    UnityEditor.TestTools.TestRunner.Api.TestMode.EditMode,
    new[] { "ProjectI.Tests.EnemyInvestigationRulesTests" });
ProjectI.Editor.FoundationTestRunner.RunFixtures("m5b-search-<unique-attempt>",
    UnityEditor.TestTools.TestRunner.Api.TestMode.PlayMode,
    new[] { "ProjectI.Tests.EnemyInvestigationSearchTests" });
```

These are **separate sequential operations**: await the first's final manifest/ownership release before issuing the second. Use the actual generated request directory; don't reuse literal labels or substitute old fixture counts. RED is expected only for the intended new assertion, not a compile/discovery/setup failure. GREEN requires every selected leaf executed with valid identity, zero failures and no unexplained skips.

**Frozen integration scope:** full current EditMode including genuine stopped-session reload; complete affected PlayMode fixtures `EnemyInvestigationSearchTests`, `EnemyBehaviorInvestigationTests`, `EnemyBehaviorPerceptionTests`, `EnemyBehaviorNavigationTests`, `EnemyBehaviorShooterTests`, `EnemyBehaviorScenarioTests`, `EnemyBehaviorLifecycleTests` and `PassiveEnemyLifecycleTests`, plus retained projectile/targeting/graph/diagnostic contracts affected by the actual final diff. Verify exact names against discovery/catalogue rather than assuming this list is executable unchanged. These are full affected fixtures, not a claim of the entire PlayMode assembly. Escalate to other retained suites if the changed interface/owner trace reaches them.

Build normal/debug/release Windows players and audit diagnostic exclusion for the changed runtime/fixture bindings. Exercise actual two/four-peer search/movement/combat: only host decides; remote peers observe movement/cues; no hidden shots; target death/disconnect, host loss and reset invalidate episodes and release claims. Cover near/far peers and differing genuine per-enemy evidence. Identify whether the existing isolated network fixture can carry each check; if built-player search access is unavailable because the sandbox is Editor-only, establish a scoped development-only harness and its exclusion proof before claiming built gameplay. Ordinary player builds alone are compilation/exclusion evidence, not search behavior evidence. Preserve separate-network/latency and human/hardware limitations when unavailable; don't label omissions passes.

Unchanged normal-stage progression/admission can reuse compatible existing proof with exact paths/date/source/build predicates; do not rerun unrelated campaigns or activate normal enemies to obtain M5B evidence. If shared entity/session/progression behavior actually changes, run the newly affected normal integration gates. Profile query counts, maximum serviced age, planning latency, per-frame work and allocations for one/three actors and an admitted multi-actor fixture; configured caps must hold. Record measured costs and target hardware limits honestly rather than claiming performance from cap compliance alone.

**Human acceptance matrix:**

| Situation | Required observation |
| --- | --- |
| Player ducks behind wall and stops | Enemy checks a plausible side/new space or gives an explicit finite failure; no repeated A→B→A under unchanged evidence. |
| Player continues left/right after identical disappearance | Same initial search decision with identical captured inputs; later real sight/sound may distinguish routes. |
| Player doubles back silently or escapes beyond radius | Enemy can inspect the wrong side and lose the player; no hidden turn correction or expanding radius following them. |
| Both sides plausible, last observed motion weak | No invented velocity; deterministic choice remains understandable, with another useful side eligible if allowance remains. |
| Enemy already has a useful viewpoint | Brief purposeful look is allowed; forced movement is absent. |
| Long wall/U-shaped obstruction/blocked route | Supported bounded detour or honest failure, no endless alternating retries, gap crossing or guaranteed omniscient flank. |
| Player reappears during travel/inspection | Genuine reacquisition restores ordinary reaction/attack behavior without cost refunds or lingering search movement overriding it. |
| Root/stun/slow, target switch, death/reset | Existing status and lifecycle rules hold; allowance/history cannot be renewed by interruptions. |
| Weak versus persistent definitions | Authoring visibly changes radius/time/coverage within the same evidence/safety rules; shared assets never share mutable history. |
| Three shooters/four players | Actors remain independent and safe under query/claim contention; no pack freeze. Coordinated side allocation remains M6. |

**Gate:** technical/automated success plus separately recorded human keep/tune/revert on purposeful movement and fair cover counterplay. Stop here and update the current brief; do not begin M6 merely because code/tests pass. If human scheduling prevents acceptance, report “implemented/automated gate complete; human acceptance pending.”

### M6 — Add moving encounter pressure and squads

- [ ] **M6-SPAWNING-READY — Complete companion spawning milestones S1–S4 and record the S4 handoff evidence.** The executor of [S4 in the spawn director and coordination plan](2026-10-15-spawn-director-and-coordination-plan.md#s4-spawning-verification-and-m6-handoff) owns checking this single prerequisite. It certifies spawning readiness only, not M6 coordination or production promotion; leave it unchecked until S4's gate actually passes.

**15 October planning amendment:** the [user decisions](../../Research/2026-10-15-spawn-director-and-squad-coordination.md#confirmed-user-decisions) replace the old hidden-birth-only, homogeneous-family, one-member-per-normal-interval and no-boss-reinforcement requirements. Detailed additions and their checklists live in the [companion plan](2026-10-15-spawn-director-and-coordination-plan.md); this section owns M6's dependency and completion summary. Existing historical evidence is unchanged. S1–S4 require M5/M5B, not M6; C1–C3 follow the spawning handoff, so this dependency is not circular.

**Post-review user amendment, 15 October:** retain this milestone split and add deliberate bounded saving for expensive choices. The companion's [population exceptions](2026-10-15-spawn-director-and-coordination-plan.md#population-exceptions-and-purchase-cancellation) supersede a universal total cap: finite Splinterbeast children bypass admission but count afterward; the single boss bypasses and stays outside the nonboss count; ordinary purchases and boss reinforcements remain limited. Unsafe children are omitted after bounded local attempts with no backlog. Overflow cancels unborn paid members with capped unused-cost refunds; no kill refunds or catch-up. These new choices override conflicting earlier research/roster wording, not physical safety or reward ownership.

**Goal:** coordinated enemies remain relevant around a moving/split party, using the credit director's safe readable arrivals, without precise hidden tracking, endless pursuit or immediate replacement. **Dependencies:** M5 including the accepted M5B keep/tune checkpoint, and `M6-SPAWNING-READY` above. **Scenarios:** P01–P08, G01–G08, with the companion's updated spawn/arrival meanings for P01/P07/P08.

**Files:** coordination files from section 5 plus `E/Coordination/EnemyEliteCooperation.cs`; existing `RequestEnemyAssignmentAction`, `EnemyPositioning`, perception/report intake and encounter lifecycle seams; exact file ownership and proposed fixtures are in companion C1–C3. Do not duplicate the credit bank, purchase/reservation ledger or spawn scheduler in coordination.

#### M6A — Moving pressure assignments

- [ ] Complete [C1](2026-10-15-spawn-director-and-coordination-plan.md#c1-moving-pressure-and-mixed-squad-assignments): consume admission/group/member identities independent of paid purchase identity, issue coarse reachable assignments, and update the existing commitment ledger. Count each actor once in its useful region, including roaming-elite cooperation; include pending/approaching groups and unpriced children. Exclude a reassessing group's own contribution from comparisons, retain useful assignments on ties and require meaningful improvement to switch. Allow temporary concentration without equal-damage or round-robin promises.
- [ ] Allow admitted mixed melee/ranged groups to share purpose while members use their own legal routes, positions and capabilities. Keep useful routes while reassignment is pending; stagger changes and never make the whole group wait for its slowest member. Complete the current fixture-only assignment node through the existing graph/capability boundary.
- [ ] Track pursuit start, progress and relevance independently of graph/task names. Reassignment or cooperation cannot reset the same chase, health, personal memory, paid attack recovery or cooldowns.

#### M6B — Squad reports and roaming elite cooperation

- [ ] Complete [C2](2026-10-15-spawn-director-and-coordination-plan.md#c2-squad-reports-and-roaming-elite-cooperation): give birth squads stable scoped membership and authorize genuine visual-report transport with original observer/time/target lifetime. Prevent recursive report refresh and cross-stage/session delivery.
- [ ] Let eligible roaming elites temporarily cooperate with nearby useful packs while retaining their identity and own pressure purpose. When no pack is useful, continue role-appropriate pressure toward the moving party. Do not merge packs, reset pursuit or apply procedural birth exclusions retroactively to cooperating actors.
- [ ] Deliver observed player locations and fresh reports while a cooperating member sees the player. Reports guide awareness/repositioning; direct fire still requires the elite's own clear sight and firing path. Preserve Bombardier's personal-memory attack contract and each support capability's eligibility rules.

#### M6C — Combined coordination gate

- [ ] Complete [C3](2026-10-15-spawn-director-and-coordination-plan.md#c3-combined-coordination-verification): prove assignment expiry, target loss, split parties, lagging roles, dash-through, alternating aggro, area clear, specialist removal and temporary cooperation using the stated fixtures and matching peer cohorts. Preserve earned space, capped bank/no catch-up and valid actor actions during relief.
- [ ] Verify bounded saving holds one expensive choice without capacity reservations, abandons expired/invalid choices until the next scheduled ordinary opportunity, and never emits catch-up groups. Verify boss phase entry stops exploration but reinforcement income/cadence begins only after successful live boss birth. Boss entry is independent of nonboss population; reinforcements count every nonboss actor/child/reservation and cannot bypass the limit. Coordination does not own boss attack sequencing, required defeat or portal/reward progression. Visible births retain reaction windows; hidden retirement remains M7's separate guarded policy.
- [ ] Record C3 source/build/selection identity, review outcomes, actual observations, reusable unchanged evidence and remaining human/hardware/separate-network acceptance. M8–M14 still own restoration of their real role capabilities, M15 production bindings, and M16–M17 full-roster integration and acceptance; passive role fixtures do not close those gates.

**Gate:** the spawning prerequisite and M6A–M6C are complete within their explicit evidence limits; moving/split solo, two- and four-player cohorts demonstrate useful reassignment and scoped elite cooperation without hidden precise fire, refunded commitments or instant refill. Checking the first checkbox alone never completes M6. The companion's downstream contract table governs the affected M7–M17 integrations without changing their milestone numbering or historical results.

### M7 — Add bounded recovery and safe hidden retirement

**Goal:** ordinary stranded enemies recover or leave without exploits, visible disappearance or progression rewards. **Dependencies:** M6. **Scenarios:** M06–M10, P03–P04, L04–L05.

**Files:** new `E/Coordination/EnemyRecoveryPolicy.cs`, `EnemyRetirementService.cs`; narrow encounter integration; new `T/EditMode/EnemyBehaviorRecoveryTests.cs`, `T/PlayMode/EnemyBehaviorRetirementTests.cs`.

- [ ] Record completed route/attack/support attempts and meaningful condition changes. Query deferral, root/stun, a brief obstruction or low usefulness cannot establish stranded eligibility.
- [ ] Check all eligible living players and legal role contributions before declaring no feasible pressure. Zero living players follows run lifecycle, never ordinary retirement.
- [ ] Exclude bosses and explicitly marked progression-critical/custom actors by eligibility, not just graph name.
- [ ] At retirement execution, recheck that no player can see the actor, including downed observers who still have a relevant view. Use supported accepted camera/view data; uncertain visibility fails closed.
- [ ] Despawn through a separate server path with no lethal damage, kill/loot/stats credit, death-triggered split, immediate replacement or admission backlog catch-up.
- [ ] Preserve health through reassignment. A visible stranded actor remains present; retry only after meaningful opportunity/geometry changes and report the blocked case honestly.
- [ ] Test visibility changes between request and execution, alternate reachable player, valid ranged opportunity, status expiry, deferred query, boss, all-downed state and duplicate retirement callbacks.

**Gate:** finite recovery and zero false retirement in protected cases. This is ordinary enemy policy; Keeper's special ally-less rule arrives in M10.

### M8 — Restore melee with committed, avoidable lunges

**Goal:** close pressure rewards a well-timed dodge. **Dependencies:** M6–M7. **Scenarios:** R02/R10, G04/G06, M05–M06.

**Files:** new `E/Attacks/Melee/MeleeAttackDefinition.cs`, `EnemyMeleeExecution.cs` in that folder; optional `E/Attacks/Shared/EnemyAttackExecutionBase.cs`; `OrdinaryMelee` graph/profile; new `T/EditMode/EnemyBehaviorMeleeTests.cs`, `T/PlayMode/EnemyBehaviorMeleeTests.cs`; extend the shared capability conformance fixture with the melee implementation.

- [ ] Restore authored melee damage/range/cooldown separately from navigation preferences; keep tier/stage modifiers applied once.
- [ ] Implement `IEnemyAttackExecution` for melee and reuse the existing generic attack node/host unchanged. Compare the two implementations: extract only proven identical lifecycle mechanics into one shallow base, or retain explicit implementations when their semantics differ. A shared base may not switch on attack/enemy type; rerun bolt and melee conformance after any extraction.
- [ ] Track during visible windup; capture lunge heading at commitment. A later dodge cannot rotate that heading or change the captured target.
- [ ] Apply collision-safe bounded movement along supported ground, with physical contact validation for damage; stop at terrain/unsupported edges.
- [ ] Define cancel paths for invalid target and stun; root prevents voluntary lunge movement without automatically disabling a legal stationary melee hit. All already-paid attempts retain recovery.
- [ ] Test dodge before/after commitment, target crosses behind actor, wall/bridge edge, root/stun during phases, no hit on an unvalidated nearby player, and no immediate second attack after a miss.
- [ ] Play mixed melee/shooter pressure; melee does not inherit shooter stand-off or wait for a slow group member.
- [ ] Record the extension proof: new melee module/definitions/bindings and tests suffice without melee branches in bolt, perception, pressure or graph-host code. Verify the real melee executor through `IEnemyAttackExecution` and the existing graph node; a mock-only demonstration does not pass.

**Gate:** clear commitment/counter window, no obstacle snapping, host/remote presentation agrees on the lunge, and the second-attack extension proof passes. Resolve a failed extension boundary before expanding the roster.

### M9 — Restore Bombardier pressure from personal memory

**Goal:** pressure known cover briefly without tracking unseen movement. **Dependencies:** M6–M8. **Scenarios:** R05, K03–K05, L01–L03.

**Files:** new `E/Attacks/Bombardier/BombardierAttackDefinition.cs`, `EnemyBombardierExecution.cs`, `EnemyBallisticPlanner.cs` in that folder; `Bombardier` graph/profile; retained projectile/warning integration; new `T/EditMode/EnemyBehaviorBombardierTests.cs`, `T/PlayMode/EnemyBehaviorBombardierTests.cs`.

- [ ] Use only the latest qualifying personal visual location/time. Reports, firing, retries and repositioning cannot refresh the remembered-fire window.
- [ ] Implement the attack interface and run its conformance fixture with the Bombardier. Keep shell trajectory/commitment logic in its module and original observation ownership in perception; add no Bombardier branch to the generic attack node or ordinary bolt executor.
- [ ] Validate the ballistic trajectory and predicted first impact against actual collision geometry, including low ceilings and stairs.
- [ ] Capture committed aim/impact/attack ID; publish a warning consistent with that trajectory. Later personal sightings affect future attacks only.
- [ ] At memory expiry stop starting remembered attacks; move to seek a fresh personal angle. Invalid trajectory causes earlier repositioning.
- [ ] Preserve service-owned launched shells and proper cleanup at encounter end; inspect the retained ballistic launch/presentation contract before adding any needed warning payload.
- [ ] Test the exact expiry boundary, repeated graph entry, squad-only sight, moving hidden player, obstruction, warning/impact alignment and shooter death after launch.

**Gate:** bounded cover pressure with no unseen target updates and matching host/client warning/impact behavior.

### M10 — Restore Keeper support and its retirement exception

**Goal:** useful, readable, weaponless support whose removal changes the fight. **Dependencies:** M6–M9. **Scenarios:** R06–R07, P04, G02/G08.

**Files:** new `E/Capabilities/Support/IEnemySupportExecution.cs`, `E/Capabilities/Keeper/EnemyKeeperSupport.cs`, `EnemyKeeperLinkRules.cs` and `KeeperSupportDefinition.cs` in the Keeper folder; `E/Behavior/Nodes/MaintainEnemySupportAction.cs`; `Keeper` graph/profile; existing Keeper presentation; new `T/EditMode/EnemyBehaviorKeeperTests.cs`, `T/PlayMode/EnemyBehaviorKeeperTests.cs`.

- [ ] Restore at most two stable eligible beneficiaries with the preserved range, physical visibility and nonstacking protection contracts recorded in M0.
- [ ] Implement `IEnemySupportExecution` without implementing a dummy attack interface. Keep link state and source cleanup inside Keeper; the generic support action binds the support slot. Keep ongoing protection valid through lifecycle hooks and authoritative damage validation even while positioning is selected; beneficiary-search work has one tick owner.
- [ ] Keep protection state owned by the source lifetime; removing one Keeper/source must not erase an unrelated valid source or leave orphan protection.
- [ ] Position for useful allies, not a player firing lane; allies keep acting while the Keeper approaches.
- [ ] Release invalid links/cues immediately; reassign to another eligible reachable beneficiary before considering retirement.
- [ ] Add the approved special rule: after the ally-less duration and completed bounded support searches, an unseen noncritical Keeper may retire despite player reachability. Reset this evidence on genuine useful support, not task renaming; status/budget deferral cannot qualify it.
- [ ] Test competing Keepers, recipient/source death, links across walls, new allies arriving during retirement validation, all allies dead, visible Keeper and no invented attack.
- [ ] Demonstrate the weaponless extension through the real graph/prefab: support and movement coexist without attack dependencies, unchanged unrelated attack implementations and no Keeper fields in the generic context. Verify removal/reset cleans links when the support branch is inactive.

**Gate:** consistent host/client links and protection, stable support, safe ally-less cleanup without rewards/replacement, and the weaponless-capability extension proof passes.

### M11 — Restore Lancer charge and overlap control

**Goal:** dangerous precision fire has a reliable warning and dodge opportunity. **Dependencies:** M6–M9. **Scenarios:** R03–R04, L02–L03.

**Files:** new `E/Attacks/Lancer/LancerAttackDefinition.cs`, `EnemyLancerExecution.cs` in that folder; `E/Coordination/EnemyPrecisionReservations.cs`; `Lancer` graph/profile; new `T/EditMode/EnemyBehaviorLancerTests.cs`, `T/PlayMode/EnemyBehaviorLancerTests.cs`.

- [ ] Restore the accepted precision charge, aim-lock and invalid-shot cancellation contract from M0; preserve paid cooldown on cancellation.
- [ ] Implement the attack contract with precision-specific commitment/cancellation in the Lancer module. Run the shared conformance fixture; the reservation service owns shared overlap claims, while the executor owns its action and releases only its claim.
- [ ] Reserve the applicable per-player precision opportunity before commitment, scoped to target/actor lifetime, attack ID and stage.
- [ ] Waiting Lancers reposition or consider another legal target; ordinary enemies continue their actions.
- [ ] Publish charge/lock/cancel/release cues with one attack identity; no late aim snap or replacement shot without a new warning.
- [ ] Test simultaneous requests, cover at commitment/release, target down/disconnect, reservation expiry, actor death, graph interruption and latency.

**Gate:** bounded precision overlap with timely cleanup and no silent instant attacks.

### M12 — Restore Bulwark shield and generator counterplay

**Goal:** advancing defense can be defeated by flanking and generator damage. **Dependencies:** M8, M10–M11. **Scenarios:** R08, P04, G02/G08.

**Files:** new `E/Capabilities/Bulwark/EnemyBulwarkShield.cs`, `EnemyBulwarkGenerator.cs`, `BulwarkShieldDefinition.cs` in that folder; `Bulwark` graph/profile; affected damage/weapon interception paths identified during M0; new `T/EditMode/EnemyBehaviorBulwarkTests.cs`, `T/PlayMode/EnemyBehaviorBulwarkTests.cs`.

- [ ] Restore directional shield/generator state and the accepted damage-path contracts; re-enable only the intended shield collision through supported prefab editing.
- [ ] Compose the existing melee executor with a defense capability registered through `IEnemyCapability`; do not subclass the entire melee enemy or add Bulwark checks to melee execution. Shield owns protection/generator state; generator hit handling forwards a typed damage request to that owner rather than duplicating health or regeneration state.
- [ ] Keep bounded turning toward the chosen threat independent of protection from other directions. Root/stun/slow retain their defined movement/action effects.
- [ ] Preserve vulnerable sides/back and the generator opening without healing/recreating the shield on reassignment or graph restart.
- [ ] Test two players attacking opposite sides, bullets versus abilities/projectiles, weak points/Scan, generator break during attack, death and stage reset.
- [ ] Verify the rendered shield/generator opening on remote clients as well as authoritative damage results.

**Gate:** cooperative flanking changes damage outcomes; no all-direction defense or bypass through an untested damage path.

### M13 — Restore finite Splinterbeast descendants

**Goal:** death creates a bounded readable aftermath without multiplication or credit exploits. **Dependencies:** M6–M8. **Scenarios:** R09, P05, L02/L04.

**Files:** new `E/Capabilities/Splinter/EnemySplinterLifecycle.cs`, `SplinterDefinition.cs` in that folder; narrow encounter admission integration; `Splinterbeast` graph/profile and melee-based child bindings; new `T/EditMode/EnemyBehaviorSplinterTests.cs`, `T/PlayMode/EnemyBehaviorSplinterTests.cs`.

- [ ] Capture one legitimate parent death event; retirement, reset and despawn are not split triggers.
- [ ] Keep split/lineage state in the Splinter capability, attached through the common lifecycle contract and a typed authoritative death notification. Keep death-response handling ordered before teardown invalidates its authorized work; do not spread birth logic into melee execution or let every generic despawn trigger it.
- [ ] Apply the [15 October child admission amendment](2026-10-15-spawn-director-and-coordination-plan.md#population-exceptions-and-purchase-cancellation): release parent population once and admit at most two nonrecursive children through trusted unpriced death admissions, bypassing the director limit but counting immediately afterward. Preserve lineage, native mesh, occupancy, stage and arrival readiness; try bounded safe local points then omit failures, with no delayed child backlog and no ordinary spawn-distance ring. If overflow occurs, cancel unborn paid members and refund only unused cost once up to the still-valid bank ceiling; retain already born actors and block further director purchases until the full nonboss count permits them.
- [ ] Make children nonrecursive and preserve `EnemyKillCreditPolicy`'s child progression exclusion. Audit loot/stats separately rather than assuming progression exclusion means every reward exclusion.
- [ ] Inherit valid coarse assignment and pursuit episode context, not a fresh unlimited chase; never inherit stale target identity or parent action tokens.
- [ ] Test simultaneous parent deaths at/above the admission limit, child overflow blocking paid spawns, partial paid-group cancellation/refunds, blocked local points/omission without backlog, partial child count, duplicate/late lethals, stage transition and all-player loss. Verify no fake purchase/credit account and no recursive lineage; actual death-owned splitting is not established by S2's accounting fixtures alone.

**Gate:** finite child population, exactly-once births, no old-stage spawns or duplicate reward/progression paths.

### M14 — Restore bosses and close encounter lifecycle

**Goal:** first-stage boss encounters remain readable and completable through required defeat. **Dependencies:** M6–M13. **Scenarios:** P08, L01–L05.

**Files:** new `E/Attacks/Bosses/PulseWarden/PulseWardenAttackDefinition.cs`, `EnemyPulseWardenExecution.cs` in that folder, and equivalent `E/Attacks/Bosses/SiegeWarden/SiegeWardenAttackDefinition.cs`, `EnemySiegeWardenExecution.cs`; distinct additional attacks, if established in M0, get their own named definition/executor in the owning boss folder. `PulseWarden` and `SiegeWarden` graphs/profiles; existing `BossAttackPresentation`, encounter/run cleanup hooks; new `T/EditMode/EnemyBehaviorBossTests.cs`, `T/PlayMode/EnemyBehaviorEncounterLifecycleTests.cs`.

- [ ] Enumerate and restore the distinct accepted Pulse Warden/Siege Warden attacks and cues from M0. A generic shooter graph does not count as restored boss behavior.
- [ ] Bind each boss attack through `IEnemyAttackExecution` and run common conformance plus its own mechanics tests. Keep boss sequencing in its graph, attack state in the selected capability and stage completion in the encounter system; no catch-all boss executor with branches for every boss type.
- [ ] Keep ordinary population, boss admission, required defeat and portal/reward ownership with the encounter/run systems under the [new boss profile contract](2026-10-15-spawn-director-and-coordination-plan.md#s3-boss-reinforcement-and-lifecycle). The unique boss bypasses/stays outside nonboss limits; actual living boss birth starts reinforcement income/cadence once. Adds never bypass their active limit, which includes every nonboss survivor, child and reservation. Failed boss placement neither spawns reinforcements nor banks their credits; boss death stops/cancels reinforcement work without duplicate completion.
- [ ] Use valid attacks/alternate routes and bounded recovery for unreachable players; never ordinary retirement. After exhausted legal recovery, retain boss health and surface an actionable blocked-encounter diagnostic.
- [ ] Revalidate zero-target handling, all-down, revive/reset, results, stage travel, client leave, host loss and new session initialization across all roles.
- [ ] End obsolete warnings, links, reservations, pending emissions and queries; cancel service projectiles on encounter cleanup, while ordinary shooter death alone retains already launched work.
- [ ] Test boss cannot grant completion by retirement/reset/failure and legitimate death advances exactly once. Test practice reset leaves no previous-generation hostile work.

**Gate:** both boss variants work through normal encounter ownership; a navigation defect is reported, never hidden by a free win or reset.

### M15 — Promote the verified roster into authored content

**Goal:** normal entry reaches the new AI with preserved authored content. **Dependencies:** M14 and completed affected role reviews.

**Files:** existing enemy definitions/prefabs under `E/Authoring/` and `Roster/`; graph/profile assets; `Assets/_Project/Editor/PrototypeEnemyBuilder.cs`, `CombatFlowEnemyBuilder.cs` only where needed to preserve future authoring; scene bindings; retained fixture adaptation; `Docs/TEST_CATALOGUE.md`.

- [ ] Use supported Editor asset operations to bind the correct profile/graph/components to each enemy, including elite variants, children and both bosses. Preserve existing GUIDs and visuals.
- [ ] Verify NGO prefab registration/component ordering and rebuild matching peers after adding network behaviors; reject mismatched builds instead of accepting undefined replication.
- [ ] Keep passive lifecycle coverage in a clearly passive fixture; preserve its damage/status/Scan/credit/reset assertions. Add active equivalents, not weaker assertions.
- [ ] Check serialized bindings, missing scripts, normal/large agent selection, authoring validation and no runtime mutation of shared profile assets.
- [ ] Check MainMenu → VerdantRelay, ordinary admission, specialist compositions, boss and portal wiring without rebuilding the arena or rebaking terrain/navigation.
- [ ] Add actual new fixture declarations to the catalogue after creation; do not list planned names as discovered tests.
- [ ] Recheck extension evidence from M8/M10/M12 against the integrated roster. Document how to add an enemy using existing capabilities and how to add a new attack in section 5, with real bindings/files from the implementation. Review dependency direction, state ownership and shallow inheritance; stop promotion if unrelated role edits or central behavior switches are required.
- [ ] Obtain three integrated reviews against the final source/asset diff; resolve blockers and freeze the checkpoint for M16.

**Gate:** one coherent authored checkpoint, no experimental production defaults left behind, and all promoted behavior meets the normal integration route.

### M16 — Run integrated automated, build and network verification

**Goal:** prove shared outcomes and lifecycle on the integrated checkpoint. **Dependencies:** M15. Follow [TESTING](../../TESTING.md) and the relevant [catalogue](../../TEST_CATALOGUE.md) entries.

**Files:** new `Tools/Test-EnemyBehavior.ps1` and scenario-driver integration; actual runtime/test sources; unique `TestResults` evidence; this record.

- [ ] Implement deterministic built-player scenario selection for AI behaviors that the retained damage/weakpoint arena scenario does not exercise. Include a controlled intentional failure and cleanup proof for any new launcher.
- [ ] Positively discover exact new/retained fixtures, mode and leaves; reject empty, skipped, duplicate, missing or wrong-mode selections.
- [ ] Run full current EditMode and PlayMode assemblies once at frozen source. Include retained combat/authority, status, spawn geometry/identity, resistance, rewards, session, stage and projectile collision checks.
- [ ] Run capability conformance against every concrete attack and verify serialized interface bindings in actual built prefabs, including multiple boss attack slots. Confirm new capability types survive build stripping and diagnostics/test-only adapters remain excluded from release.
- [ ] Build normal Windows development, debug development and release-exclusion variants sequentially; verify graph/custom-node serialization, stripping, assets and diagnostic exclusion in actual builds.
- [ ] Run actual two- and four-player AI cohorts: clustered/split party, cover exits, stairs/bridge, close rush/dodge, all specialist interactions, area/single-target builds, down/revive, reset, client disconnect and host loss.
- [ ] Include impaired-network cohorts using the existing 75 ms delay / 15 ms jitter / 1% loss profile where supported; record actual applied settings. Verify commitment/cancellation/damage and displayed cues on remote peers.
- [ ] Run retained `Test-DebugArena.ps1` two/four-player two-reset cohorts. Preserve its retained damage/weakpoint, intentional failure, disconnect, host-loss and rehost/rejoin coverage; it does not replace the new AI cohorts.
- [ ] After confirmed owned-process cleanup, run common `Test-MainMenu.ps1` and `Test-EncounterPolish.ps1 -VerdantInitial -DelayMs 75 -JitterMs 15 -LossPercent 1` once. Explicitly map any remaining affected session/authority gates to evidence.
- [ ] Validate immutable final manifests, source/build provenance, exact failures/skips and coverage. Keep primary and cleanup errors separately; timeout is not termination.
- [ ] Repeat only invalidated checks after a fix; retain earlier failed evidence and updated identity. Do not run historical natural-arrival campaigns or claim extra attempts under this plan.

**Gate:** required automated/network/build coverage passes with coherent identity; incomplete or unavailable coverage remains explicitly open. Local multiprocess is not separate-network/human acceptance.

### M17 — Tune, playtest and accept the first stage

**Goal:** prove the game is understandable and enjoyable at the intended load. **Dependencies:** M16 for the build being accepted.

- [ ] Agree the representative PC hardware and frame-time/FPS target before claiming performance acceptance; record resolution, quality, build and hardware.
- [ ] Profile solo/two/four-player host and clients at the authored director admission limit (up to 16), with the separate boss and with legitimate finite descendant surges above that limit, including heavy projectile/status effects. Preserve the 15 October boss/child exceptions and keep paid ordinary/reinforcement admissions limited. Record worst-case authored parent-to-child concurrency and measured load; the old 17-total ceiling is no longer an acceptance assumption.
- [ ] Separate graph ticks, perception rays, path queries, position scoring, attacks, allocations, presentation and network traffic. Record median and tail frame time, maximum query age and deferred work.
- [ ] Play the five initial comparisons from the scenario catalogue, then every specialist, revive, split-party and boss encounter. Record scenario/build and each player's observations.
- [ ] Evaluate: cover grants a real opening; unseen relocation can mislead; enemies resume useful pressure; ranged rushing does not cause endless retreat; melee can be dodged; precision/shell cues are readable; Keeper removal and Bulwark flanking matter.
- [ ] Compare single-target and area builds, slow and mobile players, clustered and split parties. Avoid tuning away earned clear space or adding hidden anti-build behavior.
- [ ] Tune one coherent hypothesis at a time with a preserved baseline; rerun affected checks after numerical or behavior changes. Do not call pre-tuning build results proof for changed tuning.
- [ ] Conduct two/four-player independently controlled separate-network sessions on the same build; record latency, leave/host loss and combat cue fairness.
- [ ] Record keep/tune/revert and remaining defects. Update the current brief with implemented scope and linked evidence; close only the acceptance actually obtained.

**Gate:** first-stage human and hardware acceptance is explicit. If unavailable, deliver “implemented, acceptance pending” with concrete remaining scenarios; do not invent a pass.

## 8. Scenario coverage ledger

All 48 source scenarios have an implementation owner and a final acceptance route. A reference means planned coverage, not a completed test.

| Source cases | Primary implementation | Final observation |
| --- | --- | --- |
| P01, P02, P03, P04 | M6–M7 | Hidden spawn approach, moving party, real pursuit expiry, lagging roles |
| P05, P06, P07 | M6, M13 | Area clear/recovery space, admission safety/cap, no refill burst |
| P08 | M14 | Boss start with controlled ordinary pressure and required defeat |
| K01, K02, K03, K04, K05 | M2–M5, M6, M9 | Cover, peeking, alternate exit, personal clearance and scoped reports |
| K06, K07 | M2, M6 | Coarse hearing and separate target memories/commitments |
| M01, M02, M03, M04 | M3–M5 | Firing lanes, stairs, close transit and close-rush counterplay |
| M05, M07, M08 | M3, M6 | Bottleneck throughput, safe deferral, invalidated claims |
| M06, M09, M10 | M7 | Inaccessible players, guarded hidden retirement and visible failure |
| G01, G02, G03, G04, G05 | M6, M8, M10–M12 | Separated lanes, mixed roles, split/dashing party, stable targeting |
| G06, G07, G08 | M2, M6, M10–M14 | Revive opportunities, long-range mobility and specialist removal |
| R01, R10 | M4, M8, M14 | Independent launched flight and distinct control effects |
| R02 | M8 | Committed lunge, successful dodge and paid recovery |
| R03, R04 | M11 | Precision charge/lock/cancel and per-player overlap reservation |
| R05 | M9 | Personal remembered shell location, expiry and first impact |
| R06, R07 | M10 | Stable valid links, reassignment and special retirement |
| R08 | M12 | Directional shield, generator opening and cooperative flank |
| R09 | M13 | Finite children, admission/reward policy and late-callback rejection |
| L01, L02 | M1–M4, M9–M14 | Action/target lifetime, launched work and recycled identities |
| L03 | M5, M16–M17 | Real peer cue/damage consistency, latency and dodge fairness |
| L04, L05 | M7, M14, M16–M17 | All-down/run/stage cleanup and blocked-boss safeguard |

M16 supplies integrated technical/network evidence for applicable rows. M17 supplies human/readability and representative hardware/separate-network evidence. Deterministic fixture success does not qualify historical Natural-arrival samples.

## 9. Exact verification route for implementers

For a new fixture, create/import/compile it first, then positively discover its exact `ProjectI.Tests` type and leaves. Proposed fixture names in M1–M14 are not runnable selections today. Use the existing supported Editor runner, one operation at a time:

```csharp
// Example only after this exact fixture has been created and discovered:
ProjectI.Editor.FoundationTestRunner.RunFixtures(
    "enemy-behavior-lifecycle-<unique-id>",
    UnityEditor.TestTools.TestRunner.Api.TestMode.PlayMode,
    new[] { "ProjectI.Tests.EnemyBehaviorLifecycleTests" });
// Integrated requests are separate operations after prior finalization:
ProjectI.Editor.FoundationTestRunner.RunEditMode("enemy-behavior-integrated-<unique-id>");
ProjectI.Editor.FoundationTestRunner.RunPlayMode("enemy-behavior-integrated-<unique-id>");
```

Expected GREEN: validated final manifest, correct assembly/mode/identity, every requested discovered leaf executed, zero failed/skipped/missing/duplicate leaves, and clean owned-operation completion. A RED test must fail for the intended behavioral assertion, not compilation or broken discovery. Full assembly discovery determines current totals; historical counts are not assertions.

Existing relevant regression anchors include `EnemyStatusTests`, `EnemyResistanceTests`, `EnemySpawnCircleTests`, `EnemySpawnGeometryTests`, `EnemySpawnIdentityTests`, `EnemyRosterAuthoringTests`, `CombatAuthorityRulesTests`, `StageRewardPortalTests`, `SessionLifecycleTests`, `SessionRosterRecoveryTests`, `BombardierWarningTests`, `TetherKeeperVisualTests`, `EnemyTracerCollisionTests` and the retained passive lifecycle fixture. Inspect their actual assertions before deciding coverage; a visual fixture is not specialist behavior proof.

On timeout, inspect owned request/process state and retain reports. Follow the recovery procedure in TESTING; never release a lease by editing state, cancel unrelated work, or start another cohort while cleanup is unconfirmed. Natural-arrival qualification retains its existing cumulative budgets and requires a separate eligible scope decision.

## 10. Package references and plan review record

Unity's [custom-node documentation](https://docs.unity3d.com/Packages/com.unity.behavior@1.0/manual/create-custom-node.html) documents Action/Modifier/Sequencing node authoring and start/update/end hooks. Its [blackboard documentation](https://docs.unity3d.com/Packages/com.unity.behavior@1.0/manual/blackboard-variables.html) describes variable authoring and sharing. Checked 13 October 2026; the served documentation identifies Behavior 1.0.16. Neither replaces M1's execution proof.

The installed `BehaviorGraphAgent.cs` was inspected read-only: it conditionally derives from NGO `NetworkBehaviour`, exposes `Init/Start/End/Update`, automatically starts/ticks from `Update`, and has an optional owner filter whose default is false. An owner filter is not proof of server authority. This directly motivates disabled prefab authoring, explicit initialization order and independent action guards in M1.

Planning checks completed in this documentation task:

- [x] Read both primary enemy design documents, current project brief/workflow and test procedure/catalogue.
- [x] Inspect the passive baseline, retained attack primitives, admission/composition restrictions, package pins and installed graph lifecycle source.
- [x] Resolve six material gameplay/planning questions with the user and record their answers.
- [x] Assign all 48 scenario IDs to implementation milestones and acceptance routes.
- [x] Separate proposed tuning and future fixture names from accepted behavior and executed proof.
- [x] Check all relative document links, all 48 scenario IDs, 18 milestone headings and whitespace; inspect the plan against both design documents. No missing scenario IDs or broken relative links were found.
- [x] Complete M0 prerequisites required by M1 and the isolated M1 completion gate in the approved implementation task (section 4).
- [ ] Complete deferred M0 prerequisites and M6–M17 in later scoped tasks; isolated M1–M5 implementation/automated evidence and the accepted M5/M5B human decision are recorded in section 4.

The original planning pass made no Editor, test, build or runtime/asset changes. Its source/link/checklist checks validated the document only. Subsequent approved M0–M5 implementation, actual evidence and the accepted M5/M5B human decision are recorded in section 4; later milestones remain open.