Technical reference

Blue atlas interface theme

public/index.html loads public/atlas-theme.css after styles.css, gameplay.css, city.css, settings.css and neighbours.css. The final stylesheet owns the blue interface tokens, gradients, white/pale-blue text, borders, button states, cards, dialogs and responsive frame adjustments. The existing component styles continue to provide behavior-related visibility, positioning and content layout. Browser chrome uses the matching navy theme color.

At widths above 900 px the shell uses a 94 px navigation column and a 78 px header. The City command overlay matches the map workspace's insets; the sidebar is 338 px wide, or 310 px at widths up to 1180 px. At phone widths up to 640 px the existing horizontal navigation and stacked map/sidebar remain, with City opening beneath the navigation. Short landscape map controls retain their compact positions. No canvas filter or terrain palette change is applied.

Bright blue fills and borders identify current controls. gameplay-interface.js only marks navigation entries with an actual data-view as the current page; this prevents a dialog launcher from matching an undefined screen group and claiming aria-current. The navigation regression test covers that case. Focus-visible outlines, disabled states, the existing high-contrast and reading-size attributes, and both device and explicit reduced-motion preferences remain supported. Theme updates belong in this shared stylesheet rather than in simulation or renderer code. This change adds no commands, persistence fields, dependencies, founding rules, staffing rules or quote changes.

Art Atlas source files

Live reconciliation found 22 additional legacy WebPs under atlas-v2-runtime/terrain/terrain/, already stored on the art volume. Their exact downloaded bytes now have permanent metadata IDs and release checksums. Together with the 8,281 files verified on the server before deployment, the complete installed inventory contains 8,303 files. These additional paths are runtime derivatives and grant no approval.

The October 18 catalog implementation expands src/art-inventory.js to enumerate maintained assets, source-originals, production-raster, individual-tiles, reference, connector-raster, runtime-raster, runtime-atlas, connector-runtime, hero-connectors, atlas-materials, atlas-v2, and atlas-v2-runtime directories plus public assets. Staging, audit output, tooling and environments stay excluded. Both the art volume and bundled art overrides contribute to the deduplicated path inventory, matching static serving precedence. Inventory refresh remains 30 seconds.

Classic cards retain productionVariations PNG paths. Runtime copies are separately cataloged; missing originals are reported, never replaced by derivatives. Everything is the initial and cleared filter, while explicit usage filters retain their approval boundaries. Direct image links preserve stored bytes; CSS contains the entire image with no hover zoom or cropping. SVG prototype metadata reads declared dimensions/viewBox and records vector alpha as unknown, rather than asserting a raster alpha channel. Existing permanent IDs are retained and all 8,303 local files are registered; source inclusion does not change simulation eligibility.

scripts/prepare-art-atlas-release.js consumes this expanded inventory to copy and checksum original files into an isolated release. Upload and verify the complete versioned library before switching TILE_LIBRARY_ROOT. The new catalog-assets.json describes all 8,303 release files; it is verified against the new volume and bundled files before switching roots. Historical checksum snapshots remain available in Git and the rollback art directory. On October 18 the live inventory contained 3,583 files, including newer public assets absent from this checkout. Compare exact content with GitHub and the deployed inventory before declaring a file local-only. The original-file release targets /data/art-atlas-20261018-originals/tile-library; verify its deployment receipt for publication status. See primary design and asset metadata.

The storage audit receipt ../art-direction/art-storage-audit-20261018.json records 1,245 unique images absent from current GitHub main and checked live paths (1,200 production PNGs and 45 preserved generator outputs, about 2.57 GB). Named exports add 1,200 duplicate missing paths. All 1,031 unindexed Atlas v2 runtime WebPs were downloaded for streaming SHA-256 comparison and matched local bytes; they are remotely stored despite being absent from the old catalog inventory. The audit does not cover other computers, private backups, old Git history or unpublished volume directories. The existing 3,210-file frozen release supplies checksum evidence for its paintings; it was not misrepresented as a fresh full-volume download.

Compact controls at every map scale — October 8, 2026

public/game.js keeps secondary controls, status, #mapInformation, selected-location actions and Hex concept-site buttons in #mapOptions at all scales. Existing elements and listeners are moved once and reused; Region overlay availability and City authorization gates still apply. public/styles.css positions the view/zoom/options rail independently of the full-size canvas and Hex layer, replacing the wrapping header and measured-header observer. A small view heading does not intercept map input. The options panel has bounded height, independent scrolling and 44-pixel primary touch targets; a short-landscape rule uses two control columns. hidden, data-options-open and aria-expanded track visibility together. Scale changes close options; updates within a scale keep them open. Outside pointer input dismisses it, and Escape closes it and restores trigger focus. Wheel input originating in options bypasses map zoom so long legends remain readable. Hex site actions retain their concept-only behavior.

Illustrated wiki guides

Standalone Markdown image lines in the authored player, tutorial and technical pages render as figures when they use /wiki/images/<name>.png. scripts/build-wiki.js validates the local path, PNG signature, exact intrinsic dimensions and SHA-256 against public/wiki/images/capture-manifest.json before producing any page. Missing files or mismatched records reject both build and freshness checks. Generated image URLs carry a content hash; the originals have full-size links. Images use descriptive alternative text, visible captions, intrinsic dimensions, lazy loading and proportional sizing through public/wiki.css. Source-library illustration references retain their existing text treatment.

The initial captures record source commit 5a838edbb911e4a99ea7ed416a91587c39fe1186 and per-image UTC timestamps. The Region image was refreshed against 80e2b2556c32b420712a8ba785941bf636103782 for the compact map controls, after ordinary reservation and founding in a separate local world. Its per-image source commit overrides the original baseline. The seventeen screenshots show actual shipped UI in a separate local default-seed world using ordinary reservation, founding, construction and staffing orders. Inventory, clock and controls were not injected or altered. Construction/staffing are observed; production readiness and a reviewed import are not evidence of a completed daily harvest or delivered shipment. Private session files and QA worlds are excluded from publication.

When a lesson's controls, prerequisites, costs or behavior change, inspect its images and nearby explanations against the current UI. Replace stale captures and update their manifest dimensions/hashes/provenance, or record the scoped unchanged-image review with the affected lesson. Keep variable amounts explicitly exemplary and read the player's current quote. AGENTS.md makes this part of the existing wiki synchronization workflow. Integrity checks cannot detect semantically stale screenshots. Regenerate and check the wiki, run the staged coverage gate, then inspect readable figures and full-size links at desktop and mobile widths. See Guides & tutorials and Getting started.

Personal settings architecture

public/settings.js validates thirteen browser preferences against typed defaults and bounded enum values. It stores only those preferences under gonz-settings-v1; malformed JSON, invalid fields and missing values fall back independently. GonzSettings exposes snapshots, subscriptions and bounded scroll/resolution/notification helpers. Storage exceptions retain working preferences in memory. Identity keys gonz-player-name and gonz-session-token remain separate and are preserved by preference reset. The existing multiplayer reads/writes use guarded storage access so blocked storage does not prevent initial connection, although identity cannot persist across reload in that case.

settings-interface.js owns the native modal dialog, category navigation, immediate control updates, cross-tab storage events, device motion changes and fullscreen availability/errors. Root data attributes control contrast, panel reading size, vignette, minimap, hints and CSS motion. A capture listener prevents game keyboard handlers from consuming dialog keys; native Escape/Tab/select behavior remains available. Opening dispatches gonz:management-open to release held movement input. Closing returns focus to the gear. Defaults require a second explicit button click and never clear identity or world data.

game.js listens for gonz:settings-change, restores grid/place-name choices and clears movement when shortcuts are disabled. Grid preferences survive Global/Region/Hex transitions; grid lines appear in Region (or art review), while Global/Hex keep their usual presentation. The existing globe label toolbar shares the same persisted choice. Scroll scaling/inversion applies across all three views while preserving Ctrl-wheel browser zoom and ordinary pinch/button behavior. Reduced motion completes in-flight globe zoom and makes future globe zoom immediate. Resolution limits the map canvas DPR to 2/1.5/1 and reuses the existing resize/cache invalidation path. Notifications in the map and gameplay interface use the selected 4500/10000/20000ms lifetime. No server, simulation duration, authority, save format, resources or gameplay review rules change.

The normal session seed is read-only and comes from the server welcome. The old Generate world button is exposed only for the existing art-review URL modes, where it regenerates a client preview. The session panel reads the authorized snapshot's session.worldInstanceId and selected settlement name, using text content. It exposes no token. Tests cover preference recovery, storage failure, reload/reset identity preservation, cross-tab updates and actual three-view wheel behavior.

Guides and tutorial generation

docs/wiki/tutorials.md is the hand-authored player lesson source for /wiki/tutorials.html. scripts/build-wiki.js renders it as searchable articles with a heading-derived contents list and the shared wiki shell. Gameplay, Guides & tutorials and Technical are separate top-level sections linked in the header and footer; tutorials use their own data-wiki-area="tutorials" identity, active tab and lesson-specific search label. Source archive pages retain their technical-library navigation. Authored-page link resolution preserves cross-document anchors for all three sources, and the generator validates those anchors before writing. No multiplayer client, world creation or simulation command is involved.

The existing wiki:build and wiki:check commands cover tutorials as well as the guide, catalogs and technical archive. scripts/check-wiki-changes.js requires docs/wiki/tutorials.md for every path already classified as gameplay/interface/simulation, in addition to the design and authored-wiki requirements. Deleted tutorial files cannot satisfy coverage. Update each affected lesson's actual controls, prerequisites, resource/labor needs, timing and success checks. Review Beginner guide, Start guide and the longer Getting started when early play changes. If an internal change leaves instructions intact, add a brief scoped review note to the tutorial source recording the unchanged behavior; do not rewrite a playable lesson with engineering details. A tutorial update does not replace necessary guide or technical edits.

This gate runs in the existing staged/revision-range command and GitHub job; freshness remains checked before tests and deployment. Coverage and generation verify file participation, output and links, not semantic agreement with gameplay. Check the lesson against implementation and player controls before committing.

AI faction server design record

The consolidated AI faction server design, saved October 7, brings the neutral houses, polar ice mages, Lich King and orc dynasty together with the server architecture, scaling assumptions and runtime cost policy. Routine live gameplay runs entirely through engine scripts and conventional planners with zero model calls. Optional prose is disabled by default, globally capped and unable to change game outcomes. The record links the full companion specifications and clearly distinguishes proposed work from implemented gameplay; it does not provision infrastructure or authorize paid inference.

Version 1 publication

The October 7 update git and live instruction authorizes publishing the verified Version 1 release to GitHub main and the existing Railway production service. Commit source, tests and portable fixtures together with the authored design/wiki and generated pages. Disposable QA, local worlds and private attachments stay outside Git. Run npm run wiki:build, npm run wiki:check, and the real npm run wiki:changes -- --staged gate before committing.

Railway uses the checked-in Dockerfile and /health readiness route. Keep the existing persistent world and art-volume configuration; the image's defaults use /data for saves and /data/art-atlas-20260915/tile-library for production art. Publication checks the deployment's exact Git commit, HTTP health, City assets and release/wiki pages after rollout. Those checks certify the published version and availability, alongside the separately scoped gameplay results below. They do not replace human playtesting or the deferred Version 2 acceptance.

Version 1 release verification

Version 1 notes are the local launch/release entry point; the release checklist records finalization. The delivery window is fixed at October 7, 2026 06:17:48 UTC through October 9 06:17:48 UTC. The original M0–M8 requirements remain in the separate Version 2 plan, which has no active new goal.

The fresh release browser observes ordinary native clock reads and production commits, without replacing Date.now or granting stock. Four reviewed orders (reservation, founding, construction, staffing) produce ten events. Independent replay consumes all recorded reads for 73 transactions and matches every whole-state hash and final save; a later client retains the same account and staffed building with no second founding control. Forty responsive checks cover 320/390/640/1440 pixels. Earlier 49 closing saves and 35 fixtures are byte-preserved; 145 previous syntax checks retain matching source hashes. Final repository-suite results and corrections are recorded below; no human usability or full native four-hour harvest is certified.

Current core release checks pass 177/177 cases across fourteen production/population/region/deposit/outpost/City/militia/continuity/trade/persistence suites with unchanged test-file hashes. This is a separate selected run, overlapping prior evidence; no duplicate totals or full-suite pass are claimed. The complete original broad run and the separately verified current-source corrections are recorded below.

Release-test compatibility corrections preserve the original compressed fixtures and whole expected-state assertions. Older stage 32/34/35/36/38 fixtures explicitly add the existing empty pressure permission, attendance, trial and residue-recovery books through format 43; they grant no stock, work, people or authority. The governor cargo check requests four covered rams but expects the two whole 24-weight units that a 60-weight walking team can carry with provisions, and verifies those exact custody/spending quantities. Those seven test/helper corrections pass their complete-file rerun, 28/28. No production behavior, original fixture bytes or timing changed.

An eighth correction isolates the current-schema missing-perimeter input. It previously deleted six additional isolation/closure fields and correctly failed at an earlier validator, before its expected perimeter error. Deleting only the perimeter ledger retains the exact error assertion. All 6/6 cases in the complete perimeter file pass, including paid tranches, recall, title loss, ordinary hydrology, full construction and restored custody. Separate current copies of the byte-preserved historical paid caches add only empty stage 30→43 books and the existing sediment 1→2 empty-removal metadata; all existing stocks, receipts, geometry, mass and timestamps match.

A ninth correction updates the refuge test's stale branch counts from 47 to the current 56 technologies: religion 8, politics 9, army 12, culture 8, building 12 and agriculture 7. All shelter, architect, firewood, water and population assertions remain. The complete nine-case refuge file passes; no production rule or fixture changes.

The tenth correction repairs watershed historical-format test inputs. Before deleting any later book, the helper verifies its marker and complete typed empty contents, so paid custody cannot be discarded. All 22 downgraded inputs omit the eleven empty books introduced after format 31; eight migration endpoint assertions expect the current format 43. Original malformed-term errors, paid work, stock, water, title and notice assertions remain. The complete 35-case watershed file passes; production and original fixtures are unchanged.

The complete original npm test run across 593 files finished with 3321 cases: 3305 passed and 16 failed. All 16 failures are resolved by complete current-source affected-file runs (28/28, 6/6, 9/9 and 35/35). The original failing run and its seven declared changed test files are retained, with the watershed correction separately made after termination; it is not presented as a clean full-suite pass on current sources. The fourteen core files and ten affected files pass 255 distinct selected cases, with matching source hashes. Syntax covers 155 current paths; 49 older accepted closing saves and 35 portable fixtures remain byte-preserved.

Mixed-material barter custody

Version-one trade books and their logistics markers remain exact on read/restore. Only a successful explicitly reviewed mixed proposal promotes both to version two and records kind: mixed-barter / mixedBarterVersion: 1; all old agreements remain unchanged. Invalid proposals grant no promotion, goods, workers, knowledge, title or public authority. Ordinary barter, gifts, coin sales and finite recurring agreements retain their existing single-material terms. No world-coordinate, simulation-clock or other saved format changes.

PROPOSE_MIXED_TRADE requires a current world review and current settlement authority. Each side contains one to three supported distinct whole goods of 1–40 units, with an extra material on at least one side, no cross-side overlap and at most one dated good per side. The existing dated-cargo book supports that one expiry stream while other goods retain exact quantities. Proposal checks the complete route/capacity and sender cost before book promotion. Existing acceptance reserves every payment input together; dispatch uses the normal caravan, two workers, separate rations and transport loan. Arrival checks whole destination space before depositing the complete outgoing bundle, and return uses the ordinary storage-limited unloading and physical worker release.

The browser helper peer-trade-draft.js validates optional row quantities and duplicates without sending an order. Server validation remains authoritative. Pure reads do not activate new trade formats or rewrite old contracts. Focused tests cover mixed expiry custody, full-warehouse delays, restoration and cancellation; the source-bound served regional journey independently matches every command/advance and whole production-loader/save restoration. The separate final editor pass sends no command, advances no clock and preserves whole state. The early Getting started single-material route remains valid.

Native coastal start and selected settlement context

Map script/style settlement-context-1 adds a dedicated selected-settlement span under the geographic map title. The existing canonical selection resolves the current authorized mutable-region row; its name and cell-count become escaped text content at 12px. Region/Hex keep their geographic titles, and Hex displays its canonical cell ID. Global hides the extra line; an unmanaged selection clears it. Ready current world overviews refresh the caption without changing the camera, selected hex or world. City v262, authoritative site scans, command review and all save formats remain unchanged.

The portable native coastal transcript ../../test/fixtures/native-coastal-first-session-journey.manifest.json contains the actual fresh opening, observed native clock calls per engine transaction, both accepted server segments and complete closing. Four reviewed commands cover reserve, founding, storehouse and food-space policy. Every replayed transaction matches its result/event count/state hash; ten events match eight committed transaction states. Whole production-loader opening/closing, exact save restoration and later same identity pass. The quoted 6800ms project completes in 6921ms after funding; the 417536ms entry interval includes declared QA recovery. The absent-selector and premature-preparation assertions retained the original founded state; its later work was not repeated. The anonymous credential stays in disposable local QA and is excluded from the portable fixture.

Forty-eight responsive checks cover the flow. Final read-only map validation checks six view/selection cases at four widths, including 12px named captions and correctly hidden/cleared states, with zero world commands/events and identical whole persisted state. It uses the ordinary native clock and declared programmatic map focus; it does not certify manual gestures or human first-session usability. The default coastal field/fishery/kitchen remain staffed 6/2/2, with 40 people/24 workers, capacity 1800, food-space target 40 and conditional food balance +5/day. No daily harvest is observed. All 47 earlier canonical closings/33 fixture bytes remain preserved; totals become 48/34 with only the two earlier neutral waterworks read migrations. Broader M0–M8, native production, full seed/camera/art/hidden-information and institution/army/realm/resource/water/disaster gates remain open. See primary design, status and Getting started.

Native first-session construction sites

City v262 derives preview option text from the existing authoritative city.siteScan rows, matched to the selected building and orientation only while the City projection is fresh. Labels reuse its ready/conditional/blocked classification and first authorized reason; the renderer escapes the complete text. A missing/stale scan yields a checking label, with existing occupied/busy hints. Canonical plot selection, the selected catalog quote and existing reviewed START_CONSTRUCTION command remain unchanged. No new endpoint, command, save field, version marker, migration or work duration is added. The existing site-scan tests compare readiness with exact selected-hex quotes, exercise occupied paid work, authority and unknown deposits, and verify read-only state.

The portable native transcript ../../test/fixtures/native-first-session-journeys.manifest.json contains two isolated cold served worlds and their full openings, recorded engine calls and closings. A read-only observer captures actual native now reads per execute/advance call and complete state hashes; it does not override global Date.now or change the 100 ms work unit/four-hour village day. Offline replay consumes exactly those reads, checks every transaction hash and complete state across the farming restart, then restores the entire final save. Paid transaction and scheduled-event hashes were matched to actual production persistence commits. Inert timer checks are retained, not counted as gameplay events.

Woodland completes its first lodge in 7.898 seconds after funding/14.025 from entry, using three paid reviews/nine settled events; it ends unstaffed. Farming completes a 400-capacity storehouse in 7.007 seconds after funding/13.138 from entry, then separately reviews a field 5→6 and reloads the same identity: four total reviews/ten events. Its 167.931-second entry-to-staffing time includes post-paid QA recovery. The failed screenshot and incorrect absolute-staff selector were preserved with their paid journals; replay and a same-world farming continuation validate the work without repeating construction. Sixty valid responsive geometry checks and an inspected mobile ready-site preview accompany the fixture. The anonymous browser credential stays in disposable local QA storage and is excluded from the portable fixture.

Forty-seven canonical closings and thirty-three portable fixtures include all 45 prior closing and 32 prior fixture hashes unchanged, allowing only the two previously accepted neutral waterworks migrations. Native automated input/clock observations are bounded evidence: no full village harvest, native coastal flow, unassisted human learning or complete map/art/hidden-information certification is claimed. See living world design, implementation status and player walkthrough.

Target funding and linked earned recovery

City v260 loads local-production-goal-draft v4. Pure estimateTarget uses the chosen whole stock target, current stock and projected staffed input/output. It rounds the gap up to complete current batches. Capped ceilings include lifetime commitments plus that bill; daily ceilings include current-day commitments plus one more batch when below target. Inputs from earlier selected recipes remain represented through all allowed input keys. Met targets add no new batch funding. The helper clones the draft, replaces only its budgets and rejects invalid targets/recipes, unstaffed output, exhausted finite deposits and oversized ceilings before returning. The button sends no command. Existing production-mandates v5, service/ownership checks, startup clocks, actual input spending, priorities and storage remain authoritative; no saved field/version/migration changes.

The earned-charcoal-renewal transcript pins the unchanged integrated-mineral closing:16servedreviews/59events produce eight charcoal/ten tools, separate agreement/physical freight, and verify exhausted capped funding after stock falls. Both prepared wheat plots genuinely wear into moisture blockers; its closing has met stored meals but reduced food output. The separately pinned earned-soil-after-charcoal transcript pays two ordinary care orders/fiveevents with existing materials/workers, waits the real work/crop stages, and restores both harvests. Together they preserve117people/72workers, lawful offices and338total uninterrupted kitchen batches. Every paid review is dismissed first, every event equals an independent shadow through an atomic envelope/clock witness, and opening/closing use the whole production loader. Full replay, restore and later same identity pass. The original paid runner's final capitalization-sensitive Tools assertion failed after its full paid sequence; evidence is retained. Its exact closing was independently validated, and corrected resource-control/estimate checks perform no new orders or clock advance. Current scoped selection189cases/28files is separate from full-repository certification. Original M0–M8, fourteen scenarios, varied-seed/pacing/UI breadth and wider army/institution/realm/water/resource/disaster requirements remain open.

Earned mineral-camp transcript and natural household losses

The exact accepted civic/toolmaking closing now earns 86 served reviewed orders and 934 independently settled events across 84 configured village days. The woodland owner explicitly closes migration, separately buys four existing tools by consented trade, pays for Record keeping, returns an on-site mineral report, registers its charter and sends eight existing residents/six workers. Their camp separately builds and staffs a food plot, receives real timber loads and funds a mine on the surveyed finite seam. Four miners produce 14 ore, leaving 196 of 210 in the ground. A paid home carrying team returns twelve ore; the farming owner separately consents to a physical food-for-ore exchange, smelts all twelve into twelve iron and spends the remaining charcoal to forge two additional tools. A later four-tool return shipment draws from the workshop's combined existing and new stock. Further forging is blocked by actual charcoal depletion; eleven iron remain at the farmer.

Optional farmer/coastal scribes are explicitly paused during funding, then restocked and restored through ordinary reviews without a second adoption payment. Public accounting remains active. Soil care, real forest work, finite-depot deliveries, storage room and actual camp collections still govern the route. Three existing non-ruler elders die naturally at age 85; the current office holders, succession law and nominated successors remain, while interim eligibility passes to existing living adopted kin, final population totals 117 and the original 72 workers remain conserved across homes, camps and travel. Every community has met food needs and health 100 throughout. 84 more consecutive kitchen batches extend the parent chain to 326. This is bounded earned play on the existing seed; finite seams, charcoal and later supply/land constraints remain. Actual newcomer waits, complete varied-seed regional journeys, manual map/art/hidden-information breadth and all wider original M0–M8 requirements remain open.

Every paid review is first dismissed without a command or state change. The new survey-material handoff is checked both eligible and blocked by the actual travelling team. Responsive layout checks cover 320/390/640/1440 pixels; the mobile survey card was visually inspected. Whole production-loader validation, independent full replay, exact save restore and a later same identity pass. The portable transcript ../../test/fixtures/earned-integrated-mineral-journey.manifest.json pins the unchanged civic/toolmaking source. Forty-one earlier closings and twenty-eight older portable fixtures remain unchanged; the two previously accepted neutral migrations remain the only allowances. Current selected coverage is 159 distinct cases across 23 files, including one new complete served transcript; historical counts are not added and the full repository suite is not claimed. QA clock advancement uses the saved 100 ms work unit and four-hour village day; it does not certify real newcomer pacing.

Shared frontier survey provision and material handoff

Expansion's pure surveyProvision validates the released parcel and current ordinary or Scouting detour route, then calculates the existing timber/tool bill, rounded carried meals, two workers and travel duration. quote additionally checks the current survey, free workers, warehouse affordability, food reserve and public budget before dispatch can debit the same bill. No command accepts a client-supplied provision.

cityProjection computes the existing Expansion projection once and passes safe offered survey provisions to Supply chains as frontier-survey:<siteId> one-time consumers. These add no recurring demand. The parcel projection includes no deposit report before physical return. City v259 selects the exact parcel's fixed expansion:frontier-survey:<siteId> goal and displays its fresh dispatch quote or blocker; the ordinary review handler remains authoritative. Planning creates no command, reservation, saved field or migration. Unsafe or held routes produce no plan, including during competing charter custody.

Source-bound civic, workshop and tool delivery acceptance

The exact accepted continuous-fuel closing now continues through 128 served reviewed orders and 1,375 independently settled events over 133 configured village days. Paid Joinery selects the precision saw; both owners earn Public accounting and separately review their timber budgets. The farmer builds a Smithy and Charcoal kiln on legal free fields, imports ten finite waystation iron for twenty timber plus travel meals, consumes fifteen logs for twelve charcoal, then ten iron/five charcoal for ten actual tools. A separately accepted food-for-four-tools trade physically returns four fabricated tools to the coastal home; a mixed camp trip delivers one. Ordinary camp collections, eighteen qualifying woodland cuts, fifteen consented trades, paid soil/compost care and finite-depot relief deliveries supply the route. Scribes are explicitly paused during workshop funding, then restored with real stock and remain active on every subsequent settled check for over thirty days. Public accounting remains active. Original people/workers and met needs/health 100 persist. The kitchen completes 133 additional consecutive daily batches, extending the parent's uninterrupted chain from 109 to 242. Finite iron, future storage and material upkeep still need real work; this is bounded manual play rather than indefinite supplies or the full M0–M8 objective.

Logistics projection adds forty to relief choices and ten to iron choices for walking teams. Each option still runs the existing server quote; affordability, rations, capacity, worker availability, current journeys and finite depot custody are unchanged. Projection writes nothing. Separate regressions verify read/save purity, immediate payment and exact finite iron escrow/relief receipts. No persisted field or migration.

The new portable fixture ../../test/fixtures/earned-civic-tools-journey.manifest.json pins the unchanged continuous-fuel parent. Its actual captured-command prefix comes from the first served run; after a missing visible quantity control blocked the next review, the production loader and full independent replay certify the stopped paid save. The resumed server continues only the remainder, preserving actual receipt IDs. Every event uses a valid atomic persistence envelope, a saved clock watermark at least as new as the QA clock and whole-state equality against independent replay. Whole production-loader validation remains at opening, resume and closing; no live journal is pruned or edited. All 128 reviews are dismissed read-only first. 376 responsive checks, paused/active buffer purity, later identity and exact whole replay/restore pass. Current selection is 96 distinct cases/seventeen files, not the full suite or added historical counts. Forty older closings/twenty-seven older fixture hashes remain preserved with only the two previously accepted empty-waterworks migrations. Clock advancement does not validate actual newcomer pacing; the full original goal remains active.

City v258 finishes the current redraw before coalescing another redraw requested by a blur/change handler. A deterministic served nested-blur check retains the fourteen-day draft and issues no order. The earlier paid run recorded two DOM replacement errors; their evidence remains preserved. Current UI revalidation resumes its exact paid closing with no new order or clock advance and no page errors. All real receipts, replay and restored state remain unchanged.

Conditional learned-service operating goals

'supply-chains' adds 'upkeep:<nodeId>' conditional consumers only for known nodes with positive material upkeep. Their input is 'specialists.upkeep(settlement, node)', preserving the current named appointment's fractional rate. These rows describe one assumed operating day; they are not active 'service:<nodeId>' consumers and do not add recurring demand. Existing current-service consumption remains authoritative.

'GonzSupplyGoalPlan.serviceGoal' validates an integer one-to-thirty-day multiplier and preserves exact positive material amounts without rounding up or changing its input. City v258's Research handoff selects 'knowledge:upkeep:<nodeId>' with seven days and exposes the bounded operating-days input. The material tree retains protected meals, stock allocation, finite producers and ordinary readiness. Research/adoption, household meals, travel, staffing and institution requirements are outside this conditional buffer. Planning writes no state, stock, reservation, command or enabled flag; normal reviewed activation and actual daily debit remain separate. No persisted field or migration is added.

Bounded continuous meals and fractional shortage labels

city-projection.productionStatus formats positive shortages below 0.01 as less than 0.01, and other quantities to two decimal places. The predicate stays missing > 0; normal status and batchReadiness retain the same blockers. Exact input/output amounts, engine affordability, inventory, dated goods, spending, jobs and receipts are unchanged. No floating tolerance, stock credit, persisted field or migration is added. The earned prior closing's fish stock is actually below six; the new projection regression verifies readable advice, unchanged blocked state and whole read/save purity.

The served continuous route begins at the exact previous material closing. Two ordinary storehouses each pay sixty timber/fifteen food; the camp's materials arrive on three real twenty-timber/forty-six-food trips. Seven repeated cuts of the same regrown camp plot support fourteen seven-log/six-food returns. Fourteen local partner cuts and real milling fund the two initial coastal timber trades, the farmer's own timber trade and four surplus-food trades used for storage room. Twelve soil repairs consume twenty-four compost/twenty-four timber; three compost batches use twelve logs/twelve food to produce twenty-four compost. Four wheat growers, one fisher and one kitchen worker retain actual proportional recipes. The observer records 109 consecutive daily three-fish/half-log → six-food batches, including the last settled day, across 150 configured village days.

Health, met needs, actual available labor and original home/camp totals remain invariant. The route grants no stocks, people, knowledge, title, territory or automatic orders, and the source fixture stays unchanged. The prototype is an expected-action list, not injected paid setup. All eighty-three ordinary City orders and 1,583 events use actual captured command IDs. Every review is dismissed first read-only; each settled event equals the independent engine snapshot before continuing. The source-bound continuous-fuel fixture ../../test/fixtures/earned-continuous-fuel-journey.manifest.json, helper and whole-transcript regression preserve actual receipts, all 109 consecutive batches, later identity and exact replay/restore. 240 responsive checks cover 320/390/640/1440 pixels. At the preceding continuous-fuel checkpoint, selection was 76 distinct passing cases across thirteen files; older checkpoint totals and duplicate runs are not added. Thirty-nine older closings and twenty-six older fixture hashes remain preserved apart from the two previously accepted empty-waterworks migrations. Clock advancement does not certify real newcomer waits. Bounded continuous meals do not complete indefinite tools/minerals/civic/disaster supplies or the full original M0–M8 scope.

Worn-food-plot navigation and earned manual material renewal

The source-bound earned-renewable-starter-journey helper/fixture and one whole-transcript regression preserve forty-four served orders, 319 events, six read-only exact soil selections, 172 responsive checks, review dismissal and later identity. The preceding material-only checkpoint selected 63 distinct passing cases across ten files, not the full repository suite or a sum of historical checkpoints. Thirty-eight older closings and twenty-five older fixture hashes remain preserved except the two previously accepted empty-waterworks migrations. The actual UI command IDs differ from prototype placeholders; acceptance replays the real captured commands and retains their receipt/history references exactly. A final read-only resume completes the visual/reload checks from the real saved closing.

village-guide-actions derives food.action.cellId only from a currently negative food balance, a staffed blocked food-producing community field, and enabled owned soil condition below 50. Ready basic-field staffing recovery keeps precedence. City v255 validates that the cell belongs to city.plots and uses the ordinary focusCell selection after opening Land. This sends no gameplay command, repair, authority grant or saved progress. The guide keeps other production blockers explicit; ordinary land quotes, revisions, specialist availability, materials, four builders and the full workday remain authoritative. No schema or migration changes.

The source-bound renewable starter transcript continues the exact post-coastal upkeep closing. Four selective harvests use the same naturally regrown camp plot. Four paid custom collections carry no outbound goods and reserve twenty logs/six actual food locally; each consented barter exports eighteen logs for twelve reserved timber. Recipient acceptance and sender dispatch remain separate. The working mill converts all seventy-two delivered logs into fifty-four timber; after forty-eight timber payments and three timber for actual Seed selection, the partner retains 84 timber against opening 81. Six ordinary soil repairs consume twelve compost/twelve timber across the two owners. Whole replay preserves home/camp residents, labor, inventories, paid custody and needs.

The route spans 81 configured village days with ordinary simulation processing and default 100 ms construction units. QA clock advancement does not measure newcomer waits. The kitchen/fishery are paused during most of the material route and separately restored for the ending checks; continuous fuel operation and indefinite renewable supply are not certified. Closing camp food/storage and partner warehouse room constrain another round. Both original home scribes remain paused. All earlier source closings and fixtures remain immutable and separate; the full M0–M8 goal remains active.

Earned post-coastal farming upkeep

The immutable coastal closing exposes the original farmer's soil condition 0 and real -3.25 conditional daily balance despite health 100/met food needs. earned-coastal-upkeep-journey.json.gz continues exactly from that closing through two served land reviews/eleven events and 24 layouts. One own-material compost batch pays four logs/four food; one full-day soil repair pays two compost/two timber. Its source-bound helper and second coastal transcript case conserve both owners' home/camp people/workers, verify each actual debit and preserve all three founding grants. Seven final ordinary advances prove positive conditional food balances, health 100 and met meals in all four communities. Both nine-step guides are met; both scribes remain explicitly paused. Whole replay/restore and later farmer identity pass. This is actual upkeep, not a restored-soil control or replaced earlier closing. The preceding 61 distinct selected cases/nine files include this second case; 103 selected syntax checks at that checkpoint include the upkeep helper. No indefinite materials/renewal or real newcomer waits are certified.

Coastal integration and home carrier advice

village-guide-actions derives Inspect supply-team workers only from an established owned camp, no current outpost journey and city.labor.available < 2. It keeps the actual availability count, explains local carrier custody and opens the existing Workers tab. Travelling teams and sufficient workers retain Expansion inspection. Read-model boundary tests cover zero/one/two workers and paid journeys without mutating the input, saved world or authority. No field, migration, automatic staffing or stock is added; City JS remains v254.

earned-coastal-integrated-journey.json.gz pins the exact previous farming closing, 259 served events and 56 reviewed commands, including five independent partner payment reservations and the farmer's actual civic pause. Its helper checks compressed/decompressed/source hashes and the whole opening equality. The regression replays every event, conserves coastal home/camp/mobilized/travelling-founder residents and workers, retains the separate farming home/camp forty residents/twenty-four workers, and checks all three one-time grants. It witnesses cautious contact/home wound recovery, reserved twenty-log/four eighteen-timber payments, actual worn-soil output blockage/two paid repairs, fresh survey evidence and adequately supplied registration, the one-home-worker guide, explicit service pauses and six home wheat growers at supply dispatch. Real harvest, delivered food/tool and physically returned logs earn all nine guide checks; the coastal route’s final seven ordinary advances preserve health/met meals in both homes/camps and positive conditional balances in the coastal home/camp. The original farming wheat soil is worn to zero, leaving a real -3.25 daily deficit; the separate follow-up above repairs it. Whole replay/restore and later owner identity pass.

The browser dismisses every review without state changes before confirmation and verifies 160 layouts at 320/390/640/1440 pixels. Two extra orders use Workers' one-person camp assignment and home release buttons. Prototype attempt5 is an expected action list only; earlier failed capacity, expired survey/charter, worn-soil and home-worker probes are excluded. The actual default construction work unit remains 100 ms; advancing the QA clock across 105 village days/420 game-clock hours does not certify a newcomer’s real wait experience. The current 61 selected cases/nine files are not the full suite or added historical runs. Thirty-six older save closings and twenty-three older fixtures remain preserved, apart from the two existing accepted empty-waterworks migrations. The independent three-seed early fixtures remain separate; full multi-seed journeys, recurring material renewal and full M0–M8 are incomplete. See primary design, status and player guide.

Starter seed viability and a farming material route

The derived guide selects Inspect timber trade only when no current structure's production model has a timber output and no local plot has forest origin. Any paid city.logistics.caravans entry retains the existing trip/waiting advice. The explanatory handoff makes no assumption about a partner's private stock, sends no trade command and creates no material. A regression exercises both actual nonwoodland packages, a paid import's precedence and exact save restore.

earned-starter-seed-viability records three additional independently configured seeds and all three profiles per seed. Each whole world contains fifty-five actual command/time events and twenty-three commands: independent reservations/founding, migration closure, affordable legal cleared-field first buildings, lodge staffing, one actual practice day and paid Scouting research/adoption. Profile stock is captured at that profile's learning completion; later neighbors continue the same world clock and its ordinary production. Each world replays and restores exactly with its explicit seed. Default-seed restore is rejected. No stocks are joined, private goods borrowed or extra founding grants injected. This proves bounded early work on three additional seeds, not arbitrary-seed or full integrated journey coverage.

Complete farming City transcript

earned-farming-integrated-journey pins the exact alternative-starter closing. All forty-one remaining commands use City reviews; actors two and one retain separate sessions, and actor one only accepts three exact timber payments. The source already served entry, first storehouses and Scouting. The prototype supplies expected actions only; no intermediate setup is injected. Each proposal, reservation and dispatch is reviewed separately and dismissed before acceptance without state changes. Existing Workers buttons add one command for the camp’s two growers. Whole 250-event replay and restore, 116 layouts, touch controls and later farmer identity pass.

The exact prior alternative-starter closing now earns the complete farming integrated target through visible City reviews. Existing barley fields keep meals available; real iron imports fund four kits, four existing residents finish two training days, and a cautious patrol disperses this village’s own surveyed camp. One wound heals at home before demobilization returns workers and three worn kits. Soil preparation on an existing surveyed field spends actual compost, timber and a tool over three full days, raises usable moisture and makes the separately chosen wheat crop possible without changing natural terrain. The farmer then reaches a real founder-kit shortage: forty-nine timber and three tools against sixty timber/four tools, plus ten extra timber for the camp food plot. Three separately accepted barters export thirty-two actual food each for twenty-four timber each, with real reservation, carrying and return. Another physical tools import completes the kit. Returned survey, separate charter and supplied founders move eight existing residents/six workers into a camp, followed by separate local food-plot construction/staffing. A paid trip delivers thirty-two food/one tool and returns twenty locally harvested logs. Home thirty-two residents/eighteen workers and camp eight/six remain healthy with met needs and positive conditional food balances for seven more ordinary days; all nine guide checks are met. Home retains fifteen timber and still needs future civic/material supply; this is not an indefinite material-renewal claim.

The transcript regression checks population/worker conservation through militia mobilization and the actual traveling-founder transfer ledger, healthy needs/labor boundaries, research/adoption separation, the founder timber/tools gap, exact foreign payment reservation, useful moisture/wheat change, both supply directions and all nine derived checks. The final seven advances retain positive conditional food balances; storage may still limit a later batch. The three seed tests separately check each profile’s stock at its completion and the whole world after its neighbors advance. Current checked totals are 58 distinct selected cases across eight files: fifty-seven current regressions, including the new timber-advice case and three seed-bound replays, plus one new whole farming City transcript. Thirty-five earlier canonical closings restore and twenty-one older portable fixture hashes remain unchanged; only the two previously accepted empty-waterworks migrations apply. The latest accepted record is .qa-city/farming-seeds-goal-handoff.json. Earlier checkpoint counts are historical and are not added.

The farming continuation covers forty-two configured four-hour village days, or 168 hours of game-clock time from its opening. QA advances time; it does not prove real human waiting or first-session pacing. The 100ms construction work unit matches ZoneEngine’s default used by the live gateway; no simulation clock is shortened by this change. Full coastal and multi-seed integrated routes, manual navigation/pacing/art/hidden-information and wider M0–M8 remain open.

Alternative starter food and Scouting navigation

village-guide-actions.projection derives a food-worker handoff only for a negative balance and an existing staffed, ready community-field using the input-free basic recipe. It divides actual full-day output by current staffing, rounds the shortage up to whole additional residents and checks both staff capacity and current available labor. Failed capacity/input/readiness checks retain Production advice. The handoff includes structureId; City's guide handler focuses that structure's Workers article without sending a command. Staffing still uses ASSIGN_STRUCTURE_STAFF, normal reviews and restarted cycles. This is capacity advice, not reserved food or a guaranteed harvest.

For unknown unfunded Scouting, no lodge gives the existing building:forester-lodge supply goal. A sound operating unstaffed lodge, with no qualifying staffed lodge, gives its exact Workers handoff. Otherwise node/program reasons remain authoritative. The catalog already permits suitable cleared fields, and woodlandDays practice comes from its real staffed institution; this change grants neither trees nor practice. Funded research, learned adoption, catch-up and interregnum retain precedence. No save version, command, bill or simulation clock changes. Three additional regressions cover real coastal fuel exhaustion/reviewed recovery, rejected recovery read-model branches and both actual nonwoodland institution/learning paths.

earned-alternate-starters-journey pins the fresh-entry fixture and a thirty-nine-day ordinary prefix with zero paid setup orders. The served transcript uses actors two and three independently: coastal staffing six → seven → eight, both storehouses, both cleared-field lodges, one worker/practice day each and separately paid Scouting research/adoption. Forty-three served command/time events and twelve paid/dismissed reviews reproduce the whole closing; sixty-four responsive checks and later same-owner sessions pass. Seven further ordinary food days retain forty residents/twenty-four workers per home, health one hundred, met food needs and positive conditional balances. Coastal logs remain zero. No other branch/private goods are joined. At the preceding alternative-first-project checkpoint, checked totals were 53 distinct selected cases across six files: fifty-two current guide/supply/military/starter regressions plus one new portable alternative-owner transcript case. Thirty-four earlier canonical closings restore and twenty older portable fixture hashes stay unchanged; only the two previously accepted empty-waterworks migrations apply. The accepted record is .qa-city/alternate-starters-goal-handoff.json. Earlier checkpoint counts below are historical and are not added. Full alternative patrol/land/outpost, other seeds and newcomer pacing/art/hidden-information remain open; full M0–M8 stays active.

Complete remaining starter City-review transcript

earned-starter-full-controls-journey.json.gz pins the exact earned-world-entry-journey closing and the immutable narrower integrated fixture. The browser starts there, with no intermediate setup commands, and exercises all 43 remaining orders through visible City controls. Research/adoption, crops, defense, trade, land survey/clearing/compost/soil, field construction/staffing, frontier survey/charter, founders, camp harvest and custom supply use their existing current reviewed commands. Plot changes use real select controls. Workers' one-at-a-time buttons add three orders compared with the preceding direct two-grower/zero-mill assignments. Every review is first dismissed; no command or persisted state changes, including reserved goods, occur during inspection. Source founding and first lodge were already served in the pinned predecessor.

All 262 served command/time events independently reproduce the exact closing and restore as a whole save. Five paid topics, actual civilian/equipment/food custody, wounded patrol/home recovery, unchanged natural terrain, both staffed fields, returned frontier rights and physical 32-food/one-tool delivery/20-log return remain exact. All nine introductory checks are met; three original grants and home/camp totals 40 residents/24 workers persist. Sixty-eight responsive checks at 320/390/640/1440 pixels, touch reviews and later identity pass. One new replay test checks the complete transcript, paid learning/adoption separation, every ordinary health/labor boundary and final read-only guide/food balances. At that preceding woodland checkpoint, 48 cases on hash-verified unchanged source and one new transcript case gave 49 distinct cases/five files. Thirty-three earlier closings restore and nineteen older fixtures retain hashes, with only two existing empty-waterworks migrations. The excluded first attempt used a nonexistent layout selector and stopped after one policy order; all owned servers are stopped. Manual map gestures, other starts/seeds, newcomer pacing, art and hidden-information coverage remain open. This proves the remaining paid starter City path on one seed; full M0–M8 remains active.

Derived starter troop plans and exact integrated continuation

military.kitCost(quantity) is the shared pure two/four/six-kit bill used by quoteKits, every projection.craft.cost and the supply graph's existing two-kit project source. The projection retains that bill even when command quoting fails. Three troop consumers, recruit, recruit-4 and recruit-6, each require their actual kit count; the original ID remains compatible. Their notes separate two full training days, commons/Drill, civilian labor, food and actual surveyed risk. The guide action becomes Compare militia equipment while retaining army:recruit as its read-only initial destination.

The browser derives recruitment size from that selected consumer, chooses the matching current recruit option, subtracts actual home kits and selects the smallest supported craft batch covering the remainder. It displays the authoritative projected bill/blocker and opens the actual quantity-matching existing commands. Stock, authority, worker, institution, instructor, storage and timing checks remain server-side. No world/save field, grant or migration is added. City script v253.

earned-starter-integrated-journey.json.gz pins the exact earned-world-entry-journey closing and preserves all three independent starting identities/grants. Its 17 actual research/setup events, 37 served patrol events, 167 actual land/outpost events and 38 served supply events replay sequentially as one 259-event journey. Bounded drained advances repeat until no due event remains; they do not assume a single large advance processes all backlog. The served five orders cover finite iron import, four-kit craft, four-resident recruitment, cautious patrol and final custom supply. Four kits spend eight timber/four iron and two training days use existing civilians. Actual camp contact disperses the camp, one wound heals, and later paid trade retains the original four stolen travel-food count. Demobilization returns three worn whole kits and civilian workers. A real logs blocker/owned harvest resumes milling. Actual clearing, compost, soil work and separate field construction/staffing preserve natural terrain while changing effective land. Survey/charter precede founders, local food production and a 32-food/one-tool delivery with 20 local logs physically returned home. All nine guide checks and seven further healthy positive food-balance days are verified; home/camp retain 40 residents/24 civilian workers and exactly five learned topics.

The earlier two cases verify every stage and whole replay/restore, actual labor and physical goods custody, shared bills and blocked/foreign atomic rejection. That checkpoint selected 48 distinct cases/four files; full repository coverage is not claimed. Its two served phases supplied 44 layouts across 320/390/640/1440 pixels, read-only planning/dismissal and later identity. Thirty-two earlier closings restored and eighteen older compressed fixtures retained their hashes, with only two previously accepted empty-waterworks migrations. Learning, land and founding are real replayed setup in that narrower fixture; the newer full City transcript above serves these orders as well. Newcomer pacing, other starts/multiple seeds, manual map gestures, art and hidden-information breadth remain open. The original integrated target is earned on this seed; full M0–M8 is active.

Derived Combined roster and earned lifetime continuation

combined-formations.projection derives roster for the current record and the existing last20 history records from their validated member slots, existing community birth keys and casualty/old-age entries. No field is persisted. Active ages use min(now, nextDayAt - dayMs); deaths use the matching entry time; living closed members use closedAt. Each row retains slot/role/birthKey, optional bornAt/age, recordedAt, serving/left/dead status and optional loss kind/time/sourceId. Unknown birth keys yield null birth/age. History does not invent civilian deaths after a living member's earlier detachment return. Projection creates no members and changes no book, revision or migration version.

The portable earned-born-lifetime-journey.json.gz pins the exact prior born-Combined fixture closing. It contains1454 daily events for1449 ordinary days/five actual commands, plus the independent eleven-event/five-command served continuation. A real paid refit consumes one iron/one timber. Existing-civilian naming/nomination preserves population/labor, ruler old-age death removes one civilian worker, and embodiment retains interregnum until separate reviewed handover. Each born soldier reaches85 using their original clock; old-age custody closes their exact service/cohort and Combined slot, loses one whole bow/six held arrows for each archer, decrements population/mobilized count without adding a civilian worker, and removes the last empty unit. Earlier combat mortality and already completed professional receipts remain unchanged. Cash11/earned35 are preserved; the four natural deaths have null active contract and zero wage refund. Daily and bounded-drained served catch-up match household, defense, inventory and population/labor custody; transaction revisions naturally differ between daily and batched timelines. Each full closing reproduces exactly in its own replay and restores exactly.

Tests cover every mortality milestone, per-slot ammunition/equipment loss, current roster read-only behavior, settled ages, living-return age freeze, unknown ages, lawful handover and the exact portable source/closing. The served browser verifies current and historical rosters across four widths, and the final full-calendar-date display is separately revalidated without orders against the unchanged closing. This qualifies the home lifetime of soldiers who previously earned Combined training. Their professional term was already completed; continuous funded service, broad battles, indefinite renewal and the full M0–M8 goal remain open.

Derived Combined preparation and physical charcoal custody

combined-formations.projection.preparation derives a copied shared COST, two-day drill, allowed cohorts4/6, two advanced infantry days and the five current known/active instructor states. It is available before paid adoption without creating a Combined book. The existing one-time consumer combined-drill is now selectable as army:combined-drill in the UI supply goal list and from Defense’s read-only plan. Existing funding, service, cohort, age, supplies and authority checks still decide whether an actual order succeeds. No new stored field or save migration is introduced.

Charcoal is now accepted in trade-contracts.WEIGHTS and logistics.WEIGHTS at weight1. Peer goods retain whole-unit1–40 limits and ordinary food reserve, actual stock, agreement reservation, caravan capacity/ration, route, return and storage rules. No charcoal offer, depot inventory, source, wealth or workforce is injected. The earned neighbor’s existing kiln physically converts delivered logs into charcoal; three are transported home before arrow forging can consume them. The recall case restores an actual pre-dispatch prefix, reserves real food/coal, rejects a foreign cancellation without state changes, then returns untravelled cargo and payment to their respective owners. Test reads re-fetch settlements after rejected-command rollback, which can replace object identities.

The portable earned-born-combined-journey.json.gz pins the exact born-cohort fixture closing and replays all546 actual setup events: retained harvest/milling, finite iron barter/coin sale, supplied neighbor forge/kiln and physical tools/charcoal, returned title survey and paid home smithy, lawful existing-civilian textile succession/yarn, four paid research/adoption topics, actual arrow and bow manufacture. Twenty served events with three reviewed orders then earn four-person advanced infantry, full two-day mixed drill, physical cautious patrol/return and all twenty-eight wage coins. Combined member slots retain the same four birth keys; natural dense cover fires no arrows, previous casualty stays closed, and the whole closing restores exactly. The remaining qualified detachment is outside an active wage term. At that supply-and-drill checkpoint the later old-age continuation was unproven. The newer earned lifetime section above covers home mortality under expired wages; continuous funded-service breadth remains open.

Community cohort projection and earned reinforcement continuation

community-births.projection derives comingOfAge (up to six current resident dependents sorted by actual check then birth key), comingOfAgeRemaining, daysPerYear, recordedCivilianAdults, recordedRecruitEligible and recruitThroughAt. Child ages use the last settled village check, clamped to their actual birth; check times round to the receiving community’s day. Eligibility includes only recorded local civilians aged at least eighteen whose actual birth remains below eighty-five through two future village days, matching explicit recorded recruitment’s age window. This is an age/custody count, not a complete military quote. No stored field, migration, authority, birth limit or new command is added; age-known serving, deceased, named and travelling residents remain outside that count.

The portable earned-born-cohort-journey.json.gz pins the exact previous born-professional fixture closing as its opening. It preserves 506 independently replayed daily events, three normal twenty-four-day births, policy pause and 504 actual days through the youngest’s eighteenth-year maturation. It also preserves the ten served events and exact closing for birth authorization, pause, STAND_DOWN_PROFESSIONALS, paid three-person recorded reinforcement and two training days. Catch-up advances are drained through the normal 256-event/64-community-day bounded transactions before later commands; a single advance is not assumed to process years of backlog. Daily and offline paths agree on population, birth custody, inventory, economy and the unchanged veteran unit, while transaction revisions differ by batch. The original birth-key survivor reaches forty-five during reinforcement; ages 20/19/18 join him, prior casualty remains closed, population is thirty-nine, civilian labor twenty and three kits remain spent. A second case proves a clock-only read cannot grant adulthood or labor before the settled village check. Full professional/Combined lifetime through old age remains unproven.

Derived militia home-recovery status

military.projection(...).unit.homeRecovery reports atHome, scheduled, the actual ready unit dueAt as nextAt, eligible, reason, the shared rest changes and equipmentRestored: false. The ready unit must occupy its home hex; current commons, last household shortfall and community health select the advisory reason. This projection is read-only and does not introduce a book or migration. The kernel’s existing home-rest branch now uses the same frozen one-wound/ten-morale/twenty-fatigue/65-health constants without changing its arithmetic, ordering or clocks. Advice is evaluated against current state; the kernel rechecks at the real due time after normal needs.

test/militia-home-recovery.test.js restores the manifest-verified earned wounded born-militia closing. Ordinary due checks heal the same survivor while preserving equipment and the permanent other casualty; an actual commons demolition blocks both advice and the later healing check. test/earned-born-professional-journey.test.js independently replays all 269 ordinary setup events and sixteen served events from that exact predecessor: warehouse/staffing recovery, actual harvest/milling, finite market cargo and cash, separately signed physical tool delivery, a returned survey and paid field registration, staffed barracks, paid full research/adoption/refit, advanced infantry wages/training, cautious outward/return movement and completed payroll. The fixture also pins the separate two-check served recovery prefix. No source grants, ages, health, knowledge or terrain are edited.

The final born soldier remains attached to the same original militia unit and birth service. Professional payroll is completed, earned military-household money is outside communal cash, and qualification persists without an active wage term. Source casualty records stay byte-for-byte equal as values. This first advanced role and finite seven-day duty does not certify a full Combined/professional military lifetime, infinite minerals or sovereignty.

Starter package comparison projection

founding.view adds startPackages only while the authenticated identity is eligible for its one founding grant. Each row is a copied woodland, farming or coastal package from the same startPackage selection used by the authoritative founding command. Public comparison includes starting inventory, people, building IDs and staffing, but no other player’s private stock. The property is derived; restore and snapshot versions are unchanged. Mutating a returned package cannot alter the source package or grant. Availability remains current site/reservation/title state; comparing a package promises no title.

City adds a read-only entry card above shared Overview and a visible compact-map action. The local foundingStyle filters offered site cards while retaining the currently reserved site. Changing sessions clears the old comparison state. Existing charter and resident branches keep their original behavior. data-start-entry and data-start-style navigate/focus without a world command; map inspection and review dismissal are also read-only. Existing RESERVE_FOUNDING_SITE, FOUND_SETTLEMENT, construction and staffing commands remain authoritative.

test/earned-world-entry-journey.test.js independently replays the manifest-verified fresh-world fixture: three actual newly authenticated founders, eight served commands and five ordinary work/day advances, a separately staffed completed lodge, one real production/needs cycle, exact closing and unchanged restoration. Browser evidence additionally checks keyboard/touch navigation, all three map inspections, reservation/founding dismissal, retained reservations across filters, forty layouts and later same-session charter custody. This is one seed and a first-building path; it does not certify the full beginner patrol/outpost sequence or pacing/art breadth.

Read-only first-session guide handoffs

The existing briefings projection retains its nine factual guidance checks, counters and completion rules. village-guide-actions.projection(city, steps) adds only derived action label/tab/goal or topic and current explanatory detail. Food advice uses the current producer statuses for stock-ready output and the existing production-capacity.foodOutput through the City economy for virtual intermediate-goods capacity; it does not copy or change simulation production. Zero-staff food recipes retain a visible blocker. Current projects, program history, army readiness, frontier claim/founder custody, catch-up and public continuity select the destination. No retrospective event, saved book, command, grant or migration is introduced.

City v246 resolves data-guide-action IDs against the current received guidance row. It changes only the section, topic focus or one-project unsent supply goal. All spending remains in the destination’s ordinary review and authoritative command. Three unfinished steps are shown; all nine remain inspectable. Owner/observer privacy and delegated producer-only responses are unchanged. Guide clicks neither acknowledge a briefing nor submit an order.

The player Getting started now reaches its numbered founding/food/production sequence before optional advanced notes. This rearranges existing prose without describing planned realms or reservoir operation as playable.

The served three-start walkthrough passes eleven read-only links, 36 responsive layouts, paid construction/staffing and research/adoption, exact whole replay/restore and later-session continuity. The portable first-session journey manifest at test/fixtures/earned-first-session-guide-journey.manifest.json independently replays the ordinary founding setup and actual served work. Full entry-to-first-session pacing, touch/art breadth and the complete original goal remain open.

Explicit recorded recruitment through existing cohort custody

community-births.soldierCandidates adds an optional recorded population source while retaining the original available selection. Recorded selection filters validated local civilian birth records by current adulthood and age below 85 through the exact training end, then preserves chronological oldest-first order. Named/member/independent/travelling/soldier/dead custody is excluded. RECRUIT_MILITIA and REINFORCE_MILITIA accept only the supported source and retain ordinary owner, identity, revisions, health, labor, kit, reserve, civilian-floor and role checks. Quote and claim use the same full training age window, preventing the quote from skipping an elder while enlistment claims them instead. Default omitted source retains the previous choice and quote fields.

The military projection adds separate recorded recruitment/reinforcement quotes with exact birth keys and readable ages/dates; existing ordinary option arrays remain intact. City v245 renders separate reviewed buttons and commits the optional source. The actual unit communityAdults, birth adult.services and settlement defense.cohorts already own this custody, so no new saved book or migration is introduced. Existing cancellation, demobilization, aging and field casualty paths close the same records. A casualty retains its service/casualty link and cannot create civilian labor or resurrect a birth.

The portable earned fixture pins the exact preceding household closing and source bytes. Its 550 normal setup events include real toolmaking, lawful existing-civilian recovery, separately consented physical trade, two actual 24-day births, 432 village days to each adulthood and paid kits. Twenty-three served events/six commands prove paid reinforcement cancellation, fresh full training, demobilization, recorded new recruitment, actual camp contact with one permanent recorded casualty and physical survivor return. No camp, age, health, stocks, people, knowledge or elapsed-time grants are used. Nine boundaries include immutable quotes, default selection, exact civilian/service custody, duplicate cancellation, foreign/stale/unsupported/insufficient claims, real dependent ineligibility, civilian floor and skipping an elder crossing 85 within training. The isolated age-selection predicate uses explicitly synthetic dates; it is not earned old-age military acceptance. Full professional/Combined born-to-old-age evidence remains open.

See living-world design, implementation status and the player guide.

Derived household history and ordinary lifetime acceptance

household-aging.history derives new projection objects from the existing validated household birth receipts, joined timestamps, childhood maturation, deaths and accepted chapter handovers. Rows carry kind, time, character ID and historical age; deaths also carry cause. Arrival and handover ages use the existing ageAt clock, including an adopted resident whose earlier community birth remains authoritative. Sorting resolves equal timestamps as birth/arrival/adulthood/death/handover, then character ID. The read-only aging.history projection changes no persisted version, migration, permissions or command. City v244 renders those records only within the existing private Family & continuity view, escaping names and dates.

The portable earned-household-lifetime-journey pins the exact prior realm fixture and canonical closing SHA. Its 2,396 normal setup events have no controls or stock/age/health grants: existing guardian adoption, twelve eligible birth days, 432 village days to eighteenth-year maturation, natural previous-holder losses, lawful handovers and the child's 2,040-day birth-to-85 clock. Actual food staffing and service pauses protect meals. Ordinary finite supply, real forging and separately signed physical trades supply tools/iron; demolition plus salvage and renewable woodland work fund the staffed lodge, courses, real kits and two civilian recruits.

Eleven served command/time events, including two commands for embodiment and separate handover, start from one millisecond before the natural death boundary. The existing scheduler advances paid Masonry research, keeps the running four-person house payment/progress and recalls the outward unit physically. Research custody is checked directly in the knowledge project; a chapter's preserved job IDs do not falsely stand for research. Independent whole-event replay equals the served closing; restore preserves the entire save. Portable cases also deny a fresh public patrol order after embodiment during interregnum, preserve read-only projections and verify the chronological birth/adult/handover/death rows. UI evidence covers cancelled reviews, four widths, reload and a later session. Named household civilians are not militarized, and no professional, Combined formations, permanent casualty or complete M7/M8 gate is inferred from this branch.

See living-world design, implementation status and the player guide.

Realm production office custody

realm-offices.js adds optional realmOfficesVersion:1 and an exact {version:1,nextId,records} book only on successful PROPOSE_REALM_OFFICE. That paid nomination explicitly promotes federationCongressVersion and its book from 1 to 2, retaining every old record unchanged and adding the appointment kind tied one-to-one to a named realm record. Older absent books and congress-v1 snapshots stay absent/v1 under inspection and restore. Direct unnamed appointment congress proposals reject. The source civicFederations book and fixed term are unchanged.

Each realm record pins federation/congress IDs, original ordered members, proposer, nominated owner and exact living adult character, shared day, fixed seven-day term and 3/21 per-home limits. Existing congress custody owns every separately paid twelve-food/six-timber bill, three-worker job, full local voting day, actual majority, signer, pause, deadline and refund. Every funded participant's Public offices learning/adoption dates must precede funding. Status progresses proposed → offered only on approved voting → active only on separate CONTROL_REALM_OFFICE acceptance by the nominated lawful holder. Decline, resignation, member revocation, source/membership/holder loss and finite chronological deadlines end it. Services suspend access across the whole scope without deleting consent or extending the term.

APPLY_REALM_PRODUCTION_PLAN requires current world/office revisions and 2–8 unique completed producers with exact local revisions, whole staffing and existing recipes in at least two original consenting homes. Every row passes the ordinary validateEnvelope due-work, ownership and site gates before any mutation; all final local labor deltas must fit. Releases precede increases. The outer engine transaction rolls back every home, attention and action history on any failure. Owner budgets, paused mandates, input spending and target ceilings remain. No construction, government policy, logistics, military, family or ownership command is authorized by this office.

The exact action history retains actor/character, clock, shared-day index, command, affected home vector and producer IDs. Each coordinated transaction consumes one action per affected home including the nominee's home; ordinary foreign producer commands share that home's limits and ordinary own-home owner commands are uncharged. Counts must equal retained history, daily/total bounds cannot widen, chronological actions must name actual producers and active-term dates, and overlapping member intervals reject. Up to 84 history entries are retained for four homes with 21 allowances each. No truncation loses the custody required to validate counts.

Public offices reuses the existing production permission gate and foreign private projection. The accepted candidate's own City includes consented warehouses, food/workforce exceptions and reviewed producer rows; foreign views still omit family, army and other private books. Every review pins ordinary world/character/target authority plus the office and each producer revision; draft changes invalidate shared review. City script v243 is current. The nomination/election/acceptance/revocation/production controls display the actual named role and limits; ordinary admission/amendment controls remain in Constitution & authority. The role grants no sovereign authority or free materials/workers.

Federation congress custody

federation-congress.js adds optional federationCongressVersion:1 and an exact {version:1,nextId,records} book only after successful PROPOSE_FEDERATION_CONGRESS. Legacy absence stays absent, including old active compact saves. The original civicFederations records and fixed expiry are preserved. Admission/amendment records retain the parent ID, original member vector and terms, reviewed terms, participant owners/signers, independent funding clocks, local job/progress/ballot and exact held/spent/refunded/discarded bills. Offered participants have zero custody until their own consent. Every actual payment is twelve food/six timber; funded work begins only after all owners accept. Up to four independent founding homes can participate, with one open congress per source and no overlapping guest jurisdiction.

ACCEPT_FEDERATION_CONGRESS rechecks personal public authority, fresh world/receipt revisions, own reserves/allowance, all earlier signing holders and current local policy/service/workforce support. Three-worker federationCongressVersion:1 jobs spend four food/two timber per completed full local day. The third day recomputes the actual Food workers, Other producers and Household/civic workers ballot. Every represented majority, conforming final policy and retained signer are required. Costs and work do not become property rights or free term renewal. Admission changes effective members; an approved amendment changes effective shared requirements within food 3–14, civilians 12–40 and timber 6–20. F.current/busy and the ordinary/assembly policy guard include admitted homes and the latest approved amendment; local constitution/assembly authority remains an additional restriction.

Offers last three shared days and funded work ten, bounded by original expiry; the shared day is max(parent.dayMs, all participant dayMs). Parent notice or changed membership/terms interrupts superseded work, and source expiry participates in the normal chronological deadline loop before due jobs. Services/worker/holder loss pauses local work, releases its crew and restarts a whole unfinished day. CANCEL_FEDERATION_CONGRESS closes all unfinished delegates; refunds are per-home and once-only, held when they cannot wholly fit. COLLECT_CONGRESS_REFUND requires current local authority and exact receipt revision; explicit own overflow consent records the loss. LEAVE_FEDERATION_MEMBERSHIP belongs only to the admitted home and records min(source end, request+7 shared days). Founder exit ends all memberships; a guest exit preserves the founder group and latest safeguards.

Startup validates exact book/record/participant/material shapes, ordered IDs, source/member/term chronology, known/adopted prerequisites, real adult signers, funding before work, independent job IDs/full-day clocks, actual workers, reproducible cohort ballots, final policy evidence, original deadlines, membership overlap and current policy conformity. Optional absence is not migrated into an empty book. Owner-private City projections accept a congressDraft for read-only amendment quotes, preserve scoped drafts and disable unreviewed confirmation. Public jobs omit congress bill/ballot/signature fields. Workers separates congressDelegates from ordinary workplaces, and v242 policy controls read effective shared safeguards for founding and admitted communities.

The pinned earned-federation-congress-journey.json.gz embeds the exact original previous served compact closing text, 2,090 normal setup events and fifteen served command/time events. Its manifest pins the unchanged earlier compact fixture and explicitly keeps those separate accepted branches distinct. Preparation earns a second food plot, kiln/smithy, finite iron imports, whole tools and actual timber barter before research and the fresh compact. It preserves normal old-age deaths. Three owners complete admission, amendment and exact guest exit with retained local title/term. Sixty-four served layouts, exact independent whole replay/restore and scoped custody boundaries pass. Four-home capacity is implemented; the earned served proof covers three. No realm sovereignty, wider elections or indefinite supply certification follows.

Civic federation custody and shared policy authority

civic-federations.js owns optional civicFederationsVersion:1 and {version:1,nextId:1,records:{}}. Historical absence stays absent, including saves that already adopted Constitutional design. Only a successful PROPOSE_CIVIC_FEDERATION creates the book. The proposer reserves twelve food/six timber, above ordinary food reserves and within the current public allowance. ACCEPT_CIVIC_FEDERATION separately checks invited founding ownership, current embodied public authority, live issuer, world/compact revisions, local policies/services/workforce and own bill before creating both three-worker federationConventionVersion:1 jobs. Each successful full local day spends four food/two timber from that side's held supplies. Three days record its actual cohort ballot and policies; joint activation requires both local approvals, conforming final policies and original lawful signing officeholders. No funded local charter/assembly can overlap a federation convention in the same community.

Founding records retain base terms reserveDays≥3, civilianWorkerFloor≥12 and timberLimit≤20; approved congress amendments above may strengthen the effective requirements. the exact shared day is max(a.dayMs,b.dayMs). Offer expiry is createdAt+3 shared days, work deadline is acceptedAt+10 shared days, and an active term is joint completion+28 shared days. WITHDRAW_CIVIC_FEDERATION closes unfinished custody immediately or records active exit at min(term end, now+7 shared days). Deadline scheduling participates in the normal chronological engine loop before due jobs, including offline advance. Normal changes and FUND_CIVIC_ASSEMBLY quotes both call the federation policy guard; local steward/council restrictions still apply. The ordinary recruitment floor and timber allowance remain their existing enforceable mechanisms. Ratified obligations survive services and public handover, while unfinished personal consent pauses on issuer change.

Cancelled, declined, rejected or expired work releases both jobs and refunds each warehouse's own unused bill once. Insufficient capacity retains held supplies; COLLECT_FEDERATION_REFUND rechecks only the collecting lawful owner, fresh receipt and capacity. Explicit own overflow consent records actual loss. Book startup validates exact record/material shapes, sequence, actual founding jurisdictions, signers and research chronology, full-day job clocks and worker counts, recomputed constituency ballots, exact deadlines, paid/spent/held/refunded/discarded conservation, nonoverlapping membership and active policy conformity. Orphan jobs, forged free bills/ballots/deadlines or policies that contradict ratified safeguards reject.

Owner City projections are read-only and expose both consensual conventions, live blockers and effective binding; delegated/public projections omit the private federation book. Public chunk jobs omit ballot and bill metadata. Three delegates count separately from workplaces and release on actual labor shortage. The original City script v241 supplied proposal/acceptance/refusal/cancellation/refund/exit reviews in Constitution & authority and displays current safeguards in workforce controls. The portable fixture pins the unchanged Dialogue source bytes, 393 normal preparation events and eight actual served command/time events through exact paid ratification/exit. Declared scarce stock, damage/storage and founder illness boundaries remain separate unit cases. This is the first bilateral safeguard arrangement, not a claim of completed realm sovereignty, elections or indefinite sustainment.

Territorial siege custody

territorial-sieges.js creates optional territorialSiegesVersion:1 and {version:1,nextId:1,records:{}} only on accepted deployment. Legacy absence stays absent; empty marked books, missing bindings, unknown record keys, wrong source/declaration/route, forged chronology, equipment, meals or pressure reject. Each expedition binds an existing militia through u.siege={version:1,expeditionId} and a siege-expedition job marked siegeExpeditionVersion:1. Army and crew share actual axial route, index and due time; neither scheduler advances them twice. No existing save version is forced forward for this optional path.

DEPLOY_TERRITORIAL_SIEGE accepts exactly {warId,expectedWarRevision} with current founding authority, target/world review and two attention points. It rechecks served notice, protection, services, real fit trained army, four spare workers, carrying capacity, fire/flood, explicit third-party siege passage, age/payroll/notice horizons and paid reserves. Maximum eighteen route edges each way use ordinary day/12 walking steps. Food is ceiling-rounded for maximum duty, both legs and one reserve day. One real ram weighs twenty-four; four engineers carry at most 120 total weight. Soldier top-ups move actual food out of co-located baggage before normal feeding. Army/engineer consumption and casualty losses reconcile against paid food plus the army's original provisions. Labour, household forecasts and garment presence count engineers as away; no double home meal is charged.

Two-hour pressure receipts retain start/end, actual soldiers/four engineers, prior condition, damage and result. Pressure caps fort damage at condition twenty-five and wears army readiness. CONTROL_TERRITORIAL_SIEGE accepts exact {expeditionId,expectedExpeditionRevision,action} for physical recall or separately reviewed eligible occupation. Twelve real hours is a minimum gate, not an instant breach. Occupation expiry is the lesser of arrival +24h and confirmation +4h; source family/title is unchanged. Ended-war commands feed to their actual time and immediately initiate return. Other interruption checks run on actual travel/duty ticks. Structural work rejects a currently occupied fort.

Actual defending garrison contact is distinct from fixed-strength NPC patrol combat. The receipt records both real forces, powers, fort bonus and stationed-garrison snapshot. Birth-linked deaths, kits/quivers/food losses, cohorts and professional refunds use the existing casualty path. Startup cross-checks both battle and casualty source. Garrison refill/finite daily/standing food headcounts now include actual siege casualty slots at the saved collection boundary as well as real old-age deaths; these slots are derived from casualty receipts, not invented age deaths. Known soldier old-age receipts can retain optional siege custody without changing older receipt bytes.

Returning survivors detach only at home; four engineers return even if the army is destroyed. Used ram dismantling creates at most six timber/two iron; unused whole ram returns once. Partial credited salvage/meals and indivisible whole ram stay with the unloading job until storage fits, with no workers. The final archive conserves paid/consumed/lost/returned/held food and equipment. City v240 and world job positions v2 expose actual troop/engineer positions, shared public contact summaries, dates, pressure, recall and occupation reviews. Private issuing character keys are omitted. Historical notice briefing bytes remain unchanged; current City guidance routes notices to these implemented expedition controls. The pinned earned-territorial-siege-journey.json.gz continues the unchanged notice fixture: eighty-one earned setup events, forty-five served events, actual defender combat/death, twenty hours of pressure, four-hour occupation, real return and conserved salvage. Selected verification is 409 distinct cases in thirty-eight files; forty-eight served responsive checks and twenty prior closing restores pass. Six prior fixture byte hashes remain unchanged. Elara’s independent normal old-age death remains in the final thirty-nine-resident attacker closing, with all four soldiers returned. Wider siege weapons, orders, territorial peace/title settlement and the original M0–M8 remain open.

War declaration and protection custody

war-declarations.js owns optional warDeclarationsVersion:1 / {version:1,nextId:1,exits:{},records:{}}. Older save absence remains absent. Only a successful protection exit or paid declaration creates the book; an empty marked book, missing marker, unknown fields or inconsistent sequence rejects. At most 2,048 declarations and sixty-four earlier truce offers per notice are retained. The current offer has its own exact receipt. Startup validates actual founding families/issuers, learned/adopted prerequisite chronology, real foreign fortification/axial identity, exact bill and absolute clocks, protection snapshots, actual imported allied unit/agreement/arrival witnesses and separate lawful truce signatories. It rejects a later protection exit used to legalize an earlier declaration, free bills, forged dates/anchors, third-party acceptance, duplicate live outgoing/target bindings and inconsistent response revisions.

END_NEWCOMER_PROTECTION accepts exactly {confirmLoss:true} under fresh world review and current founding authority. It spends no materials/attention, records the lawful issuing character and permanently ends the remaining 72-real-hour window. The natural deadline is charter-issued time plus 259,200,000 ms, independent of village-day tuning and continued through succession. Actual imported armies at a primary fortification and distant outpost assets do not acquire starting-estate protection; invitations/outward troops are not the presence witness.

DECLARE_TERRITORIAL_WAR accepts exactly {targetStructureId,statement}, two attention points and {food:4,timber:4,tools:1} through the existing protected-reserve/public-budget checks. Current instruction, needs, 65 health, target standing condition, foreign ownership and attacker/target protection are checked before the atomic debit. The notice stores a disputed-control claim, not a finding of legal entitlement. Eligible time is accepted time plus 86,400,000 ms; expiry is plus 604,800,000 ms. Neither services nor projections shorten/restart these absolute dates. Expired status is projected from time without inventing a closure or refund.

CONTROL_WAR_DECLARATION requires {warId,expectedWarRevision,action} and the fresh world review/current founding authority of one of the parties. Attacker withdrawal closes without refund. Either party can offer a truce; its expiry is the lesser of notice expiry and twenty-four real hours. Separate other-party acceptance needs the same active proposing character and closes without stock, title or office changes. Declined/withdrawn/expired prior offers remain in truceHistory; exact response count determines revision. Closure need not retain optional instruction services. Public projections remove issuing character keys and imported-unit source details, while both parties retain target/claim/bill/dates/replies and receive factual Defense briefings.

City v239 adds these reviewed controls in Defense. Claim drafts are scoped to world instance/community, updated during typing and preserved through refresh and review dismissal. Responsive checks verify four widths, both owners, reload/later session and read-only review cancellation. The portable earned-war-notice-journey.json.gz pins compressed/raw bytes and the unchanged earned-covered-ram source dependency, then replays its original root through the earned industry and twelve new setup/eight served events. Isolated protection/reserve/succession controls and the existing allied-watch fixture stay separate from this earned branch. The optional physical deployment/contact/pressure/temporary occupation path above now extends this historical notice checkpoint; no broader M0–M8 gate is completed.

Selected current verification: 345 distinct cases in thirty-one files passed, plus twenty-eight served responsive checks and restoration of nineteen separate prior branch closings. Seventeen prior closings restore unchanged; two historical waterworks saves receive only the already accepted 42→43 empty residue-custody migration. All five prior portable fixture hashes remain unchanged. This is a selected run, not the full repository suite; reruns and earlier served attempts are not counted twice. The original full goal stays active. Current notice/truce evidence and the next actual deployment/pressure/occupation work are pinned in .qa-city/war-notice-goal-handoff.json.

Siege equipment custody and fabrication jobs

siege-equipment.js owns optional siegeEngineeringVersion:1 / {version:1,nextId:1,fabrications:{}}. Paid first Siege engineering adoption creates an empty book; absence stays absent on older saves. The retained book is bounded to 2,048 records. Initialization checks the paid known/adopted topic, real charter/issuer chronology, record sequence, selected workshop, bound home job and four existing crew members, exact three-day material tranches, full-day receipt clocks, conserved reserved/spent/refunded goods and at-most-one whole output. Missing/orphaned markers, mismatched crews, skipped days, invented refunds and double-stored equipment reject. Receiving real equipment does not require the recipient to have learned its manufacture.

Fresh FUND_SIEGE_FABRICATION takes {structureId}, one attention point and the complete {logs:12,timber:18,iron:6,cloth:3,tools:3,food:12} bill through protected food/public timber checks. The siege-fabrication job has its own marker, not the generic building crew marker. Four additional existing civilian workers count only during unfinished running assembly; population loss can release this crew before existing workplace assignments. Command, surface-water and daily simulation boundaries reconcile instruction, services, needs and available labor. Three separate full village-day receipts spend one third each. Pausing discards unfinished time, preserves supplies and restarts a fresh day when available.

Fresh CANCEL_SIEGE_FABRICATION also pins expectedFabricationRevision. The command boundary rolls back a refund if every unused material cannot fit. Completed assemblies cannot convert spent materials back into stock. Completion creates one whole coveredRams output held for storage without workers, with daily retry; no overflow discards this equipment. Transport equipment treats it as indivisible and registers carrying weight 24, reused by existing physical outpost/player trade routes. No army, ownership or offensive permission is derived from cargo.

Defense/worker projections expose current offers, actual held/spent/refunded supplies, full-day clocks, four assembly workers, whole stored output and history; receipt and world revisions are rechecked on confirmation. city-interface.js?v=239 supplies reviewed funding/cancellation and read-only review dismissal, without a new navigation tab. Supply chains contains a separate funded assembly source, with actual inputs, output, institutions and three days. Catalog validation checks this project’s dependency reachability and rejects circular initial-ram prerequisites; it is not a daily workshop recipe.

The portable earned fixture and manifest pin the original opening, 1,993 setup events, ten actual served events and exact closing, replayed without disposable QA dependencies. The corrected served branch retains supplied Wheat and both engineers, passes twenty-four responsive checks, owner reload/later session, independent whole-state replay/restore and clean server shutdown. The earlier food-depleted harness stays a disclosed superseded branch. Declared full-storage unit controls exercise custody only. The declaration, fixed 24-real-hour notice and target protection gate above are now implemented. Physical deployment and twelve-hour pressure/occupation are now extended above; this partial equipment stage completes no M0–M8 milestone.

Prior covered-ram checkpoint verification: 312 distinct cases in twenty-seven files passed, plus twenty-four served responsive checks and restoration of eighteen separate prior branch closings. Sixteen prior closings restore unchanged; two historical waterworks saves receive only the already accepted 42→43 empty residue-custody migration. Four prior portable fixture hashes remain unchanged. The full repository suite is not claimed, and superseded harness/reruns are not counted twice. The original M0–M8 goal stays active; evidence and next siege deployment/notice/pressure work are pinned in .qa-city/siege-goal-handoff.json.

Combined formation custody and military integration

combined-formations.js owns optional paired combinedFormationsVersion and book version markers, accepting1 and2. Paid first adoption creates only an empty version-one {version:1,nextId:1,records:{}} book. Only the successful explicit mixed-arrow field dispatch below promotes both markers to2, retaining existing records. Legacy absence and version-one saves stay unchanged on read; missing books/markers, orphaned unit bindings, invalid roles, duplicated/fictitious casualties, free arrows, forged drill clocks and inconsistent refunds reject during initialization. The army node requires Formations and Archery at a staffed barracks. Existing infantry profession and original military/payroll versions remain unchanged. A 4096-row per-record bound reserves six rows for real terminal casualties; before the non-casualty history fills, new loading/departure/fire requires a home detachment end. Existing gear remains returnable and deaths never lose their receipt capacity.

Fresh authoritative FUND_COMBINED_FORMATION charges one attention point and reserves {food:8,tools:1,bowKits:2,arrows:12}. It records the actual unit, lawful issuer, funded infantry contract, initial four/six members, known birth keys only where already recorded, and combat/death ledger baselines. The last two existing slots become bow members; no people, labor, age or pay is invented. Existing simple formation is removed with its old cost retained. military.advance awards four spent meals per full safe local day while the existing unit stays home. Service/readiness/needs loss resets unfinished timing; restored service starts a fresh day. Departure, reinforcement, pure-formation orders, role end and demobilization reject unfinished/incompatible custody.

Weighted live role strength uses 1.25 line / 1.5 eligible bow factors, falling to1 for unavailable bow fire. Two fit members of each role are required; aggregate wounds reduce bow availability first. Open ground adds10% firing coordination; moderate cover applies a15% penalty. Dense cover, hazard/exposure, unavailable wages/instructors, low readiness, excessive fatigue or incomplete ammunition remove firing. Pure professional/formations/mounted paths remain separate. archery.engage delegates real patrol/relief contact to this custody; defensiveQuotePower previews eligible mixed defense without mutation, and actual protected co-located crossings consume a necessary complete volley only. Contact history records mixed arrows as well as pure-archer arrows, including the final volley. Home-only LOAD_COMBINED_AMMUNITION consumes actual whole stock. The additional mixed field journey below physically delivers separately paid arrows; pure-archer field/depot supply retains its existing formats.

Mixed detachment field ammunition

combined-field-ammunition.js derives live bow members from the detachment's casualty/old-age prefix. field-ammunition.recipient/quote use this surviving six-per-archer capacity and actual remaining, keeping the infantry profession free of an ammunition ledger. The City quote includes recipient kind and capacity without mutation. Standard depot, quartermaster, two-carrier, route, authority, stale-review, finite stock, reserves, weight and military-duty checks still apply. Only successful DISPATCH_MILITARY_SUPPLY with mixed arrows promotes the paired book markers1→2; it neither rewrites records nor grants stock. Food/kit/pure-archer journeys retain versions1/2/3.

New mixed cargo is supplyVersion4 with ammunition.version2, exact formationId/fittingContractId, dispatch entryIndex, original live soldiers, paid/carried/delivered/returned arrows and nullable deliveredAt. Restore validates the original prefix and dates, surviving dispatch capacity, fitting/unit/settlement identity, whole conserved cargo, combined carrier weight, recipient compatibility and exactly one matching delivery row. Version-one books reject field-load entries. At the actual rendezvous, a bounded quantity fills only surviving empty quivers and appends a field-load with jobId, paid quantity, dispatch prefix/time and destination. Combined reconstruction validates chronology, unique journey ID, capacity and 12 + arrowsLoaded = remaining + arrowsFired + arrowsLost + arrowsReturned. Delivered receipts remain valid after a later home detachment end; remaining carrier arrows still need physical whole-item storage. The contact-history margin protects future death receipts.

Seven controlled unit cases and the portable controlled journey manifest ../../test/fixtures/controlled-mixed-field-ammunition-journey.manifest.json cover real payments/walking, cancellation, duplicates, malformed custody, later closure, normal patrol line casualties and offline domain settlement. Scheduled replay compares the whole state; a single bulk catch-up separately compares unit, cargo, Combined/payroll ledgers, inventory and defense because event-publication timestamps/revision counts depend on scheduling. The portable fixture records normal100ms paid depot/drill setup and one explicitly controlled four-arrow contact, followed by two served reviews/four atomic state witnesses, production-loader validation, later identity and28responsive checks. It is not an ordinary earned mixed campaign or full M0–M8 certification.

field-combat.resolve and birth-linked old-age callbacks pin actual original casualty/death IDs before deleting the unit. Anonymous casualties follow existing unknown-first selection; known slots follow the actual cohort closure. The additional ledger accounts separately for fitted bow losses and up to six arrows per fallen bow member. Reconstruction checks exact selected slots, source chronology, all source rows within the detachment lifetime, surviving counts, complete drill days and whole material conservation. Its states are training, equipped, closed, lost and returning. A terminal unfinished home drill enters returning with both held bows, surviving unused meals and arrows retained; the owner must make full warehouse space and collect them through END_COMBINED_FORMATION. Equipped total loss records actual lost equipment. Ending at home archives condition-rounded whole bows and exact arrows; it neither changes population nor refunds existing wages.

Owner-only Defense projections remove birth/member keys, expose actual paid progress/blockers, current ammunition and fresh funding/loading/end quotes. City reviews use current target/world revisions and current authority; canceled reviews are read-only. Supply consumers show conditional per-drill and per-loaded-arrow inputs, never production output or fixed daily ammunition demand. city-interface.js?v=237 exposes the controls without adding a navigation tab.

239 distinct selected cases in twenty-one files pass, including twelve combined cases, two portable earned cases, 133 retained military/birth cases and 92 integration/preserved-branch cases; the full repository suite is not claimed. Default-timing setup replays 840 original events without grants. The earned twenty-event served flow uses actual dense terrain and fires no arrows. A separate declared open-camp flow fires four and loads four home arrows; both pass exact whole replay/restore and forty total responsive checks, with all servers stopped. Synthetic terminal-death and controlled readiness/terrain/storage tests are declared; a new complete combined birth-to-old-age journey is not claimed. test/fixtures/earned-combined-formations-journey.json.gz pins opening/setup/served/closing bytes through its manifest and is replayed without QA-directory dependencies. Prior earned Dialogue, regional and both residue fixture byte hashes are preserved. Full M0–M8 and fourteen original gates remain active; Siege engineering, wider progression and useful permitted reservoir operations remain open.

Interfaith and civic dialogue implementation

civic-dialogue.js owns an optional civicDialogueVersion:1 / {version:1,nextId:1,records:{}} root. interfaith-dialogue follows Scholarship and Civic representation. Paid adoption adds only the empty book; legacy absence remains absent. The retained ledger has a 2048-record limit. PROPOSE_CIVIC_DIALOGUE pins an actual accepted-but-expired unfulfilled cultural/pilgrimage pact during the offering sender’s seven-day retry wait, reserves six food/four timber plus one to twenty whole communal coins and records that embodied owner’s tradition. The invited side remains null and zero delegates are assigned until its own fresh ACCEPT_CIVIC_DIALOGUE reserves the identical local bill and independent tradition.

Acceptance creates a stationary marked job in each community. Each uses two existing delegates, consumes three food/two timber per completed day and needs two full local days. Completed local sides release labor and retain held compensation until both finish. Institution, needs, damage or labor loss pauses only the affected job and restarts its unfinished day. nextAt integrates the three-sender-day offer deadline and ten-sender-day accepted work deadline into ordered simulation. The shared receipt revisions track both jobs. Public chunks show only six job silhouette fields; private owner City projection includes mutually negotiated terms/progress and producer delegates omit them.

Only completion credits held coins to the recipient communal balance and permits waives(sourceKind,sourceId,senderId) for that exact source promise. Cultural/pilgrimage retry checks use this receipt; neither original pact status nor visits change. Referenced pacts are protected from old-record pruning. A new exchange retains ordinary active guidance, separate owner consent and paid physical travel. Held dialogue money is included in the finite coin-market conservation equation; there is no NPC refill, private estate payout or minted income.

WITHDRAW_CIVIC_DIALOGUE permits either participant to stop voluntary work. Decline, withdrawal or exact expiry removes both marked jobs, returns held coins to the sender and attempts each full local unused material bill without loss. Full warehouses retain unused quantities in the closed side with no workers; tracked later checks or COLLECT_CIVIC_DIALOGUE_REFUND return them once. Only the current embodied local owner can set discardOverflow:true for their own bill. Work quantities and whole coins stay integral; refunded/discarded food and timber can reflect an actual fractional fungible warehouse remainder while conserving the bill.

Initialization rejects missing/unmarked books, forged source facts or a source visit that was actually fulfilled, owner/issuer/adoption chronology, counterfeit money, invalid cost/work/refund custody, overlapped live dialogues, altered local work clocks, premature paid closure and orphaned jobs. Closed receipts preserve both choices, materials and original source evidence through succession/reload. Regional consent/interruption/refund notices and the supply-chain conditional consumer are read-only. World/simulation three and major-waterworks 43 stay unchanged.

Current scoped verification: 294 distinct cases across twenty-four files: twenty-two dialogue cases, two portable ordinary earned-journey cases and forty-six catalog/navigation/founding cases in five files; 112 retained coin/ethics/scholarship/civic/constitutional/pilgrimage/performance/continuity cases in eight files; and 112 integration/preserved-branch cases in eleven files. Duplicate reruns are excluded; the full repository suite is not claimed. The previous summary counted the integration files as twelve; the actual selected log contains eleven, and its 112 passing cases are unchanged.

Ordinary earned acceptance: An 862-event setup replays exactly from the original world opening using normal 100-millisecond construction work units and four-hour village days. Two actual founders use only their ordinary packages, paid selective harvest/precision sawing, finite tool barter, paid institutions and real research/adoption. One village grows flax, spins yarn, weaves cloth and physically trades two cloth for one tool under both owners’ consent. It then completes a paid pilgrimage trip, a real host stay and physical return; the offering village misses its reciprocal visit at the actual fourteen-day deadline. No materials, knowledge, people, coins, terrain, damage or accelerated construction are granted.

The separately served seven-event City flow from that earned opening verifies both owners’ actual local payments, independent faith-supported/philosophical traditions, held compensation, no early payment, actual mediator suspension and fresh-day resumption, exact source-promise remedy, owner reloads, a later private session, whole replay/restore and twenty responsive checks at 320/390/640/1440 pixels. The mobile paid-history screenshot was inspected and the server exited cleanly. Each community spends six food/four timber; four existing communal coins move from the sender’s twenty-four to the recipient, leaving twenty/four and NPC treasury 1176. The original recipient visit and unfulfilled pact remain unchanged. Both communities retain forty residents, twenty-four civilian workers, full needs and positive staffed wheat food balances.

Earned evidence is pinned in .qa-city/dialogue-earned-goal-handoff.json, .qa-city/dialogue-earned-opening-attempt7.json and .qa-city/dialogue-earned-browser-YviiBP/evidence.json. The portable test/fixtures/earned-civic-dialogue-journey.json.gz includes the original opening, all setup commands, the earned ready state, actual City commands and closing; its manifest pins compressed/decompressed hashes. Regression tests independently replay the entire setup and the served custody sequence without reading disposable QA files. The prior declared-material/previous-pilgrimage-adoption/one-millisecond-setup branch remains separate and preserved in .qa-city/dialogue-goal-handoff.json. No stocks or branch states are merged.

This verifies the finite optional mediation journey. The earned closing has 32.5 sender timber and 19.5 recipient timber, no stored logs or tools, with four spare recipient cloth and the existing source manuscript retained. Record keeping and Scholarship still consume two timber per community day; remaining owned woodland and actual milling/imports must be supplied before those services exhaust this buffer. Food is sustainable at the present population and active staffing, but indefinite institutional supply and every geographic starting choice are not certified. At that dialogue checkpoint Combined formations was next; it is now implemented above, and Siege engineering remains open; all nine original M0–M8 milestones and fourteen scenarios remain in the active goal.

Scriptural/philosophical scholarship implementation

scriptural-scholarship.js owns a separately paid preservation/discussion lifecycle. The religion node follows Literacy, Scholarship and Ethical teaching at a staffed scriptorium. Paid adoption alone promotes scripturalScholarshipVersion:1 and an empty {version:1,nextId:1,records:{}}; legacy absence remains absent. FUND_MANUSCRIPT_DISCUSSION requires a fresh world/target revision, current lawful embodied owner, actual institutions/services/needs/labor, a selected owned scriptorium and real source manuscript/cost. covenantId:fair-earnings|civilian-care and tradition:secular|faith are explicit; no faith score or conversion is introduced.

The stationary marked job holds one manuscript-ethical-teaching and reserves nine food/six timber. Two real readers consume three food/two timber per whole completed day over three days. The source remains unspent custody. Service/damage/needs/labor loss pauses and releases readers, restarting the unfinished day. Completion creates one ethicalCommentaryFair or ethicalCommentaryCare and returns the original source. If two whole storage slots are unavailable, both texts remain held with zero reader labor in awaiting-storage. The earned output can later unload without new writing. CANCEL_MANUSCRIPT_DISCUSSION requires exact record revision and returns unused custody plus any finished text once; overflow requires explicit discardOverflow:true.

Strict initialization checks book marker, sequence, actual charter/issuer eligibility and known/adoption dates, selected structure, no overlapping funded discussions, exact material/output custody, worker count and whole-day clocks, and closed source/output receipts. Orphaned jobs and contradictory marked saves reject. Source return is recorded as refunded input rather than new production. Job processing is included at command, ordered daily/native-water and completion boundaries; population release prioritizes paid readers, and site-work lookup excludes stationary discussion so repairs remain possible. Read-only City projections list private pending/history and reader labor; public chunks expose only the six-field job silhouette, while producer delegates omit these records.

The two whole commentary resources join the existing resources.js catalog and one-unit transport-equipment.CARGO_WEIGHTS. Cargo, trade, outpost routing and credit validation therefore enforce real whole items and existing weight/capacity/reservation/storage behavior. No new NPC purchase or free import offer is added. Supply-chain projects include the source as held/reusable input and expose paid discussion/output separately from optional written instruction. Actual controls revalidate all conditions; projections grant nothing.

FUND_ETHICAL_COURSE accepts optional useCommentary:true. It requires active Literacy and matching stock in addition to existing requirements, adds the actual item to escrow, and creates nested ethical instructionVersion:2, commentaryResource and bindingDays:28. Unfinished instruction retains/refunds the whole item; the second completed day consumes it. Existing version-one course fields, costs and fourteen-day dates remain unchanged. Full restore rejects unmarked/changed duration, wrong commentary, missing item custody and invented consumption. Extended paid sources also validate through existing tax version-two consent; accepted allowance/rate/receipts stay frozen. A recipient may use a delivered commentary after local Literacy/Ethical teaching without receiving Scriptural/philosophical scholarship for free. World/simulation remain three and major-waterworks 43.

Preceding scholarship verification: 382 distinct cases in thirty-two files: twenty-two Scriptural/philosophical scholarship cases and ten supply-chain cases in two files, 219 retained economy/politics/continuity cases in sixteen files, 123 military/population/City/education/trade/transport cases in eleven files and eight preserved-branch cases in three files. Duplicate reruns are excluded; this is not the full repository suite. The default-timing 306-event opening is command-earned, including real school/scriptorium construction, surplus-food waystation provision trips, tool barter, research/adoption and an actually copied Ethical teaching manuscript. No stock, people, coins, knowledge or terrain controls were added. Served Fair earnings and Civilian care flows verify actual paid discussion, preserved source, whole commentary, optional instruction, independent tradition choices, full replay/restore, consecutive private owner reloads and thirty-two responsive checks at 320/390/640/1440 pixels without page errors. The source/supply tree is read-only and opens the real scholarship controls. All owned browser servers stopped. Evidence is pinned in .qa-city/scholarship-goal-handoff.json; .qa-city/gameplay-acceptance-audit-attempt8.json preserves all nine original M0–M8 milestones and fourteen required scenarios. The full goal remains active.

The two-founder integration case performs real founding, school construction, two separate one-material consented trade trips, paid study/adoption and a chosen receiving course. The default-timing earned opening and served flows cover whole-source conservation, pauses/restarts, independent traditions, actual physical output/use, save restoration and exact replay. Boundary controls are declared separately from earned setup. See current status, primary design and player guide.

Ethical teaching implementation

ethical-teaching.js implements finite paid public instruction and voluntary covenants. The religion node follows Record keeping at a village center with six days' practice, three-day eight-food/six-timber research, four-food/four-timber adoption and one mentor consuming one food/one timber daily. Paid adoption adds only ethicalTeachingVersion:1 and ethicalTeaching:{version:1,nextId:1,records:{}}. Unmarked legacy saves remain absent. The empty book contains no promises, people or stock. World/simulation remain three and major-waterworks 43.

FUND_ETHICAL_COURSE accepts covenantId:fair-earnings|civilian-care and tradition:secular|faith. Authority requires the current lawful living embodied founding leader, current world/target revision, active Ethical teaching/Record keeping, dry sound commons, met needs/65 health, two available workers and real cost/budget/reserve checks. Eight food/four timber is reserved; each of two full instruction days spends four food/two timber. Stationary marked jobs consume two students while running and are excluded from site occupancy, allowing repairs. Need/service/damage/labor interruption pauses/relinquishes students and restarts an unfinished full day. Ordered daily/offline processing agrees. Completion creates a fourteen-home-day covenant; expiry is a read of the saved binding interval. Completed promises persist through service loss/succession. CANCEL_ETHICAL_COURSE requires exact course revision, returns unused custody once, and requires explicit overflow consent if storage would discard anything.

Military recruitment/reinforcement quotes call the covenant guard before their ordinary requirements. Civilian care protects twenty actual remaining civilian workers and four population-meal days in stored food. Personal-estate and professional-service quotes apply the same four-food-day guard even for no levy. Existing troops, wages and physical obligations are unchanged. Fair earnings rejects half in new terms, raises allowance to four and uses two morale for military quarter consent. Protected consent creates nested tax version two with ethicalCovenantId in both actual contract and tax index. Restore validates that source against the exact paid completed same-home Fair earnings record at the original signing date. Cumulative assessment uses the frozen allowance: people * floor(max(0,n-allowance)/divisor). Version-one standard terms retain two and ordinary morale costs. Neither expiry nor later courses rewrite accepted payments or inheritance.

Full restore rejects missing adopted books/markers, forged material custody/progress, orphaned jobs, worker counts, clocks, overlapping instruction/binding periods and contradictory closed records. Tax-source validation runs against the raw source book before full ethical initialization, then ethical initialization validates the entire source. City projections are read-only/private, list two students separately and retain actual funded/current/history records. Public chunks expose only the job silhouette; producer delegates omit this section. The existing command persistence path records actual courses, consent and receipts without a protocol migration.

Preceding Ethical teaching verification: 305 distinct cases in twenty-four files: eighteen Ethical teaching cases, 201 retained economy/politics/continuity cases in fifteen files, 78 military/population/City/attention cases in five files and eight preserved-branch cases in three files. Duplicate reruns are excluded; this is not the full repository suite. Both new default-timing openings are command-earned without direct stock, coin, population, knowledge or terrain controls and replay exactly from their original opening. Served Civilian care and Fair earnings flows verify paid reviews, read-only cancellation, actual pause/resume or military pay, complete save replay/restore and consecutive private owner reloads. Thirty-two responsive checks cover 320/390/640/1440 pixels without page errors. All three owned browser servers, including the first civic harness selector failure, stopped. Evidence is pinned in .qa-city/ethical-goal-handoff.json; .qa-city/gameplay-acceptance-audit-attempt7.json retains all nine original M0–M8 milestones and fourteen required scenarios. The full goal remains active.

See current status, primary design and player guidance.

Payroll tax implementation

tax-administration.js owns optional quarter/half terms on newly funded pay, exact per-person cumulative assessments, morale consent and private receipt projections. The politics node follows Record keeping/Public accounting and the registry. Paid adoption creates only taxAdministration:{version:1,contracts:{}} plus coinMarket.payrollTaxVersion:1; learning/legacy absence grant no terms or funds. The index pins each accepted source contract, home, start, finite days, people and option. Missing/mismatched terms or index reject. World/simulation remain three and major-waterworks 43.

Existing FUND_OFFICE_STIPEND and FUND_PROFESSIONAL_SERVICE accept optional taxOption:none|quarter|half, defaulting to none for compatibility. Quotes revalidate current authority/revisions, original money/material/service requirements and adopted active tax support. Military tax consent requires morale at least 80 plus the four/eight-point cost and debits morale once. Current voluntary terms do not enact global tax policy or bypass constitutional reserve/budget/succession guards. Original contracts retain gross totals, held balances, paid clocks and refund equations. Earlier unmarked contracts remain untaxed.

For standard version-one paid terms, cumulative assessment is people * floor(max(0,n-2)/divisor) with divisor four or two. Protected version-two terms use the four-coin allowance bound to their actual paid ethical source. The instalment is that assessment minus day n-1. Active tax/accounting/record services transfer that exact amount from the earned gross payment into community coins; otherwise a zero-collected, permanently waived receipt is stored. No arrears or private-balance reassessment occurs. Military wages remain in their existing aggregate private ledger, reduced by actual collected tax; personal stipend balances and event replay credit only net income. The unchanged global 1,200-coin custody equation includes actual net private assets and original held funds. Tax has no additional money sink or source.

Every paid-day receipt binds actual source clock, day, due, collected and waiver reason. Whole restore validates terms/index, adopted dates, source gross days, exact receipts/collection sum and military consent/timing; personal estate reconstruction replays net stipend earnings before donations and actual death chapters. Death at an equal community/payment boundary settles before new pay/tax. Cancelled service refunds only unearned gross funds and leaves collected/public and net/private money intact. Daily versus offline accounting agrees. Fresh City projections are read-only; foreign owners are rejected and producer delegates receive no tax book/history. Existing command event persistence carries the new terms/receipts without a new protocol command.

The fifteen tax tests include real earned setup and separately declared scarcity, morale and health boundaries. Two independently replayed default-timing openings feed served stipend/military proofs; the first browser's selector error and failed setup attempts are retained. See current implementation status, primary design and player guidance.

Assembly numeric drafts now keep the focused field while fresh City state/quote replies arrive. Input captures the draft and disables review; blur requests a fresh server quote before confirmation. This prevents a replaced number field from losing selection between keystrokes. Interregnum UI review permits only the bounded council appointment/cancellation commands alongside existing continuity actions; charter amendments still require public handover.

Constitutional authority implementation

constitutions.js implements local charters and paid successor appointments. Optional constitutional-design research depends on Courts and Civic representation. Paid adoption promotes only an empty constitutionsVersion:1 / constitutions:{version:1,nextId:1,records:{}} book. Learning leaves it absent; older saves remain absent. An adopted program, marked job or lost book cannot masquerade as an old save. No policy, nominee, population, coins or supplies are granted by adoption or restore.

FUND_CHARTER_CONVENTION requires current human public authority at the founding home; FUND_COUNCIL_APPOINTMENT additionally has a bounded continuity exception for an embodied existing adult during interregnum under an already ratified council charter. Both require fresh world/target review, an existing eligible adult, active constitutional/Courts/Civic/record/accounting service, sound dry commons/registry, represented actual constituencies, three free workers, protected food, public timber limits and ordinary operating budgets. They debit {food:12,timber:6} once and create an isolated three-day stationary constitutionalSessionVersion:1 job. Civic assemblies and constitutional sessions share one local deliberation slot. CANCEL_CONSTITUTIONAL_SESSION requires the current embodied adult and exact session revision, credits only unused materials and rejects overflow without explicit engine loss consent.

Each full workday spends four food/two timber. Canonical command, needs and physical-water boundaries reconcile interruptions; paused jobs hold supplies and release delegates, then restart a whole unfinished day. Constitutional delegates are counted separately in labor capacity/release and private City projection. Their stationary jobs do not block ordinary physical commons repair. Public chunk jobs use the existing safe silhouette field whitelist, omitting session, candidate, ballot and supplies. Fresh City projection computes conditional offers without mutation or foreign/delegated access to the constitutional ledger.

Ratification records a reproducible majority ballot from actual civilian constituencies and reserve evidence, an eligible existing successor and a policy baseline. Steward charters retain ordinary edits plus prior seven-day assembly binding. Council charters guard existing SET_VILLAGE_POLICY, SET_PUBLIC_BUDGET and NOMINATE_SUCCESSOR paths: lasting reserve/recruitment-floor/timber authority uses the latest actual paid assembly or the ratified baseline; a successor needs a ratified appointment. New paid conventions amend the arrangement. Family death/handover, child maturation and real council recovery cannot silently appoint a council successor. Handover consumes the nomination, not titles, court obligations, estates or funded work.

Whole restore validates explicit book/version, ordered unique records, per-community chronology, original issuer and candidate eligibility, adopted knowledge dates, one funded local session, exact cost/reserved/spent/refunded/discarded equations, full-day job clocks, closed history and reproducible ballots. Under current council authority, each policy must equal its latest lawful assembly/baseline and the successor must equal the latest live unused ratified appointment. Existing office law/chapter receipts remain compatible; absent-schema saves and historical fixture bytes are preserved. The local charters govern founding communities; the separate bilateral federation book above now adds common policy safeguards. Broader electoral, monarchy/republic/federation government and realm authority remain planned.

Courts: consensual civil hearings and coin custody. courts.js owns the optional v1 book/marker, case revisions, original party/character consents, immutable returned-lease facts, unworked-rent-v1 rule, exact materials, escrow and local court-hearing jobs. Contract law is the research prerequisite; registry-supported adoption creates only an empty book. Learning alone leaves the book absent. coin-market.js initializes and validates monetary custody before its existing 1,200-coin global conservation check, including courts.funds. No treasury, personal estate or communal money is minted.

REQUEST_COURT_REVIEW requires the current founding tenant, fresh world review, a paid completed lease/full physical receipt, whole claim and active host court; it spends no goods or coins. ACCEPT_COURT_CASE requires the current host, fresh world/case revisions and actual legal service, reserves, operating ceilings, two free witnesses, six food/two timber and claim coins. Gross escrow counts once in operating commitments. The marked job consumes half the fee per complete day and resumes only a new whole unfinished day after interruption. The recorded remedy floors proportional unworked gross rent and caps it by claim; judgment immediately credits only held coins to the parties once, leaving the original lease untouched.

WITHDRAW_COURT_CASE closes an unpaid request or records current party consent. A funded job persists until both request withdrawal; only then normal storage/host-authorized loss checks credit unspent materials and return escrow. Service/commons damage or flood, registry loss and labor changes release witnesses. Generic crew controls cannot cancel hearings, and stationary civic/court jobs do not block actual commons repair. Every canonical tracked/native surface-water boundary reconciles these local programs. Requests use ordered three-day expiry; hearing work continues under existing council stewardship, with old consents retained through lawful handover.

Whole restore checks book version/coverage, unique lease submissions, actual parties, known/adopted court dates, recorded lease facts, consent dates, exact material equations and coin distribution, job/whole-day clocks and deterministic judgments. Quarry archive pruning retains facts referenced by cases. Older states remain unchanged before paid adoption; a missing book beside a marked program/job rejects. Private City views disclose shared cases only to their actual parties; foreign/delegated production views omit case custody. Public local-job projections omit case/assembly identifiers, coins and evidence. City labor separates court witnesses from delegates and producers; drafts are keyed by world/community/lease and captured on input. See player guide and primary design.

Civic representation and assemblies. civic-assemblies.js owns a version-one root book/marker, marked local jobs, actual material custody, three-constituency ballots and finite policy bindings. The politics topic needs the registry and known Record keeping/Public accounting. Paid ADOPT_TECHNIQUE explicitly promotes absent schema zero to an empty v1 book. It grants no policy, people or materials. Earlier snapshots without the program/book/jobs restore unchanged; a civic program or job without its book fails closed.

FUND_CIVIC_ASSEMBLY requires the current lawful founding owner, mandatory fresh world review, active services, three represented existing constituencies, three idle workers and six food/two timber above existing reserve/budget guards. It costs one attention. Each complete workday consumes half the reserved bill. Service, registry, commons flood/damage, capacity or reviewed-policy changes pause the job and release delegates. Restored ordinary specialist service resumes a full unfinished day. Waiting checks and progress emit canonical events without repeat payment. Free CANCEL_CIVIC_ASSEMBLY needs the exact record revision and refunds only unspent stock through normal storage/explicit-loss checks.

The final ballot records its real workforce/population/stock basis, three delegate votes/reasons and majority. Ratification applies the existing reserve, recruitment floor or daily timber budget and binds it for seven local days. Policy/budget setters reject conflicting edits until expiry or a later paid ratification. Binding survives service loss and succession; new orders retain character authority checks. Records, material equations, job/clock correspondence, ballot calculation and active-policy agreement validate on whole restore. Private City requests accept a policy/value draft for a read-only quote; public chunks and delegated producer views expose no ballot or custody book. City workforce accounting separates delegates from producer staff and releases them on interruption/completion. Input drafts are captured before asynchronous rendering; quote refresh is deferred past any render-triggered blur to prevent a nested DOM replacement. Starter succession law and world/simulation version three are unchanged. See primary design and player guide.

Physical public job positions and ordered caching. public/world-job-position.js supplies the same marked-job position and civil-crew labels to ZoneEngine and the map. Mobile jobs use their current validated route index; stationary local training/building jobs retain their work cell. changedChunkSnapshots compares lightweight before/after movement state during commands/advancement and adds old/current locations to derived replies without changing canonical events, receipts or saved chunk revisions. The existing public job whitelist is retained, including protection of cargo, meals, authorization and signers.

Gateway welcome/subscription/update handling includes current chunks for an owner's own mobile jobs outside manifested parcels. Foreign accounts gain no such permission. Previously observed owner transit chunks receive departure/removal updates even after subscriptions change. This grants no title, new mutable region or gameplay authority. Browser caching rejects older chunk world revisions and uses object identity with per-job world-revision tombstones: a leaving chunk cannot erase a newer position or revive a completed team. Later reservoir stages share working labels, and City Show recovery crew uses the public current cell.

After each tracked mobile-job step, ZoneEngine compares position, phase, revision, status and due/meal clocks. If they changed and the step emitted no domain event, WorldJobPositionChanged checkpoints the old/current cells. The gateway's existing event-based persistence and broadcast then retain real progress. Due/meal changes are included so a safe wait or return reserve cannot silently reset on reload. Existing domain events take precedence; derived chunk projection itself still performs no mutation. Canonical checkpoint events advance ordinary world/chunk revisions and preserve stale-review enforcement.

No save migration is introduced: world/simulation stay three and major-waterworks 43. The old controlled fixture restores exactly, including original trial custody and review metadata. A separate checkpointed fixture replays current paid commands with current world revisions; the historical command script is preserved rather than rebased. The pre-waterworks land-test input now omits all later major books/markers; mixed hidden custody still fails restore. The original-goal audit distinguishes missing later applications from static catalog reachability. See primary design, implementation status and guide.

Additive abandoned-residue recovery (major-waterworks 43). major-offchannel-residue-recovery.js owns an exact marked {version,attempts,recoveries,history} ledger and dedicated movement jobs. FUND_MAJOR_OFFCHANNEL_RESIDUE_RECOVERY validates current source authority, unchanged failed/reconnected trial, fully archived original crew, installed floor basis, title/holder, registry services, available labor, exact costs/capacity and operating budgets. Payment is booked once and costs one attention. RECALL_MAJOR_OFFCHANNEL_RESIDUE_RECOVERY checks the exact active job revision and is free. Review fingerprints exclude changing wall-clock term endpoints; the term starts on commit, while physical/cost/progress and ordinary world revisions provide freshness.

Canonical job/needs dispatch advances actual route steps and paid meals. Funding and recall each freeze one transaction timestamp, so the review term, job/meal clocks, event and return boundary agree even with a continuously moving server clock. Safe work requires a whole day; hazards reset the current clock while meals continue. The first paid receipt contains all retained sediment; the second spends a tool and confirms clearance. Strict restore validation binds original trial/floor identity, coordinates, cargo/meal conservation, arrival/work/return chronology, progress across attempts, actual crew archives and nonoverlap with every major crew. Capacity-limited unloading uses normal resource credit and retains labor until finished. Current engineering/holder/title/geometry, the separate 28-day term, finite wait and return reserve gate continuing work.

Original trial records and all native transfers stay immutable. summary derives effective raw sediment/contained spoil from receipts without inventory credit or changed water/mass; blocksRetesting stays true until both paid days, including after day one has contained the mass. No hydraulic capability or pressure/containment/supply certificate is created. Source City projections expose costs/progress/cargo/reasons; public map jobs expose only the movement whitelist, without private authorization/materials/meals/trial identity.

Explicit 42→43 updates two parent markers and adds only an empty recovery book/marker. Hidden unversioned jobs/books, missing/unsupported custody, forged cargo/clocks/fees/receipts/mass and orphan history reject on restore. Old pressure/regional fixture bytes remain unchanged and assert exact neutral migration. The supported fixture records declared initial soil and home/source timber adjustments (80/40) before new commands, actual runoff capture of 21 mass and controlled unsafe original cleanup access. It retains the original forced crew's one-third unmet meal; recovery adds none. This is finite custody evidence, not earned economic supply. See primary design, off-channel specification, player guide and implementation status.

Earned ten-community reserve-cycle acceptance (verified; runtime unchanged). test/helpers/earned-regional-reserve-cycle.js clones the manifest-pinned clay-satellite closing, executes ordinary revision-bound staffing, recipes, paid harvests, physical supply and repairs, and advances its saved 100 ms generic work timing through exactly 120 village days. The entire interval is measured, including all opening/closing adjustments; all jobs are returned/unloaded at the boundary. No inventory, population, knowledge, title, currency or elapsed-time injection is used. World/simulation stay three, major-waterworks 42 and all pressure books remain exact.

The independent .qa-city/earned-reserve-cycle-independent-audit-attempt1.json replays 3,231 events/403 exact accepted results without the scheduler, separately recaptures warehouse/production/daily entries, matches every resource closure in ten warehouses and verifies three distinct whole-save restores. It independently checks 120 assessments at each community's original daily phase, all 1,200 food/health/labor/storage/water outcomes, uninterrupted capital and every opening-active service. Eight separately observed repairs pay eight timber/four bricks/one tool each. Primary precision mill stays staffed three; closing fields restore three/six and population remains 142. The source's final two-worker mill restaff is a command at the same timestamp after the measured boundary, with no elapsed stock or food benefit.

Actual deposit credits/finite seam loss give 96 fresh clay versus 56 kiln inputs and 56 fresh ore versus sixteen smithy inputs. Six sixteen-clay journeys per link deliver 96 home; three fourteen-ore journeys per link deliver 42. Warehouse capacity causes one clay and three ore sponsor jobs to unload incrementally. Validation sums unique gross receipt sequences for each journey, with later physical timestamps and exactly its requested cargo; it does not require a single receipt. Paid return/unloading continues until all retained cargo is released. This supersedes the first new test's invalid one-receipt assumption, not a simulation rule.

Independent home deltas: food +63½, logs +35, timber +56, clay +40, bricks +10, ore +26, iron +4, charcoal +8, tools +4. Network deltas: food +574½, logs +120, timber +77, clay +40, bricks +10, ore +40, iron +4, charcoal +8, tools +4. Thus fullBoundedReserveGatePassed:true applies to this interval. Home food balance is still −2½, and seams retain only 24 clay/28 ore; neither a locally self-sufficient home nor indefinite mineral renewal is claimed.

earned-regional-reserve-cycle.test.js verifies the paid integrated cycle, individual phases, services, all warehouse/material balances, partial receipts, finite geology and a separate full event replay. earned-regional-reserve-cycle-returned-fixture.test.js pins the closing and unresolved finite-resource boundary. Thirty-six distinct tests pass across seven selected files, including forestry, recipes, settlement recognition, fractional turnover and the preceding returned fixture. Compressed new returned SHA 86db26d4f13b79078bffd52e2eb81ff2112fb59f702ff91b11a86f96bbfb9c8e; raw {snapshot} SHA add5eb9388a76c654ab44c8fa598709795eafc33d04a596822445079980b6240. Scheduling is acceptance tooling; no new player automation is introduced. See implementation status for preserved failed candidates, exact checkpoints and remaining mineral/realm/major-water gates.

Preserved preceding registered village well and clay-satellite acceptance (implemented and verified). zone-engine.constructionRequirements now permits secondary-well at an outpost only when its retained local charter points to an operational village-center, condition at least 65 with no job. Existing local plot survey, natural suitability (moisture ≥0.55, elevation ≤0.65, unmarked field/woodland), clearance, adjacency, footprint, materials and work checks remain. land.initialize permits persisted outpost wells only with retained local village custody and still validates their survey/source/adjacency. Construction's base forty-timber/eighteen-brick/twelve-food/two-tool bill is separate from actual logistics support. Existing land.sourceCapacity keeps the central source limit and adds twelve only per completed sound dry staffed secondary well with active Irrigation and a usable commons connection. This changes no ledger/schema, command or frontend flow; world/simulation remain three and major-waterworks 42. A retained reoccupied camp cannot start another well until actual village commons restoration; existing legal assets are not deleted merely because the commons is damaged.

test/helpers/earned-regional-clay-satellite.js clones the unchanged manifest-pinned earned ore closing and uses ordinary revision-bound commands/actual advances. It pays housing, local development, seven local researches, mill, well and registry; physically moves three existing households and establishes the sponsor's sole mineral satellite through returned survey/conditional charter. Sponsor administration/water occupies five actual workers before six founders leave. No stock, people, knowledge, rights or time are injected. All prior links and the root six direct titles remain exact. Real resident aging removes one ruler, with ordinary embodiment/handover restoring human rule. Ten communities close with 142 residents and every crew home; the primary precision mill remains staffed three. Optional sanitation and excess pumps pause only when actual population fits remaining capacity. Care/capital services and food fields three/six are current closing facts.

Independent audit .qa-city/earned-clay-satellite-independent-audit-attempt1.json replays 12,803 events and checks all 1,500 accepted command results without the scheduler. It separately recaptures warehouse/production/daily histories, verifies ten warehouse closures, 4,246 individual daily phases, eleven exact full checkpoint restores and nine paid repairs. New clay seam loss/ten twelve-unit credits prove 120 extraction; five sixteen-unit receipts on each distinct link prove eighty new home incoming against seventy-two kiln inputs. Existing earned ore proves seventy extraction/42 home incoming/32 smithy inputs. The old clay seam's final 36 depletes to zero; retained exhausted and Greywood ground, depot, grants, communal coins and all pressure books are unchanged.

The independent 120-day home reserve window is 1890604800000→1892332800000. Deltas are food −27½, logs −22, timber +160, clay −40, bricks −2, ore +6, charcoal −3 and tools zero. Both whole-continuation replacement flags pass, while fullReserveGatePassed:false remains required for that preceding interval; the newer complete 120-day sample above passes its separately measured reserve gate. Closing home food balance −2½ is a freight dependency. Do not equate preparation receipts with steady-state production.

local-village-wells.test.js covers paid source eligibility, no premature/passive delivery, staffing/Irrigation/damage and custody restore; its construction supplies are a controlled rules fixture. earned-regional-clay-satellite.test.js covers the command-earned economy and a separate whole-event replay. earned-regional-clay-satellite-returned-fixture.test.js pins the ten-community returned save, paused water, lawful succession, finite geology and open reserve gap. 38 distinct cases pass across ten selected files; the older four-load integration run is superseded by the current five-load rerun and counted once. Compressed returned fixture SHA 4ba80c1a03d405c5774043f26ab47e68c3be5b260b045c9b95bb9aa5f040a782, raw {snapshot} SHA b513a78ee71457fba5c779a69df480b36880917ceaa0d3d4df79dd89d3d7f0a4. Scheduling remains acceptance tooling, not new player automation. See implementation status for exact sources, logs, preserved failures and remaining reserve/realm/major-water gates.

Preserved preceding earned ore renewal (verified acceptance tooling; runtime unchanged at that stage). test/helpers/earned-regional-ore-renewal.js continues the immutable accepted clay closing through ordinary revision-bound commands and actual advances for 521 village days plus four seconds at saved 100 ms generic work timing. earned-regional-clay-returned-fixture.js checks its manifest-pinned schema-42 input and exact restore. World/simulation remain three; no new migration or runtime/UI command is introduced. All pressure books remain byte-equivalent to the empty input books.

Local sponsor preparation pays six separate researches, a lumbermill, well headworks, housing and registry before real survey/charter/founding. Temporary service suspension conserves actual timber while stockpiling; current services are restored before authority is exercised. One physical household relocation changes root/sponsor population, then eight existing sponsor residents/six workers depart. Nine chartered communities retain 143 residents, the root's six direct titles remain intact, and the satellite certificate binds outpost-12 to sponsor outpost-3 and root village-7. Camp/field use seventy founding timber; five later local supply loads pay ninety mine timber. Temporary home field-worker borrowing is tracked and restored, with the primary precision mill always staffed three.

Extraction is measured from eight actual seven-ore warehouse credits and exact finite seam loss 210→154. Four fourteen-ore trips on each of two direct links yield 56 home incoming ore exactly once at physical unloading. Home smithy inputs consume 32; twelve retained startup ore and 24 finite iron paid with 48 timber are reported separately. The same journal has 108 new clay, 96 home clay receipts and 176 kiln clay inputs, leaving the home at zero clay and the pit at twelve stored/36 in ground. Bounded ore replacement passes; clay replacement and the combined reserve gate fail for this longer sample. Home's −16½ current daily food balance is an actual freight dependency.

The helper observes each founding.advanceNeeds single-community assessment and restores the hook in finally. The independent audit replays 16,058 events/1,170 command results without the scheduling helper, separately recaptures and compares all warehouse/production/daily histories, checks all nine warehouse closures and independently reproduces daily minima. It verifies 4,302 assessments at each settlement's saved phase, nine full milestone restores, 28 paid eight-timber/four-brick/one-tool repairs, all crew returns and restored root services/capital recognition. Full milestones have event indices; repair observations are separate. All old links, depleted/Greywood deposits, grants and communal coin balances stay exact; finite market inventory changes only through paid barter.

test/earned-regional-ore-renewal.test.js covers the integrated journey and fresh-engine replay. earned-regional-ore-returned-fixture.test.js pins the exact returned snapshot, satellite custody, restored capital, finite depot loss and remaining clay gap. That preceding stage's two selections passed 48 distinct cases across eight files, including satellite, deposit, headworks and knowledge regressions; this is not the full suite. The compressed returned fixture has SHA 348ef9a38f5113a84ba57c44531024659bd52056c396e06ec15e00d53d730575 and raw {snapshot} SHA 320098a0915fef56c18d698d9dae14efb31e17e53b498efd09c67894aa43cc4b. Acceptance automation exists only in test tooling. See implementation status for current checkpoint/audit hashes, preserved experiments and remaining combined reserve/realm/water gates.

Preserved prior earned regional clay renewal (verified acceptance tooling; runtime unchanged). test/helpers/earned-regional-mineral-renewal.js continues the original regional schema-39 save through revision-bound ordinary commands and actual advances, retaining its 100 ms generic work timing. test/helpers/earned-regional-clay-renewal-fixture.js pins compressed/raw hashes and explicitly asserts neutral 39→40 pressure rights, 40→41 attendance and 41→42 trial additions. World/simulation stay three; every non-migration field remains exact. The source-preparation fixture helper now checks the same final empty trial book, preserving its original bytes and historical result.

The ordinary journey earns capital recognition, pays two fourth-ring registry offices, returns the mineral survey, obtains the conditional charter and physically founds the sixth direct child with eight existing residents/six workers. Network population remains 143. Camp/field construction consumes the seventy-timber founder kit; later delivery pays the separate fifty-timber pit. Extraction is derived from actual warehouse credits and matching finite deposit loss, not workshop history: eight twelve-unit credits reduce seam 1450857 from 240 to 144. Six sixteen-unit collection jobs produce exactly 96 home incoming clay, once per physical return. Home kiln inputs consume 56. Twenty ore inputs are separately retained mined stock and zero new extraction; only bounded clay replacement passes.

The single-day founding.advanceNeeds observer records 1,422 actual assessments and restores its hook in finally. Coverage follows each community's own saved nextDayAt, including different opening day phases and the new camp's later creation. All eight retain health 100, no hardship/food shortfall and valid storage/water/labor. Eleven ordinary repairs pay their complete eight-timber/four-brick/one-tool bills with four workers. Current staffing deliberately suspends optional source Regional institutions and post-departure home Land registry/extra clerks; required remaining services stay supplied. Home food balance closes at −20½ daily, so imported food is a dependency, not a self-sufficiency claim.

test/earned-regional-clay-renewal.test.js verifies the immutable opening, paid construction/people, finite extraction, six actual incoming receipts, eleven repairs, daily accounting, unchanged exhausted/Greywood geology/depot/grants/coins and independent fresh-engine replay of all 4,073 journal events. Five milestone checkpoints contain event indices and whole snapshots; eleven repair observations are separate and are not falsely counted as restorable saves. test/earned-regional-clay-returned-fixture.test.js checks the manifest-pinned whole returned save and empty pressure books. Independent audit .qa-city/earned-clay-independent-audit-attempt2.json verifies exact replay/restoration and material/warehouse balances. That prior selection passed 26 distinct cases across eight files, including the separate earned pressure-result fixture; neither branch supplies the other. The later ore journey above supersedes its open ore gate for a separate bounded sample. Combined reserves, realm progression, permanent containment and useful water remain open. See implementation status for current hashes and preserved failures; older source-preparation notes below describe the preceding bounded gate.

Finite live pressure custody (implemented; world/simulation 3, major-waterworks 42). major-offchannel-pressure-trial.js owns version-one durable records and privately restored WeakMap/WeakSet interval capabilities. The explicit 41→42 migration adds only majorOffchannelPressureTrialVersion:1, an empty records book and the two parent markers. Earlier permission and attendance steps remain explicit. Missing, hidden, unsupported and orphan books/jobs reject. The immutable attendance specification still certifies attendance only; a separate trial record is required for hydraulic work.

START_MAJOR_OFFCHANNEL_PRESSURE_TRIAL requires exact proposal, crew, target and world revisions, source authority and a pure next-opening review fingerprint, and charges one attention. It arms a finite sequence without material payment or immediate flow. Activation checks the exact canonical dry clean opening and installs the paid floor's addressed curve exclusion. The durable phases are armed, testing, cleanup, complete, failed and cancelled; the attached attendance job uses trial/cleanup before physical homeward/unloading. Generic forecast surface directives and external basin callbacks remain unusable on a live engine. Actual external outlet receipts have kind paid-off-channel-pressure-inflow-v1 and hypothetical:false; their enclosed shared kernel arithmetic remains a model calculation, never independent authorization.

major-offchannel-pressure-flow.js shares forecast source/kernel, head-limited outlet and clear-water drawdown arithmetic. Every interval records actual source capture, direct rain, spill/drawdown, zero-sediment outlet credits, global opening/closing totals, model closure, protocol and hydrology fingerprints, and a paired natural comparison. New holders and adverse soil, structure, inventory, wetland or fish differences stop before flow. Native surface rain/outflow/incoming, natural-basin incoming/route samples and sediment carrying capacity reconcile only exact permanent trial transfers. No native ledger obtains a blanket exemption. Interrupted live execution restores the whole state and pending events, then reconnects and runs the ordinary interval.

STOP_MAJOR_OFFCHANNEL_PRESSURE_TRIAL checks actual source authority and the current trial revision; it is free. Before activation it cancels and returns the crew. After activation it conserves an exact compartment debit/natural-basin credit, restores the natural curve and starts cleanup. Successful drawdown also reconnects immediately. Cleanup is two whole safe workdays after reconnection, spending one carried tool each; hazard holds reset cleanupWorkStartedAt. The first day moves deposited sediment into contained spoil without inventory credit. Every elapsed day still consumes paid provisions. Exhausted supplies retain residue, return the crew and earn no result; paid abandoned-residue recovery is implemented in the separate stage above.

Whole-save restoration recomputes stored opening forecasts and every kernel/drawdown/protocol transition, checks exact actual transfer identities and chronology, global closure arithmetic, immutable permission/crew/geometry association, unique custody, cleanup clock/tool/sediment conservation, native reconnection and the entire certificate body. The result is paid-game-pressure-trial-result-v1; pressureTested:true requires the complete actual finite sequence, while containment/useful-supply/live-flow authorization remain false. It is a bounded game result, not engineering calibration or completion of M0–M8.

Scoped acceptance: 137 distinct tests across eighteen selected files, exact whole command/advance replay and phase restoration, pinned earned closing, independent native/custody audit, and served City start/stop, held-water stop and result scenarios. All three served scenarios pass persistence, reload and four viewport widths, with their servers stopped. These are bounded-stage checks; the full repository suite and complete M0–M8 goal are not claimed.

The following attendance notes describe the preserved 40→41 layer. Its tools may now be invested only by an attached validated pressure trial; the separate trial layer above supersedes the older statement that no hydraulic start or certificate exists.

Paid pressure attendance (implemented; world/simulation 3, major-waterworks 41). major-offchannel-pressure-crew.js owns a separate version-one attempts/history book and majorOffchannelPressureCrewVersion:1 jobs. Explicit 40→41 migration adds only that empty book and the two parent markers; 39→40 still separately adds permission custody. Missing, hidden, unsupported and orphan books/jobs reject. Neither migration grants workers, goods, water or certificates.

FUND_MAJOR_OFFCHANNEL_PRESSURE_CREW requires the exact current source proposal/world revision and actual source authority, immutable paid permission and installed predecessor chain, active Hydraulic engineering, safe physical route, four free home residents, inventory and regional ceilings. It charges one attention, books major-offchannel-pressure-crew, withdraws two tools plus finite quoted food and creates the real traveling job at revision zero. The 35-step route needs 96 meals (98 carried units within capacity 120): round up four times the whole outward/return travel, seven ready days, eight future trial intervals, two future cleanup days and one unload day. The whole allowance must fit the original permission expiry. These future allowances authorize no hydraulic phase.

Only the exact recognized owned crew may be exempted from permission currency's all-crews-returned check during its own journey. Other crews remain blockers; unrelated major crews sharing home/source are mutually exclusive. Scheduler dispatch, due-work guards, daily carried meals, labor protection, occupied cells, household adoption, private regional alerts and public map redaction recognize attendance. Home daily consumption uses the shared paid travel-food ledger; current economy projection reports four away workers. Public chunks retain only ID/type/actor/cell/version/route/index/phase/status, omitting permission, stock, meals and payment. City owner projection supplies the quote and actual custody/recall state.

Phases are outward, ready, homeward and unloading. Real route steps use the home day/12 clock; ready arrival binds actual time/index and seven-day expiry. Permission/consent/title/holder/reach or engineering loss, unsafe access, timeout and return-meal reserve cause return. Physical blocked travel and gallery departure keep consuming meals. RECALL_MAJOR_OFFCHANNEL_PRESSURE_CREW needs the exact current job revision; it is free, walks unused supplies home, and credits only actual unloading room. A held unload keeps the job/labor. Validation checks exact job shape, frozen permission/specification/route coordinates, chronology and minimum walking time, arrival/readiness, departure index/time, return steps, finite tool and meal conservation, attempt counts, unique custody and no unrelated major crew overlap. Revision-zero funded saves and both arrived/returned saves restore exactly.

readyReview requires actual current attendees and computes a fresh pure pressure forecast; it verifies caller state remains unchanged. The carried tools are never invested in this attendance layer. All physicalTrialImplemented/pressureTested/containmentComplete/liveFlowAuthorized flags remain false. The attendance-only layer creates no surface interval capability, off-channel worksite, curve exclusion, hydraulic start command, cleanup or pressure certificate; those now belong to the separate trial layer above. The manifest-pinned offchannel-pressure-crew-arrived fixture and ordinary verification journal preserve actual paid arrival; the independently recalled later closing proves physical return and unloading. The full M0–M8 goal remains active.

The following schema-40 permission notes describe the preserved previous layer.

Pressure permission custody (implemented; major-waterworks/land schema 40). major-offchannel-pressure-rights.js owns the separately versioned permission book: finite notices, immutable installed-floor/inspection/control hashes, an eight-interval read-only pressure comparison, exact named holders, bounded grant/withdraw histories and one paid licence per notice. The explicit 39→40 migration adds only empty version-one pressure rights plus the two parent markers. World/simulation versions remain three. Marked-but-missing, unversioned, unsupported or orphan physical pressure custody rejects; no migration grants consent, labour, goods, water or a certificate.

Commands are FILE_MAJOR_OFFCHANNEL_PRESSURE_NOTICE, GRANT_MAJOR_OFFCHANNEL_PRESSURE_CONSENT, WITHDRAW_MAJOR_OFFCHANNEL_PRESSURE_CONSENT and ISSUE_MAJOR_OFFCHANNEL_PRESSURE_LICENCE. Fresh confirmations require current target/world revisions and the exact review fingerprint. Filing and payment each charge one attention; failed orders roll back and duplicate command IDs replay their original receipt. Payment checks actual home inventory, knowledge spending and regional ceilings, then books the major-offchannel-pressure-permission expense category. Consent creates no material payment; withdrawal preserves all prior expense and physical receipts.

The notice stores both the combined forecast dependency digest and the separate current player-changeable dependency digest. These are distinct: the forecast digest also includes compared basin curves. Currency checks the actual source title/holder, all named affected holders, exact installed predecessors, supported route, revision, static reach definitions and twenty-eight-day expiry. Every named party, including the source, must explicitly grant before payment. Each party may make at most eight alternating grant/withdraw changes. The loader checks predecessor hashes, source-party identity, model chronology and timestamps, recomputes every stored kernel/drawdown receipt and summary, and validates the paid consent prefix. Hashes and arithmetic are integrity checks, not a cryptographic external audit.

Private City projections expose source quotes, current paid status and the affected community’s own consent controls; incoming summaries omit the full review and physical basis. The permission layer alone creates no crew or hydrology capability; the separate attendance layer above creates a redacted walking crew only. Permission explicitly keeps pressureTested, containmentComplete, storageAuthorized, captureAuthorized, releaseAuthorized and liveFlowAuthorized false. Actual attendance is implemented above; the future live trial, guarded compartment/exclusion integration, cleanup, natural reconnection and useful supply are unimplemented. The ordinary five-command journal and manifest-pinned offchannel-pressure-permission-with-loss-summary-paid fixture preserve the predecessor woodland closing separately.

The following schema-39 and earlier notes describe preserved predecessor stages.

Fractional warehouse turnover restoration (implemented; world/simulation 3, major-waterworks 39, warehouse book one unchanged). warehouse-history.js keeps strict checkpoint/retained-receipt/current-stock reconciliation. Its separate lifetime-total comparison now accepts ordinary relative tolerance or a finite forward-error bound: with n = count + 2, gamma = n Number.EPSILON / (1 - n Number.EPSILON); each resource's scale is abs(opening) + abs(incoming) + abs(outgoing). Nonfinite results/scales or n * epsilon >= 1 reject. This bounds cancellation from actual fractional additions against large historical turnover instead of shrinking the allowance with remaining stock. It rewrites no inventory, totals, receipt, marker or schema. Validation remains numerical, not cryptographic.

warehouse-fractional-turnover.test.js preserves the real historical tools prefix above seventeen million, then records controlled setter withdrawals to zero and restores exactly. This controlled regression is not an earned economy. Changed current stock, a material 0.01 gross change, a changed retained receipt and overflow totals reject. Existing warehouse migration, command rollback, refunds, cargo, fractional production, retention, offline and projection tests still pass.

Ordinary woodland continuation (verified using existing runtime controls). Manifest-pinned offchannel-pressure-home-woodland.json.gz preserves the exact supply-ready predecessor plus twenty revision-bound ordinary commands and 465 advances. Its two new forest titles are separately surveyed/returned and each pays eight timber, one tool and four food; surveys have their own paid supplies. An actual one-resident/one-worker migration spends eight finite-waystation rations over 44 steps/four days. Returning the next-party policy to households after dispatch leaves that journey unchanged and prevents another larger party; migration closes on arrival. The registry stays staffed for Regional institutions. No population, stock, technology, title, age or work deadline is assigned into the save.

major-offchannel-home-woodland.test.js replays all 485 events, checks both communities at every event and all 32 daily samples, restores the whole closing, and verifies unchanged major-waterworks books and absent curve exclusions. Retained production/movement receipts prove five completed local harvests supply 105 logs, 32 three-worker basic mill batches consume 96 logs and produce 72 timber, and civic withdrawals total 64 timber. The sample begins with one authorized harvest still finishing, so its completed harvest count is five while new automatic order count rises only from nine to thirteen. Closing log/timber reserves gain nine/eight. Migration uses real source people and travel food; source engineering still consumes finite inherited tools.

Verification passes 87 distinct tests across ten selected files, with the nine warehouse cases rerun after the overflow guard. The independent audit restores the current-runtime save and checks retained/gross balances, production, finite migration and a fresh read-only conserved pressure forecast. No new City command, migration, live pressure book or containment authority is added. Thirty-two days are bounded evidence; the construction fixture retains inherited stock, while the separate earned regional branch still needs mineral replacement. See implementation status.

The following 105-test pressure-model and supply-only notes describe the preserved earlier verification stage.

Pressure-model verification: 105 distinct tests pass across fourteen selected files: eleven new sequencing/sealing cases, one real ordinary supply/replay case, preserved v1/v2 kernel/transition and paired forecasts, full paid floor lowering with sixteen lined-open water intervals, and surface/basin water, routing, sediment, exposure, topsoil and wetland regressions. The independent audit also recomputes every modeled component balance and replays/restores the entire supplied closing save. This is scoped verification, not the full repository suite or completion of M0–M8. No new City control or live pressure authority was added. The primary design and both wiki audiences are synchronized; generated wiki build/check and whitespace validation pass.

Ordinary pressure-stage supply continuation (verified; no new runtime authority). Manifest-pinned offchannel-pressure-supply-ready.json.gz starts at the exact plugged-controls fixture and preserves all twelve revision-bound commands plus 74 clock/advance events. Only ordinary technique suspension/adoption, structure staffing and DISPATCH_OUTPOST_SUPPLY occur. The already learned Scouting program and one staffed forester lodge produce the paid 37-step dry detour; seventeen meals and a 21-timber collection fit 59/60 return weight. Suspension avoids unpayable home civic upkeep during travel, and the three services resume afterward. Source field staffing rises from one to three actual workers; no workers, stock, practice or rights are assigned into the save.

major-offchannel-pressure-supply.test.js independently replays all 86 events, restores the whole closing save, checks conserved combined timber, unchanged populations/labor and every major-waterworks book, completed return/unload and active restored services, then runs the conserved pressure comparison at the new weather boundary without modifying the caller. The inherited construction stock remains controlled input; this fixture proves neither earned recurring replacements nor live pressure or containment. See implementation status for hashes and the separate regional branch.

Installed raised-ground sealing and finite pressure forecast (implemented as read-only modeling; schema remains 39). major-offchannel-transition.js adds hypothetical installed-raised sealing v3 with the exact paid ground binding and current natural bed; legacy v1/v2 receipts remain unchanged. major-offchannel-design.js excludes one actual raised bed at 455074, retains original design provenance at 450074, and emits a retain-existing-paid-foundation instruction. A separate WeakSet in major-offchannel-lined-open.js suppresses lined-open routing only on forecast facades bound to the current selected design, reproducible transition receipt, paid ground and exact curve exclusion. Installed soil protection remains active. Facade cloning propagates this comparison capability; live engines reject it.

major-offchannel-forecast.js accepts the internal option protocol:'pressure-proof-v1' only after paid inspected floor, completed plugged controls and a connected closed outlet exist. major-offchannel-pressure-protocol.js validates charging → holding → discharging → drawdown → drained chronology. Full-head opening/closing must follow the charged interval; a real positive modeled discharge precedes drawdown. major-offchannel-pressure-drawdown.js keeps the outlet's 1,000-unit rating and creates a distinct hypothetical clear-water drain receipt, rated 50,000 and bounded by fractional gravity head. The surface directive routes that return once through the footprint to the natural basin, separately from spill and upslope attribution, and enforces their shared drain capacity. The actual same-interval receiving head is checked again. Sediment is retained; no sediment, stocks or material disappear.

The forecast stops on its first drained boundary, reports the actual closing tick within the requested horizon, and leaves reconnectionRequired:true, pressureTested:false, containmentComplete:false, liveFlowAuthorized:false and eligible:false. The intact lining's 250-unit evaporation/zero infiltration assumption is explicitly uncalibrated; boundary hold is not a continuous pressure certificate. No live command, durable pressure book or migration is added. Manifest-pinned offchannel-plugged-controls-complete.json.gz preserves the exact accepted working-controls save; major-offchannel-pressure.test.js checks restoration, current-bed exclusion, receipt/curve capability binding, false holds, chronology, fractional backwater, retained sediment, shared drain rating, incomplete horizons and the conserved real-network comparison. Existing v1/v2 kernel/transition and paired forecasts remain covered. Live trial rights, custody, failure behavior, reconnection and useful service are still planned.

Paid plugged working-control custody (implemented; introduced in major-waterworks/land schema 39). major-offchannel-working-controls.js owns version-one licences, installed task assets, immutable paid receipts and pinned physical crew histories. Explicit schema 38→39 migration adds only empty majorOffchannelWorkingControls, its version-one marker and the two schema-39 markers. Hidden unversioned books/jobs and partial current markers reject. No previous inspection, floor, fittings, walls, title, water or population record is rewritten. Earned regional fixtures now assert the exact neutral addition rather than silently accepting a changed checkpoint.

ISSUE_MAJOR_OFFCHANNEL_WORKING_CONTROLS_LICENCE freezes the current raised design, exact installed-floor and actual dry inspection hashes, source charter, home route and source/release/safety stage. FUND_MAJOR_OFFCHANNEL_WORKING_CONTROLS pays actual home materials and finite round-trip meals, reserves four existing residents and creates a physical walking/work/return/unload job. Both commands cost one attention and book distinct existing regional operating-budget categories. RECALL_MAJOR_OFFCHANNEL_WORKING_CONTROLS requires current job/source/world revisions, is free, preserves completed parts and returns the entire unfinished material batch with remaining meals. The saved recall marker is explicit; shared expedition withdrawal does not set it.

The fixed raised-v2 specification reuses installed collars and dry closed hardware. Six tasks cost {timber:8,bricks:8,dressedStone:4,iron:4,tools:6} over ten complete workdays. Three licences cost {timber:12,tools:3,food:12}. On the exact 35-step route each two-day task pays 32 meals, each one-day task 28. Receipts bind task order, exact material conservation, full workday timing, predecessor hashes, current source engineering/title and receiving head below the raised gallery's safe wall threshold. Constructor validation rejects missing paid histories, overlapping source/home major crews, forged materials/meals/workdays, return positions and altered plug/pressure flags. Labor, away-household food, occupied cells, household adoption, regional warnings, private City controls and public job/chunk filters include the new crew family. Public data omits private payment, licence, meal and receipt internals.

The 45-day journey retains the installed lined-open mode, native receiving basin and natural stage curve. Plugged construction changes no canonical water or sediment and grants no pressure, containment, stored water, capture or release authority. Tests pair all 45 live water intervals with canonical controls and replay the entire revision-bound journal in a fresh engine. Current acceptance and served cancel/confirm/recall/reload evidence are recorded in implementation status; inherited controlled construction inputs remain separate from earned regional supply. Previous schema descriptions below record their own historical stages; current restoration additionally applies this neutral schema-39 book.

Preserved earned regional 120-day source preparation (verified; no runtime schema change). test/helpers/earned-regional-source-preparation.js starts from the exact schema-38 earned maturation save and issues revision-bound commands with real actor, targets and clock. It never assigns stock, people, workers, research, rights, age or event times inside the snapshot. Default generic work timing stays 100 ms. Its fixture loader explicitly asserts the 38→39 working-controls addition and the separate empty 39→40→41→42 pressure permission/attendance/trial additions. Original accepted checkpoints and hashes remain unchanged; later clay acceptance supersedes only the current-continuation/open-clay interpretation of its historical result.

The observer wraps founding.advanceNeeds(engine, at, 1) to audit 840 completed-day assessments, restoring the original function in finally. All seven communities retain their opening active services, health 100, food/water/storage and valid labor. The primary mill stays at three workers and records all 120 actual production batches/360 timber. Source field phases use actual food batch receipts and stop before civic timber runs out. Exports use current local needs; harvest jobs use current vegetation quotes; workshops hold real staffing until paid outputs occur. All freight costs and unused-ration returns are separate from new produced food.

Warehouse rows use their actual monotonic entries[].sequence, not the production book's recorded counter. Finite clay extraction is identified by its producer warehouse credit and reconciled to the deposit's remaining amount; it does not appear in workshop production history. All seven inventory books reconcile from opening stock and incoming/outgoing ledger rows. Three source-to-satellite jobs and separate home-to-source collections preserve two-leg clay custody. The current forest load is 21 logs/six food plus twelve funded rations, exactly its 60-weight quote. Earlier 21-log/eight-food and 21-log/24-food proposals reject.

test/earned-regional-source-preparation.test.js verifies 840 daily checks, seven separately paid repairs/returns, 69 returned tours, 24 real clay extracted, recipes, all warehouses, unchanged grants/coins and a fresh-engine replay of every one of the 3,176 command/advance invocations. Whole save restoration and replay are exact. Closing home floors pass at 51¼ timber/fourteen bricks/twelve tools. The independent audit additionally pins sources and 119 resource balances. materialReplacement records forty clay consumed versus twenty-four extracted, and twenty ore consumed versus zero extracted; both replacement flags and fullReserveGatePassed remain false. This helper is test/acceptance tooling, not a new governor or player automation. See implementation status for current checkpoint and failed-attempt provenance.

Installed-floor dry inspection (implemented; historical schema-38 stage). major-offchannel-inspection.js owns exact paid licences, a finite four-worker expedition, immutable whole-interval reviews, one paid observation receipt and pinned returned histories. Schema 37 migrates only to the empty version-one inspection book/marker and two schema-38 markers. Unversioned books/jobs, partial current markers and forged custody reject. Existing floor/fitting/wall/foundation books are not rewritten. Constructor validation checks installed-floor identity, route/coordinates, predecessor hashes, exact material/meal arithmetic, licence/wait timing, one full workday, certificate linkage and historical crew overlap.

ISSUE_MAJOR_OFFCHANNEL_INSPECTION_LICENCE and FUND_MAJOR_OFFCHANNEL_INSPECTION debit actual home stock and existing public/shared operating budgets, charging one attention each. START_MAJOR_OFFCHANNEL_DRY_INSPECTION binds the current job revision and exact review hash; RECALL_MAJOR_OFFCHANNEL_INSPECTION returns unfinished custody physically. Inspection competes for home labor and excludes unrelated major crews and traveling-adult adoption. Public job/chunk fields omit private payment, review and receipt internals. Private City projection contains the current costs, finite crew state, review and observation certificate; public floor overlays add inspected status without changing raw predecessor records.

The review clones canonical hydrology for two forthcoming boundaries: one establishes the opening after arrival, the next completes the entire observed interval. Surface.afterInterval advances armed→inspecting only at the matching first boundary and inspecting→homeward/certified only after the second actual dry interval. Current title, frozen installed-floor receipt, human holder, Hydraulic engineering, route, meals, water/sediment fingerprints, zero local flow and receiving head are rechecked. Inspection changes no mode, gate, natural curve, water or sediment ledger. The spent tool is recorded only with the actual complete day. The certificate explicitly retains pressureTested:false, containmentComplete:false and storageAuthorized:false.

The manifest-verified schema-37 fixture test/fixtures/offchannel-installed-floor-complete.json.gz has compressed SHA 82c08844828e5904dca450e9f9617473ceaf2b53ff527e620f84266fcf821b96 and exact predecessor SHA 58883e93ca6c7f578cfe1856fedf2ea1759499d8e0fb72cdf926f59ee021d551. Tests cover neutral migration, actual finite payment/labor/return, expiry, partial-interval recall, engineering loss, stale atomic rejection, nonzero water/bed rejection, full live completion, immutable predecessors, paired canonical hydrology and forged certificates/history. A rehashed wet interface still rejects. The closing checkpoint SHA is d2100a5964db24e9159e9538475308cbfdbfa9a2e67196f69ccae2feb08f216c. Live browser journeys verify payment/recall and both actual observation boundaries against independently advanced persisted whole state. See implementation status for acceptance scope.

The preceding schema-37 floor migration below is historical; current saves additionally require the schema-38 empty or populated inspection family.

Continuous floor installation and lined-open custody (implemented; schema 37). major-offchannel-floor-placement.js owns a version-one ledger with exact stage licences, immutable predecessor hashes, paid whole-day joining/re-rigging receipts, pinned physical builder histories, holder actions and actual dry-lowering consumption receipts. Schema 36 migrates only to the empty floor-placement book/marker and two schema-37 markers. Unversioned placement data/jobs and missing marked current data reject. Historical custody validates paid predecessors and time/action sequences separately from current title, engineering, meals and access. The builder can share only its paid setup with a later exact source drain-operator tour; unrelated overlaps reject. Installed original-bed pulses are unavailable and both crews physically return.

major-offchannel-lined-open.js applies the installed mode at the footprint. Surface records direct rain plus upslope incoming as boundary exports, with zero local film/evaporation/infiltration. Basin credits the existing native destination once using its ordinary source ledger, not a second Surface transfer through the receiving hex. The footprint stays in the raised natural curve. Header demand above 50,000 is conserved as explicit connected open-basin overbank export; it does not become reservoir storage or disappear. Sediment treats these native legs as basin boundaries even if the receiver is enrolled in Surface, preserving its ordinary four-field legs and BasinSediment custody. Covered-footprint topsoil/runoff erosion is suppressed; external sediment still follows actual water. Existing basin wet-bed evaporation and aggregate seepage remain.

Read-only lowering review uses one complete ordinary dry interval followed by sixteen paired natural/lined canonical intervals. Typed proofs retain water/sediment closure arithmetic, time/tick sequence, header/overbank partition, full changed reach and current holder parties. Candidate mode is a forecast-only WeakMap capability copied only between forecast facades. It cannot authorize live installation. The final actual interval must match the frozen dry closing fingerprint and every current grant before the 232-mass consumption receipt is written. Immutable raw floor/fitting/wall books stay intact; public overlays subtract consumed staged mass and release slots. City/private event and public chunk filters include the new job marker without exposing payment/certificate internals.

The tracked, manifest-verified input test/fixtures/offchannel-closed-fittings-complete.json.gz (SHA 68fa89047f1056ea117cb244ce0379c36cfd74b8440d0e2cfe56f7bf25a43b2f) preserves the accepted schema-36 five-tour predecessor. Floor tests cover neutral migration, unfinished whole-batch return, retained joining/re-rigging, withdrawal, actual complete lowering, predecessor immutability, typed forged custody, sixteen actual storms with independent natural controls and whole restores. The accepted controlled closing is .qa-city/floor-placement-complete-attempt3.json, SHA 58883e93ca6c7f578cfe1856fedf2ea1759499d8e0fb72cdf926f59ee021d551. Controlled construction supplies are disclosed in implementation status. Pressure testing, qualifying inspection, containment/useful supply and earned regional maturation remain open.

Offline/stepped replay preserves all simulation and physical receipt data. Batched invocation revision counters and notification recordedAt timestamps differ by dispatch timing; the independent audit records these delivery metadata differences explicitly and checks each resulting whole save restores exactly.

This supersedes the proposed predeployment inspection sequence: exact full-dry lowering is now the construction gate; a separately qualifying installed-floor inspection remains a later gate. Earlier stage notes below describe the historical staged state before installation.

Paid closed fittings and reinforced gantry (implemented; schema 36). major-offchannel-closed-fittings.js owns a separate version-one book for licences, reinforcement/closed-hardware receipts and pinned four-builder histories. Whole schema-35 saves migrate only to an empty book/marker and the two schema-36 markers; unversioned fittings/jobs and missing current data reject. Current title/engineering/access is checked during each paid workday, while historical custody validates against exact immutable floor/wall hashes and geometry. The reinforcement overlay raises gantry rating to 240 without rewriting its original 200-mass wall receipt. Four hardware additions occupy existing collar slots six through nine; exact final loads are [30,30,22,23,22,23,16,16,16,16], totaling 214. Gallery projection subtracts only added staged hardware; raw floor investment and 186-mass receipts stay unchanged. All completed assemblies remain uninstalled and disconnected, with no water or sediment intervention.

Commands ISSUE_MAJOR_OFFCHANNEL_CLOSED_FITTINGS_LICENCE / FUND_MAJOR_OFFCHANNEL_CLOSED_FITTINGS cost one attention; RECALL_MAJOR_OFFCHANNEL_CLOSED_FITTINGS is free. Funding uses the same home gross spending/operating budget and physical expedition meals/return machinery as other paid work. Source/origin major-job guards, labor, away-household food, adoption protection, private/public job filtering, regional exceptions, City reviews and map projections are connected. Completed task receipts require two actual paid days, exact materials, frozen stage/specification/slots and retained physical return histories; malformed rating, installed status, slots, daily proof or materials reject.

Four new portable regressions and 74 prior supporting cases pass (78 distinct focused cases total). The complete five-tour default-timing replay includes 407 paired canonical hydraulic checks across 39 intervals and whole-state restores; the independent regional checkpoint migrates neutrally. Actual gateway review/cancel/payment/recall/reload and read-only completed City/map checks pass at four widths. See implementation status for immutable hashes, finite controlled opening supplies and the corrected initial UI rendering failure. Dry mechanical assembly is not hydraulic pressure/containment proof. Physical deployment must consume staged custody through a separate overlay and activate the planned lined-open water contract; those remaining stages and earned regional supply stay open.

Floor fabrication and save schema 35. major-offchannel-floor-fabrication.js owns a separate version-one ledger of licences, cradle/part receipts, exact slot loads, material investment and pinned physical crew histories. The schema-34-to-35 floor upgrade adds only the empty floor book/marker and two schema-35 markers; schema 36 then adds the empty closed-fittings data and current schema 37 the empty floor-placement data; unversioned floor data/jobs reject and current saves require complete valid marked data. Immutable lining/wall/foundation receipts, water, households and title remain unchanged. Historical paid custody is separate from current engineering/title/service checks.

ISSUE_MAJOR_OFFCHANNEL_FLOOR_FABRICATION_LICENCE, FUND_MAJOR_OFFCHANNEL_FLOOR_FABRICATION and RECALL_MAJOR_OFFCHANNEL_FLOOR_FABRICATION use offChannelFloorFabrication City projection. The marker participates in due-job dispatch, labor, away-worker meals, adoption protection, worksite occupancy, source/origin major-crew conflicts, finite budgets, recall and unload. Public jobs expose marker/location/route, excluding certificates, cargo and meals. Map parts and the original lining gallery's public capacity derive current staged mass from separate floor receipts; the original fabrication asset is never rewritten. Reserved-slot remainder is distinct from wholly unreserved slots. Parts are edge-on above the open floor and add no hydraulic hook.

The manifest-verified tracked offchannel-walls-complete.json.gz fixture retains the exact six-face checkpoint; controlled finite materials appear only in derived tests. Four floor regressions verify neutral migration, paid cradle, actual partial-module recall, complete eight-tour custody, exact restores and forged proof rejection. The full run covers 26 workdays and 682 independent canonical control comparisons across 72 water intervals; it creates no floor, seam, sediment removal, curve exclusion or operating authority. The separate regional checkpoint also migrates neutrally. Actual City licence/task/recall transactions and funded/returned reloads pass; the completed City/map view agrees with separate staged custody and reads without writes at four widths. The active crew public chunk exposes its route/marker while omitting certificates, cargo, meals, payments and daily receipts; travelling builders are excluded from the household naming pool. The focused current selection totals 74 distinct passing cases, including disclosed older migration checkpoint regressions. See implementation status for immutable evidence and remaining gates.

Verified wall placement. The tracked-fixture journey passes all six actual dry lowerings in 79½ village days with seven returned home crews, six returned source operator crews and unchanged paid predecessors. Each lowering matches an independent hydraulic control, and the final save restores exactly with six faces, 504 free gallery mass and no active job. Controlled opening stocks include the continuing home civic timber bill; this is separate from earned regional economy. The independent audit also confirms neutral migration of the accepted regional checkpoint. The served final City/map state passes read-only reload, private filtering and four screen widths. A separate actual City gateway check verifies that cancelling the gantry review changes no state, while confirmation debits exact materials and 32 meals, retains carried custody in an outward job and restores the funded job across reload; it does not advance construction. Mobile payment/funded views were visually inspected and both browser servers exited zero. See implementation status for immutable evidence and remaining gates.

Wall placement and save schema 34. major-offchannel-wall-placement.js owns a separate version-one ledger of stage licences, paid gantry/setup receipts, returned crews, interval authority and installed faces. Whole version-33 saves gain empty majorOffchannelWallPlacementVersion / majorOffchannelWallPlacement records; pre-existing unversioned data/jobs reject, and current saves require the complete marked ledger. Earlier source, fabrication, population, water and ground books remain unchanged. Historical construction remains separate from current officeholder consent.

Owner commands are ISSUE_MAJOR_OFFCHANNEL_WALL_PLACEMENT_LICENCE, FUND_MAJOR_OFFCHANNEL_WALL_PLACEMENT, RECALL_MAJOR_OFFCHANNEL_WALL_PLACEMENT, AUTHORIZE_MAJOR_OFFCHANNEL_WALL_LOWERING, GRANT_MAJOR_OFFCHANNEL_WALL_PLACEMENT_CONSENT, WITHDRAW_MAJOR_OFFCHANNEL_WALL_PLACEMENT_CONSENT and START_MAJOR_OFFCHANNEL_WALL_LOWERING. The City proposal projection is offChannelWallPlacement; incoming requests contain only holder-facing authority. Public jobs expose the wall marker and route, not private certificates, cargo or meals.

The complete fabrication asset is fingerprinted and never rewritten. Placement receipts bind its exact two staged material receipts, paid face setup and separately rated gantry, actual drain receipt/stationed operator, reviewed opening/closing ticks and frozen current-holder consent prefix. Forecasts run the canonical surface/basin/sediment kernel without mutating the live world. Actual completion must match the reviewed hydraulic fingerprint and retained crew authority; local interval water, rain and incoming flow are zero. Installation records 84 consumed mass / 84 released slots and leaves floor, water, sediment, ground, curves and operating permissions unchanged. Labor, carried food, occupied worksite, source/origin crew conflicts, budget categories, due-job dispatch, return storage and exact restoration use the new job family. Only a prepared same-proposal wall crew may coexist with its separately paid source drain operators; historical setup must precede dispatch.

Tracked test/fixtures/offchannel-lining-complete.json.gz preserves the exact canonical fourteen-task state and manifest-checked identity/timing metadata. Derived tests disclose finite new construction stocks and ordinary service/staffing commands. They do not alter population, labor capacity, title, water or predecessors. test/major-offchannel-wall-placement.test.js covers neutral migration, paid work/return, recall and the six-face actual interval sequence, with stale wet openings, withdrawal and forged custody checks. Full goal, earned regional supply, floor, cleanup, inspection and useful reservoir operation remain open.

Paid lining fabrication and save schema 33. major-offchannel-lining.js owns the version-one book, stage-specific licences, fourteen canonical tasks, gallery capacity, exact face/half slots, crew travel/meals and returned-job histories. ISSUE_MAJOR_OFFCHANNEL_LINING_LICENCE, FUND_MAJOR_OFFCHANNEL_LINING_FABRICATION and RECALL_MAJOR_OFFCHANNEL_LINING_FABRICATION are separate owner commands. Schema 32 saves migrate only to an empty lining book and marker; unversioned pre-existing lining data/jobs are rejected. Current saves require valid marked data. Historical foundation, water, sediment, households and supplies retain their values.

The new gallery is an explicitly paid open-grate structure at height 457330, 256 above the existing wall top 457074. Both assemblies must complete before it grants elevated final-hex access or twelve supported slots of carrying-mass capacity 42 each. The original closure deck supplies access only and gains no free storage rating. Gallery assembly needs an unflooded route and worksite with receiving head below floor 455074; ordinary retained surface moisture can remain. Later fabrication may use the completed gallery above a wet target only while head stays strictly below the wall top. All preceding route hexes must remain dry. Stage-specific licences bind the exact source/sponsor/route and immutable paid predecessors. The downstream opening, curtain travel, bypass, natural beds, storage curves and water/sediment ledgers remain unchanged.

Each atomic task retains its complete material batch in carried custody until completion; recall before completion consumes elapsed labor/meals but returns materials. Completed fabrication is paid non-inventory site custody. Gallery pieces cost 38 carrying units plus live meals per tour; wall halves cost 42 plus meals. Builder labor, food accounting, occupied sites, due-job dispatch, recall, public projection and private-field filtering use the new job type. Proposal projections use offChannelLining; the City card reviews payment without submitting until confirmation. No local generic pathfinding exception is granted: only the lining module may append its paid elevated final hex to a strict-dry prefix.

Every workday records and rechecks authority, route and site conditions before the final atomic investment. Incomplete recall derives a partial asset status immediately, including before the next simulation advance, so City projection and restoration agree. Both the sponsor origin and source block conflicting major-work crews; historical custody accepts touching intervals and rejects overlap. Successful task receipts pin their returned crew history while only unrelated interrupted returns use the bounded history window. Gallery capacity stays zero until both assemblies finish, then decreases by 42 for each staged half. Licence and task funding each cost one attention and book their exact separate operating-budget categories; recall remains free.

Verification passes nine lining tests, fifteen existing migration regressions and fifty-one supporting attention, budget, household-adoption, regional-overview and City-projection tests. The lining tests use a manifest-verified compressed foundation fixture under test/fixtures, so they run without ignored local caches. Controlled fixture supplies are explicitly disclosed. Independent audits pass funded and recalled projection/restoration, source-side crew conflicts, historical boundaries, and unchanged migration of the full-foundation and regional-preparation checkpoints. The served browser flow passes reviewed licence/payment, cancellation, travel, map tracking, recall/unloading, funded and returned reloads, private-field filtering and 320–1440px layouts.

The complete fourteen-task canonical-weather journey now separately passes: eighty workday receipts, seven licence payments, fourteen task payments/returns, exact final restore and zero remaining staging capacity. The portable integration regression node --test test/paid-offchannel-lining-journey.test.js also passes from the tracked fixture, adding one test to the earlier 75-case selection. A paired no-lining control matches every hydrology book through 1,290 advances. Independent replay of 367 commands plus those advances reproduces the whole closing state. The completed City/map view passes final counts and hides further fabrication payment actions; reading and reloading preserves the save exactly. Sponsor opening construction stocks are controlled, while source supplies receive no grant. Earned production/import, floor placement, cleanup, inspection, containment and useful supply remain open. See implementation status for immutable evidence and limits.

Remaining M8 work is separately paid sediment cleanup/spoil transfer when needed, a qualifying installed-floor dry inspection, hydraulic pressure tests, containment and useful permitted water delivery. The installed connected lined-open mode gives the natural basin sole persistent water custody, exports local rain and separately attributed upslope bypass once, and avoids a duplicate local evaporation/infiltration pass. Fabrication alone does not enable it; the separately paid actual floor-lowering receipt does. A proposed high-side spoil rack additionally needs a separately paid full-stroke hoist and actual authorized cleanup intervals; existing curtain gear cannot lift sediment to the higher rack. Those later proposals and their hydrology remain unverified. The full M0–M8 objective and earned regional supply gates remain active. See implementation status for exact verification scope.

Continuation harnesses must use command IDs absent from the restored commandReceipts map. Same-actor retries intentionally return their original accepted result before payload and revision checks; changing a payload does not turn an old ID into a new command. The original remaining-thirteen candidate reused185 existing IDs and was rejected without execution. The successful replacement uses a unique attempt prefix, a startup absence check and a per-command absence assertion. Existing runtime idempotency is unchanged.

Planned lining must separate construction quantities from hydraulic areaScale, and uninstalled module custody from an installed floor's effects. The proposed protected-cover shortcut is rejected: a continuous liner cannot preserve ordinary infiltration. A future lined-open mode needs durable live/forecast parity, exact sediment-removal custody and a connected-bay model that counts surface/basin footprint and backwater volume once. Dry inspection needs an actual qualifying canonical interval, including rain, drainage and late receiver effects. No current foundation receipt grants lining, reservoir storage, capture, release or irrigation. The gallery and wall-half fabrication specification is now frozen above; floor, cleanup and inspection costs remain proposals.

The installed continuous floor gives the connected natural basin sole ownership of persistent water. While the bay remains connected, the footprint retains zero Surface water and pays zero local evaporation/infiltration; direct rain and separately attributed upslope runoff cross the existing edge once. Basin would retain the raised footprint in its curve and pay its single wet-bed evaporation pass and existing aggregate seepage. This does not promise lower total seepage from the still-connected natural basin. Nonzero sediment removal needs a separately specified paid capacity and supported spoil location; floor deployment cannot silently remove it. The connected lined-open runtime is implemented by separately paid floor installation. Paid cleanup and a separately qualifying post-installation dry inspection remain open. See implementation status.

Complete paid foundation audit: From the immutable returned-seven checkpoint, thirteen default-timing cycles complete in104 village days, reaching20 placements,50,000 fill and bed455074. The independent completion auditor checks every placement against a distinct returned builder and operator job, all twenty hydraulic reconnections, no active construction/operator job, no worksite sidecar or curve exclusion, immutable first-seven history, null work/licence/placement projections and rejected extra placement. Storage/capture/release/live-flow flags remain false. Both independent audits restore the entire final snapshot exactly with workUnitMs=100. See implementation status for frozen evidence and preserved failed branches.

Physical supply continuation checks: The accepted bootstrap starts from the immutable two-lift checkpoint and completes two paid charter extensions, six forestry jobs, 42 mill batches, the lodge, Scouting and the supply return. Actual input/output receipts are 168 logs→126 timber. outposts.supplyQuote uses active Scouting and expansion.dryRoute for a 37-step detour with seventeen rations; its shared 60-weight limit admits forty tools outward and 21 timber homeward, but rejects 22 timber. The completed exchange retains delivered:{tools:40,food:0} and returns the exact timber cargo; its job is absent after unloading. Source timber58→37 and home timber72→93 match physical custody. Scouting is then suspended and the lodge unstaffed by ordinary commands. Exact reload passes. No route or capacity rule is relaxed; controlled initial stocks do not establish an earned regional economy. See implementation status for immutable identities and earlier failed harness checks.

The scheduler must hold producer staffing through actual due times: zone-engine.assignStaff resets a charter producer's nextDueAt to the command time plus its local day whenever staffing changes. Charter production executes inside founding.advanceNeeds at the community boundary, after household and specialist bills. A batch due just after that boundary waits for the next one. QA must reacquire structures after commands and advance to the first community boundary at or after the current batch's due time. Expected output or in-transit cargo cannot pay an earlier bill. Regional attempt 28 demonstrates this timing gap and stops at 25 measured days; every preparation, measured-day and closing-tail acceptance check remains required.

Bootstrap trial three establishes two non-scheduler constraints that the accepted sixth trial now handles. operating-budgets.reason rejects four-log mill inputs when the enabled daily-only budget omits logs, even with physical stock. Normal SET_REGIONAL_OPERATING_BUDGET needs active civic services, ceilings covering current commitments and at most 1,000 per daily material; it preserves gross spending and history while adding logs:4. Each of 42 actual production commitments then consumes four logs and produces three timber. The founder and Jonas die of ordinary old age during the 55.67-day bootstrap, reducing home population27→25 and labor16→14 without health loss, hardship or new food shortfall. Embodiment/handover to Mira and adoption/nomination of an existing civilian preserve population, labor, goods, grants, water and old foundation records. Research is asserted through its {learnedAt,source:'community-research'} record, not a boolean. The later default-timing continuation independently verifies Mira's ordinary death, public handover to the nominated existing adult, retained funded job409 and a living successor; home capacity becomes thirteen. Historical consent retains its persisted actor while new decisions use the current living steward. No runtime rule or save schema changed in these bootstrap trials. The QA harness uses a one-millisecond generic construction/forestry work unit instead of the default100ms; village-day production, research, travel, lifecycle and hydrology retain their own clocks. Default generic-work pacing is not established by this run.

Current QA scope: All twenty paid lifts, forty distinct returned crew jobs, lawful succession and default-engine reload pass. The final thirteen cycles separately verify home52 timber/26 tools/130 rough stone/65 clay, source26 timber/13 operator tools and10.4 tools of actual Hydraulic upkeep. Gross carried food is distinguished from actual consumed and physically returned food. The initial construction supplies remain controlled fixtures, and the earlier supply bootstrap's accelerated generic work is disclosed separately. Neither earned regional sustainability nor completed reservoir operation is accepted. Paid gallery and wall fabrication and all six wall placements are implemented and verified; floor installation, inspection and containment remain planned; see implementation status.

Regional preparation scheduler: bounded 32-day acceptance. Attempt5 observes all 224 completed community days after founding.advanceNeeds(engine, at, 1) returns and holds mill staffing until a real output receipt appears. It verifies four returned 24-log forest loads, three returned sponsor shipments, six additional four-log/four-timber mill batches, and one paid eight-timber/four-brick/one-tool repair. All seven communities remain inhabited, healthy, fed, serviced and within labor/storage/water limits. Cumulative home logs reconcile to 115.5; forest logs to 21. The earliest forest warehouse row has aged out of the final ring, so its archived witness is checked alongside retained receipts and cumulative ledger totals. Default work timing and schema 32 exact restoration pass. Remaining preparation, the existing worker's day49.5 loss, both dependents' day144.5 maturity and the subsequent120-day measurement remain open. The old paper harvest count requires reconciliation because only three home harvests actually ran. See implementation status for immutable hashes. Trials1–4 below remain diagnostic history; their failed branches are never resumed.

Trial3's observer stops during the first household day because it checks economy.days inside knowledge.advance. The engine increments that counter only after production, population care, continuity and knowledge recording. Full daily evidence must be captured after founding.advanceNeeds(engine, at, 1) returns: exactly one of the seven communities advances by one day, its prior due time equals at, and its next due time advances by its village-day length. Keep all-community service/food/health/hardship checks after that call and again after ZoneEngine.advance, which also schedules crews. A saved partial observer failure may be restorable but does not constitute a completed day or an accepted continuation input.

Trial4 uses that complete-day hook and independently verifies35 completed assessments across five days, plus one actual24-log forest return at the quoted four-day round-trip time. All seven closing communities retain health100, zero hardship/unmet food, required services and valid labor/storage/water; default restore is exact. The trial then stops because a helper reaches the idle mill's timer without an output receipt. Charter production is assessed inside the completed community day, so future waits must follow the exact new production receipt and its input/output custody. No sponsor bridge, full preparation or120-day acceptance is established by this stopped trial.

Regional repair attempts 25–27 extend the corrected food and mill staffing schedule. Attempt 25 reaches seventeen measured days before an audit helper misreads already-delivered food; attempt 26 fixes that receipt check and reaches 22 days before a helper omits restoring field staff. Attempt 27 restores the field correctly and retains health 100, zero service failures, positive food, a paid repair, replacement materials, the next repair reserve, empty freight and exact restoration through 22 days. It stops at the sponsor timber guard: 3.75 timber, a mill producing 1.5 against two daily upkeep, and home timber 18.25 below the protected export trigger. A physical milling/delivery schedule must close that rate gap; the full 120-day gate remains open. See implementation status.

Foundation operations and ground tests build their required new-stage fixtures through tracked helpers when no explicit cache is supplied. Three operations cases and all four ground cases pass with only a closure-predecessor cache; the new prepared/dry/active stages are built during those checks. Isolation migration tests also derive the real version-30 boundary explicitly rather than requiring an ignored local snapshot. Two focused cached predecessor cases pass. These checks verify fixture portability and the selected behaviors; they are not a whole-repository test result.

Raised-ground drain review now binds openingConditions.currentWorksiteBedHeightUnits to the actual currentBedHeightUnits; the two-lift regression checks bed 450574, fill 5,000 and the matching Ground fingerprint. City construction-drain copy describes the current floor rather than assuming original ground after a paid lift. Retained-sediment test fixtures now include version-two removed: 0; corrupted-partition checks start from a normalized current save so they reach the intended custody validation. Seven drain flow/review cases pass across the initial five and corrected two, five affected worksite/isolation cases pass, and the coupled reservoir sediment forecast case passes. These remain focused checks.

Regional repair reserve, attempts 19–22 (not accepted): Attempts 19–20 establish the persisted thirty-log forestry target and expose a next-event guard that ignored already scheduled milling from physical logs. Attempt 21 fixes the guard but its forest mandate still chooses a secondary food collection; it stops after forty measured days at sponsor food 3.5 before a ten-food daily bill. Attempt 22 removes that secondary collection, moves 84 logs in four measured trips and sends nineteen food with a sixteen-timber export. It stops after 34 measured days when fundRepair pauses routes with sponsor food 9.5 before the next ten-food bill. Attempts 21–22 record exact daily coverage for all seven communities, health 100, no service failure and exact restore, but neither satisfies the 120-day gate. The accepted source remains SHA 4746644b25d2bceca3d97ca70bc1b5f8d4cc0f975afbb009299587388de360ec. A successor must provision physical sponsor food across route draining, the paid repair and replacement-material work before calling fundRepair. See implementation status for artifact hashes and full accounting.

M8 paid foundation (all twenty paid lifts and returns verified): The raised design uses twenty paid lifts of 2,500 fill subunits and 250 height units each, from original bed 450074 to floor 455074. Each lift consumes ten rough stone, five clay and one tool, totaling 200 rough stone, 100 clay and twenty tools, before licensing and meals. These are direct investments of existing extracted goods into the frozen construction specification; no new fill resource or recipe credits free material. The source's same-owner rootHome is frozen as both originSettlementId and payerSettlementId; the proposal's community remains sourceSettlementId and retains title and Hydraulic authority. The four-person foundation job belongs to the sponsor origin, while the separate four drain operators remain stationed at the source. The current lawful dry route has 36 cells and 35 steps; route identity belongs to each licence and job because a later paid lift may need a different safe path. Each lift carries 84 paid meals and 31 carrying-weight units of cargo, totaling 115 of 120 capacity, for the outward journey, one preparation day, fourteen days of ready custody and physical return. Public licence, quote, work and asset projections expose this source/origin/payer split and sponsor name without exposing private placement authority. ISSUE_MAJOR_OFFCHANNEL_FOUNDATION_LICENCE, FUND_MAJOR_OFFCHANNEL_FOUNDATION and RECALL_MAJOR_OFFCHANNEL_FOUNDATION keep payment, travel and preparation separate from placement; preparation creates no raised ground or operating authority.

Each prepared lift needs a new actual dry drain opening, fresh affected-holder review and consent, and an explicit combined placement/closure command. AUTHORIZE_MAJOR_OFFCHANNEL_FOUNDATION, holder GRANT_MAJOR_OFFCHANNEL_FOUNDATION_CONSENT/WITHDRAW_MAJOR_OFFCHANNEL_FOUNDATION_CONSENT, and PLACE_MAJOR_OFFCHANNEL_FOUNDATION_AND_CLOSE remain separate orders. The transition moves all local bed sediment into durable contained spoil with no inventory or fill credit, consumes the exact carried batch and places one lift atomically. Water must be exactly zero. The new window retains the existing eight-interval limit and every reopening-prefix review; geometry is fixed throughout that window. Reopening removes the temporary exclusion but keeps the paid raised bed in natural-basin capacity and flood exposure. A later lift repeats the paid preparation, dry-opening and authority sequence. Old isolation-only receipts remain immutable. Version 32 supplies separate construction, ground/spoil and authority books; old saves migrate to empty books. The served path verifies one paid placement, map projection, exact restart, one live interval and withdrawal/reopening with the raised ground and contained spoil retained. The completed command journey now verifies all twenty consecutive lifts, reopening and both returns, including lawful succession during lift19. Lining, permanent containment, capture/release and useful irrigation remain required. This work does not complete the M0–M8 goal.

The verified placement fixture preserves the source community's real worker limit instead of adding residents or water. Two four-person field crews plus Hydraulic engineering and its registry clerk would need eleven source workers, so the source's same-owner founding home sponsors the foundation crew. That home pays and physically carries the lift batch and meals along its recorded walking route; the source retains title, engineering and drain operators. The current reviewed dry route has 35 steps and needs 84 meals plus 31 cargo weight, totaling 115 of the crew's 120 capacity. Origin labor, payer reserves, source authority and route safety remain separate checks. The served comparison is read-only, cancel submits no order, public records omit private action and certificate fields, and the input fixture remains byte-identical. Existing closure and isolation fixtures remain immutable. The separate full twenty-lift command audit now verifies the complete material and authority sequence; the served UI evidence remains bounded to its one-lift journey.

Regional repair reserve, attempt 18 (not accepted): The protected-export continuation completes its first measured paid well repair and 29.5 measured days after 32.5 preparation days. All seven communities retain health 100 with no service or food failure, exact daily assessment coverage, empty closing freight and exact restoration. It stops when sponsor timber reaches 4.75: opening 24.25 plus 16.5 milled plus a 24-unit delivery cannot sustain 60 consumed in upkeep. Home closes with 19.25 timber and can spare only 3.25 above the protected sixteen; another 24-unit shipment is unavailable. One 21-log sponsor harvest in the measured window does not sustain the current milling/upkeep cadence. This is a schedule/rate failure, not a proof of impossibility. The 120-day repair-reserve gate remains open; later attempts are recorded above.

M8 paid temporary isolation (implemented): After the supported-open perimeter, a separate paid removable curtain has 33 tasks: 28 panel courses, a flush seat, dry operating deck and lifting/reopening gear, upslope bypass/header, nonreturn spill fitting and raised proof. Its bill is 64 timber, five bricks, eight dressed stone, 34 iron and seven tools, plus licences and carried meals. The existing outside jamb support is credited. Four-person capacity-limited trips keep the assembly raised and the full opening clear throughout construction. The immutable completed asset remains raised-ready; a separate operating ledger records its actual position.

Migration 30→31 introduces separate version-one physical-closure, operating-authority and hydraulic-isolation books. Startup restores a privately authorized curve exclusion before validating retained surface water. Water and bed sediment remain in their ordinary ledgers; live sediment partitions reference the exact durable isolation record and certificate. Each actual interval uses the canonical coupled kernel and is checked against its private preflight. Recall, withdrawal, changed authority or the deadline requests reopening before the next canonical interval; the crew stays at the paid station until the reopening receipt commits. Interior/exterior wall failure also runs fresh natural drainage from the same opening. Rejected commands restore the private runtime boundary, and the reviewed reach is reserved against new hydraulic changes while closed. New drain/outlet pulses cannot overlap isolation. Reopening does not automatically reclose.

major-offchannel-closure.js supplies ISSUE_MAJOR_OFFCHANNEL_CLOSURE_LICENCE, FUND_MAJOR_OFFCHANNEL_CLOSURE and RECALL_MAJOR_OFFCHANNEL_CLOSURE. Licence issuance and tranche funding each consume one attention; comparison, consent, closure and recall do not consume attention. The owner-requested off-channel-isolation scenario accepts only eight isolated intervals. major-offchannel-isolation-review.js unions all prefix-zero-through-eight reopenings through interval seventeen, including transient receiver, ecology, built-property and holder effects. Ordinary City projection performs no such replay. AUTHORIZE_MAJOR_OFFCHANNEL_ISOLATION, holder GRANT_…_CONSENT/WITHDRAW_…_CONSENT, and CLOSE_MAJOR_OFFCHANNEL_ISOLATION are separate commands. Historical certificates bind a fixed consent action count/fingerprint and exact paid predecessors; current continuation separately checks stewardship, dependencies, title, staffing, station and return meals. Live partition version two is keyed to the hydraulic record; forecast partition version one remains forbidden in live saves. Later forecast clones may retain historical live partitions only when their exact durable receipt and certificate match. Durable isolation validates its activation clock, contiguous interval count and frozen reopening boundary independently of forecast-tail history.

The full twenty-lift command journey now passes. Physical lining installation, intake/capture, finished reservoir operation and useful irrigation remain unfinished. An eight-interval window does not silently grant another lift: each subsequent batch needs new paid preparation, an actual dry opening, fresh review and current authority. The full M0–M8 goal remains active; this stage does not satisfy the earned regional supply or completed reservoir gates.

Regional reserve QA through attempt 17. Preserved command-only continuations distinguish quote-shape/order defects from economic reserve failure. Collection quotes expose escrow, not collect; actual home inventory must cover every due workshop batch before an in-transit load arrives. Common manual/bridge quote paths release carrier labor first, and measured export waits for competing routes while retaining three primary-mill workers. Attempt 17 reaches fifteen measured days without service/food/health failure but stops at due condition 70 with timber 10.25 below the guarded sixteen. No production rule changed for these probes, and the 120-day repair-reserve gate remains open. See implementation status for distinct inputs, stops and artifacts.

Temporary-worksite comparison. major-offchannel-worksite-review.js adds the owner-only off-channel-worksite waterworks forecast scenario with exact world/proposal revisions. It requires the completed supported-open predecessor and no overlapping waterworks crew/control. From the actual opening it compares zero or one conserved preparation-drain interval plus eight/sixteen temporary intervals against canonical natural hydrology. It reuses ordinary affected-reach, water/sediment closure and inventory-redaction rules; the quantity-neutral closure boundary reports its immediate exposure change separately.

major-offchannel-worksite.js owns a typed sidecar and privately issued surface directive. Forecast and durable live capabilities are distinct. Water stays in surfaceWater.cells[1372994], bed sediment in the ordinary sediment row. Original-bed geometry permits 60,000 normal and less than 70,000 absolute effective volume, including uncapped two-per-mass sediment displacement. Surface loss is interior-only; a typed sediment partition and interior-only erosion view keep upstream bypass from mobilizing the worksite. Completed receiver water and sediment receipts gate finite spill. Trial branches are cloned from the same opening; reaching either wall limit selects a fresh same-interval natural reconnection, preserving conservation and rejecting automatic reclosure.

Forecast clones deep-copy the sidecar and curve map. Opening fingerprints include them when present, leaving ordinary-world certificates unchanged. Branch-specific basin metadata determines exposure. Forecast ledger validation checks exact typed geometry and receipts; ordinary saves retain their existing surface capacity and curve restrictions unless the exact live isolation record reconstructs its capability first. The separate version-31 migration above adds durable live custody and combined-operation consent. The paid-foundation path places one reviewed lift at a time and all twenty lifts now pass. Finished reservoir operation remains unfinished. See the construction checklist.

Supported open perimeter. Migration 29→30 creates majorOffchannelPerimeterVersion: 1 and {version,nextLicenceId,nextAssetId,licences,assets,history} only when the new marker, book and job fields are absent. major-offchannel-perimeter.js owns exact source licences, predecessor/specification bindings, durable assets, ordered material receipts and physical four-worker trips. ISSUE_MAJOR_OFFCHANNEL_PERIMETER_LICENCE, FUND_MAJOR_OFFCHANNEL_PERIMETER and RECALL_MAJOR_OFFCHANNEL_PERIMETER use normal authority and revisions. Funding/licensing spend ordinary attention and budgets; recall returns remaining custody without refunding installed work. Shared scheduler, worker/away accounting, hardship protection, feeding, occupancy, public job allowlists, City and map projections include the new crew.

The frozen support height is max(wallTop - originalInsideGrade, wallTop - outsideBed), not the finished-floor retaining height. The exact six profiles produce 193 lifts of at most 256 height units, five keyed packages and one proof task. Costs and exact lift remainders persist in receipts. Low faces use inside-plot cribbed construction from the preparation frame; the outside generated bed remains context only. Access stays at original grade 450074 for every task. Retained surface moisture is unchanged; basin exposure or receiving head at that grade stops work. No hydrology hook or natural-curve exclusion is installed.

A 28-day source licence binds the exact paid preparation/drain records and route. A tranche takes the largest ordered prefix fitting capacity 120, finite meals and return before expiry; current title, stewardship and Hydraulic engineering remain required. Strict restoration checks identity, coordinates, specification, licences, ordered investment, meal/material sums, nonoverlapping journeys and completion. Public projection omits private certificates and signer identity. The completed asset is perimeter-supported-open, with its full-height downstream bay clear and zero fill/water/sediment movement. The later temporary closure uses its separate worksite ledger and current affected-holder authority; saved v2 sealed-containment terms are not reinterpreted. See the construction checklist.

Attended construction-drain operation. Migration 28→29 creates majorOffchannelDrainOperationsVersion: 1 and {version,nextId,records,operatorHistory} only when the new book, marker and operator jobs are absent. Current saves require strict journey, authority and receipt validation. The immutable connected-closed construction asset remains the predecessor; the separate operating book records movement.

major-offchannel-drain-operations.js provides DISPATCH_MAJOR_OFFCHANNEL_DRAIN_OPERATORS, RECALL_MAJOR_OFFCHANNEL_DRAIN_OPERATORS, AUTHORIZE_MAJOR_OFFCHANNEL_DRAIN_PULSE, GRANT_MAJOR_OFFCHANNEL_DRAIN_OPERATION_CONSENT and WITHDRAW_MAJOR_OFFCHANNEL_DRAIN_OPERATION_CONSENT through ordinary command authority/revisions. Tours use four workers, two timber, one tool, finite meals, capacity 120 and fourteen station days. Labor, feeding, occupancy, catch-up, budgets and public job allowlists include the crew. Existing home budget service and ceiling checks remain. Source engineering and separate affected-holder consent are checked before flow; historical completed consent prefixes do not depend on a holder's later owner.

major-offchannel-drain-flow.js reviews one next-interval pulse and seven closed forecast intervals. surface-water.runInterval shares the canonical water/basin/sediment core between live simulation and forecast facades. Before live mutation, prepare runs the complete copied interval, checking opening/dependency fingerprints, ordinary allocations, final receiver pre-spill storage and sediment displacement, conservation and hydrology. A module-private capability and exact preflight receipt guard the live attended hook. The receipt binds natural edge 1372994→1372993, total/extra flow, ordinary cumulative counters, sediment attribution, receiver head and resulting hydrology fingerprint. Added drainage fits the 50,000-subunit section and retained water; receiving head stays below original grade 450074.

Ordinary water/sediment books remain sole custody. City and command results expose allowlisted summaries only; public action history omits private signer identities. Viewer-specific consent controls check current ownership, living stewardship, deadline and action limits. New dispatch/review waits for overdue surface intervals to catch up, and a grant must precede its scheduled interval; approval cannot be applied retroactively. Saved operation keys and completion timestamps bind the exact durable receipt. Holder withdrawal or changed evidence cancels the pending pulse but can retain a sound stationed crew. Recall, lost source title/engineering, unsafe access or station expiry cancels authority and starts physical return/unloading; the control remains closed. Seven forecast intervals are not seven observed live intervals. Ground, perimeter and natural basin capacity stay unchanged; fill, isolation, reservoir storage and irrigation remain separate gates. See the construction checklist.

Paid closed construction drain. Major-waterworks 27→28 introduces required majorOffchannelDrainVersion: 1 and a separate {version,nextNoticeId,nextLicenceId,nextAssetId,notices,licences,assets,history} book only when all new fields/jobs are absent. The two drain modules initialize after preparation; no early hydraulic metadata loader or surface-water schema change is needed because the natural curve stays intact. Current marker deletion and drain fields hidden in older versions reject restoration.

major-offchannel-drain-rights.js files a fresh eight/sixteen-interval comparison under a twenty-eight-day notice, binds immutable completed preparation plus current physical and structural downstream dependencies, and records affected-owner grant/withdrawal actions. Raw comparison evidence remains internal; City and command responses use safe summaries. Licensing costs four timber, one tool and four food and records the exact consent-action prefix. Later withdrawal, including in the same timestamp, stops new authority without invalidating historical issuance. Current construction checks deliberately do not compare the evolving opening-water fingerprint, but they do recheck title, ownership, exact design, preparation, route and structural review currency.

Notice filing and City availability share the same eligibility check. An unchanged unexpired notice prevents duplicate filing; changed structural dependencies permit a replacement immediately if current physical bindings are eligible. Historical notices and their authority prefixes remain validated after replacement.

major-offchannel-drain.js owns four-worker, capacity-120 paid construction jobs and three exact task receipts. Source labor, carried meals, budgets, public map/job allowlists, recall and physical unloading use the major-works integration. The preparation asset is a referenced immutable predecessor; only that exact predecessor is excluded from the successor's occupancy conflict. The result is connected-closed, original ground/perimeter/basin curve unchanged, zero fill and zero moved water/sediment. FILE_MAJOR_OFFCHANNEL_DRAIN_NOTICE, GRANT_MAJOR_OFFCHANNEL_DRAIN_CONSENT, WITHDRAW_MAJOR_OFFCHANNEL_DRAIN_CONSENT, ISSUE_MAJOR_OFFCHANNEL_DRAIN_LICENCE, FUND_MAJOR_OFFCHANNEL_DRAIN and RECALL_MAJOR_OFFCHANNEL_DRAIN use normal actor/revision/session authority. The separately implemented attended opening uses the operating book and conserved interval attribution above; neither construction nor its licence invokes hydrology.

Construction-drain comparison. The explicit waterworks forecast accepts a separate off-channel-drain scenario with exact proposal/world revisions and an eight- or sixteen-interval horizon. Owner checks and foreign-inventory redaction match the finished-reservoir comparison. City keeps each result separately. The candidate preserves original terrain, natural basin capacity, source bypass and reservoir storage at their current values; it creates no asset or permission. Its only intervention transfers additional retained surface water along the exact existing footprint-to-natural-receiver edge before ordinary cumulative routing and sediment accounting. Same-interval candidate receiving head before spill bounds that additional drainage. Forecast intervention entry points remain unavailable on live engines. The separate attended hook now requires the completed paid asset, stationed operators, current operating consent and full canonical preflight; construction consent alone grants no flow. See the construction checklist.

Disconnected off-channel preparation. Major-waterworks ledger 26→27 creates majorOffchannelPreparationVersion: 1 and {version,nextNoticeId,nextLicenceId,nextAssetId,notices,licences,assets,history} only when all new fields and preparation jobs are absent. Version 27 requires the book; missing or partially marked current state rejects. Earlier proposal terms, notices, grants and outlet construction receipts remain unchanged. major-offchannel-preparation-rights.js binds a raised v2 draft, exact site/boundaries, source-owned route and completed closed outlet to a separate fourteen-village-day notice and paid preparation-only licence. These records grant no operational water authority and never enter the legacy shared-pool notice list.

major-offchannel-preparation.js owns the exact nine-task sequence and four-person majorOffchannelPreparationVersion: 1 jobs. Ordinary stock, food-reserve, knowledge and operating-budget checks fund material/meal custody; completed task receipts persist through recall, expiry and amendment. The shared crew aggregation covers labor, daily feeding, occupancy, catch-up and exclusive major-works journeys. All major construction/control/connection/operator/preparation crews are excluded from home food demand while eating carried rations and protected from hardship departures; unloading crews resume ordinary home meals while their labor remains committed. Public chunks expose only visible site progress and an allowlisted route/position job; private City projection exposes quotes, retained investment and recall. The four commands are FILE_MAJOR_OFFCHANNEL_PREPARATION_NOTICE, ISSUE_MAJOR_OFFCHANNEL_PREPARATION_LICENCE, FUND_MAJOR_OFFCHANNEL_PREPARATION and RECALL_MAJOR_OFFCHANNEL_PREPARATION; proposal and job revision checks use ordinary command transactions.

No preparation path invokes a water transfer, curve exclusion or terrain mutation. Retained surface moisture is permitted and remains in ordinary custody; basin exposure or receiving head at the original ground elevation blocks work. prepared-disconnected means paid stakes and fittings only. The next paid connection must keep the perimeter open and the natural basin curve intact. A later supported perimeter needs a separate versioned isolation transition with conserved footprint water/sediment and explicit displaced basin volume before fill. Neither state is implemented by the comparison. See the off-channel construction checklist.

Regional probe boundary: The latest command-only continuation measures exactly 120 days and drains paid freight for one further day. A pass-through observer of knowledge.advance captures 121 distinct, contiguous home and sponsor assessment days; independent audit verifies no missing, duplicate or failed service day. Event-observed minimum health is 100, population/workers stay 146/77, five repairs are paid and network food increases 577.5. Full restoration, every recorded material balance, unchanged grants/coins and empty opening/closing freight pass. Routes have separate jobs but share home labor; each needs two available workers, and an idle staffed mill continues to reserve its assignments.

This is bounded food-throughput evidence. Home timber closes at 4.25, below the next eight-timber repair bill, with exhausted headworks and adequate secondary wells. Logs remain available but unmilled. Long-run milling, repair reserves and mineral replacement stay open; no complete scenario replay is claimed. The earlier 120.083-day observation-based service trial and its food deficit remain distinct. Implementation status records exact evidence, failed branches and the independently audited limits.

The forecast assumes completed intact lining and controls, unchanged current land uses and no new player orders. It supplies a fixed evaporation potential of 250 water subunits per interval and zero lining infiltration; actual loss cannot exceed available water. These are explicit hypothetical operating assumptions, not calibrated construction performance or a general flood-safety certificate. A live asset must bind its condition, failure behavior and operating permission separately.

Read-only off-channel forward hydrology. The existing authenticated world-forecast-request accepts scope waterworks through major-offchannel-review.project, with exactly one selected proposal, current world/proposal revisions and an 8/16-interval horizon. The wrapper copies raw evidence before projecting inventory effects in interval, changed-receiver and built-effect paths. Actor-owned communities retain quantities; foreign/unknown communities expose only identity, resource and adverse flags, with optional tick. Raw simulation evidence is unchanged. major-offchannel-forecast clones the opening world, applies the hypothetical dewatering receipt in its candidate, and compares identical weather forcing. major-offchannel-surface removes captured water from the exact source allocation before natural credit and separates direct footprint rain from upslope bypass; sediment.advance retains original transport/erosion allocation before removing captured mass. Basin external-inflow receipts credit accepted release after losses and before spills, with a prospective receiver-head check. These hooks explicitly reject live engines. Their ephemeral external legs are not a durable live-asset schema.

Candidate hydraulic metadata and flood exposure omit the exact original footprint bed through a clone-local, coordinate-bound exclusion. Forecast receipts bind design, opening hydrology, curves/topology, evolving compartment custody and affected dependencies. Per-interval reach retains transient exposure, structures, inventories, topsoil, wetland/fish changes and changed terminal flows, including modeled coastal interests. The combined accounting includes surface/basin storage, reservoir storage, rain, losses, exports, bed sediment and explicit excavation spoil. Failure preserves completed rows and exact failed forcing; it never commits a partial interval to the caller. Scheduled/observing legacy commissioning controls are rejected rather than silently skipped. This is a conditional forecast of current land uses, not notice eligibility or a projection of future player orders.

Raised designs use candidate-raised-off-channel-compartment-v2, explicit foundation fill 50000, source-bed/head limits and separate v2 primitive receipts. Ledger 25→26 adds only version markers after rejecting premature raised fields; saved v1 terms/notices rederive against v1. The original bed 450074 remains the natural-curve exclusion and dry construction boundary; floor 455074, spill 456074 and wall 457074 describe the hypothetical supported compartment. No terrain is rewritten and spoil cannot become foundation inventory.

Longer attended maintenance evidence. The corrected 48.583-day ignored continuation relocates four residents through ordinary travel, suspends post-title Land registry, and retains the route/sanitation service set. It records village→Town→City→Regional-capital checks, health minima 100, zero sampled retained-service failures and an exact final restore. One manual day-24 pause drains active freight and frees workers for an 8-timber/4-brick/1-tool repair, a six-brick batch and two trips collecting 96 food. This is not an autonomous maintenance acceptance test. Combined logs close as 6.5 + 250 harvest − 234 milling − 3 kiln = 19.5; timber closes as 57.75 + 234 output − 240 civic/service − 8 repair = 43.75. The combined wood inventory falls one, food reserves fall, and woodland recovery is still pending. Land registry was required for the earlier paid title; current development and Governor route predicates do not require keeping it active afterward. See implementation status for the changed gate and distinct earlier replay.

Sponsor-forest interval accounting. The exact ignored 24-day replay records eight harvest jobs totalling 166 logs, not 168; opening sponsor stock supplies the remaining two collected logs. Seven completed round trips deliver 153 logs, while the eighth holds fifteen homeward. Its six outward timber are already included in the sponsor's total 58 received. Full log closure is opening home/sponsor 6.5 + harvest 166 = mill input 129 + closing home 28.5 + in-flight 15. Timber closure is opening 53.75 + output 129 = closing 38.75 + home civic/service cost 96 + sponsor specialist cost 48. All 43 mill batches have matching physical receipts. No repair is funded within the measured interval, and the old retained repair receipt is not current evidence. The artifact's repairMaterials predicate checks only bricks/tools, omitting eight required timber; minimum timber 3.25 therefore fails complete repair readiness. Exact replay and health 100 do not establish food, woodland-recovery or maintenance equilibrium. See implementation status.

Off-channel interval kernel and sealing planner. major-offchannel-kernel.advanceInterval is pure: exact selected geometry plus explicit opening/forcing produce a frozen versioned receipt. It conserves source capture/bypass and compartment water/sediment separately, rounds minimum bypass upward, limits capture against incoming sediment displacement, applies bounded supplied loss potentials and rain, and retains bed sediment. Release respects actual water, retained head, section rate and supplied receiver acceptance; closed controls retain water. Invalid custody, capacity, unsafe arithmetic, alias coordinates and attempted backwater reject. The kernel reads no weather, world stock, natural pool, title or permission; a future network caller must supply verified forcing, evolving receiver head/capacity and authority.

Receiver heads may contain fractional height units, matching ordinary basin hydraulics; conserved water and sediment remain safe integers. The source-split section bounds the complete supplied source edge, not just captured water. Distinct bypass and spill legs still need network-level downstream capacity validation. Future live sealing must bind the complete current curve/topology and apply all footprint debits, basin credits, spoil custody and the curve exclusion atomically; the present design/opening receipt is a hypothetical review rather than that authorization.

major-offchannel-transition.plan produces a hypothetical current-boundary dewatering/excavation receipt. It binds the full design and opening custody with fingerprints, drains footprint water, carries at most one sediment unit per hundred drain-water subunits, and records the remaining bed as planned paid spoil rather than inventory. Its compartment opening is exactly zero. major-offchannel-design.sealingReview supplies actual surface/basin custody, computes the candidate receiving head with supported sediment credit and one exact footprint bed excluded, and checks exposure/backwater without editing cached natural metadata or world state. City displays the resulting plan. These primitives, current-custody review and explicit coupled forward comparison are implemented; complete notice integration, live construction/asset persistence and operation remain open. A historical counterfactual cannot be reconstructed from existing aggregate edge rows alone because per-cell opening water, losses, topsoil and wetland feedback are not fully retained.

Default earned satellite material regression. city-integration.test.js passes its immutable first-earned-100 cityExpansion.snapshot directly to capital-satellite-preparation.prove, then passes that exact saved result to capital-satellite-material-return.prove. The preparation's material, mill and founded boundaries advance monotonically and restore the same world; no ignored files, environment-selected fixtures, stock/population grants or lifecycle rebasing are required. Whole-journey and stage-specific reports record one old-age death, four relocations, minimum home health 20, minimum sponsor health 89.5 and a maximum observed sponsor hardship counter of seven. This is deliberately a bounded recovery/material proof rather than healthy expansion acceptance.

The later return leg records no hardship, extracts twelve clay from the finite child deposit, physically carries eight through the sponsor to home, spends eight clay/three logs on six bricks and pays eight timber/four bricks/one tool for headworks condition 0→100. Child retained clay is four and final home/sponsor/child populations are 95/8/8. One offline catch-up and twenty-four due-time steps compare cargo, people and journey completion; the finished whole save restores exactly. An explicit assertion preserves the initial City snapshot for the independent 120-day equilibrium and 3,600-day regional branches. The complete default City test passes; later recurring-supply experiments below remain separate ignored QA evidence.

Two-mill continuation and measurement boundaries. The later earned City expansion pays for title and construction before staffing both mills with three residents each. The subsequent 24.083-day interval receives physical log cargo and restores/replays exactly, but sponsor civic timber falls 41.5→0.5 and home health reaches 71.7 before returning to 100. It therefore remains a failed network-equilibrium gate. The central well's last repair occurs 71 days before that measured interval; condition zero does not itself mean household water shortage, because base capacity plus three staffed secondary wells supplies 96 places for 91 residents. Keep dispatches separate from completed cargo receipts, and collect interval receipts while advancing: the final warehouse and production histories have bounded retention and can omit early events from the same measured interval. See implementation status.

The repeated audit reaches the identical saved state and accumulates 31 physical mill batches/93 timber, four completed cargo receipts/84 logs and one still-outward 21-log load. The production history reports only 27 batches/81 timber because four batches occurred with accounting inactive; per-advance warehouse movements establish the complete input/output balance. Home timber spends 62 on research/specialists and 22 on resident care; sponsor offices spend 41 without receiving any new timber. Neither capped final rows nor a dispatch counter is a complete interval resource balance.

Bounded recurring satellite acceptance. The ignored command-only continuation .qa-city/probes/satellite-recurring-tail.js begins from the prior accepted first-clay repair, rather than the newer default test branch. Actual construction, production and shipments create the child field and office supplies before authorizing two Governor legs. A 24-world-day interval without player orders verifies dispatch counters 3→11 and 4→8, automatic maintenance orders 33→35, exact costs of 8 timber/4 bricks/1 tool per repair, food/health/population custody and exact replay/restore. It explicitly reports falling timber/log/brick/tool reserves and zero forestry dispatches. The clay deposit falls from 60 to 24 during setup; the measured interval transports existing extracted clay without further depletion. This is a bounded recurring proof, not renewable equilibrium. An earlier promotion attempt mistakenly used the later day-3075 setup checkpoint; the accepted first-material path originates at day 3016 with 128 clay in the seam. The passing default regression now uses that correct origin. Its later meal shipments produce a different repair date, so the earlier recurring checkpoint is kept as separate evidence.

City growth authority on existing fourth-ring releases. charter-extensions continues to derive the same fringe-v3 field/forest sites. A recognized City/capital exposes those sites; registration requires four active administration services and the ordinary registry, survey, adjacency, ownership, world revision, payment and reserve gates. An exact eligible major-work authority has priority and writes its unchanged v3 receipt. Otherwise City growth writes ledger {version:4,radius:4} and entry {version:4,releaseVersion:3,...cityAuthority}. The exact-key authority freezes development version, stage, recognition transition, last check, four service IDs and registry building/address. Restore compares any still-retained recognition transition, bounds older evidence against retained history and checks registry identity while allowing later decline, service loss or demolition. Schema version no longer implies radius five: v4 remains ring four, requires a paid v4 entry and rejects altered radius, release, authority, location, duplicate plot and survey/cost custody. Existing v1–v3 ledgers retain their bytes and geometry.

Exact off-channel draft geometry. major-offchannel-design.js derives candidate-off-channel-compartment-v1 from the released terrain and the exact existing rated/sectioned outlet. SELECT_MAJOR_WATERWORKS_OFFCHANNEL accepts only {proposalId,expectedProposalRevision,mode} with set/clear; authoritative source ownership, public authority, Hydraulic engineering, current title/site use and fully registered source-edge evidence apply. Selection replaces the shared-pool intake fields with offChannelDesign; every component has numeric and axial coordinates. The original v24-to-v25 migration introduces v1 without rewriting old terms/notices. Ledger26 additionally supports distinct raised v2 geometry while preserving each existing family. Current review exposes candidate/selected geometry; legacy shared-pool impact results cannot stand in for an off-channel replay, and legacy operating-notice filing remains rejected. Disconnected preparation uses its separate source-only notice. No reservoir asset or water is created. See the construction, kernel and useful-delivery checklist.

Historical retention with existing outlet receipts. major-waterworks-impact.simulate accepts recorded engineered requests as its final argument. It uses basin-water.requestFromReceipt to bind retained positive receipts, reserves receiving-node capacity, applies ordinary losses, invokes the shared pure transfer kernel, then routes natural spills. Engineered legs remain separate from ordinary transfer maps and contribute to node incoming/outgoing balances. Sediment replay traps proposed captured inflow, applies engineered transport with explicit zero-mass receipts, then ordinary transfers/exports. Whole-window comparison requires coupled sediment evidence whenever it contains a positive operating receipt. Exact baseline water, routes, receipt identity and beds must match; an unknown attempted request is never invented from a cancelled or dry operation. A missing attempt that changes bounded-node routing therefore remains unavailable under the exact-match check.

The proposed branch freezes recorded caps, floor/head limits and ticks, recalculating physical amounts from changed water and bed displacement. engineeredScenario identifies this conditional model; per-interval engineeredFlows exposes observed/proposed water and sediment, including candidate zero flow. This does not predict new requests, reauthorize historical consent, shorten history or move live custody. Legacy engineered: null retains its unobserved meaning. No save schema changes are needed. Live off-channel storage/containment and durable natural-basin exclusion remain implementation work; the explicit read-only forecast now models their hypothetical boundary separately.

Renewable stock identity and migration. resource-stock-identity.js owns root stockCoordinateVersion: 1 and exact per-row coordinateVersion: 1 / cellAxial: {q,r}. Authored Tidebreak, coastal-founding and coastal-outpost creators supply these fields. Restore no longer merges absent rows from initialResourceStocks. Preparation checks canonical key/cell/address equality, shoreline suitability, bounded quantity, recovery parameters, clock, status and revision. Full validation after founding/outpost initialization requires the exact authored and established source set, immutable source parameters and recovery clocks no earlier than establishment; habitat observation remains separately validated by fish-habitat.

A complete numeric-only family upgrades only if its root marker and all per-row address fields are absent. Missing or partial current metadata, missing stocks, extra identities and altered provenance reject. Entirely absent stocks may initialize only in the explicit source state/simulation 1/1 format without a stock marker or resource-use evidence. Migration adds addresses without advancing recovery or altering fish, habitat, inventory, production or jobs. The existing gateway startup transaction persists validated additive upgrades before accepting clients. Known fish-use evidence includes retained imports, warehouse movements, production, dated cargo/trade and observed project records, even when the current inventory is empty. Future renewable kinds, creators or durable fish ledgers must be added explicitly to the expected-set/evidence rules. The new metadata is excluded from existing outlet opening/dependency fingerprints, preserving those certificates. General coordinate migration and full M0–M8 acceptance remain open. See living world design and implementation status.

Capital-origin satellite material acceptance. The command-only QA continuation now founds and supplies a clay satellite from the actual earned-100 capital origin, accounting for later death, maturation and transfers. Camp assembly spends forty of the dispatched sixty timber and two of four tools; further physical supplies fund the fifty-timber/fifteen-food/one-tool pit. Twelve extracted clay reduce the finite deposit 240→228; two independent paid legs deliver eight to home, where eight clay/three logs produce six bricks and an eight-timber/four-brick/one-tool repair restores headworks 0→100. The collection leg agrees between one offline catch-up and twenty-four due-time steps, and the final snapshot restores exactly. No grants or lifecycle rebasing occur. This proves a first paid material/recovery cycle, not uninterrupted service or recurring sustainability; see implementation status for evidence and final reserves.

One-pulse outlet commissioning. major-outlet-connection.js owns version-one majorOutletConnections assets/history. Paid whole-unit work removes receiver then source plugs behind closed controls; old footing/channel/control receipts stay immutable. major-outlet-commissioning.js owns version-one majorOutletOperations connections/history and paid four-person operator jobs. An early book check runs before basin receipt validation; full physical, operator, consent and receipt validation follows proposal/construction initialization. Missing both markers migrates an empty book; partial or unknown versions reject.

FUND_MAJOR_OUTLET_CONNECTION, DISPATCH_MAJOR_OUTLET_OPERATORS and AUTHORIZE_MAJOR_OUTLET_PULSE cost one attention each and bind source authority plus world/proposal revision. Physical recalls bind job revision. Grant/withdraw consent binds the exact review fingerprint and a named community's current public steward. Operator dispatch reserves 2 timber, 1 tool and actual route meals plus fourteen station days; setup invests materials at the dry source control. Connection and operator spending use distinct root-budget categories. No read or migration moves water.

The separate major-outlet-impact.review clones hydrology into closed/open branches. A release is eligible only when the complete changed water and bed displacement closes within twelve intervals, with no unresolved exports or adverse modeled fish, ecology, improved-land or structure effect. It inventories all changed source and receiver coast crossings, affected holders and the bounded public-commons reach. An exact source authorization plus all named holder grants covers only one scheduled request up to 1,000 subunits. The certificate independently freezes the entire physical alignment in basis.corridorTitles: each cell is source-chartered or unassigned under the retained exact public-works licence. Dispatch, authorization, each interval and command reservations reject later foreign title or a changed basis; historical restore validates every retained title row against its licence. The impact catchment union alone does not establish corridor rights. Dynamic hydrology fingerprints omit unrelated inventory/people and raw wear clocks while retaining hydraulically relevant thresholds; stable dependency fingerprints bind routes, weather, rainfall registration, modeled stocks and tenure. Relevant pending work blocks quoting; command transactions reject changes to the reserved reach until closure or withdrawal. Physical job reservations are reach-scoped, but opening-state invalidation remains deliberately broader across all registered hydrology. A disconnected registered basin change may cancel an otherwise independent pulse; this is a conservative current limitation.

surface-water.advance asks commissioning for a validated request before physics and verifies the resulting interval afterward. basin-water.advance(e,at,requests=[]) debits finite post-loss source water and credits its distinct receiver before natural spills, constrained by source floor, closing heads and section ceiling. Sediment moves at most floor(water/100) available bed units. A positive receipt consumes the asset's one-test allowance. Gates close within that interval; subsequent exact observation records completion or incident. Operators then walk home and unload unused supplies. Station checks, route holds and partial unloading emit durable world events so the gateway commits changed meal clocks and custody between water intervals. The public map exposes component, plug, closed-gate and measured test state without private cargo.

Water version six and sediment version three add engineeredTransfers and routeWindow.engineeredStartTick. Migration creates empty cumulative custody and marks existing route rows engineered: null, preserving all old physical quantities. New rows use an observed array, empty when no transfer occurred. Partial markers, inconsistent identities, water/sediment mismatches and nonconserved receipts reject validation. Existing natural transfer maps and sample shapes remain unchanged. major-waterworks-impact.history and replay now include exactly bound positive operating receipts and coupled sediment as described above. Neither drops an operating crossing to manufacture a verified reservoir scenario.

Remaining operating boundary: Ordinary reservoir water signatures still expire with their fourteen-day notice; construction renewal does not extend them. The separate commissioning consent covers one finite pulse only. Continuing outlet service, new-operation reservoir forecasting, physical intake/storage, maintenance and removal remain unimplemented. Outlet-only testing must not be presented as stored irrigation supply.

Sealed outlet controls. major-outlet-controls.js owns majorOutletControlsVersion: 1 and {version,nextId,controls,history}. Only absence of both root fields and all control jobs initializes an empty ledger; partial/unsupported state rejects. FUND_MAJOR_OUTLET_CONTROL takes {proposalId,expectedProposalRevision,role}; RECALL_MAJOR_OUTLET_CONTROL takes {jobId,expectedJobRevision} through normal source authority, revision and idempotency. Funding costs one attention point, commits four workers and debits exact stock under knowledge/root budgets. Budget restoration accepts footing, channel, permit, control, connection and operator spending kinds.

Certificates bind the completed channel, historical exact notice/geometry, expiring authorization and independent endpoint/worksite title bases. Source worksite is alignment index one behind the intact plug; receiver worksite is its endpoint. Numeric cells carry exact axial pairs. Restore validates routes, workday timing, funded prefixes, prior investment, whole-unit receipts and material/meal conservation. It rejects overlapping control trips and overlap with retained footing/channel crews. A single captured funding time binds creation and payment even with a moving real clock; fractional warehouse credits remain valid custody during partial unloading. Work receipts retain their physical crew records; non-investing returned history is bounded. Current rights, service, hazards and site use are rechecked while outbound/working. A wet basin endpoint is never a dry crew route.

Private outletConstruction.controls contains role quotes/progress and active custody. Public majorOutletControls contains only component id, cell, role, status, work counts, closed gate and zero water; public jobs retain the route/position allowlist. Labor, feeding, catch-up, occupancy, subscriptions, regional exceptions and maps include control jobs. Old footing/channel schemas remain unchanged. Permit renewal checks every current alignment title and remains available until both controls and closed-gate connection work are complete. No read, migration or work unit changes basin water. See player guidance and major waterworks plan.

Structure and planned-site coordinate custody. structure-coordinates.js uses root structureCoordinateVersion: 1. Every structure, including ruined and cleared, has coordinateVersion: 1, anchorAxial and ordered footprintAxial alongside anchorCellId / footprintCells. Every persisted district step has the same metadata beside cellId and a newly frozen numeric footprintCells. Exact integer q,r objects must inverse-resolve through cellIdForAxial. Saved footprints must equal the catalog geometry for the saved integer orientation 0–5 and remain wholly in the structure/plan settlement's region. Only cleared structures are excluded from occupancy conflicts.

Structure-bound construction/rebuild/repair/demolition/salvage, develop-village / local-charter work and non-null-structure landVersion: 1 jobs have cellCoordinateVersion: 1 / cellAxial. The selected cell must equal the linked anchor, except maintain-terrace, reinforce-terrace, terrace-spillway and maintain-drainage, which may address a non-anchor footprint cell. Construction equipment loans, held returns and history carry independent point addresses and must match their retained structure's anchor. The central job creator stamps only this family; military, travel and unrelated land work keep their existing schemas.

Restore prepares this family after charter regions and settlement reconstruction, before downstream job/district/equipment validation. A missing root marker upgrades only when all new family fields are absent, including district footprintCells; it preserves every prior value except deriving an absent legacy structure settlement reference from its actual region. Current marked records cannot regenerate missing evidence. Founding, construction, outpost establishment and replacement camps create metadata immediately. District scheduling validates the frozen site before funding; attempts must match its anchor, orientation and footprint. The gateway durably commits validated additive migration before accepting clients, without advancing time or changing paid work, stock, workers or condition. Broader map/job coordinate migration remains open. See living world design, implementation status and player guidance.

Household journey coordinate custody. migration.version: 9 covers the household source, journeys, transfers, travel deaths, route relief and their cross-ledger copies. household-coordinates.js supplies cellCoordinateVersion: 1 / cellAxial for the source and point receipts and routeCoordinateVersion: 1 / routeAxial for journeys, transfer routes and death routes. A historically absent transfer route has routeAxial: null; an undelivered relief pledge has cellId: null and cellAxial: null. No historical location is invented.

Before any version-one-through-eight upgrade, population.initialize rejects new address fields anywhere in that family. It then performs the existing numeric migrations and validation and adds addresses only to wholly unmarked version-eight data. This occurs before logistics initialization and full community-birth validation. Household-linked adult.mortality uses journeyId; outpost transferId, stationary deaths and military death records keep their separate schemas. Active and completed caravan householdRelief copies must agree with the corresponding retained transfer relief receipt, and completed history belongs to the actual village rather than the frontier endpoint. Receipts may outlive the bounded completed-caravan history.

Every address has exactly integer q,r keys and must resolve through cellIdForAxial to the saved numeric cell. Existing route orientation, death route/index/location and transfer validation still apply. Both reviewed recall and automatic turnback update numeric and axial arrays together. Startup commits the validated additive snapshot before accepting clients; the migration does not advance time, transport a person, spend food or alter current route position. See living world design, implementation status and player guidance. General map/entity/job coordinate migration remains open.

Exclusive local storage ownership. world-storage-lease.js resolves the world directory (or an uncreated world's parent), then atomically creates its sibling .<world-name>.writer-lock-v1 with wx. The claim records version, random nonce, PID, hostname, purpose and acquisition time. Canonical paths are used for both locking and persistence I/O. Writes verify the retained claim; release checks file identity and owner nonce. Same-path and junction aliases are covered; arbitrary mapped-drive/network namespace aliases and distributed fencing are not claimed. Empty, malformed and stale claims all prevent a new writer. An operator may remove the exact claim only after verifying that the former process has exited; age or PID alone never triggers automatic removal.

PersistenceStore.prepare() holds ownership while strictly loading without creating world files. Gateway domain validation precedes activate({deferTimers:true}), which creates storage directories. The validated migration commits before gateway setup completes and startTimers() begins background saves. The start() convenience method performs prepare/activate for direct callers. Explicit phases reject duplicate starts and post-close mutation; close/abort coalesce, drain in-progress initialization and queued writes, and release ownership. Abort writes no checkpoint. Failed startup cleanup retains the original error alongside any release failure. All partition writes settle before a failed batch finishes, so no append can continue after ownership release. Live-writer durability probes use the unlocked read-only loader only after awaited appends; it is not a consistent concurrent backup or fork API. world-fork.js is the separate purpose-built offline path.

Gateway cleanup covers world restoration, migration, WebSocket and worker setup. Normal close stops admission and new requests, drains accepted work, removes and persists clients synchronously, terminates simulation workers and checkpoints storage. It waits for WebSocket closure and terminates a nonresponsive socket after one second; delayed close handlers cannot write after storage release. The server waits for both gateway and HTTP close, with a one-second HTTP connection fallback. Signals during startup wait for initialization cleanup; repeated signals do not force an early successful exit. A failed port bind also closes the initialized world. The explicit offline fork workflow is implemented below; damaged-journal repair remains planned. See multiplayer recovery.

Offline world forks. Stop the source server, then run npm run world:fork -- --source <existing world-v6 directory> --destination <new world-v6 directory>. forkWorld resolves canonical local paths, acquires both source and destination leases in stable order, rejects existing or overlapping destinations and strictly materializes the source through readPersistedWorld(source, {strictFormat:true}). A current complete event-only source is intentionally accepted. If world-snapshot.json exists, its version-one envelope must contain exactly version, writtenAt, players, mutations, worldManifest and livingWorldState; extra or missing fields reject. The materialized manifest/state must already be current, identified and deeply equal to the snapshot/manifest of a ZoneEngine restored from that state at its saved updatedAt clock. The tool performs no implicit domain migration; start and checkpoint an older compatible save with the current server first.

The canonical source digest recursively key-sorts the materialized players (by token hash), mutations (by key), manifest and living state and hashes them with SHA-256; persistence watermarks are excluded. The child preserves gameplay and economy state, player records and reconnect-token hashes, mutations, active jobs and cargo, and durable command receipts. It receives a fresh gonz-instance-v1 ID plus matching worldForkProvenanceVersion: 1 markers and worldForkProvenance objects in manifest and state. The exact provenance keys are rootInstanceId, parentInstanceId, generation, sourceRevision, sourceDigest and integer forkedAt. A native unmarked source remains unchanged and unmarked. A child uses the native instance as root and parent at generation one; each fork of a fork retains the root, points to its immediate parent and increments the generation. Source bytes and modification times remain exact. The digest is reproducible evidence, not an authenticity signature. Native worlds omit both provenance fields. Restore, initialization and commit reject malformed, missing or changed ancestry and a source revision ahead of the saved child revision. Restoration validates the persisted child rather than the unused fresh template's revision.

The tool stages and re-reads a canonical child snapshot, creates a sibling .<world-name>.fork-pending-v1 marker, exclusively creates the destination, creates an empty events directory and publishes the snapshot with an atomic no-replace hard link. It copies no raw source journal. This requires a local filesystem that supports hard links. A gateway refuses a pending marker, so a crash cannot turn a partial fork into a fresh world. An existing destination, including an empty directory, is never overwritten. Failed publication removes only the verified snapshot, event directory, destination directory, marker and stage files owned by that attempt; it never recursively removes a world. If ownership or file identity cannot be proved, cleanup stops and leaves the marker for explicit operator recovery.

The child gateway accepts the preserved reconnect token and player identity under the new instance. A request carrying the parent instance receives WORLD_INSTANCE_MISMATCH without changing player or world state. With the current child session, the same actor can query an accepted receipt preserved from the parent. The implementation provides an offline independently identified continuation, not a concurrent backup, distributed filesystem claim, damaged-journal repair or fsync/power-loss guarantee. The authoritative combined regression in .qa-city/world-fork-regression-final.txt passes 58/58 cases: thirteen fork cases and forty-five ownership, persistence, identity, migration, protocol and real-gateway prerequisites. See offline world forks, living world design, gameplay foundations and implementation status. Remaining coordinate custody, continuing satellite material supply beyond the verified first cycle and the full M0–M8 objective remain open.

Transaction checkpoints and recovery. PersistenceStore.commitLivingWorld clones a proposed transaction, appends it separately to events/world.ndjson on the write queue, then publishes its manifest/state and coupled player. It does not put uncommitted state into a snapshot or combine acceptance with best-effort player/chunk appends. A newer queued or concurrent player update is retained. writeSnapshot captures its payload only after preceding queued operations settle, writes a temporary file and renames it. Its returned promise rejects on publication failure; graceful server shutdown reports failure and exits 1. Periodic failures are logged without an unhandled timer rejection.

Event timestamps advance beyond both the previous event and successful snapshot boundary; snapshot capture also reserves its boundary before awaiting disk. Thus a later same-millisecond update or a command queued behind a snapshot survives restart. readPersistedWorld is a read-only streaming loader used before startup creates directories or timers. It validates supported wrappers/events, record shape, paired instance identity and a bijection between saved tokens and numeric players. Malformed/truncated JSON, unsupported event types, duplicate snapshot keys and account aliases reject loading. No fallback fresh world or tail truncation occurs. Domain validation and additive migrations still follow in ZoneEngine before clients are accepted. Gateway startup now uses the preparation/activation ownership lifecycle above, with startTimers() only after validated restoration, migration and setup succeed. abort() drains the queue without flushing or snapshotting after a failure, preventing an embedding process from checkpointing rejected state later.

Legacy replay retains the earlier watermark rule (event.at > snapshot.writtenAt). World commits follow physical journal order. Within a metadata file the later line wins; across partitions the greater timestamp wins, with explicit player records taking precedence over embedded world profiles at equal times. The root world-events.ndjson format predates events/, so partitioned metadata supersedes root records even across clock rollback. The loader returns the greatest observed event clock to keep subsequent writes monotonic. These rules preserve known legacy ordering without inventing chronology that older saves never recorded. Tests include real failed appends/checkpoints, immediate restarts and actual corrupt-save server startup. The offline fork path above is implemented separately; deliberate repair and power-loss durability remain outside this transaction-recovery slice. See multiplayer architecture.

Protocol 3 session authority. Each welcome carries session: {version:1, worldInstanceId, actorId, epoch}; epoch is a fresh random 128-bit hexadecimal value per successful hello, including resume and restart. It is not persisted. All post-hello JSON requests must carry the exact current binding, and ready-client JSON responses echo it. Gateway dispatch checks that the client is still registered under its token and player, is not removed, and has an open socket. Queued mutations, city projections, outpost quotes, forecasts and receipt queries repeat this check immediately before execution. A valid foreign instance yields WORLD_INSTANCE_MISMATCH; missing, malformed, wrong-player or obsolete session bindings yield STALE_SESSION. Revoked clients are ignored. The replacement welcome and initial private snapshot wait in the same transaction queue; no ready-client JSON is sent before welcome. Movement broadcasts also skip unwelcomed clients entirely, without updating their peer or entity baselines, so neither binary frames nor lost presence names precede welcome. A failed append therefore rolls back before the new client sees its first overview. A command already executing is allowed to finish its atomic durable commit; a new current session can query that player's receipt. Existing receipt actor checks, bounded retention and command idempotency still apply.

The browser sends the binding centrally, rejects control messages from an obsolete binding and ignores all frames/open callbacks from obsolete sockets. City proposals capture the session and character; an interregnum's explicit null character remains distinct from switching to a successor. A new epoch clears reviews and read requests/comparisons, while ordinary same-world/player drafts require a new review. World/account change reloads the client so closure-local drafts and private caches cannot cross scopes. gonz-city-pending now stores a scoped record. Recovery validates world and player, discards legacy/unmatched records, and queries with the new epoch without replaying the command. A server 4001 replacement or 1002 protocol failure stops automatic reconnect and asks for an explicit reload. No living-world or receipt migration is needed; protocol-2 browsers/load clients must update. See multiplayer architecture and living world design.

Mineral satellite topology: satellite-outposts.js validates the bounded root → developed direct village → mineral satellite tree. outposts.administration reports mode, rootId, capacity and blockers; a direct developed sponsor has at most one retained child, including an evacuated title. New founding/reoccupation needs the local charter, operational dry center, active record-keeping/land-registry and staffed sound registry. New founding uses a released mineral parcel and no more than twenty-four walking edges. Existing founderWorkforce, survey/charter, food, route and storage checks still fund and transfer the actual cohort.

outposts.satelliteVersion: 1 migrates a wholly unmarked direct network without changing gameplay fields. A founder's exact satellite object records version, rootId, sponsorId, localCharterGrantedAt, registryId, siteId and departedAt. The job, original resident transfer and retained link agree. Transfer purpose is classified from its active job, original link or an unestablished 8/6 founder destination independently of whether the certificate is present; recalled founders cannot lose provenance and reoccupation cannot acquire founder metadata. Existing service degradation is not rewritten into historical departure authority. Root traversal rejects cycles, mismatched parents/owners and deeper nesting.

outposts.rootHome and ownedNetwork let root operating and logistics limits include descendants while retaining immediate-route custody. regionalBudgetRouteVersion: 1 adds an immutable immediate sourceId to retained logistics receipts and routeVersion, sourceId and outpostId to funded-job references. Wholly unmarked old receipts migrate from validated direct links; partial or inconsistent records reject. Completed receipts still validate their immediate parent and founding root after the travelling job is removed. Founder dispatch freezes one departure clock for its certificate, job, transfer and cohort movement, then restores the live command clock. Manual supply still uses the immediate link; projection of a satellite at the root provides two dispatchSteps, requiresRelay: true and directPickup: false. The sponsor sees its ordinary direct pickup. Regional overview includes both levels and points route actions at the immediate sponsor. It does not merge inventories or grant remote spending. test/helpers/earned-satellite-outpost.js separately starts through the command-earned local-village/headworks helpers, builds the local institutions, relocates an actual household, founds a clay satellite, extracts twelve units and relays them through both paid links without direct test grants. A saved first-leg cargo escrow completes with equal material, population, labor, deposit, link and resident-transfer custody under live stepping, offline catch-up and resumed due-time stepping. Its smaller founding root and the controlled mechanics tests remain distinct from the still-open exact-100 capital provisioning/repair acceptance. See living world design, implementation status and player guidance.

Ordinary work-journey axial custody: regionalRoads.routeCoordinateVersion: 1 covers active road jobs, every saved edge's ordered route and returned history. quarryLeases.coordinateVersion: 1 and routeCoordinateVersion: 1 cover exact lease-site siteAxial addresses and crew/receipt routes. husbandry.routeCoordinateVersion: 1 covers both collection and relocation; jobs and receipts carry routeCoordinateVersion, routeAxial, destinationCellId, destinationCoordinateVersion: 1 and destinationAxial. watershedSurveys.routeCoordinateVersion: 1 covers live teams and retained receipt routes, whose existing endpoint and corridor checks bind observations to those same addresses. Per-record route metadata uses routeCoordinateVersion: 1 and exact ordered {q,r} objects. Restore checks every address against its numeric runtime cell; route indices remain unchanged.

Each ledger migrates only when its coordinate markers and all covered record fields are absent. Migration adds addresses to the saved numeric routes and sites, never replans a route or grants goods. Marked-but-incomplete, malformed, unsupported or mismatched data rejects. Road edge construction/repair and all new dispatch paths author coordinates; the five covered journey families currently keep their dispatched paths through return. Existing rights, adjacency, food/cargo balance, labor, material and receipt validation still applies. Public projections retain their existing field allowlists. This is partial M0 custody, not support for remapping the atlas or arbitrary world expansion.

Startup migration durability: After constructor validation, the gateway compares the complete restored snapshot with the loaded snapshot and writes a durable empty-event commit if any migration changed it, or if the world instance is new. This happens before WebSocket acceptance and before simulation timers. A compatible already identified save therefore retains journey-address upgrades after an immediate event-only restart; no gameplay action or graceful shutdown is required. Seed, generator/checksum, instance identity and ordinary save compatibility checks still apply. See multiplayer architecture.

Physical major-outlet footing: major-waterworks-construction.js owns root majorWaterworksConstructionVersion: 1 and the separate {version,nextAssetId,assets,history} ledger. FUND_MAJOR_OUTLET_CONSTRUCTION targets the source home and carries {proposalId,expectedProposalRevision}; RECALL_MAJOR_OUTLET_CONSTRUCTION targets that same home and carries {jobId,expectedJobRevision}. Both use ordinary world/target/character authority and idempotency. Each new paid trip charges one attention point. The funding quote checks current exact notice currency, returned ordered corridor evidence, paid revision-specific target licence, active Hydraulic engineering, dry target/use and own-or-unchartered walking access, four free workers, real stock/food reserves, spending limits, load capacity and the remaining permission window. Licence issuance retains its existing civic-service prerequisites; already issued rights do not disappear when those two registration programs stand down.

Assets freeze historical certificates and numeric/axial geometry separately from live access checks. The first target is the penultimate interior alignment cell, with source and receiver plugs retained. Foundation materials are invested through saved stage receipts, not debited again on restore. Partial work remains an occupied footprint; fresh exact rights may reauthorize matching geometry while retaining original certificates and investment. Referenced proposals are pinned against withdrawn-draft trimming. Carried, invested and returned materials and paid/consumed/returned/unmet meals remain distinct. Jobs reserve the crew in labor, civilian eligibility and travel-food accounting until physical unloading. Route holds consume carried meals; no cancellation teleports goods home or refunds completed work.

City receives the private per-proposal outletConstruction projection. Public chunk majorOutletFootings contains only asset id, cell, visible status, disconnected state and zero water moved; public jobs omit cargo, meals and certificate details. The map paints a dry footing rather than a live channel. Public snapshot subscriptions also include retained or currently funded footing chunks outside charter regions; this changes visibility, not land authority. Owners receive newly funded footprint deltas, while public jobs continue to omit private custody. Regional exceptions and factual construction briefings link back to Land & water. Live basin water is not changed by this module. The separate dry-channel ledger below supplies support/fill and successive interior sections. Verified hydraulic capacity, full impact and water permissions, intake and endpoint commissioning, connected operation, maintenance and decommissioning remain unfinished gates. See living world design, major-waterworks plan and player behavior.

Supported dry outlet interior: The construction module also owns the additive majorWaterworksChannelVersion: 1 ledger and majorOutletChannelVersion: 1 jobs. FUND_MAJOR_OUTLET_CHANNEL takes {proposalId,expectedProposalRevision}; RECALL_MAJOR_OUTLET_CHANNEL takes {jobId,expectedJobRevision}, both at the source policy target with ordinary authority/revision/idempotency checks. Existing footing certificates, paid jobs and receipts remain valid; migration adds an empty channel ledger only when its marker, ledger and channel jobs are absent.

RENEW_MAJOR_OUTLET_CHANNEL_PERMIT takes {proposalId,expectedProposalRevision,expectedAssetId} at that same source target. It requires the crew to have returned and unloaded, current Hydraulic engineering/Public accounting/Land registry services, unchanged exact design and notice evidence, and the existing paid corridor licence. It charges that licence's actual fee through stock, reserve and spending checks (32 timber and 16 food for the surveyed Basin strip), plus one attention point. Each renewal grants fourteen village days from issuance; unused time does not stack. It neither increments the design revision nor changes the original notice deadline. Changed design, surveyed evidence or tenure still requires ordinary amendment and new exact rights. Current construction access accepts only the source's own title or the exact released public corridor; foreign signatures are not a substitute for this narrower permit.

The separate majorWaterworksChannelPermitVersion: 1 marker adds ordered immutable authorizations, paid permit receipts, nextAuthorizationSequence and currentAuthorizationId. Jobs and invested-unit receipts pin an authorizationId, so repeated windows on one design revision remain distinguishable. A wholly unmarked earlier channel ledger receives explicit IDs for its original noticed authorizations without buying or extending any right. Migration first checks the untouched original primary certificate and strictly increasing unique notice revisions; certificates are compared by exact values and keys without depending on JSON property order. Partial permit metadata, a mismatched primary or ambiguous revisions reject restoration. Historical payment and geometry stay separate from present access and expiry checks.

The exact paid profile fixes the receiver-first interior cell list, support/cut height deltas and depth/width work units. Each whole support-fill unit costs one timber, one brick and two dressed stone; excavation costs one timber and one tool; bed preparation costs one timber, one brick and one dressed stone; lining costs three bricks, one dressed stone and one tool. Every unit takes a village workday. Funding chooses an ordered tranche for one cell within 120 carrying weight including meals and the current construction authorization window. No first-footing material is converted to new support or lining. If the original exact footing already excavated a cut at this same geometry, its completed cut units remain explicitly linked and are not charged again; new preparation above raised support remains payable. Exact geometry, rights, stage receipts, material/meal balances, accepted payment and physical travel remain separately validated historical evidence.

The common labor, household eligibility, daily travel feeding, catch-up, occupancy and event/persistence paths include both job families. Private City outletConstruction.channel gives section progress, the next quote, crew custody and blockers. City and accepted funding/renewal results use compact asset and authority summaries, with per-cell receiptCount; the full historical certificates and unit receipts remain only in authoritative state. This prevents both repeated network transfer and amplification through saved idempotency receipts. Its plan totals materials and work for all unfinished physical units, separately from the older preliminary reservoir allowance; travel meals and future permit fees are excluded because each trip and later authorization is funded separately. plan.currentSiteConflicts applies the same site-use checks to unfinished sections and returns only cell/alignment position plus the current blocker text. It gives early warning of structures, land works or other orders without reserving a future site or weakening the funding-time check. Public majorOutletChannels contains only built or currently funded exact targets with a unique footprint id, cell/alignment position, visible status and stage counts, dry-section kind, disconnected state and zero water moved. It omits account identity, cargo, meals, certificates and private stock. Public subscriptions include these remote chunks without granting charter authority. The complete dry interior is deliberately separate from endpoint/intake construction or any hydraulic certification; reads, migration and building move no basin water.

Finite-deposit coordinates and migration: deposit-identity.js owns depositCoordinateVersion: 1 on the root and exact coordinateVersion: 1/cellAxial: {q,r} pairs on every authoritative deposit. ZoneEngine.initialDeposits and frontier-sites.establishDeposit create addresses. Restore preserves the original state/simulation versions before upgrading them, then prepare validates record shape, key/cell/address agreement, bounded quantity/status/revision and starting-seam presence. Existing frontier validation delegates to the centralized full expected-set check after outpost links are validated, before the constructor returns. It compares all generated starting and linked frontier provenance, including evacuated links, and rejects unknown or missing rows. Complete ledgers migrate only when the root marker and every row address pair are wholly absent; no quantity, history, inventory or job is changed.

Pre-deposit and durable upgrade boundaries: Only an absent ledger in original state/simulation version 1/1, with no coordinate marker or extraction evidence, may initialize starting seams. Evidence includes any extractor structure (even cleared), extraction/reclamation job, frontier link, quarry agreement, reclaimed plot or stored raw mineral. A present incomplete ledger, a modern absent ledger or partial coordinate metadata rejects. test/living-world.test.js replaces its former exhausted-state resurrection expectation with rejection and separately tests this narrow legacy format. The gateway commits coordinate migration before creating the WebSocket server, even for a world already carrying its stable instance ID. Existing numeric keys, geography checks, resource amounts, survey disclosure, lease rights and physical extraction rules remain unchanged; general entity/map/job coordinate migration remains planned.

Persistent hosted-world identity: world-identity.js creates cryptographically random 128-bit gonz-instance-v1 IDs. Root state and manifest both retain worldInstanceIdentityVersion: 1 and worldInstanceId; ZoneEngine adopts the saved pair, rejects disagreement with a supplied ID, and adds the pair to older snapshots only when both fields are absent. Persistence requires both manifest/state records and either matching valid pairs or complete absence in both. A new candidate snapshot must also match its manifest. The gateway adopts the durable ID before generating its compatibility manifest, then durably commits a newly assigned pair before creating the socket server. Commit timestamps are greater than the loaded snapshot timestamp, preserving replay at an equal-clock boundary. The welcome and health response expose world.instanceId; world.id and world.generatorNamespaceId remain the deterministic seed namespace. Existing charter bindings and numeric cells are unchanged. Copying an identified save keeps the same logical world. The explicit offline fork path creates the distinct instance and durable lineage described above; protocol 3 binds every request to the selected parent or child world. See living world design and offline world forks.

Earned City growth and material interval: Normal city-integration.test.js runs complete city-hundred-growth.prove, then city-material-equilibrium.prove. Growth checks population 100, labor 44, six births, three actual maturations, 17 arrived workers, exhausted source workers, paid titles, unchanged grants and restored state. The 120-day continuation uses ordinary source targets, paid startup collections and staged Governor authorization, then issues no player commands. Daily checks retain all City capabilities, water 108, no food shortfall and four protected repair workers. Seven repairs spend 56 timber, 28 bricks and seven tools; refining, freight and forestry replenish consumed stock. Clay falls 72→32; the exhausted ore seam stays zero while stored ore falls 102→72. Bulk catch-up compares all gameplay state. World/settlement/chunk revision increments are checked against actual committed transactions; only new briefing recordedAt observation times may differ. A day-60 save replayed over identical daily boundaries must match the full final snapshot. This is bounded acceptance, not perpetual mineral supply.

Fulfilled-target workshop capability: city-projection.productionStatus retains public waiting status and its target reason, and adds read-only batchReadiness: {ready, targetSatisfied, reasons}. It calls productionMandates.status with ignoreStockTarget solely for this latent capability check. Recipe, accounting, pause, source reserve, production allowance and all physical/input/operating-budget/storage blockers remain. settlement-development.assess accepts ordinary ready production or a target-satisfied, otherwise-ready batch after its operational, condition-65, staffing and no-job checks. The production loop still respects the target. These reads change no save schema, stock, allowance, rate or output.

Earned water-and-title integration: Normal integration passes the unmodified regional-capital-next-material-loop.materialReturn into complete city-hundred-growth.prove. Optional first-well and registered stops remain diagnostic checkpoints. Actual demolition, salvage, surveys, refining and paid construction create three staffed secondary wells and seven registered frontier plots. Three old-age deaths reduce labor before six births and finite physical migration bring the community to 100 residents. Only three births mature during the proof, each after at least 432 village days. Restoration retains all titles, wells, people and inventories. Required institutions are restored after construction, and the 120-day helper verifies subsequent recurring maintenance in the same integration.

City acceptance fixture provenance: secondary-well.test.js earns the initial well build/repair sequence, then supplies expansion timber and tools directly for its isolated housing, household-water and later freight checks. It is not a founding-to-100 material-economy acceptance test. The full command-earned material checkpoint comes from the City integration journey and its regional-capital growth/material helpers at 64 residents. Further actual housing, food, sanitation, water and migration to 100 plus a sustained repair interval remain acceptance work; direct fixture stock must not count as earned production.

Coordinated Governor freight: regional-governor-plans.validate/apply accepts APPLY_REGIONAL_GOVERNOR_PLAN only at the lawful founding home's anchor with a current world revision. The exact top-level payload is {rows}; two or three distinct established owned outposts each supply an exact {outpostId, revision, action, payload} row. revision is the destination anchor revision. An authorize payload contains every supported ordinary Governor setting explicitly, without a second outpostId; omitted optional settings reject rather than defaulting or inheriting old terms. A pause payload is empty. Existing governors.configure/pause enforce services, route limits, retained spending and paid-trip rules inside the engine transaction, so a later failure rolls back all earlier mandate updates and events. Pause does not require restored Governor services. No new save ledger or migration is needed. The WebSocket envelope is bounded at 16 KiB: three fully specified route budgets exceed the previous 8 KiB, while all existing semantic limits remain unchanged. regional-governor-plan forecasting validates the same rows and executes the same command in the copied engine, then reports each route's prior and new spending/dispatches, ending state and daily decisions alongside the baseline regional warehouses and workforce. Live stock, events, mandates and jobs remain unchanged by comparison; the exact proposed order must still be confirmed. Focused tests cover atomic rejection, service-loss pause, paid-trip preservation, save restoration, shared-worker competition and forecast/live agreement. This does not establish long-run City resource equilibrium. See living world design, interface behavior and player guide.

Active caravan route coordinates: The version-1 logistics ledger has routeCoordinateVersion: 1, and every active caravan stores routeCoordinateVersion: 1 plus ordered routeAxial pairs. logistics.setRoute clones numeric steps and derives exact {q,r} addresses at both waystation and bilateral dispatch and whenever Scouting replaces a live route. Restore requires equal route/address lengths, exactly the two address keys, and cellIdForAxial(q,r) === route[index], followed by the existing endpoint, adjacency, phase, food and cargo checks. An absent ledger marker migrates only if every active caravan lacks both fields; incomplete unmarked records and missing or altered current addresses reject. Migration grants no stock or transport benefit and preserves the current index, cargo, escrow and provisions. Numeric movement, road timing, equipment, draft-animal loans and escort checks still use the live path. A loan's original funded route and an escort's original consented route remain separate; the militia's live axial path follows the changed caravan route. Completed history has no route to migrate. Focused tests verify both creators, legacy physical completion, corruption rejection and fire/flood detours. See living world design, gameplay foundations and player guide.

Known-hazard waystation dispatch: logistics.quote first obtains the released village-to-waystation route and any fortification-watch briefing. If the segment required for an ordinary exchange or household-relief meeting crosses known burning vegetation or recorded basin floodwater, active scouting may call expansion.dryRoute for up to 120 edges. Ordinary exchange searches to the depot. Targeted relief searches to the household's current interior hex with 120 - tail.length available edges, reviews the dry prefix for watch avoidance, then appends the original depot tail as fallback if the household moves before delivery. Only the required prefix must be clear; the complete funded route must still fit 120 edges. All later quote calculations, including provisions, carrying weight, animal feed, improved-road time, perishable arrival and market reservation, use that same selected route. Dispatch re-quotes before debit and saves its numeric steps on the existing caravan job. A missing service or dry path retains atomic rejection; later hazards still use the in-flight scouting detour or hold. The City quote flags the detour before review. Focused tests use a real adopted scout, both hazards, quote purity, physical finite-tool return, a held household before a sealed depot and restore of its conserved relief receipt. See living world design, gameplay foundations and player guide.

Defense and military route addresses: military.survey records routeCoordinateVersion: 1 and ordered routeAxial pairs on the surveyed corridor before it can fund patrols or guards. military.setUnitRoute records the same fields on each militia job. Recruitment, patrol, guard, mounted duty, escort start and caravan-follow detours, garrison assignment, relief muster and relief completion call it whenever the active unit route changes. military.dispatchSupply records the fields on each independent military-supply job. trade-escorts.access records the original recipient-consented route with the same address fields; caravan-follow detours change the live unit route without rewriting that accepted permission. The alliedGarrisons and militaryAssistance ledgers each have routeCoordinateVersion: 1, as do their records. Unsigned offers have null numeric and axial routes. Accepted watch and relief agreements keep ordered axial steps alongside the original numeric route even after physical return. A military age-85 death receipt records routeCoordinateVersion: 1, a nullable historical routeAxial, and cellAxial for its actual death hex; linked supply routes, garrison posts and copied peer permissions retain their own addresses. Separate defense.surveyRouteCoordinateVersion: 1, defense.unitRouteCoordinateVersion: 1, defense.supplyRouteCoordinateVersion: 1, defense.oldAgeRouteCoordinateVersion: 1 and defense.peerEscortRouteCoordinateVersion: 1 markers, plus the two agreement-ledger markers, migrate old numeric-only records only when their marker and all applicable address fields are absent; an unmarked partial record is rejected. Restore checks pairs through the bounded inverse cell lookup before the existing phase, adjacency, rendezvous, stock and death-ledger checks. Moving jobs still use numeric routeIndex; other historical military records, other job families and global map identity remain open. Tests cover the surveyed corridor, paid and permitted routes, accepted watches and relief, dynamic escort detour, home and field deaths, neutral migrations, forgery rejection and physical return. See living world design, gameplay foundations and player guide.

Held outpost resident-party issue: Regional overview treats an outpostVersion job in the founders, settlers, reoccupation or evacuation role with a fire or basin-flood next-hex blockReason as a resident hazard. It reads the home settlement's current scouting program, then targets research if inactive or expansion if active; an empty-provisions urgency retains its existing expansion target. The account-scoped read does not call outposts.advance or change custody. Supply jobs keep their separate established guidance. Tests dispatch real emergency evacuations, hold them at the first flooded step with and without Scouting, and verify target, affected site, unchanged snapshot and retained position. See living world design, gameplay foundations and player guide.

Reviewed resident departure routing: reviewedResidentRoute checks the ordinary released path for fire and recorded basin floodwater, then selects expansion.dryRoute with active home Scouting. reoccupationQuote and settlerQuote use the selected route for age, provisions, load and duration and reject a sealed path before debit or resident transfer. evacuationQuote runs the dry search from outpost to home and reverses it into the saved home-to-outpost route, which the existing homeward index traverses backward. It falls back to the ordinary route when a dry path is unavailable, preserving emergency departure. The read-only knownHazard result is true when that selected ordinary path crosses existing fire or recorded floodwater; City resident reviews show its emergency warning or a Scouting detour row for a safe alternative. Both quote and accepted job retain the selected path; existing job/transfer numeric and axial custody and restore checks apply without a new save version. Focused command tests cover paid detours, sealed elective rejection, hazardous emergency fallback and evacuation/reoccupation restore. A separate journey test advances a community-born adult through old-age death on an evacuation, applies a later flooded-next-hex detour to the survivor party, and restores the route-at-death receipt before arrival. See living world design, gameplay foundations and player guide.

Dry founder departure and resident-route history: outposts.founderRoute derives the ordinary released route, checks fire and recorded basin floodwater, and asks expansion.dryRoute for a bounded replacement only with active home Scouting. founderProvision uses that path for Supply chains planning when one exists; founderQuote prices rations, duration, load weight and worker age from it and enforces the extra-outpost distance limit. Dispatch re-quotes before debit, records numeric and axial steps on both job and population transfer, then consumes the claim. If no dry route exists, quote and command fail before mutation. A later hazardous next hex can trigger a Scouting detour for any outpost resident role. rerouteResidents snapshots the old route and axial cells into each prior death lacking routeAtDeath, then changes the active job and transfer routes together and marks routeHistoryVersion: 1. Restore requires that marker for historical routes and checks each bounded path, endpoints, axial steps and death cell/index. Older transfers without reroutes remain valid without new fields. The reroute check consumes carried food and does not move the party or repeat a transfer; no replacement leaves it held. See living world design, gameplay foundations and player guide.

Frontier-survey hazard routing: expansion.quote retains its ordinary released route unless a step is burning or has recorded basin floodwater. With knowledge.active(home, 'scouting'), it calls the same bounded dryRoute used by travel, prices provisions and duration from the chosen path, and rejects a sealed path before debit. On a newly hazardous next hex, expansion.advance can replace an outward route under active Scouting or a homeward route regardless of service; both replacements preserve the current cell, pair every new numeric step with routeAxial, remain at most 61 cells and consume the normal carried food at the check. Failed replanning leaves the paid team held with its old route. A carried report is not published until physical home unloading. This does not change rights, coordinate migration versions or the world-size limit. See living world design, gameplay foundations and player guide.

Blocked outpost-supply recovery issue: The account-scoped Regional overview read recognizes outpostVersion supply jobs whose blockReason begins with the fire or basin-flood next-hex hold. It checks knowledge.active(home, 'scouting') without changing the job. An inactive service appends the research/adoption/staffing route explanation and targets research; an active service appends the bounded next-check retry and physical-clearing explanation and retains the expansion target. The existing empty-provisions urgent branch keeps its expansion target. Outpost travel alone attempts expansion.dryRoute on due checks and keeps paid cargo and food in custody when no route fits. Tests exercise both branches with real paid teams and mocked recorded floodwater, plus read purity and restore. See living world design, gameplay foundations and player guide.

Bounded axial resolver: world-kernel.axialCellId(q,r,cols,rows) computes col = q + floor(r/2) and delegates range checks to canonicalCellId. ZoneEngine.cellIdForAxial uses its configured kernel dimensions, while naturalCellAt returns the generated cell or null. expansion.sameRoute and outposts.routeMatches now resolve each saved axial step to a numeric ID and require equality with the retained route. Tests round-trip ordinary and edge cells and reject fractional or outside coordinates. Existing seed/checksum gates, geography and numeric state keys remain unchanged; this is not a cross-size save migration. See living world design, gameplay foundations and player guide.

Outpost journey and transfer route custody: outposts.routeCoordinateVersion: 1 requires routeCoordinateVersion: 1 and ordered routeAxial pairs on every active outpost-journey job and retained population-transfer receipt. newJob records the address beside each numeric route step, transfer copies it, and the scouting reroute refreshes the job addresses when it replaces j.route. Restore migrates older records only if the ledger route marker and all applicable per-record route fields are absent, including a null route for pre-v2 completed transfers. routeMatches rejects malformed or changed pairs before existing adjacency, job/transfer custody and death-receipt validation. Movement still indexes numeric routes; other job families and global map storage remain open. See living world design, gameplay foundations and player guide.

Retained outpost link axial custody: outposts.linkCoordinateVersion: 1 marks siteAxial on each retained outposts.links[outpostId] entry. activate copies the founder job's validated axial destination when it creates the region and link. On restore, outposts.initialize migrates a numeric-only link only when the ledger marker and every link coordinate field are absent, then compares siteAxial with the released site's center and the existing outpost anchor check. Partial or mismatched data rejects. supplyQuote and reoccupationSite also check the link before new trips. Evacuation leaves the address in place; identifiers, route arrays and transfer history remain numeric-backed. See living world design, gameplay foundations and player guide.

Conditional title and founder-site axial custody: expansion.claimCoordinateVersion: 1 requires exact q,r siteAxial on each conditional charter; expansion restore derives it from siteFor only for an unmarked numeric-only claim and rejects partial or altered fields. outposts.founderSiteVersion: 1 analogously covers founderSiteAxial on each active role: 'founders' journey after dispatch consumes the claim. founderQuote and founderProvision call expansion.claimMatchesSite before any departure payment, resident transfer or preview; activate checks founderMatchesSite again before creating a region, village, camp or link. A mismatch on arrival returns the team. These are destination identities, while founder routes and retained outpost links still execute with numeric IDs. See living world design, gameplay foundations and player guide.

Frontier survey axial custody: expansion.coordinateVersion: 1 marks the target site's axial address in every live frontier-survey job, its optional carried j.report, and each returned expansion.reports[settlementId][siteId] entry. Separately, expansion.routeCoordinateVersion: 1 marks the active job's ordered routeAxial alongside its numeric route; dispatch and dry homeward replanning set both. Initialization compares every route pair with its numeric cell and each site pair with siteFor(...).centerCellId, preserving existing route adjacency and receipt validation. An absent route marker migrates a numeric-only route only if the job has no partial route fields, including site-address-only saves from the preceding version. A partial marker, malformed pair or changed address rejects restore. expansion.charterReason and charter-extensions.quote also call reportMatchesSite at acceptance, before claim issuance or paid stock debit. Route execution and site IDs remain numeric-backed, so this is not the full world-coordinate migration. See living world design, gameplay foundations and player guide.

Partial stable world identity migration: ZoneEngine derives gonz-world-v1:<128-bit SHA-256 prefix> from the configured seed and persists worldIdentityVersion: 1 and worldId in its state and v3 manifest. A legacy snapshot upgrades only when both fields are absent after seed verification; a partial or mismatched identity is rejected. PersistenceStore.initializeLivingWorld accepts an otherwise byte-equivalent v3 manifest missing exactly those fields, while preserving its existing v1/v2 additive path. The WebSocket welcome exposes that ID as world.id for client-side world context. New founder/outpost charters persist the same identity. founding.validateRegions checks each charter's original seven ordered axial cells against the generated radius-one origin, migrates both absent charter identity fields, and rejects partial/foreign fields or changed coordinates before region custody is accepted. Paid charter-extension ledgers now mark coordinateVersion: 1 and store each receipt's exact axial pair beside its numeric cell. expectedRegion migrates only ledgers with no coordinate version and no axial fields, rejects unmarked or mismatched pairs, and leaves paid title, stock and numeric references unchanged. Operational records still use numeric cell IDs, so this does not unlock arbitrary expansion. The separate persisted instance identity described above distinguishes independently created worlds with identical seeds. See living world design, gameplay foundations and player guide.

Civilian recruitment floor: Each charter economy now has civilianFloorVersion: 1 and civilianWorkerFloor in 0–200. Home and outpost constructors initialize zero. founding.migrateEconomy adds zero only for an absent legacy field and rejects a present unmarked value or malformed version-one floor. SET_VILLAGE_POLICY requires existing charter authority and validates the setting. military.quoteRecruit and quoteReinforce compare the post-order laborBase with the floor before pay or claimSoldiers; current staffing, illness and named-household protections continue to apply. founding.economySummary supplies City, and Regional overview reports an exception only when a retained floor exceeds current civilian labor after later losses. This is a prospective recruitment guard, not a staffing mandate or automatic governor order. See living world design, gameplay foundations and player guide.

Versioned receiver-reach notice evidence: basin-connections.coastalReview hashes exact screened ocean and shore cell sets and public charter-cell assignments, excluding community names and foreign stock. potentialReleaseReceiverReach combines that coastal digest with canonical inland topology, exact reviewed cells, inland public tenure and review limits in a v3 SHA-256 fingerprint. receiverReachEvidence stores the selected receiver basin and digest on the exact notice. After party and reason comparison, noticeCurrency requires amendment on a digest mismatch even when a charter transfer between already named holders preserves the party list. Major-waterworks v24 migrates v23 notices to null evidence rather than reconstructing a historic boundary; selected-outlet legacy notices become stale, while notices without an outlet retain their normal currency check. Restore validates the object and rejects unversioned v23 evidence or malformed digests. Earlier v1/v2 digest objects remain loadable in ledger v24 but compare stale against v3, requiring amendment without discarding saved notice history. Controlled coastal and paid two-owner tests cover exact tenure, amendment blocking, migration and tamper rejection. This is public reach provenance, not complete W2 coverage or a construction grant. See living world design, major works plan and player guide.

Selected receiver public map locations: potentialReleaseReceiverReach joins each bounded public community to its current mutable-region anchor, falling back to the first region cell only when the anchor is absent. The added mapCellId is public navigation data; no foreign inventory, station, water level or household ledger is read. City lists at most twelve communities and uses its existing data-city-map focus action. It also renders up to eight natural and eight engineered frontier entries, omitted-channel count and bounded coastal crossings from the public receiver projection; additional entries are counted rather than hidden as complete. The paid south-camp notice test verifies the real anchor and new-party amendment path. This is neither a modelled wet cell nor W2 completion. See living world design, major works plan and player guide.

Engineered-network coastal exit inclusion: basin-connections.coastalReview now receives the bounded engineeredNetworks discovered by projection and adds their known ocean outlet links to the coastal crossing set. The existing four-step, 256-cell coastal cap and public-charter-only projection still apply; private stock and water levels remain excluded. The selected major-outlet receiver review and its potential-party notice basis inherit these shore communities. A controlled channel-to-recipient-to-ocean test checks inclusion, open status and read purity. This closes one known-party omission, not the ocean or wider W2 reach. See living world design, major works plan and player guide.

Selected major-outlet potential receiver reach: potentialReleaseReceiverReach finds the exact selected releaseOutfallScreen crossing, resolves its distinct receiving basin and calls the bounded basin-connections.projection from that root. The screen returns public communities from the natural and existing paid-channel network plus its bounded coastal review, reviewed cell and basin counts, natural and engineered frontiers, omitted-channel count and unchartered cell count. It never reads a foreign private water level or stock. noticeBasis adds potential-release-receiver-reach independently of releaseReplay so a dry or unavailable recorded window cannot hide a potential recipient. noticeCurrency rechecks the party and basis arrays when public title or reach evidence changes. release-receiver-reach-unresolved and release-receiver-customary-tenure-unresolved remain distinct blockers. This does not certify actual transfer, future flood extent, ocean completeness, rights or W4 operation. See living world design, major works plan and player guide.

Exact candidate common inlet section: SECTION_MAJOR_WATERWORKS_INTAKE requires source authority, current Hydraulic engineering, an exact rated pool-entry grade, current source survey, complete candidate paths and a full registered shared-demand window. major-intake-section.capacity gives 50,000 subunits per lane per four hours at 1,000 height-millionths of depth, scaled by depth, for the canonical depths 1,000/2,000/4,000 and lanes 1/2/4/8/16/32. The selected candidate-sectioned-entry-paths-v2 profile carries a lined-common-channel-v1 section; the command rejects options below the observed-window merged peak. Selection or clearing revises exact terms and preliminary lining days, timber, bricks, stone, tools and food. entryRetentionBound caps per-edge post-bypass potential at this common capacity, while ratedEntryLimit caps the independently routed contribution in the verified basin replay; each reports section-limited water separately. Neither creates a live intake. Ledger v23 migrates v22 without a section, rejects unversioned v22 section terms and validates exact active and frozen dimensions on restore. intake-engineering-unverified remains because the abstract throughput does not prove hydraulic head, gate-to-store capture, containment or safety. See living world design, major works plan and player guide.

Shared candidate intake-path demand: sharedIntakeDemand requires a rated exact manifold, complete bounded in-pool paths and fully registered four-hour entry rows. It applies ceil(amount * bypassPercent / 100) on each edge, caps the remainder at that edge's selected gate tier and adds same-interval potential once to every candidate path hex, including merged cells. The per-cell peak tick and latest load are deterministic; incomplete paths or empty registered windows return an explicit incomplete screen. review.sharedIntakeDemand and City expose the result without new ledger terms. It is demand under hypothetical routed capture, not a hydraulic section, in-channel measurement, controlled storage link or W4 water movement. intake-engineering-unverified remains. See living world design, major works plan and player guide.

Lined remote outlet section (implemented, provisional): SECTION_MAJOR_WATERWORKS_OUTLET requires source authority, active Hydraulic engineering, an exact rated remote alignment, current source evidence and a returned paid exact corridor profile. outletSectionScreen computes full-pool head above the higher of graded opening invert and observed receiving peak (or optimistic natural bed without a peak), then evaluates three canonical depths at the saved rate's lining-lane count. It rejects an undersized choice; a valid choice stores candidate-sectioned-outlet-v2 with a canonical lined-open-channel-v1 section, revises the proposal, adds lining work/materials and freezes in later notices. The verified whole-basin replay binary-searches each proposed transfer against capacityAtHead at closing source/receiver level, keeping section-limited units and intervals separate from the existing gravity/backwater loss. The exact-entry upper bound now binary-searches its release against the same section at closing source head with fixed observed receiver peak, or optimistic natural bed when unmonitored. It conserves each exact edge transfer but still omits same-interval routed arrivals and receiver rise. Its section-limited intervals add release-section-limited-at-exact-entry-bound separately from the receiving-aware blocker. A changed receiver screen can add release-section-undersized-at-current-head, and a section-limited recorded window adds release-section-limited-in-recorded-window; release-outfall-engineering-unverified never clears. Ledger v22 migrates v21 without invented sections and rejects forged/unversioned section terms. Proposal and notice restore compare rederived exact terms with order-insensitive deep equality; a valid gate-rating command after outlet selection no longer becomes an invalid save merely because optional fields were inserted later, while altered canonical entry geometry still rejects. The paid Basin journey covers a rejected shallow choice, a supported deeper choice, save/notice validation and no live water, title or stock mutation. This is not physical discharge or W4 work. See living world design and major works plan.

Released Basin outlet wayleave (implemented, bounded): REGISTER_MAJOR_CORRIDOR_LICENCE accepts only the authored candidate-unmarked-outlet-v1 cells from Basin source 1370944 to remote endpoint 1346380. It requires an exact returned corridorSurveyVersion:1 receipt, open current notice, public source authority, active Hydraulic engineering, Land registry and Public accounting, an operational staffed registry, no foreign charter or published founding parcel on the unchartered strip, and the exact currently unchartered cell list. Acceptance spends two timber and one food per cell, books communal spending and stores a revision-bound licence; it changes no charter or water state. easementStatus counts that licence only for cells still unchartered, so a later holder must sign its own exact easement. A new proposal revision does not inherit coverage. Major-waterworks ledger v21 introduced the empty-licence v20 migration; current v22 retains that check and validates released geometry, report and notice provenance, and pins the paid field report through watershed trimming. The Basin test confirms sixteen cells, no title/water mutation, blocker change, save restore, tamper rejection and amendment invalidation. This is a W3 land-right step, not hydraulic approval or W4 operation. See living world design and major works plan.

Marked-site-avoiding outlet route (implemented, bounded): The existing 1,200-cell, eighteen-step remote scout now runs a second deterministic BFS inside the same discovered land graph, rejecting every cell whose immutable natural feature is not none. It reports an optional exact path, steps, provisional one-lane grade-cut work, currently unchartered count and crest. SELECT_MAJOR_WATERWORKS_OUTLET accepts routeKind:'unmarked' only when that endpoint has a current canonical avoidance path, saving candidate-unmarked-outlet-v1 cells in the revised proposal and later frozen notice. Its own crest drives the selected head display. Major-waterworks ledger v20 migrates v19 neutrally and rejects forged or unversioned avoidance geometry; remote field and corridor survey validation accepts only the canonical selected path. The Basin test clears two dune conflicts without assigning sixteen unchartered cells, moving water or certifying section, discharge or consent. See living world design and major works plan.

Direct remote outlet alternative (implemented, bounded): major-outfall-recon.inspect retains the lowest-crest Dijkstra trace and a separate deterministic shortest BFS path to each shown receiver endpoint. The read reports both lengths, provisional one-lane grade-cut work and current unchartered counts; the direct path trades more excavation for fewer construction plots in the paid Basin case. SELECT_MAJOR_WATERWORKS_OUTLET accepts routeKind:'direct' only for the current source-basin endpoint and saves canonical candidate-direct-outlet-v1 cells. Terms and frozen notices rederive that path on restore; major-waterworks ledger v19 migrates v18 neutrally and rejects unversioned or forged direct geometry. The chosen path's own crest drives release-head display, while grade, rights and physical capacity remain unresolved. Existing remote endpoint visits, monitoring and corridor surveys follow either exact route; watershed custody accepts only the canonical lowest-ridge or direct cells. The City handler resolves remote scout leads directly, so both buttons open a real review rather than silently failing to find a natural spill crossing. See living world design and major works plan.

Exact remote outlet corridor survey (implemented, bounded): DISPATCH_WATERSHED_SURVEY accepts {cellId, remoteProposalId, corridor:true} only for an active source-owned candidate-ridge-outlet-v1 endpoint with a returned ordinary field report from that proposal. The physical route approaches the first selected corridor cell through own/unchartered land, then follows every canonical selected cell to the endpoint; the 60-edge travel cap, two-worker labor, meals, fire and charter checks remain authoritative. Corridor work uses four timber and two tools, of which two timber and one tool are spent at dispatch as access gear. Only this trip type may cross modelled basin water up to 0.003 normalized depth; deeper water blocks movement or study. After one complete site day, its findings include an immutable ordered natural-bed/biome/feature profile. Publication waits for return. Watershed ledger v5 migrates v4 neutrally, rejects unmarked corridor markers or forged route/profile/custody, and pins evidence needed by an active proposal. Major-waterworks review clears release-corridor-unvisited only for a returned report matching the exact selected cells and source basin. Hydraulic capacity, rights and construction blockers remain.

Remote receiver survey and station custody: watershed-surveys.quote accepts remoteProposalId only for the exact endpoint of an active source-owned candidate-ridge-outlet-v1 proposal with no current charter there. A bounded BFS walks source-owned or unchartered dry land, at most sixty edges and 1,200 considered hexes; ordinary fire, flood, labor, active Hydraulic engineering, budget and meals apply. monitor:false funds the two-timber/one-tool field report. Only a returned field report from the same proposal can authorize monitor:true, which separately funds six timber and two tools. Both jobs carry remoteSurveyVersion:1; the monitor also carries remoteMonitorVersion:1 and priorReportId in the job and custody record. The prior report stays pinned after later publication. Work takes a full day on site, spends materials only then and installs a real passive gauge before the team returns; reports publish only after physical return. The gauge carries the remote marker, proposal ID and revision. Source and receiving basin water cells remain one conserved ledger; basin-rainfall.enroll registers the complete terminal catchment, and major-waterworks.receiverObservedPeak reads the actual receiving-basin node after full intervals. This clears release-receiver-unmonitored only when a peak exists, separately from release-remote-site-unvisited; project rights and engineering blockers remain. Later charter claims retain the existing narrow observation easement, without conveying title or water rights. Watershed ledger v5 and surface-water ledger v3 migrate older saves neutrally and reject unmarked remote installations; restore checks the paired records, prior report, material/route custody, unique gauge cell, rainfall extent and water samples. See living world design, major works plan and player guide.

Remote major-outlet proposal custody: major-outfall-recon.inspect can return an exact selected lead by endpoint even beyond the six displayed leaders. Its route minimizes the absolute natural crest, with a distance and cell-ID tie break, so a later change in proposed pool waterline does not silently rewrite the selected path. SELECT_MAJOR_WATERWORKS_OUTLET accepts a source-basin/endpoint pair from the current bounded trace, checks optimistic head and saves canonical candidate-ridge-outlet-v1 cells at a new revision. outletTerms regenerates the route on restore or amendment; releaseOutfallScreen adds the selected remote crossing to current-term checks. constructionCells includes every route cell for title, marked sites, notice and easement review. The grade and hypothetical replay use its terminal receiver without certifying a channel or moving live water. Ledger version eighteen migrates version seventeen neutrally and rejects remote terms disguised as older saves. A paid 35-cell Basin command/notice test checks custody, mutation rejection and stock/water purity. At corridor selection the receiver is unmonitored; the separate paid station above can later supply peak history, while the engineering blocker remains. See living world design, major works plan and player guide.

Standing Governor communal coin targets: The governor ledger has an additive coinPlanVersion 1 capability. Older mandates migrate to coinPlan null; a missing marker with new plan, allowance, receipt or active Governor coin custody rejects restore. A plan selects deliver or collect, a whole destination target of 1–1,000, a retained source floor of 0–1,000 and a per-trip cap of 1–100. Existing Governor budget, spent, daySpent and bounded history maps now admit coins as a gross relocation authorization in capped or daily-only mode. At each daily check, coinLoad takes the minimum of destination gap, current spendable source surplus, per-trip cap and remaining authorization. A zero material target can still fund the same physical supply job; mixed goods keep their normal quote, warehouse and food checks. The Governor's monetary commitment is recorded once at dispatch and never refunded by recall, while regional material and operating spending checks/bookings receive only actual material, provisions and feed. The outpost job's coinTransfer or coinCollection controls physical balance changes and fixed-endowment custody, including recall and reload. Projection remains pure and Regional overview exposes the instruction and low allowance. Focused command tests cover both directions, repeated trips, mixed cargo, renewal, capped blocking, migration and offline replay. See living world design and player guide.

Owned-outpost two-way communal coin custody: The custom outpost supply quote accepts separate zero-to-100 whole values for home delivery (coins) and outpost collection (collectCoins) on the existing home-authorized two-worker route; either value can support a coin-only load. At dispatch, the home balance pays delivery coins into a version-one coinTransfer job field, while the outpost balance reserves collection coins into a version-one coinCollection field. Successful destination exchange credits delivered home money once and changes reserved outpost money into team-held return money. An outward recall or low-provision return releases the outpost reserve immediately at its origin; held home money refunds only at physical home unloading. A successful return credits collected money at home even if material unloading is blocked. Each custody field partitions its whole amount by stage; outpost restore validates role, phase and partition, and coin-market restore counts reserved and carried amounts in the fixed 1,200-coin endowment. Older jobs lack the optional fields. Gateway, City draft, quote, review, journey projection and regional carried-money view expose the current stages. Treasury relocation is outside the regional gross spending cap; later covered local purchases remain checked. Command tests cover market-funded money in both directions, recall, arrival, spending, offline replay, restore and forged custody. See living world design and player guide.

Regional coin operating coverage: operatingBudgets version three adds the boolean coinCoverage to each home record and permits coins in the existing capped or renewing allowance maps. Version-one/two budgets migrate with coverage false and no invented coin authorization; a version-two ledger claiming new coin fields or receipt kinds rejects. operating-budgets.reason and book ignore coin costs when coverage is false. When it is true, professional-service.quote checks the full prepaid wage escrow and start books it only after creating the funded contract; coin-market.quote checks finite waystation purchases and logistics.dispatch books their actual coin reservation against the caravan. coin-trade.accept checks and books the buyer's full bilateral coin price when payment is reserved; trade-contracts.scheduleQuote preflights each recurring round before it creates a child contract. The private buyer contract projection reads the current allowance and surfaces an acceptance blocker without mutating the ledger. Command payments use ordinary transaction rollback, home-day gross receipts and local treasury checks; recurring trade preflights the same allowance before creating a child. Sales are excluded, and cash refunds do not decrease gross commitments. Tests cover real market, military and two-player trade funding, over-cap rejection without mutation, recurring preflight, refunds without gross reset, old-save migration, receipt validation and restore. Other coin expenses remain outside this opt-in scope. See living world design and player guide.

Bounded production-steward target authority: SET_PRODUCTION_TARGET_ONLY passes the existing accepted-office and local-producer authorization gate, then requires a fresh world and structure review, an operational target-mode producer, active Public accounting and an exact {target} payload from 1 through ownerTargetCeiling. It changes only mandate.target, its timestamp and the producer's next full-cycle due time/revision; all inventory, input budgets, period, spending, batch history, recipe and mode remain. Later batches recheck the ordinary target, local stock and allowance. Owner SET_PRODUCTION_MANDATE reviews reset the ceiling to the owner-selected target. Production mandate ledger v5 migrates v4 ceilings conservatively from the current target and validates target <= ownerTargetCeiling <= 10000; public-office ledger v2 adds this command to consented audit history while v1 histories cannot claim it. The restricted City view and review do not expose broader charter powers. Focused tests cover rejected ceiling widening, unchanged immediate stock, a later paid mill batch, restore and migrations. See living world design and player guide.

Bounded major-outfall reconnaissance: major-outfall-recon.inspect uses deterministic land adjacency within eighteen walking steps of the candidate basin, caps discovery at 1,200 cells, and computes for each reachable endpoint a minimax natural-bed trace before grouping lower-bed endpoints by distinct complete receiving catchment. It returns up to six leads with the traced path, highest required ridge above the proposed full-pool level, and receiving peak only if the existing basin-water ledger has observed one. major-waterworks.projection exposes this read only for a supported source candidate; City labels it as terrain reconnaissance rather than a selectable alignment. It creates no persisted field, water transfer, consent or rights and does not relax any existing W2–W4 blockers. A paid Basin fixture verifies the two recorded backwater receivers and an unmonitored lower, high-ridge reach, plus determinism, read purity and restore agreement. See living world design and major works plan.

Finite shared-water automatic maintenance: waterworks-maintenance adds an empty, versioned waterworksMaintenance ledger to older saves and requires its matching land.waterworksMaintenanceVersion marker thereafter. Source-authorized SET_WATERWORKS_MAINTENANCE stores a one-to-twenty cumulative cap and never resets fundedRepairs when paused or amended. Source village daily processing uses the current waterworks.quote and waterworks.start path at 60% condition or lower, checks four free workers, and increments gross funded count only after a paid job exists. The active job carries a version marker; unexpected funding failures escape the daily transaction for rollback. Failed eligibility checks retain a reason without spending. The source projection and Regional exception expose the last result, while the recipient sees no policy or source warehouse. Existing funded jobs continue after pause or ruler death under normal crew/service rules; consent notice blocks new policy funding. Tests cover authority, stock conservation, pause, cap exhaustion, additive migration, malformed saves and offline equivalence. This does not change major-reservoir proposal semantics. See living world design, gameplay foundations and player guide.

Shared-water regional attention: waterworks.attention derives owner-local issues from version-one conduit records and one conserved waterBalance read per Regional projection. It reports pending offer/funding windows, unfinished work, sub-maximum delivery with its current reason, source wear at 60% or below before the below-50% failure threshold, and notice before and after its exact end boundary. regional-overview attaches the affected owned City Land & water target; it neither advances simulation nor exposes partner stock. The two-owner waterworks test checks command transitions, private rows, pure reads, save restoration and deadlines. No waterworks save version changes.

Reservoir inlet-grade command wiring: major-waterworks.selectIntakeGrade is exported for the SELECT_MAJOR_WATERWORKS_INTAKE_GRADE zone-engine dispatch path. Selection and clearing use the existing current-authority, survey, entry-rating and revision guards; the command changes only candidate terms and preserves historical notices. Watershed command and recipient projection tests cover this dispatch path.

Authoritative cell lookup guard: ZoneEngine accepts in-range numeric IDs and canonical decimal string keys such as those in persisted state maps. It rejects null, booleans, malformed strings and out-of-range values before terrain, region, deposit, renewable stock, vegetation, occupancy and active-job reads. In particular, a southern-edge structureFootprint member that is null cannot become cell zero via Number(null). Existing valid saved IDs and geography remain byte-for-byte stable; this is boundary validation, not the planned width-independent world/axial identity migration.

Numeric cell-ID boundary: canonicalCellId(col, row, cols, rows) now returns null when either coordinate is outside its configured dimensions. Kernel generation passes both dimensions, and cellCoordinates already rejects IDs beyond cols * rows. The last valid production cell remains 2252799; row 1100 is outside the 2048×1100 world. No persisted valid ID, world checksum or save schema changes. Numeric IDs remain width-dependent pending the separate stable world/axial migration.

Proposed reservoir material exception: major-waterworks.materialAttention reads each source-owned active exact rated proposal without impact mutation, combines its intake and outlet preliminary material estimates once, and compares them with current local inventory after the settlement's household food reserve. It emits only positive shortages. Regional overview targets land:major-<scope>-plan:<proposalId>, the same one-time consumer generated by cityProjection; the existing data-regional-goal handoff selects it in Supply chains. Revised or cleared exact terms change the scope and bill on the next projection. The read reserves no goods, grants no work order, and does not alter save schema.

Physical manuscript production goals: The City Knowledge picker now takes copy:<node> and scriptorium:<node> from supplyChains.projects, filtered to topics known by the selected local community. Both project rows describe one physical book and authoritative per-book input; the former uses knowledge.projectSpec(node, "copy").cost, the latter the scriptorium's one-book bill. School copying reads knowledge.nodes[*].manuscript.copy.reasons and opens that card’s manuscript details. The scriptorium handoff selects nodeId and quantity: 1 in the local draft, reads the matching live commission quote and focuses its panel. Neither route changes state until the separately reviewed server command funds work; finished books still enter local storage and need physical transfer before study.

Alternative learning supply goals: The study:<node> and academy-research:<node> consumers use knowledge.projectSpec(node, "study").cost and academy.cost(node) respectively. The City goal picker exposes them only for unknown local topics, alongside public research. The selected study handoff reads the topic’s manuscript-study reasons and focuses its open manuscript controls; the academy handoff reads a current quote or explicit missing-academy state, preselects that topic in the Academy draft and focuses its panel. A learned selected path switches to the existing adoption goal. These projections and UI transitions do not mutate inventory, knowledge, work, projects or save schema; the respective authoritative funding commands still quote and reserve inputs.

Public research and first-adoption material goals. supply-chains.projection already exposes research:<nodeId> from knowledge.NODES[nodeId].research; it now also exposes adopt:<nodeId> from the node's first-adoption cost. A saved program, active or suspended, yields an empty adoption input because ADOPT_TECHNIQUE charges only when that program record does not yet exist. City lists unknown research and known adoption consumers in the Knowledge goal group, carries a selected research topic to adoption after learning, and uses the existing data-city-knowledge path to focus its exact Research card. All traces are read-only and still protect stored household food. test/supply-chains.test.js compares public research and adoption graph inputs with actual server debits, suspension, read purity and restored state. Manuscript study and academy funding retain their distinct cost and command paths; no saved schema or authority rule changed. See living world design and implementation status.

Named-specialist training in the supply graph. supply-chains.projection adds a one-time specialist-training:<nodeId> consumer only when the owned home has a specialist ledger and the service is locally known with nonzero upkeep. Its input copies specialists.COST (four timber, eight food, one tool), so the graph and actual FUND_SPECIALIST_TRAINING reservation share the same source. City maps it to the Knowledge goal group and plans one course with the existing resource allocator. The goal handoff validates the topic in the current City knowledge projection, selects it in the Research draft and scrolls to Named specialist training. Current and forecast Regional issues carrying specialistNodeId render a second read-only link to knowledge:specialist-training:<nodeId>; the normal owned-settlement navigation and later training quote remain authoritative. test/supply-chains.test.js compares a pure graph read, real funding debit and restored snapshot. No persistent field, stock grant or automatic course was introduced. See living world design and implementation status.

Forecast specialist focus before a live issue. The bounded economy-forecast Regional projection copies the world and collects future regional-overview issues, including an aging:<characterId> target with specialistNodeId once the incumbent reaches warning age. The forecast row renders Inspect current controls through regionalLink. City now accepts its service-focus intent for an owned settlement even if the current regional.issues array lacks that future issue; after the present City loads, it checks the topic against the actual local knowledge projection before selecting and scrolling to Named specialist training. Neither forecast nor navigation issues a command. test/specialists.test.js verifies the future target appears while the current issue is absent and the live snapshot is unchanged. A changed future may invalidate the forecast, and actual training still uses current quotes and reviewed authority. See living world design and implementation status.

Aging named-specialist Regional exception. regional-overview reads the existing household-aging.projection and each owned community's specialists.appointments and specialists.successors. A warning-age living appointed adult without a designated backup yields a service-specific aging:<characterId> issue targeting Research; it is urgent at four or fewer economy.dayMs before oldAgeAt. The target carries specialistNodeId for UI focus. With a designated backup, the ordinary household continuity warning remains. regionalLink emits that node on the read-only navigation control; after switching settlements, City selects the exact topic in Named specialist training. There is no new persisted state or command from navigation. test/specialists.test.js covers pure warning projection, urgency, a paid three-day course, separate backup designation and transfer on death. Existing course eligibility, appointment and death handling remain authoritative. See living world design and implementation status.

Finite Regional-capital material and repair continuation. test/city-integration.test.js passes the saved command-built capital into test/helpers/regional-capital-next-material-loop.js, which funds two later headworks repairs and a copied staffing and separate Governor clay/ore return. test/helpers/regional-capital-renewed-repair.js continues that copied return for three further manual START_LAND_PROJECT headworks repairs under a paused SET_LAND_MAINTENANCE instruction. The helper uses ordinary local staffing, recipe change, daily production, paid Governor log transport and actual job completion. It asserts eight timber/four bricks/one tool withdrawn for each repair, requires new kiln bricks after ready brick stock falls below four, and checks that kiln and metalwork batches reduce clay and ore below their pre-delivery balances while increasing bricks and tools. Daily checks keep every charter fed and household water capacity sufficient; explicit RELEASE_SPECIALIST orders clear dead named appointments before pooled service resumes. Recognition can decline temporarily and must return to Regional capital at the end. A snapshot round trip preserves the resulting inventory and work state. This test is finite evidence, not a new production policy, save field or proof of renewable mineral deposits. See living world design and implementation status.

Standard outpost food-plot supply handoff. The home outposts.projection computes each linked camp's current localFoodPlot shortage and adds a Food plot timber offer capped at ten whole missing timber. A second Food plot provisions offer appears while a populated camp without the field has less food than its current construction-food cost plus three resident meal days. It suggests the current shortfall plus two days of resident meals, capped at 40 food, and may require another trip for a large shortfall. Each ordinary supplyQuote supplies eligibility, carrier, ration and payment detail; DISPATCH_OUTPOST_SUPPLY remains the only order and physical arrival remains the only camp credit. The camp's data-outpost-food-supply control identifies the selected timber or food offer, navigates to its own home and focuses that outpost's normal supply panel after the refreshed City response. It neither edits a custom draft nor issues an order. test/outposts.test.js verifies quote purity, home debit, no in-transit camp credit, arrival, construction, staffing and actual food receipts and harvest. No save field or production rule changes. See living world design.

Outpost food readiness handoff. The existing-plot Frontier & charters card joins outposts.localFoodPlot.structureId with the current owner-scoped city.structures[].production projection and city.economy. It displays the existing status and reasons or available next-cycle food, plus foodBalance, stored food and foodDaysWithoutProduction; data-city-tab="production" uses ordinary City navigation. test/gameplay-journey.test.js verifies a completed unstaffed field reports Assign workers, then the staffed field reports ready and a nonnegative current balance. No command, save field or independent harvest estimate is introduced. See living world design.

Pilgrimage dispatch integration. zone-engine routes DISPATCH_PILGRIMAGE to outposts.pilgrimage; the handler is exported alongside pilgrimageQuote. The missing export previously made a reviewed order fail at dispatch. test/pilgrimages.test.js covers 13 physical journey, consent, exchange and migration scenarios with the export restored. Payment, route and host validation still run in the existing handler; no save schema changes. See living world design.

Outpost food-plot UI handoff (M1/M6 bounded). outposts.localFoodPlot exposes a candidate owned hex, construction inputs, missing resources and the current blocker, or identifies an existing Community food plot and its staffing. The Frontier & charters preview control validates the current candidate and passes its cell to the established placement flow for community-field; the newly selected City projection and START_CONSTRUCTION quote remain authoritative. An operational existing plot exposes the existing ASSIGN_STRUCTURE_STAFF review for two workers only when the projected local labor pool can cover the difference. Server acceptance still checks revision, ownership, actual stock, crew and building state. test/gameplay-journey.test.js compares the recommended candidate and bill to the selected-plot quote, then confirms the built plot is unstaffed before the real staffing command and staffed afterward. An isolated browser check confirmed the same exact hex and paid construction and staffing controls; no new save field or production shortcut is introduced. See living world design.

Founder-kit goal and quote parity (M3/M6 bounded). outposts.founderSupplies calculates the route-dependent rations, cargo and full payment shared by founderQuote and the read-only founderProvision. The owner outpost projection exposes standard and ten-extra-timber provisions alongside their independent live quotes or reasons. supply-chains.projection adds the corresponding one-time expansion consumers only for a current registered charter with a feasible carrying route; no projected input enters local stock or reserves it. city-interface renders the selected plan, live blocker and existing DISPATCH_OUTPOST_FOUNDERS review with the matching extraTimber parameter. Command acceptance still rechecks capacity, rights, adults, workforce, route hazards, protected food and materials before spending and physically moving residents. test/gameplay-journey.test.js verifies blocked-plan visibility, standard and variant cost parity with eligible quotes, and disappearance after dispatch. See living world design.

Land-goal project handoff (M3/M5 bounded). supply-chains.projection adds soil-improvement and small-irrigation consumers using the authoritative land.TYPES costs. city-interface resolves a selected land:<type> goal against the current city.land.options, mapping repair-headworks to maintain-headworks; plant-woodland uses the existing city.woodland.options planting quote. The read-only card names selectedCellId, displays that server quote or reason, and enables the existing data-land-project or data-woodland-order review only when eligible. The command still rechecks plot revision, world revision, technique, survey, rights, materials, workforce and site condition. test/gameplay-journey.test.js compares the new goal costs with live eligible quotes before soil and irrigation work, then verifies real terrain and water effects. See living world design.

First-patrol supply goal (M3/M5 bounded). military.patrolProvisions derives round-trip rations and additional local food from the existing surveyed route, troop count and carried food. quotePatrol now uses that same helper before its ordinary reserve, hazard, readiness and age checks. The owner military projection exposes the read-only plan; supply-chains.projection creates a first-patrol one-time consumer only for a ready unit at home. city-interface maps it to army:first-patrol, renders the current defense.patrol quote or reason, and enters the existing START_PATROL review for ordinary or cautious contact only when eligible. No stock, save schema or route state is changed by the goal. test/military.test.js checks quote parity, a protected-reserve rejection, unchanged inventory after planning, physical departure and removal of the ready goal. See living world design.

Militia kit craft handoff (M3/M5 bounded). For army:recruit, city-interface compares current city.settlement.inventory.militiaKits with the two-kit goal and reads the existing city.defense.craft option for quantity two. Its data-defense-action="CRAFT_MILITIA_KITS" button is disabled without that authoritative quote and otherwise enters the existing revision-checked review handler. The card displays the quoted batch inputs and rejection reason separately from the supply planner's hypothetical outputs. military.quoteKits and command acceptance still check commons, two available civilian workers, an unfinished existing batch, timber, iron and spending limits; the one-day job and warehouse custody are unchanged. The integrated market journey asserts the craft quote after a paid iron arrival, then completes the ordinary batch and two-resident recruitment. See living world design.

First-militia goal readiness (M4/M5 bounded). The army:recruit goal reads the existing owner-scoped city.defense.recruit option for two soldiers and renders its authoritative reason or quote. Its data-defense-action="RECRUIT_MILITIA" button is disabled without a quote and enters the existing revision-checked review handler when enabled. The goal also links to the Drill research node and Defense controls. It introduces no command, saved field or independent recruitment estimate; military.quoteRecruit still checks commons, active Drill, civilian labor, ages and actual kit stock at acceptance. The barracks is not checked by founding recruitment. See living world design.

Barracks goal to first militia equipment (M3/M4 bounded). In city-interface, the selected building:barracks goal adds a read-only data-supply-next-goal="army:recruit" button to its existing building handoff. The click checks for the projected recruit consumer, selects quantity one of that existing goal and rerenders; it creates no command or save field. The recruit consumer requires two militiaKits, distinct from the barracks construction bill. test/market-itineraries.test.js verifies a four-load physical brick/iron import itinerary, a separate final-brick purchase, normal barracks construction and staffing, a further iron purchase, kit crafting and two real-resident recruits. It verifies the marketplace ledger and population remain consistent. See living world design.

Exact building-goal handoff (M1/M3 partial). city-interface resolves the selected building:<definitionId> goal against the current city.catalog, displays the projected plot-specific eligibility reason, and routes the preview button through the existing data-city-preview footprint flow. The direct data-city-build control is disabled without item.eligible and otherwise opens its current START_CONSTRUCTION review with the projected quote revisions. No separate command, stock allocation or save field is introduced; server acceptance still rechecks the footprint, rights, technique, materials and workforce. A local browser walkthrough verified a food-plot goal, four available sites and a reviewed order. See living world design.

Mixed-material supply-goal itinerary (M3 partial). GonzSupplyGoalPlan.mixedImportSequence takes the selected goal's aggregated shortages, current projected logistics offers and available depot inventory. It searches eligible quote lot sizes for two to four loads spanning at least two resource IDs, bounding cumulative receipts by finite depot stock. Complete sequences rank by load count, excess units and quoted coin amount. When none fits, a bounded combination search ranks partial sequences by summed capped fraction of each need covered, then fewer trips, less excess and fewer coins; at least two resources must receive goods. The result reports remaining needs separately, without reducing the goal planner's current-stock shortage. The City action recomputes from current offers before opening only a local Trade & transport draft. No world or warehouse changes until AUTHORIZE_MARKET_ITINERARY; later server quotes remain authoritative. A command test verifies separate stone and brick returns and save restoration; a fresh founding barracks goal shows a four-load partial draft. See living world design.

Supply-goal planned import cue (M3 partial). GonzSupplyGoalPlan.plannedImportLoads reads the owner-visible city.marketItinerary and current logistics offer outputs. It returns only travelling, pending or blocked undelivered legs of an unfinished plan; returned and cancelled plans add no cue. city-interface filters those loads to resources still short in the selected hypothetical goal, renders their quantities and status without allocating them to a particular material line, and links to the existing Trade & transport review. The pure helper changes neither the goal planner nor authoritative inventory. A browser walkthrough confirmed ten reserved rough stone and a five-stone unpaid future load after the first reviewed dispatch, while the home shortage remained twelve. See living world design.

Finite mineral market circulation (M3 partial). coin-market.OFFERS adds paired whole-lot sales and purchases for roughStone at four coins, clay at one and ironOre at two. No save schema changes: existing market payment, money-conservation and caravan validators apply to the new IDs, and depot inventory admits these weighted resources through logistics. Sales reserve finite NPC funds, carry actual local goods, add depot stock at exchange and credit coins on return. Purchases reserve actual depot units and communal coins, and import only on return. New-world depot defaults still include finite rough stone but zero clay and iron ore. Focused quarry, clay-pit and iron-mine journeys prove surveyed finite extraction, outpost collection, deposit, purchase and restored ledgers; they do not prove resource renewal. See living world design.

Supply-goal import sequence handoff (M3 partial). GonzSupplyGoalPlan.importSequence searches currently eligible quote lot sizes for a two-to-four-leg sequence covering a positive material gap within visible finite depot stock. It minimizes trip count, then overdelivery, and returns no draft if one quoted load suffices or the stock/leg bound fails. The City Supply chains action recomputes against its current resource import and logistics offer, seeds only a local Trade & transport draft and leaves the authoritative world untouched. AUTHORIZE_MARKET_ITINERARY remains the separate reviewed first dispatch; its later normal quotes may block as resources change. The integrated twelve-stone case selects ten and five lots, then verifies the goal shortage is twelve while the first import is travelling, two after its return and zero only after the second unload. See living world design.

Bounded market import itinerary (M3/M6 partial). market-itineraries persists a versioned founding-home ledger of two to four exact logistics.OFFERS or coin-purchase loads, per-leg outcomes, gross committed spending and cumulative ceilings. AUTHORIZE_MARKET_ITINERARY requires owner, anchor and current world revision and uses logistics.quote and logistics.dispatch for its first leg. A scheduled check after each completed physical return requotes the next leg against real workers, protected food, finite depot stock, market funds, route and storage. Busy carrying teams defer; another quote/payment failure blocks without dispatch or spending. CONTROL_MARKET_ITINERARY supports cancellation or a reviewed retry with ceilings at least as large as commitments already spent. Caravan recall cancels later legs and its return closes the active leg. Validation rejects orphaned marked jobs and malformed ledgers; old saves without either get an empty ledger. City projection exposes the plan and Regional overview flags a blocked one. Focused tests cover two real stone returns, save replay, ceiling retry, recall and migration; no renewable market source is implied. See living world design.

Goal-linked finite import (M3 partial). city-interface matches a Supply chains material line's import ID to city.logistics.offers, then uses only currently eligible prequoted lot options. It chooses the first lot covering ceil(gap / receivePerLot) or the largest eligible offered lot when none covers the whole line, and opens the existing DISPATCH_CARAVAN review through data-city-trade. The server still rechecks the offer, finite depot stock, payment, workers, route, food and storage at acceptance. A command journey with an idle quarry returns ten then five paid rough stone, checks the home shortage after each arrival and matches an in-flight restore; no deposit or save schema changes.

Finite mineral warning target (M3/M6 partial). regional-overview.projection keeps the low/exhausted deposit issue on its source community, but sets the navigation target to the founding home's anchor, supply tab, exact resource, and resource:<id> goal. The bounded goal quantity is min(1000, ceil(homeStock) + 12). city-interface transfers those fields into its current Supply chains selection before refreshing the home City. Reads do not mutate the deposit, inventory, goals, mandates or cargo. Stone, clay and iron tests assert the source identity, home target and selected resource. No save migration is needed.

Paid second stone return through home service and succession recovery (M3/M6/M7 bounded). The extended command journey in test/outpost-production-target.test.js first records a blocked Governor check with zero home timber while the outpost's daily target has replenished actual stone. It suspends enabled optional programs, uses finite relief-caravan food exports to free warehouse room, harvests eligible woodland, and mills real logs. During the longer run, an age/health death enters AI_INTERREGNUM; EMBODY_KIN and a character-bound REQUEST_HANDOVER restore lawful authority for subsequent orders. Existing disabled programs are re-adopted, the enabled accounting program resumes at its daily check, and the retained Governor mandate dispatches and completes a second paid stone trip. No ledger is reset or save schema changed; the case remains bounded by actual food, forest, deposit, tools and service upkeep.

Governor home-service recovery navigation (M3/M6 partial). governorView reads city.governors.serviceReason, the home settlement.inventory.timber, and current knowledge.nodes[*].program.active to show data-governor-service-recovery only when service is unavailable. Existing data-supply-trace, data-city-knowledge and data-city-tab handlers open the timber graph, exact inactive technology card or workers screen; no new command or saved field is added. The command-built stone-camp case verifies the matching world state after a paid return: local daily target work has refilled quarry stock, but zero home timber suspends Regional institutions and a further Governor check leaves dispatches unchanged. An enabled program retries at its later daily upkeep check; a disabled program needs an adoption review. Materials, staffing and the physical route remain authoritative.

Renewing remote production draft (M3/M6 partial). GonzLocalProductionGoalDraft.plan accepts renewAfterPickup from the home-to-outpost City shortcut. For a producer without an accepted mandate, it clones the draft, selects daily-only, clears the capped suggested input ceilings, then funds one nominal recipe batch per allowed input using the existing whole-unit ceiling rule. A retained mandate keeps its current allowance period and gross spending. The ordinary destination SET_PRODUCTION_MANDATE still validates the reviewed draft; later production rechecks service, staff, actual fractional input spending, finite deposit, stock target and storage. Pure cases and the paid stone/Governor journey cover a post-pickup refill. No save schema changes; home civic service and transport remain separate gates.

Combined stone-outpost target and Governor return (M3/M6 bounded). test/outpost-production-target.test.js now builds a paid stone camp, researches and adopts its local accounting, and uses GonzLocalProductionGoalDraft.plan and GonzGovernorSupplyDraft.plan against the actual zero-stock projections. SET_PRODUCTION_MANDATE and SET_GOVERNOR_MANDATE authorize separate future work. An unstaffed first check has zero dispatch, allowance spending and deposit change; later staffed batches debit local tools and finite deposit, and a physical Governor job reserves and returns the produced stone. Restore preserves the Governor ledger. No simulation or save schema changed; one bounded journey is not a long-run supply proof.

Resource-trace handoff (M3/M6 partial). The individual Supply chains trace passes regionalNeed = max(1, min(12, 1000 - homeStock)) to regionalProducerView and governorCollectionButton. The former exposes the existing GonzLocalProductionGoalDraft.remoteNeed path for a named outpost producer even at zero stock; the latter permits an unsent Governor draft when a current non-exhausted producer or woodland source is present. The goal tree still passes its exact uncovered line. No save schema or authoritative command changes.

Zero-stock Governor draft from a home goal (M3/M6 partial). city-interface exposes the material-line shortcut when regionalSources has collectable goods or a present producer with remaining finite capacity, an unbounded recipe, or a woodland source. GonzGovernorSupplyDraft.plan accepts zero available and assigns a positive allowance for one prospective load while returning load: 0; it preserves an existing route's other cargo, trip limit and gross spending. It does not mutate the world. SET_GOVERNOR_MANDATE still authorizes only future checks. For a new collection-only route, governors.proposal blocks while the outpost has no eligible stock, without reserving cargo or spending; an existing route may still dispatch its separately authorized goods. A paid woodland continuation proves blocked-then-dispatched-then-returned custody and save restoration; the live City check verifies the zero-stock control and draft target. No save schema changed. See living world design, gameplay foundations, implementation status and player guide.

Blocked mandate to Public accounting (M3/M6 partial). When production-mandates.projection supplies a target serviceReason, the Production mandate renders a navigation action to the current City's public-accounting technology card beside the disabled review. The action changes only the displayed section and focused card; productionDrafts stays keyed to the producer and SET_PRODUCTION_MANDATE remains unissued. Existing local or linked-home service checks and actual research/adoption commands remain authoritative. See living world design, implementation status and player guide.

Remote target accounting cue (M3/M6 partial). The home Supply chains producer row renders the same accounting prerequisite as the destination Production mandate: local active Public accounting, or active Public accounting plus Regional institutions at the linked founding home. This is explanatory text, not a cached eligibility decision. The destination City still refreshes and its existing mandate review remains authoritative. A live isolated City walkthrough confirmed the finite home-gap bound and the exact outpost quarry draft; with accounting absent, the server-backed review control remained disabled. See living world design, implementation status and player guide.

Finite outpost target ceiling (M3/M6 partial). supply-chains.projection obtains finiteRemaining for an owned outpost mineral producer from the authoritative deposit at its structure anchor, not from a production read model or theoretical recipe yield. GonzLocalProductionGoalDraft.remoteNeed subtracts collectable outpost stock from a home goal line and caps the proposed extra units at that producer's remaining whole deposit; the UI shows any uncovered residue and omits a zero-capacity action. planProducerGoal checks the freshly projected destination deposit again before creating the unsent mandate draft. Pure tests cover partial, zero and unlimited cases; clay and stone cases verify the live site remainder. This is advice only: deposit spending and output still occur in actual batches, and freight remains separate. See living world design, gameplay foundations, implementation status and player guide.

Paid outpost target and return regression (M3/M6 bounded). test/outpost-production-target.test.js constructs a stone camp through player orders, sends timber, researches and adopts local Record keeping and Public accounting, and uses the exact home-projected producer ID to draft an outpost rough-stone target. The authoritative SET_PRODUCTION_MANDATE then funds batches that debit tools and finite deposit. The home Supply chains goal remains short through remote production and outward dispatch; only the paid return clears it. A pause isolates the one-load debit, followed by a renewed daily input allowance and further finite batches after collection. Saved mandates and home stock restore. The case verifies the path without claiming infinite stone or continuous service. See living world design, gameplay foundations, implementation status and player guide.

Outpost production target from a home shortage (M3/M6 partial). supply-chains.projection now includes the exact structure ID for each owned outpost producer already identified by its selected recipe. In the home goal tree, City offers the remote target shortcut only when that producer's output matches the missing resource and collectable outpost stock falls short of the line's unarranged need. The click records a transient navigation intent, fetches the outpost City, revalidates the structure and current recipe, then reuses the pure local-production planner with that outpost's warehouse, mandate and allowed inputs. It opens the ordinary SET_PRODUCTION_MANDATE draft without issuing a command; staff, accounting, source depletion, batch completion, paid collection and home unloading remain separate. The clay-outpost test checks zero-stock producer ID, outpost-local target and read purity. No save schema or material ledger changed. See living world design, gameplay foundations, implementation status and player guide.

Local production target from a Supply chains goal (M3 partial). public/local-production-goal-draft.js is a pure planner called only from a selected recipe step with a current matching structure. It sets a whole target from local warehouse stock plus that step's covered amount, estimates nominal full-staff batches, and preserves the current draft and retained mandate. Capped input budgets rise from lifetime spending plus the estimated batches; daily-only budgets cover prior spending today plus one nominal next batch. Both modes retain other authorized input keys and reject their respective 10,000/1,000 limits without mutation. city-interface.js revalidates the source/producer, opens the exact Production mandate draft and leaves SET_PRODUCTION_MANDATE as the authoritative owner-reviewed command. Pure cases cover spending, period change and invalid drafts; test/production-mandates.test.js applies one resulting tool target to a staffed smithy, observes real iron/charcoal spending and output, and restores the ledger. No save schema, goods or worker allocation change on draft. See living world design, gameplay foundations, implementation status and player guide.

Governor carrier shortage navigation (M3/M6/M7 partial). governors.projection already computes the authoritative two-carrier idle-floor blocker without reserving labor. public/city-interface.js now shows 2 + mandate.minIdleWorkers beside the founding home's projected availableWorkers only for that exact blocker, and a local button opens the existing Regional staffing comparison. The control does not preselect donors or issue a command; the existing two-to-eight-row validator, copied forecast and revision-checked atomic order remain authoritative. The capital integration continuation tests the labor/production phase followed by separate paid Governor clay and ore receipts and physical source-to-home replenishment. It leaves both mandates enabled, verifies the satisfied clay target causes no extra dispatch while ore uses the returned carrier pool, then restores the same saved ledgers. No save schema, route priority, labor allocation or resource rules change. See living world design, gameplay foundations, implementation status and player guide.

Single-community Regional staffing plan (M3/M7 partial). regional-staffing-plans.validate still requires two to eight distinct operational owned producers, fresh per-structure revisions, an authoritative founding-home command and a valid post-change labor total for each touched settlement. It no longer requires the changed producers to span two settlements. The acceptance path releases staff reductions before additions and wakes affected outposts; the forecast uses the same validator in a copied world. City shows the comparison when at least two producers exist across the linked network and permits all changed rows to belong to one community. The command-built seven-community continuation tests a zero-free-worker home: one swap enables actual iron/charcoal tool output; another enables actual clay/log brick output. No save schema changed and the copied production branch restores.

Regional exception goal routing (M3/M7 partial). regional-overview adds an optional target.goal only for timber balance, missing headworks materials and low post-repair civic timber. The City Regional issue link carries that value as data-regional-goal; navigation switches to the issue's settlement and Supply chains tab, selects the existing goal ID and resets quantity to one. The Supply chains projection remains authoritative for its recipe graph and stock gaps. Neither issue projection nor navigation issues a command. A thirty-day copy of the 100-resident City built with controlled expansion stock verifies that changing a finite Governor log route to ongoing daily authorization produces further physical dispatches, preserves food at both ends, and restores its route/stock state; bricks and tools for recurring headworks remain unsupplied.

M8/W2 proposed-pool transit screen (partial). Impact.history compares natural and proposed retained-window water on source-catchment cells, then intersects newly wet cells with the untraversed suffix of outward paid jobs or untraversed prefix of homeward paid jobs. The public landExposure.transitExposure counts unique job IDs, maximum affected in one interval and charter owner names; recipient proposalTransit reveals only that owner's bounded affected route cells. major-waterworks.review adds proposal-active-transit-risk, and noticeBasis adds proposal-transit-interruption for a non-source carrier even without a land claim. A changed basis requires amendment and fresh notice under the existing revision check. The replay does not mutate jobs, cargo or water; it is conditional on present routes and recorded intervals.

Regional woodland source before stock: supply-chains.projection limits remote log sources to established links with the same owner as the founding home. For each linked outpost, forestry-mandates.projection supplies retained standing status, while vegetationPlan("harvest") quotes its current natural forest plots without persisting vegetation changes; the first ready plot, or the best blocked plot, becomes the manual source. Its conditional expected logs and the mandate's separate conditional quote are metadata only. The remote row remains visible at zero available logs, with Land & water and Orders links, but the client hides both pickup controls until whole remote stock exists. Neither source enters local stock, readyOutput or the backward goal allocator. The command-level regression proves zero-stock read purity, a real harvest, reservation at dispatch, eight logs credited only after return, save restoration and a separately paused standing order. No save schema or resource grant changes. See living world design, gameplay foundations, interface and player guide.

Zero-stock owned-outpost producer projection: supply-chains.projection limits remote sources to established links owned by the founding home's owner. It checks each linked outpost's uncleared production buildings against their currently selected recipe, then obtains current readiness from the same city-projection.productionStatus used in the outpost City view. A resource source survives the previous positive-stock filter when at least one selected producer can make it; each entry carries the producer's plot, ready output if ready, or current blocker. The home Supply chains UI links to that outpost's Production card and hides manual/Governor pickup controls when available is zero. Potential remote production is excluded from home stock, ready-output rate and the goal planner's material allocation. An empty paid clay-pit case verifies ready and unstaffed observations, read purity and unchanged shortage; existing delivery/privacy cases cover later escrow, return and owner scope. There is no save migration or new resource grant. See living world design, gameplay foundations, interface and player guide.

Supply-goal Governor collection draft: public/governor-supply-draft.js is a pure client planner loaded before city-interface.js. The Supply chains goal and resource trace expose the shortcut only for a fresh owner-visible regionalSources row with a corresponding Governor projection and known Regional institutions or a retained route. On click, the client revalidates source and route, then sets an unsent Governor draft. A new route gets a zero delivery target, home stock target capped at 1,000, an ongoing trip setting, daily-only material allowance sized for one possible load and travel-food allowance; a retained route preserves its existing delivery, collection rows, allowance mode, trip cap and spending while raising or adding one collection target. Conflicting or full rows and invalid source/limit values reject before draft mutation. Blank UI rows are filtered by the existing reviewed submission handler. No server schema or inventory changes occur until SET_GOVERNOR_MANDATE is reviewed; subsequent physical dispatch, escrow, rations, returns, reserves, save validation and replay all use the existing authoritative Governor implementation. Pure planner tests and a command-funded log collection cover these boundaries. See living world design, gameplay foundations, interface and player guide.

Household-critical recurring well repair order: land-maintenance.advanceDay sorts due instructions with an eligible central well first only when the headworks are at most three ordinary wear checks from dropping below 50% and the current population exceeds the water source without the well's extra twelve units per level. For a well already below 50%, current household-capacity shortfall supplies the dependency check. A lined well uses one-point wear; an ordinary well uses two. Remaining instructions use their previous lowest-condition then cell-ID order, and proposal still tries same-plot candidates by wear with normal worker, food, specialist, cost and allowance checks. regional-overview.projection reuses the dependency check and raises headworks-timber-floor only with an enabled instruction, no pending repair, all ordinary repair materials locally stored and a post-payment timber balance below retainTimber. It is an urgent read-only issue targeted to the well's Land & water card; it neither overrides the floor nor pays the job. Controlled headworks tests cover competing plots, dependency/no-dependency order, warning purity, ordinary payment and offline replay. No migration is needed. See living world design, gameplay foundations, interface and player guide.

Retained timber in automatic land maintenance: landMaintenance.version is three. Version-one ledgers first migrate their existing capped/day fields, then version-one and version-two plot instructions gain retainTimber:0; new instructions also default to zero. Version-three validation requires a whole value from 0 through 1,000, and an older version claiming the new field is rejected. SET_LAND_MAINTENANCE retains the previous floor when the field is omitted on an edit, or authorizes a reviewed replacement. For each eligible maintain-* quote, proposal checks local timber - quote.cost.timber >= retainTimber before calling land.start; a failed candidate reports its amount and can yield to another eligible type on the plot. No stock, cumulative spending, job or earlier payment changes on approval or failed check. Projection includes a read-only optional example of twice current active specialist timber upkeep. The focused test checks blocked/funded transitions and both legacy migrations; the existing maintenance replay and cancellation tests cover unchanged work semantics. See living world design, gameplay foundations, interface and player guide.

Well repair with active-service timber buffer: When a chartered settlement has enabled headworks and knowledge.upkeep(settlement,"timber") > 0, supply-chains.projection adds a conditional repair-headworks-service-buffer consumer with the ordinary maintain-headworks bill plus twice that current timber draw. The existing repair-headworks consumer and the authoritative project cost stay unchanged. regional-overview.projection adds headworks-service-buffer only for an enabled well at 80% condition or below with no pending repair, all actual repair materials locally present, positive active timber draw and post-payment timber below two current service days. It links to Supply chains and uses the existing well-wear urgency threshold. This is a pure planning read: it does not mutate inventory, change the maintenance allowance or reserve timber. test/deep-groundwater.test.js verifies the dynamic input, alert, stock clearing and unchanged snapshot. See living world design, gameplay foundations and player guide.

Larger-capital two-repair material continuation: test/city-integration.test.js now passes the actual final snapshot and clock of regional-capital-growth.prove to regional-capital-next-material-loop.prove. The latter issues owner commands with live expected revisions: two DISPATCH_OUTPOST_SUPPLY collections, staffed mill/charcoal/smithy/brick production, SET_GOVERNOR_MANDATE and temporary PAUSE_GOVERNOR_MANDATE, worker reassignment, and the existing SET_LAND_MAINTENANCE daily-only instruction's two normal maintain-headworks jobs. It makes no inventory or condition writes. It checks every advance for Regional-capital stage, water capacity at least 64 and food with no shortfall in every chartered settlement. Two additional paid repairs complete over 45 checks; the endpoint holds 10 timber, four bricks, one tool and 82% well condition. The four-worker mill phase matters: a repair funded from barely eight timber can leave Regional institutions without operating stock even if the crew succeeds. The test covers a bounded manual schedule, not finite-seam replenishment or perpetual autonomous operation. See living world design, gameplay foundations and player guide.

Pending owned-outpost pickups in a home material goal: supply-chains.projection adds settlementId and a pickupState on owner-visible outpost-supply movement rows. The state is reserved only for an outward team holding a nonempty escrow; it is returning only after successful loading (delivered exists) in the homeward or unloading phase. A recalled outward team has no inbound state. public/supply-goal-plan.plan filters to movements whose homeId matches the viewed settlement, takes reserved quantities from reservedExchange and loaded quantities from cargo, and attaches them as pendingPickups to material rows. It never allocates them as stored goods or subtracts them from shortages. The clay outpost integration checks each custody transition and the pure planner test excludes recalled and other-home movements. Existing job settlement, stock, reserved exchange and save validation remain authoritative.

The planner maintains a separate per-resource pending pool and provisionally consumes it once per material line, recording pendingPickups with the line's assigned amount and full loadAmount, plus pendingUnarranged. This pool is separate from remaining warehouse stock and never satisfies the shortage calculation. A two-branch recipe test verifies that one six-log returning load is shown as four then two, not six on both lines.

Movement rows expose the active job's dueAt as nextCheckAt, which the planner passes through without estimating arrival. The client uses data-supply-inspect-journey to switch to Expansion and focus the exact data-outpost-journey card after rendering, with the job ID checked against the current projection first. test/clay-outposts.test.js verifies outward and homeward next-check values against the live job; completing the journey removes it from pending goal rows.

Owned-outpost sources in the home supply projection: supply-chains.projection enumerates only established state.outposts.links whose homeId is the viewed founding home and whose settlement owner matches. For each transportable resource in outposts.WEIGHTS, it reports whole stock available at that outpost after subtracting its protected food floor. The result is resource.regionalSources, not resource.stock, readyOutput or a waystation import. public/supply-goal-plan.plan copies those rows to uncovered material lines without satisfying any part of the goal. public/city-interface.js renders the same source in the full resource trace and preloads a local custom-trip draft of at most twelve units on Plan outpost pickup; it discards any stale custom quote. The ordinary server ownerSupplyQuote and DISPATCH_OUTPOST_SUPPLY review remain required. test/clay-outposts.test.js checks twelve remotely stored clay, eight debited to travelling escrow, four remaining remotely, zero at home until the physical return, then eight at home, with a byte-equivalent world snapshot after advice. No save version or cargo rule changes; food reserve, route, workers, carrying capacity, dated goods and storage remain authoritative at quote and dispatch.

Automatic headworks repair in the linked 100-person City: The existing SET_LAND_MAINTENANCE instruction, originally saved as version two and now migrated to version three with a zero timber floor, is authorized on the surveyed home source with threshold:60, minIdleWorkers:0, allowanceMode:"daily-only" and budget:{timber:8,bricks:4,tools:1}. Authorization is inventory-neutral. A physical sell-logs caravan of twelve pays for buy-bricks four and buy-tools one from finite waystation stock. After seven waiting daily checks, land-maintenance.advanceDay reaches 60% well condition and funds an ordinary maintain-headworks job with a four-person crew, recording exactly eight timber, four bricks and one tool in spent and daySpent. Normal completion restores 100% condition; no water capacity is invented while work runs. The home remains City with 100 residents and full food, water and sanitation, while the linked eight-person camp has no food shortfall. Restored saves retain the maintenance ledger, population and inventory. That daily-allowance change granted no stock; renewal alone cannot replace expended bricks or tools.

Bounded City recovery with physical governor exchange: After the manual-only failure below, existing SET_GOVERNOR_MANDATE uses deliverResource:"food", destinationTarget:0, collectResource:"logs", homeTarget:40, keepOutpost:5, maxCargo:20, and a six-trip capped food/log allowance. Each governorHomeId job reserves actual source logs, spends route food and credits home only on return; the first two dispatches are checked as distinct paid jobs. Home field targets at 1,600 and a camp field target at 250 prevent full warehouses from blocking forestry and delivery. DISPATCH_CARAVAN sells twelve actual home logs for the four bricks and one tool needed for each of two normal maintain-headworks projects. The owner reviews tripLimit:20 and higher finite allowances after six dispatches. The 100-person home earns City and passes seven, then twelve, then twelve explicit City checks; its development.changes counter remains constant through later market journeys and repair. Sixteen governor departures are recorded by the endpoint, both communities remain fed, sanitation is fully served, household water never falls below 100 after City recovery, and the saved City has 24 home logs, 31 timber, 76% headworks condition and an eight-person camp with 34 logs. Populations, inventories and the governor ledger restore without a new runtime schema. This proves a bounded staffed route; twenty authorized trips, finite buyer funds and recurring bricks/tools cannot establish unattended equilibrium.

Manual-only linked 100-person recovery and measured failure: The earlier saved woodland branch continues with existing commands and schemas. After precision-saw-timber stalls behind inactive Joinery, SET_PRODUCTION_RECIPE selects saw-timber; real log conversion revives the active specialist, and precision sawing can be selected again. SUSPEND_TECHNIQUE on Land registry frees a recurring timber while Public accounting and Regional institutions keep regional forestry authorized. Three home SET_PRODUCTION_MANDATE targets at 1,600 food open storage for further DISPATCH_OUTPOST_SUPPLY returns. A ten-log finite sell-logs caravan pays for buy-bricks two and buy-tools one. The owner briefly suspends Regional institutions, imports more physical camp logs, then funds normal maintain-headworks work at eight timber, four bricks and one tool. The repaired 108-place source and three producers switched to continuous output allow eight residents through physical migration within five daily checks, yielding 100 residents at home plus eight at the outpost. Further paid returns and a 250-food target at the camp allow another automatic harvest, but the longer replay reaches home logs zero while camp logs remain at least twenty; headworks capacity falls to 96 and the home is a Village. Both populations, rights and inventory restore from save. The outcome shows a transport/maintenance cadence gap, not a new resource or population grant.

100-person woodland-outpost supply branch: A saved pre-City checkpoint starts with 100 residents and earlier controlled expansion materials. Existing DISPATCH_CARAVAN jobs sell 180 real clearing logs in eight loads of at most 24 because cargo and seven travel rations must fit the 60-weight capacity; delivered finite waystation stock supplies 70 timber in three loads and five tools in one. DISPATCH_FRONTIER_SURVEY returns a report for site:530:715; active Record keeping permits REGISTER_OUTPOST_CHARTER. DISPATCH_OUTPOST_FOUNDERS with extraTimber:10 debits 70 timber, four tools, food and eight existing people, then establishes an eight-person camp with 30 timber and one unchanged founding-grant ledger. Its paid community-field construction and two workers keep four local food checks without shortfall. Two normal START_HARVEST jobs credit camp logs; two DISPATCH_OUTPOST_SUPPLY journeys each carry 32 food outward and credit 18 logs to home only on physical return. The home mill is temporarily unstaffed during each return so exact custody is visible. A pre-service SET_FORESTRY_MANDATE fails because the linked home lacks Regional institutions. Eight more logs sold to the finite buyer fund two tool purchases, after which a staffed home registry completes paid regional-institutions research and adoption. The camp then retains an ongoing forestry order, creates a normal forestryMandateVersion:1 harvest job, stores its output locally and sends 18 logs home on a third paid food-and-collection trip. Save restoration validates the link, populations, inventories and active forestry mandate. This adds no runtime schema or resource grant and does not prove perpetual material or repair balance.

Measured one-woodlot City limit: A copied ZoneEngine continuation starts from the saved 100-resident City after standing forestry and three 1,600-food producer targets have run. The owner-visible regional projection has timber-balance and headworks-materials issues before advancing and mutates no live state. Four ordinary nextDayAt advances on the copy leave 100 residents but deplete stored timber on check three, record unserved sanitation, wear the central headworks below 50 on check four, reduce household water capacity from 108 to 96, and downgrade City to Town. The source engine snapshot stays byte-equivalent. This test is negative evidence for indefinite M3/M7 balance; no production rate, grant, price, right or save schema was changed here.

Standing forestry and target food at 100 residents: The existing version-two forestry mandate accepts orderMode:"ongoing" on the actually registered fringe-v2 woodlot. Its first check calls the normal full-batch storage quote and records blocked with zero orders when fewer than 21 spaces remain; the City forestry projection reports the same reason. Three existing SET_PRODUCTION_MANDATE target orders at 1,600 food pause field output while retaining staff. After household meals free capacity, the next mandate check creates a forestryMandateVersion:1 two-worker harvest job. Normal completion credits physical logs once, and eight following daily checks retain population 100, City stage, food, household water and sanitation. No runtime schema, inventory migration or forestry yield changes were made; one woodlot and finite repair inputs still limit the long-run claim.

Bounded City woodland renewal: The 100-resident command route chooses an eligible field for storehouse, leaving one fringe-v2 forest release unbuilt. Existing DISPATCH_CARAVAN log-sale and tool-purchase jobs, DISPATCH_FRONTIER_SURVEY, and REGISTER_CHARTER_EXTENSION acquire that plot without a resource or title grant. Two normal START_HARVEST jobs on the same hex debit tree cover and maturity, credit actual stored logs and wait for recovery between cuts. Existing forestryStorageReason requires capacity for the whole quoted 21-log second batch; a one-day field staffing pause opens that space before the second order, and staffing then resumes. Nine checks before the second cut and three afterward retain 100 residents, City stage, full food/water/sanitation service and nondecreasing timber under the selected precision-saw recipe. The live City projection includes the pure Regional overview headworks-materials issue with a Supply chains target before the brick purchase and removes it after completed work. A fourth normal maintain-headworks job spends local timber, four bricks bought with four actual log-sale coins, one tool and assigned crew before condition falls below delivery. No runtime rule or save schema changes in this step; controlled earlier expansion stock, finite buyer coins, stored clearing logs and future repair cycles remain limitations.

Secondary local wells: secondary-well is an Irrigation-gated, one-hex civic building costing {timber:40, bricks:18, food:12, tools:2} and 110 work, with one staff place. zone-engine.constructionRequirements requires a survey of the same settlement, a naturally suitable unmarked field/forest source (moisture >= 0.55, elevation <= 0.65), cleared ground and commons adjacency. For an outpost, new well construction also requires retained local charter custody and the actual operational village-center commons, condition at least 65 and no building job; a raw or merely reoccupied camp must first develop or restore it. Persisted wells retain custody through damage/evacuation when that local charter remains valid. The normal paid construction queue and footprint rights still apply. land.secondaryWells contributes twelve units per non-cleared operational well only with condition at least 65, assigned staff, active Irrigation, no active building job and a dry site; land.sourceCapacity adds this to the existing central source when its commons connection is usable. land.allocation exposes installed potential separately from current local delivery, preserving household-first irrigation accounting and separate conduit imports/exports. land.initialize rejects persisted non-cleared wells without the matching survey, source terrain or commons adjacency. City Buildings uses the catalog entry and Land & water lists live well status. A command-only test sells 39 actual founding timber for 78 coins, barters for tools, buys 78 finite waystation bricks, funds three staffed wells, a damaged-well repair and the central deep lens, and restores 108 local capacity. A follow-on branch injects only later expansion timber/tools, then executes returned frontier surveys, paid first- and second-ring registrations, eight timber-framed houses, three staffed food fields, a care hall, waste yard, storehouse and 60 physical migrant arrivals to reach 100 without a new founding grant. Headworks wear initially removes the central twelve; secondary wells retain 96 places until paid repairs restore 108. A precision lumbermill converts finite cleared logs to timber for daily sanitation and repair, while log sales earn finite coins for bricks and tools. Twenty-five consecutive 100-resident checks retain complete food/water/collection service; Regional institutions at a staffed registry earn City stage, and restore preserves 100 people and 108 water places. This is a bounded scenario, not proof of renewable expansion materials or indefinite upkeep. See living world design, interface and player guide.

Town sanitation: urban-sanitation is a Building-branch topic researched at a staffed Care hall after Care institutions and Public accounting. waste-yard is a two-staff civic building with standard construction/condition rules and a semantic footprint-and-label fallback. people.sanitation version three initializes empty for older chartered villages and validates served days, cumulative timber and each last coverage/pressure receipt. Version-one ledgers migrate explicitly; their last receipt gets costVersion: 1 and retains the historical flat one-timber rule, while new receipts use costVersion: 2. Version-two ledgers gain a null (unlimited) dailyTimberLimit on migration without changing receipts or stock. The owner-only SET_SANITATION_POLICY command accepts null or a whole zero-to-32 limit, spending nothing immediately and retaining worker assignments. At a household check, sanitation.plan computes need = max(0, population - 64) and covered = min(need, 24 × eligible staff, 48 × min(local timber, daily limit)), when the technique is active; a null daily limit is unlimited. A sound operational yard must have at least 65 condition, a dry site and assigned staff. Spending is ceil(covered / 48) real timber. Unserved residents produce min(8, 2 + unserved/8) pressure rounded to two decimals. population.advance applies that after ordinary/event recovery and before separately recorded flood injury. City projection explains blockers; Supply chains lists the exact conditional use. settlement-development.assessCity treats sanitation as met below 100 residents, while health pressure already begins above 64. At 100 or more it requires the latest check to match current population, have zero unserved residents and be the immediately preceding village check, plus an active Urban sanitation program and eligible yard staffing capacity at least equal to the current need. Current timber stock is deliberately not part of this stage check because payment precedes development assessment; the last receipt proves actual supply on the completed day. The existing three-day qualification/decline streak handles stage changes; no saved development schema changes. Staffing and specialist upkeep use existing workers and food. No waste goods, compost, geographic waste network or disease transmission is claimed. See living world design, interface and player guide.

Dated flour market sale: coin-market.OFFERS.sell-flour quotes two coins per flour from the existing finite NPC fund. logistics.quote requires a sound operational Grain mill with two assigned workers, selects oldest-first flour through the shared perishable-cargo selector, and rejects selected batches expiring by the estimated outward arrival. DISPATCH_CARAVAN debits real flour and provisions, holds buyer coins, and creates a separate marketFlour version-one batch ledger. Outward expiry spoils carried batches, recalls the trip and releases held money; exchange consumes flour without adding it to the undated waystation depot. Recalled survivors return through perishables.receive with original dates, subject to warehouse and age-bucket space. Completed delivery credits communal coins only on physical home arrival. marketFlourVersion: 1 is added empty to older saves and validates active and retained completed custody; it does not reinterpret existing marketFish receipts. The City review, caravan and history expose batches, and Supply chains marks sale as conditional rather than an automatic recipe. See living world design, interface and player guide.

Grain meal floor: storagePolicyVersion: 2 adds economy.grainMealDays (integer zero through three) to chartered villages and outposts. Version-one and pre-policy saves migrate to zero; version-two saves validate the field. SET_VILLAGE_POLICY reviews the setting under existing settlement authority, revision and catch-up rules. founding.productionGrainMealReserveReason applies only to batches consuming grain and producing flour: a batch is held if post-input stock would be below population × grainMealDays. Live production, City producer reasons and one-cycle potential food output use that same condition. Ordinary household fallback, trade, physical cargo and dated spoilage retain their own rules. No stock, reservation, warehouse capacity, worker or expiry is created by changing the setting. See living world design, interface and player guide.

Dated grain and flour: perishables ledger version three extends each chartered settlement's fish batches with grain (sixty daily checks) and flour (fourteen). foodChainStartedAt marks the migration boundary. Earlier version-one/two fish ledgers validate under their own schema before grain/flour are added from actual current inventory as fresh opening batches; no historical spoilage is inferred. warehouse-history inventory changes withdraw oldest batches, including field use, milling, household fallback and flood loss. A new production batch gets an expiry from its actual output check; age expiry runs before that check's production and records a real withdrawal. The 256-distinct-expiry limit includes reserved player-trade payment dates. fishTransportVersion and fishVersion advance to two: old active outpost jobs and bilateral contracts get fresh dated custody for their physical grain/flour cargo or reservations, while already closed undated contracts retain historical absence of dates. New transfers preserve original dates through reservations, travel, storage waits and recall. Restored ledgers validate quantity conservation, chronology and custody; copied-world forecasts and owner projections use the same rules. Prepared food remains unaged. See living world design, interface and player guide.

Monitored-source title and feature comparison: major-waterworks.projection(...).monitoredSites adds constructionTitle.unassignedCells and constructionTitle.markedCells from each site's own review(..., includeImpact=false).constructionTenure. The selected site's values agree with the detailed candidate; another station is calculated at its highest supported capacity, without copying the selected footprint. City renders exact marked cell IDs and feature kinds, with a separate untitled count. The read leaves proposal, water, land and stock untouched. A paid two-station test checks independent review and save restoration; the Lower basin case checks farm 1375043. See living world design, gameplay foundations, waterworks plan and player guide.

Construction checks marked terrain separately from title: ZoneEngine.constructionFootprint reads the immutable naturalCell(id).feature only after confirming that footprint hex belongs to the selected settlement, preserving the outside-boundary privacy rule. It emits feature for any marked cell except a resource marker when the building is an extractor for that cell's surveyed matching deposit or when the surveyed, exhausted deposit has a completed paid reclamation record. A disturbed resource site awaiting that project reports the existing extraction blocker and its reclamation remedy instead of the generic feature refusal. constructionRequirements maps the feature blocker to the rights category; constructionPlan and START_CONSTRUCTION use the same footprint gate, so a rejected order spends no stock. Existing structures and saves are untouched. A controlled title on farm 1375043 verifies the denial, while the paid iron-outpost tests verify the resource exception. See living world design, gameplay foundations, interface behavior and player guide.

Incoming marked-construction disclosure: major-waterworks.projection(...).incoming derives markedConstructionCells from constructionCells(notice.terms) and immutable naturalCell(...).feature, then intersects that list with current easementCells for recipientMarkedConstructionCells. The source proposal and exact notice terms remain authoritative; no new saved field or rights are created. City renders this terrain list ahead of recipient easement controls, including for superseded notice history. The paid two-owner test confirms farm 1375043 appears for the southern recipient, is absent from that recipient's own marked-charter subset, and appears identically after restore. candidate-construction-features-unreviewed still blocks approval independently of title. See living world design, gameplay foundations, waterworks plan and player guide.

Construction-feature blocker independent of title: major-waterworks.constructionTenure now derives featureCells from constructionCells(terms) before filtering for unassigned title. unassignedFeatureCells remains the subset without a current charter, while candidate-construction-features-unreviewed stays in review.blockers for any marked construction cell. The read-only City panel names the marked cells regardless of holder. A controlled test adds title to farm 1375043 in memory and checks that the unassigned-feature entry disappears while the separate feature blocker persists; no command, save field, consent or feature-use approval was added. See living world design, gameplay foundations, waterworks plan and player guide.

Shared two-owner receiver supply and notice: The watershed-outposts integration continues player-seven/player-eight charter receipts through PROPOSE_TRADE, ACCEPT_TRADE and DISPATCH_TRADE: six southern-home tools exchange for eight observation-home timber after actual travel and payment custody. The source home pays three ten-lot iron waystation trips, uses harvested logs in a charcoal kiln and staffed forge-tools smithy, and sends forged stock on normal outpost cargo journeys. Test helper monitoredBasin(...,{localTools:true}) skips only its usual waystation tool purchases; authoritative survey, construction, research, supply and monitoring commands remain, and five waystation tools stay finite. The source's returned watershed report exposes fringe-v3:1373000:1375044 for an ordinary dry pre-survey before the station. After a normal draft and selected natural intake and pool-entry controls, REGISTER_CHARTER_EXTENSION charges sixteen timber, two tools and eight food with active Land registry and Public accounting and records the exact proposal/edge authority. The 25,000-subunit base review then has only marked farm 1375043 unassigned; the selected controls add other untitled endpoints. The filed notice names the southern village in constructionTenure.otherHolders. Its actor acknowledges, grants incoming.easementCells for exactly 1375042 and 1377091, and separately signs water use; the source actor signs its own. Restore checks trade, seven base receiver titles, dry report, gauge, frozen terms and distinct response, easement and water-consent actions. The signatures grant neither full affected-party coverage nor operational waterworks. See living world design, gameplay foundations, major waterworks plan and player guide.

Southern basin paid title and marked-ground audit: frontier-sites.watershedSouth appends the fixed seven-field release only when its dry terrain, complete drainage to basin 1375046, disjoint offers and bounded route from site:495:703 still hold. frontier-sites.find and expansion.projection expose it without changing earlier offers. A two-owner integration starts after player seven's four paid receiver titles; player eight returns the normal frontier survey, founds and provisions the camp, adds a real household, funds the local village and staffed registry, then pays separate inner and outer edge surveys and registrations for 1377091 and 1375042. Title, population, stock and outpost links survive reload. major-waterworks.constructionTenure continues to count current ownership; its new unassignedFeatureCells names marked but unchartered construction ground, including 1375043 with generated farm feature. City identifies the missing ordinary edge offer rather than treating a three-hex radius as title or vacant tenure. No new save field, water grant, feature consent or cross-owner reservoir easement is introduced. See living world design, gameplay foundations, major waterworks plan, interface behavior and player guide.

Prospective fourth-ring receiver survey: charter-extensions.prospectiveWorksCells reads at most sixteen current published source reports owned by the village without an installed station. It recomputes a complete candidate catchment and bounded natural pool-entry edges, then exposes only released fourth-ring endpoints in the City charter projection with preSurveyOnly: true. The ordinary expansion.quote and travel job still charge workers, timber, tools and carried food; floodwater still blocks movement and on-site observation. charter-extensions.quote continues to reject registration without an active exact selected entry-control proposal, active civic and hydraulic service, a fresh returned survey and ordinary payment. The paid Lower basin integration pre-surveys 1375044, installs the station, selects revision-three controls, registers the exact edge, and restores its report and proposal-pinned title. The unselected 25,000-subunit storage/spill review leaves 1375042–1375043 unassigned; the active selected-entry proposal still has twelve untitled construction cells after its exact control endpoints are included, alongside water-right and engineering blockers. No save field or automatic title was added. See living world design, gameplay foundations, major waterworks plan and player guide.

Lower-basin receiver-edge title sequence: A command-funded village uses charter-extensions version-one receipts for 1375046, 1377095 and 1377096 and a version-two receipt for 1375045. Each DISPATCH_FRONTIER_SURVEY consumes the ordinary two-person route cost and must return before REGISTER_CHARTER_EXTENSION spends the local registration materials. The helper suspends timber-consuming civic programs during physical home supply journeys, activates Land registry for registration and also Public accounting for the outer edge. It then installs the paid runoff station at owned 1375047. major-waterworks.review at 25,000 subunits reports construction tenure unassigned only at 1375042–1375044, while retaining the separate engineering, impact, easement and water-use blockers. Save restoration revalidates each charter receipt and gauge. expansion.projection now explains the player-facing order; no charter, water or material is granted automatically, and a flooded survey site still returns no report. See living world design, gameplay foundations, major waterworks plan and player guide.

Lower-basin observation village and paid station: frontier-sites.watershedWatch appends stable offer watershed-watch-v1:505:670 only when the original Basin approach exists, its seven high natural fields and moisture pass the fixed terrain check, no earlier released two-ring or base region overlaps them, and the linked woodland approach has a walkable route. The center's complete candidate drainage terminates at basin 1375046 with at least 25,000 natural saddle subunits; all parcel cells stand above that proposed waterline. expansion.projection lists the offer separately. Existing survey, conditional charter, founder and supply transfer, local village, knowledge and watershed-survey commands do the work without grants. The command-funded regression develops the eight-founder camp to a twelve-resident village, pays local building and agriculture prerequisites through Hydraulic engineering, returns a watershed report from owned hex 1375047, installs its separate runoff station and restores both report and gauge. major-waterworks.review recognizes 32,500 natural saddle subunits there, but its 25,000-subunit candidate still has unresolved construction title in this monitoring-only route because basin center 1375046 is unchartered. No proposal, material grant, hydraulic approval or W4 operation follows from monitoring. See living world design, gameplay foundations, major waterworks plan and player guide.

Monitored reservoir source release counts: major-waterworks.projection reuses each paid station's current review(..., false).releaseOutfallScreen at its highest supported capacity. Only complete, nontruncated routes to a distinct receiving basin enter releaseRoutes.complete; the summary separately counts positive receiver-bed head, positive retained-peak head, positive bed head lost at a recorded peak, and missing receiver-node history. Selected source and same-basin station rows use the same basin calculation, while the source report IDs remain distinct. The list is read-only and bounded to the existing sixteen displayed stations. City presents it as a site comparison, not hydraulic approval; no saved terms or water change. See living world design, gameplay foundations, major waterworks plan and player guide.

Candidate-outfall receiver peak preflight: major-waterworks.releaseOutfallScreen now uses the same retained receiver peakStorage, current sediment displacement and basin level calculation as the selected outletGradeScreen. For every candidate crossing with a current receiver node, it reports receiverObservedPeak and maxOneIntervalObservedPeakReleaseSubunits = max(0, proposedCapacity - sourceBasinVolumeAt(floor(receiverPeakLevel) + 1)); unknown history remains null. The integer step is the smallest represented level strictly above a fractional peak and keeps the bound in whole water subunits. observedPeakHeadSupportCount counts only complete, distinct receiving routes with positive peak-level head. The earlier receiver-bed bound and selected-grade blocker remain distinct. City renders both bounds before selection; the paid Basin regression supplies a high receiver peak and checks zero peak-level head despite positive bed-only head. No save field, command, release routing or construction authority changes. See living world design, gameplay foundations, major waterworks plan and player guide.

Same-plot land-maintenance candidate fallback: land-maintenance.proposal keeps condition-and-name ordering but checks specialist, authoritative land.quote, selected-period allowance and operating-budgets.check for each candidate in turn. Candidate-specific failures become bounded read-only quote.deferred entries; the first fundable candidate starts its ordinary land.start job and its retained decision reason names skipped work. Food headroom, free workers, crew priority and active plot work are checked once before the loop and still block every candidate. If all candidates fail, their reasons form the visible blocked check. The paid irrigation-after-unfunded-soil case verifies actual custody and daily/offline agreement. No save schema or separate repair path was added. See living world design, gameplay foundations and player guide.

Land-maintenance allowance periods: state.landMaintenance version two adds allowanceMode, day and daySpent to each plot instruction. Version-one saves migrate as capped; the current-day gross map is reconstructed only from retained same-day funded checks. configure rechecks the selected period against already committed gross spending, and advanceDay resets the daily map only on a new charter home day before calling the existing land quote/start and operating-budget paths. The funded job still debits real materials; cancellation does not subtract from spent or daySpent. Restore validates mode, day, daily map and cumulative job/history bounds. City and Regional projections expose the period and current-day totals. Tests cover two paid headworks repairs under one-repair daily ceilings, soil repair, capped switching, migration, corruption and daily/offline agreement. This changes authorization, not resource supply. See living world design, gameplay foundations and player guide.

Frozen major-reservoir notice basis: major-waterworks.noticeBasis combines seven bounded public party sources without changing the existing noticeParties IDs or owner rules. Filing saves the ordered reason arrays as notice.basis; City source history and projection(...).incoming[].basis render that filed value, including on superseded notices. Ledger/land version sixteen migrates version-fifteen and earlier notices to basis: null and validates exact party keys, supported codes and canonical order on restore. A null historical basis never claims reconstructed evidence. For non-null basis, noticeCurrency now compares the current canonical reason lists after party and owner checks and returns notice-basis-changed-amend-required on any difference. Response and grant commands reject that notice, and current water-consent coverage becomes unsigned until amendment and re-filing; version-fifteen migrated null bases retain the earlier party check. The recipient impact replay still governs whether an active notice can be answered; the reason list grants no rights and changes no water. See living world design, major waterworks plan and player guide.

Recipient notice engineering disclosure: majorWaterworks.projection(...).incoming[].terms is already a copy of each filed notice's frozen terms. city-interface now renders the exact intakeManifold.edges and rating, optional intakeDesign.profile, optional outletAlignment.cells, and optional outletDesign.rateSubunits/profile for recipient notices, source notice history and the filing, answer, easement and water-consent confirmation reviews. Lists are complete; absent selections are explicit. It never substitutes the current proposal's currentReview for a historical notice. A two-charter paid Basin test checks that the recipient's terms equal the filed revision and remain unchanged but inactive after amendment. This is presentation of existing public notice custody: no new save version, rights, hydraulic result or water movement. See living world design, major waterworks plan and player guide.

Main navigation to live City: gameplay-interface.js maps the five top-level gameplay buttons to GonzCity.openTab followed by openView("city"): economy→supply, family→continuity, politics→offices, military→defense and expeditions→expansion. openTab selects the requested section before City mounts or remounts; its normal render path downgrades a restricted resident or production steward to the authorized view. The shared City reviews and server commands remain the only durable order path. data-view-jump design links and Chronicle still use labeled browser-local sample screens. The scripts have new cache keys, no state or save-schema change, and the runtime navigation test covers all five routes plus the sample boundary. See living world design and player guide.

Per-site finite extraction in goal plans: supply-chains.projection gives single-output mineral recipes both the aggregate finiteRemaining for display and finiteSites with each matching existing structure ID, anchor hex and remaining deposit. The read-only supply-goal-plan tracks usage by source key and site ID across all goal branches, preferring currently ready instances, then larger remaining seams. It counts workdays separately within each site, caps the final batch by that site's remainder, and traces full input for every workday. siteBatches exposes selected hexes, batches and proposed output; selecting a blocked instance adds a source issue even if another site is ready. Other recipes and finite one-time projects retain their existing planning rules. This changes no save data or actual extraction. See living world design and player guide.

Accepted lease in the material graph: supply-chains.projection reads the tenant-scoped quarry-leases.projection, keeping only accepted leases with a current dispatch.quote. For each, it emits one project keyed by the agreement ID, exposes that ID for the City action, sets maxBatches: 1, caps output at min(deposit.remaining, quote.maximumYield), and uses the quote's complete tools and journey food as input. The project note distinguishes already held coin rent, payment on arrival and physical return before local stock. An unaccepted, blocked, travelling or completed lease has no tenant project source. city-projection.productionStatus surfaces the same live reservation as a host extraction-site blocker. The material branch's dispatch button opens the existing DISPATCH_QUARRY_LEASE review only for a current tenant, accepted status and valid quote; the server command remains authoritative for staff, institutional service, money, route, depletion and warehouse acceptance. The dependency planner only shares the finite hypothetical batch across branches; it never executes extraction or delivery. No save schema changes.

Retained receiver high-water evidence: basinWater version five adds peakStartTick, peakStorage and peakTick to each active conserved node. advance updates the high-water mark after each recorded four-hour interval without changing routing. Migration from versions one through four seeds the mark from only the oldest retained sample's opening and later retained closings, so no earlier high-water value is fabricated. Restore requires finite safe values bounded by cumulative inflow and by every retained sample, with an in-range tick. major-waterworks.outletGradeScreen maps the selected receiving basin's peak storage through its current sediment displacement and basin level function, then compares that level with the proposal's full source-pool waterline. review adds release-receiver-observed-peak-blocks-head when the former is at least the latter. This is a cross-time historical stress screen, not the same-interval replay or a rated future design flood. It changes no water, rights, order or material stock.

Finite local extraction planning: supply-chains.projection exposes finiteRemaining for single-output deposit recipes with at least one existing matching local producer. It sums the current deposits from the private production instances; it does not infer a deposit for an unbuilt catalog site. GonzSupplyGoalPlan.plan tracks produced units per source key across the whole tree, caps a partly depleted final batch to that remainder and still traces the full batch input. Any excess enters shortages; it is never added as a proposed co-product or warehouse stock. Ready output and site blockers remain separate current-cycle advice. The read is side-effect free and does not reserve deposits against live orders, leases or other plans. This covers existing local quarries and mines, not all future extraction and contract routes.

Ordered source selection in the dependency inspector: GonzSupplyGoalPlan.plan accepts either a legacy single source key or an ordered array of source keys per material. It de-duplicates keys, filters unavailable options and applies valid sources to the remaining gap in order. Its batches ledger limits finite maxBatches across all branches, while stored and proposed co-product pools are consumed once. Each material row exposes selectionKeys and per-source steps with count, covered amount, input children and readiness; any residual enters shortages. The City review adds or removes priorities locally and never issues a world command. A repeatable source may cover the gap before later entries; selected source readiness is an advisory current check, not a funded reservation. Existing local single-output deposit recipes now have the finite-unit cap above; automatic source choice and wider future-site or lease capacity remain open.

Finite salvage supply source: supply-chains.projection adds salvage:<structureId> only for an idle chartered ruin with cityProjection.structures[].salvageQuote.store === true. Its output is the exact catalog-derived quote, maxBatches: 1, with no automatic production rate or stock credit. supply-goal-plan limits selected batches by that cap across all material branches; co-products enter the proposed pool once, and unmet demand remains in shortages. Active funded work removes the source; cancellation may restore it, while clearing or rebuilding removes it. If the quote changes to uncollected because storage fills, no source is listed. All reads are private to the authorized City projection and side-effect free. This extends the M3 dependency inspector; future-site and lease source caps and automatic source choice remain open.

Cancellation previews for reserved harvest, clearing and salvage jobs add back that job's own warehouse hold before pricing refunds and any cart return. Cancellation removes the job before crediting either resource, so the preview and actual capacity now agree. Older unmarked salvage jobs keep material credit before a borrowed cart returns.

Chartered salvage custody: START_SALVAGE computes recoverable materials from the structure's catalog definition and applies the same food-space policy as new forestry output. New paid jobs save either salvageStorageVersion: 1 with an exact reservedSalvage map, or salvageDisposalVersion: 1 with quotedSalvage. The former contributes to storageSummary.salvageReserved through all crew states; capacity loss blocks before completion and later repair work can pass the queued job. Completion removes the hold before crediting the catalog yield; the latter clears the structure and records all quoted material as discarded. SalvageRecovered.storageOutcome records the result. Restore validates version, charter, structure, cell and exact catalog batch; older jobs without these fields keep the old overflow behavior. cityProjection.structures[].salvageQuote is a read-only current quote for idle ruins; command funding rechecks it. This is partial M3/M5 output custody, not a blanket guarantee for all production paths.

Clearing-log storage custody: ZoneEngine.vegetationPlan quotes the complete clearing yield from current cover. When the full batch fits local warehouse and protected-food space, new charter jobs persist clearingStorageVersion: 1 and reservedLogs; founding.storageSummary counts that hold with harvest holds as occupied space. ZoneEngine.forestryStorageReason queues a storage-backed job before felling if capacity falls, and the due-time guard checks again before changing vegetation. work-crews.schedule permits later repair work past that queue. Completion removes the hold before credit and clamps logs to the funded yield. When the batch cannot fit at funding, clearing remains legal: clearingDisposalVersion: 1 and quotedLogs record that all felled logs stay uncollected. Completion credits none and reports actual discarded logs, even if warehouse space opened meanwhile. woodland.initialize validates both marked forms; unmarked old jobs keep their former behavior. test/woodland.test.js covers both outcomes, damage, repair, completion and restore. New salvage has its separate custody rule above; older forestry and salvage jobs keep their prior overflow behavior.

Selective-harvest storage reservation: ZoneEngine.vegetationPlan computes expected logs for a mature selected plot and checks founding.economySummary free storage plus the configured food-space target before a chartered manual order is quoted or accepted. The standing forestry proposal applies its own full-batch check using that same yield. New charter harvest jobs persist harvestStorageVersion: 1 and reservedLogs; founding.storageSummary counts these commitments as occupied capacity even when crews queue or pause, so ordinary production and arrivals cannot claim the same room. ZoneEngine.workBlockReason queues a funded harvest when damaged or removed storage makes occupied capacity exceed the current limit. completeVegetationJob rechecks that condition at the due time before touching vegetation. The crew keeps its hold, and work-crews.schedule permits later repair work past this storage-blocked job; repair, new storage or outbound goods can resume it. Cancellation removes the job and hold. Completion removes it before creditResources, crediting at most the funded yield if the plot changes; older jobs without the field keep their former yield rule. woodland.initialize rejects malformed reservations on restore. test/woodland.test.js checks crowding, concurrent credit, cancellation, capacity damage, exact-due blocking, full completion and replay. No extra warehouse or on-plot cargo is created.

Six-title capital stone-to-lining regression: test/helpers/seven-community-masonry.js resumes the saved state after seven-community-stone-import.js and issues only normal owner commands. A frontier survey and charter registration add one titled field plot; forest supply, selective harvest and regrowth drive home timber and charcoal, while the smithy forges tools from paid iron. The scenario funds Masonry, Contour surveying and Structural engineering, builds and staffs a mason workshop, converts twenty-four rough stone to eighteen dressed stone, spends four on research, and commits twelve to the headworks lining. It includes actual clay-village cargo, brick-kiln batches and several paid repairs before the two-day lining; assertions preserve 62 people, six outpost titles and the restored linedAt value. Administrative services are suspended to free workers, and test/helpers/seven-community-lined-capital-return.js then resumes that saved result. It physically returns forest logs and food, mills timber, pays a later well repair, restores civic staffing, and verifies nine Town, City and Regional capital checks followed by a separate test/helpers/seven-community-lined-upkeep.js continuation of 26 stable days, six-title capacity, 62 residents and save restoration. That continuation uses two 24-log loads and eleven faster sawmill checks. A separate 24-day branch runs test/helpers/seven-community-lined-next-repair.js: it suspends two civic programs, mills retained home logs for two days, physically imports eight owned-camp clay, overlaps kiln and forge-tools smithy staffing for two days, and starts a paid maintain-headworks job from local timber, bricks and tools. Assertions on every advance retain 62 residents and at least 62 household-water capacity; the job ends at 100% condition with linedAt intact and reloads from save. Civic suspension makes the repair endpoint City. test/helpers/seven-community-lined-post-repair-capital.js resumes its exact saved state, completes four physical forest log pickups and seventeen four-worker sawmill days, reserves the last load for a continuously supplied mill, re-adopts Land registry and Regional institutions, and checks nine Town, City and Regional-capital qualification days. Three staffed offices restore six-title capacity; every advance checks 62 residents, six local food days, household water and six retained titles. While the mill rebuilds timber, that helper also physically returns eight owned-camp clay and runs two kiln days in parallel with milling; the Regional-capital endpoint reloads with ten timber, eight bricks and 51% lined-well condition. test/helpers/seven-community-lined-preventive-repair.js then releases four field workers and funds maintain-headworks from local stock. Every advance checks 62 residents, six food days, six retained titles and household water; after one day the lined well is at 100% and reloads from save. The eight-timber payment makes Regional institutions inactive for operating supplies, so current new-title capacity is two although the six titles remain owned and recognition still reads Regional capital. test/helpers/seven-community-near-forest-recovery.js continues the exact saved well-repair state through a crowded nearby outpost: a physical 48-food pickup frees warehouse room before a manual selective harvest; another team returns actual logs. The helper temporarily borrows one registry worker to staff the home field and sawmill, then restores office staffing. It checks 62 residents, six local food days, household water, six retained titles, Regional-capital recognition and save restoration. Continuous unattended balance remains unverified. See living world design, gameplay foundations and player guide.

Seven-community stone-import continuation: test/helpers/seven-community-stone-import.js forks the saved capital state reached by city-integration.test.js after six outpost titles and 62 home residents. The branch lowers lumbermill staffing by two to free a normal carrier team, sends three sequential DISPATCH_CARAVAN orders for ten, ten and five rough-stone lots, and completes each job through actual due-time advances. It asserts twenty-five home rough stone, twenty-five fewer depot rough stone, at least fifty home timber spent, unchanged six-title ownership, three import receipts and snapshot restoration. This import helper stops at delivery; the next saved-state helper pays for research, refinement, repairs and lining with real local materials and labor. See living world design, gameplay foundations and player guide.

Finite waystation rough-stone barter: logistics.OFFERS['rough-stone'] gives {roughStone:1} for {timber:2} per lot. Only a newly initialized logistics depot includes roughStone:96; existing version-one saves keep an absent or recorded amount without migration or material creation. The ordinary DISPATCH_CARAVAN quote applies two-person capacity, cargo weight, travel rations, local reserve and budget, route conditions and finite depot stock. Dispatch debits local timber and reserves stone in escrow; arrival exchanges it, and unloading credits the village only after physical return. Recall before exchange restores the depot reservation. logistics.projection reviews one, five and ten lots, leaving failed ten-lot routes visibly ineligible. Supply chains derives the offer from the same catalog. test/logistics.test.js covers debit, reservation, exchange, return, recall, exhaustion, old-save neutrality and restore. The waystation stock is finite; no stone deposit or masonry output is created by trade. See living world design, gameplay foundations and player guide.

Leased stone to headworks integration: test/leased-stone-well-lining.test.js starts from two normally founded owners and uses only accepted commands after the earned quarry-lease fixture. Four paid workdays debit twenty-four rough stone from the host's finite deposit; the tenant's four-person journey receipt returns exactly twenty-four, while the twelve-coin rent moves only after site arrival. The tenant retains the same outpost title count, learns and supports Masonry, refines twenty-four rough stone to eighteen dressed stone, spends four on Structural engineering research, then pays twelve for lining after normal groundwater prospecting and headworks extension. Three brick caravans and timber-for-tools caravans use ordinary logistics custody; local harvesting and milling replace timber. Assertions cover the separate payments, one-point wear on the following village day, and restored quarry-lease and land ledgers. The specific seven-community capital's host access and repeatable material balance remain unverified. See living world design, gameplay foundations and player guide.

Dressed-stone headworks lining: land.TYPES['line-headworks'] quotes a four-worker, two-day Structural engineering job on a sound, surveyed current village well, with exact dressedStone: 12, bricks: 8 and tools: 1 payment. It shares source structure custody, crew scheduling, pause/cancel refund and service interruption with the existing well work. At completion only headworks.linedAt changes; subsequent ordinary land.advanceDay wear is one point per day. maintain-headworks preserves that timestamp, while well-headworks resets it for the larger level. Water capacity, source limit, flood exposure and prior condition do not change. Land ledger six migrates earlier wells to null only, rejects unversioned/future/pre-build times and validates active lining jobs. Regional repair lead time uses floor((condition - 50) / wearPerDay) + 1 checks at or above 50%, where wearPerDay is one for lined and two for unlined headworks. City and Supply chains expose the state and material route. Controlled headworks tests cover completion, later wear, repair, extension, migration and forged saves. paid-well-lining-journey.test.js uses only normal commands after its earned Masonry village fixture: the owned quarry produces finite rough stone, carriers return it, a supported mason workshop dresses it, research and adoption unlock the two well jobs, waystation trades supply tools/bricks, and four free workers complete the paid survey, extension and lining. A lumbermill worker remains necessary for the Masonry specialist to stay active while dressing stone. The saved capital continuation above now also pays for refinement and lining; long-term materials remain open, while the following saved capital-return helper verifies renewed recognition. See living world design, gameplay foundations and player guide.

Outlet landholder notice-party coverage: major-waterworks.noticeParties now unions releaseReplay.receiverReleaseExposure.claims.communities with its existing natural-versus-proposal claims, construction holders and receiver building/well-pressure communities. The claim is the current public charter on a hex newly wet in the same proposed interval with release compared with its closed outlet. That holder can be absent from the natural-versus-proposal list when natural flow wets the same plot. IDs are de-duplicated and owner IDs come from current settlement state, not from replay metadata. A verified replay supplies the claim; incomplete evidence invents no party. noticeCurrency rechecks an existing notice against this current set; a missing newly identified party suspends answers and grants until the source amends and files again. The ordinary frozen notice, response and separate consent rules apply without a ledger migration or live-water mutation. See living world design, major waterworks plan and player guide.

Flood-exposure release counterrequest: RESPOND_MAJOR_WATERWORKS_NOTICE now accepts requestedReleasePercent: 25 with decision: object and ground: flood-exposure only when the exact current notice has terms.releasePercent: 50. The existing eight-field response, command event, source/recipient projections and briefings retain it; no ledger version or migration is needed. Restore validates that frozen 50→25 scope without replaying mutable later water history. Downstream-flow objections still allow the other supported rate, while bypass requests remain exclusive to downstream-flow and a response still cannot request both alternatives. The recipient's release-impact screen informs the choice but does not gate subjective concern. Amendment does not import the old answer or consent. See living world design, major waterworks plan and player guide.

Recipient-scoped outlet release evidence: major-waterworks-impact.history accumulates positive same-bed, same-interval outlet-open minus outlet-closed building flood-rate differences in public per-charter aggregates, including distinct affected structure and newly wet working-well counts. When passed recipientId, recipientWellExposure.receiverRelease includes only that recipient's current-charter receiver hexes (64 shown with an exact count) and its own aggregate pressure; an unrelated charter gets zero. Existing incoming[].wellExposure and the alternate-release wellExposure carry the owner-scoped value into City, where the noticed and alternative outlet effects are compared. The public aggregate does not include current building condition; no foreign exact receiver cells or private condition leave the recipient view. This is a read-only recorded-window scenario and grants no consent or flood-safety approval. See living world design, major waterworks plan and player guide.

Exact source amendment projection: major-waterworks.projection uses the one active proposal at the selected source cell, when present, as the baseline for City candidate capacity. Its selected release/bypass, exact intake route/manifold and outlet alignment/design pass through normal review validation; other monitored plots retain independent generic review. Every valid capacity and alternate-bypass variant uses a complete review so grade, flow, impact, blockers and notice-party membership cannot be copied from different terms. Each candidate keeps one full alternate-release review, with percentage-keyed replay and party arrays derived from the matching terms. City selects that review when the release control changes. The projection has no write or save-schema effect, and amending still changes revision and invalidates prior exact consent. See living world design, major waterworks plan and player guide.

Disconnected rated-entry evidence: The same-interval residual-flow graph computes which positive-capacity selected gate receiving cells can reach a source-basin boundary-export sink through other recorded surface transfers. ratedEntryLimit reports disconnectedEntryCount and up to eight exact {from,to,admissible} pairs; history aggregates affected intervals and entry-interval occurrences. A gate with a path remains connected even when another gate competes for a shared downstream bottleneck. This is a graph reachability statement, not a unique flow allocation or source-water provenance. See living world design, major waterworks plan and player guide.

Rated source-inflow custody: major-waterworks-impact.simulate applies a non-null exact-entry intake limit only when delivering direct runoff to the proposal's source basin. Basin-to-basin incoming transfers still increase that basin's arrived, storage, subsequent routes and conserved pass-through, but cannot spend an allowance derived from source-basin surface-edge paths. The null-limit legacy basin-wide branch retains its earlier hypothetical behavior. A controlled 2,000/118,326 direct/transfer case checks 1,500 rated capture and zero transfer capture under 25% bypass. This is still a read-only upper-bound scenario without mixed-water provenance or built controls. See living world design, major waterworks plan and player guide.

Exact routed-entry upper bound: major-waterworks-impact.ratedEntryLimit now requires a matching surfaceRouting.edgeWindow row and exact basinWater.routeWindow source receipts. Per selected entry, it subtracts the integer-ceiled bypass and limits the remainder by the gate tier. A bounded residual-flow graph starts with those per-edge capacities at their receiving cells, follows only other registered transfers from that same four-hour interval, and ends at boundary source receipts for the proposal's basin. Candidate simulate capture uses the resulting maximum flow only for direct source-basin runoff in single-tick, no-release and carried-storage branches; incoming basin transfers cannot spend that allowance. Missing receipts yield zero; unrelated exports cannot contribute, and positive-flow entries without a sink path are reported separately from entries sharing a bottleneck. edgePotential reports the pre-route gate sum and potential the routed ceiling. This is an optimistic same-interval attribution after possible mixing, with no lagged surface storage or engineered gate. See living world design, major waterworks plan and player guide.

Regional rated-intake exception: major-waterworks.intakeRatingAttention reads active source-owned rated-entry-controls-v2 proposals, derives current exact natural entries and their retained surfaceRouting.edgePeaks, and emits only tiers below an observed edge peak. Regional overview maps each issue to the source hex and Land & water tab. The read is owner-scoped, bounded to eight recent active proposals and changes no saved state; a sufficient amended tier or cleared rating removes the current exception. It does not substitute for complete W2 impact or W3 construction checks. See living world design, major waterworks plan and player guide.

Persistent surface-routing peak evidence: Ledger version three adds peakStartTick and edgePeaks[key] = {amount,tick} to cumulative transfers and the 20-row exact edgeWindow. recordInterval advances a peak only for an actual larger registered transfer. Restore validation checks key provenance, safe quantities, start/end ticks, recent-row maxima and exact peak receipts still in the window. Version one migrates with an empty peak history; version two derives peaks only from its validated retained rows and starts history immediately before those rows. poolEntryFlowEvidence exposes both recent and retained per-edge peaks; gateRatingReview uses retained peaks for the below-observed-tier blocker. A past peak outside the retained window is preserved by the versioned ledger but cannot be reconstructed from a legacy cumulative total. See living world design, major waterworks plan and player guide.

Exact rated-entry ceiling in basin replay: major-waterworks-impact.ratedEntryLimit matches each basin tick to the retained surfaceRouting.edgeWindow row and requires every selected endpoint to have joined before that full interval. For each exact edge it subtracts the integer-ceiled selected bypass from observed transfer, caps the remainder at the per-edge gate tier, then sums a safe-integer total and constrains it by recorded same-interval paths to source-basin exports. simulate limits total candidate capture to the routed quantity in the one-tick, no-release preflight and retained-window branches; unobserved intervals use zero. The natural branch still must reproduce recorded basin balances and routes exactly. Public replay output includes coverage, observed flow and potential admission; it does not claim cell-level capture provenance or an engineered connection. The controlled test uses one 8,000-subunit observed edge with 25% bypass to cap basin capture at 6,000 and rejects a missing next interval. See living world design, major waterworks plan and player guide.

Rated-intake grade, work estimate and supply goal: major-waterworks.intakeGradeScreen requires complete bounded natural pool-entry paths and derives one candidate invert below the proposed capacity waterline, propagating at least one height-millionth fall along each path. It counts each merged hex once, reports natural high approaches and sums ceil(cutHeightUnits / 256) per cut hex. SELECT_MAJOR_WATERWORKS_INTAKE_GRADE selects or clears that canonical candidate-graded-entry-paths-v1 profile on a rated exact-entry draft, requiring current source authority, Hydraulic engineering, survey and complete paths. A selection changes revision and makes prior notice signatures historical; same-capacity amendments retain it, while clearing the route, controls or rating drops it. Version-fifteen migration accepts older notices without inventing a grade and rejects unversioned or forged active/frozen profiles. intake-grade-unselected clears when selected, while intake-engineering-unverified remains. intakeWorkEstimate version two adds grade.cells.length + grade.cutWorkUnits four-worker days whenever the current grade screen is complete, including before formal selection. It adds 4 * cutCells + 2 * cutWorkUnits timber, 2 * cutCells + cutWorkUnits bricks, 2 * gradeCells + cutWorkUnits dressed stone, ceil(cutCells / 4) tools and four food per extra day to the rated-gate envelope. Otherwise the bill explicitly remains gate-only. review and saved projection expose current shortages after protecting household food; city-projection sums the intake bill with any exact graded outlet as one one-time Supply chains consumer. The paid Basin grade's one 295-unit high cut yields two cut-work units, raising its gate bill to 56 days and 168/116/104/40/11/224 timber/bricks/dressed-stone/iron/tools/food. The profile is exact proposal language, not a hydraulic cross-section, future-flow proof, permission or construction. See living world design, major waterworks plan and player guide.

The preliminary intake uses lanes = ceil(gateCapacitySubunits / 250000) and days = 3 + edgeCount * (2 + lanes) for four workers. Timber is 16 + edgeCount * (6 + 3 * lanes); bricks 8 + edgeCount * (5 + 2 * lanes); dressed stone 8 + edgeCount * (3 + 2 * lanes); iron edgeCount * (1 + lanes); tools 2 + ceil(edgeCount / 2) + lanes; food 4 * days. These are abstract planning quantities, not measured excavation or a gate discharge certificate.

Regional outlet exception: major-waterworks.engineeringAttention reads at most eight recent active source-owned proposals with exact graded outlets. It calls the verified historical replay for current terms and returns only positive receiving-backwater losses; Regional overview shows a source-local attention row with the requested, delivered and withheld totals and a Land & water target. The read does not advance time, mutate custody, publish another owner’s basin levels or authorize funding. Clear/withdraw removes the current row, while older notices remain recorded history. See living world design and player guide.

Graded-outlet backwater replay: For each exact recorded interval, the proposed receiver’s opening water and direct local runoff are read before release from the candidate branch; when release is requested, a second read-only candidate step without release supplies its known routed incoming transfers before ordinary losses, with that branch’s sediment displacement when the coupled sediment window is complete, or the current modeled displacement used by legacy water-only replay. Its modeled water level plus one height unit is converted through the source basin’s volumeAt; the effective release floor is the maximum of that volume and the exact graded entrance floor. Requested release is first capped by available held water above this floor and the selected four-hour rate. A bounded integer search then finds the greatest transfer whose resulting source level remains at least one height unit above both the graded invert and the receiving level after that transfer. The replay records per-tick routed receiver influx, pre-release and post-transfer receiver heights, effective opening floor, discharge withheld by backwater and the portion attributable to the receiver rising during transfer, plus aggregate blocked intervals and units. Ungraded legacy corridors retain their earlier optimistic semantics. This is a gravity-screening constraint, not a friction or channel-section design. The exact-entry bound remains a separate upper bound without receiver water. See living world design and player guide.

Proposal-to-supply projection: City computes the authoritative major-waterworks review once and passes each active draft or noticed proposal with a valid exact graded outlet estimate into the settlement-local supply graph as a copied one-time consumer. Its input is exactly outletWorkEstimate.materials, so dressedStone joins the same resource trace as the mason recipe. These prospective goods never enter recurringDemand, coverage or warehouse receipts, and projection does not mutate the proposal. Clearing or withdrawing the proposal removes the current planned consumer; old notices remain history. The source owner sees only its own proposals. See living world design and player guide.

Preliminary outlet-work arithmetic: outletWorkEstimate runs only when candidate-graded-outlet-v1 is exact terms. It assigns ceil(rateSubunits / 2500) abstract lining lanes within the already selected corridor, sums ceil(cutHeightUnits * lanes / 256) over the canonical profile, and estimates village days as 1 + routeCells * lanes + cutWorkUnits + 2. The four-person planning materials are timber 24 + 4 * routeCells * lanes + 2 * cutWorkUnits, bricks 12 + 3 * routeCells * lanes + 2 * cutWorkUnits, dressed stone 8 + 2 * routeCells * lanes + cutWorkUnits, tools 2 + lanes, and food 4 * villageDays; whole-unit shortages are rounded up against the source warehouse, except food uses max(0, storedFood - population * reserveDays) so protected household meals cannot be counted as construction-ready. The projection exposes foodReserveFloor and spendableFood, matching the Supply chains planning goal; it still spends nothing. Dressed stone is an existing resource made by a staffed mason workshop from finite rough stone after Masonry, or physically imported; no generic stone resource exists. The paid Basin rate of 2,500 yields two cut-work units, eight days and 40/25/16/3/32 timber/bricks/dressed stone/tools/food. This read does not fund work, validate a physical cross-section or change proposal/notices, jobs, water, materials or rights. It is a provisional planning estimate until full W2 effects, W3 engineering and lawful paid stages exist. See living world design, major waterworks plan and player guide.

Exact graded-outlet terms and replay: RATE_MAJOR_WATERWORKS_OUTLET requires an active exact corridor, current returned survey, Hydraulic engineering, positive proposed grade head and complete recorded entry intervals. It revision-selects or clears one of 1,000, 2,500, 5,000 or 10,000 water subunits per four-hour interval. outletDesignTerms canonicalizes candidate-graded-outlet-v1 against the deterministic outletGradeScreen profile; same-source amendments retain exact design while corridor replacement or clearing removes it. The earlier version-fourteen migration carries version-thirteen saves forward without inventing an outlet design and rejects forged or unversioned active/frozen grades and rates. entryRetentionBound clamps each requested opening-held release to both max(0, opening - volumeAt(sourceMetadata, gradedEntranceInvert + 1)) and the selected rate; Impact.history additionally applies the per-interval receiving-basin backwater floor for graded terms. They report requested, released and unmet amounts; the impact candidate sends only the achieved hypothetical release to the selected receiving basin. A missing design adds release-outlet-rating-unselected; a rate below a recorded requested interval adds release-outlet-rating-below-recorded-request. The permanent release-outfall-engineering-unverified blocker remains because profile and tier do not establish a channel section, friction, safe receiving outfall, construction or actual water movement. See living world design, major waterworks plan and player guide.

Candidate outlet-grade preflight: major-waterworks.outletGradeScreen runs only for a canonical selected corridor. With N exact route cells, receiver natural bed R in millionth-height units and route index i, its candidate invert is R + N - i. Thus the terminal invert is one unit above the receiver bed and each step upstream is one unit higher. Each cell reports max(0, naturalBed - invert) as cut height; their sum is not excavation volume because no channel section is specified. volumeAt(sourceMetadata, openingInvert + 1) gives the graded entrance's minimum held-water floor. The screen compares illustrative 1, 2.5, 5 and 10 game-unit four-hour rates with max(0, capacity - floor) at full capacity, as a preflight before any rate is chosen. The paid Basin profile has inverts 447914, 447913 and 447912, a 511-unit spill cut, a 7,410-subunit head floor and 2,590-subunit maximum full-capacity draw. Candidate capacity variants recompute the preflight. entryRetentionBound and Impact.history use the prior optimistic receiver-bed floor for ungraded outlet-alignment terms, and switch to the selected profile and rate when exact design terms exist; no live water, notice or rights change from this read. See living world design, major waterworks plan and player guide.

Selected outlet custody and head-limited replay: SELECT_MAJOR_WATERWORKS_OUTLET accepts one current, complete releaseOutfallScreen crossing whose in-pool route reaches a distinct complete receiving basin and has positive optimistic head at the proposed capacity. outletTerms canonicalizes the bounded candidate-low-outlet-v1 cells; selection or clearing increments the proposal revision, and constructionCells, title, notice and easement screens include those cells. Same-source amendments retain the route. Major-waterworks ledger version thirteen migrates version twelve with no invented selection and rejects forged/unversioned geometry in proposals or frozen notices. With a selected outlet but no exact graded rating, entryRetentionBound and Impact.history compute the requested opening-held release, cap it at max(0, opening - volumeAt(receiver bed + 1)), and expose requested, released and unmet values. The impact candidate branch sends the hypothetical release to the chosen receiving basin; natural history and live basin water are unchanged. A missing selection adds release-outlet-unselected, and even a valid selection retains release-outfall-engineering-unverified and remaining W2–W4 gates. See living world design, major waterworks plan and player guide.

Release-outfall head screening: major-waterworks.releaseOutfallScreen traces each exact spillCrossings source through the candidate footprint back to terms.basinId, appends its receiver and reports whether the route is complete. It compares storageScreen.waterlineHeightUnits to the maximum natural crossing bed. For a hypothetical excavated low-level outlet, H.volumeAt(metadata, receiverBed + 1) is the optimistic held-water head floor; the one-interval possible draw at full proposed capacity is max(0, capacity - floor). With a rated pool-entry history, each entryRetentionBound interval is checked for requestedRelease > max(0, opening - floor). A failure at every candidate crossing adds release-head-insufficient-for-recorded-terms; no complete crossing adds release-outfall-route-unresolved. release-outfall-engineering-unverified remains regardless of these checks. The screen changes no water ledger and does not define excavation, outlet capacity, downstream effects or rights. Candidate capacity variants recompute the screen at their own waterline. See living world design, major waterworks plan and player guide.

Pool-entry gravity screening: major-waterworks.poolGravityConnections traces each canonical naturalPoolEntries.edges[].to through basin-topology.routingContext to terms.basinId. A path is complete only when the terrain trace is complete, reaches the basin, remains inside terms.footprint, and does not rise in natural elevation. The read model bounds each displayed path to 32 cells, exposes all distinct interior cells, current surface-routing.target deviations and beds at or above storageScreen.waterlineHeightUnits. Current drainage splits do not erase the fixed natural bypass and dry upper cells may still drain downhill. A selected exact control set with incomplete gravity geometry adds candidate-pool-gravity-path-unresolved; the permanent intake-engineering-unverified blocker remains because this test neither constructs control works nor specifies storage containment or a release route. See living world design, major waterworks plan and player guide.

Exact-entry retention screening: major-waterworks.entryRetentionBound reads the same full registered surfaceRouting.edgeWindow rows as poolEntryFlowEvidence, and only the canonical selected natural from:to entries. For each edge and interval it rounds the chosen bypass up and caps possible admission at rated gate throughput and remaining flow. The 25% or 50% release rule requests opening held water rounded up; a selected outlet caps actual hypothetical release above the receiver-head floor, after which new admission is limited by remaining store capacity. Passing water includes unadmitted edge flow and released water. Each row conserves opening plus exact-edge flow as closing plus passing water, with passing at least the summed per-edge bypass. No loss or inflow from elsewhere is added. review.entryRetentionBound is null without rated controls and otherwise is a read-only historical upper bound shown in City. It remains distinct from the basin-wide retentionBound and major-waterworks-impact replay, and cannot establish a hydraulic connection or clear intake-engineering-unverified. See living world design, major waterworks plan and player guide.

Rated exact pool-entry terms: RATE_MAJOR_WATERWORKS_MANIFOLD requires a current owner, living public character, active Hydraulic engineering, selected canonical route and entry controls, current returned survey and at least one full registered interval with positive measured entry flow before selecting a rating. It stores rated-entry-controls-v2 with the canonical sorted edge set and one gateCapacitySubunits tier of 50,000, 100,000, 250,000, 500,000 or 1,000,000 for each four-hour interval. Clearing returns the exact sites to natural-entry-controls-v1. gateRatingReview compares each edge's peak in the bounded window with the selected tier; the blocker is specific to missing rating, missing rate evidence or observed exceedance, while intake-engineering-unverified stays until a physically coupled design exists. Every set/clear revises the draft, invalidating old notice permissions. Ledger version eleven migrates to twelve only without unversioned gate ratings; current proposal and frozen notice terms are canonicalized on restore. charter-extensions.worksSite accepts either exact entry kind so rating does not remove an available fourth-ring title path. The paid Basin integration checks undersized and passing observed tiers, fresh revision, immutable notice history, unchanged water/stock/title, restored rating and rejection of forged or unversioned terms. See living world design, major waterworks plan and player guide.

Measured reservoir pool-entry transfers: major-waterworks.poolEntryFlowEvidence joins each canonical bounded naturalPoolEntries.edges pair to surfaceWater.cells, the conserved cumulative surfaceRouting.transfers[from:to] receipt and the version-two edgeWindow below. Both endpoints must be registered for a measured row; registeredSince is the later join time. Recent rates use only window rows whose full interval began after every known endpoint joined. Each edge reports recent total, peak/tick and latest four-hour transfer; the screen also reports the peak combined transfer from one actual interval rather than summing unrelated peaks. surface-routing.target supplies the present primary outlet, which may differ from the natural edge while the channel's environmental bypass still flows there. review exposes this evidence once in poolEntryFlowEvidence; City renders it for candidates and saved proposals. The paid-station test checks all eight exact Basin receipts and rates against the edge ledger, zero at installation, read purity, retained blockers and restore. Historic rates may span routing changes and omit unregistered exports, pool rain and other basin inflow; they cannot prove design capacity or complete capture. See living world design, major waterworks plan and player guide.

Major-reservoir title-action join: public/city-interface.js renders the first twelve exact constructionTenure.unassignedCells in candidate and saved-proposal cards and joins each cell to city.charterExtensions.sites by canonical cell ID. Only a current released offer supplies survey and registration actions; every listed cell keeps a map inspection action. The displayed payment, survey quote/reason, returned report and registration quote/reason all come from the existing authoritative projection; action buttons use the same DISPATCH_FRONTIER_SURVEY and REGISTER_CHARTER_EXTENSION review handler as Frontier & charters. Cells without a current offer are labelled as unresolved title gaps, not inferred from radius alone. The client creates no proposal, title, goods or water; acceptance rechecks the server's current revisions and resources. See living world design, major waterworks plan and player guide.

Fourth-ring major-work title and frontier return detour: charter-extensions adds stable fringe-v3 radius-four plain field/forest releases without altering version-one/two IDs or paid receipts. Projection exposes a v3 plot for early survey only when a current paid unmonitored source report identifies its natural pool-entry endpoint, or for survey and registration review when the source owner has an active site-only natural-entry-controls-v1 or rated rated-entry-controls-v2 proposal covering that endpoint. Registration additionally checks current public authority, active Land registry, Public accounting and Hydraulic engineering, a staffed office, a returned report no older than fourteen village days, adjacency, reserves and the exact {timber:16,tools:2,food:8} payment. Ledger version three preserves up to sixty ordered entries within radius four. Each works receipt freezes its proposal ID, revision, source, basin and exact natural entry edge; restoration checks that provenance, terrain geometry, release, cost and ordered connection. Old version-one/two ledgers retain radius two/three. major-waterworks.constructionTenure reports selected fourth-ring works reach separately from ordinary three-ring proximity. expansion.advance can replace a completed survey's homeward route with a bounded dryRoute from its actual cell while retaining the original site endpoint and report; each later movement, carried food, save and offline replay follows that route. The focused fourth-ring test stages one extra market tool before monitoring and registers hex 1377089 after a dry return detour. A second paid end-to-end Basin test forges sixteen tools from purchased iron and local charcoal, carries them to the local village, surveys and pays for the other five entry endpoints, then monitors and registers hex 1377089. Its selected proposal has no unassigned construction cells or construction-title blocker. No water, gate or automatic ratification is created. See living world design, major waterworks plan and player guide.

Version-eleven pool-entry proposal custody: SELECT_MAJOR_WATERWORKS_MANIFOLD requires the source owner, a living public character, active Hydraulic engineering, an exact current revision, a selected clear natural route and complete nonempty naturalPoolEntries. It saves the canonical sorted {from,to} edge set as natural-entry-controls-v1 inside proposal terms, or clears that set in a new draft revision. constructionCells includes both endpoints, so current title, site uses, notice parties and charterConstructionCells easements use the same exact footprint. review now distinguishes an unselected control set from an engineered hydraulic gate; selecting controls removes only intake-entry-control-unselected. The capture replay remains a hypothetical basin-wide comparison. Ledger version ten migrates to eleven only when no old term contains unversioned controls; restore regenerates canonical edges and rejects forged or truncated sets in drafts and notices. The paid Basin command test verifies eight selected edges, immutable water/stock/title, notice, amendment, clear, stale revision, migration and restored terms; a controlled second-charter endpoint tests its notice and exact easement. See living world design, major waterworks plan and player guide.

Exact intake-to-entry coverage: major-waterworks.intakeEntryCoverage compares each directed naturalPoolEntries.edges pair with the consecutive directed cells of the exact natural-route-v1 alignment. review returns known/matched/unmatched counts, bounded example edges and the entry-completeness flag. When an alignment is selected, incomplete ingress analysis adds candidate-pool-entries-unresolved; a complete review without selected candidate controls adds intake-entry-control-unselected. intake-engineering-unverified remains in either case, and completeCaptureDesign stays false because route overlap is not a gate. The coverage counts are read-only current-terrain projections; the separate version-eleven command above adds exact proposal terms but no permission. The paid Basin integration verifies one matched and seven unmatched edges, a notice, immutable water/stock/title, and matching coverage after restore. See living world design, major waterworks plan and player guide.

Named charter flood exposure in major-reservoir replay: major-waterworks-impact.history retains its exact natural-balance and route validation, then groups each standing structure's structurePressure rates by its current settlementId. The read-only landExposure.communityFloodExposure rows report observed/proposed building intervals and rate points, wet usable center/camp intervals, and distinct changed structure/connection counts; rows sort by charter ID and the display caps at 24 with an omitted count. Exposed standing structures without a current public settlement enter a separate unattributed bucket and remain in global totals; City warns that their holder still needs review. Water is unchanged. Source-only current-condition loss remains separate; other charters' private condition is not used for a public damage estimate. test/major-waterworks.test.js checks an affected second charter, reconciliation, blockers and read purity; test/major-waterworks-impact.test.js checks the unattributed bucket. See living world design, major waterworks plan and player guide.

Paid Basin intake integration: test/helpers/watershed-village.js extends the real title fixture with a local lumbermill, physical home-to-village freight, local practice and sequential prerequisite research, active Hydraulic engineering, a returned DISPATCH_WATERSHED_SURVEY and a second returned survey with monitor:true. The candidate at source 1370944 has naturalCapacity 15860 and canonical route [1370944,1372993]; test/watershed-outposts.test.js drafts 10000 subunits, selects that route at revision two, files notice and restores the ledger. The long-route test helper caps and rounds food backhaul to whole carrying capacity; replacement tools are delivered before gauge installation because live basin floodwater can block a later supply departure. SELECT_MAJOR_WATERWORKS_INTAKE still requires an exact active revision, current returned source evidence, Hydraulic engineering, lawful authority and a conflict-free complete trace. It stores natural-route-v1 cells as terms without moving water or granting rights. Ledger version eleven validates the canonical path on restore; current site conflict suspends notice actions. Selected cells enter construction tenure, site-use, party and easement review. Engineering design, full impacts and W4 operation remain separate. See living world design, major waterworks plan and player guide.

Cross-charter intake title and exact permission: intakeRouteScreen continues to report otherHolders but does not mark named public title as a route conflict. It still rejects unchartered, incomplete, feature, standing-structure and land-work paths. constructionCells includes a selected route; noticeParties includes any other public holder of those cells, charterConstructionCells supplies its exact sorted easement list, and noticeCurrency suspends actions if the named set changes. test/watershed-outposts.test.js uses a controlled in-memory terminal-title allocation after real Basin preparation to verify selection, party notice, acknowledgment, precise easement, separate source/holder water consents and remaining engineering/impact blockers. Removing the allocated title later suspends the notice and both signature-coverages through current route screening. This test allocation is not a player title-transfer command. See living world design, major waterworks plan and player guide.

Remote watershed village and title integration: The command-only regression starts at site:495:699, surveys/founds watershed-v1:499:668, builds a field from optional founder timber, and moves four existing residents after capacity-aware paid supply and Town house construction. The outpost has twelve residents and eight civilian workers. Its productive field can fill the 400-unit camp depot while carriers walk, so subsequent timber loads use actual returned surplus-food cargo to leave arrival room. Further ordinary timber/tool journeys, a staffed home registry, local Record keeping and DEVELOP_LOCAL_VILLAGE produce a saved village charter. Local Public accounting, Land registry and a staffed registry office, plus another physical material/tool chain, support four returned DISPATCH_FRONTIER_SURVEY jobs followed by four separate REGISTER_CHARTER_EXTENSION receipts. The exact three pool cells and distinct spill receiver become part of the existing mutable charter region in inner-before-outer order and restore with the ledger. No population, well yield, basin water or intake is created by these commands. The test proves title for those four candidate construction cells, not complete W2 impacts, all-party water rights or W4 construction. See living world design, major waterworks plan and player guide.

Bounded watershed outpost release: frontier-sites.watersheds appends a stable watershed-v1:499:668 offer only when its fixed seven-cell natural parcel is seven unmarked fields, clear of old site and two-ring charter opportunities, reachable from the site:495:699 founding offer, and draining to a complete candidate basin with at least 10,000 water subunits. The exact pool and spill endpoints must be natural, feature-free fields outside the camp and no more than three hexes from its center. The current release has basin 1372993, 15,860 subunits of natural saddle capacity and four separately released construction fringes. The site uses the existing expansion survey, conditional charter, outpost transfer, local food plot and paid charter-extension systems; no new save ledger, population or resource stock is granted. founding.view publishes the linked starter in strategicSites without reordering its original three woodland offers. expansion.projection publishes the watershed category separately so nearer ordinary sites cannot hide it. Focused tests prove read purity, route and fringe geometry, the complete paid founder-to-village journey, four returned title surveys/payments, a productive staffed food field and save restoration. No reservoir title or water is generated at outpost arrival. See living world design, major waterworks plan and player guide.

Candidate construction-title audit: major-waterworks.constructionTenure deduplicates the exact proposal source, footprint and both spill-crossing endpoints, then reads current mutable-region ownership to count source-held, other public-held and unchartered cells. For each unchartered cell it compares natural hex distance to all published founding, frontier, coastal and farming site centers; distance greater than three from every center is outside ordinary inner/outer charter reach. The separate worksReach list identifies exact selected fourth-ring pool-entry edges with a conditional paid path. This is only a geometric upper bound, not a claim, site vacancy check or inferred customary tenure. review includes the read-only audit, and candidate-construction-title-unresolved persists while any construction cell has no current charter, separate from signature, intake and impact blockers. Capacity variants and active proposal reviews recalculate live title; the audit is not persisted and does not alter notice parties or rights. The source City view maps the first twelve unchartered construction cells. Focused tests cover accounting, distant cells, restoration, live holder change and read purity. See living world design, major waterworks plan and player guide.

Candidate-pool natural entry screening: major-waterworks.naturalPoolEntries uses the complete terminal catchment and selected candidate footprint, examines outside neighbors along the bounded perimeter, and accepts only edges whose deterministic basin-topology.routingContext.trace enters the pool on its next step. The review caps pool cells at 256, boundary cells at 2,048 and returned edges at 128; exceeded or incomplete paths produce complete: false, never an exhaustive claim. It reports sorted immutable from → to edges and unique endpoint cells, then recomputes source, other public and unchartered holder counts on every read. The source City card shows twelve edge pairs; capacity variants and saved proposal reviews reuse the same read-only geometry. The entry list is not persisted as terms, merged into candidate easements or notices, or used to transfer water. Paid-station tests verify eight fixture edges, a known crossing, restore and live tenure change. See living world design, major waterworks plan and player guide.

Natural gauge trace in major-reservoir review: naturalGaugeTrace remains a read-only terrain and current-tenure view, including source-held, other-held and unchartered cells. Unselected candidate reviews retain intake-alignment-unselected. A separate exact-revision intake command may select that canonical path when its preflight is clear; only then do route cells enter proposal construction and notice terms. This distinction prevents a gauge report from silently granting an intake or rights. See the intake-selection section above, living world design and player guide.

Durable reservoir-notice briefing events: briefings.RULES records MajorWaterworksNoticeFiled from its source and named recipient anchor cells, then routes response and easement/water-consent grant or withdrawal events from the source cell and acting recipient anchor. Each owner receives a Land & water history entry for its own charter; cityProjection still enforces ownership. The record contains proposal ID and revision, names the acting community for later actions, and formats an objection's recorded ground plus any requested opening-storage release or new-arrival bypass rate. An old entry never implies current validity or consent. The version-one briefing ledger and forty-entry cap are unchanged, old saves gain no retrospective events, and the projection has no write side effect. test/major-waterworks.test.js verifies both owners receive a paid notice and later action records, both kinds of alternative request are rendered, foreign reading fails, projection is pure and the ledger survives restore. Live notice status remains in major-waterworks.noticeAttention and its exact Land & water projection. See living world design and player guide.

Regional major-reservoir notice exceptions: major-waterworks.noticeAttention derives a bounded, read-only current-notice summary for a source or named recipient. It reuses notice-currency checks, the exact review window, current party responses, construction-cell easement coverage and separate source/recipient water consent. regional-overview.projection adds owner-scoped Land & water issues for an unanswered recipient notice, later unsigned recipient permissions, missing source decisions/signatures, changed evidence and expiry; an open notice within two village days of its deadline is urgent. Completed recipient actions clear that recipient's prompt, while withdrawal restores it. The read never funds work or mutates the proposal or water ledgers, and all major-impact, unknown-tenure and W4 blockers remain. A paid two-owner notice test covers read purity, acknowledgment, individual grants, withdrawal, deadline and expiry. See living world design and major waterworks plan.

Itinerary service blocker routing: regional-overview.projection compares a blocked saved itinerary reason with the active regional-budgets.projection service reason. A match targets the founding home anchor and research tab, preserving the next leg's affectedSettlementId; the shared-budget service issue also targets Research. Other blocked itineraries continue to target expansion for stock, route and retry controls. The focused itinerary test suspends Regional institutions after the first paid leg, verifies the second dispatch is blocked without changing the saved cargo plan, checks the read-only issue and save restore, then adopts service and uses CONTROL_OUTPOST_ITINERARY to fund and finish that same leg. No budget or physical-transfer rule changes. See living world design, gameplay foundations and player guide.

Three-load repair itinerary in the seven-community route: The plannedRepairFreight branch of seven-community-combined-food-and-repair.js issues one AUTHORIZE_OUTPOST_ITINERARY with collection legs {clay:8}, {ironOre:4}, {clay:8} against owned established outposts. outpost-itineraries dispatches one paid carrying job per leg after the previous job returns; regional-budgets.check still requires active home civic service at each new dispatch. The integration helper therefore waits for all three departures and returns before suspending Regional institutions, Land registry and Record keeping. It asserts three returned outcomes, at least sixteen physically arrived clay and four ore, completed save restoration, and matching itinerary ledgers after replay. Eight clay pay the first kiln cycle; the remaining eight survive the subsequent twelve-day regional continuation and pay the second kiln cycle, with no DISPATCH_OUTPOST_SUPPLY in that branch. The second repair still uses an ordinary four-worker headworks job, not free maintenance. Focused itinerary tests separately cover finite stock, shared ceilings, blocked later legs, recall and corrupt saved custody. Further renewable material provisioning remains unproved. See living world design, gameplay foundations and player guide.

Food-field accounting fallback: productionMandates version four migrates version-three records with foodFallback: "pause" and validates "continuous" only for a Community field's food target. The production status returns an unblocked fallback while accounting is unavailable and the selected recipe produces food. The normal engine batch still checks staffing, crop services, inputs, land and storage; record skips fallback harvests so saved target batches, spending and allowances remain unchanged. Once regional-accounting service returns, the retained target status governs subsequent cycles. production-capacity.foodOutput and the City and regional projections reflect active fallback. Local and delegated-outpost tests cover service loss, restoration, save migration and malformed records. The seven-community integration helper runs both a manual-switch baseline and a separate opt-in branch from the same 68-person save; the opt-in branch checks warehouse receipts from the woodland field during each of two delegated-accounting outages, unchanged target batch counts through those outages, two normal paid headworks repairs, target resumption and save replay. The baseline figures below still describe its actual manual orders. See living world design, gameplay foundations and player guide.

Second combined 68-person repair with source food continuity: test/helpers/seven-community-combined-next-repair.js continues the 62%-well endpoint of seven-community-combined-food-and-repair.js. A revision-checked SET_PRODUCTION_MANDATE changes the owned woodland wheat field from the delegated 1,160-food target to continuous production before the capital suspends its home civic programs; the field's two workers and local Seed selection specialist stay assigned. During the suspension a paid eight-clay return, three-worker home saw, forge-tools smithy batch and brick-kiln batch stage eight timber, two tools and six bricks. An ordinary four-worker maintain-headworks job spends eight timber, four bricks and one tool before the 50% extra-water cutoff. Restored home civic service permits a reviewed return to the 1,160-food target, and the woodland governor dispatches another physical log team. Three further checks re-earn Regional capital with 68 watered residents, 92% headworks, 31 logs, five timber, four bricks, one tool and 1,060.5 food; the forest has 1,163.5 food and 160.5 free warehouse units. Each advance checks seven charter food stocks and household water; restore preserves target, well and all inventories. This is bounded player-managed care across a delegated-service outage, not unattended mineral or repair renewal. See living world design and gameplay foundations.

Combined delegated food target, real workshop inputs and well repair: test/helpers/seven-community-combined-food-and-repair.js starts from the saved 92%-well 68-resident Regional capital and authorizes a 1,160-food SET_PRODUCTION_MANDATE on the owned woodland wheat field using the existing home regional-accounting service. It switches the field to continuous production before executing the physical clay/ore, charcoal, metalwork, brick and four-worker maintain-headworks route while home civic programs pause. After civic restoration the target is reviewed again; twelve ordinary home checks observe both completed target batches and target-held waits, new standing selective-harvest orders and governed physical log departures. The source ends with 1,165.5 food and 188.5 free warehouse units, and the capital remains Regional capital at 62% headworks with 68 watered residents. Every checked advance preserves six home food days and food in all seven chartered communities. A sixth-day snapshot rehydration matches direct home/source stocks, the production mandate, forestry instruction and governor ledger at day twelve. This is one bounded combined route, not renewable ore/clay supply or indefinite well care. See living world design and gameplay foundations.

Finite clay-and-ore replacement repair at 68 residents: test/helpers/seven-community-replenish-repair-materials.js forks the saved 92%-well state for an independent repair measurement; the combined route above runs it with a woodland target active. PAUSE_GOVERNOR_MANDATE lets a funded trip complete without new departures; three SUSPEND_TECHNIQUE commands reserve sawed timber. Two ordinary DISPATCH_OUTPOST_SUPPLY journeys collect eight finite clay and four iron ore from owned camps. A staffed charcoal kiln consumes logs for fuel, a three-worker smithy selects metalwork for three iron and one tool from four ore and two charcoal, and a two-worker brick kiln consumes eight clay and three logs for six bricks. Four released home workers pay maintain-headworks with eight timber, four bricks and that tool before water capacity falls short. Restored saw and civic programs re-earn Regional capital and the governor dispatches another physical log trip. The saved endpoint has 86% well condition, 37 logs, four timber, two bricks, three iron, two charcoal, zero tools and about 1,001 home food. Every advance checks all seven charter food stocks and water for 68; restore checks their inventories and headworks. This branch proves a finite replacement cycle; the combined route above verifies bounded target overlap, while twenty-day simultaneous operation and long-run mineral balance remain unproved. See living world design and gameplay foundations.

Delegated woodland wheat target and warehouse headroom: test/helpers/seven-community-forest-food-target.js starts from the restored 68-resident capital after seven-community-repair-with-local-wheat.js. regional-accounting.service identifies the linked founding home's active Public accounting and Regional institutions; SET_PRODUCTION_MANDATE applies a 1,200-food target with no input allowance to the local two-worker wheat field. The existing seed keeper stays assigned and two workers remain for each selective harvest. Twenty checked home days leave 1,210.5 woodland food and 123.5 free warehouse units, compared with 45.5 free units from an otherwise identical continuous-production save. New standing forest orders and governor departures occur, all seven charters retain food, 68 home residents retain food and water, and the capital keeps Regional-capital status. A midpoint snapshot restored after ten days reproduces home/source inventories, the production mandate and the forestry/governor ledgers at day twenty. No engine rule or save format changes are required. The bounded endpoint has 52% home headworks and no bricks or tools; longer storage and repair-input balance remains open. See living world design and gameplay foundations.

Second paid 68-person repair after woodland wheat: test/helpers/seven-community-repair-with-local-wheat.js starts from the local food-positive forestry save at 54% home headworks. PAUSE_GOVERNOR_MANDATE prevents new dispatches without cancelling an in-flight paid journey. Three SUSPEND_TECHNIQUE commands let one three-worker saw check increase home timber from five to eight; releasing the saw and one registry clerk permits four workers on a normal maintain-headworks job. That job spends eight timber, four bricks and one tool before household water falls below 68, restoring 100% condition. Restaffing, one civic timber-buffer check, three ADOPT_TECHNIQUE commands and a reviewed governor reauthorization recover Regional capital and another physical log dispatch within three checks. The saved endpoint has a 92% well, 46 logs, three timber and 965.5 food, with no bricks or tools. All seven charter food stocks, 68 home water places, woodland food surplus and both inventories survive the advance and restore assertions. Later replacement input cycles remain open. See living world design and gameplay foundations.

Local forestry food balance with continued harvests: test/helpers/seven-community-forest-food-recovery.js continues the saved 68-person state from seven-community-repair-after-growth.js. The forestry village initially has twelve residents and two basic field workers, with eleven eligible food output and a one-food daily deficit. ASSIGN_STRUCTURE_STAFF temporarily activates its already built mill; real local logs become three timber. FUND_RESEARCH then spends that timber on three due checks of Seed selection, followed by ADOPT_TECHNIQUE and CHOOSE_CROP for wheat on the same eligible field. Two field workers produce thirteen eligible food per day, the one staffed seed keeper remains active and two local workers remain free for selective harvest jobs. Eight subsequent home-day advances check all seven charters' food, six home food days, 68 watered residents, new standing forest orders and governed physical log departures. Snapshot restore preserves the forest knowledge, selected crop and inventory. The bounded endpoint retains Regional capital with 54% headworks; its next paid repair is verified above, while source warehouse saturation and later material supply remain open. See living world design and gameplay foundations.

Paid 68-resident repair after food recovery: test/helpers/seven-community-repair-after-growth.js continues the saved endpoint of seven-community-adult-food-balance.js through ordinary revision-checked commands. PAUSE_GOVERNOR_MANDATE prevents new woodland departures without cancelling the in-flight job. A separate DISPATCH_OUTPOST_SUPPLY returns eight finite clay while suspension of three timber-upkeep programs permits two checks of local saw production to reach eight timber. Reassigning the saw's three workers to forge-tools and two freed carriers to the kiln yields two tools from two iron and one charcoal and six bricks from eight clay and three logs in one production check. A four-worker maintain-headworks job spends eight timber, four bricks and one tool before condition falls below the 50% extra-delivery threshold. Resumed saw production funds restored civic programs, and a reauthorized governor mandate dispatches another physical log team. Every advancement asserts six home food days, water for 68 and positive food without shortfall in all seven charters; a restored engine retains the well and home stock. Five more days end at Regional capital, 84% headworks, 33 logs, five timber, four bricks, one tool and 913 food. This is bounded managed coverage, not unlimited materials or equilibrium. See living world design and gameplay foundations.

Paid repair, two adult arrivals and positive home food balance: test/helpers/seven-community-adult-food-balance.js continues the saved 66-person capital from seven-community-governed-forestry.js with 70% headworks, zero bricks and an in-flight governed log job. PAUSE_GOVERNOR_MANDATE prevents new dispatches without cancelling that job; after its physical return, three civic programs are suspended, a separate DISPATCH_OUTPOST_SUPPLY team collects eight finite clay, the home saw accumulates at least eight timber over ordinary checks, and two kiln workers fire six bricks. A normal four-worker maintain-headworks job debits eight timber, four bricks and one tool before the 50% extra-water cutoff and restores 100% condition. Staffing the second wheat field from one to three and restoring civic service yields 71.5 eligible food output. SET_VILLAGE_POLICY opens one-adult-worker migration; two distinct waystation arrivals raise population from 66 to 68 within 68 permanent housing and 72 water places, and the third unused journey returns after closure. The resumed governor log mandate dispatches again; with two carriers away, measured daily food demand is 67, so the local food balance is plus 4.5. Eight further checks raise stored food from 853.5 to 873.5 and preserve water and food in all seven charters. The home briefly drops only to City during civic suspension and requalifies as Regional capital with three staffed offices and six current slots. Snapshot restore agrees on 68 people, title, inventories, well and active governor ledger. The 70%-well endpoint has 35 logs, four timber, two bricks and no tool; indefinite repair supply remains unproved. See living world design and gameplay foundations.

Governed log route with full registry staffing: test/helpers/seven-community-governed-forestry.js continues the saved 66-person Regional capital from seven-community-balanced-forestry.js. Revision-checked staffing changes the second home field from two to one and the saw from four to three, freeing exactly two carriers while all three registry offices keep the current administration capacity at six. SET_GOVERNOR_MANDATE reauthorizes the existing paused owned woodland route with collectResource: logs, homeTarget: 64, maxCargo: 20, allowanceMode: daily-only, food/log budgets of 100/40, no outgoing tool target and explicit empty additional cargo arrays. In eleven ordinary home-day checks, three distinct two-worker jobs depart and two finish; cumulative committed food and logs rise, and source forest stock is physically debited. The first check has only two timber for three civic-upkeep programs, briefly blocking delegated service; real three-worker saw output restores Regional institutions before the first governed dispatch. Every advance verifies the capital title, six home food days, household water for 66 and food across seven charters. Snapshot restore agrees on the active governor ledger, capital title, inventories and headworks. The bounded endpoint is 70% well condition, 43 logs, three timber, no bricks and 883.5 food at home; it does not establish indefinite food or repair-material balance. See living world design and gameplay foundations.

Balanced source food and a retained-capital well repair: test/helpers/seven-community-balanced-forestry.js starts from the saved 66-resident Village after seven-community-tool-after-capital.js: 92% well, twenty logs, three timber, four bricks and two tools at home, with an almost full 1,400-place woodland depot. A revision-checked ASSIGN_STRUCTURE_STAFF lowers its field from three to two workers. The ordinary economy projection changes from a 4.5-food daily surplus to a one-food daily deficit against twelve meals, retaining over one hundred stored food days and at least two harvest workers. One paid forty-food DISPATCH_OUTPOST_SUPPLY creates full-yield space, and home ADOPT_TECHNIQUE restores delegated accounting to the existing selective-forestry mandate. Six additional marked harvest orders and three paid twenty-log returns feed the staffed home saw across the three earned promotion stages. Three staffed registry offices yield six current slots. A normal four-worker maintain-headworks job spends eight timber, four bricks and one tool at 56% well condition; two saw staff work during a fourth log return, the fifth paid trip overall, and four resume afterward, with Regional-capital recognition preserved. Every advance checks six home food days, 66 household water places and food in seven charters. Snapshot restore matches title, mandate order count, inventories and well. The endpoint has 92% well, 36 home logs, two timber, zero bricks and one tool; it does not prove autonomous logistics or indefinite material renewal. See living world design and gameplay foundations.

Replacement tools and next repair from the 66-person capital: test/helpers/seven-community-tool-after-capital.js starts from the restored Regional-capital endpoint of seven-community-capital-after-forestry.js: 70% well, zero tools, zero free workers, eight logs, ten timber and four home ore. Revision-checked staffing and knowledge commands release seven workers and suspend three timber-upkeep programs. Concurrent physical DISPATCH_OUTPOST_SUPPLY jobs collect 32 woodland food plus four logs and eight finite clay. During transit a two-worker charcoal kiln converts five logs to four charcoal; a three-worker smithy runs metalwork on four ore and two charcoal for three iron and one tool, then forge-tools on two iron and one charcoal for two tools. After one office restarts delegated service, the existing forestry mandate increments its order count and issues a marked selective-harvest job. A staffed home saw and kiln convert remaining real logs and imported clay into repair stock. A four-worker maintain-headworks job debits eight timber, four bricks and one tool before household water fails; a separate paid team returns twenty harvested logs. Every advance checks six home food days, all seven charter food stocks and 66 household water places. Snapshot restore agrees on mandate count, inventories, stage and well. The bounded endpoint is a 92%-well Village with two tools and twenty logs; continuous capital and material renewal remain unproven. See living world design and gameplay foundations.

Paid capital return after forestry restart: test/helpers/seven-community-capital-after-forestry.js continues the saved endpoint of seven-community-forestry-restart.js from a 66-person Village and 80%-condition well. Two concurrent DISPATCH_OUTPOST_SUPPLY jobs collect forty woodland food and eight clay. The home temporarily suspends its three timber-upkeep civic programs, re-enables them to satisfy delegated forestry service, waits for a marked real harvest job, and physically returns twenty logs. A second suspension reserves timber while the four-worker saw and two-worker kiln process actual logs and clay into enough timber and bricks for a normal four-worker maintain-headworks debit of eight timber, four bricks and one tool. The well returns to 100% before household capacity falls short. Re-enabled civic programs and two additional paid twenty-log returns sustain a staffed mill through all Town, City and Regional-capital checks; three staffed offices yield six current administration slots. Each advance checks six home food days, all charter food stocks and water for 66 people. Snapshot restore matches stage, seven inventories and headworks. The bounded capital endpoint has 70% well condition, eight logs, ten timber, two bricks, no tools and no free workers; it does not establish unattended renewal. See living world design and gameplay foundations.

Paid restart of delegated woodland harvesting: test/helpers/seven-community-forestry-restart.js forks the one-timber endpoint of seven-community-ore-tool-renewal.js. The starting outpost has an enabled ongoing mandate, mature selected trees and free workers but only five warehouse spaces; its retained checks are blocked by missing delegated accounting. A paid forty-food DISPATCH_OUTPOST_SUPPLY trip creates at least 21 free spaces. Four home saw staff use existing logs while three already adopted civic programs are re-enabled. A later ordinary regional check increments the original forestry order count once and creates a marked harvest job; only normal completion credits village logs. Another paid supply job physically moves twenty logs and four timber home. Home milling reactivates Regional institutions; forestry-mandates.projection.serviceReason becomes null. Every advance verifies six home food days, household water for 66 and seven charter food stocks. Restore agrees on forestry order count, inventories and well. The run stops before renewed capital status or unattended resource balance. See living world design and gameplay foundations.

Forestry service issue targets the supporting home: regional-overview.projection uses forestry-mandates.projection's current serviceReason only when it is the actual blocked reason at a linked outpost. The issue retains its source settlement and affectedSettlementId, but sets its target to the founding home's anchor and research tab. A missing local crew, full warehouse, immature plot or finite order cap keeps the existing local People or Land target. The actual endpoint of test/helpers/seven-community-ore-tool-renewal.js asserts that its suspended home service yields the specific issue, destination and affected forest without changing the world snapshot; focused forestry and regional-overview tests retain local blocker behavior. This is a read-only navigation change and does not resume the mandate or grant logs. See living world design and gameplay foundations.

Replacement ore to two further 66-person repairs: test/helpers/seven-community-ore-tool-renewal.js forks the restored endpoint of seven-community-next-well-cycle.js. It dispatches two simultaneous revision-checked supply jobs for eight ore from the higher-stock replacement owned iron mine and eight finite clay from the linked clay village, asserting both source debits. The home smithy switches to metalwork (four ore and two charcoal → three iron and one tool), then forge-tools (two iron and one charcoal → two tools). A two-worker kiln fires eight clay and three logs into six bricks. Two separate four-worker START_LAND_PROJECT jobs each debit eight timber, four bricks and one tool and restore headworks to 100%. Every advance checks six home food days, no latest food shortfall in seven charters and household water for all 66 people. Save restoration compares inventories, population and well. The final one-timber/zero-brick/one-tool buffer is a bounded material-cycle proof, not renewable equilibrium. See living world design and gameplay foundations.

Next paid 66-person headworks cycle: test/helpers/seven-community-next-well-cycle.js forks the exact 100%-condition snapshot after the earlier repair in seven-community-full-office-freight.js. Two revision-checked DISPATCH_OUTPOST_SUPPLY teams overlap after a paid START_HARVEST creates real woodland logs: one collects eight finite clay, the other brings those logs home. Source clay is debited on physical exchange. The home pauses its lumbermill, staffs the kiln and consumes clay plus three logs to produce six bricks. At no more than 62% headworks but before the water cutoff, a four-worker START_LAND_PROJECT spends eight timber, four bricks and one tool and restores 100% condition. Every advance asserts six home food days, uninterrupted household water for 66 residents and no food shortfall in seven chartered communities. Save restoration compares all charter inventories and headworks. The separate capital branch still proves full-office freight; this repair fork ends as a Village with no tool and does not prove perpetual material balance. See living world design and gameplay foundations.

Town house, adult admission and full-office governor freight: test/helpers/seven-community-town-house.js forks the registered-field save and uses revision-checked commands for woodland log collections, home milling, finite clay, charcoal, brick and tool batches, four paid headworks jobs and Joinery's 63-timber/20-food house quote. Permanent housing rises from 64 to 68 without a population grant. seven-community-household-growth.js staffs the second food field higher, observes two separate adult arrivals, closes migration and waits for an unused third traveler to return; the finite source loses exactly two residents. seven-community-full-office-freight.js pays another well repair after real woodland log collections, then restores Record keeping, Land registry and Regional institutions. With the school, one home saw worker and all three registry offices staffed, nine development checks regain Regional capital and six current founding slots with two carriers free. A newly funded governor journey uses both workers, collects village timber, physically returns and releases them. Every advance checks food in all seven chartered communities and uninterrupted household water for 66 residents. Restored state agrees on stage, administration, source debit, inventories, governor record and headworks. At the bounded endpoint 52% headworks, seven timber, no bricks and one tool leave another repair imminent; this is not an unattended equilibrium. See living world design and gameplay foundations.

Saturated capital charter expands one paid housing plot: test/helpers/seven-community-housing-plot.js forks the post-repair 64-person snapshot with exactly 64 housing places and no unoccupied owned buildable cell. Three staffed smiths first forge two tools from two retained iron and one charcoal. Two ordinary DISPATCH_OUTPOST_SUPPLY woodland jobs each return twenty timber, with a separate eight-ore pickup from an owned finite mine between them. A reviewed smithy recipe switch to metalwork consumes four imported ore and two charcoal for three iron and the third tool. charter-extensions.projection offers an explicitly released outer field. DISPATCH_FRONTIER_SURVEY pays four timber, one tool, seven travel food and two workers; the report must physically return before REGISTER_CHARTER_EXTENSION independently pays twelve timber, two tools and six food. The accepted ledger adds exactly one cell to the home region. Assertions confirm no survey-only rights, free house, resident or capacity increase; food in seven charters and household water for 64 persist. Save restoration validates the extension ledger, land ownership, inventories, housing and headworks. The separate paid-house and migration continuations above construct the Town house and admit two adults. See living world design and gameplay foundations.

Capital requalification after a second 64-resident repair: test/helpers/seven-community-post-repair-capital.js resumes the exact saved end of seven-community-early-second-repair.js. It checks a 100%-condition well, 64 residents, zero home tools, a paused governor mandate and a Village stage. Three staffed smiths consume two retained iron and one charcoal to forge two tools, then unstaff. Three distinct DISPATCH_OUTPOST_SUPPLY teams return sixteen timber plus eight logs, twenty timber, and another twenty timber during promotion; their route time and source debit are ordinary simulation events. The school and home mill are restaffed, ADOPT_TECHNIQUE re-enables previously adopted Regional institutions, and three qualifying checks each regain Town, City and Regional capital. Every advance checks six home food days, household water for all 64 people and food without recent shortfall across seven chartered communities. The endpoint has at least twenty timber, two tools and more than 60% headworks. Three staffed sound registry offices restore six current founding slots; only one home worker remains free, which is insufficient for an overlapping two-person governor journey. Save restoration compares stage, administration, paused mandate, headworks and every charter inventory. This proves a funded recovery, not simultaneous full-office freight or renewable material balance. See living world design and gameplay foundations.

Second preventive well repair during adult-worker governor freight: test/helpers/seven-community-early-second-repair.js forks the tenth home-day snapshot from seven-community-adult-governor-return.js, after two paid one-person migrations and real forestry supply. It verifies the homeward governor job remains in custody when PAUSE_GOVERNOR_MANDATE stops later dispatches, then lets it unload. SUSPEND_TECHNIQUE reserves timber while ordinary DISPATCH_OUTPOST_SUPPLY jobs debit eight finite clay and 32 food from the clay village and return sixteen forestry timber. Two assigned kiln workers fire at least four local bricks from actual clay and logs. A four-worker START_LAND_PROJECT for maintain-headworks spends at least eight timber alongside exactly four bricks and one tool; ordinary daily upkeep can also debit timber. The condition stays at or above the 50% extra-delivery cutoff before the job restores it to 100%. Every advance checks household water capacity against 64 residents; all seven communities retain food and charter links, and save restoration matches well and inventories. Civic service is suspended during this job; the separate continuation above checks capital requalification and six current slots. See living world design and gameplay foundations.

Two paid adults and renewed seven-community capital: test/helpers/seven-community-adult-governor-return.js forks the command-produced snapshot immediately after the preventive maintain-headworks job. It staffs the home field at eight, selects migrationParty: 'adult-worker' and opens migration after verifying live admission reasons are empty. While two separate waystation residents and their paid provisions travel, ordinary outpost supply jobs return twenty timber/eight food and then 32 food/eight logs; the source village moves to three field and three saw workers. Closing migration at 64 residents preserves the two-person source debit and two-worker home credit. An existing paused governor mandate is reauthorized in daily-only mode with home timber, logs and food targets; fifteen chronological home checks must fund at least three distinct carrying teams and complete two, including observed homeward timber-and-log cargo. Each check asserts six home food days, working water for 64 residents and no last-day shortfall in any of seven charters. Village → Town → City → Regional capital requalification finishes with ten timber and 54% headworks. One staffed registry office yields four current founding slots despite six retained links. Restore compares capital stage, source residents, governor record, all inventories and well condition. This is a bounded labor-and-freight proof before the next brick/tool-funded repair, not indefinite unattended balance. See living world design and gameplay foundations.

Governor handcart unit limit: governors.settingsValid now accepts maxCargo through 100, while governor-loads.plan still allocates each direction by combined units, actual transport.capacity, route rations, animal feed, source surplus, material allowance and destination storage. outposts.validateCargo and outpost-itineraries.validGoods accept up to 100 units of one material for automatic, manual and saved exact-load supply; supplyQuote then enforces the 60-weight carrier or 100-weight serviceable-cart limit with provisions included. The City inputs expose the matching upper bound. test/governors.test.js authorizes an 80-food collection with a real cart, verifies projection, source debit and in-transit escrow, restores an active job, then verifies home unloading, a worn returned cart and unchanged gross commitment. Reauthorizing the same unit ceiling with human carriers confirms that their 60-weight limit still applies. test/outpost-itineraries.test.js funds and restores a 70-food first load while rejecting 101. Older 50-unit or smaller mandates need no migration. The seven-community managed loop still needs real cart production/repair and enough food output to hold Regional-capital qualification. See living world design and gameplay foundations.

Renewing mixed forestry exchange checkpoint: test/helpers/seven-community-renewing-exchange.js branches from the actual maintain-headworks completion in seven-community-preventive-well-repair.js, before later manual capital recovery. It uses revision-checked owner commands to staff the home school and saw, pay a DISPATCH_OUTPOST_SUPPLY load of sixteen timber, six logs and four food, and staff the source village field and saw. SET_GOVERNOR_MANDATE reauthorizes the existing paused route in daily-only mode with home timber, logs and food targets and separate material allowances. Ten chronological home checks must fund at least three distinct governor jobs and complete at least two; an observed homeward job carries all three materials. Assertions keep all seven communities fed, verify working water for 62 home residents, retained six links and usable warehouse stock, then restore the exact mandate and both inventories from save. The bounded endpoint has less than six home food days and is not a Regional capital, documenting the current labor-and-cargo constraint rather than claiming an unattended equilibrium. See living world design and gameplay foundations.

Preventive well repair from the ready exception: test/helpers/seven-community-preventive-well-repair.js resumes the saved 52% capital with four local bricks, eleven timber, two tools and the urgent owner-only headworks-ready issue. Ordinary owner commands unstaff two extra registry offices, the home lumbermill and the school, freeing four residents for START_LAND_PROJECT with maintain-headworks. The usual quote debits eight timber, four bricks and one tool, and the one-day job restores 100% condition before the modeled two-check loss of extra water; every engine advance checks household capacity against the 62 residents. Two separate DISPATCH_OUTPOST_SUPPLY jobs return twenty timber with eight food and sixteen timber with eight logs from the owned forestry village. The home fully staffs a food field during travel, then runs one saw worker through nine Village, Town and City qualification checks. Three restaffed offices restore live six-title capacity. Assertions cover zero water interruption, positive food and no last-day shortfall in all seven communities, retained charter rights, active Regional institutions and save restoration of stage, capacity, headworks and each inventory. The observed endpoint has 66% headworks, three timber and one tool, so this is a funded prevention and recovery cycle rather than a standing balance. See living world design and gameplay foundations.

Second material-cycle toolmaking and capital return: test/helpers/seven-community-tools-capital-return.js resumes the saved post-repair Town snapshot without injecting people or stock. Four ordinary DISPATCH_OUTPOST_SUPPLY jobs return two mixed eight-log/sixteen-timber loads and two further sixteen-timber loads from the owned forestry village. A paid START_HARVEST on mature local woodland replenishes actual village logs; its staffed lumbermill continues producing real timber while trips travel. The home staffs its charcoal kiln for a five-log/four-charcoal batch, then runs the persisted forge-tools smithy recipe to consume two retained iron and one charcoal for two tools. Home field and mill staffing plus temporary release and restoration of two extra registry clerks sustain food and civic service through Village, Town and City qualification. Assertions cover 62 residents with six local food days, seven fed communities, active Regional institutions, six effective outpost slots, retained forged tools and timber, working well water and save restoration of stage, capacity, water and inventories. The observed endpoint has 52% headworks, eleven timber and two tools. With the full four-brick/eight-timber/one-tool bill locally present, regional-overview.projection emits an urgent owner-only headworks-ready issue targeting Land & water and showing two ordinary wear checks remaining. If the headworks are already below 50%, the same issue says the repair is ready to restore water. It neither reserves the bill nor starts work; another paid well repair is imminent. This integration proves a second local source-to-service cycle, not unattended multi-community balance. See living world design and gameplay foundations.

Second headworks repair and wear-check forecast: regional-overview.projection computes floor((condition - 50) / wearPerDay) + 1 remaining ordinary headworks-wear checks while condition is at least 50, or zero after extra water has stopped. The historical capital checkpoint here has an unlined well with two-point daily wear; a paid lined well instead wears one point per day. An enabled, worn well at 80% or lower with missing local repair materials and no funded repair produces the same owner-only Supply chains issue; it becomes urgent at three remaining checks, including the 54% boundary. This is a read-only lead-time estimate, not a promise that stock in transit can arrive or that a future repair will complete. test/helpers/seven-community-timber-after-repair.js checks that the real capital's 54% well reports three checks and two missing bricks. test/helpers/seven-community-second-well-repair.js continues that saved state: a paid clay trip, ordinary six-brick kiln batch and separate sixteen-timber forestry pickup precede another four-worker maintain-headworks job. The long pickup visibly interrupts the extra twelve household water units before the paid job restores 100% condition; its endpoint has no tools, retains all six charters and reloads without stock or water grants. The test proves an additional paid material cycle and a recoverable outage, not uninterrupted regional operation. See living world design and gameplay foundations.

Forestry timber return after the paid well repair: test/helpers/seven-community-timber-after-repair.js resumes the saved zero-timber endpoint through normal owner commands and deterministic village checks. It reallocates home mill labor to a food field, uses a paid DISPATCH_OUTPOST_SUPPLY trip for 40 forestry-village food to open local warehouse capacity, then completes a manual START_HARVEST of 21 real logs there. Four village sawmill workers produce exportable timber from that stock. Two separately paid outpost-supply jobs collect sixteen and nine timber; the home assigns two then one saw worker against six then seven field workers, releasing two extra offices only during the second journey. The return requalifies through Town, City and Regional capital and restores three staffed offices, active Regional institutions and six current outpost slots. Assertions check all seven communities fed, home food at least six population days, working headworks, a retained local timber buffer, and save restoration of stage, capacity, water and all inventories. The observed endpoint has 54% headworks condition and eight home timber. The route does not assert unattended long-term balance or create stock on load. See living world design and gameplay foundations.

Local clay-to-well renewal and civic-supply exception: test/helpers/seven-community-material-renewal.js resumes the saved capital-return snapshot through ordinary revision-checked owner commands. A paid DISPATCH_OUTPOST_SUPPLY collects eight finite clay and 32 food from the owned clay outpost; two staffed kiln checks consume the clay and three home logs for six bricks. A separate four-worker START_LAND_PROJECT with maintain-headworks spends four bricks, eight timber and one tool and restores headworks to 100%. The assertion checks all seven communities remain fed, home food covers six population days, and save restoration preserves stock and water. At this endpoint timber is zero. regional-institutions is enabled but inactive for unavailable upkeep, so outposts.administration reports capacity two against six retained charters; the capital stage has only a decline grace. regional-overview.projection now sends operating-supply interruptions to Supply chains and includes each required daily material and current local warehouse amount, while labor and institution blockers retain their existing targets. The integration checks the issue, retained rights and owner-only restored projection. This is one paid replacement-material cycle, not continuous capital operation. See living world design and gameplay foundations.

Regional woodland capital-return integration: test/helpers/seven-community-capital-return.js resumes the fully saved local-mill endpoint, with no seeded residents, stock or rights. It suspends home Record keeping, shifts mill staff to zero, then funds thirteen START_HARVEST jobs and five DISPATCH_OUTPOST_SUPPLY log returns from two other owned woodland villages and the forestry village; two further physical trips return food. Two maintain-headworks jobs spend the remaining bricks and tools. Home milling consumes delivered logs to rebuild timber, and the smithy consumes retained iron and charcoal for tools. Home ADOPT_TECHNIQUE calls restore Record keeping and Land registry; one staffed office, three mill workers and six field workers keep all Town, City and capital assessment rows true for the required three checks at each stage. The endpoint restores three staffed offices and verifies six-title capacity, six local food days, household water, no latest food shortfall in all seven chartered communities, and rehydrated stage, development history and inventories. The forestry mill and its local Record keeping are explicitly paused during log diversion. No save-schema change is needed, and the branch does not prove indefinite timber, brick, tool or waterworks balance. See living world design and gameplay foundations.

Second-site forestry mill integration: test/helpers/seven-community-local-timber.js forks the command-produced recovered seven-community snapshot after the managed-upkeep proof. SUSPEND_TECHNIQUE, ASSIGN_STRUCTURE_STAFF, selective START_HARVEST and DISPATCH_OUTPOST_SUPPLY use the ordinary authority, labor, ration, warehouse and travel rules. At least six deliveries move home-milled timber to the forestry settlement for its catalog 110-timber and 30-food lumbermill cost; clay and log returns, kiln output, smithy output and paid maintain-headworks jobs cover intervening material needs. Local Record keeping is suspended if enabled so its daily timber upkeep does not silently spend the construction stockpile. START_CONSTRUCTION occupies an open village plot, two assigned village workers consume local logs for timber, and a paid return team physically collects sixteen timber. The test pauses the village mill, waits for a cell in its earlier harvest set to regain the actual cover, maturity and health thresholds, and funds a second START_HARVEST on that same plot. After local ADOPT_TECHNIQUE for Record keeping and mill restaffing, a later village production check records a fresh receipt with real log input and timber output. The restored snapshot retains the operational local mill and both warehouses. No resource, person, right or building is inserted directly into engine state and no save schema changes. The home may lose Regional capital stage while Land registry is suspended; the separate regional-return integration above re-earns it through physical inputs, without proving continuous capital service or equilibrium. See living world design and gameplay foundations.

Land-project goal and headworks repair warning: supply-chains.projection includes a repair-headworks conditional consumer only when the local land.water projection has enabled built headworks; its copied input comes from land.TYPES['maintain-headworks'].cost. The City goal selector lists one-time and conditional land consumers under Land projects. For that repeatable repair and for buildings, public/supply-goal-plan.repeatGoal scales the material bill by one to twenty proposed projects before the existing planner allocates stored stock and upstream alternatives once. It excludes catalog construction work and does not create orders. regional-overview.projection checks the single-repair cost when headworks condition is at most 80 and no maintain-headworks job is already funded. If any local material is below cost, an owner-only headworks-materials issue gives each current stock and missing quantity, targets Supply chains and becomes urgent with three or fewer ordinary wear checks remaining. It never includes carried or expected cargo, reserves materials, starts a job or advances the world. The command-funded deep-groundwater test proves the exact quote, one- and two-repair shortages, immutable projections and clearance when stock returns; normal land-job checks still decide whether a repair can start.

Seven-community upkeep integration: test/helpers/seven-community-upkeep.js resumes the command-produced recovered capital snapshot. It uses accepted staffing, supply, harvest, production and headworks jobs, never injects resources or residents. Two extra office clerks are released during two-carrier loads, kiln and smithy batches, or four-worker well repair, then restored; one office and the capital-required services remain operational. Seven home field staff and one mill staff preserve food while slower timber output spends the initial reserve. The test advances at least 24 village days, verifies after every advance that capital status, delivered water, six local household food days and food without shortfall in every chartered community persist, and requires at least two paid repairs, two food returns, two log returns, fired bricks and forged tools. Stage history never adds a regression; all three offices restore six-title capacity and the ending state reloads with the same home inventory and capacity. This is a finite managed interval, not a renewable timber or mineral equilibrium. See living world design and gameplay foundations.

Third registry office and sixth retained outpost: outposts.administration counts a third distinct operational registry-office at condition 65 or higher, with staff and no active work, when the home is an earned Regional capital and Land registry and Regional institutions are active. It returns capacity six; two offices support five. founderQuote rechecks live service, one active founder, current survey and charter, at most twenty-four walking steps, six available home workers, household protection, paid cargo and reserves. Existing sites and funded journeys remain when capacity later drops. outposts.initialize rejects more than six retained links or an over-limit founder; older saves need no migration because capacity derives from existing buildings and programs. The isolated third-registry-office branch checks the empty-clerk rollback. The sixth-mineral-outpost branch of the long City integration test starts after five links and a physically exhausted iron deposit. Paid pickups retrieve 16 retained ore and woodland logs for charcoal, tools and timber; civic-program suspension and readoption, specialist-death release, clay-fired well repair and real food imports permit a third office and re-earned capital. A returned iron survey and conditional charter fund eight existing founders with ten extra timber. A separate local field feeds the new camp; five supply teams deliver ninety timber and collect food to protect storage; a staffed mine consumes the new finite deposit; a returning team delivers ore for home metalwork and a new tool. It checks six retained links, old ground stock still zero, new stock lower than its initial amount, and saved links, inventories and deposit remaining. seven-community-recovery then branches from that actual state: continuous field production and paid food deliveries raise the forestry village's health, six mature-cell harvests return logs, two kiln batches and forged tools pay for well repair, and three waystation household arrivals debit twelve source residents. One staffed office, an operational school and three mill workers reserve two labor slots for Regional institutions; three daily checks at each stage regain Town, City and Regional capital before the remaining two offices are staffed. It asserts six-title administration and positive food in all seven chartered communities. This is bounded command-driven recovery, not a long-term seven-community balance. See living world design and gameplay foundations.

Regional finite-deposit attention: regional-overview.projection iterates only surveyed deposits attached to settlements in the requesting account's founding-home link set. It associates each deposit with an uncleared extractor on the same cell and compares remaining stock with max(initial * 0.2, five full catalog output batches). A positive live seam warns only while that extractor is staffed; an exhausted built seam remains visible. city-projection.productionStatus supplies current staff-scaled output for an approximate cycle count, even though blocked production and storage can delay actual exhaustion. The attention target is the deposit cell in that settlement's supply tab. Its guidance names existing imports, consented worked-site leases and conditional new surveys without authorizing any of them. No advance, mutation, survey reveal for another player or save migration occurs. test/mineral-outposts.test.js, test/clay-outposts.test.js and test/masonry.test.js cover threshold, clearing, ownership and immutable reads; test/regional-overview.test.js checks the surrounding private projection. See living world design and gameplay foundations.

Governed clay and later local-brick upkeep: The six-community extension in test/helpers/regional-capital-growth.js uses SET_GOVERNOR_MANDATE with collectResource: "clay", a positive home target and allowanceMode: "daily-only" after the fifth pit produces actual stock. governors applies existing route food, two-carrier availability, shared daily logistics ceilings, outpost storage, physical job and return checks. The test observes dispatched mandate history and a rise in home clay after a return, then staffs the existing kiln for at least two further batches. A paid maintain-headworks repair, temporary Record keeping and Land registry suspensions, real milling and a physical forestry-village log collection restore the supplied-workshop requirement and Regional capital status before the route. A later 36-day command-driven interval sets SET_LAND_MAINTENANCE on the home well with a 70% threshold, daily-only allowance and an eight-timber/four-brick/one-tool budget. When condition is due, the owner frees four workers; the next daily check funds a normal maintain-headworks job, and its completion restores 100% condition. Two such commitments consume locally fired bricks without DISPATCH_CARAVAN brick purchases or manual project starts. The instruction's order count rises by two, brick stock falls by exactly eight and total repair use exceeds stock held before governed kiln output. Checked days require capital stage, delivered water and positive food without shortfall in all six communities. The second office and its five-title capacity are restored; inventories, well state and the land-maintenance ledger rehydrate. This exercises existing rules; no save-schema migration is needed. It remains a managed finite-resource proof. See living world design and gameplay foundations.

Fifth retained outpost and finite local brick chain: outposts.administration counts distinct operational registry-office structures at condition 65 or higher with staff and no active work. At earned Regional capital with active Land registry and Regional institutions, one office grants four retained outposts, two grant five and three grant six; lower-stage limits are unchanged. initialize and founder validation accept at most six persisted links, while capacity governs new dispatches and never deletes existing links. City founder review discloses the second-office condition. test/helpers/regional-capital-growth.js continues the earned 64-resident state: it pays for and staffs a second office and home kiln, surveys and registers a fifth clay site, transfers eight existing residents with the paid kit, and delivers real construction timber on DISPATCH_OUTPOST_SUPPLY journeys. A field occupies non-deposit land; a staffed clay-pit consumes finite state.deposits stock, and a return journey transfers clay to the home warehouse. The existing kiln recipe consumes eight clay and three logs for six bricks. Paid headworks repair and actual waystation arrivals restore 64 residents, delivered water and capital status. Assertions cover five retained links, six fed communities and save restoration. No title, goods, deposit or population are granted on load, and no save-schema migration is needed. This is bounded integration coverage, not an indefinite material balance. See living world design and gameplay foundations.

Chartered iron in the managed Regional capital integration: test/helpers/regional-capital.js chooses a non-deposit field plot in the fourth, surveyed iron outpost, preserving the finite deposit cell. After the 240-day above-60 checkpoint and replay assertion, test/helpers/regional-capital-growth.js uses ordinary DISPATCH_OUTPOST_SUPPLY jobs to deliver ninety timber and return camp food under warehouse limits. START_CONSTRUCTION places an iron-mine on the deposit; four assigned workers deplete state.deposits into ironOre, and a physical return job moves four ore home. The home charcoal-kiln supplies fuel and a staffed smithy explicitly selects metalwork, consuming four ore and two charcoal for three iron and one tool. Additional SET_LAND_MAINTENANCE allowance, paid replenishment, mill staffing and a temporary SUSPEND_TECHNIQUE/ADOPT_TECHNIQUE pair for Land registry keep capital water, labor and timber viable through the branch; its checkpoint restores Regional capital status and food in five communities. No stock or deposit is seeded by the test, and the ore seam remains finite. This is integration coverage, with no save-schema change; the later fifth-charter branch above adds the new founder-review text. See living world design and gameplay foundations.

Ten-year managed 64-resident capital upkeep: test/helpers/regional-capital-growth.js continues the command-funded capital branch after its first above-60 household. It selects migrationParty: adult-worker; three distinct accepted waystation journeys each debit one source resident and reach the 64-place housing limit without an added population grant. A SET_LAND_MAINTENANCE instruction on the founding well uses threshold 54, zero retained idle workers and explicit cumulative allowances. One paid maintain-headworks job uses existing stock; later DISPATCH_CARAVAN exchanges trade logs for bricks and timber for iron, while staffed charcoal-kiln and smithy batches produce replacement tools. A reviewed increase in the maintenance total retains the original orders and spending. Each ordinary four-worker repair consumes eight timber, four bricks and one tool; the saved ledger reaches ten orders and gross spending of 80 timber, 40 bricks and ten tools. Staffing changes free each crew and restore the mill after completion. From recovered Regional capital status, every engine advancement over 240 village days checks population above 60, headworks condition at least 50, household water capacity, capital stage and positive food without a latest shortfall in all five chartered communities. At least one lawful ruler handover and two later material replenishments occur. An offline replay of the final decision-free segment matches all five inventories and populations, the founding land plot, maintenance ledger and governor ledger. The separate 3,600-day branch still ends at 60; operation beyond finite market supplies, renewable mineral supply, sustained replacement inputs and indefinite succession balance remain open. See living world design and gameplay foundations.

Founding-home deeper source and first above-60 admission: land version five migrates version-four and earlier plots without a groundwater grant and rejects an unmarked or malformed groundwater record. prospect-deep-well requires a surveyed founding commons on original feature-free fields with moisture at least 0.55 and elevation at most 0.65, an active Small irrigation program, an operational source structure and four available workers. Its paid two-day job records one verifiedYield: 12 on completion; sourceLimit then rises from the original 60 to 72, but sourceCapacity still delivers only the original 60. Existing well-headworks may subsequently add one paid level at that founding source. It requires separate materials and three days, and uses the existing condition, flood, repair, maintenance and household-priority calculations; no second level or duplicate survey is accepted. The focused command test checks physical imports and harvest, save/offline completion, wear/repair, authority, legacy migration and forged yield. test/helpers/regional-capital-growth.js forks the earned capital save before the separate 3,600-day continuation. It uses accepted commands to import iron, make charcoal and tools, collect actual outpost logs, mill timber, recover food, pay for research and both well jobs, clear ground and build a town house. A four-person waystation journey then raises the home above 60 within 64 housing and 72 delivered water units. The test checks the source resident debit, arrival, inventory and migration replay, then re-earns capital after temporarily released services are restored. This proves one funded short-term growth path, not long-run above-60 balance. See living world design and gameplay foundations.

3,600-day Regional capital integration: test/helpers/regional-capital.js extends the command-funded five-community route through a third paid backup cohort. A temporary field-to-mill shift accumulates real timber; retained tools and paid courses qualify Record keeping and Regional institutions backups. regional-overview.projection routes enabled programs with Waiting for specialist workers to people, reporting actual free labor and reassignment guidance. After a reviewed governor change collects logs without exporting food, the route selects one-adult migration near the home’s 60-person housing/water cap and uses paid field/mill staffing shifts to restore eligible food output and timber. people version three records migrationParty; version-two saves migrate to the default household policy, while malformed unversioned selections are rejected. Departure debits one actual source resident and outward/return rations; arrival rechecks the selected party’s housing, water, food output and reserves, and active journeys retain their original size when policy changes. Every checked day through 3,600 retains capital stage and positive food across five communities; segmented replay compares inventories and ledgers. Earlier 2,600- and 3,500-day capital descriptions below are prior checkpoints. This does not prove indefinite demographic balance. See living world design and gameplay foundations.

Daily operating-budget production recovery: operating-budgets.reason accepts the actual production check time and category from zone-engine, production-capacity and city-projection. An existing enabled daily-only book keeps enforcing its saved material limits during serviceReason, but only for producer input commitments. It does not permit new budget approval, undo a pause, bypass a capped budget's service rule or authorize other covered jobs and routes. Regional overview reports this state as limited. The command-funded five-community journey now combines ongoing forestry, daily governor, daily shared logistics and daily shared operating books for 2,600 managed days; replay compares both shared ledgers, and gross food commitments exceed 10,000 in each. The focused recovery test checks real mill payments, the next-day allowance, pause and save restoration. See living world design and gameplay foundations.

Renewing shared operating budget, version-two stage: operatingBudgets version two added totalMode, day, daySpent and lastBookedAt to each home ledger. The version-one migration marks existing budgets capped and retains gross spending and receipts; because only the latest forty receipts survive, it conservatively counts all previous gross spending as today's until the next home day. Capped checks use the 10,000-unit total limits; daily-only checks use at most 1,000 per material against current home-day spending. book records both daily and gross commitments after a successful physical payment, with dated activity/community receipts. A reviewed mode edit must cover spending in the selected period, so a return to capped cannot erase obligations. Scheduled husbandry care, garrison food and allied arrival refill pass event time to shared checks. Restore validates the period, chronological receipts, aggregate spending and day bounds. City review, private projection and Regional overview carry the mode, today and next reset. The focused budget suite covers real consecutive-day mill batches and later governor collections, replay, migration, mode edits and forged state; physical blockers and other local/shared permissions remain in force. See living world design and gameplay foundations.

Renewing target-production allowances: productionMandates version three migrates version-one/two instructions to allowanceMode: "capped", retaining targets, source reserves, aggregate spending, batches and stock. Because earlier saves held only the latest batch, migration conservatively sets daySpent to aggregate spent for the current local day; the next day renews normally. New commands choose "capped" (up to 10,000 per input overall) or "daily-only" (up to 1,000 per input per local village day), defaulting to the previous mode on revision. status checks spending for the selected period; record retains gross spending and current-day spending only after a real batch. The production receipt now uses the actual simulation check time rather than its potentially earlier scheduled deadline, preventing a same-day edit from discounting a delayed batch. Changing to capped requires covering all prior spending; changing to daily covers spending today. The regional plan's exact rows, copied forecast and City controls carry the period. Actual warehouse inputs, staffing, source stock, accounting, recipe service, storage and operating budgets remain independent blockers. Focused tests cover finite imported iron, later paid batches, migration, invalid ledgers, offline equivalence and regional comparison. See living world design and gameplay foundations.

Ongoing selective forestry: forestry-mandates version two migrates version-one ledgers by adding orderMode: "capped" without changing orders, paid harvest jobs or selected plots. New and revised enabled commands choose "capped" or "ongoing"; omission preserves an existing mode and defaults a new instruction to capped. Capped mode keeps the 1–10,000 maximumOrders stop, while ongoing mode retains that stored value for a possible later return but does not apply it to dispatch. orders remains a safe cumulative counter, incremented only after an ordinary physical harvest job is accepted; every local day still has one scheduled check, and tree, accounting, household food, worker, queue and whole-yield storage checks remain authoritative. A return to capped must cover all past orders. regional-forestry-plans and the single-site forecast admit and return the selected mode; Regional overview suppresses the near-total warning for ongoing instructions. Save validation rejects unmarked ongoing fields and malformed mode or counters. Local and coordinated tests cover later real orders, forecast equality, replay and migration. See living world design and gameplay foundations.

Renewing food-only supply: mandates version four migrates version-three instructions to allowanceMode: "capped" with a home-day index and the actual food committed on that day from retained decisions; versions one and two pass through their existing migrations first. New mandates default to capped, and omission on reauthorization preserves the old mode. Capped foodBudget remains at most 10,000 and covers cumulative spentFood; daily-only foodBudget is at most 1,000 and covers current-day daySpentFood. mandates.advance moves the daily ledger to every scheduled check, including waiting or blocked checks, before quoting a load. proposal prices cargo plus travel food against the chosen remaining allowance, validates safe cumulative counters, and the accepted physical job increments both cumulative and daily spending once. Save validation checks the home-day index, budget period, recent decisions, counters and job custody. City review sends the period and Regional overview labels daily use separately. Focused command tests cover later-day renewal, offline replay, mode changes and forged ledgers. See living world design and gameplay foundations.

Renewing governor route allowances: governors.allowanceModeVersion: 1 migrates older mandates to allowanceMode: "capped", recording their current day and that day's actual dispatched commitments from retained receipts. Unmarked daily fields are rejected. New commands select "capped" or "daily-only", defaulting new routes to capped and preserving an existing mode when omitted. Capped budgets stay at 100,000 per material; daily budgets are at most 1,000. governors.proposal and governor-loads.plan calculate available goods against lifetime spent or current-day daySpent, including travel food and draft feed. checkCommitment checks the complete physical quote and safe cumulative counters before dispatch; accepted jobs then increment both ledgers once. Validation cross-checks saved spending with retained receipts and the selected period. Reauthorization cannot lower a capped total below gross spending or a daily limit below commitments made that day. Regional overview displays the period and suppresses the low-lifetime warning for daily routes. Tests cover two real successive-day dispatches, restart, mode changes and forged daily spending. See living world design and gameplay foundations.

Daily-only shared logistics: regional-budgets now uses version-two book and capability markers. On load, a valid version-one book migrates every existing home budget to totalMode: "capped" without resetting its ledgers; a genuinely older budget-free save initializes an empty version-two book. New enabled commands may select "capped" or "daily-only", preserving an existing mode when omitted and defaulting new budgets to capped. check always enforces the per-home-day whole-material ceiling and safe cumulative counts, but checks limits only in capped mode. book still records gross lifetime spending, daily spending, physical journey sequence and the last forty receipts once after accepted dispatch. Capped reauthorization must cover all previous spending; switching modes never refunds it. initialize validates mode, counters, daily allowances, historical receipts and active job references; a missing marked book or unsupported mode rejects. City sends the reviewed mode, Regional overview pairs daily spending with daily limits for daily-only instructions, and the copied regional forecast includes the mode. The three-community integration test verifies food and governor departures on successive days with zero shared lifetime limits, replay and save migration. See living world design and gameplay foundations.

Chronological regional controls: mandates.pause and governors.pause reject an enabled instruction when nextCheckAt <= e.now(), matching their existing configuration guards. outpost-itineraries.control likewise rejects cancellation of a waiting plan once its next departure is due. The commands have no side effect on rejection. After deterministic catch-up records the due check, a fresh pause or cancellation stops later work while leaving paid outpost jobs, cargo and gross budget spending untouched. Saved schedules and ledger versions are unchanged. Boundary tests compare each rejected snapshot, process the due event and then stop subsequent work successfully. See living world design and gameplay foundations.

Finite governor trip custody: governors.configure stores tripLimit: null for ongoing authorization or a reviewed absolute total above the mandate's existing dispatches. A new governors.tripLimitVersion: 1 marker migrates older mandates to null; an unmarked preexisting limit or a capped active mandate already at its limit rejects on restore. governors.advance increments the lifetime count only after outposts.supply accepts a funded physical job. On the final dispatch it sets enabled: false and nextCheckAt: null after recording that daily check; the job and gross spending remain untouched. The projection returns completed for a reached cap, and Regional overview emits an owner-only unmet-target issue after the final job has returned, while the owner may explicitly extend or remove the cap through an ordinary revised command. Stale/foreign commands, local worker and material checks, shared budgets and offline event order retain their existing guards. A command-funded two-trip test verifies the stop, replay, migration and forged-state rejection. See living world design and gameplay foundations.

Large civic works and the fourth crew: knowledge.NODES["large-civic-works"] requires learned Structural engineering and Construction planning, and uses the existing staffed mason-workshop research, adoption, specialist and daily-upkeep path. catalog.STRUCTURE_DEFINITIONS["civic-works-hall"] is a one-hex paid civic building with one operating staff place; generic construction, repair, flood, worker and save rules apply. work-crews.buildingSlots still returns one without active Construction planning, two with it, and three for an earned City or Regional capital with active Regional institutions. It returns four only if Large civic works is also active and at least one hall is operational, 65% sound, dry, staffed and free of other building work. Multiple halls do not stack. work-crews.schedule pauses the latest excess running crew on capability loss with remaining time and paid inputs intact, and later resumes it in FIFO order when service and labor return. The queued reason names the missing fourth-slot requirement. A command-funded masonry-to-hall test and scheduler interruption cover the choice; a separate earned-City test covers the three-slot stage gate. See living world design and gameplay foundations.

Paid topsoil restoration: land.TYPES["restore-topsoil"] requires active Agronomy, a surveyed prepared plot and recorded quality below 100. The common land-job path spends eight compost, four timber and one tool at acceptance, reserves four workers for two village days and pauses a supported field. On completion topsoil.restore adds up to twenty missing quality points; if natural recovery reached 100 while the crew worked, the completed job grants no additional quality. It does not credit old sediment, reset soil-work condition or alter surface water. Topsoil ledger version two adds cumulative treated counts and restoration receipts at the actual paid completion time to the version-one water-boundary loss/recovery history; version-one saves migrate with zero treatments and unchanged quality. Validation checks treatment count, receipt chronology, bounded gain and cumulative quality arithmetic. Generic specialist interruption, pause/cancel, material refund and offline crew behavior apply. See living world design, gameplay foundations and waterworks plan.

Armored terrace runoff spillway: land.TYPES["terrace-spillway"] requires active Structural engineering and an existing surveyed, reinforced terrace at 50% condition or better with no earlier spillway. The regular land-project review and crew path charges eight dressed stone, eight bricks and one tool, commits four workers for two village days, and records terrace.spillwayAt only on completion. It does not restore condition. runoff-erosion.advance sets armoredTerrace on each receipt only when the terrace is sound and the spillway predates the entire registered water interval; loss then halves terrace-only condition damage, rounded up. A failed terrace loses protection until separately repaired. Soil, tracked topsoil, other improvements and water routing use their existing rules. Land ledger version four adds spillwayAt:null to older terraces while preserving version-three reinforcement; runoff-erosion ledger version two adds armoredTerrace:false to version-one receipts without changing recorded damage. Restore validates timestamps, dependencies, receipt shape and computed losses. Supply chains lists the one-time bill. See living world design, gameplay foundations and waterworks plan.

Structural terrace reinforcement: knowledge.NODES["structural-engineering"] requires Masonry and Contour surveying, four dressed stone for research and a staffed operational mason workshop for its research and active specialist. land.TYPES["reinforce-terrace"] pays twelve further dressed stone, eight timber and one tool at acceptance, reserves four workers for two village days and uses the existing land-job pause, cancellation, service-block and review path. Supply chains lists the project as a one-time material use. Quote requires a surveyed existing terrace at 50% condition or better, no prior reinforcement and no competing plot/building work. Completion sets terrace.reinforcedAt without restoring condition or directly altering runoff erosion; the separately funded spillway above is required for that effect. land.advanceDay deducts one ordinary condition per day from reinforced terraces rather than two, including offline catch-up; critical-foundation rules remain. Current land ledger version four migrates version-one/two terraces to reinforcedAt:null, retains version-three reinforcement and adds spillwayAt:null without a grant. See living world design and gameplay foundations.

Regional reciprocal-commitment exceptions: regional-overview.projection reads the founding owner's pilgrimage-exchanges.projection and cultural-exchanges.projection once for the authorized home row. A recipient's still-open offer produces an attention issue; an accepted pact produces one owner-specific unfinished-visit issue until that sender's actual successful visit is recorded, escalating in its final two local village days. After an unfulfilled deadline, only the missing sender gets the seven-day retry issue. Each issue has a stable pact-derived ID and a People target. Closed, expired and fulfilled records produce no issue, and the other party's private overview is not returned to this actor. The read creates no command, ledger field, permission, stock or visitor and does not advance time. Existing exchange and regional save schemas remain unchanged. See living world design and gameplay foundations.

Pilgrimage exchange ledger: pilgrimage-exchanges.initialize creates an empty version-one global ledger for old saves only when its continuity marker is absent; a marked save missing the ledger or an unmarked save containing it fails restoration. PROPOSE_PILGRIMAGE_EXCHANGE requires two foreign founding owners with active pilgrimage guides, a current review and no live pact for that pair. The other owner may accept or decline within three days. Acceptance grants bilateral consent for fourteen days without transferring resources. pilgrimages.guestConsentAt checks public, private and accepted-pact permission at quote, arrival and event; withdrawal or expiry removes only pact-derived access. Only a successful hosted gathering calls recordVisit; both paid directions extend access to thirty days from acceptance. The bounded ledger validates parties, deadlines, statuses, recent host receipts and missing-sender retry windows. A missed sender waits seven days after an unfulfilled deadline before proposing another pact to that partner. Public/private permissions and performer exchanges remain independent.

Pilgrimage custody and guest consent: pilgrimages.initializeVillage adds an empty version-three host ledger with public access closed and no private invitations to earlier charter saves. Version-one owned receipts and version-two public-consent ledgers migrate without changing spent goods or granting visits. The pilgrimage-networks node uses normal research/adoption and the physical manuscript catalog. outposts.pilgrimageQuote requires an active home guide, available two-person team, sound dry host, four host food above reserve and a seven-host-day interval. It admits populated established owned outposts and foreign chartered founding cities or established outposts only while the foreign host has public pilgrimage guest access open, has named that founding community privately, or has accepted a current bilateral pilgrimage exchange. SET_PILGRIMAGE_GUEST_POLICY and SET_PILGRIMAGE_INVITATION are host-owned, revision-checked and spend no goods; at most four valid foreign founding communities may be named. Performer consent remains separate. DISPATCH_PILGRIMAGE spends home food once and persists a supply-role job with pilgrimageVersion:1, version-two consent metadata, carried two-food event stock and separate route rations. Existing step travel, hazard/Scouting detours, crew exclusivity and recall apply. Arrival starts a visiting phase for one full host day, unless every applicable foreign permission has closed. pilgrimages.resolve rechecks consent, guidance, camp or commons, host basic needs and four real host food above reserve; success spends both food pools, records the guest consent time on the receipt and restores at most two host health. Failure turns the team home without spending event stock. Restore validation checks route phase, consent, timestamps, event custody and receipt links, rejects forged foreign legacy jobs, and preserves older owned jobs. A successful foreign gathering also records its sender obligation in a current accepted pilgrimage exchange. Wider route networks remain planned. See living world design and gameplay foundations.

Efficient kiln firing: production-recipes.RECIPES.kiln keeps the catalog's {clay:8,logs:3} → {bricks:6} as its first, default recipe for old saves and offers {clay:8,logs:2} → {bricks:6} behind kiln-firing. The Building node uses the existing knowledge ledger, staffed kiln institution, research/adoption costs, specialist labor and one-food daily upkeep. SET_PRODUCTION_RECIPE persists a version-one choice and resets nextDueAt; knowledge.cropRecipe checks the selected recipe's active technique at each due production check. Supply chains and City production project the same recipe definitions. Existing saved kilns without a recipe acquire only the old default; saved valid alternatives are retained, and malformed recipe IDs remain rejected. The focused test seeds raw clay and logs at the warehouse boundary; finite extraction and physical clay delivery have their separate integration coverage in clay-outposts.test.js. See living world design and gameplay foundations.

Owned-outpost Scouting detour: expansion.dryRoute searches at most sixty walking edges and avoids current burning vegetation and recorded basin-exposure.cell floodwater without caching hazard state. outposts.supplyRoute uses that path when the ordinary cached route is blocked and the home has active Scouting; otherwise it retains the ordinary route or rejects the blocked quote. outposts.supplyQuote prices carrier rations, road timing, capacity and any draft loan/feed from the chosen path. governors.configure, proposal and projection use the same chosen path for distance limits, cargo planning and allowance accounting; food mandates already use the supply quote. During outposts.advance, a paid human or draft-assisted supply job facing a newly blocked next hex can splice a bounded dry path from its actual current hex to the destination or home, update its route index to the same physical hex and retain custody, schedule the next road edge and emit OutpostSupplyRerouted. That travel check still consumes food and any selected horse's feed. No alternate path leaves the existing blocked state. A draft loan's immutable route keeps the accepted feed quotation; travelRoute records the actual revised route and must match the live outpost job. The nested detourVersion:1 marker migrates older loans to travelRoute:null without moving goods, workers or animals. Paid feed still equals the original accepted route quotation; elapsed-time feeding and actual-edge condition wear continue on the detour. The existing outpost job route schema validates saved paths, and stepped and offline replays agree. See living world design and gameplay foundations.

Conditional wetland retention capacity: wetland-ecology.capacityAtCondition shares the live capacity formula for an unconverted marsh, and sediment.retentionLoss accepts a branch condition so its half-capacity clamp follows that branch rather than today's condition. In major-waterworks-impact.history, each recipient-owned observed marsh in a registered basin carries natural and proposed condition and dry-streak state through the exact basin-water window; each interval now also records the corresponding next-interval retention limit. The output includes today's, natural and proposed limits while retaining today's local sediment bed. Reads do not edit water, habitat or sediment. This is a capacity consequence only: local rain/transfer forcing, actual surface storage/discharge and resulting basin feedback are not replayed. Tests cover the live formula, sediment-cap boundary, per-interval branch values and owner privacy. See living world design and waterworks plan.

Paid frontier reconnaissance: START_PATROL accepts contactStance: "recon" only through an owner-authorized ready militia with active Scouting and an uncleared surveyed corridor. military.quoteRecon reuses ordinary departure, readiness, hazard, age and protected-food checks but prices the actual out-and-back approach route, leaving the final occupied camp hex out of travel distance. Acceptance pays the warehouse food and stores the optional stance on the existing militia job. military.advance checks the actual last approach, then records a dated PatrolReconnaissanceCompleted report with current observed strength and vegetation cover and switches to physical homeward travel without combat or camp clearance. Travel feeding and delays still apply. Persisted validation accepts the stance only on a genuine patrol outside the camp, and arrival clears it. Stepped/offline replay and save restoration match. A new order requires current Scouting even if an accepted march continues after service loss. See living world design and gameplay foundations.

Recipient wetland condition scenario: major-waterworks-impact.history first exactly replays the retained natural water routes and balances. For each currently observed, unconverted wetland inside the reviewing recipient's charter and a registered basin, it compares natural and proposed closing waterline inundation while holding today's separate local surface-water storage fixed. The pure wetland-ecology.response function is shared with live advance: converted ground loses ten condition, two consecutive known dry checks lose five, wet checks recover two, and unobserved checks do not change condition. Each branch carries its own dry streak from the current record across the verified window. Unmodelled, unobserved and converted sites are counted separately; at most sixteen modelled sites appear in the bounded per-hex list. No habitat, water or save ledger changes on a read, and foreign site state is omitted. A controlled major-waterworks-impact test covers changed waterline, multi-check drought, no-release and privacy. This conditional response holds current local retained water and other ecology drivers fixed; it is neither a historical replay of habitat state nor full W2 proof. See living world design and waterworks plan.

Defensive archer volleys and fire policy: military.quoteGuard checks the trained archer's possible 1.5 defense factor at the surveyed post, and escorts.quote reports the possible factor at the observed camp without funding or firing. professional-service.power applies it only to an active, paid archer guard holding its post or an active moving escort at the camp, when archery.volley confirms two carried arrows per unwounded member, cover below 70, no burning hazard and fatigue at most 60. guardProtection and escorts.protection still check real position, food, condition, morale, timing, threat and crossing custody. After these checks pass on an actual crossing, archery.defensiveVolley compares ordinary archer power with the observed threat. The version-four archer policy defaults to necessary, which holds fire if ordinary power suffices; reviewed SET_ARCHER_FIRE_POLICY can choose always, which fires even then. Each fired volley creates one existing-format ammunition volley receipt, decrements the quiver, emits the firing event and adds arrowsFired to the defense report; it reduces that crossing's condition loss from two to one and fatigue gain from four to two. Duplicate phase visits do not fire again. The next crossing reads the reduced balance and may lose protection. Version-three archer jobs migrate to version four with necessary and unchanged quivers; malformed version-four policies reject restore. Home loading and version-three field-supply delivery remain unchanged. archery.projection includes policy, assigned defensive hex and current blocker without changing custody. test/archery.test.js covers both policies, guard, escort, deprivation, restoration and replay. See living world design.

START_MOUNTED_GUARD combines military.quoteGuard(..., mountedReview=true) with rider qualification and two available fitted horses. The quoted post must be fields or forest with vegetation cover below 45, and ordinary defense power multiplied by the conditional mounted factor 1.75 must meet the surveyed threat. It pays guard food plus ceil((2 × postIndex / 24 + days) × 4) + 8 horse feed, checks the feed budget, sets both animals to mounted status, and saves a version-three mounted.kind="guard" ledger beside the ordinary guard order. Actual movement uses the mounted route step; soldier and horse food are separate elapsed-time balances. militia-riders.fieldPosture provides the defense factor only while the unit is holding its exact post with two unwounded, low-fatigue riders and fit, fed mounts on open ground. guardProtection applies that factor to actual caravan crossings. Fire, flood, reserve, deadline, readiness, recall and horse-feed withdrawal remove protection; a returning supply team is also released if mounted withdrawal interrupts its rendezvous. Guard resupply changes soldier food only and cannot extend the paid term. Rider marker three migrates to four, upgrading active patrol/escort custody to mounted record version three without moving stock; restore validates guard kind, route, phase, feed conservation and animal custody. test/militia-riders.test.js exercises paid departure, actual crossing, save integrity and physical return. See living world design.

Major-reservoir source water consent: The existing version-nine majorWaterworks notice schema stores source grant and withdraw actions in waterConsentActions, keyed by the source settlement ID with lawful source owner and character. It grants no default signature to an old save. The source does not need a recipient-style acknowledgment because its lawful authority filed the notice; it must still act separately before the current fourteen-day window closes. waterConsentStatus.source reports its live signature and controls, while allNamedSigned requires that source plus every named recipient, including the zero-recipient case. Recipient grants still require their own prior acknowledgment. Restore validates source identity, chronological actions and bounded grant/withdraw sequence alongside recipient records. The command changes no actual basin water, warehouse stock or construction state; other W2–W4 gates remain.

START_MOUNTED_ESCORT composes the existing escorts.quote and rider-qualified horse eligibility against a still-home, already-dispatched caravan. It pays the escort's ordinary soldier food and ceil(plannedCaravanRoundTripMs × 4 / dayMs) + 8 horse feed, then records mounted:{version:2,kind:"escort",caravanId,plannedDurationMs,...} and moves both identified animals to mounted. escorts.follow advances horse wear only on an actual caravan edge, including detours; military.feed and checkEscort consume carried horse feed on elapsed time while the unit remains away. The caravan's pace is unchanged. professional-service.power applies militia-riders.fieldPosture to escort defense only while the escort is active, co-located at the crossing, two unwounded low-fatigue riders and two fit fed mounts remain, and ground is fields or forest walking terrain. Patrol contact still needs under 45 tree cover. escorts.detach sets a physical mounted or walking return; escorts.follow unloads horses and feed after shared arrival. Rider marker version two migrates active version-one patrol custody to version:2,kind:"patrol",caravanId:null,plannedDurationMs under marker three, without changing route, feed, stock or horse status. Restore validates order kind, caravan identity, exclusivity, paid/consumed/returned feed, phase and actual escort link. test/militia-riders.test.js covers a paid caravan, protected crossings, detour, recall, shortage, restart and tamper rejection. See living world design.

START_MOUNTED_PATROL reuses the authoritative military survey, patrol food and casualty path after a two-person unit has a saved rider qualification. The reviewed command chooses any two distinct mature fitted horses currently home, cared, unloaned and outside breeding/relocation, checks active husbandry and mounted service, pays soldier food plus ceil(8 × corridor edges / 24) + 8 horse feed, and sets both horses to mounted. The unit's version-one mounted record carries horse IDs, start/feed timestamps, paid/carried/consumed/returned/unmet feed, steps and travelling/unloading status. Each living horse consumes two field feed per village day; normal home care and livestock water demand exclude mounted horses; route watering follows the existing travel abstraction without a separate water cargo ledger. One route step takes dayMs / 24 while both horses have at least 70 condition, feed and two riders; otherwise it uses the existing dayMs / 12. Fire/flood blockers keep consuming supplies, horse shortage forces homeward and can kill an animal, and professional-service.power multiplies actual field-contact strength by 1.75 only when militia-riders.fieldPosture finds two unwounded riders, fatigue at most 60, two mounted horses at 70 condition or better, positive carried feed, fields or forest ground and tree cover below 45. Defense strength remains unchanged. A total field loss marks surviving mounts dead and loses carried feed; a surviving unit returns both horses to home status and retains unused feed until storage can accept it. The defense rider marker now migrates through version four; new charters start at four. Restoration checks the pair's home settlement, fitted qualifications, travel status, route, custody uniqueness and feed conservation, rejecting orphan mounted horses. City Defense projects each assignable pair and current route hex privately. The focused test/militia-riders.test.js exercises paid movement, mid-route restoration, return, loss and migration. The quote reports current camp cover and suitability; the encounter report records the applied factor and reason. Mounted guards and convoy escorts are playable as described above; campaigns and wider cavalry tactics remain open. See living world design.

militia-riders adds a riderVersion:1 marker to charter defense and nullable riderDrill / riderQualification fields to a militia job. Missing fields on genuine older saves migrate to null; a marked save must retain valid custody. START_RIDER_DRILL quotes a ready uncontracted two-soldier unit and two distinct qualified home horses, checks active husbandry and mounted specialists, normal horse condition and enclosure service, the known soldier age window, feed stock and budgets, then holds four feed and sets a home rider-training phase. Daily military advancement spends two held feed only after fresh ordinary care for both horses; a pause retains progress. CANCEL_RIDER_DRILL refunds unspent feed when whole storage permits. The draft-busy path excludes reserved horses from draft loans, breeding and relocation. Completion records unit-level rider qualification and returns the unit to ready; casualty, old-age loss or completed reinforcement clears it. Restore validation checks phase, pair, spent/held conservation, course dates, qualification shape and exclusive horse custody against active draft and breeding records. City Defense projects eligible pairs and blockers privately. The drill alone has no field effect; the supplied mounted patrol above now adds army horse custody, field feed and faster travel and the conditional open-ground field-contact advantage described above. test/militia-riders.test.js covers the command and restoration path. See living world design.

Selected resilient horse line: knowledge.NODES["selective-breeding"] adds an Animal husbandry-dependent Agriculture topic with a staffed livestock-enclosure institution and one-feed daily specialist upkeep. livestock-breeding.quote accepts an explicit ordinary or resilient selection; the selected option requires active adoption, two parents at 95 condition and the paid {food:12,feed:16,tools:1} cost. The ordinary default keeps its existing {food:8,feed:12,tools:1} bill and 80-condition threshold. Selection is fixed on the funded project. advance pauses a selected project when breeder service or parent fitness fails and records selection on the permanent birth receipt plus a matching trait on the identified foal. husbandry.careDay continues to consume two feed and two spare water on a complete care day; a resilient born horse changes only condition deltas to −8/+8 from the ordinary −10/+5. husbandry.initialize migrates version-one breeding books to version two by marking old projects and births ordinary and old foals with null traits; marked legacy fields and mismatched receipt/trait/cost custody reject. No warehouse horse or additional birth is created on migration. City People projects both selectable quotes and the eventual trait. test/livestock-breeding.test.js covers paid selection, service interruption, actual care, migration and forged state.

Agronomy and targeted soil care: knowledge.NODES.agronomy adds a Crop rotation-dependent Agriculture topic with the existing community-field research/adoption path, one specialist worker and one food of daily upkeep. land.TYPES["targeted-soil-care"] requires the active program, a surveyed plot with prepared soil below full condition, one compost, one timber, four available crew members and one village day. It shares maintain-soil's completion effect on the existing plot.soil improvement but costs half as much of each material. work-crews.SIZE registers the new job so payment, queueing, specialist interruption, cancellation and persisted-job validation use the existing version-one paths. land.projection.options exposes the authoritative quote or blocker; the City Stewardship text shows existing soil condition and topsoil.projection.quality without mutating either ledger. The topsoil custody ledger is untouched: restoring soil condition does not add recovery receipts or change measured topsoil quality. Automatic land-maintenance retains maintain-soil and its fixed allowance/history validation. test/land.test.js covers payment, live quote, read purity, authority, in-progress restore and completion.

Live source diagnosis for selected supply goals: public/supply-goal-plan.js still expands selected full-staff recipe or funded-project batches as hypothetical requirements and allocates current warehouse stock only once. For a selected local recipe it now reads the authoritative city.supplyChains.recipes[].instances projection, counts status === "ready" sites and sums their nonnegative availableOutput for that material, falling back to projected output when needed. If none is ready, the first projected instance reason is reported with its cell ID; absent buildings, unassigned recipes, restricted prototypes and separately funded projects retain their distinct reasons. The City card shows this present-cycle upper bound beside the planned batch count, and its map shortcut prefers a ready instance. Proposed excess output and co-products are separately shared with later lines at most once; they never enter warehouse stock, mutate the projection, reserve stock or assert the batches will complete. The selected tree remains browser-session state; no world save or migration changes. Pure planner tests cover mixed ready/blocked sites and mixed-metalwork co-products; a command-funded woodland test covers actual log exhaustion. See living world design and gameplay foundations.

Elevated storehouse flood rule: The catalog adds a Masonry-gated, one-hex 400-capacity elevated-storehouse with a 0.002 floodStorageLift, paid ordinary construction, and its own semantic client recipe using the shared shed motif. Catalog validation requires a positive bounded lift only on storage-capacity definitions. flood-storage.currentExposure gets each standing store's recorded waterDepth, applies its catalog lift only at stage === "operational" and condition at least 65, and uses max(0, waterDepth - lift) as effective depth. The resulting positive-depth capacity share and maximum effective depth feed both the City one-interval potentialLoss and advance's authoritative warehouse withdrawals. No specific goods are assigned to a building; structural flood damage is separate and remains unchanged. Existing receipts retain their effective depth value and ordering, and no save schema or migration changes. A command-only test covers quarry-to-workshop material custody, actual construction, restore and shallow exposure; unit tests cover deeper water and damaged-store fallback. See living world design and gameplay foundations.

Filing-time major-waterworks impact evidence: Major-waterworks ledger version seventeen adds impactEvidenceAtFiling to each notice: true only when releaseReplay.kind === "verified-window-retention-replay" at filing, false for a preliminary notice and null for migrated pre-seventeen history. Restore validates that marker and never reconstructs it from current water. noticeCurrency reruns the exact frozen terms for true notices and returns notice-evidence-updated-amend-required if natural replay no longer reproduces conserved records; the source and recipient disable new answers and grants while withdrawals remain possible. Preliminary and legacy notices keep their prior basis/party checks. The replay and notice read are pure; the marker does not certify full W2 impact, engineering or build authority.

Current coastal fish-bed holder notice evidence: major-waterworks-impact.history scans current surveyed ocean fish stocks and applies Fish.oceanReach to natural and candidate basin-ocean exports in each exact retained interval. A stock enters the public coastalFlowExposure once when those basin flows differ; the summary returns only a total, current charter IDs/names with per-holder counts, and an unattributed count. It omits coordinates, reserves and habitat condition, while recipient-scoped coastalFish retains detailed effects. major-waterworks.noticeBasis adds ordered coastal-basin-flow-change for each named holder, and source review marks changed or unattributed beds as blockers. A change of party or reason suspends an existing exact notice until amendment. When every retained row has a complete sediment journey, a parallel coastalSedimentExposure compares natural versus proposed basin-ocean sediment exports near each stock; direct ocean sediment is unchanged in both branches and does not create a difference. Its independent ordered coastal-sediment-change notice reason and source blockers cover sediment-only effects. Incomplete journeys return null rather than inventing a sediment result. Neither screen counts unregistered stocks or clears the complete ecology or rights gates.

Current wetland-holder notice evidence: The public major-waterworks replay builds a bounded list from current wetlandEcology.cells through wetlandSites, excluding converted, unobserved and unregistered sites. At each exact interval it compares wetlandInundated under natural and proposed closing waterlines, with held source-pool water included only in the proposed source basin. Distinct changed cell IDs stay internal; landExposure.wetlandExposure exposes only total changed sites, named current charter IDs/names with counts and an unattributed count. No private condition, stock or site coordinates enter the public summary. major-waterworks.noticeBasis adds ordered wetland-exposure-change for each named recipient, while source review blocks on any changed site and separately marks unattributed sites. An existing notice with changed party or basis needs amendment. Owner-scoped detailed habitat and forage reads remain separate; this does not establish missing customary holders or future ecological response.

Held-pool marsh and wetland response: forageInterval and wetlandInundated now accept an optional candidate pool and add candidate.held only at the source basin to its routed closing storage. Each branch still uses its own closing sediment bed. Recipient-scoped marshForage retains the live two-site cap, 40-food capacity and eight-food regrowth for each dry current healthy unbuilt marsh; wetlandHabitat runs W.response from current condition and dry streak with current local surface retention fixed. A source-side site that is dry naturally but wet under the proposed pool loses conditional forage while gaining wet-condition recovery; an already wet site does not acquire a false dry streak merely because capture removed routed node water. Both cases, owner scoping and read purity are tested. No forage is harvested, habitat ledger advanced or feedback into later water intervals simulated.

Natural-versus-proposal stored-goods pressure: The retained-window storeExposure helper now accepts separate natural/candidate closing sediment beds and an optional held source pool, while the existing outlet-open/closed call keeps its same-bed behavior. It evaluates each standing store's effective depth, catalog capacity and raised-floor lift through the live flood-storage.rate; every charter's dry store still contributes to pooled capacity. Public landExposure.storagePressure contains only affected store counts, named current charter holders and capacity-percentage-point pressure. The viewing owner's recipientWellExposure.proposalStorage applies flood-storage.weightedLoss to its current vulnerable stock and retains the largest one-interval added whole-unit loss without mutating inventory. A positive rate difference adds a distinct blocker and ordered notice reason even if whole units round to zero or land was already wet. Controlled cases cover source-pool depth, privacy, exact basis, raised-floor protection and read purity. Historical stock, future service changes, unregistered reaches and W4 custody remain outside this screen.

Natural-versus-proposal household injury: Major-waterworks retained-window replay compares each recorded natural closing basin waterline with the candidate closing basin water plus held source-pool water. The proposed source level uses the candidate node storage and candidate.held with the candidate closing sediment bed; natural uses its recorded closing bed. Current operational sound homes and staffed refuges are evaluated through the shared dry-housing, Refuge.plan and FloodHealth.assess rules. The public landExposure.householdInjury lists only affected charter IDs/names; recipientWellExposure.proposalHealth gives the viewing recipient's worst one-interval natural/proposed exposure and added pressure. A positive difference adds a separate blocker and ordered exact notice basis. Read purity and private scoping are tested, including a depth increase on already wet land and removal by separate dry housing. The ordinary changedExposure and structurePressure calls now also add the held volume to candidate source-basin water; the outlet-open receiver comparison retains its separate closed/open branch. Candidate held water enters the affected-basin set even when routed node storage alone is unchanged. Source land claims, standing-building rate points, working-well counts and present-condition loss scenarios therefore agree with the household waterline. The full-capacity storage footprint remains a separate static screen. This does not simulate changing population, structural condition, shelter supplies, daily health floors or future rain through the window.

Controlled-release household injury: The retained-window outlet-open and outlet-closed branches use their same opening sediment bed to derive wet housing/refuge footprints without mutating the basin ledger. Shared refugee planning accepts an exposure callback, so current enabled policy, active specialist service, readiness, staff, limit and finite logs determine temporary shelter in each branch. Shared flood-health assessment then uses current population, the branch's dry permanent housing and actually available refuge to calculate exposed residents and depth-scaled direct injury pressure. The public result names current charter holders with a positive outlet-added pressure but contains no population or health. A recipient-scoped result retains the largest one-interval added pressure with closed/open exposure counts. It is a current-configuration comparison against recorded water, not a day-by-day replay or actual health debit; the twenty-health floor and future changes remain live-simulation concerns.

Controlled-release active-route impact: Major-waterworks retained-window replay intersects each outlet-open-only newly wet receiving-basin hex with the remaining route of current paid jobs whose phase is outward or homeward. Outward routes use cells after routeIndex; homeward routes use cells before it. Public output reports distinct interrupted jobs and named charter owners but no cargo or job IDs. Recipient-scoped output lists that owner's affected remaining route hexes and job count, even beyond its charter border. An affected owner enters the ordered frozen notice basis and the source gets a separate active-transit blocker; changed current jobs may invalidate an old notice rather than silently drop a party. This reads current jobs against historical water forcing and changes no live route, goods or water. Inactive phases, completed legs, future traffic and unregistered water are outside the result.

Controlled-release store impact and privacy: The read-only major-waterworks retained-window replay applies the live flood-storage rate and catalog floor lift to every current standing store under the same opening sediment bed with the outlet closed and open. Each branch weights local loss percent by capacity over all standing stores in a charter. Public release output contains affected-store counts, maximum added capacity-percentage points and named current charter holders, never foreign inventory. A recipient-scoped result applies the live whole-unit loss helper to only that charter's current pooled vulnerable stock and reports the largest one-interval additional loss; it does not compound past intervals or edit stock. Added storage pressure becomes a frozen notice-basis reason and review blocker. Unknown flow and future stock remain outside this conditional screen.

Per-store flood weighting and migration: Flood-storage version two records weightedFromTick on initialization. Older nine-field receipts keep the original deepest-store formula and validate only before that boundary; later ten-field receipts retain integer pressure, the sum of storage capacity times local loss percent. Each local rate is five percentage points per 0.001 effective depth, capped at 25. The whole-unit loss is floor(before times pressure divided by total capacity times 100). The current-exposure helper supplies both owner preview and actual withdrawal, including sound raised-floor lift. Migration changes no prior stock or receipts, and new damage begins at the next surface-water tick. Warehouse and dated fish ledgers continue to record only actual withdrawals.

Current flooded-store exposure: flood-storage.currentExposure derives standing storage sites from current structure stage and catalog capacity, reads each current basin-exposure.structure hit, and returns per-site wet depth and loss rate, total/wet capacity, deepest depth, weighted pressure and positive potentialLoss for present authoritative inventory. projection.currentExposure is owner City data and is computed on read, with no save field. advance calls the same helper at the water boundary before withdrawing goods, so an unchanged depth and stock reproduce the preview exactly. Adding a dry store changes the denominator under the existing pooled-capacity rule; no item is located in a specific building. The card explicitly labels the result as one identical-interval calculation and leaves unregistered reaches unknown. Forecast copies derive their own current exposure independently. Alternative-term recipient basin comparison: Both incoming bypassAlternative.wellExposure and releaseAlternative.wellExposure already carry basinFlow from the recipient-scoped exact replay. City now joins their bounded basin IDs with the noticed wellExposure.basinFlow and renders arrivalChange, closingChange and reducedTicks for each branch. Each delta is relative to the same recorded natural branch; a basin missing from a truncated list is labeled outside the bound rather than assigned zero. Only registered basins intersecting the viewing charter enter recipientWellExposure, and no absolute balance or new save field is exposed. The comparison remains read-only evidence, not a water right. Recipient-scoped alternative release replay: For a current open major-waterworks notice with an exact 25% or 50% releasePercent, projection reruns major-waterworks-impact.history at the other rate while retaining the frozen capacity and environmental bypass and passing the viewing recipient ID. incoming[].releaseAlternative holds the alternative rate plus either an explicit replay reason or only recipientWellExposure; it is null for suspended, expired, superseded and legacy no-release notices. The existing recipient filters limit wells, buildings, charter land, marsh and coastal fish, and no aggregate or foreign land exposure leaves the server. City compares both proposed branches under the same recorded natural forcing, including per-owned-fish-bed basin discharge and conditional no-harvest reserve where supported. This value is computed on read, not saved; it does not amend a notice, grant consent or change live water.

Recipient-scoped alternative bypass replay: For a current open major-waterworks notice, projection reruns major-waterworks-impact.history once with the other supported environmentalBypassPercent, retaining the frozen capacity and release rule and passing the viewing recipient ID. incoming[].bypassAlternative contains the alternative percentage and either an explicit replay reason or only recipientWellExposure; it is null for expired, suspended and superseded notices. This preserves the existing own-charter land, well, building, marsh and fish filters and does not send aggregate or foreign land exposure. City compares the noticed and alternative proposed branches against the same recorded natural forcing, including per-owned-fish-bed basin discharge and conditional reserve where the exact sediment and flow window supports it. The alternative is not saved, noticed or consentable until amendment and new notice. No live water or rights change.

Major-reservoir bypass counterrequest custody: Ledger version nine extends each notice response with nullable requestedBypassPercent. A current named human recipient may supply 25 or 50 only with decision: object and ground: downstream-flow, only when different from the exact notice’s environmentalBypassPercent. A response may request one alternative: bypass or opening-storage release. Other answers store null for both. The version-eight migration requires the old seven-field response and adds null, preserving earlier notices, exact terms, owners and dates; later restore requires eight fields, checks both request scopes and rejects forged rates. Source and recipient projections retain the request on its frozen revision, and City exposes the request in the objection control, review and history. Amendment leaves the old response historical and requires a new notice, acknowledgment and water consent. Neither response changes live water, rights or construction.

Major-reservoir bypass variants: major-waterworks.terms accepts only 25% or 50% environmental bypass on new arrivals, independently of its 25% or 50% opening-store release. DRAFT_MAJOR_WATERWORKS may include bypassPercent; omission defaults to 25% on a new draft and preserves the existing exact term on amendment. review, notice filing and currency checks use the stored bypass. Restore regenerates exact terms and rejects unsupported or forged percentages, while historical version-four proposals and notices must retain their original 25% bypass. projection.bypassCandidates exposes per-capacity 25% and 50% replay variants and bypassOptions for City; releaseNoticeParties derives the current possible holders for each selected release replay. These are read-only comparisons. The exact term flows into retained-inflow bounds, interval and recorded-window impact replays, notice signatures and recipient evidence. The independent local surface-routing natural-edge bypass remains fixed at 25%. No live reservoir operation is enabled.

major-waterworks.noticeParties unions review.possibleParties, coastalParties, screenedClaims.communities, verified releaseReplay.landExposure.claims.communities and current charters whose standing receiver buildings gain flood pressure from the proposed release. It removes the source, deduplicates by settlement ID and reads each current public owner from state.settlements. A replay with a reason adds no speculative impact holder. review computes this for each actual storage-capacity variant; fileNotice persists its exact two-field {settlementId, ownerId} snapshot. noticeCurrency recomputes the same list from current evidence, including a bounded replay when called without a precomputed impact result, and suspends actions if any ID or owner differs. Old notice records are not rewritten and no saved schema changes. test/major-waterworks.test.js covers union/deduplication and current owners, an actual filed list, holder change, restore and stale-notice rejection. The list remains incomplete where the reach or rights model is unresolved. See living world design and waterworks plan.

major-waterworks-impact.simulate records captured subunits separately for each runoff and basin-transfer leg. On a complete version-two sediment journey, routeSediment deducts floor(incomingMass * capturedWater / incomingWater) from each incoming leg, using integer BigInt arithmetic, and carries that mass in a separate cumulative candidate reservoir-trap account. The remainder joins the receiving basin bed; natural replay has zero captured water and must still match every saved transfer, export and closing bed. Each interval verifies openingBed + basinSourceMass = closingBed + exits + trappedMass; later releases do not remobilize trapped mass, although their water may move untrapped basin sediment. The proposed closing bed sets following-interval water displacement and current-interval exposure. Incomplete journey windows retain water-only comparison and sedimentScenario: null. Controlled runoff and upstream-transfer cases in test/major-waterworks-impact.test.js verify trapping and read-only custody. This is a deterministic proportional assumption, not a live reservoir ledger or chemistry model. See living world design and waterworks plan.

fish-habitat.recover now supplies the existing ZoneEngine.resourceStock capacity-capped recovery expression and the recipient-only reservoir scenario. major-waterworks-impact.coastalStocks reads resourceStock(cellId, now, false) so a notice starts at the current nonmutating stock projection, not stale persisted remaining. After each stock's first verified nearby-flow interval, both no-harvest branches recover for one village day using the prior branch condition, cap at current capacity, then apply nextCondition to the interval's verified flow and sediment. habitatScenario reports initial and closing fish reserves, total recovery, per-tick remaining and condition, and closing recovery potential. This replay neither harvests fish nor edits the persisted stock. The impact test covers prior-rate timing, divergence, full-capacity saturation and a projected reserve different from stored state; live fish tests still cover stock settlement and restoration. See living world design and waterworks plan.

major-waterworks-impact.history now gates each recipient fish stock's low-flow and turbidity counts on its first complete row with positive natural nearby flow. It records firstObservedTick, unobservedIntervals and per-row reachObserved. The shared fish-habitat.nextCondition scenario is created only at that first tick when all water-source and sediment rows are complete, then advances over subsequent known intervals from the stock's current condition. A merely cumulative crossing outside the retained window cannot make earlier zero-flow rows observed. test/major-waterworks-impact.test.js covers a dry opening tick, later connected wet tick, subsequent dry tick, a distant unobserved stock and unchanged state. See living world design and waterworks plan.

basin-sediment version two retains a twenty-interval routeWindow with sorted per-source mass and ordered nonzero transfer/export legs carrying their water amount. Restore checks row clocks, source-to-water routes, per-leg water support, deterministic mass movement, node sample balances and cumulative custody. Version-one saves migrate with startTick at the current tick and no invented older journey. major-waterworks-impact reads each sediment sample's opening bed for water routing, then verifies natural water and sediment routes exactly. A complete journey window enables candidate sediment to follow candidate water routes and update the next interval's bed. End-of-interval land, structure and marsh exposure uses each branch's closing bed, matching the live order in which basin-water.advance precedes basin-sediment.advance and later exposure. If journey coverage is incomplete, verified water still uses recorded natural beds in both branches and sedimentScenario is null. Incoming source soil stays fixed; a bounded proportional reservoir sediment trap is simulated, while future erosion is not. test/basin-sediment.test.js and test/major-waterworks-impact.test.js cover a deposit and reciprocal spill, migration, forged legs, route-coupled fish exposure and read purity. See living world design and waterworks plan.

basin-water version four extends each exact route row with sorted source receipts {cellId, kind, basinId, amount} and a sourcesStartTick marker. It checks source totals against cumulative custody and basin runoff samples; missing, duplicate, rerouted and overdrawn source entries reject restoration. Version-three rows migrate with sources: null, preserving their verified basin routes without making up direct ocean flow. fish-habitat.oceanReach shares the live connected-ocean exit rule with major-waterworks-impact.history. For each recipient-owned foundingSource or outpostSource fish stock, the replay compares natural and candidate basin exports. Complete water-source rows include unchanged direct ocean arrivals and count total-flow intervals below 1,000 subunits. When exact sediment journeys also cover the window, basin and direct-source sediment join the same stock reach, and the candidate follows its own water crossings before counting the live turbidity rule (flow >= 1000, sediment at least 10 and sediment × 2000 at least flow). recipientWellExposure.coastalFish exposes only the holder's bounded stock list and distinguishes complete from older unknown intervals. For a stock with a recorded connected ocean crossing and a complete window, both branches apply the shared fish-habitat.nextCondition rule starting from present condition; the result includes conditional closing condition and daily recovery potential but never advances stock or predicts catches. test/basin-water.test.js, test/basin-sediment.test.js and test/major-waterworks-impact.test.js cover exact source custody, migration, crossing changes and privacy. See living world design and waterworks plan.

major-waterworks-impact.history now builds a recipient-scoped marshForage scenario from current charter cells that satisfy the live wetland-foraging filters: natural wetlands, unoccupied, undrained, observed wet habitat at condition 50 or higher. Only cells with a registered basin are compared; their bed is tested against each exactly replayed natural and candidate closing waterline. Each interval caps dry sites at two and reports 40 capacity and eight daily regrowth per site. The result includes changed-site and omitted-unregistered counts, but no other charter's cells or absolute basin receipts. It never edits food, habitat or water. City renders the conditional current-habitat scenario inside the incoming notice. test/major-waterworks-impact.test.js checks retention/release, charter privacy, drainage and habitat exclusion, and read-only state. This is not historical harvest, modeled wetland succession or a complete W2 ecology proof. See living world design.

knowledge.NODES.saddlery adds an army node requiring Animal husbandry and Textile crafts, with a staffed operational textile workshop as its research institution. The additive make-saddles alternative in production-recipes leaves the version-one default spin-yarn recipe intact for older saves. knowledge.cropRecipe requires both active Saddlery for the chosen batch and the workshop's existing Textile crafts service; the Supply chains projection lists both operating techniques. One full two-worker batch converts {cloth:8,timber:4,iron:2,tools:1} to {saddles:2} through normal daily production, storage and history. resources.RESOURCES recognizes whole equipment; transport-equipment.CARGO_WEIGHTS assigns two per saddle and feeds the existing logistics, outpost and player-trade weight maps. The existing whole-cargo validator rejects fractional saved saddles. Saddlery alone introduces no military state or horse ownership; the later riding course below provides individual fitting. test/saddlery.test.js exercises the actual flax-to-cloth chain, iron delivery, paid knowledge, blocked/active production, save restore and physical bilateral trade. See living world design.

riding-training adds a version-one ledger under state.ridingTraining with a matching logistics marker. Old saves with neither gain an empty ledger; a missing ledger with an active version-five husbandry job, a marker mismatch or invalid paid custody fails restoration. The new cavalry-training army node requires Animal husbandry, Field logistics and Saddlery plus staffed barracks research and an active specialist. TRAIN_RIDING_HORSE and CANCEL_RIDING_TRAINING are reviewed owner commands against the current home charter. Training reserves {saddles:1,feed:6} and one worker for a specific mature home horse in a cared enclosure. A husbandry-version-five job progresses on three fresh, ordinary paid-care days with condition at least 80, active specialists and enclosure service; the first day spends the saddle and every completed day spends two feed. The ledger records held, spent and returned supplies, trainer progress, fitting and qualification by stable animal ID. Refunds wait for whole warehouse capacity and cannot recover invested materials. Draft busy checks exclude the active horse from draft training, trips, breeding and relocation; qualification itself does not block later draft use. husbandry.projection exposes the owner-only course and qualification for City People. test/riding-training.test.js covers paid work, exclusivity, interruption, refund, old-save migration, invalid custody and deterministic replay. The separate militia rider drill above adds unit qualification; the mounted patrol and convoy escort above now add custody and field feed; their conditional contact advantages apply only after the separate rider drill and deployment. See living world design.

test/riding-training.test.js also contains a command-only journey through the real textile, import, timber, coin, livestock and army-institution gates. It uses the existing precision-saw producer and real pasture upkeep, retires used workshop/lodge plots in a seven-cell charter, and verifies that the manufactured saddle is the one removed by training. No test stock credit or mocked technique participates in that scenario; the smaller custody tests deliberately isolate the horse-course rules. See implementation status.

military-map.projection reads the authoritative saved militia and military-supply jobs, the charter's active defense survey and existing watch-post structures. It emits current positions and only the remaining outward or homeward slices of accepted routes; held and ready duties have no invented future path. cityProjection.militarySites is owner City data. The browser publishes it only when the City and world revisions match and the viewer owns the charter; the Military Region overlay separately checks owner and revision and yields to placement or another analytical view. It changes no job, population, stock, animal or save schema. See living world design and interface behavior.

START_PATROL accepts optional contactStance: "cautious"; absent means the established ordinary attack. The reviewed command still uses military.quotePatrol and pays identical food. The optional stance persists on the militia job only during that patrol and is validated against non-patrol duties at restore. In military.advance, just before the final occupied-camp step, current professional-service.power(..., 'field', campCellId) is compared with observed strength without firing archers' arrows. If lower, the unit remains at the prior route index, enters homeward, logs PatrolContactAvoided, and returns on normal feeding and movement checks. Otherwise existing contact resolves. Arrival home removes the stance. This introduces no new soldiers, animals, supplies or retroactive behavior; see living world design.

Current major-waterworks signature blockers

major-waterworks.projection keeps the generic candidate review, then reconciles the exact current noticed proposal's blocker list with easementStatus.complete and waterConsentStatus.allNamedSigned. The first requires all candidate construction cells covered by source charter or current exact recipient grants; the second requires a release-rule notice and a live source signature alongside every named recipient consent. They remove only construction-easements-unsigned and water-use-rights-unsigned, respectively. Drafts, withdrawn or superseded revisions, partial signatures keep the relevant warnings, and legacy release terms keep the water-right warning. The projection changes no ledger or water and leaves major-impact-model-unverified and all other screening blockers intact.

City-level construction crew capacity

work-crews.buildingSlots returns one by default, two for active Construction planning, and three only when that program and Regional institutions are both active at earned city or regional-capital stage. work-crews.schedule already reconciles running four-person jobs in accepted order against the current count, retaining remainingMs, workedMs, materials and FIFO position when excess work is queued. Its later queue pass starts only jobs with a slot and four free residents; no capacity or labor is persisted as a new grant. City projection exposes the derived count and ordinary wait reason. Town decline or either service loss removes the extra slot on the next scheduler check without deleting funded work.

Household relief meeting quote

The targeted logistics.quote returns rendezvous with the active journey ID, current shared hex, estimated caravan arrival from the current road segment and the journey's saved next movement check. The City review displays those values and City People links to Trade; neither read mutates state or promises arrival. The command still rechecks the active journey, route and supplies, while actual co-location is the only food-transfer condition.

Paid relief rendezvous and migration ledger v7

DISPATCH_CARAVAN optionally accepts householdJourneyId only for the relief offer. The command rechecks an active travelVersion: 3 journey for the same charter, its current interior hex on the quoted caravan route, and a not-yet-due household step before deducting stock and reserving two carriers. On each actual outward caravan step, after hazards and raid handling, population.deliverRelief compares the caravan's current route cell with that journey's saved current cell. At a match it moves the remaining cargo.food into rations or returnRations, records travelFoodReceived and a transfer relief receipt with job ID, time, cell and amount, and emits HouseholdReliefDelivered. On success the caravan changes to homeward at the shared hex, without visiting the depot. The targeted quote checks known fire and floodwater only through the meeting hex; the ordinary depot quote checks its whole route. If the target moves or finishes first, ordinary depot travel handles the remaining cargo and may encounter a later hazard. Caravan carrier feeding can consume cargo food before a meeting. Migration v6-to-v7 migration adds zero received food and empty receipt arrays only to older valid records; v7 restore checks food conservation against initial prepaid food plus actual receipts, validates receipt positions and times, and matches an active caravan's delivered metadata to its household receipt. No remote food credit, detour, illness or mortality rule is introduced.

Actionable migration-source food warning

population.summary computes source.departureFoodRequired as eight party meals times the actual surveyed route's minimum two-day walking length only when the four-person destination is otherwise eligible, migration is open, there is no active journey or source-population blocker, and the route has no known water/fire hazard. source.departureFoodShortfall compares that requirement with current migration.source.food; both fields are null when no ready route can be quoted. regional-overview.projection adds a private waystation-food attention issue for that City only when this exact source shortfall is the current dispatch blocker. The issue points to City Trade; the People card shows the same amount and a link to the existing relief caravan offer. The projection is pure and does not count offered or carried food as delivered. logistics credits migration.source.food only when a paid relief caravan physically reaches the depot, after which the issue naturally clears. No save schema, migration command, right or food source was added.

Finite waystation care after hungry household return

population.reachWaystation is the common completion path for physical return and source-hex turnback. It credits surviving residents, workers and unused provisions to migration.source; for travelVersion: 3 with travelFoodUnmet > 0, it then deducts min(source.food, journey.residents) and records the existing arrival receipt plus care: {mealsCompleted, mealProgress, nextAt, completedAt, deaths}. Two full survivor-sized meals are required. Each subsequent village-day check advances each outstanding cohort once from finite source.food; a partial serving persists as progress toward a meal, and zero stock leaves care pending. On the second full meal, HouseholdWaystationRecovered records release. availableAtWaystation subtracts resting survivors, workers and dependents from the source pool; the dispatch gate, age-known waystation worker selection and independent-career origin gate exclude them. An age-known adult's ordinary waystation old-age death updates source counts and records their birth key in the active care ledger, shrinking its survivor-sized meal and resting-worker counts; restore checks that this death belongs to the returned cohort. The private People projection exposes total, available and recovering source residents. Migration v7-to-v8 gives previously completed recovery receipts a completed care state, leaving existing populations, food and journeys unchanged. Restore validates care structure and rejects more resting people than source population. The older v5-to-v6 neutral recovery: null and v6-to-v7 relief migrations still apply. V1/v2 travel versions do not receive this care charge. No village-health, journey-death or new food source is inferred.

Current household travel exceptions

regional-overview.projection reads each included charter's one active migration.journeys entry after building its owner-scoped settlement row. For a stepwise journey (travelVersion >= 2), a nonempty blockReason produces an attention issue, and current rations + returnRations < residents produces an urgent food issue. The identifiers include the durable journey ID and the target opens that owner's City People section; details use the saved routeIndex, nextStepAt, current party size and actual remaining food. The generic issue renderer and regional forecast consume the same read model. A later daily movement or completed transfer removes the issue naturally; historical travelFoodUnmet alone is not a current warning. For v3, the low-food issue also names the six-hex hungry pace applied at the next check. The exception view itself adds no command, save field, derived stock, permission or migration timing; the v3 hungry pace described below changes later movement checks. A focused real-dispatch test covers a held outgoing leg, ration-depleted held return, owner/private reads, restore equivalence and clearing after physical arrival.

Household location and map City context

The City People location-only button has its own data-household-location action. It shares the route inspection pin with the full route shortcut and turns the Region route overlay off. The City target remains the journey's owner when a selected cell is on that saved route; an explicit City choice or an off-route cell clears the pin and hides the route layer. GonzCity.householdMapInspection() exposes only that settlement ID to the shared map status, which labels a different underlying region Household hex. A City response refreshes the pinned route or clears it after the journey ends. This is client navigation state, not a server claim or new permission.

Household route Region overlay

The City browser publishes the current people.journey route, index, next check and blocker to GonzWorld.setHouseholdRoute only from an owner City matching the public overview revision; the quote carries the charter owner ID. Region activation also checks the current connected player, world revision and either the selected charter or a selected hex on that exact route. The City controller temporarily pins the owner settlement while inspecting one of those route hexes, including a hex inside another mutable region; otherwise a City refresh would replace the owner quote with that region's projection. Explicit City selection clears the pin, and moving off the route uses ordinary selection. A stale, scoped or disconnected quote does not draw. The canvas traces route.slice(routeIndex), marks the first and last cells, and records overlay/current-cell data attributes for UI inspection. A People shortcut focuses the current route hex and selects the layer; map toggles keep it mutually exclusive with Managed land, Staffing, Resource sites and Institutions. Placement preview suppresses it. This is client presentation of saved travel state and adds no server command, save field, route permission or territory grant.

Reviewed incoming-household recall

RECALL_HOUSEHOLD targets the current charter cell and names one journeyId. The owner-only handler accepts only an active travelVersion: 3 incoming journey for that settlement and rejects a due movement check until the village has caught up. It applies the existing village migration policy with migrationOpen: false in the same transactional command, then calls the shared current-hex reversal used by the ration guard. The reversed route copies the original array, records its starting index and next check from the command time, preserves both food compartments and marks the transfer returning. At the source hex it closes the transfer immediately and credits only remaining food. Save validation and ordinary daily movement cover the return; no new ledger version is needed. The People review uses the current owner City revision, and current-leg progress subtracts startRouteIndex. Rejected or stale orders leave policy, travelers and provisions unchanged.

Stepwise household migration

population uses migration ledger v7, retaining the v5-to-v6 care receipt migration and adding the v6-to-v7 relief receipt migration described above. V1–v3 active journeys are tagged travelVersion: 1 and finish with their original timed arrival contract; v4 stepwise journeys retain travelVersion: 2 and its earlier food rule. Newly dispatched journeys use travelVersion: 3 with routeIndex, startRouteIndex, lastStepAt, nextStepAt, carried rations, reserved returnRations, travelFoodConsumed, travelFoodUnmet and blockReason. The existing canonical passable route is surveyed once, then copied into each journey so reversing one route cannot mutate the cached path for another dispatch. routeHazard checks recorded basin-exposure.cell and burning vegetation before automatic dispatch without deducting source people or food. Each village-day population.advance calls walkHousehold: v3 moves at most twelve adjacent hexes with a full party meal available at the start of the check and at most six when short, checking each next cell for water/fire. Outward v3 travel cannot spend reserved return food; v1/v2 accepted pacing remains unchanged. New outward journeys eat only from outward rations; before another day requiring a full party meal, an underfunded party reverses at its actual hex, retaining return rations. A party still on the source hex immediately rejoins the waystation. A returning party uses reserved food first, then any outward leftovers; a prolonged hazard can still create unmet meals. A blocked party retains its index and extends arrivesAt by a village day once the nominal ETA passes. On arrival, current admission is checked for survivors; refusal also resets progress on the reversed route. Remaining food is credited only at the reached endpoint, then hungry waystation returns take finite care stock. The City People projection exposes current hex, blocker, food, unmet meals and source stock. The browser renders current-leg progress and next movement from that owner City projection; Find household on map uses the existing data-city-map action to select route[routeIndex]. Restore validates route topology, maximum possible movement from the leg's starting index, timestamps, provision conservation and death receipt positions, including age-linked adults on a held or returning journey. Food exhaustion has no further mortality rule.

Basin exposure on survey crews and personal walking

expansion.quote checks the already chosen fixed survey route with basin-exposure.cell before command funding. expansion.advance checks the next route hex after the existing feed call, leaving routeIndex and actual crew position unchanged while blocked. If the survey-site hex is wet during the on-site phase, the job becomes homeward with no report; existing return movement and unloading still apply. careers.originOffers marks a locally recruited adult unavailable while the fixed path to the waystation contains known floodwater, so BEGIN_LANDLESS_CAREER does not remove a resident into a blocked route. careers.advanceJourney sets the existing waiting status at a wet next hex and retains its scheduled recheck. The independent daily meal check continues separately. These reads use current recorded exposure; neither module adds a water flag or changes saved journey versions. New population household journeys use the separate stepwise rule above.

Topic-filtered institution map

The owning cityProjection retains the authoritative institutionSites rows; city-interface.js forwards them with topic IDs, names and required institution names only when the same unscoped owner City revision matches the world overview. Each site's techniques[] now carries a per-topic reason from the same institutionCandidates result and current basin-exposure.structure check. The browser's institutionTopicId filters those rows for both canvas markers and accessible legend entries, and uses the selected technique's supportedHere/programActive flags for status. The technology-tree shortcut calls GonzWorld.showInstitutions(topicId) after focusing the City's anchor; generic access passes an empty topic ID to show all. An empty filter shows the required building name from the existing knowledge projection. This is local presentation state with no new command, save schema, learning, adoption, radius or authority.

Founding household timestamp and save repair

continuity.ensureFounder now passes settlement.charter.issuedAt to create, rather than calling the moving engine clock again after the charter exists. During load, continuity.initialize runs reconcileFounderClock before household-aging.valid: it repairs only four founding-source adults without joinedAt whose lifecycle start timestamps all equal one another, fall after charter issuance by no more than 60 seconds, and whose recorded lifecycle years match the charter-based elapsed time. The repair changes only those four startedAt values. Other lifecycle inconsistencies continue to fail restore validation. A moving-clock founding test covers immediate reload, the older drift shape and a corrupt date; the isolated browser QA village also reloaded from its saved state after the repair.

Authoritative institution sites on Region

knowledge.institutionSites maps actual standing structures to the topic definitions that name them as primary or alternative institutions. For each topic/site pair it uses institutionCandidates and current basin-exposure.structure to decide whether that precise site can support the topic now; the projection reports known and active-program flags separately from physical usability. cityProjection includes the rows for the owning City but omits them from the explicit production-steward projection; resident-member projection is separate. city-interface.js forwards only an unscoped owner City whose revision matches the world overview. game.js requires the same connected selected settlement and revision before drawing or enabling markers, suppresses the layer during construction preview and makes it exclusive with other analytical layers. The map is a read-only source locator. It neither models a service radius nor changes knowledge, workers, stock, permissions or saved state.

Recorded basin floodwater on funded civilian travel

husbandry.js, livestock-relocation.js, quarry-leases.js and regional-roads.js query basin-exposure.cell(engine, cellId) rather than saving a second water state. Their quotes reject known wet required route cells before stock, workers, coins or escrow change. At each due movement step, a wet interior next cell leaves routeIndex unchanged after ordinary provision accounting and exposes a blocker; drying permits the same job to resume. Husbandry also treats a wet enclosure anchor as unusable for purchase or admission, so a relocation may return when its destination floods. The quarry site projection names a flooded site; its crew withdraws before advancing the finite deposit or investing another quarter-tool. A regional road crew withdraws from a wet work edge before material investment; regional-roads.improved returns false while either edge endpoint is flooded, so actual road travel no longer receives its improvement. A dry edge can regain its benefit subject to condition and route eligibility. The existing job and exposure schemas remain unchanged. Other journey modules do not inherit this rule automatically.

Selected resource sites on the Region map

city-interface.js maps the current owner-only city.supplyChains projection to one browser quote for the selected resource. It emits a warehouse-anchor row only for positive local stock; one row per actual assigned recipe instance that outputs or inputs the resource; and rows for movements carrying or reserving that resource only when their present cellId is in the City's region. supply-chains.js copies a movement's route from its current index only for the settlement that owns the job; a receiving settlement's projection gets an empty route. The browser keeps the initial contiguous part inside its selected City region, starting at the movement's current hex. game.js draws that path as a dashed line beneath the current cargo marker; it does not draw off-region cells or grant route authority. The quote includes the existing resource balance's ready-output upper bound and separate assigned recipe and recurring household/service demand. No catalog-only recipe, off-region movement, projected import or undisclosed deposit is turned into a map marker. game.js requires a connected, equal-revision owner City quote matching the map-selected settlement before drawing or enabling Resource sites. A changed resource sends a local gonz:resource-flow-select event to rebuild the quote from the same City detail. An error or expired scoped appointment clears it. Canvas markers have corresponding text rows and inspected-hex buttons; the pointer-interactive legend defaults open on desktop and collapsed below 640px. Managed land, Staffing and Resource sites are mutually exclusive presentation modes and placement temporarily suppresses them. This creates no command, save data, destination credit or supply forecast.

Region worksite staffing overlay

On a successful gonz:city-response, city-interface.js forwards only the current owner City projection's non-cleared, staff-capable structures to GonzWorld.setWorksites. Each row contains the building anchor, stage, name, assigned staffing and catalog staff capacity. A charter requires matching settlement.ownerId and connected playerId; any scoped city.access excludes the layer. game.js requires connection, the selected Region settlement ID and equal City/overview revisions before enabling or drawing it. An error or expired role clears the quote; a newer overview hides stale markers until a matching City response arrives. The canvas draws colored anchor markers with assigned/capacity counts, and the DOM provides equivalent status text and inspected-hex buttons. The overlay is local presentation state, mutually exclusive with Managed land and Resource sites and suppressed during placement. It reads no hidden construction eligibility or another owner's structure list, changes no simulation or save state, and models no production guarantee or service radius.

Construction site comparison

The owner-only world-city-request accepts an optional siteDefinitionId alongside the selected plot and orientation. cityProjection checks authority and catalog identity before constructionSiteScan evaluates every managed region anchor with the existing constructionRequirements and constructionPlan rules. Each row returns a ready, conditional or blocked status and its first reason. Founding-only definitions and fixed charter prototypes return an empty row list with unavailableReason, while the Animal husbandry pasture gate remains conditional. This is a read-only quote: it does not reserve land, spend materials or disclose hidden deposits. city-interface.js refreshes the comparison with the City revision, definition and rotation; game.js renders the candidate anchors in Region and temporarily replaces Managed land shading during preview. The panel groups rows by status, retains each disclosure across refreshes and restores focus to an inspected hex control. The selected-site panel reads the same catalog entry for current discounted materials, capacity and baseline full-staff production; it uses quote.durationMs only when a full construction plan exists and lists every blockers[*].remedy. These values are an explanation, not a future production guarantee. The final reviewed construction command still checks authority, stock, footprint and revisions. Focused tests compare scan statuses with actual construction eligibility, preserve an unchanged snapshot, reject foreign City access and show two clients the same server rows.

City-owned World header inventory and treasury

city-interface.js is the only writer of the World header's food, timber, logs, iron, population and communal-coin figures. It uses a fresh owner City projection whose settlement ID and revision match the selected accessible overview before showing logistics.market.balance; that number is spendable communal coins, excluding the market's separate holds and carried payments. Food and population labels name the City providing those figures, including when the map selection is a different, inaccessible charter. Shared development has no coin ledger. The no-city and ended-resident branches clear stock and money; a restricted settlement clears private stock and treasury, except food explicitly present in a current scoped resident or production-steward projection. An offline or stale City never leaves a numeric treasury claim. game.js continues to render only the inspected hex's scoped #livingIndustryInventory, avoiding a later selected-hex update that could overwrite private header values. The change adds no command, save field or monetary mutation.

Region managed-land overlay

game.js draws the optional Region analytical layer from the already public overview.mutableRegions[].cellIds and matching public overview.settlements[]. A charter uses canManage to choose the owner's actionable-charter color versus another charter; settlements without a charter use the shared-development color. The renderer clips its iteration to the current camera extent and paints before dynamic structures, roads, crews and the selected perimeter. The toggle and legend are local browser state, synchronized with aria-pressed and hidden outside Region; a new overview requests a redraw only while the layer is active. The overlay neither queries private City detail nor persists or changes tenure, and its unshaded cells make no ownership claim.

Food consequence and caravan count in the City pulse

city-interface.js uses the current owner City projection's economy.foodBalance, economy.foodDemand, warehouse settlement.inventory.food, and economy.nextDayAt to describe a negative potential daily balance. It finds the first approximate check where starting food stock would be less than one full current daily demand after the potential net deficit from each preceding check: check one if stock is already lower than demand, otherwise floor((food - demand) / -foodBalance) + 2. This accounts for meals preceding new production but is neither a shortfall prediction nor a simulation of foraging, grain, changed work or cargo. It does not advance the clock or create a forecast ledger. The Waystation caravans pulse filters logistics.caravans by absence of peerContractId; the latter jobs are peer trade, although both types share the transport projection.

Unique inbound cargo projection for the map City card

city-interface.js derives the bounded owner-only disclosure from a fresh City projection. It includes positive material cargo only when an outpost supply journey, waystation caravan, bilateral trade journey or recurring agreement's current journey is heading toward the viewed settlement. The logistics.caravans projection contains all transport-version caravans, including peer trade, so the waystation branch excludes peerContractId jobs. Bilateral tradeContracts.contracts excludes schedule child contracts, while tradeSchedules.agreements[].journey supplies those children; the two trade branches cannot count the same job. Governor- and mandate-funded deliveries use outpost role: supply and need no extra branch. No ledger, migration or command changes; carried coins, other routes and unloaded stock are outside this disclosure.

Scale-aware map City card and selected footprint

The owner #cityOverlay marks itself data-map-compact=true on Global until its local detail toggle is opened; CSS hides the deeper pulse rows, priorities, work disclosure and secondary commands while retaining workers, food, Open City and map/detail controls. Its map-scale state resets when the accessible settlement changes or the role branch changes, and a gonz:world-state map-view transition re-renders it without another City request. Locate on map uses the authoritative mutable-region anchor through the existing GonzWorld.focusCell path. In Region, game.js derives outside edges from the exact selectedLivingRegion().cellIds and strokes only that perimeter, with a label in the map context only when a settlement is selected there. The outline has no authority effect and does not claim influence beyond those cells.

Dated communal treasury pulse

coin-market.js adds a dailyHistoryVersion capability to the existing version-one monetary ledger. On migration it records the present spendable balance as an opening checkpoint and no historical entries. Founding and outpost establishment open new charter histories; founding.advanceNeeds appends a balance after each completed community day, retaining eight dated checks and rolling the oldest into the checkpoint. Restore validates settlement scope, money and strictly increasing dates. The owner logistics.market.dailyTrend compares the last check with its predecessor or the opening. Current balance remains authoritative and may have changed since the last check; held and carried money remains in its existing separate ledgers. The map shows that delta only with a fresh owner City revision, along with economy.stored / capacity. Trade shows the comparison dates and balances. The first post-migration interval may be shorter than one full village day. This history is a bounded trend, not an event-by-event financial audit.

Actionable City pulse and inbound custody summary

The owner-only city-interface.js overlay turns current pulse metrics into section links and derives its bounded work disclosure from the same fresh City projection. Local structural and land jobs come from city.jobs. Inbound rows require positive carried cargo and the direction that approaches the viewed community: outpost supply outward to the viewed outpost or homeward to its home, a homeward waystation caravan, or a bilateral or recurring trade journey outward to the recipient or homeward to the sender. Route blockers and dueAt are rendered as next-check evidence, never as guaranteed arrival or available warehouse balance. Four rows render at most, with a total count and explicit omissions. The restricted-role branch returns before this summary and no new state is persisted.

City-scoped map overlay and job count

game.js no longer writes the global overview.activeJobs into the map's Orders badge. city-interface.js resets that badge to unknown on each sidebar render and fills it from city.jobs.length only when the City projection matches the current overview revision and the socket is connected. Restricted and ended resident branches never expose that owner job list. The owner overlay uses the same current projection's economy.housing, foodDaysWithoutProduction, foodBalance, jobs, logistics.caravans and existing insights() reasons. Until matching detail arrives, it shows only the overview's available settlement summary and a refresh notice; shared development keeps unmodelled economy measures explicit. The expanded card scrolls independently so the Overview and Orders tabs remain reachable. The earlier job-count correction itself required no persisted ledger or command.

Live map shell and City sidebar state

GonzWorld.snapshot() exposes the server-acknowledged player name alongside connection, selected settlement and overview state. gameplay-interface.js uses that snapshot for the shared map status in •••; its local rehearsal state remains confined to concept screens. The initial HTML contains neutral loading text and no sample shortage, weather, influence, stock or job records. city-interface.js replaces the sidebar from an accessible City projection, shows an explicit no-city state when none is available, and clears job rows on resident continuation or restricted production access so earlier private rows cannot persist. Connection loss retains the last known settlement projection only where City labels it as such; order submission remains gated on a live connection.

Major-reservoir release counterrequest custody

Ledger version seven extends each notice response with nullable requestedReleasePercent. A current named human recipient may supply the other supported 25 or 50 rate when decision: object and ground: downstream-flow, provided it differs from the exact notice's terms.releasePercent. A version-four notice with no rate may receive either downstream-flow request. A flood-exposure objection may request 25 only against an exact 50% notice. Other objections and acknowledgments store null. RESPOND_MAJOR_WATERWORKS_NOTICE remains once per recipient and revision under the same lawful-character and owner checks. Source and recipient projections carry the request with the frozen response; City shows it in the objection review and response history. Migration from version six adds null to each old response, after earlier migrations. Restore validates response shape, responder custody, chronology, allowed rate and ground-specific scope; it rejects an unsupported or forged request. An amendment leaves old notice actions unchanged, and new notice/consent is required. The request does not mutate the proposal, water or construction ledgers.

Selectable major-reservoir release rule

Version-five exact terms now accept releasePercent 25 or 50; omission on a new draft defaults to 25, while omission on an amendment keeps that proposal's existing rate. environmentalBypassPercent remains 25. major-waterworks-impact.history admits 0 for legacy/no-release comparison and 25 or 50 for selected releases, using integer-ceil of opening hypothetical stored water before new arrival. Source projection computes both bounded replays per candidate capacity; the chosen City draft includes its rate in the command payload and review. Current proposal review and recipient notice exposure use the saved exact rate, not a default. A changed rate increments the proposal revision, leaving frozen old notices and responses untouched. New notice and communal consent bind to that revision. Restore regenerates terms with the saved allowed rate and rejects unsupported or altered notice values. No ledger migration or real-water mutation occurs; full reach, rights and construction gates remain open.

Major-reservoir objection-ground custody

Ledger version six extends each notice response with ground. RESPOND_MAJOR_WATERWORKS_NOTICE requires exactly one of downstream-flow, flood-exposure, existing-land-use or evidence-gap for an object answer; acknowledge records null. The answer still requires a named current human holder, lawful character and active exact revision, and is accepted only once. Source and recipient projections expose the ground with that revision's response; City displays it alongside the decision and in the review confirmation. Migration from ledger version five adds null to old responses, meaning no historical reason was recorded. Earlier version migrations run before it. Restore checks the current eight-field response shape, actor and party custody, chronology and known grounds; null remains valid for historical objections. No impact, easement, water-consent, construction or stock ledger is changed by responding. The ground is review evidence and does not encode approval or a veto.

Recipient-scoped major-reservoir basin-flow differences

In major-waterworks-impact.history, a current notice recipient's charter cells are intersected with current registered basinWater.nodes catchments. After each natural interval reproduces its saved balances and exact routes, the proposed branch applies the frozen notice terms. For each intersecting basin, both branches accumulate runoff + incoming across the verified window and retain their last closing storage; the public recipient object subtracts natural from proposed and exposes only safe-integer arrivalChange and closingChange with basinId, plus reducedTicks, largestReduction/largestReductionTick and largestIncrease/largestIncreaseTick. The extrema come from each interval's proposed-minus-natural runoff + incoming, with zero and null when no such interval exists. Any per-interval difference also puts a row in the changed-first group even when net arrivals cancel. Changed rows sort first, then basin ID; at most sixteen are returned with total/omitted counts. Absolute observed/proposed amounts remain internal and are not projected to the recipient. Unregistered basins, ocean/unresolved destinations, water rights and useful delivery are not inferred from a zero or absent row. The calculation is read-only and leaves water and saved notices unchanged.

Conditional major-reservoir building-condition replay

After exact natural route and balance verification, major-waterworks-impact.history keeps separate current-condition maps for the viewing community only for the natural and proposed branches. The structurePressure pass uses current operational/damaged footprints and flood-damage.rate to supply each interval's depth rate. Each branch spends min(remaining condition, rate) on each selected structure, accumulates finite loss, and records a structure as ruined once it reaches zero; later ticks cannot spend it again. The result retains per-tick and window loss/ruin counts beside the prior uncapped pressure totals. No applyDamage, flood receipt, service reconciliation, warehouse debit or construction change runs. Today's condition and footprint are deliberately placed at the start of old recorded forcing; no repairs, other hazards or historical structure dates are replayed. This is conditional impact evidence, not a live operation or rights gate.

Recipient-scoped major-reservoir land, well and building comparison

For a current notice only, major-waterworks.projection invokes major-waterworks-impact.history with the frozen notice terms, their release percentage or zero for a legacy notice, and the viewing recipient's settlement ID. Natural balances and exact route rows must still replay before any result is returned. The changed-land sets are intersected with the viewing community's current charter and bounded to 64 exact map cells per direction. The existing current-center/camp footprint check accumulates wet connection-intervals, distinct changed structure IDs internally and per-tick counts only where structure.settlementId matches that recipient. Projection exposes only own changed-land counts/cells, well counts and own-building condition/ruin totals, or a reason; it never returns the replay's broader land, route, structure or foreign water details to the recipient. Superseded notices receive no new effect projection. The computation is read-only and does not change consent, water, building condition or household allocation. Its use of today's structures against retained weather limits historical and future claims.

Major-reservoir current well-connection exposure

After each major-waterworks-impact.history interval passes exact natural balance and route verification, its standing-structure pressure pass also identifies operational village-center and outpost-camp footprints with condition at least 50. This matches land.sourceCapacity's live structure eligibility, but uses each replay branch's closing basin level rather than live basin-exposure. A positive depth on any footprint cell counts one wet connection-interval; each distinct structure whose natural and proposed wet status differs is counted once for the window. The same computation runs for no-release and controlled-release branches. The result contains only aggregate counts and per-tick counts, without names or private foreign water. It changes no live water, household allocation, structure condition or legal gate. Current centers are being tested against recorded forcing, so the figures do not establish past service or future delivery.

Exact-term major-waterworks water consent

Version five adds releasePercent to new major-reservoir draft and notice terms, chosen as 25 or 50 alongside selected capacity and a 25% or 50% environmental bypass. The controlled-release replay uses that proposed release share: integer-ceil of the selected share of opening hypothetical stored water each interval. Restore keeps migrated version-four proposal/notice terms and existing signatures without adding this field; a legacy notice cannot receive a new water-consent grant or be refiled until the source explicitly amends, increments its revision and files a new version-five notice. Historical notices remain unchanged after amendment. A new consent grant therefore has exact capacity, bypass and release scope, while an older recipient signature retains capacity-and-bypass-only scope. Neither scope moves live water or satisfies all-party rights, full impacts or physical operation.

Version four added waterConsentActions to each frozen notice, migrating version-three notices to an empty array; version-one/two migration remains sequential and invents no signatures. GRANT_MAJOR_WATERWORKS_WATER_CONSENT checks an active exact version-five revision and a lawful active character. The source can sign only its own continuing water use after filing notice; a named human recipient must first record acknowledge before signing its own right. Neither can sign for the other. Withdrawal requires a current grant and current community authority; a later grant may follow. Each action stores {settlementId, ownerId, characterId, kind, at} with an eight-per-community bound. Restore validates identity, chronological order, grant/withdraw sequence, recipient response precedence and unchanged notice terms. Source projection summarizes its own signature and current named-recipient coverage; recipient projection gates separate grant/withdraw controls. An amended or withdrawn proposal has no actionable old consent, and a changed owner does not count a prior holder's grant as current. Existing version-nine saves remain valid with no source signature invented; an old noticed revision can gain one only through a new lawful command inside its still-open window. Commands touch no basin, stock or land ledger. New consent is scoped to noticed capacity, bypass and release, while live operation, unidentified/NPC parties, complete impact evidence and W4 construction remain separate blockers.

Retained-window land exposure comparison

After each natural interval exactly reproduces its saved basin samples and route row, major-waterworks-impact.history applies the live basin-exposure land threshold to natural and proposed closing water in every basin with different storage. It uses H.level(metadata, storage + current sediment displacement) for nonempty pools, ceil(elevation * HEIGHT_SCALE) for each catchment land bed, and excludes lake and ocean cells. The pure comparison returns per-tick newly wet/dry counts plus distinct cell counts and at most 64 sorted IDs in each direction for City map links. The list cap is disclosure/UI bounded; counts include all modelled changed cells. A changed current sediment bed can invalidate natural historical replay before exposure is published. Neither branch edits live exposure, structures or households; unregistered basin reaches and temporal damage remain outside this result. A controlled enclosed-basin test checks no-release and release waterlines and read purity.

Before returning a verified scenario, the full changed-cell sets intersect e.mutableRegions to count current named charter holders and uncovered cells. They also intersect all uncleared structure footprints, improved land.plots and active non-compost land jobs, counted once per direction. Only aggregate use counts enter the owner projection; individual foreign work, stocks and inventories are not returned. For each current operational/damaged structure, structurePressure checks its deepest modelled wet footprint cell against all registered basin levels in both branches and calls the same flood-damage.rate used by live damage. Per-tick and window totals report exposed structure-intervals and condition-uncapped rate points; only a distinct changed-structure count is disclosed. This uses today's buildings with historical runoff, so it cannot establish historical or future actual loss or authorization. The separate viewer-scoped scenario above estimates finite condition loss and ruin only if today's buildings faced the recorded window without repairs.

Recorded-window controlled-release branch

major-waterworks-impact.history(e, terms, 25) uses the same exact-route-verified natural replay as the no-release branch. For each tick it integer-ceils one quarter of opening hypothetical held water as requested release. Without a selected outlet, the older scenario adds that water directly to the source basin after new runoff intake. With a selected exact outlet, the request is capped by opening water above the receiver-head floor, and only the achievable hypothetical release enters the distinct receiving basin before natural loss and routing. Neither branch counts release as a new source arrival for bypass. Remaining capacity can take new arrivals, with at least an integer-ceiled quarter of those arrivals passing. Global mass checks include opening held water and all natural storage, losses and exports. Per-tick and window totals include requested, released and unmet water, capture, pass and closing held amount; selected capacity variants and active source proposals recompute the owner-only comparison. Unsupported release percentages and unverifiable natural histories return a reason. This is a pure historical scenario; it changes no live basin state or legal gate. Controlled dry-interval and paid-station tests verify release timing, downstream crossing, conservation, projection and restore equality.

Verified retained-window major-reservoir branch

major-waterworks-impact.history takes at most twenty consecutive basinWater.routeWindow rows from the monitored source node's recorded lifetime. Starting from the first row's saved opening water, it reconstructs each registered basin's local runoff and runs the pure basin loss/reciprocal-spill model. Every natural node's opening, runoff, incoming, outgoing, losses, exports and closing amount must match its saved sample, and the aggregated directed route row must match exactly; the latest settled flag is also checked. Only then does the candidate step run from its own preceding natural-pool storage and a separate carried reservoir amount. It may intercept source arrivals up to remaining selected capacity while passing at least integer-ceiled 25% of each interval's arrival into natural storage. Each step proves global conservation, including carried reservoir water. The result retains bounded per-tick values and aggregated changed crossings; no live ledger is mutated. A current sediment geometry that cannot reproduce earlier rows, an old migrated save with no route rows, or any forged mismatch yields a reason without impact numbers. Selected capacity variants and active source drafts recompute this owner-only projection; other monitored-site summaries omit the expensive replay. The default branch has no release; the separate controlled-release branch above adds a hypothetical discharge. Neither branch has a live delivery, future-rain, habitat or rights effect, and major-project approval remains blocked. Controlled and paid tests cover wet/dry carryover, reciprocal and ocean routes, twenty-tick truncation, old-save checkpoint, purity and restoration.

Verified single-interval major-reservoir branch

major-waterworks-impact.replay reconstructs the latest basinWater interval from each node's opening and recorded local runoff, then runs a pure copy of the current basin loss and bounded routing rules. It compares every simulated node field, exact transfer/export row and settled status with the conserved save. A missing latest route row, differing current sediment/geometry, or any mismatch returns a reason and no impact numbers. The candidate starts the same natural water, intercepts source-basin runoff and incoming transfers into an initially empty capacity-limited store, and uses cumulative integer-ceiled selected 25% or 50% bypass before natural storage. Both simulated branches check global water conservation. The result includes arrival, capture, pass/bypass, changed exact route amounts, changed basin IDs and bounded-settlement status; it contains no foreign inventories, usable water, release or rights. major-waterworks.review adds it only as a current read-only projection, recomputes selected capacity variants and active source drafts, and does not use it in the approval gate. Controlled lake/ocean and reciprocal-basin tests, plus a real paid-station scenario, verify route changes, refusal on mismatch, read purity and save restoration. This is a one-interval branch under recorded forcing, not a multi-interval operating or ecological model.

Conserved source-boundary routes in major-reservoir review

major-waterworks.sourceBoundaryRoutes reads the selected source basin's cumulative outgoing basinWater.transfers keys and version-two exact exports, returning sorted receiving-basin destinations and ocean/unresolved crossing cells with their conserved amounts. It ignores incoming transfers. The result includes node createdTick, ledger lastTick, an exact-route total, and legacyExports as a separate unlocated ocean/unresolved pair; migration never assigns old totals to an exact route. review recomputes this owner-facing evidence for selectable capacities and current active proposals without mutating the basin ledger. City labels the cumulative window independently from the last-twenty-sample retention bound. A paid monitored basin test checks real outgoing transfer custody and restored replay; a separate legacy test checks inbound exclusion and unlocated history. The cumulative listing itself does not distribute hypothetical water; the separate verified replay branches above compare changed crossings under recorded forcing, without following every recipient to the open world or granting operating authority.

basinWater.version === 3 adds {routeWindow:{startTick,rows}}. Each advance aggregates the actual directed transfer and exact ocean/unresolved export crossings by endpoint for that tick, stores an empty row when there are no exits, and trims to twenty rows. Restore requires consecutive ending ticks, sorted unique positive endpoints, recent per-edge totals no greater than cumulative custody, and exact equality between each row's incoming/outgoing/export sums and the corresponding source and recipient node samples. If the window still contains every interval since first registration, its per-edge totals must equal cumulative custody exactly. Version-one/two migration sets startTick to the old lastTick and starts with no rows; previous cumulative custody remains intact. sourceBoundaryRoutes.recentRows filters this bounded window to the selected node's lifetime and excludes incoming transfers from the owner-facing source list. These observed routes carry no hypothetical reservoir volume.

Owner-only major-reservoir source-plot comparison

major-waterworks.projection enumerates installed gauges with settlementId equal to the viewed charter, sorts the selected cell first and cell IDs thereafter, and bounds the returned summary to sixteen entries with an omitted count. Each entry calls the existing authoritative paid evidence/review path at the largest catalog-allowed capacity within its natural saddle; failed publication, lost title or unsuitable geometry returns reason. Successful entries contain report and basin IDs, current source-cell terms, capacity, screened land count, built-site and land-work conflict counts and blocker codes, without foreign live balances or inventories. Reusing one selected review avoids a redundant calculation. The list and map focus are read-only and do not register surface cells, advance water, record notices or amend proposals. A paid two-station test checks distinct reports over one conserved basin, selection order, state purity and save restoration.

Major-reservoir paid land-work intersections

major-waterworks.storageScreen constructs the exact source, pool and spill-endpoint cell set from proposal terms. It intersects that set with state.land.plots only when one of soil, irrigation, headworks, terrace, drainage or road exists; a survey-only record is excluded. It separately intersects non-compost landVersion === 1 jobs through cellId or outletCellId. Sorted improvedConstructionSites and pendingLandProjects include holder IDs, cells, kinds and job status but no foreign inventory or staffing. Either set adds candidate-land-works-unresolved in review, independent of the current structure-occupancy blocker and easement status. The read changes no project, water or resource ledger; normal retirement and paid work remain authoritative. A paid small-irrigation project on a real candidate crossing verifies pending, completed, restored and retired states without inventing an improvement or clearing the existing food plot.

Read-only major-reservoir retention bound

major-waterworks.retentionBound consumes the owned basin node's already validated recent samples, never the proposal's hypothetical water. Per sample, known arrival is runoff + incoming, minimum bypass is ceil(arrival × 25 / 100) using integer arithmetic, captured water is the smaller of remaining selected capacity and arrival after bypass, and passed water is arrival minus capture. Every hypothetical row satisfies opening + arrival = closing + passed, with no delivery, evaporation or infiltration in this scenario. The result contains up to twenty dated tick rows and cumulative inflow, bypass, capture, passed and closing totals. An observed account validates the real sample's opening + arrival = closing + outgoing + ocean + unresolved + evaporation + infiltration and aggregates each receipt type across the same rows; it is not subtracted from the hypothetical passed volume because existing natural storage and losses differ. Empty samples produce zero evidence. Candidate capacity changes recompute the bound; active source proposals get a fresh current review. It is not persisted in the water or proposal ledger, so reads and forecasts cannot grant water. It is an optimistic upper bound from known arrivals beside a current-service reference; the separate verified replay branches above provide bounded engineered-versus-natural crossing comparisons; incomplete rainfall, existing pool storage, release rules, ecology and rights stay explicit blockers.

Major-reservoir candidate-cell easements

Version three adds easementActions to each notice. Current exact construction cells include any selected natural-route alignment in addition to the source plot, candidate pool and spill-crossing endpoints. Each named holder acknowledges the exact revision before granting the complete sorted intersection with its present charter; withdrawal remains separate. An amendment makes older grants historical. A signed easement does not resolve hydraulic design, water use, impacts or construction.

Major-reservoir design-capacity screen

major-waterworks.storageScreen uses basin-water.metadata and level with the selected capacity in integer water subunits. For every complete source-catchment cell, a non-lake/ocean land bed below that modelled dry-bed waterline enters a sorted read-only set. Intersections with the candidate saddle poolCells and immutable natural features produce the outside-footprint and feature subsets. The function reads basin-exposure.forBasin and returns sorted observedWetCells, candidateOnlyCells and observedOnlyCells; these are set differences against the current water-boundary exposure, not a counterfactual flood outcome. It also intersects constructionCells (source, candidate pool and spill endpoints) with every non-cleared structure footprint, returning current structure ID, holder, name, stage and intersecting cells. This includes ruins and unfinished works, without exposing foreign inventory or staffing; candidate-construction-site-occupied remains an independent approval blocker until a structure is cleared. screenedClaims intersects the capacity set with current public mutable-region cells and counts still-unassigned screened land; it does not infer vacant tenure. review derives each selectable capacity and adds candidate-storage-footprint-unresolved when the storage model wets land beyond the recorded candidate footprint. The City capacity selector switches among those distinct reviews; outgoing and incoming notice projections recompute the screen from each frozen revision's terms against current exposure and occupancy, while a recipient's current charter intersection is identified separately from the historical party snapshot. The result is not saved as a physical water balance, has no side effects on conserved storage or structures and does not resolve displaced use, downstream flow, sediment, ecology, rights or project operation.

Major-reservoir notice and response custody

noticeCurrency compares the current revision's pinned reportId and sorted {settlementId, ownerId} party snapshot with a fresh bounded review of the source terms. The same inland/coastal party merge used at filing is used for this comparison; a newer report, unavailable candidate evidence or changed party/holder list returns an amendment-required reason. respond and new easement/water-consent grants reject stale notices. Withdrawals remain possible. Source signature status accepts a notice only when it is both inside reviewUntilAt and current by this comparison; the source projection exposes the blocker and the incoming recipient projection closes action controls with noticeIssue. This is a live currency check on the modelled party envelope, not evidence that the envelope contains every affected user.

Version eight adds reviewUntilAt to each notice. New filings set it to issuedAt + 14 * source.economy.dayMs; commands accept recipient answers and new easement/water-consent grants only while engine.now() < reviewUntilAt. Existing grants can be withdrawn after closure, but easementStatus and waterConsentStatus cease counting them toward live source blockers. Source and incoming projections expose the deadline and open flag. Version-seven migration marks every earlier notice with a null deadline, preserving recorded actions as closed history without fabricating an old review period; a source amendment and re-filing creates a new bounded revision. Restore checks the exact non-null deadline, rejects answers and new grants at or after it, and permits later withdrawals. This is procedural W3 progress, separate from impact verification and physical work.

The version-nine majorWaterworks ledger retains each proposal's chronological notices by proposal revision. FILE_MAJOR_WATERWORKS_NOTICE requires the lawful source owner and the exact active draft revision, then snapshots its proposal terms, paid survey ID and currently identified inland and nearby coastal public settlement IDs and owners. The party union also includes current charter holders of the exact source, pool and both spill-crossing endpoint cells, even if their cells are dry under the storage screen and recorded release replay. This lets a construction-only holder acknowledge and grant its separately reviewed exact-cell easement. Party currency is recomputed against current charter holders before further signatures. All referenced notice reports stay pinned while their proposal remains in history. Open frontiers and NPC holders remain visible; notice never changes their rights. RESPOND_MAJOR_WATERWORKS_NOTICE requires a named, currently owned human recipient with its own lawful character and the exact active revision. A recipient can record one acknowledge decision or an object decision with a stated ground, actor, character and time; this reply is review evidence, not itself a construction easement or water-use signature. Amendment increments the proposal revision, retains prior notices, replies and easement actions as history, and returns it to draft so a new notice must be filed. A recipient's read-only history exposes old terms and answers as superseded, with no action on those revisions. Withdrawal ends the active review; the ledger keeps the twenty most recent withdrawn proposals and never reuses their IDs. Version-one drafts migrate through version two with an empty notice list; version-two notices migrate with empty easement actions. Validation rejects missing marked state, duplicate or out-of-order revisions, malformed party snapshots or terms, fabricated responders and impossible dates. City exposes source proposals and recipient notices without private foreign water or inventory. No water or material ledger is touched by notice or easement review.

Versioned major-reservoir drafts

major-waterworks.js owns state.majorWaterworks = {version: 18, nextId, proposals} and land.majorWaterworksVersion = 18; older saves receive an empty marked ledger and version-one drafts migrate without notices. Version-four records keep their original terms and record version until amended. DRAFT_MAJOR_WATERWORKS requires normal settlement authority, an active Hydraulic engineering service and living public character, a returned paid survey and a monitored basin with candidate saddle footprint. Its capacity must be one of 10,000, 25,000 or 50,000 water subunits and no larger than the candidate basin-water.volumeAt below the spill sill. A new record stores the observation plot, basin terminal, exact candidate footprint and sorted spill crossings, selected 25% or 50% bypass and selected 25% or 50% opening-store release, report ID, character, revision and timestamps. A second active proposal is rejected; amendment increments its revision, while withdrawal preserves history. The referenced source report is pinned from survey-history trimming even when a newer report replaces the current one; that newer report requires an amended draft before a notice may be filed. Restore validates marker, record ID, original report, owner/character, clocks and regenerated immutable geometry; malformed terms fail closed. Read-only City projection recomputes current possible public communities, unassigned cells, feature sites and open natural, engineered, coastal, easement, water-use and impact-model blockers. The ledger is deliberately outside the conserved water and construction-job ledgers: it has no funding, operation or complete water right yet; only the separate candidate-cell easements and exact-term recipient water consents above can be signed.

Coastal fish response to conserved sediment

fish-habitat.capture records both water and sediment totals for the same nearby basin-to-ocean crossings and direct ocean-bound sources before a surface interval. surface-water.advance settles basin sediment before the fish response. The difference from the capture gives the current interval's water and soil mass without replaying historical exports or double-counting a basin and a direct source. A valid load cannot exceed floor(flow / 100) mass units. At least 1,000 water subunits and no high load increase shoal condition by five; at least ten mass units with sediment × 2,000 >= flow instead decrease it by ten. A dry recorded interval decreases it by ten. Stock recovery through this boundary uses its previous habitat condition; only later recovery uses the new one. The version-two habitat receipt adds lastSediment to the prior condition, flow and timestamp. Version-one receipts migrate with zero historical sediment; malformed or impossible new mass fails restore. City and private source forecasts expose the same last observations. Unknown or distant coasts are not assigned a dry or turbid observation.

Basin sediment custody and displaced water level

basin-sediment.js owns state.basinSediment = {version: 1, startTick, lastTick, sources, nodes, transfers, exports} and land.basinSedimentVersion = 1. Migration checkpoints each existing sediment.exports source total as an offset and creates no basin deposit. During a later surface boundary, basin-water.advance returns its exact ordered source/transfer/export water events; the surface sediment ledger returns only its newly exported mass. The basin sediment ledger assigns that mass to the same source destination, then moves up to floor(water-event subunits / 100) bed units on each recorded basin transfer or final export. Basin evaporation/infiltration are water-only losses. Nodes keep cumulative runoff/incoming/outgoing/ocean/unresolved and bed, plus twenty chronological interval balances. Restore checks marker, clocks, source offsets, water-concentration bounds, basin/edge custody, exact mass balance and retained receipts. A duplicate boundary is inert.

basin-water.effectiveVolume adds min(50,000, basinSediment.bed × 2) subunits when nonzero water is present. Existing level, spill, backwater and flood exposure calculations use that displaced volume while water storage and every water balance retain their original conserved units. New deposits affect following interval routing; current private level/exposure reflects the bed already present. basin-water.projection and owner forecasts expose the same basin sediment record, with no foreign live balance. This does not model coastal sediment fate, species-specific water quality, unregistered runoff or complete major-project effects, so W2 remains partial and W3 rights are not granted.

Conserved sediment on registered surface edges

sediment.js owns state.sediment = {version: 1, startTick, lastTick, cells, transfers, exports} and land.sedimentVersion = 1. Initialization checkpoints the processed surfaceWater.ticks on old saves without generating past mass; a marked missing ledger or invalid clock rejects. topsoil.advance returns only actual quality-loss points for the current interval. Each point becomes 100 abstract mass units. After water allocations are fixed, sediment visits the same strictly descending registered cells: opening bed plus new source plus incoming mass equals new bed plus transferred or boundary-exported mass. Carry capacity is floor(discharge / 100) mass units, halved for natural wetlands. A split route assigns carried mass proportional to water, with the last leg receiving the integer remainder. Missing receivers and ocean/closed exits become retained cumulative boundary exports; later cell registration cannot reclaim them.

Per-cell cumulative generated/incoming/outgoing/boundary and retained bed reconcile with edge totals, source topsoil loss and at most twenty chronological receipts. Restore checks schema, route geometry, source registration, current-water cumulative outflow bounds, split arithmetic and mass balance. wetland-ecology.capacity subtracts min(floor(unsilted capacity / 2), bed × 2) from the next surface-water interval's limit; the water itself still passes through the ordinary conserved solver. Project drainage previews and City/forecast projections use that same current deposit. No warehouse soil or changed generated elevation is implied; the separate basin ledger above carries only accounted mass, while complete coast routes and species-specific responses remain open. This is a bounded W2 coupling, not W3 permission.

Cultivated topsoil from measured runoff

topsoil.js owns state.topsoil = {version: 2, startTick, lastTick, cells} and land.topsoilVersion = 2. surface-water.advance applies it to its conserved interval map before completed-work erosion can weaken terrace condition. Older saves checkpoint the processed water tick with no retrospective loss; version-one records migrate with treated:0 and unchanged quality. Only a surveyed plot whose soil work was completed by the interval start and whose source cell is registered participates in water-driven changes. The selected route is the same natural or sound local-drainage target used for that interval's discharge. Fall is the nonnegative difference between upward-rounded millionth elevations. Loss is min(4, floor(discharge/8000), floor(fall/2000)), halved and rounded up for fallow or a sound pre-existing terrace, limited by quality remaining. Every sixth low-flow boundary, a fallow plot below 100 recovers one point if it did not lose quality at that boundary. The separately paid Agronomy restoration above records its bounded gain at project completion.

Each affected cell stores 0–100 quality, cumulative loss/recovery/count and its last twenty chronological before/after receipts. Restore checks marker/schema, processed ticks, surveyed/registered source, actual cumulative outflow upper bound, immutable route/fall, formula and totals. land.effective subtracts (100-quality)/500 from the fertility bonus used by crop recipes, so forecasts and ordinary production agree. land.quote applies the same penalty to completed-project food previews. production-history accepts recorded historical field factors from 0.8–1.25 and still checks exact output against the saved factor; old 1, 1.1, 1.15 and 1.25 receipts remain valid. The City projection exposes only the owner's selected surveyed plot, and the private forecast includes owned plot records. Water balances, generated elevation and warehouse inventory are unchanged; the separate sediment ledger above carries only newly lost topsoil mass along registered surface edges.

population.initializeVillage migrates version-one people to version two with floodInjury: {version: 1, last: null}; version-two saves require a valid last receipt and cannot erase it by dropping the field. At each existing village-day check, flood-health.assess examines sound operational housing footprints through basin-exposure.structure. It counts flooded housing places, the deepest recorded depth, and the residents still without dry permanent places after refuge.advance has spent actual nightly firewood. Exposed count is bounded by both the unsheltered count and flooded places; hazard is one step per 0.001 depth, capped at five, times exposed/population. population.advance applies the rounded debit after ordinary needs, care and festival results and above health 20. The last receipt stores the check time, population, exposed count, depth step and actual health loss; validation bounds loss by the possible pressure. No new water, warehouse withdrawal or population death occurs. City People and private forecasts read this same record; unrecorded terrain and plain building damage give no flood injury.

fish-habitat samples only new basinWater.exports ocean receipts and basinWater.sources[*].ocean direct-source receipts after each conserved surface interval. These classes partition water. A crossing or source can be a shore plot; the prior bounded downhill endpoint remains authoritative for existing habitat saves, and the bounded basin routing trace adds flat/lake paths when no downhill ocean endpoint exists. Either path must reach the ocean within 32 cells; only fish stocks within four connected ocean hexes qualify. The pre-interval amounts are captured before basin-water.advance, preventing cumulative exports and old source offsets from being counted twice. For each linked stock, resourceStock first settles elapsed recovery at the previous condition, then its recovery clock advances even if full. The version-two stock.habitat record retains condition 0–100, last interval water flow, sediment mass and observation time; clean flow of at least 1,000 raises condition by five, while dry or heavily sedimented flow lowers it by ten. Later recovery multiplies the stock's base recoveryPerDay by condition/100. Initialization validates a linked receipt and exact water tick; old stocks have no habitat record and keep their original rate. Read projections do not settle stock. This partial model excludes distant coastlines and unregistered runoff.

founding.forageSummary now reads current wetlandEcology.cells in addition to woodland vegetation. It counts at most two charter wetlands with no occupying building, drainage conversion or current basin exposure; each must have a real mode: wet observation and condition at least 50. Those cells add forty to the existing finite foraging capacity and eight per village-day regrowth each, while eligible woodland retains sixty and twelve. The one existing economy.foraging.remaining pool and five-food-per-worker limit continue to govern gathering at the settlement's daily check; no stock or water is generated on read and no save schema changes. An unobserved receiver cannot qualify merely because it looks moist on generated terrain. The actual paid-station marsh test exercises production, converted-land exclusion and offline equality. This is edible marsh gathering, not a species-specific aquatic model.

basin-connections.coastalReview derives public shoreline screening on each owner read. Ocean seeds are the traced terminal cells of natural ocean outlets, complete candidate spill paths, installed-channel receiving paths, or the returned report itself. A sorted multi-source breadth-first search follows only ocean neighbors for four steps and at most 256 ocean cells, then collects adjacent non-ocean shore cells. Current mutable community charters intersecting either set appear by public name and owner; private water, stocks and unpublished reports are never read into the result. The scan is separate from reviewedCells/unassignedCells, and complete is always false because a local screen cannot close open-ocean users or ecology. Old saves need no migration because this is a pure projection. Controlled tests cover near/far parties, renamed authorities, read purity and the persistent open boundary.

flood-storage adds state.floodStorage version two and land.floodStorageVersion, checkpointing absent old saves at the current surface-water tick without replaying old water. After basin-water.advance and before structural flood damage, each new surface interval checks basin-exposure.structure for standing operational, damaged or ruined buildings with catalog storage capacity. For each chartered community it apportions pooled vulnerable stock (food, grain, flour, feed, fish, preservedFish, flax, yarn, cloth, garments, saplings, logs, timber, charcoal) by flooded standing capacity over all standing storage; each wet store contributes its own capacity-weighted rate min(25%, 5% × ceil(depth / 0.001)), and each positive withdrawal is floored to a whole unit. Food receipts say spoiled and material receipts say damaged. The warehouse-history wrapper writes one simulation outgoing receipt per good, while floodStorage keeps twenty recent validated entries, count and cumulative losses. The new material resource IDs append to the version-one receipt order, so existing saved receipts stay valid; their losses start only at later intervals. For dated fish, grain and flour, the stock setter also removes the earliest perishable batches and increments used, which counts all non-expiry withdrawals; spoiled remains reserved for scheduled age expiry, and flood/warehouse receipts identify flood loss. Duplicate ticks are inert, dry checks add nothing, and restore rejects malformed clocks, capacity, amounts or receipt order. City and owner forecast projections include the ledger. Controlled and actual paid-station tests cover capacity split, textile, sapling, loose-wood and charcoal loss, oldest-batch withdrawal, warehouse movement, migration, offline replay and read privacy. Stone, metal and tools are unchanged; pooled flood injury uses the separate daily rule above.

basin-connections.projection follows at most sixteen installed drainage crossings from the returned report’s affected cells. For a complete non-ocean recipient outside the root analyze set, it first adds the catchment, then calls the same bounded natural-network analysis from that recipient to include higher outlets, reciprocal backwater, reviewed catchments and crossing endpoints. It deduplicates supplemental basins and links across recipients and caps supplemental catchment/network additions at 8,192 cells, sixteen additional basins and 128 directed crossings; a route to an incomplete or over-budget extent retains one explicit engineered frontier. Newly included cells participate in subsequent channel passes, so a second paid channel can expose another recipient. recipientCatchmentIncluded and recipientNetworkIncluded/Complete distinguish partial claimant evidence from a closed terrain network; engineeredNetworks carries only public geometry and open frontiers. Present authorities are recomputed on each read, foreign water/stock and private reports stay hidden, and no ledger or rights mutate. surface-receivers.sourceProjection shows the natural bypass before an already registered source’s receivers join; conserved allocation and save schemas are unchanged. Focused terrain tests cover upstream and wider-connected claimants, chained channels, oversized frontiers and read purity.

land.sourceCapacity now excludes an operational center or camp when basin-exposure.structure finds any wet footprint cell. The exposure lookup is lazy because basin-water depends on founding. Local surveyed capacity and headworks remain unchanged in saved state; localWater and water return zero local source during inundation. The existing waterworks.waterBalance endpoint exposure rule stops bilateral transfer, while land.water also reports sourceFlooded for the City warning. population.needsCapacity, irrigation suitability, livestock care and migration consume the same reduced allocation; the ordinary daily needs check records water hardship without retroactive consumption. A dry, otherwise sound source re-enters automatically. Controlled founding-center and signed-conduit tests cover daily water need, both endpoint losses, recovery and offline restore. No water or stock is debited from the basin model.

refuge.permanentHousing calls basin-exposure.structure for operational housing footprints after the existing condition check, omitting wet structures from capacity without changing their saved stage or residents. founding.economySummary.housing delegates to that same function, aligning City/Regional numbers with population.needsCapacity and daily population.advance. refuge.plan filters otherwise staffed, ready halls by exposure and returns a floodwater reason when that is the blocker; refuge.advance then spends no logs for zero sheltered residents. A dry building re-enters through normal condition/staff/policy checks. The exposure import remains lazy to avoid the founding/basin-water module cycle. Two controlled paid tests verify a flooded forty-place center, shelter-driven health, dry recovery, a staffed hall, unchanged firewood and restoration. That shelter rule adds no save migration; the separate versioned stored-food flood loss is described above.

basin-connections.projection keeps the cached analyze result terrain-only, then reads existing land.plots[].drainage routes whose outlet differs from watersheds.downstream. Starting from the reviewed geometry, it follows at most sixteen linked channels and their basin-topology.routingContext.trace receiving paths; an omitted path, ocean user or receiving basin outside the eight-basin natural review remains in engineeredFrontier, and omittedEngineered counts routes beyond the bound. Public community and feature scans include these added cells. Foreign condition, stations, balances, stocks and reports are not projected. This is a read-only potential-route inventory; no runoff receipt is moved and network.complete still describes natural closure only. Focused tests cover an omitted recipient basin, current public parties, unchanged state and bounded omission.

watershed-surveys.quote checks basin-exposure.cell along its selected within-charter path before dispatch mutates inventory or public budget; the same quote serves ordinary observations and monitor installations. advance checks each next route hex before moving, retaining route index, carried stock, rations and unpublished findings on a wet step while feed continues to consume meals. A wet observation site at the study due check changes the team to homeward without findings, material spending or surface-water.install; the existing unload returns held materials subject to warehouse capacity. Completed findings remain private until physical return, even if home is flooded. No new saved field or historical exposure replay is introduced. Four controlled-exposure tests cover payment, travel, observation, prevented station installation, refund, return and restore; exposure between those checks is not separately recorded.

waterworks.quote and waterworks.blockReason consult basin-exposure.cell over every saved route hex for all three paid conduit project types. Quote rejection precedes inventory and public-budget mutation; the common work-crews.schedule retains completed work and paid stock while a flooded corridor queues the crew, then resumes it when dry. waterBalance checks only the source and receiver well anchors for floodwater: the endpoint pauses actual exported/imported capacity and reports a reason, while an intact buried middle segment continues to transfer. Existing source, condition, service, fire and consent checks still gate the same conserved balance. The City projection uses these quote, job and delivery reasons without a new save field. Two controlled exposure tests cover funding, custody, restoration, resumed construction, interior continuity and each endpoint; generated basin exposure is covered by separate paid-station tests.

basin-exposure.structure derives the deepest current exposed footprint cell from the existing conserved basin view; flood-damage reuses it for the established once-per-interval condition hit. knowledge.institution now excludes otherwise eligible flooded structures, so requirements, adoption, service checks and City reasons agree. The existing post-boundary knowledge.reconcileInstitutions drops active service immediately after a real flood hit; daily knowledge.advance can restore an enabled program after recession if staff and upkeep remain available. Funded public research blocks through projectInstitution; academy.reason, scriptorium.reason and specialists.school separately guard their exact paid teaching buildings, retain material custody and require ordinary reviewed resume. Controlled paid tests verify each path and save restoration. There is no new persisted field, historical flood replay or water debit.

knowledge.cropRecipe now reports inundated and the basin-exposure reason for every production building with a recorded wet footprint cell, retaining its selected recipe. The existing zone-engine.advanceProduction due-cycle rule advances the deadline without warehouse debits or output when inundated is true, including for non-charter producers; it does not bank missed cycles. city-projection.productionStatus and Supply chains consume the same reason. The prior field/nursery rule and basin-exposure migration remain intact; no new saved field or water movement is introduced. A funded staffed lumbermill test covers blocked logs/timber, one resumed batch and exact restore, alongside the actual paid-station exposure scenario.

surface-routing.allocations divides a recorded source's integer discharge when sound drainage points to a different reserved outlet than watersheds.downstream: ceil(discharge / 4) continues down the natural edge and the remainder takes the channel. With one route or no natural neighbor, the full discharge keeps its selected destination. surface-receivers.register snapshots pre-interval sources, admits paid outlets first, then natural neighbors, within the existing 64-cell cap; newly joined receivers add no local rain. surface-water.advance records each leg independently as a transfer or boundary export. surface-routing.boundaries uses both legs for fixed gauge import/export balances; runoff erosion still uses total source discharge and its selected paid or natural edge. Version-one routing receipts remain unchanged and are never reallocated retroactively. surface-receivers.sourceProjection, surface-routing.projection and City Land & water expose the natural bypass and cumulative edge totals. The fixed 25% rule covers local recorded drainage only; species-specific habitat requirements and major-project rights remain unresolved.

Recorded basin exposure now gates local and outpost garrisons.quote, allied-watch quote, relief military-assistance.quote and escorts.quote before their funded commands mutate stock or consent. Long and standing owned watches route through the ordinary garrison quote. military.advance already checks the next hex for paid non-campaign militia; military-assistance.step now separately checks campaign movement and contact, retaining route index and rations on a flooded step and withdrawing without combat at a flooded camp. garrisons.status denies warning service at a flooded post, garrisons.check withdraws the unit at its next check, and tower route search excludes exposed neighbors. escorts.protection denies protection on an exposed current hex. Lazy exposure lookups avoid the founding/basin-water module cycle. Existing save schemas are unchanged; focused controlled-exposure tests cover each quoted path, custody, offline relief replay, dry detours and physical return. Unknown reaches and other travel systems still require their own audit.

military.quotePatrol and military.quoteSupply now consult basin-exposure.cell along the selected travelled route before paying; the corridor guard checks only the prefix ending at its post, so wet ground beyond it does not block funding. military.advance checks the next route cell for paid militia and military-supply movement, preserving the index, job, people and cargo on a recorded flood while ordinary feeding and deadlines continue. guardProtection denies protection immediately at a flooded post, and guardReturnReason initiates physical withdrawal at the next needs check. The lookup is lazy to avoid a founding/basin-water module cycle. No military or exposure save version changes. Four controlled-exposure tests in test/military.test.js cover quote rollback, held paid movement, ration use, restored and offline-equivalent custody, recall, guard protection and the post-only route boundary; other military travel modes still need a complete flood audit.

basin-exposure.cell is now consulted by caravan, bilateral-trade and owned-outpost quote paths after the ordinary walking route is found and before payment. logistics.advance and outposts.advance check the next route cell before moving, exchanging or unloading; a flooded cell retains route index, people and cargo, sets a visible blockReason and leaves ordinary provision consumption and deadlines active. The existing scouting A* excludes flooded neighbors as well as fire and water biomes and records any bounded physical detour on the caravan job. Floodwater at a founder camp during its assembly phase changes that party to a physical homeward return. No persisted route or exposure schema changes. Controlled-exposure tests in test/logistics.test.js, test/outposts.test.js and test/knowledge.test.js cover quote rejection, held stock, Regional issue, detour, recession and restore/offline agreement. test/trade-contracts.test.js additionally funds a real watershed survey and runoff station, follows a paid bilateral caravan into the ledger's naturally flooded woodland corridor, and checks the held position, restore, physical recall and later quote rejection without replacing basin-exposure.cell. Other travel modes and full unregistered-basin coverage remain outside this slice.

founding.productionFoodReserveReason compares a batch's net prepared-food consumption with the current economySummary.reserveFloor. zone-engine.advanceProduction calls it after actual household needs and before input spending, resource depletion or production receipts. city-projection.productionStatus calls the same helper for the read-only blocker; Supply chains inherits that status. Food-neutral or food-positive batches and noncharter development production retain their existing rules. A blocked recurring cycle is not banked by the existing charter nextDueAt advancement. The first affected recipe is the tree nursery's food-and-compost propagation. test/woodland.test.js covers the blocked and resumed batch, unaffected food plot, snapshot restore and offline agreement. No persistence field or migration is added.

founding.migrateEconomy adds storagePolicyVersion: 1 and foodStorageDays: 0 to older charter economies, rejects an unmarked setting or invalid marked value, and creates new homes and outposts with the same version and zero-day default. SET_VILLAGE_POLICY validates a whole number from 0 to 3 under existing settlement authority and revision checks. founding.economySummary exposes foodStorageTarget = ceil(foodDemand × foodStorageDays) using live demand, including active service and garrison meals. founding.productionStorageReason rejects a positive-net nonfood batch if its projected free space falls below that target; zone-engine.advanceProduction applies the gate before paying inputs or recording output, and city-projection.productionStatus uses the same reason. Standing forestry applies the check before issuing a new job for the whole expected log yield. Legume byproduct collection leaves the greater of its existing next-meal headroom and this policy target in both simulation and projection. Food-producing batches, existing funded jobs, manual transport and return credits retain their normal storage rules, so the target is a decision-time check rather than a warehouse allocation. Focused coastal and forestry tests cover actual day advancement, bounded offline replay, legacy migration, malformed values and blocker projection.

ZoneEngine.creditResources floors free warehouse capacity for compost, militiaKits, manuscript resources and transport-equipment.isCargo goods. It preflights every whole-unit amount before calculating storage or writing stock, rejecting fractional or negative amounts atomically even when an earlier entry in the same object is divisible food. Other divisible goods may use fractional headroom. All credits clamp available room to zero, so a damaged or otherwise overfull store cannot turn a positive arrival/refund into a negative inventory change. The existing caller handles unaccepted goods according to its journey, refund or production rule. A fractional-capacity founded-village test verifies atomic rejection, whole-item storage, divisible-food acceptance and snapshot restoration.

land.initialize migrates version-one ledgers to version two. It accepts a finite nonnegative fractional inventory.compost only for version one, floors that one stock and calls warehouse-history.migrateLegacyCompost before warehouse-history validation and binding. With a marked version-one warehouse-history capability, the migration appends one adjustment receipt with the exact fractional outgoing amount, updates gross outgoing compost and applies normal 240-receipt checkpoint retention. Without that capability, later warehouse initialization uses normalized stock as an honest migration opening. A version-two fraction is invalid. Marked malformed or unreconciled warehouse history remains invalid, and version-two reload is idempotent. Plot, job, right and production-history records are not rewritten.

knowledge.CROPS.legumes.uncollectedByproduct marks compost as a whole-unit field byproduct. At an actual production check, the engine scales the nominal harvest with staff, floors compost to whole units, then caps stored compost against current capacity after all other outputs and inputs while retaining headroom equal to the greater of current staffed food output and one household food-demand cycle. The excess is uncollected on the plot and creates no stock, credited receipt quantity or land-condition change. Food and other outputs remain subject to the normal atomic storage test. city-projection.productionStatus applies the same conservative cap to current-space availableOutput; supply-chains.projection uses that available quantity for ready output, although actual household consumption may free more space before harvest. Production-history restoration accepts a smaller or omitted compost output on legume receipts, keeps exact food output and older full-batch receipts valid, and rejects excess or forged byproduct. The 1,000-day command journey compares bounded offline catch-up with stepped home/outpost inventories and checks every day's food shortfall. Whole-compost, tight-storage, receipt-integrity and restore tests cover the new invariant; the version-two land migration above handles older fractional compost balances.

The settlement-local supply-chains.projection now serializes selectionTechniques and operatingTechniques on field alternatives. It derives them from the same knowledge.CROPS selection and harvest rules: every named crop includes seed-selection, while only the legume's operatingTechnique adds Crop rotation at harvest. Flax and milling grain keep their respective requiresTechnique as selection-only gates. Basic fields have empty lists. The City renderer labels both phases in plan and active source views; it does not alter commands, simulation, persistence, or output rates. knowledge.cropRecipe remains the production authority, and selected workshop recipes retain their independent operating gate.

knowledge.CROPS.legumes adds a selectable community-field recipe with {food:32,compost:4} at full eight-worker staffing, moisture 0.45 and a Crop rotation selection requirement. Its operatingTechnique also requires the live Crop rotation program on every production check; unlike the older flax and milling-grain selection prerequisites, losing this soil steward pauses the legume harvest itself. The existing CHOOSE_CROP payment/revision path spends two food and restarts nextDueAt; generic charter production applies staff scaling, operating budgets, finite storage, flood and soil blockers, warehouse movements and production receipts to both outputs atomically. production-capacity.foodOutput counts only its actual 32 food, while Supply chains lists compost as a local recipe output. The crop selection itself adds no save field, while the later whole-compost rule upgrades the land ledger to version two as described above. A command-funded test grows the compost, pauses/restarts it by specialist state, restores offline output and spends the resulting eight units on a real soil project.

Outpost-transfer ledger version two adds accepted route and ordered deaths while retaining the original resident and worker departure counts. An active resident job holds those totals minus in-transit deaths. community-births version eleven adds nullable diedAt to outpost adult moves. At the birth community's age-85 check, outposts.residentDeath snapshots job phase, route index, cell and pre-loss party counts; the matching adult move and mortality receipt close together. Arrival skips dead birth keys and credits only survivors; household-relocation admission uses its live party size. A last resident death sets the transfer to lost, records the current hex and remaining goods, and removes the job. A workerless founder or reoccupation party with surviving dependents switches to the homeward leg before camp assembly. After a party returns home, outposts.returnedWorkers derives its current unloading labor from the arrived job count minus birth-linked local death receipts after that transfer's arrival. It leaves j.workers and transfer history unchanged, so in-transit deaths are not subtracted twice. outposts.projection exposes this as currentWorkers; regional-overview exposes returnedWorkers and sets travelling people to zero for an arrived job. Both projections are read-only and keep historical transfer totals separate. Cargo stays at the home hex when storage is full, including when the effective crew reaches zero. Version-one outpost and version-ten birth saves migrate with empty deaths and null move markers. Restore checks route geometry, ordered party debits, exact birth links, local mortality and terminal loss receipt. Age-unknown legacy adults remain outside this rule.

outposts.residentAgeWindow checks the age-known civilians selected by the shared community-births.selectedCivilians rule before founder, reoccupation, household-relocation and evacuation quotes, then repeats during transfer before the population debit. It compares each recorded 85th birthday with outward walking time plus a possible return walk; evacuation needs only its homeward leg. Founder and reoccupation windows include two village days of assembly. Age-unknown workers occupy available places first. The version-two transfer ledger records later deaths on delayed active resident jobs as described above.

Migration ledger version three adds deaths to each historical household transfer. The original residents and workers remain departure counts; an active journey holds those counts minus recorded losses, and arrival credits only its live party. Arrival calls conditions with the live resident count, so housing, water, eligible food output and protected reserve requirements scale to survivors; ordinary departure checks continue to use four. Each death records birth key, origin-clock time, leg kind, saved route, derived travel index and cell, and pre-loss party counts. population.journeyPosition derives a bounded hex from the leg's departure and arrival times. Community birth ledger version ten adds nullable diedAt to migration moves; the age-85 birth-community check closes the exact moving adult and a linked mortality receipt. Arrival skips the dead birth key. Version-two migration and version-nine birth saves migrate with empty deaths and null move markers. Restore checks receipt order, route geometry, travel position, party conservation and the birth link, including after a turnback or arrival. Outpost resident-transfer mortality and unknown-age legacy adults remain separate work.

Military old-age ledger version eight adds a nullable supply snapshot with the carrier job ID, route index and prior militia phase; version-seven saves migrate to null. community-births.ageSoldiers now includes resupply-wait and records the held unit hex before mutating the roster. military.endSupplyForOldAge changes the linked outward team to a homeward journey at the same timestamp and clears supplyJobId, so surviving soldiers resume their previous phase and final unit deletion does not orphan the team. Existing carrier cargo, paid-food conservation, travel consumption and full-storage unloading rules remain authoritative. Receipt restore validates the link, route prefix and phase; birth, cohort, population, kit and troop ledgers still close once. Age-unknown legacy adults remain outside this birth-linked mortality rule.

Military old-age ledger version seven adds a nullable campaign snapshot; version-six saves migrate to null without inventing relief duty. community-births.ageSoldiers includes campaign muster, outward, contact and homeward phases. It closes the birth service, cohort, professional payroll, fitted kit, carried food and any archer quiver at one donor village check. military-assistance.withdraw ends offensive duty for survivors, while a final loss sets lostAt, keeps returnedAt null and attempts to return undelivered depot escrow to host storage and leaves any blocked remainder claimable. Agreement and historical receipt validation compare the accepted force with battle plus age deaths, keep the consented route and distinguish a real return, contact destruction and old-age loss. Existing depot deliveries remain paid. Linked field-supply hold mortality uses version eight above.

community-births.ageSoldiers now covers owned local and outpost garrison.version: 1/2 short, 3/4 funded finite and 6/7 standing duties on outward, garrisoned and homeward phases, in addition to home, patrol, guard and escort phases. Consented allied version: 5 uses the same outward, garrisoned and homeward death transition. The version-six military old-age receipt snapshots the watch, actual route and index, and a self-contained {structureId, definitionId, cellId} post with hostId for an outpost or allied host; version-five receipts migrate with null garrison fields. Restore checks phase, bounded walking route, post identity and timing without requiring a demolished historical structure to remain. For versions three/four it checks original troop authorization, finite food allowance, dated collections and spent sum against preceding death receipts. For versions six/seven it checks cumulative allowance, collection count, spent sum and thirty retained receipts. A death snapshot's collection count establishes which earlier meals used the larger force, so standing-garrisons.validate can reconcile lifetime spending after old receipts roll out. Outpost versions two/four/seven retain their original refillAllowance; outpost-garrisons.validate derives arrival strength from live troops plus deaths after refill and checks refillTaken against the original walking duration. A death before arrival reduces the actual refill, while a later death does not rewrite host stock. Future garrison-support.supply calls charge only survivors at the recorded host. garrisons.check still applies lookout, scout, accounting, readiness, reserve and carrying-capacity rules. allied-garrisons.validateUnit reconciles the accepted troop count with surviving soldiers plus matching death receipts, retaining the original refill and daily-food ceilings. Arrival food uses strength at refill, so a pre-arrival loss lowers the payment and a later loss cannot rewrite it. completed receipts validate the actual returning survivor count; a last-soldier death closes the agreement as lost, with no physical return. Historical military death receipts validate the consented watch, host, route and agreed expiry.

community-births.ageSoldiers now includes active and detached convoy escorts at the age-85 village check. A version-five military death receipt snapshots the escort record, route index and actual hex; versions one through four migrate with a null escort field. The birth service, cohort, troop count, kit, proportional carried food and any fitted service or quiver close together. The caravan retains its separate goods and consent. escorts.protection recomputes from surviving strength on each crossing, and trade-escorts.initialize compares the historically accepted soldier count with live troops plus recorded losses since acceptance. Relief and linked field-supply death transitions are implemented above.

outposts.evacuationQuote requires the local household clock to be caught up before it snapshots all residents. This prevents an already-due eighteenth-birthday check from being skipped by moving a dependent between communities.

community-births adds a per-charter people.communityBirthVersion: 11 and an opt-in ledger initialized empty and disabled on older saves; version-one receipts migrate with their original birth site and no transfer. SET_COMMUNITY_BIRTH_POLICY requires a current reviewed world revision, settlement authority and a caught-up household clock; outposts must be established and populated. Each household-day check after named-family continuity uses the settlement's actual permanent housing, household water, eligible one-cycle food output plus active service upkeep, protected food stock, health/stability and two present unnamed civilian adults. The available-adult check shares household-adoption.available, which subtracts named residents and outpost, military-supply and other traveling crews for readiness in the policy review and every birth-day check. Named-family continuity runs before this check, so an explicitly planned named child takes the last available housing place on a shared home deadline. Twenty-four consecutive eligible checks add one dependent and a local community-birth-N receipt; failure resets progress and pause clears it. The child adds no worker, stock or office. continuity.residents counts children at their actual location among protected dependents, so hardship emigration and child adoption cannot silently take an age-tracked minor. Founder, reoccupation and household-relocation orders may explicitly select up to their two dependent places from present community-born children; evacuation selects all resident children. outposts.transfer debits source population and labor, then records exact dependent and selected adult birth keys from the pre-departure worker pool on the resident transfer. Arrival or physical return updates the same receipt only where aggregate residents actually arrive; a child whose eighteenth birthday passed in transit becomes a worker only on the receiving community's next village check. The origin receipt retains birth provenance and one maturation record, without a second population increment. Version-one and version-two ledgers migrate through versions three to eleven, with each child retaining a chronological moves list and legacy latest-transfer fields; no historical trip is invented. Version-three matured adults migrate to unresolved custody without a new labor or population grant. New maturations create an age-known civilian adult receipt. Resident transfers select age-unknown workers first, then exact known birth keys for remaining worker places; communityAdults on the outpost transfer and the adult receipt track departure, arrival and return. The version-three migration ledger retains completed household transfers with exact age-known keys and recorded journey deaths. Hardship departures take selected adults to the finite waystation; later incoming households take anonymous source workers first, then age-known workers, and a failed admission returns the same keys to the source. Active journeys and completed receipts cross-check each other without adding people or workers, and public household events omit exact birth keys. Recruitment and reinforcement now link selected known civilians to exact militia units and durable service receipts after age-unknown workers are exhausted. Cancellation and demobilization return survivors; fatal contact closes selected birth receipts without another labor debit. Version-seven births migrate with empty service histories, and older militia rosters receive no invented birth keys. Founding-household adult adoption, independent careers and resident membership instead link a selected age-known birth key to the new named character and use the recorded birth to set actual age and lifetime clock. Membership keeps ordered joining periods: leaving returns the same key to civilian custody, and a later invitation can select it again. Named death closes the live link without a second population debit. Age-unknown adults and old adoption, career or membership receipts keep the age-24 model. Restore cross-checks marker, sequence, origin, every transfer list and location, repeat/return chronology, maturity, named birth keys and adoption or membership receipts, membership and military-service period order, casualty closure, death closure and available dependent capacity; older unnamed residents receive no fabricated ages. At each local check after named continuity, a present age-known civilian reaching 85 receives one old-age mortality receipt and loses one resident and worker. This runs even with family growth disabled, then reconciles specialist service and assigned labor. Version-eight adult records migrate with null mortality; restore checks death age, local custody, chronology and pre-debit counts. The origin community's daily check also closes an age-known adult still at the finite waystation at 85, debits migration.source.residents and workers once, and records frontier-waystation as the death location. The owner-only People projection counts local deaths, including adults born elsewhere, and separately counts its own born residents who died at the waystation. Natural old-age death for age-unknown legacy adults remains pending; see the adult cohort ledger plan. The People projection and factual briefings are owner-only. test/community-births.test.js and test/outpost-community-births.test.js cover home and paid outpost capacity, v1/v2 migration, physical departure and arrival, adulthood, private reads, pause/restart, forged custody and direct/offline agreement.

household-births adds continuity.householdBirthVersion: 1, a per-account births receipt list and one nullable birthPlan. Old saves without the marker migrate to empty ledgers; marked ledgers validate child identity, guardians, population/labor evidence, lifecycle origin and chronological maturation. PLAN_HOUSEHOLD_BIRTH and CANCEL_HOUSEHOLD_BIRTH use ordinary current-world review and household authority. The plan records two living adult guardians and requires health at least 80, three stable needs days, one free permanent housing/water place, eligible one-cycle local food output at least the new population plus active service upkeep, and stored food for the new population's reserve. At each continuity.advance, twelve consecutive eligible checks add one age-zero named dependent and increment settlement population once; blocked checks reset progress and a guardian death ends the plan. No goods or workers are created. household-aging advances the new child on the existing 24-day year, and household-children.mature transfers one dependent to civilian labor at eighteen with no population or public-office change. Family & continuity shows the owner-only projection. test/household-births.test.js covers the paid-housing path, delayed population addition, save migration and malformed receipts. Unnamed cohort ages and autonomous population equilibrium remain outside this slice.

knowledge.NODES.festivals adds a Culture topic beyond the initial eighteen-node gate; the six-branch graph contained 32 topics at that release and now has 42. festivals owns an optional, version-two people.festivals ledger, initialized empty for older charter saves or migrated from version one with a disabled calendar, and validated for funded totals, pending due time, bounded result history and finite calendar terms. SCHEDULE_FESTIVAL requires current reviewed world state, charter authority, active adoption, a usable commons, two free workers, eight food above reserve and two timber within the existing public budget. It spends stock immediately and reserves those workers through ZoneEngine.laborAssigned. population.advance resolves the pending event at the next household check after computing actual basic needs, adds at most three health recovery only if the organizer and commons still operate, then releases workers and records the result. Lost requirements never refund paid supplies or invent residents. The owner-only cityProjection.people.festivals read powers the City People review. test/festivals.test.js covers payment, labor, recovery, service loss, migration, corruption rejection and direct/offline equivalence.

knowledge.NODES["ritual-organization"] adds a Religion topic after Festivals, with six practice days, three funded research days, separate one-worker adoption and one-food daily upkeep. SET_FESTIVAL_CALENDAR requires current reviewed world revision, charter authority and active calendar service for a positive count of one to four; zero stops future funding. The version-two festival ledger stores calendar.enabled, limit, funded and authorizedAt. Version-one saves migrate to an empty disabled calendar and malformed terms reject. After a full village-day check increments the local day, festivals.calendarDay may fund one ordinary festival for the next household check using the existing live gates, eight local food, two timber, two free residents and public budget. It never reserves future stock, waits through service or resource loss, and stops at the authorized count. Stopping a plan does not revoke a paid pending gathering. City exposes remaining authorization and the current blocker. Supply chains reports the event cost per actually funded gathering as conditional use, not guaranteed daily demand. Tests cover delayed stock, service suspension, finite exhaustion, stopping, migration and offline replay. Faith and secular calendars have identical mechanics and change no belief or resident fields.

knowledge.NODES["performing-arts"] adds the next Culture step with Festivals, Literacy and Textile crafts prerequisites. Research needs an operational staffed school; adoption supplies a separate one-worker organizer. The catalog's Community theater requires that active technique for construction, consumes actual timber, bricks, cloth, food, tools and work, and has two assignable venue staff. performances owns an optional version-six people.performances ledger; older charter saves start empty and version-one school events migrate with null legacy venue IDs and their four-point cap. Version-two venue events migrate with displayed:false. Validation checks paid food/cloth totals, the pending village-day due time, venue kind/ID and bounded chronological results. SCHEDULE_PERFORMANCE requires a current reviewed world revision, charter authority, active organizer, a selected staffed operational school or theater at 65% condition outside recorded floodwater, two free residents, two cloth and two food above household reserves. The school needs one venue worker; the theater needs two. It debits stock and reserves labor immediately while fixing the venue ID and display state. population.advance resolves the event after ordinary recovery and any festival, applying at most four school, six ordinary theater or eight displayed-theater health points within the remaining room only if basic needs and that booked venue still operate. Another venue cannot replace it. Interruption keeps spent stock; workers release after resolution and the five-day cooldown follows the recorded result. cityProjection.people.performances powers the owner-only People card. supply-chains lists festival and performance costs as conditional consumers and theater construction as a one-time input, without counting optional events as recurring demand. test/performances.test.js covers payment, labor, venue choice, interruption, caps, migration, forged totals and offline equivalence. Owned-outpost touring is implemented below.

knowledge.NODES["cultural-patronage"] requires Performing arts and Scholarship, eight village practice days, four research days at a staffed theater, and a separately adopted one-worker patron with one-food daily upkeep. The theater catalog has an operatingTechnique gate and production recipe {cloth:4,timber:2,tools:1} → {notableWorks:1}; its two-staff gate prevents fractional works under the ordinary staffing ratio. advanceProduction checks stock, operating budgets, storage and protected food before completing a cycle and records actual transactions in economic-identity under the Cultural patronage sector. The resource is a whole equipment good; persisted local inventory and owned-outpost cargo validate integer quantities, with four weight per carried work. INSTALL_NOTABLE_WORK uses structure and world revisions, settlement authority, active Patronage and Performing arts, a sound dry two-worker theater, and one work in that settlement's warehouse. It debits exactly one and records the theater ID and installation time in people.performances.displays; a second installation is blocked. Displayed status is copied into a newly funded event, so later installation cannot change an existing pending cap. Clearing a theater removes its display without reversing cumulative spending. Initialization checks the version-six ledger and verifies display IDs refer to uncleared local theaters. Supply chains adds the theater recipe and optional theater-display consumer. The City People projection supplies per-venue display state, blocker and cap. test/performances.test.js exercises production through event settlement and restore. Owned-outpost and invited foreign-charter touring journeys, including private invitations, are implemented below.

outposts.tourQuote reuses the dry walking supply route, worker and equipment availability, 60/100-weight capacity and protected home-food check for a dedicated two-person tour. DISPATCH_PERFORMER_TOUR requires a current reviewed world revision and founding-home authority, active Performing arts, a populated established owned outpost or inviting foreign charter with a camp or village commons at 65% condition outside recorded floodwater, two free home workers, two cloth and two event food plus separately paid round-trip rations. Its outpostVersion:1 supply job carries those exact goods with tourVersion:1, so existing labor, food, cart wear, map position, fire/flood detours, recall and home unloading rules apply. Arrival enters a validated performing phase at the actual gathering-site hex. The legacy outpostId job field names any tour destination; a foreign founding village has siteId:null, while outposts and developed local villages retain their real frontier site. Restore checks the appropriate host anchor in each case. Resolution follows a full host village day and its household check; performances.resolveTour consumes event cargo once, checks current host food/water/shelter and camp plus home organizer service, records at most four health recovery in the host's separate version-six people.performances.tours ledger, and sends the team home. An event aborted before its paid performance returns remaining cargo without a host receipt. Held visits have a five-host-day interval. Version-three and older ledgers migrate with empty tour history. Version-four owned-tour receipts migrate with null guest-consent markers and guest visits closed. Local performance prices and historical caps remain unchanged. Restore verifies tour custody, chronological host receipts, spending totals and job phase. regional-overview labels active tours and routes inspection to People. test/performer-tours.test.js covers paid dispatch, authority, physical arrival and return, recall, cooldown, malformed save rejection and direct/offline agreement. SET_TOUR_GUEST_POLICY requires host authority and a current reviewed world revision. Any charter owner can opt in to foreign visits or close them. Projection exposes foreign chartered communities with public access or a matching private invitation, plus active destinations. At dispatch the job records the host consent timestamp; its origin keeps the two-worker and cargo custody. Loss of every applicable host permission before arrival or resolution sends the unheld team home without spending event goods or creating a host receipt. A held guest event records the consent timestamp, uses the same needs/site/organizer checks, and shares the five-host-day cooldown. Ordinary owner supply cannot start while a guest team is assigned to the same outpost. Restore rejects forged guest markers and receipts. The version-six ledger adds guests.invited, an at-most-four map of foreign founding-community IDs to grant timestamps. SET_TOUR_INVITATION requires the host owner and current reviewed world revision; an established chartered host can grant or withdraw one specific foreign founding community, with a notification in both regions. guestConsentAt chooses the active public timestamp, named private timestamp or accepted cultural-exchange timestamp for dispatch and live permission checks. Public policy changes preserve private grants. Save validation rejects self, outpost or unknown partner IDs and malformed timestamps; version-five saves migrate with an empty invitation map. The City projection exposes eligible named partners and the owner card reviews each grant or withdrawal. knowledge.NODES["shared-civic-identity"] requires Literacy and Regional institutions, eight practice days, four paid school research days and separate one-worker, one-food-per-day adoption. performances.civicInterval returns four instead of five host days only for two foreign founding charters with both local programs active and either mutual private grant timestamps plus one successful held guest receipt in each direction after the later grant and within thirty days of each receipt's host clock, or a currently fulfilled bilateral cultural exchange. outposts.tourQuote uses that live interval only when the host's latest held receipt came from the same origin; a different latest visitor retains the five-day host-wide cooldown. It exposes the effective interval to City. Revocation or suspended service restores five days without rewriting receipts, cargo, event caps or old saves. The technology adds a manuscript resource through the ordinary catalog. cultural-exchanges.js adds a version-one global ledger with a continuity marker; older saves migrate to an empty book. PROPOSE_CULTURAL_EXCHANGE needs both founding communities' Performing arts and Shared civic identity services and current reviewed owner authority. The opposite owner may accept or decline a three-day offer. Acceptance grants bilateral tour permission for fourteen days without stock movement. performances.resolveTour credits only a successful held guest event to the actual sender; both directional credits extend the term to thirty days from acceptance. Either owner can withdraw. Once an accepted, non-withdrawn pact reaches its fourteen-day deadline without both visits, projection reports unfulfilled and derives retryUntil only for each missing sender. PROPOSE_CULTURAL_EXCHANGE rejects that sender's new offer to the same partner for seven further village days; a fulfilled sender remains free to offer and the recipient can initiate a new pact. Records with an active retry delay cannot be pruned for ledger capacity, and the City projection prioritizes actionable or cooldown records within its latest twenty rows. This requires no new save field. guestConsentAt rechecks pact permission at quote, arrival and event; expiry or withdrawal returns an unheld team only if no public or private grant remains. Save validation checks owner identity, bounded IDs, chronology, visit progress and status; at most 2,048 records are retained and closed or expired entries are pruned before capacity is exhausted. City People exposes party-specific reviews and fulfillment status. Broader reciprocal cultural obligations and shared civic institutions remain planned.

The initial M4 acceptance audit in implementation status maps eighteen authoritative knowledge.NODES—three per branch—to live applications and focused behavioral tests. An assertion over the current graph verifies eighteen unique IDs, their six branch memberships and resolvable prerequisite IDs; eleven application suites pass 113/113. knowledge records learned topics separately from adopted and active programs. Funded research, institution staffing and material costs remain real, while care and refuge require a separate policy choice after knowledge and construction; public and faith-supported policies have equal welfare effect. This verifies the initial content/working-choice gate, not specialist mobility, wider diffusion/licensing or later realm institutions.

regional-overview.projection distinguishes a real two-person standing-forestry crew shortage from a mandate's separately configured idle-worker floor. When the proposal reports its worker blocker and availableWorkers < 2, the private forestry exception opens People, includes the exact free count and population.conditions food-output requirement for the next household, and leaves the ordinary mandate and job untouched. With at least two free workers, the same proposal blocker remains targeted to Land & water because changing the idle floor is the relevant decision. population.conditions is exported as a pure read of the existing admission rule; no save migration or resource flow changes. The City integration and policy-floor tests cover both targets.

population.conditions now returns nextPopulation, requiredFoodOutput and requiredFoodStock alongside existing housing, water, eligible one-cycle foodOutput and blocker reasons. The same computed thresholds govern actual waystation departure and arrival rechecks and appear privately in cityProjection.people; this only extends the read model and needs no save migration. public/city-interface.js shows those values in People → Household migration with a Production navigation action. The current output comes from production-capacity.foodOutput, which excludes paused, target-held, input-blocked and policy-blocked producers. The 2,600-day City replay asserts that stored food alone leaves output short before reviewed staffing and target changes, and that the resulting capacity meets the exact threshold before one finite household travels. This is a present-state admission check, not a sustained-production forecast.

The extended test/city-integration.test.js uses ordinary founding, building, staffing, production and outpost commands before a 1,000-village-day no-order replay. ADOPT_HOUSEHOLD_ADULT and NOMINATE_SUCCESSOR prepare an existing adult before that interval. The ruler dies naturally and public commands remain unavailable during AI_INTERREGNUM; EMBODY_KIN and REQUEST_HANDOVER restore authority only to the appointed living adult. SET_PRODUCTION_MANDATE raises the starter field target to 900, SET_VILLAGE_POLICY opens migration until one finite household arrives with two workers and then closes it, and SET_FORESTRY_MANDATE switches the 200-order capped instruction to ongoing daily checks while retaining its cap and order history. A second adopted adult is appointed before another absence. At day 1,462 a natural death removes one worker and blocks two-person harvests; another handover, a third adult adoption/appointment, two 1,200-food targets and sixth starter-field worker make the migration capacity check pass. A second finite household arrives, and migration closes. The ongoing instruction issues real jobs beyond order 200 while four communities retain positive food, zero meal shortfall and active home accounting/regional services through day 2,600; a third lawful handover completes after another old-age death. An unchanged copied branch loses Regional institutions to timber shortage. The test divides the extended timeline at each public order and checks direct offline advance against stepped inventories, economies, production and forestry ledgers, and continuity for every command-free segment. Household arrivals deduct four real waystation residents each; adoption, appointment and handover create no population, office, logs or timber.

forestry-mandates.proposal now recognizes an already issued automatic harvest after its accounting and household-food checks but before testing free workers or older queued work for another order. A running two-worker harvest can therefore return waiting rather than falsely reporting that its own workers are missing. The owner-only regional allowance warning can then identify a near-spent cap while that job finishes. A genuine shortage with no marked job still reports blocked; cap exhaustion and service/food failures retain their prior priority. Focused tests verify the waiting projection is immutable and that the immediate blocker remains the regional exception after the job finishes.

forestry-mandates.MAX_ORDERS now permits a cumulative maximumOrders up to 10,000 in the migrated version-two ledger and ordinary SET_FORESTRY_MANDATE command. regional-forestry-plans.validate and both City editors accept the same larger finite total. Revising authorization preserves orders, earlier jobs and stock; restore still validates that capped orders do not exceed the cap, and old 1–200 saves need no migration. A value above 10,000 rejects without mutation. regional-overview.projection now adds an owner-only forestry-allowance attention issue when an enabled instruction has one to five orders left and no more immediate forestry blocker, targeted to Land & water. Raising the cap or pausing clears it; at the maximum, the detail points to ongoing review or manual harvests. Tests cover direct and coordinated authorization, immutable invalid values, warning purity and restored ledgers. Daily job completion and resource checks remain unchanged; the proposal now reports an in-progress automatic harvest before testing labor for the next job.

The private supply-chains resource projection now includes current finite depot stock for every existing barter or coin purchase source and the settlement's own available communal coins for paid imports. The City goal tree and resource source card label coins as money rather than cargo and exclude imports from recurring production rates. Its chartered timber note derives ready workshop output, assigned recipe input and active service upkeep from the same existing local projection, reports only a conditional net and identifies an active Land registry's actual timber cost. Reads change no stock or service state. In the City integration scenario, a normal reviewed SUSPEND_TECHNIQUE after early registrations removes that one-timber daily upkeep; ADOPT_TECHNIQUE later re-enables the retained installed program without a second adoption payment. A copied branch retaining the registrar has less timber after the same 158-day interval and the same number of forestry orders. No save migration or production rule changes are needed.

coin-market.OFFERS now includes buy-logs and buy-timber at one and two whole coins per unit. logistics.quote checks the shared depot's actual finite stock and the existing worker, route, reserve, carrying and coin requirements; dispatch reserves the goods and communal payment. Existing exchange, recall, unloading, receipt and save-contract validation handle both purchases without a schema migration. Both depot stocks initialize at zero. The catalog has eight coin offers. A two-village test exercises real material sales, earned buyer coins, purchase escrow, return delivery, restoration and the unchanged 1,200-coin conservation invariant.

outposts.projection now exposes localFoodPlot only for a populated owned outpost. It prefers an existing Community food plot (operational and staffed first), otherwise scans only that outpost's current charter cells using ZoneEngine.constructionRequirements for the actual community-field definition. Land, rights, occupied and job-blocked cells are not offered as immediate candidates. The returned owner-scoped card carries exact discounted cost, local shortfall, readiness and first current blocker, or an explicit no-plot reason. public/city-interface.js renders this in Frontier & charters with map/Buildings links; it never calls construction or writes state. The normal START_CONSTRUCTION review and acceptance still recheck everything. Outpost and integrated-journey tests cover standard-load shortfall, optional-load readiness, read purity, actual construction and staff transition.

test/gameplay-journey.test.js now funds a second actual START_HARVEST on regenerated owned woodland and waits for the staffed home mill to turn stored logs into the 70 timber required by DISPATCH_OUTPOST_FOUNDERS with {extraTimber:10}. It restores during founder travel, asserts the 30-timber outpost arrival, pays ordinary START_CONSTRUCTION for a legal local community-field, finishes with four camp workers, then assigns two. Construction spends one actual camp tool; the later independent supply trip delivers one replacement tool and food while returning twenty locally harvested logs. After that trip, thirty ordinary home-day advances send no commands, assert no household food shortfall in either charter, and leave both with food. A direct ZoneEngine.advance from the saved pre-absence state matches both final inventories; the final save restores exactly. This is a finite integrated M2/M3/M5/M6 acceptance route, not proof of indefinite regional balance.

outposts.founderQuote(e,s,extraTimber) supports only 0 (default) or 10. The latter adds ten to both actual timber cargo and home cost and checks the complete cargo plus walking/assembly rations against the existing 300-weight founder limit before DISPATCH_OUTPOST_FOUNDERS spends anything. The owner-scoped outpost projection exposes separate standard and food-plot quotes/reasons; the City review sends {extraTimber:10} only for the optional button. Existing founder jobs and old clients keep the original default and save format. Camp assembly still deducts forty timber and two tools from carried cargo, leaving thirty timber for local construction after a successful optional journey. Unsupported values fail without a command receipt or inventory change. test/outposts.test.js checks the two quotes, payment, physical cargo, arrival and restore. The City integration scenario below uses standard founder cargo and a later carrier trip for camp one, then the optional founder load for camps two and three.

The expanded test/city-integration.test.js calls ordinary DISPATCH_OUTPOST_SUPPLY with ten timber for the first newly founded camp. The next two founders carry ten extra paid timber each. START_CONSTRUCTION spends 30 local timber and food on a legal moist field in all three camps, then ASSIGN_STRUCTURE_STAFF commits two of each camp's six workers. The test stops redundant local foraging and retains a separate physical third-camp 16-food delivery and OutpostFoodDelivered briefing. After all three links exist, three normal SET_PRODUCTION_MANDATE commands target 160 local food using the owner-linked home accounting service. The home suspends Land registry after registration, reauthorizes its retained bounded forestry ledger and sets starter food plot, second field and lumbermill staffing to five, four and four respectively. Earlier three-mill staffing with six and five food workers passed 90 days but left one free worker; 39 days into a longer replay, standing two-worker harvests could no longer replenish logs and Regional institutions lost timber service. The new allocation leaves at least two free home workers at setup. Ninety chronological village-day checks plus 180 more from a saved state require positive food, zero household shortfall and population in all four settlements, positive home timber and active home Public accounting and Regional institutions. Direct advance matches all four inventories and economies plus complete production and forestry ledgers. The test also checks early camp food, retained titles after City decline and immutable rejection of a fourth founder order. No new save schema or inventory grant is involved.

production-recipes.RECIPES.lumbermill retains saw-timber as the first/default recipe for old and new structures and adds precision-saw-timber with input {logs:4}, output {timber:4} and requiresTechnique:"joinery". The existing SET_PRODUCTION_RECIPE command restarts a full cycle without crediting stock; knowledge.cropRecipe checks the selected recipe's active specialist on every production pass. Suspension therefore blocks the precision recipe until Joinery resumes or the default is selected. The focused recipe test verifies a real four-log debit/four-timber credit, no immediate grant, restore, blocked service and recovery.

test/city-integration.test.js configures the existing SET_FORESTRY_MANDATE over owned natural woodland during the first sixty days, revises selected plots after paid charter extensions and resumes the retained instruction for later timber-funding and upkeep intervals. The test never calls START_HARVEST; normal daily proposals and completed two-worker jobs supply the logs, while the mill, paid construction, imports and institutional upkeep consume materials. It pauses future orders before crew-sensitive phases and finishes an outstanding marked job because pause does not cancel it. In the deterministic run, the main 550-timber buildup took 158 village days; the full route issued 85 of 200 allowed harvest orders by day 90 of the four-community continuation and 116 by day 270. The later 180-day interval retains at least 108 home timber. The earlier always-on registrar route took 237 days and 96 orders through its shorter acceptance. This verifies command-level reachability with fewer repetitive player orders, not acceptable elapsed-time pacing or indefinite forestry balance.

APPLY_REGIONAL_PRODUCTION_PLAN is a founding-home-targeted world command with two or three exact {structureId, revision, payload} rows in at least two established owner-linked communities, or four rows while the founding home is currently city. The bound is read from the authoritative home stage for both the live command and copied-world forecast; downgrade restores the three-row bound without changing already saved local mandates. regional-production-plans.validate checks owner authority, local producer stage and revision, payload bounds and destination catch-up; apply calls the existing production-mandates.configure for each row inside one ZoneEngine.execute transaction. Later failure restores every local mandate, structure revision and pending event from the pre-command snapshot. economy-forecast.project supports regional-production-plan through the same command on a copied world, then compares real local production, meals and transport over one or six home days. The owner-scoped regional projection exposes current local mandate/output/allowance data for City drafts. No new persisted ledger is introduced; target spending, source reserves, production deadlines and authority remain the local implementation's responsibility.

APPLY_REGIONAL_FORESTRY_PLAN accepts two or three exact {settlementId,revision,payload} rows from the founding-home anchor. regional-forestry-plans.validate requires distinct owned established linked communities, current anchor revisions and bounded per-community forestry payloads. The command calls the existing forestry-mandates.configure for each row inside one ZoneEngine.execute; a later failure restores the pre-command world and drops all pending events. No new persistent ledger exists. regional-overview.projection exposes owner-scoped local forest options for the City editor. The regional-forestry-plan forecast validates the same rows, executes the normal command on a copied engine, advances all linked communities together and compares it with unchanged orders. The client only enables the final review for an exact matching draft and world revision. Focused tests cover no immediate logs, foreign/stale/duplicate/invalid rows, failure on the second configuration, restore and forecast-to-live agreement after a real local harvest check.

public/city-interface.js now derives item goals from positive outputs of city.supplyChains.recipes with material inputs and city.supplyChains.projects; these remain separate from the full resource list. A clamped integer supplyGoalQuantity (1–1,000) sets the root amount for an item or resource, so the existing material recursion computes a current-stock gap and whole-batch upstream inputs for each alternative. Construction and defense goals retain their quoted amounts. Selection and quantity changes rerender only the client and do not issue commands or write saves. The supply projection also corrects feed/horse notes to describe already implemented eligible manual and automatic draft routes; route eligibility and actual feed/cart checks remain authoritative elsewhere.

regional-overview.js now reads an enabled governor mandate's latest history entry with status: "dispatched". For goods still relevant to its selected delivery/collection rows, plus carrier food and selected-animal feed, it compares budget[good] - spent[good] with that historical entry's committed quantity. A short allowance creates a home attention issue targeted to the outpost's governor control, unless the current route is already blocked, in which case the existing blocked issue remains the actionable explanation. This pure projection does not mutate the ledger, infer future load quantities, or change save shape. regional-overview.test.js funds a real trip exactly once, verifies the private warning through restore, then increases the cumulative budget through the ordinary command and confirms the warning clears; pausing also hides it.

The second three-settlement-stewardship.test.js case starts from the same command-built home and two supplied, field-staffed owned camps as the manual return test. It opens migration with the home field fully staffed and mill temporarily idle, waits for two real household arrivals (+8 residents, +4 labor), closes migration with a six-day home reserve, then staffs five field and three mill workers. It stops second-camp foraging and authorizes two existing SET_GOVERNOR_MANDATE routes: first-camp logs to 30 at home, second-camp food to 400. During sixty subsequent home village days it sends no more commands. Assertions require at least two dispatches per route, committed logs/food, multiple returned non-food receipts, positive stock and no household shortfall in all three communities, positive home timber, active Public accounting and Regional institutions, and a forestry order in each settlement. A copy without either mandate ends with less home food. Direct offline advancement from after authorization agrees on every warehouse, the governor and forestry ledgers, and home program activity. This proves one bounded, unattended configuration with real labor and cargo; it does not test indefinite renewal or every possible target, route or hazard.

regional-accounting.js returns a service source for active local Public accounting, or for an established outposts.links record with the same owner whose founding home has both active Public accounting and Regional institutions. This shared check now gates forestry-mandates, production-mandates target authorization/batches, and raised production priorities; the latter retains its saved level but uses normal effective order during service loss. Production and forestry remain local to the outpost's workers, warehouse, source and due times. City producer and forestry projections expose the service source or a missing-service reason. No save shape changes: old local mandates and priorities retain their ledgers. New tests cover home-service authority, loss, blocked reauthorization, fallback, restoration and save persistence.

three-settlement-stewardship.test.js constructs a home and two real owned camps through commands, delivers ten timber to each, pays for and staffs local fields, suspends optional home programs while rebuilding timber by ordinary woodland jobs and milling, then restores services and uses two 250-food targets plus three standing forestry instructions. The first camp initially has no room for a 21-log harvest; Regional overview names this storage exception. Ending its foraging lets existing food be consumed while target production protects meals and leaves warehouse space. Extending the test from thirty to sixty checked home days exposed a home mill/service shortage at day fifty. The command path uses four field and three mill staff long enough to issue a home harvest, then five field staff, with temporary two-person field staffing during three rounds of two real outpost return trips. Each trip escrows eighteen camp logs and twelve food and returns the carrier job. All checked days retain food and active home accounting/governance; all three forestry ledgers issue local jobs. Direct offline advance is compared for all three inventories, home programs and mandate ledgers at each order boundary and for every journey. Journey time passes between sampled day records. This is finite, manually managed M7 integration evidence, not an unattended equilibrium or proof of every region-system gate.

forestry-mandates.accounting now selects active local Public accounting first, then an established outposts.links[settlementId] whose chartered home has the same owner and active Public accounting plus Regional institutions. Authorization and every daily proposal use this live check; the outpost still runs the original local food, worker, plot, storage, job-priority and cap checks. The projection returns {source:'local'|'home',settlementId} or a service reason, and the ready state names home delegation. No ledger migration is needed: existing instructions retain their orders, and losing home service records a blocked check without deleting them. The focused test proves owner-only authorization, loss/recovery of service, no immediate remote logs, local completion, save restoration, regional comparison and offline equivalence.

economy-forecast.project(...,{scope:'regional',scenario:{kind:'regional-forestry',cellId,payload,expectedWorldRevision,characterId}}) now accepts one owner-linked SET_FORESTRY_MANDATE authorization or pause. projectRegion validates scope, payload keys, live revision and current character; simulate executes the normal command on its copied engine and compares it with an unchanged copied baseline for one or six home days. The scenario returns the local charter ID, previous and final order counts, newly issued jobs, final status/reason and recorded daily checks; regional comparison retains each community's distinct inventory and issues. The City review matches the exact payload and revision before displaying a result. It shows the two timelines without submitting a live order. Focused tests compare six simulated days with a real authorized command, assert read purity and replay, and cover invalid or unauthorized drafts and pause with an outstanding job.

forestry-mandates stores optional state.forestryMandates={version:2,bySettlement:{}} after migrating version-one capped instructions; unmarked older saves initialize empty only if no marked automatic harvest job exists. SET_FORESTRY_MANDATE uses ordinary charter authority, revision checks and Public accounting at authorization. It preserves cumulative orders when a policy is revised or paused. The community-day pass in founding.advanceNeeds calls forestry-mandates.advanceDay after meals, production and land maintenance, with historical now fixed to the tick. The proposal checks local log stock against target, a remaining cap only in capped mode, active accounting, food and labor floors, older queued crew work, one outstanding marked job, selected owned natural forest plots through the existing vegetationPlan, at least 50% health, no basin exposure, and enough current warehouse space for the computed complete selective yield. It sorts eligible plots by maturity, cover and cell ID, then calls startVegetationJob("harvest"); forestryMandateVersion:1 marks the normal crew job. The ordinary completion path alone reduces tree cover/maturity and credits actual logs, subject to the usual later world state. A failed daily proposal records a waiting or blocked reason without issuing an order. Saved mandates and marked jobs are validated on restore; City and Regional overview projections are read-only, with a regional attention issue for blocked instructions. The focused test exercises accepted commands, no early log grant, cap exhaustion, blocked checks, offline replay, authority and malformed-save rejection. This is an ongoing local order source when reviewed, but not a guaranteed perpetual log producer.

The live UI check used an isolated owner-owned charter save and a separate local server. Land & water exposed both natural forest plots and the editable target, floor and cap. Its review displayed the exact chosen plots, 30-log trigger and two-order lifetime limit. Authorization displayed zero issued jobs, pause displayed the retained policy, and page reload restored the paused state and values. This is a UI and persistence check; it does not substitute for the elapsed simulation regression below.

The coastal integration test continues the command-built three-dispatch scenario through two thirty-village-day periods, a later ninety-day interval and a fourth governor order. It uses manual START_HARVEST during the first two periods, then reviews SET_FORESTRY_MANDATE over the three owned natural forest plots for the final ninety days. The same scenario staffs the mill, field, fishery and smokehouse; changes active techniques; imports finite tools and iron; surveys and registers the second forest edge; repairs the cart; and retains the home field's reviewed food-production target. It checks ninety consecutive days of active service without manual harvest commands, the camp's meals, at least 100 free home warehouse units, fourth-trip log custody and later fish production. A separate restored engine advances directly through all ninety days and matches both inventories, service programs, forestry ledger and physical jobs; six more days match stepped and offline inventories, services and both retained mandates. Pausing forestry does not cancel an issued job, which must finish before the next import uses those carriers. The fixture supplies current characterId after a family generation change. This demonstrates a finite player-configured recovery path, not indefinite steady state or perpetual external iron/tool supply.

regional-overview.projection now computes a read-only timber summary for each owned linked settlement from knowledge.upkeep(s, "timber"), warehouse timber/logs and the current productionStatus of staffed lumbermills. Only ready available timber output counts toward current supply; selected saw input determines nominal log cycles. The timber-balance attention issue targets Supply chains when active upkeep is positive, stock is under six current upkeep days, and ready output is insufficient or assigned saw logs cover fewer than three cycles. This is a present-state warning, not a forecast: it excludes future harvest, transport and competing use. It changes no command, job, inventory or save schema; the regional regression checks warning, recovery and read purity.

governors.routeReason applies a twenty-four-hex ordinary limit and a thirty-six-hex extended limit to the canonical owned-outpost walking route. A longer-than-ordinary route requires knowledge.active(home,"field-logistics") and transport-equipment.quote(engine,home,false).mode === "handcart" at authorization and every shipment proposal. The existing governor proposal, outposts.supplyQuote and outposts.supply still check a present serviceable cart, goods, travel rations, local/shared budgets and physical custody; used version-two equipment returns worn. The City projection exposes routeHexes and routeReason for the home card. No mandate ledger field, job version or save migration is added. The focused twenty-eight-hex governor test prepares prerequisite service and one cart, then checks rejection before readiness, funded dispatch, worn return, later blockers, replay and restore. Road-building expeditions retain their own twenty-four-hex limit; a cart alone does not increase any route range.

The coastal command-built regression now exercises this permission with actual learned/adopted services, a constructed staffed registry and cartwright, imported iron and tools, one manufactured cart and later cartwright repairs. It runs three governor dispatches on the twenty-eight-hex route. The second carries food and logs after the player releases camp-depot capacity by reducing field staff. The home also surveys and registers one released forest edge, harvests its real logs, mills timber, temporarily uses carrier policy to import tools while the cart is worn, then restores handcart policy after repair. The camp pauses its smokehouse to retain fuel while the third cart is prepared; older fish are allowed to expire, then a new batch is made and reserved for the third exchange. Its physical return increases home preserved fish, and snapshot/offline replay matches the dated fish receipt and home inventory. Daily checks block while the cart is worn; authorized spending and existing journeys retain normal custody. When governor-loads.plan finds no eligible material, governors.proposal includes each unmet row's existing limit diagnosis in the blocked reason; a full-depot test proves that food and tools name Destination storage and no goods or allowance are spent. This covers a finite three-trip loop, not a multi-season equilibrium of woodland regrowth, institutional upkeep, cart repair and camp meals.

The private world-outpost-quote-request WebSocket read is serialized behind pending world writes. outposts.ownerSupplyQuote checks founding-home ownership, a current world revision, at most three goods per leg and optional draft identity before calling the unchanged supplyQuote. It returns the actual route, rations, cargo/escrow, stock and storage checks, weight, equipment, animal feed and original fish-expiry custody without mutation. public/city-interface.js retains a draft per home/outpost and accepts a quote response only for the matching request, draft fingerprint and City revision. Form input immediately invalidates its prior review, while the live order remains a second step. Its review submits DISPATCH_OUTPOST_SUPPLY with the quoted maps; the ordinary command rechecks every condition and may reject if the world changes. No migration or persisted quote is added. The coastal test checks pure owner quotes, foreign/stale/overwide rejection, mixed delivery and collection, physical arrival and return; the WebSocket integration test checks that the new route rejects a development settlement as a founding home. Isolated live Edge verification covers an accepted custom quote and dispatch, cancellation, four viewport widths and no page exceptions.

outposts.projection derives each linked site's productionInputs from its staffed operational structures, knowledge.cropRecipe selected production and the charter staffing ratio. It returns resource, destination warehouse stock, summed per-cycle demand and stock / demand coverage. City renders this on the home Frontier & charters card above Manual supply transport. The projection does not count carried cargo, forecast future local production or mutate inventory. The coastal fire test checks zero log coverage while fuel is held in transit and the exact stock-based figure after physical delivery; no command or save field is added. The twenty-eight-step coastal route now has the advanced governor option described above.

The first two-way outpost exchange has a separate home guide step. During outposts.unload, a supply journey that actually exchanged at the outpost records each positive non-food quantity credited to the home warehouse in an OutpostGoodsReturned event. Travel rations, outward recalls, collection reservations, goods still carried and storage-blocked quantities produce no such credit. A partially unloaded team may emit another receipt for a later positive batch; zero-credit retries cannot advance the step. briefings.record keeps the resulting count through acknowledgment, bounded entry truncation, restore and later outpost evacuation. The receipt identifies the source outpost and credited goods; it does not assert that every collected unit was produced there. Older saves gain no retrospective receipt. The command journey now checks twenty locally harvested logs arriving home, and outpost tests cover exchange timing, outward recall and restored event counts. No cargo or inventory schema changed.

public/city-interface.js derives a bounded, read-only goal tree from city.catalog construction costs and the existing city.supplyChains resources, recipes, funded projects and one-time defense consumers. A selected building quote may be repeated for one to twenty proposed projects; recruitment and fitting steps keep their fixed quote, while a crafted item or resource uses its selected unit target. The one-time defense list includes the existing rider-drill consumer at its command's four-feed cost; fitting two riding horses and supplying a later patrol, guard or escort remain separate live quotes. public/supply-goal-plan.js follows one browser-selected recipe or project per uncovered material, allocates each unit of current local stock at most once across the selected traversal, excludes the projected protected food floor, expands whole proposed batches into their inputs and totals uncovered requirements. Excess products and co-products from a selected hypothetical batch enter a separate proposed pool only after its input lines expand; later lines consume each proposed unit at most once. The result distinguishes stored stockUsed from proposedUsed and reports the latter on each material line. It separately reports selected source issues from projected building count, assignment, availability and current instance readiness; a project always needs its own funding. Source choices are keyed by settlement and goal for the browser session. The planner never credits proposed output or byproducts into the warehouse, reserves stock, funds work or changes the authoritative world. Physical import offers remain separate unfulfilled alternatives. The view links to existing producer staffing, map focus, recipe assignment, project, building, land and import controls; repeated-resource and depth guards bound cycles. A resource-trace control opens the existing full graph. Selection sends no command; actual technique, site, staffing, capacity, finite source, storage, rights and spending checks remain on the server.

public/city-interface.js derives the Research technology-path navigation from the existing owner-scoped city.knowledge.nodes projection. Six branch panels order nodes by recursive prerequisite depth, show learned versus active-program counts, and include cross-branch labels from each node's projected prerequisite IDs. A topic button focuses the matching existing detail card in the unchanged catalog order. No client order, engine rule, catalog ID, schema or save field is added. The server continues to validate all prerequisites, practice, institutions, staffing, supplies, authority and adoption independently of this navigation.

The home briefings.guidance outpost step now requires OutpostFoodDelivered in its cumulative briefing counts. outposts.advance emits that event only after fishCargo.exchange deposits a positive j.delivered.food on a separate supply journey into a populated outpost whose retained link is established; founder cargo, dispatch, transit, recalls, material-only trips and food delivered to an evacuated empty charter cannot satisfy the step. briefings.record writes the owner-scoped event at home and destination and retains the count after entry truncation or acknowledgment. This is a one-time achieved objective, so later evacuation does not erase it. Version-one briefing saves remain valid without a synthetic past delivery, and no inventory or transfer ledger is migrated. The command journey tests check incomplete founding and dispatch, completed arrival, material-only and empty-charter exclusion, and restored completion.

test/outposts.test.js now exercises an existing physical supply journey under a staged fire hazard at its next owned route cell. outposts.advance leaves routeIndex fixed, retains cargo outside destination inventory and records blockReason while ordinary daily household checks continue at the outpost. regional-overview.projection emits the home journey issue with the destination as affectedSettlementId, names the destination in a supply-job alert, and emits a separate local food-shortfall issue; the outpost filter includes both. The ordinary RESPOND_FIRE command spends ten local food and removes the obstruction; the same job later delivers once and releases its two workers. A blocked-state snapshot followed by the same containment and offline advance matches the stepped home/outpost food balances. The fire is a test hazard setup, not evidence of naturally generated fires in unclaimed corridor cells; no save migration is added.

test/coastal-outposts.test.js extends the already command-built coastal charter, construction and two-way fish journey with a material interruption. It withholds the initial smokehouse logs until after the real fishery and smokehouse are staffed, dispatches a supply team with enough food for the long route, then stages a fire on its next owned home-route cell. Travel retains logs outside outpost stock; the fishery catches, the smokehouse reports its missing-log blocker, preserved output stays zero and the regional issue points to the outpost. The ordinary RESPOND_FIRE order spends home food. Both stepped and blocked-snapshot catch-up deliver the same stock; subsequent normal production and collection return dated preserved fish. The first unprovisioned test attempt returned under the existing low-food rule, so this coverage checks a funded recoverable delay rather than changing transport policy. No engine or save-schema rule is added.

outposts.projection now includes Food and log fuel ({food:20,logs:10}), Log fuel ({logs:10}), and a Collect four preserved fish offer when at least four are present at the destination. Each uses the unchanged supplyQuote to expose current stock, food-reserve, worker, load, route, storage and fish-expiry blockers before City renders its existing reviewed dispatch button. The coast journey takes both outgoing and return payloads from these projected offers, not hard-coded command-only combinations. outposts.supply still validates and pays the accepted order, moves physical cargo, retains original fish dates and can recall on low provisions. The offered twenty food is delivery cargo, distinct from the quote's travel rations, but the existing feed rule may consume some while delayed. No new command or persisted field is required.

economy-forecast.project accepts a regional regional-governor scenario with action authorize or pause, the exact reviewed payload, current world revision and embodied character. projectRegion restricts the destination to an established owned link of the requesting founding home; the copied ZoneEngine executes SET_GOVERNOR_MANDATE or PAUSE_GOVERNOR_MANDATE against the current home-cell revision. The existing governor validator checks services, route, targets, mixed cargo, prior commitments and optional draft animal. Authorization or pause initially changes no warehouse goods. Chronological governors.nextAt/advance checks then use the ordinary physical outpost-supply jobs, local reserves and workers, animal equipment, spending ledgers and shared budgets. The scenario returns only new dispatches, incremental gross spending, bounded daily check outcomes and final instruction state; regional baseline/proposal timelines expose each local warehouse and carried journey separately. The City review matches the exact payload, action, character and world revision before rendering; confirmation still sends a separate live order. No save field or migration is added.

economy-forecast.project accepts a regional regional-district scenario with one linked owned settlement cell, plan name, two to six building steps, resource ceilings, current world revision and embodied character. projectRegion bounds the proposal and rejects foreign or unlinked sites; the copied ZoneEngine executes AUTHORIZE_DISTRICT_PLAN at the current cell revision, so the real district validator, owner rights and service checks remain authoritative. Authorization leaves warehouse stock and plots untouched. The ordinary districts.nextAt and districts.advance scheduler then charges eligible steps, handles dependencies and crew queues, and produces the final plan/step status, reasons and committed materials. A second copied timeline keeps current orders. Both advance the linked region under actual meals, jobs, journeys and shared limits; City matches the result to the exact reviewed plan, character and world revision before displaying it. Live confirmation remains a separate command. No save field or migration is added.

economy-forecast.project accepts a regional regional-crop scenario with one owned linked operational community-field structure ID, known crop ID, current world revision and embodied character. projectRegion rejects foreign, unlinked and malformed proposals. simulate executes the ordinary CHOOSE_CROP command on a copied ZoneEngine with the actual structure target revision; normal seed payment, local Seed selection, crop technique, effective moisture and plot availability checks remain authoritative. The result records site, previous crop, food seed withdrawal, next due time and immediate regional state. A second copied timeline keeps current orders; both advance all linked settlements, meals, harvests, processing, journeys and shared budgets chronologically. City shows per-community warehouse, health and worker differences only when the result matches the reviewed crop, plot, character and world revision. Live confirmation remains a separate command. No save field or migration is added.

economy-forecast.project accepts scope: "regional" with a regional-construction scenario for one known definitionId, linked owned cellId, orientation zero through five, current expectedWorldRevision and embodied characterId. projectRegion rejects foreign and unlinked plots; the copied ZoneEngine then runs the real START_CONSTRUCTION handler with its current target revision. Local site, stock, attention, support, queue and authority checks remain authoritative. The scenario records the new structure/job IDs, local immediate withdrawals, footprint, completion time and final stage/job reason. A second copied timeline keeps current orders, while both advance every linked community chronologically. The City review matches the resulting scenario to its exact building, cell, orientation, character and world revision before showing regional stock and worker differences. The live command is submitted separately. No save fields or migration are added.

economy-forecast.project now accepts scope: "regional" with a regional-supply scenario containing one established owned outpostId, nonnegative whole cargo and collect maps of real transport goods, optional draftAnimalId, current expectedWorldRevision and embodied characterId. The copied ZoneEngine executes the actual DISPATCH_OUTPOST_SUPPLY handler with the home-cell target and its current target revision, then advances the linked timeline beside an unchanged baseline. The returned scenario.atStart records the new physical journey and its carried and reserved custody; jobId identifies it. The normal quote and command enforce route, weight, rations, workers, stock, collection rights, animal/equipment, storage and budgets. The view remains owner-scoped and does not mutate the source engine; the live review still submits its separate ordinary command with current revisions. No new save fields or migration are introduced.

regional-itinerary extends the private regional scenario with two to four ordered manual loads. Each leg names one established, linked, owned outpost; cargo and collect each contain at most three supported goods with whole quantities 1–60 and at least one nonempty side. Optional draftAnimalId, current world revision and active character are validated before copying. The forecast executes the same AUTHORIZE_OUTPOST_ITINERARY command as the live review on a copied ZoneEngine, then advances real outpost jobs beside an unchanged baseline. Per-leg dispatched, returned, blocked, waiting and pending outcomes and regional warehouse differences use the authoritative saved-plan lifecycle. The copied result names a waiting load and its next home-day check when a temporary daily allowance is spent or an existing destination team is still travelling; a shorter horizon can also leave later loads pending. The City keeps a screen-local ordered draft and only offers the one-click review while the comparison matches the current draft and revision; comparison alone makes no live order.

outpost-itineraries stores a version-two outpostItineraries book keyed by founding home, with at most one current two-to-four-leg plan per home. Authorization costs one account attention and immediately calls ordinary outposts.supply for leg one, marking the resulting job with plan ID and leg index. Before each leg, the module quotes the current ordinary supply trip and checks any configured regionalBudgets ledger against the sum of outgoing cargo, travel food, reserved collection and selected draft feed. After a successful physical dispatch it books one itinerary receipt against home-day ceilings and any capped lifetime ceiling and attaches the budget sequence to that same job. regional-budgets.configure rejects edits while a waiting itinerary check is due; the global command guard already rejects an overdue physical outpost job, so neither case can apply a new budget to an earlier dispatch. A failed first-leg check rejects the entire authorization without payment. A later REGIONAL_DAILY_ALLOWANCE_WAIT check leaves its outcome pending and sets nextCheckAt just after the next home village day; it can repeat if another route spends the new daily allowance. OUTPOST_TEAM_BUSY also leaves the leg pending and checks again at the next home-day boundary after needs, before a new recurring route can claim a just-returned carrying slot. waitKind distinguishes budget from carrier contention in saved version-two plans and routes the owner-only Regional overview issue to Regional budget or Frontier & charters respectively. The one-millisecond return handoff is routine and dispatch clears the issue. A paused budget, exhausted capped total ceiling or per-load daily limit failure records a blocked outcome without booking. The configured budget ledger migrates to version two, with prior budgets capped and charges no existing trip retroactively. Prior version-one itinerary books migrate to version two with their active jobs and outcomes intact; a deferred next check beyond the immediate return tick becomes daily-budget, while other prior plans gain a null wait kind. On physical job removal, the engine records its return and schedules the next exact leg one millisecond later, after same-time village work settles, for one attempt under current quote, reserve, route, equipment and custody rules. CONTROL_OUTPOST_ITINERARY with resume retries only that blocked leg, while cancel stops future legs and leaves paid work travelling. A team that returns without an actual destination exchange cancels future legs rather than dispatching a dependent load. Recalling the active outpost journey cancels future itinerary legs as well. The book validates order, timestamps, job identity, ownership and cargo on restore; the shared ledger validates its new receipt kind and active job link. Old saves gain only an empty itinerary book, while a missing book with a marked active job rejects. No reserved future goods, free labor, refunded travel costs or fabricated trips are introduced. Regional overview publishes blocked plans as owner-only issues. Independent manual trips remain outside shared ceilings; route optimization remains open.

economy-forecast.project accepts scope: "regional" with an optional regional-staffing scenario of two to eight distinct producer IDs, structure revisions, whole staffing levels, a current world revision and embodied character. regional-staffing-plans.validate confines rows to the requesting founder's home and established linked chartered outposts, requires at least two communities and rejects stale, foreign, duplicate, unchanged or out-of-capacity rows. simulate executes one APPLY_REGIONAL_STAFFING_PLAN command on a copied ZoneEngine; a second copy follows unchanged orders under one shared deadline and step budget. The live command uses the same validator, checks catch-up in each destination, releases workers before increases, wakes affected districts and receives one receipt or engine rollback. Existing assignStaff restarts local production waits. Both regional summaries use the owner-scoped read and chronological engine, so jobs, meals, cargo and shared budgets participate without source mutation. The version-two result includes applied changes, baseline, proposed checkpoints, issues and per-community comparison. UI drafts remain local to the browser; the reviewed order must match a fresh comparison and carries current world, home-cell and producer revisions. Owner-only batch authority does not extend local production-steward appointments.

regional-overview.projection copies the current governors.projection household-day target into the home instruction and the destination row's inboundGovernor. It derives nonnegative shortfall from desired stock minus actual local warehouse food and retains the governor's current status and navigation target. The outpost-filtered City card renders that row without treating in-transit cargo as inventory. This is owner-scoped, read-only projection data; no save migration, check timing or delivery rule changes.

Governor household-day food targets

The existing governors ledger gains foodTargetVersion: 1 and per-mandate foodTargetDays (null or 1–12) plus includeGarrisonFood (boolean). Unmarked older mandates migrate to null and false without changing their fixed target, history, spending, jobs or warehouses. A marked record missing either field, an unmarked record already carrying them, a nonfood dynamic main delivery, a positive simultaneous fixed main target, or invalid bounds rejects restoration. Authorization requires the usual owner, current revision, regional office and specialist services. It records zero as the fixed main-food target when days are selected and reserves no stock.

Both the legacy single-good proposal and governor-loads mixed-cargo planner now derive the effective destination target at each due check through the existing mandates.target household and optional funded-garrison calculation. The result participates in the same shortage, source surplus, protected reserve, travel-food, carrier, storage, weight, budget and cumulative allowance checks as fixed cargo. A waiting or blocked check spends nothing. Funded journeys retain their original goods and deadlines if population or duty later changes. Private City projection reports the currently computed target; daily and offline advancement use the same function. No food creation or new transport path is introduced.

Copied-world natural-source forecast

economy-forecast.summary now projects owned state.stocks through resourceStock(cellId, at, false) at the starting point, each daily checkpoint and the horizon. Each row carries source cell, kind, name, remaining, capacity, authored recovery rate, condition and the currently effective production-mandate floor. It never persists read-time recovery. The existing copied ZoneEngine advances chronological production, stock recovery, cargo and village days; no parallel stock arithmetic or saved ledger was introduced. regionalSummary applies the same read separately to each authorized linked community, while the local forecast remains settlement-scoped. City renders source timelines separately from warehouse inventory and labels the result as an estimate under current orders. The coastal reserve scenario asserts local and regional daily balances against actual catches, offline replay and unchanged live state. No save version or migration changes.

Fish-source reserve on target production

productionMandates upgrades from version one to two. Every retained mandate receives sourceReserve: 0 on migration without changing its target, budget, spent inputs, batches, producer deadline or natural stock. New target orders may supply a whole reserve for an actual stockKind fishery, bounded by its source capacity; non-stock producers accept only zero. The reserve is effective only in target mode, with the existing active Public accounting requirement. Switching to paused retains the value without catching; switching to continuous leaves the historical ledger intact but makes the effective floor zero. Version-two restore rejects missing, malformed, excessive or non-fishery values; a version-one record carrying the new field rejects instead of silently dropping it.

At a due production check, resourceStock first applies actual time-based recovery. The target mandate then waits if remaining fish are at or below the reserve. Otherwise the produced fish amount is capped by remaining - sourceReserve, permitting a partial batch while preserving all ordinary worker, input, operating, storage and perishable checks. The stock decrement and warehouse addition occur through the existing production transaction; no new catch or replenishment path is introduced. city-projection and supply-chains use the same effective floor for owner-only readiness and next-output estimates, without persisting read-time recovery. The primary design and player guide describe the player decision.

Coastal outpost site and finite stock custody

frontier-sites.coastlines emits a deterministic bounded coast-outpost-v1 candidate on generated shore terrain, excluding base regions, existing founding/frontier/coastal/farming candidates and their two-ring charter fringes. It appends after prior frontier candidates so their identifiers and ordering remain unchanged. expansion.projection lists the coast separately, but does not disclose fishCellId or stock quantity until the existing physical survey returns; the City map link is report-gated. Existing survey, conditional claim and founder routes remain authoritative.

At the first successful camp activation, outposts.activate adds one stock at the surveyed ocean cell with outpostSource custody, capacity 240, recovery eight per village day, full remaining stock and an establishment timestamp. It does not add warehouse fish. Existing resourceStock recovery and fishery production consume the same stock, while ordinary perishables and outposts.fishCargo preserve dates on trips. frontier-sites.validateStocks reconciles every coastal outpost link with exactly one sourced stock and rejects a missing, foreign, over-capacity or chronologically invalid stock. Old saves without a coastal link need no new marker or stock and retain their prior resource state. The primary design and player guide describe the released play path.

Worked mineral lease migration and custody

quarryLeases and quarryLeasesVersion now use version two. Unmarked older worlds receive an empty version-two ledger; genuine marked version-one stone agreements migrate to material: roughStone without changing jobs, money or output. New offers derive material only from the selected operational stone-quarry, clay-pit or iron-mine and its matching finite deposit. Each completed workday consumes 0.25 tools and removes at most 6 rough stone, 12 clay or 7 iron ore. The quote preflights two weight units per material against the existing four-worker, 120-weight expedition limit. Outpost, player-trade and depot transport use the same clay and iron ore weights; the currency ledger remains separate.

Restore validation binds the declared material to the building and deposit, and reconciles per-day extraction, job cargo, returned stock, remaining seam, tools and rent custody. A forged mineral on an old lease, changed material on a new lease or mismatched return cargo is rejected. Existing *_QUARRY_LEASE command identifiers and version-one job shape are retained; the new version distinguishes agreement authority, not a new way to mint resources. The primary design and player guide describe current play.

Recurring coin-sale custody

tradeSchedules and logistics.tradeSchedulesVersion upgrade from three to four. Older barter and relief agreements receive price: null; no old schedule gains a monetary obligation. A new PROPOSE_COIN_SALE_SCHEDULE records a fixed whole-coin price of 1–400 per round with two to six rounds and the existing deadline/interval rules. The recipient accepts the terms without reserving money. At each due check, preflight requires current accounting services in both villages, buyer balance, seller cargo, food reserves, route, two available workers, carrying capacity and any selected horse/cart/feed. A blocked check creates no child contract or coin hold.

A funded check creates the existing coin-sale child, accepts it under the buyer authority and dispatches its physical caravan. Acceptance reserves that round's coins; arrival transfers them to carried custody; home arrival credits the seller. Stopping or recalling before exchange refunds the buyer once, and an exchanged round continues its physical return. Parent validation matches child kind, price, goods, timing and scheduleId; coin-trade and coin-market validate the reserved/carried/credited/refunded partition against the fixed 1,200-coin fund. Parent projections derive committed, credited and refunded totals from retained child receipts, without making coins a material resource or cargo weight. Old version-three schedules migrate neutrally; marked missing or forged records reject. Forecast and offline advancement use the same schedule check and caravan deadlines.

Breeding project and born-animal custody

husbandry and logistics.husbandryVersion migrate three to four, adding breeding: {version:1,nextFoalId:1,projects:{},births:{},cooldowns:{}} without changing the existing finite supplier identities, stock or old jobs. A version-four job is a paid livestock-breeding project. START_LIVESTOCK_BREEDING requires current-world revision and settlement authority, active Animal husbandry, one mature home mare and stallion with complete care and 80 condition, a staffed nursery place, two spare water, a care allowance, one additional available worker and the exact {food:8,feed:12,tools:1} charge under the ordinary gross operating budget. The whole cost is spent at funding; no stock is held or refunded. A 24-day mare cooldown starts then. CANCEL_LIVESTOCK_BREEDING releases the job and reservation, retaining that cost and cooldown. One active project per village bounds overlapping nursery claims.

At each full work deadline, the job checks both parents, care since its last successful work, condition, nursery and water. An unavailable or loaned parent pauses work without advancing progress; a dead parent cancels. Twelve successful checks create a new foal-N in the reserved nursery and a permanent birth receipt with project ID, parents, birth and maturity dates. The 30-day maturity gate prevents draft training or use before adulthood; ordinary daily care applies to the juvenile immediately after its first full local day. Capacity and water include active unborn reservations and replace them with the real child at birth. Restoration validates consecutive born IDs, immutable birth provenance and receipt equality, parent chronology, project/job custody, paid cost, progress, cooldowns and the bounded completed-project history. Older version-three saves receive an empty ledger; missing marked ledgers or forged births reject. Forecast and offline advancement use the same job deadlines and daily care path. A command-driven regression purchases every finite supplier identity via physical trips, verifies that 22 recorded deaths do not replenish stock, and then creates and cares for a new birth from the two surviving founders at supplier availability zero. The test funds the later trips with planted woodland, real harvests and conserved coin sales, and checks restored custody and birth provenance. This proves one supplier-loss survival path; herd-scale operation and wider disaster recovery remain open.

Governor draft custody and feed ceilings

governors keeps its existing mandate version and adds a marked draftVersion: 1. Old unmarked human mandates migrate to draftAnimalId: null, draftFeedSpent: 0 and null/zero transport fields on their bounded history. A marked mandate with a missing marker, or a version-five draft job in an unmarked state, rejects restoration. Configuration requires the normal home authority, an established owned outpost, active office and specialist services, current revision, a qualified ready home horse and enough remaining feed allowance for at least one trip. Authorization reserves nothing. Changing or pausing the mandate does not erase cumulative spending or an already paid journey.

Daily governors.proposal validates the selected horse through draft-animals.loanQuote, then includes its separate feed in outbound weight, home feed stock, governor cumulative allowance, shared regional budget and operating-budget preflight. Mixed-cargo planning reserves that weight and allowance before allocating the other materials. outposts.supply accepts an internal governor context for the selected route; a player command cannot forge it. The funded physical outpost job has draftAnimalVersion: 5 and governorHomeId; its draft loan has governorOutpostId. The draft subsystem books animal feed as livestock operating cost and owns feeding, return, care/rest and cart wear. Governor operating booking therefore uses only the non-animal commitment, while the regional and mandate ledgers include animal feed once. History records the selected identity and actual feed. A failed check only writes a blocked history entry and advances the next check. Restore binds active loan, job, home and outpost and checks cumulative feed against material spending. Projection supplies each horse's current readiness and the mandate's physical quote to City. Human governor routes and food-only mandates keep their prior behavior.

Finite recurring draft authorization

trade-schedules version three adds draftAnimalId (or null), immutable animalFeedPerRound, cumulative animalFeedSpent, and animalFeed on each funded trip. Version-one agreements upgrade through version two; version-two agreements receive null/zero fields without altering stock or historical human jobs. A marked but missing or malformed schedule ledger still rejects. Proposal and recipient acceptance remain separate, and neither reserves stock, horse or cart. The sender's selected horse is validated by the draft quotation route at proposal and again at acceptance; every later check uses trade-contracts.scheduleQuote(..., true) against current goods, both inventories, workers, road, horse care/rest, cart, feed, capacity and budgets. A blocked check advances the daily retry without a child contract or partial payment, and never falls back to human carriers.

At a funded check, the ordinary child trade is proposed and accepted under both existing authorities, then dispatched with the schedule's selected animal and current revision. The child gains scheduleId; the draft-animals version-four loan retains both tradeId and scheduleId, and the active job uses draftAnimalVersion: 4. Actual feed is booked separately from exports and human provisions and reconciled with the trip and cumulative schedule totals. Validation binds the child contract, sender, recipient route, exact horse, schedule, loan and job; old version-three manual trade jobs keep their original meaning. Closed schedule pruning removes its child contracts and their completed draft receipts. Owner projections show the selected ID and live feed; recipient projections expose only draft assistance and the agreed feed commitment. The scheduled trip follows the same arrival, cancellation, low-provision return, road, fire, cart and paid-care logic as a manual draft caravan. Governor draft authorization is described above.

Manual bilateral draft-caravan custody

trade-contracts.dispatchQuote accepts an optional draftAnimalId for an accepted contract from the sending village. It reuses draft-animals.loanQuote, requiring a qualified fit/rested home horse, staffed enclosure, handcart mode, separate animal feed, gross livestock operating authorization, combined cargo plus rations plus feed within 100 weight, current sender stock and two available handlers. The actual DISPATCH_TRADE command additionally requires a current world revision for a selected animal. Manual dispatch spends the exact export and human provisions, borrows one real cart, pays animal feed separately, creates one version-three draft loan tied to the bilateral contract, and starts road travel with the animal speed factor. Recipient consent/payment custody and normal physical exchange remain unchanged. Scheduled dispatch uses the separate version-four authorization above.

The nested draft book now upgrades version one through five without altering old loans, materials or timing. draftAnimalVersion: 3 remains reserved for active one-time player-trade caravans; its receipt stores tradeId, exact starting route, animal/enclosure, paid/consumed/returned feed, steps, return/admission and status. Restoration checks the sender, recipient, job, unscheduled contract and destination. Generic logistics verifies both carried-leg weights including feed. Closed trade pruning removes its already-completed draft receipt if the linked contract leaves the 100-agreement archive. The shared draft feeding, low-provision recall, road timing, cart wear, enclosure admission and paid rest paths apply unchanged. Owner projections show feed and identity; recipient contract projections show only draft assistance, never private animal stock. Forecast and offline replay use the same job.

Natural receiver propagation and custody

At each surface-water boundary, surface-receivers.js inspects the registered source-cell snapshot. A sound completed channel selects its reserved lower outlet; otherwise watersheds.downstream selects the immutable natural neighbor. An absent target is added empty with rainAt: null; no new cell can trigger another admission in that same boundary. The limit is 64 new cells per interval, with paid channels first and then source-cell ID order. At the limit, source discharge remains an external boundary export and is never recovered when coverage extends later. Normal transfer, loss and basin ledgers conserve water; admission alone adds no rainfall, station, inventory or rights.

surfaceReceivers version two uses exact receipts {cellId, sourceCellId, joinedAt, rainAt, route} and marker land.surfaceReceiversVersion = 2. Version-one four-field channel receipts upgrade by adding route: 'channel' without changing balances. Validation checks exact schema, immutable route geometry, existing source/target cells, boundary-aligned admission after the checkpoint, source timing and rainfall provenance. The selected-owner downhillFlow projection reports only source registration, public route geometry, receiver admission metadata, that source's edge total and its cumulative boundary export; it does not reveal foreign live storage. Forecast, offline replay and restart use the same boundary registration.

Runoff erosion of completed earthworks

runoff-erosion.js consumes the actual per-cell interval map immediately after surface-water finishes cell transfers and basin routing, before ecological checks and flood damage. The current saved ledger is runoffErosion = {version: 2, startTick, lastTick, cells} with land.runoffErosionVersion = 2. An old world checkpoints its current processed tick and receives no retrospective condition loss; version-one receipts migrate with armoredTerrace:false. Reads, forecasts and migration do not produce water or material grants. Erosion changes completed land work condition, using the existing production, routing, road and repair behavior; it does not alter cell water equations or generated elevations.

For a surveyed plot with registered runoff, drop = max(0, ceil(sourceElevation × 1,000,000) − ceil(targetElevation × 1,000,000)), where target is the exact edge chosen by the surface solver for that interval. The integer hit is min(8, floor(discharge / 8,000) × min(4, floor(drop / 2,000))). Prepared soil takes ceil(hit / 2) when the plot was fallow or its terrace was sound and completed by the interval start; soil and other included works otherwise take the full hit. Existing condition floors damage at zero. An improvement completed within the interval waits for the next full one. This uses normalized game terrain, not real-world erosion rates or sediment mass.

Each damaging cell has cumulative count/damage and at most twenty chronological receipts: tick, boundary time, chosen target, discharge, rounded fall, soil protection flag, and per-work before/after/damage. Restoration validates schema, clocks, surveyed/registered source, natural or valid local-channel edge, immutable fall, integer pressure, condition arithmetic, unique work kinds, bounded totals and retained discharge no greater than recorded cumulative outflow. Current work condition can differ from the last receipt because ordinary daily wear and separately funded repair also change it. A duplicate boundary is inert. Full interval flow chooses its edge before any erosion can fail a channel; following intervals use the failed-work fallback. Saved forecasts, bounded offline catch-up and normal replay agree; City shows only owned selected-plot history, and the forecast returns only owned charter plots. Completed-work condition damage itself has no sediment export, geomorphic height change or species-specific aquatic effect; newly lost topsoil quality supplies the separate registered-edge sediment ledger above, so the W2 and W3 gates remain partial.

Empty surface receivers with independent rainfall enrollment

The version-two surface-receivers.js ledger above supersedes the original channel-only version-one description. Migration checkpoints the processed surface tick and adds no cells or water. At the beginning of a later water boundary, sound completed drainage from an already simulated cell admits an absent reserved receiver. A natural source can likewise admit its downhill neighbor. The existing ten-field surface cell starts at zero and retains that original joinedAt permanently.

surface-water.addCells distinguishes ordinary rainfall enrollment from receiver admission. A later station/basin enrollment updates the receiver's rainAt while leaving its counters and storage intact. Interval rain and cumulativeRain use this independent date, returning zero when null. The first rainfall interval is prorated; nothing before enrollment is reconstructed. Ordinary evaporation uses elapsed surface participation, while infiltration retains the existing incoming/remaining-water rule. Boundary-admitted cells pay no elapsed evaporation on that first boundary; actual incoming water can still infiltrate, be retained or leave. Internal edge and basin-export ledgers account for every subunit.

After reconstructing station and basin rainfall registration, receiver validation checks exact schema, IDs, actual source/cell custody, immutable valid descending route geometry, first-admission boundary after the migration checkpoint, source admission no later than receipt, and rainAt equality with authoritative rainfall provenance. It adds receipt-only cells to the expected surface extent and preserves their earlier join dates when rainfall later appears. Marked-missing ledgers, future/misaligned admissions, forged rain dates and absent receiver cells reject. Admission does not register multiple downstream hops in one interval or basin rain. Records and retained water survive channel removal and later ownership/site changes.

Wetland low-retention classification and woodland dry stress require known local rain at the ecological observation time; actual inundation and adequate retained water still qualify for wet/balanced recovery. Comparing the observation timestamp with rainAt preserves prior unobserved responses when monitoring is added at the same or a later boundary. This uses existing ecology schemas without rewriting historical responses. Rainfall coverage counts exclude receivers whose rain is still unknown; overall simulated-cell counts can include them.

Selected wetland projections include rainfallRegistered; drainage projections include receiver admission, rainfall start and retained water when a receipt exists. Private forecasts use the same simulation. The source must still have recorded runoff; admission supplies no groundwater, inventory, station, rights or new precipitation. Full physical reach coverage and major engineered works remain separate requirements.

Versioned surface transfer edges and fixed-catchment readings

surface-routing.js owns state.surfaceRouting = {version: 2, startTick, transfers, edgeWindow} with land.surfaceRoutingVersion. Keys from:to hold {from, to, amount} cumulative internal transfer receipts. Initial migration checkpoints the processed surface tick and assigns existing nonzero cell.transferred totals to their accepted natural recipient. Version-one routing saves then migrate to edgeWindow = {startedTick, base, rows}: base copies prior exact cumulative transfers and rows begins empty, never inventing historical rates. New intervals append sorted registered internal edge amounts with exact tick and time, keeping twenty rows; evicted amounts join base. Restore requires consecutive timestamps, registered endpoints, sorted unique edges, and exact reconciliation of base plus rows with every cumulative transfer. These migrations change no cell, sample, basin balance, precipitation or inventory. Marked-missing state rejects. The surface ledger remains version two; the routing ledger's startTick still controls the old gauge-reading format boundary.

For a completed drainage improvement at condition >= 50, the solver selects its reserved outlet after the receiver-admission step has added any absent outlet for a simulated source. Other cells use watersheds.downstream; absent source runoff is explicitly unresolved in the private projection. Existing land validation requires a surveyed same-charter adjacent wetland with strictly lower elevation and the accepted bounded drop. The receiver module above can now admit an empty outlet without rainfall. Boundaries outside registered cells therefore keep their existing natural basin-export interpretation; diverted edges are internal transfers and cannot reinterpret older basin-source receipts.

The solver records each positive internal discharge on its actual edge. Historical receipts survive maintenance, removal and later routing changes. Restore validates exact edge schema, safe integer amounts/endpoints, existing registered cells and natural-or-valid-drainage geometry. Summed outgoing/incoming edges must equal every cell's cumulative transferred/incoming. Existing precipitation, per-cell, basin and global conservation checks remain in place. Receiving retention uses the current wetland ecology limit; elevation-ordered execution passes overflow onward without a cycle or added capacity.

Gauge geometry remains immutable. New samples add imports and exports to the existing seven fields. For each fixed catchment, sum cell incoming/discharge and subtract internal transfers to obtain crossings in O(catchment size), avoiding a scan of the global registered area per gauge. Validate opening + rain + imports = closing + evaporation + infiltration + exports. discharge remains the measured station-cell outflow and is informational outside this balance. Samples at or before the migration tick retain their seven-field historical identity. Exact interval dates, rain, continuous opening/closing and latest storage agreement still apply; the twenty-reading window can contain both formats.

Land views expose route status and exact edge totals with an explicit warning that the latter can include historical natural flow. Forecasts add drainageRouting scoped to the inspected community. Reads never create water or change routes. Unregistered source runoff, complete affected reaches, general diversion permissions and major reservoirs remain unfinished.

Wetland ecology and retention coupling

wetland-ecology.js owns state.wetlandEcology = {version: 1, startTick, lastTick, cells}, anchored by land.wetlandEcologyVersion. Initialization checkpoints the processed surface tick with empty records and changes no water, inventory or vegetation. Marked-missing state rejects. At a subsequent surface boundary, targets are existing records, registered surface cells and current basin exposure, restricted to natural wetlands. New surface cells joining exactly at the boundary wait. Unregistered non-inundated receivers stay unobserved.

Each nine-field cell record stores cellId, joinedTick, lastTick, condition, dryStreak, mode, lost, recovered, and last. The six-field observation records interval time, before/after condition, retained subunits or null, actual inundation and physical conversion. First observation starts from condition 100. Conversion means any extant drainage improvement, regardless of upkeep condition, and subtracts ten points per check. Otherwise actual inundation or retention >= 1,000 subunits is wet and adds two points. Dry registered cells cap their streak at two and subtract five points from the second consecutive check. Responses clamp to 0–100; unobserved checks reset the dry streak without healing or loss.

The surface solver uses capacity(engine, cellId) for natural wetland: an unsilted limit of 2,000 subunits while converted, otherwise 2,000 + 100 * recordedCondition (100 if not yet observed), less the bounded current sediment-bed penalty above. Habitat and sediment change after the current interval's water routing, so their new limit affects the following interval. Surface losses and discharge account for all water released by a lower cap. Generated strict-descent geometry is unchanged. The separate surface-routing ledger above now records completed channel overrides between registered endpoints; reservation still adds no capacity. Removing drainage leaves the ecological record intact.

Surface restore intentionally retains its absolute natural 12,000-subunit bound, allowing previously retained water to wait above a newly reduced cap until the next interval. Never clamp stored water on a land action, migration or read. Ecological receipt validation uses the unsilted upper bound implied by that observation's before condition/conversion; historical sediment is validated in its own ledger rather than reconstructed from today's bed. Exact schemas, clock/custody, latest-response arithmetic, bounded streaks and cumulative loss/recovery are validated. Repeated ticks are inert and skipped clocks reject.

WetlandConditionChanged emits only on condition changes. Authorized selected-land views expose the local projection; forecasts include wetland-origin plots inside the community. Drainage quotes add ecology with current condition, before/after retention and scale; removal estimates use today's retained condition and never promise full restoration. Neither projections nor ecology alter warehouse balances, groundwater yield, deposits or legal rights. Full aquatic species, complete sediment reach and broader terrain response, affected-flow coverage and major engineered routes remain open.

Woodland water response and usable habitat

woodland-water.js owns state.woodlandWater = {version: 1, startTick, lastTick, cells}, with land.woodlandWaterVersion. Migration checkpoints the processed surface tick and adds no vegetation or resources. At each subsequent chronological water boundary, the target set is registered surface cells, recorded inundation cells and already tracked woodland. Natural forest or existing positive tree cover can join. New surface cells whose joinedAt is the current boundary wait; unknown receiving rainfall never becomes a zero-rain assumption.

Each record has cell/join/last ticks, capped wet/dry streaks (three/two), mode, cumulative health loss/cover loss/water-supported health recovery and one exact latest before/after response. Burning, zero-cover and cultivated plots are unobserved. Otherwise actual inundation wins; registered retention below 1,000 water subunits is dry and other registered cells are balanced. Unregistered dry-looking receivers stay unobserved. From the third wet check: health -6, cover -2, maturity -1. From the second dry check: health -4. Balanced checks add up to two health points. All vegetation quantities clamp to 0–100.

Before applying the current response, ordinary vegetation advancement uses the previous saved water mode to suppress regrowth during flooded/dry intervals. Flood-damaged surviving cover enters existing recovery. Current effects then update the patch, timestamp and revision, with WoodlandWaterChanged events only on actual health/cover/maturity changes. No terrain origin, flow amount or inventory changes. Validation checks exact schema, processed clocks, patch custody, streak bounds, latest response arithmetic and cumulative bounds. A duplicate interval is inert; a skipped clock rejects.

Forage habitat selection additionally requires health >= 50 and no current basin exposure; its finite wild-food capacity/regrowth and existing two-plot cap remain unchanged. woodland.sources adds the same health/water requirements to existing mature seed criteria. Nursery eligibility and actual production share that source predicate. Selected authorized land displays the latest response; forecasts include only records within the owner's community. Reads do not advance ecology. Full species-specific aquatic ecology, complete sediment reach and broader terrain response and complete affected-flow coverage remain open.

Flood condition loss and chronological recovery

flood-damage.js owns state.floodDamage = {version: 1, startTick, lastTick, structures}, anchored by land.floodDamageVersion. New/legacy initialization checkpoints the current surface tick with empty records; missing marked state, unsupported schema, inconsistent clocks or malformed receipts reject. Each structure record stores its ID, cumulative condition loss, hit count and the latest twenty entries. Entries retain tick/time, worst footprint cell, basin, normalized depth, before/after and actual loss. Validation checks bounded amounts/counts, footprint identity, chronological dates, depth-rate arithmetic and retained cumulative bounds. Historical depths are retained observations, not reconstructed from today's pool level.

At each completed surface interval, crew scheduling first suspends exposed sites. flood-damage.advance then applies one hit to each operational/damaged building using its deepest current exposed footprint cell (cell-ID tie). Requested loss is min(10, max(1, ceil(depth / 0.001))); the existing damage path clamps remaining condition, handles ruin/staffing/attached work and releases construction-cart custody. Unfinished, ruined and cleared structures are excluded. Damage runs under the interval's clock and warehouse context, followed by institution reconciliation and another crew schedule before tied jobs/days. Reprocessing the same tick is inert; a skipped damage clock rejects.

Condition history stays after repair, rebuild or salvage. Existing normal repair/rebuild commands fund actual materials and work; damage grants no repair stock, water or refunds. Current pool balances are never changed by structural damage. City history is restricted to the inspected community; forecasts use the same ledger and expose it alongside projected structures. Raw receipts record actual applied loss, including a final fractional condition remainder. This structural flood-loss module adds no direct warehouse loss, resident injury, unfinished-earthwork damage or travel interruption; runoff erosion of completed works is handled separately above.

Derived basin exposure and operational consequences

basin-exposure.js owns state.basinExposure = {version: 1, startTick}, anchored by land.basinExposureVersion. Initialization follows validated surface/basin state and checkpoints the current surface tick. Marked-missing state, unsupported versions, extra fields or future/negative ticks reject. Effects remain inactive until basinWater.lastTick > startTick; migration changes no water, stocks, samples or accepted order terms.

For every funded basin node, exposure uses the same basin-water.level(metadata, storage) and land bed ceil(natural elevation * 1,000,000). A cell with a strictly lower bed is inundated; natural lake/ocean cells are excluded. cell and forBasin return current cell/basin/time/normalized-level/depth evidence. An engine-local cache binds the exact water-state object, last tick and migration tick, so restored or rollback-cloned state cannot reuse stale exposure. Reading coverage never alters saved state or consumes water. The existing storage model and bounded/unresolved receivers still limit impact completeness.

land.effective adds flooded and inundation only to exposed cells without mutating origins. knowledge.cropRecipe blocks community fields, tree nurseries and other producers on any inundated footprint cell while retaining their chosen recipes. Existing production rules skip blocked due cycles; recession gives no retroactive output. City food capacity, production reasons and private forecasts consume the same recipe rule.

New construction footprint checks add a flood blocker. Land quote eligibility and food previews exclude inundated plots. workBlockReason checks crew-version-one site/structure/outlet cells; all running paid crews now recheck that reason. Immediately after each chronological surface interval, crew scheduling runs at that boundary before tied jobs/days, saving remaining duration and worked time. Queued orders resume only when dry and otherwise eligible. Existing pause, cancellation and material custody apply; no flood-time work is earned. Older unversioned orders keep their accepted timers.

Private basin projection exposes inundation only with an owned returned station balance, and inundationPending distinguishes migration from a dry basin. The city retains expanded cell details through refresh. Local authorized land/production/work can disclose visible operational flooding independently of remote report publication. The structural damage ledger above now handles standing buildings. Woodland water stress is implemented above; broader aquatic ecology, complete sediment reach and broader terrain response, named-person wounds and complete travel coverage remain open; bounded injury and travel rules are described above.

Surface version two: basin rainfall registration

basin-rainfall.js registers complete non-ocean terminal catchments through surfaceWater.coverage = {startTick, upgradeStations, basins}. Each basin receipt is {basinId, stationKey, registeredAt}; the earliest station enrollment wins, with station-key ties. surface-water.addCells adds only missing zeroed cells. surfaceWater.version and land.surfaceWaterVersion are two. Rainfall enrollment does not rewrite existing samples or transfers. The separate routing ledger above now records channel edges and adds catchment-crossing terms to subsequent samples. Rainfall extent is complete only for an explicitly registered, completely traced basin; it does not prove full flat-flow or downstream impact coverage.

On real installation, new catchment cells join at installedAt; the first rainfall interval is prorated. A version-one save records its current tick and sorted existing station keys, preserves existing cell counters/samples and basin receipts, then enrolls those catchments after the next processed interval, before incrementing the surface tick. New cells join at that boundary and receive no rain until the following interval. Pending migration and completed enrollment survive restart. A newer installation in the same basin can enroll earlier without resetting existing cells. Validation recomputes expected registration provenance and the exact union of original upstream and enrolled basin cells, including each cell's earliest join date and cumulative rainfall.

Enrollment requires complete topology within existing search limits. Spill receipt alone never recursively activates another basin's rain. Lake cells have zero surface retention/losses and pass precipitation plus inflow to the basin pool, whose losses apply once. Boundary runoff from a strict-descent terminal resolves from the source cell itself. Historical boundary exports remain receipts, even if a downstream cell subsequently becomes registered. No past water is reintroduced. Basin metadata is additionally cached per advancement/validation pass so full rainfall coverage does not repeatedly evict the bounded shared cache during routing.

Private basin projection adds rainfall: {complete, registeredAt, coveredCells, catchmentCells, reason} behind the existing returned-survey access. An ordinary report can show current model coverage, while live basin balances still require an owned station's returned installation report. Coverage reads are pure. Forecast and live/offline advancement share the same enrollment boundaries and conserved simulation.

Basin-water custody and coupled levels

basin-water.js owns state.basinWater = {version: 2, startTick, lastTick, settled, sources, nodes, transfers, exports, legacyExports}, anchored by land.basinWaterVersion. It initializes after surface-water validation. Missing marked state or unmarked retained state rejects. Old saves checkpoint each existing positive cell-boundary export as a source offset, set both ticks to the last processed surface interval, and add no basin storage. The existing surface graph, cumulative rainfall, cell storage, station terms and historical samples remain unchanged. Version-one basin ledgers migrate cumulative ocean/unresolved totals into explicit legacyExports without inventing per-crossing attribution; volume, losses, dates and transfers remain intact. Newly processed exits keep exact basin/from-cell/to-cell/kind/amount receipts. Validation reconciles each node’s export totals with its legacy offsets plus those generated-edge receipts. Newly processed overdue intervals use the new model; previously processed exports never return.

surface-water.advance calls basin advancement after cell transfers and before committing that interval's tick/sample publication. A source receipt binds offset + received to the cell's cumulative boundary total and partitions received into toBasin + ocean + unresolved. Resolved receiving paths use basin topology. Only real positive deltas fund storage; there is no second catchment-rain source. A source cannot give historical exports back when more cells or basins become known. Directed from:to transfer totals reconcile each node's cumulative incoming/outgoing, and nodes reconcile runoff + incoming = storage + outgoing + evaporation + infiltration + ocean + unresolved. Combining both ledgers, precipitation equals cell retention/losses + historical offsets + basin retention/losses + external exports; do not count captured cell-boundary exports as an additional final sink.

Hydraulic metadata requires a complete terminal catchment and bounded routing context. Elevation is ceil(natural elevation * 1,000,000); volume is the sum of max(0, level - bed) * 10 water subunits over catchment cells. Land beds retain generated heights. For a connected lake component, model beds share its minimum generated height; this explicit flat-bed abstraction changes no terrain and grants no initial volume. Metadata examines every boundary and retains the lowest shared edge to each receiving basin or external endpoint, including higher connections that are absent from a lowest-saddle-only review. Its immutable cache is bounded to 64 entries.

New runoff is deposited first. Each present basin then loses up to 250 subunits per wet model cell to evaporation and floor(remaining / 100) to infiltration, once per four-hour interval. Water first arriving through a spill pays the receiving basin's losses next interval. Sixteen sorted routing passes transfer only volume above the shared saddle toward the neighbor's level. Integer binary search finds the largest transfer that does not invert the two resulting heads. A higher receiving head allows reverse flow on its own pass. Equal/near-equal levels cannot oscillate an indivisible subunit back and forth. Unfinished routing retains its residual storage and sets settled: false until a later interval resolves it.

At most 32 new nodes are registered per interval. An unresolved route, unsupported metadata or receiver beyond this discovery bound records an external unresolved export; it is not available inventory and cannot be reclaimed later. Ocean exports are separate. This bounds discovery and prevents false completion of a worldwide affected-reach model. All known node storage remains in the saved ledger between intervals. These numerical/model limits must remain blockers for future project-impact approval.

Each node retains exactly twenty recent balances (or all since its creation), with exact tick/time sequence, contiguous opening/closing amounts, cumulative bounds and final storage agreement. Restore validates source partitions/endpoints, generated transfer connections, loss/export partitions, node origins, clocks and sample custody. Numeric volumes are nonnegative safe integers. Private City and forecast projections require an owned station whose installation report has returned in the selected terminal basin; ordinary returned terrain surveys expose geometry but not new remote live readings. Shared physics can run while an installation team is physically held on its return route.

No intake, allocation, groundwater recharge or habitat effect is implemented by the basin-water ledger. Separate exposure/damage modules apply operational and structural consequences. The separate exposure rules above now interrupt cultivation and paid site work. It models rainfall from registered cells and abstract basin storage. Enrolled station basins have complete modelled rainfall extent; unregistered receiving basins still have partial inflow. Complete affected-reach coverage, ecological effects, permissions and construction/service rules remain required by the major-waterworks gates.

Basin topology and model evidence

basin-topology.js computes version-one immutable topology separately from watersheds.js and the live runoff ledger. analyze(engine, cellId) uses only generated cells/neighbors. Equal-height non-water cells form connected land components; their outlet is the lowest strictly lower neighboring cell, with recipient ID then source ID ties. A sorted-neighbor BFS finds the path across a flat to its outlet. Component levels strictly decrease between land components, so no flat traversal cycle is introduced. Connected lake cells form one terminal component even when their generated elevations differ; those values do not establish an operating lake level. Ocean is an open endpoint and is never enumerated as a planetary catchment.

From the terminal land/lake component, reverse traversal includes each adjacent component whose selected outlet enters the growing catchment. All component members are added together. Only a complete catchment can certify its lowest boundary saddle: minimize max(source elevation, recipient elevation) over every outgoing adjacency edge, retain every tied lowest edge, and trace each recipient to its terminal. Geometry alone leaves backwater and shared storage unresolved; the separate basin-water ledger above now models funded reciprocal transfers rather than treating depressions as one-way sinks. A land basin's potential retention footprint is the connected subset at or below the saddle within that catchment. No physical depth, volume, rainfall or flood prediction is derived from it.

Limits are 4,096 component cells, 4,096 catchment cells, 1,024 cells per route, 32 displayed lowest spill edges and 32,768 unique terrain cells per query. Limits produce explicit issue codes and completeness flags; omitted nodes do not become authorized discharge boundaries. A fully established catchment remains known if later receiver exploration reaches a limit, but its spill result is unresolved. Results are recursively frozen and retained in a sixteen-entry per-engine cache, outside snapshots. Sorted neighbor enumeration makes both successful geometry and bounded traversal deterministic.

watershed-surveys.projection includes this review only for the selected plot with a published returned report. Public intersecting communities, uncovered region-cell count, natural feature cells and current runoff coverage are recomputed around immutable geometry on each projection. No stocks, private inventories or foreign survey reports enter that data. Existing City authority protects the view. Generated analysis is separate from historic observations and can be used by old returned reports without migration, payment, station installation or stored-report mutation.

basin-connections.js adds a version-one natural connectivity review to the returned-report projection. Breadth-first expansion reuses basin-water.metadata so its connections include higher outlets and reciprocal catchments, using the same rounded saddle geometry as live storage. It examines at most eight queued basin candidates, includes at most 8,192 whole catchment cells and records at most 128 directed links. Each metadata/topology query retains its own existing terrain bounds. The network cache is recursively frozen, sixteen entries, outside snapshots. Deterministic outlet order determines bounded discovery. No additional saved state or migration is needed.

Incomplete catchments, unavailable metadata, receiving-path limits, oceans and each traversal limit generate explicit frontier reasons. Repeated reasons are grouped per basin, while individual crossings remain in links. complete means only that this bounded natural network closed without a frontier; it never establishes full impacts or permissions. The projection combines network cells with original approach/lowest receiving routes, terminal cells and displayed crossing endpoints for public-community, feature and unassigned-cell counts. Consequently reviewedCells includes supplemental evidence beyond the bounded catchment array. Community identities are recomputed on every read, deduplicated by settlement and contain only public id/name/ownerId. No foreign levels, stocks, station reports or workers enter the result. Existing returned-survey/City authority protects access; the derived evidence changes no report date, water provenance or inventory.

watersheds.js preserves its immutable strict-descent graph; the surface solver now records completed channel overrides through the separate routing ledger above. The basin-water ledger consumes only subsequent boundary exports using explicit migration offsets; it does not replace saved cell routing or replay its history. Project permissions and ecological/flood effects remain open even when natural basin transfers are modelled. Basin review alone leaves all inventories and water ledgers unchanged.

Shared surface runoff ledger

surface-water.js owns state.surfaceWater = {version: 2, epochAt, ticks, cells, gauges, coverage}, anchored by land.surfaceWaterVersion. Empty migration adds no rainfall or storage. The first installed gauge sets an independent epoch; each interval is VILLAGE_DAY_MS (four real hours), independent of settlement calendar offsets. ZoneEngine.advance processes this deadline chronologically before tied jobs/days. Forecast nextAt includes the same deadline; advance emits a quiet SurfaceWaterAdvanced persistence event.

The sparse cell set is the union of complete upstream catchments of installed gauges and complete terminal basins enrolled by the rainfall registration above. Each cell appears once; natural strict descent supplies its default route, with completed sound channel overrides between registered endpoints as described above. Joining cells start at zero with their actual joinedAt. Water uses integer thousandths of a game unit. Base daily rain is round(8 * natural moisture) units, multiplied by the repeating eight-interval factors [1, 1.5, 0.5, 0, 0, 0.75, 2, 1]. The first partial interval receives the elapsed fraction, rounded down to a subunit. This is deterministic abstract game forcing, not a real climate estimate or observed river measurement.

In descending elevation order, each cell receives rain and this interval's upstream transfers. Lake/ocean cells pass through all water without cell retention or losses. A land cell evaporates up to 250 subunits per full interval (prorated on first registration), then loses floor(remaining / 10) to infiltration. Wetlands use the condition-dependent 2,000–12,000 limit described above, with converted plots capped at 2,000; natural forest/woodland retains up to 4,000, and other land up to 2,000. Excess travels immediately along the selected descending route if its recipient is registered; otherwise it is cumulative natural boundary export. Wetland/woodland response and basin inundation now supply partial ecological and flood consequences. Constructed major reservoirs and groundwater exchange remain open. Adding a downstream cell never imports previously exported water.

Per-cell cumulative rain + incoming = storage + evaporation + infiltration + outflow; outflow = transferred + boundary export. Recipient incoming equals the sum of its historical incoming edge receipts, even if a source now uses another outlet. Global rain equals retained storage + both losses + boundary export. Validation checks integer amounts, biome bounds, exact deterministic cumulative rainfall (whole weather cycles plus at most seven remainder intervals), registration provenance, transfer endpoints and these identities. Stations keep exactly the latest twenty eligible complete-interval samples; each balances, has the expected rain/date sequence, and ends at current catchment storage. Nested station readings overlap and are not independent supplies.

Survey state is version two. DISPATCH_WATERSHED_SURVEY accepts optional boolean monitor: true; its saved job and record carry runoffMonitorVersion: 1. Eligibility requires an already returned same-plot survey, a complete upstream extent, descending outlet, ordinary owned-route access and no existing/reserved station. Installation materials are six timber and two tools; route food, staffing, full observation time, interruptions and actual return reuse survey custody. Installation occurs only at completed on-site work. Station projection stays private and hidden until report publication, although shared water simulation can run earlier. Completed station receipts remain pinned alongside latest reports. Original version-one survey jobs retain two-timber/one-tool terms through explicit migration.

Surface-water initialization runs before survey custody validation; station records must match completed paid installation work, and installation findings must match their station. Missing marked ledgers, unsupported versions, orphaned cells/stations, altered rain, mismatched transfers or invalid sample custody reject. This release exposes no water withdrawal or usable inventory conversion. Groundwater, shared wells and existing irrigation retain their prior accounting.

Watershed geometry and fieldwork custody

watersheds.js computes version-one potential drainage from naturalCell elevations. It picks the lowest strictly lower neighbor with a cell-ID tie break; ocean/lake cells terminate. Reverse traversal records up to 256 upstream cells and a forward path up to 120 edges, with independent completeness flags. Strict descent prevents cycles. Immutable per-engine caches are outside saved state. Closed basins and incomplete traces are explicit; this module has no flow, precipitation, storage or well-capacity side effects.

watershed-surveys.js owns state.watershedSurveys = {version: 2, records, reports}, anchored by land.watershedSurveyVersion. Missing marked state and retained unmarked state reject; old saves initialize empty. DISPATCH_WATERSHED_SURVEY targets the home and names an owned cellId; RECALL_WATERSHED_SURVEY names jobId. Current world revision and settlement authority apply. Dispatch requires active hydraulics, two available workers, one team per community and an owned adjacent land route. It reserves two timber, one tool and ceil(4E/12)+6 food under ordinary stock/reserve/public-budget rules and costs one attention. Recall is free.

Version-one watershed-survey jobs travel at the ordinary one-twelfth-day step, observe for a full day, then return. They do not borrow carts/animals or occupy building work slots. Materials remain held until completed observation; observed findings stay in the private job record until home arrival. Elapsed meal feeding enters household travel-food accounting on journey and daily checks; timestamps prevent double deduction. Unloading workers eat at home, and unused materials/meals wait for storage. Publication is separate from final supply recovery and occurs once.

Restoration validates exact material partitions, paid/consumed/returned meals, elapsed unmet demand, route/owner/workers, study and publication chronology, original geometry, observation schema and latest-report references. One report per observed owned plot and each paid station installation remain pinned, with twenty additional closed receipts. Observation values retain their historic time; only public intersecting community identities are recomputed on read. Forecast copies run real survey deadlines. City/Region and factual briefings share owner-visible state; chunk jobs redact findings, observation metadata and meal/material details. Family handover retains the same funded record and current authority checks.

The major-waterworks plan separates implemented W0/W1 and the partial W2 runoff ledger from the still-missing complete-basin, ecological, consent, construction and operation gates. Existing groundwater/conduit rules are unchanged.

Owned-outpost draft loan extension

DISPATCH_OUTPOST_SUPPLY accepts optional draftAnimalId only with a current world review and normal home authority. outposts.supplyQuote uses the actual owned route, combines animal feed with cargo and human rations in both load checks, and checks delivered feed plus provision feed against the same stock. Existing cargo/escrow withdrawal remains unchanged. After reserving the serviceable cart, draft.reserve withdraws and books animal feed, stores outpostId on the loan and marks the job draftAnimalVersion: 2; road scheduling then sees the correct assistance factor. Manual cargo/collection does not acquire the automatic governor budget scope.

At the owned-outpost delivery milestone, the nested draft book migrated version one through two to version three; it now migrates onward to version five, preserving those regional checks. Global husbandry markers remain three; training jobs remain husbandry version three and waystation loans draft version one. Active owned-outpost loans must match the outpost, accepted route, supply role, cart custody and provision partitions; governor/mandate job markers remain forbidden. Existing books migrate without changing stocks, identities, rest or accepted deadlines.

Outpost elapsed feeding now invokes draft feeding, including unloading when animal admission is blocked. Draft day checks dispatch to the corresponding logistics module; last-fed timestamps prevent duplicate household/animal deductions. Real steps record animal wear. Receiver storage/freshness checks happen before the final move, preserving actual position and wear through repeated blocked checks. Draft low-condition/provision return releases the original outpost escrow before walking home. Fish custody, expiry and ordinary household journey meals retain their existing paths.

Unloading independently recovers cargo, cart, animal admission and unused animal feed. The job closes only when all are recovered; the loan then receives its bounded closed receipt. Rest uses the same complete paid-care proof as manual waystation loans. Private outpost projection adds the separate loan and per-offer animal quotes. The browser retains the explicit animal choice per home/outpost across refreshes and review cancellation; an unavailable saved choice remains blocked rather than silently choosing another animal. These controls grant no recurring authorization. Ordinary supply/founder/household jobs keep their existing terms.

Draft training and manual caravan custody

draft-animals.js now owns state.husbandry.draft = {version: 5, courses, qualified, loans}. Global husbandry and logistics markers remain three; validated old husbandry state receives an empty draft book, and earlier draft books upgrade without stock changes. Retained unmarked draft state, unsupported versions and unrecorded jobs reject. Earlier collection/relocation jobs retain husbandry versions one/two and their accepted terms. No legacy inventory horse or abstract haulage converts into a qualification.

TRAIN_DRAFT_ANIMAL selects animalId; CANCEL_DRAFT_TRAINING selects jobId. Both require a current world review and settlement authority. Funding books {timber: 4, tools: 1, feed: 6} under knowledge/public spending and regional livestock operating limits, reserves one additional worker and creates a version-three draft-training job. At each full deadline, fresh paid home care, condition 80+, active instruction, sound staffed enclosure and labor capacity gate progress. Work one consumes timber/tool; each of three works consumes two feed. Refunds conserve unused inputs and retain reservations while storage blocks. Completed course/qualification provenance is permanent; canceled course history is bounded to twenty. Training stays local and does not count as away household labor.

DISPATCH_CARAVAN optionally accepts draftAnimalId and requires current world revision for that opt-in. It preserves the manual goods quotation and existing required-handcart policy, adding ceil(4E/12)+4 animal feed to actual withdrawal and both load checks. Regional livestock spending covers this feed; ordinary manual cargo/handler provisions keep their existing budget scope. Reserve the cart and loan atomically, then schedule travel. draftAnimalVersion: 1 marks the job; the separate loan stores animal/home, original route, paid/remaining/consumed/returned/unmet feed, actual steps, admission and assistance state. Animals use status draft; original order identity, home places and water reservations survive. Active training/loans prevent relocation or another assignment.

roads.travelEdgeMs applies factor 0.75 only to fit, fed assisted travel; actual accepted deadlines survive later condition changes. Each successful edge records wear. Low outward return reserves, mortality or condition below 70 invokes ordinary physical recall with assistance ended. Elapsed feeding runs through logistics travel and husbandry day checks, including fire and blocked admission, with shared timestamps preventing double consumption. Road/scout detours and actual escorts use the same edge durations. Existing ordinary jobs keep their prior timing validation.

At home, cargo/cart return uses existing storage/wear rules; animal admission additionally requires its reserved enclosure and keeper. Remaining feed can unload incrementally. A used loan records restFrom, restUntil and restCompost. Reuse requires elapsed rest, lastCareAt at/after restUntil and a new gross compost increment proving a complete paid care day, even if compost overflowed storage. Relocation/admission timestamps cannot bypass care. Immediate unused recall imposes no new rest. Twenty closed loan receipts remain; no horse is converted to cargo on death or recovery.

Validation checks exact training/input partitions, qualification identity, route/provision terms, exclusive custody, cart-used versus actual steps, jobs and timestamps. Private City/Region, supply-chain demand, labor, forecasts, succession and notices share the ledger; public training jobs redact private animal/input data. Owned-outpost, one-time bilateral and finite recurring player-trade quotation paths are implemented above; governor draft quotation is implemented as described above.

Livestock relocation custody

livestock-relocation.js adds RELOCATE_LIVESTOCK and RECALL_LIVESTOCK_RELOCATION, reviewed against world revision and settlement authority. Both endpoints belong to the same founding village/outpost family and owner. Dispatch reserves all present source animals, destination places, two origin workers and exact food/feed under the existing gross operating budget. It costs one attention; recovery recall is free. Recovery is independent of current husbandry instruction and source condition.

Relocation introduced global husbandry.version and logistics.husbandryVersion two; the draft release above advances both to three. A validated version-one migration creates an empty relocations map and assigns each animal's historic homeFeed to careBySettlement; the map sums to its lifetime total, and each settlement's policy spending sums its own entries even after animals leave. Purchase jobs remain husbandryVersion: 1. New husbandryVersion: 2 relocation jobs retain accepted enclosure-to-enclosure adjacent routes, elapsed feeding, original animal IDs, provision partitions and distinct destination-admission/handler-return stages. Animals use status: relocating and relocationId until admission/return; originals retain their purchase orderId. The marker, unknown versions, missing custody, duplicate animals, forged routes and spending are rejected.

Incoming reservations add destination water only across settlements. Return places remain at the origin until admission. Local care never feeds relocating animals; journey feed follows elapsed time on steps and day checks. Automatic return checks destination care and return reserves; fire never teleports the team. Dead animals retain their actual settlement/enclosure custody and paid history. Admitted animals receive destination care while handlers return; full origin storage holds only remaining supplies/people. Active endpoint structures reject demolition/salvage but permit repair/rebuild. Twenty closed relocation receipts are retained independently of permanent purchases.

outposts.WEIGHTS.feed = 1 and actual feed offers enable destination care through existing finite cargo withdrawal, delivery, recall and storage rules. Resident evacuation remains blocked by live/reserved livestock and origin handlers; it becomes available after physical relocation and ordinary staff/work release. Labor, household travel meals, canonical job deadlines, private projections, regional exceptions, forecasts and redacted chunk jobs support both husbandry job versions. Relocation animals are not warehouse cargo; separately qualified animals can now join explicitly reviewed manual draft loans as described above. Wider rescue parties, arbitrary rerouting and animal trade remain unimplemented.

Livestock identity, purchases and care

husbandry.js owns the version-three global ledger (migrated through versions one and two), anchored by logistics.husbandryVersion. Monetary initialization creates the once-recorded 24-animal supplier before coin conservation checks; final initialization validates animal identities, custody, enclosure references, accepted routes, payment stages, exact provision partitions and care spending. Missing marked state, unmarked retained enclosures/knowledge and fabricated livestock reject. Old material inventories and legacy resident horses are never converted. The finite allocation bounds actual purchase provenance, while only twenty canceled collection receipts remain.

Animal husbandry adds a real Agriculture topic after Seed selection/Joinery and a distinct livestock-enclosure catalog definition with a semantic visual fallback. New pastures require active husbandry, using the shared construction eligibility path. Earlier pasture assignments and production stay unchanged. Old stables remain excluded from charter haulage production. Supply rows distinguish legacy warehouse horses from identified livestock and expose actual care feed demand and a conditional compost byproduct reference.

SET_LIVESTOCK_CARE, COLLECT_LIVESTOCK and RECALL_LIVESTOCK_COLLECTION require current world reviews and settlement authority. Collection reserves two animal identities, an empty two-place enclosure, two real workers, 24 held coins, and exact food/feed. It charges one attention; care authorization and recall are free. Held purchase funds participate in coin-market conservation. Payment transfers to the existing NPC treasury only at physical pickup; an unexchanged recall refunds at home. No additional coin endowment or warehouse horses are created.

Version-one livestock-collection jobs use ordinary durable deadlines and canonical adjacent walking routes, with a sixty-weight provision ceiling. They do not borrow a handcart or reuse generic goods escrow. Elapsed-time feeding runs on travel steps and home daily checks; handler meals enter the existing household travel-food accounting. Actual movement, fire blocks, recall, pickup, admission and partial unused-provision unloading persist. After admission, home care begins separately; handlers waiting for material storage eat as residents, while unadmitted travelling animals still consume carried feed. Public chunk jobs omit private animals, payment and provision data; City/Region retain owner access.

careDay runs after normal production and resident services. A complete day since admission/last care is required. Each home animal uses two actual feed under its community's lifetime ceiling and any enabled regional operating ceiling. Staffed operational enclosures, soundness and fire checks apply. Land-water projections reserve two spare units per live/arriving animal against future projects/growth; existing households, irrigation and signed exports keep priority. New shared-water approval subtracts livestock reservations. Existing export allocation does not acquire a retroactive lower priority.

Successful full care recovers five condition and credits one compost through ordinary storage rules. Byproduct counts are gross production; overflowing compost is discarded. Feed may still be consumed when water is missing. Any care failure lowers condition by ten and records a reason; zero records mortality without manufacturing salvage or a replacement. Existing care remains possible without the research specialist. Occupied/reserved enclosures block demolition/salvage, and outpost evacuation blocks live reservations. Repair and rebuilding remain recovery paths; physical relocation now clears the livestock evacuation blocker as described above; wider rescue services remain planned.

Care spending reconciles with per-animal consumed home feed, including dead animals. Forecast copies execute the same acquisition, travel and care deadlines; Region reports actual problems and positions. Factual notices use simulated event time, with quiet movement events outside the return briefing. Tests cover physical paid acquisition, partial-day admission, shortages, death, fire, storage, recall, water loss, malformed saves, privacy, replay and offline/forecast agreement. The animal-services specification retains automatic transport, breeding and recovery requirements; paid training and manual waystation, owned-outpost and accepted one-time player-trade draft loans are now implemented.

Academy research custody and scheduling

academy.js owns the additional per-community project. knowledge.initializeVillage creates a neutral charter.academyVersion = 1 / settlement.academy ledger with sequence, nullable project and twenty retained receipts. Existing knowledge.project is neither moved nor altered. Marked missing, unmarked retained and unsupported ledgers reject; nonchartered academy state rejects. Active projects validate their actual local academy, known catalog topic, chronology, sequence, progress, material conservation and exclusion from the public slot. Completed receipts match retained knowledge’s learning timestamp; canceled receipts return exactly unused supplies.

Scholarship unlocks the catalog academy with a normal school construction prerequisite, paid footprint and two structure staff. Runtime operation independently requires active Literacy, Scholarship and Public accounting, condition 65+, no building job, and the topic’s normal institution. knowledge.requirements retains ordinary practice/prerequisite checks at funding. FUND_ACADEMY_RESEARCH reserves node.research plus {timber: 1, food: 2} * node.days, books the full gross timber commitment and charges one attention. All four academy commands require current world review and settlement authority. Duplicate topics are blocked by academy quotes, public funding and manuscript-study requirements, including paused slots.

knowledge.workers, institution reconciliation and labor release include the two academy researchers independently of building staff and public researchers. Daily knowledge advancement processes academy work using the same household timeline. Original research material consumption uses cumulative ceiling-rounded fractions; prepaid support invests one whole daily allocation. A blocked project needs explicit resume and a fresh day, so restoring a building or staff cannot bank missed work. Cancellation uses an atomic whole refund, and no extra warehouse support withdrawal occurs during advancement. Evacuation refuses retained academy work even when paused. Death preserves public custody while normal illness/service-loss rules may block progress.

Completion writes the existing community-research provenance and records learning-center research evidence. The learning ledger permits four receipts per frame to cover both projects, scriptorium storage and a separately released held book; old entries remain valid. Private City/forecast and continuity models expose custody, Region reports blockers, and AcademyChanged briefings use actual event times. Foreign overviews strip academy. The supply graph distinguishes the academy’s combined one-time funding from recurring services. The new building has a semantic footprint/label visual fallback and no synthetic output recipe.

Learning identity from institutional completions

learning-identity.js adds charter.learningIdentityVersion = 1 and settlement.learningIdentity. Population initialization explicitly migrates old unmarked communities to an empty window beginning at their next household check. Marked missing ledgers, unmarked retained data and unsupported versions reject. The ledger contains startedAt, completedDays, fourteen bounded daily frames and pending receipts; the calculated next deadline must equal economy.nextDayAt. Physical reoccupation resets this calendar alongside production identity, retaining other assets.

knowledge.advance records completed research/study and successfully stored school copies. scriptorium.storeBook records each stored ordinal; cancellation records a finished held book only after successful warehouse credit. record checks active Literacy and a sound staffed school at that moment, independently of earlier funding. It retains kind, topic, project start, book ordinal, completion time and supporting-school identity. Imports never call this hook. Pending evidence enters the daily frame after production and needs; a command-time release waits for the next check. Three distinct nonempty frames in fourteen derive the label. Expiry runs through ordinary daily simulation, never through reads or camera updates.

Validation checks exact chronology, known topics, actual minimum project duration, kinds, ordinals, historical school ID shape, bounded receipt arrays and duplicate project/ordinal identities across the window. Four receipts per frame permit public and academy research, scriptorium storage and a separately released held book. Historical school operation is recorded at completion; later demolition or staffing loss does not rewrite it. This is a factual activity record, separate from goods custody, paid scribe history and production identity. No retrospective credit is inferred during migration.

City and private forecast projections expose completion records and current school requirements. Public overviews strip learningIdentity while deriving only culturalSpecializations; regional owner comparisons include those labels. LearningSpecializationChanged records earned/lost recognition at the actual daily deadline, including offline replay. City disclosure and keyboard focus survive refreshed projections. Existing research, scriptorium, institution, material and authority rules remain authoritative.

Economic identity from completed production

economic-identity.js defines nine production sectors and a bounded seven-day aggregation ledger. charter.economicIdentityVersion = 1 marks settlement.economicIdentity. Neutral initialization begins at the next scheduled village day, with no invented past production. Successful physical reoccupation invokes restartAfterReoccupation after resetting economy.nextDayAt, starting an empty period on the new calendar and recording a briefing without changing assets. The ledger end must equal the next scheduled household check. Each retained frame has its exact chronological deadline and per-sector batch count, worker assignments and gross input/output maps. Validation checks marker/ledger presence, counts, dates, known sectors/resources, feasible staffing bounds and recipe-compatible resource types.

founding.advanceNeeds wraps the existing production call in a temporary daily collector. ZoneEngine.advanceProduction records each completed batch after the actual stock mutation. Failed or blocked batches never reach the collector. Finalizing the daily frame happens after needs, services and maintenance; the temporary collector is restored in a finally block and never serialized. Direct isolated production helpers outside a household day are not town identity checks. The window, not reads or camera visibility, controls labels: three of seven qualifying frames, at least two worker assignments per sector-day (four for farming).

Owner City and private forecasts expose evidence and current producer status. Regional summaries carry labels for each actual community. Foreign public overviews strip the ledger and expose only derived labels. A bounded return-briefing event reports label changes. Detailed paid scribe receipts retain their existing separate rules; this ledger provides only aggregate daily production evidence. It neither modifies settlement.specialization landscape data nor grants resources, research, labor or authority.

Charter settlement development ledger

settlement-development.js owns neutral per-village initialization, capability assessment, daily progression and read-only projections. charter.developmentVersion = 3 protects settlement.development; version-one town ledgers first gain zero City streaks and version-two ledgers gain zero Regional capital streaks, without retrospective checks, promotion or assets. A marker without its ledger, unsupported version, impossible streak/history and an unearned Town, City or Regional capital state are rejected. population.initializeVillage initializes the record for both founding and physical outpost establishment. Daily evaluation follows actual production, needs, continuity, services and funded maintenance in founding.advanceNeeds.

Town requires 48 actual residents with the disclosed housing, water, health, meals, local reserves, accounting, service institution, supplied workshop and physical-exchange evidence. City requires the same working capabilities, 56 actual residents, six local household food days and active Regional institutions. Regional capital requires current City capability plus three established owned outposts with completed local village charters, resident housing/water, health 80, no latest food shortfall, three local food days and an OutpostFoodDelivered briefing count at each recipient. This event records a real home supply team's food arrival, not founding-kit or in-flight cargo. Three consecutive checks promote or regress one stage; duplicate timestamps do nothing. Twenty transition records retain lifetime sequence numbers and validate legal adjacent-stage changes and earned promotion populations. A City promotion and capital promotion must record at least 56 residents; a capital-to-City downgrade may lawfully record fewer after founders leave. The restore validator now applies that threshold only to upward transitions. Only stage/revision and this ledger change; shared development stages are untouched. City permits a third retained outpost and Regional capital a fourth only while Land registry, Regional institutions and the staffed operational office remain active; lower current capacity never deletes existing links. The outpost restore ceiling is four independently of current service. Regional-capital status also raises coordinated production from four to five rows; forecasts and actual application share the same cap. Projections appear in owner City Overview, regional exceptions and private economy forecasts; a specific briefing event records changes.

test/city-integration.test.js uses accepted world commands from the standard forty-resident founding state. It checks paid registry and edge title, bounded standing forestry, harvest and milling, food targeting, researched services, physical migration, three founder journeys and a third-camp delivery. test/helpers/regional-capital.js branches from that save without changing the original 2,600-day longevity scenario. It pays three local houses and charter projects, obtains residents through actual relocation or finite waystation migration, researches local Record keeping, staffs food plots, physically sends food/timber/tools, and forges tools from imported iron and charcoal. The home re-earns City and then Regional capital after three checks; a five-producer forecast is read-only and an actual five-row order succeeds on a copied engine. Raising the forestry allowance and further smithing fund a fourth reviewed site and founder journey. Population is conserved through dispatch, the fifth order is rejected without mutation at that one-office checkpoint, and the four-link save restores even after a lawful capital-to-City decline below 56 residents. Later home migration re-earns capital. The continuation researches and adopts Seed selection, chooses wheat on both home fields, and trains and appoints three newly adopted young named adults for Record keeping, Land registry and Regional institutions; their 75% upkeep factor lowers combined timber service demand from three to 2.25 per day. Eight workers on the starter field, two on the second and three at the mill leave labor for selective harvest and carriers. The third developed outpost runs its own bounded standing harvest, and a governor route delivers food from home while returning actual logs. The source field's 500-food target protects local log storage; home fields remain continuous so arriving households see lasting food output. The governor aims for 600 source food and 70 home logs, retaining 600 home food. Across more than 2,600 further player-managed village days the test requires Regional capital on every checked day and no intervening stage history, positive food without shortfall in all five communities, and at least six home food days. Source harvest, outbound food, returned logs and new home migrants are observed. The first funded named-specialist cohort is trained and appointed manually; the later Record keeping and Regional institutions backups each receive one real course from a SET_SPECIALIST_TRAINING_PLAN daily check, then take the posts on actual age-85 incumbent death checks; a later Land registry pause frees labor and reduces required milling without erasing the existing fourth charter. The reviewed governor food allowance reaches 30,000 and actual gross spending exceeds the old 10,000 ceiling. Offline advancement matches inventories, development, forestry, governor, specialist and knowledge ledgers across the unaltered periods between player decisions. This proves a long managed route, not unattended succession or infinite resource balance.

governors.js and regional-budgets.js now validate route-specific and optional shared cumulative whole-material limits through 100,000 instead of 10,000. The shared daily limit remains 1,000. Both commands require current authority. The governor ledger retains version one; shared logistics uses version two with version-one budgets migrated as capped. Already committed gross spending, jobs and stocks remain. The larger capped-total validation range itself needs no additional migration. Capped edits cannot lower a total ceiling below recorded spending; daily limits cannot undercut today's recorded spending, and values above 100,000 reject without mutation. The City governor and capped shared-logistics total inputs expose the same larger maximum. Daily dispatch continues to check local goods, provisions, source reserves, workers, route, carrying capacity, receiving storage and any active shared or operating budget independently.

Governor mixed-load planning

governor-loads.js validates and allocates optional mixed plans under governors.cargoPlanVersion: 1. New or explicitly edited mandates carry cargoPlanVersion: 1, additionalDeliveries and additionalCollections; each array permits at most three unique {resource,target,keep} rows. The primary fields remain backward compatible. Migration adds only the capability marker. Unmarked additional data, unsupported versions and orphan tagged journeys reject restoration. Legacy mandates and funded trips retain accepted behavior, and an older client must explicitly supply all mixed rows before editing an existing mixed mandate.

The planner reserves normal travel weight/food and any borrowed equipment, allocates whole units food-first in stable reviewed order, enforces combined per-leg unit/weight limits, and reserves collection before computing freed destination storage. governors.proposal sends the result through ordinary outposts.supplyQuote; local route spending, shared daily and any capped lifetime budgets and regional operating budgets remain authoritative. Actual dispatch, fish ages, workers, recall, fire and storage holds use the existing outpost ledger. Paid jobs carry governorCargoPlanVersion: 1; later policy changes do not rewrite them. Projections expose deficits and per-row constraints without modifying live stock.

test/governor-loads.test.js covers real two-way mixed cargo, shared capacity, limits/reserves, replay and authority, migration/corruption, changed targets, offline forecasts, two-outpost worker competition and full-catalog wire size. The added fish-cargo scenario builds the actual coastal industry and registry, then delivers dated preserved fish and tools together without renewing freshness.

Regional road maintenance mandates

road-maintenance.js owns roadMaintenance: {version: 1, routes} and the independent roadMaintenanceVersion marker. It validates route authority, thresholds, cumulative section/material counts, bounded chronological decisions, no-gift migration and maintenance tags on both active and returned road crews. Missing marked ledgers or orphan tagged crews reject restoration. Existing manual road jobs have no maintenance tag and retain their terms.

SET_ROAD_MAINTENANCE changes an explicit founding-home policy under normal authority, revision, character and replay checks. founding.advanceEconomy runs its daily checks after local land/building upkeep. The module selects the most worn route deterministically, uses regional-roads.quote with an internal threshold and dispatches through the existing physical custody/accounting path. Clients cannot override the internal threshold through a manual command. Local and shared budgets are checked and booked once; the authorization's gross spending never decreases on recall or refund. Carried workers, food, cargo, section completion and unloading remain regional-road responsibilities.

City, private economy forecasts, regional decisions and briefings expose the same policy and funding results. Saves initialize empty instructions; authorization itself changes no inventory, staff or condition. test/road-maintenance.test.js covers real physical repair, funding protections, pause/recall, budgets, migration, invalid commands/saves, immutable private projections and forecast/offline equivalence.

Nursery propagation and forestry orders

woodland.js owns woodland: {version: 1, startedAt} and land.woodlandVersion: 1, validates versioned new planting payments and projects local seed sources/quotes without advancing live vegetation. logistics.nursery records the one-time 64-sapling supplier allocation. Missing marked state or malformed allocation/planting data is rejected; restored old paid forestry orders have no plantingVersion and retain their original payment/timer. No player inventory or grant changes during migration.

The tree-nursery catalog recipe consumes four compost/four food for four whole saplings at two staff per normal village day. knowledge.cropRecipe adds local mature seed-source and effective-moisture requirements alongside existing soil-steward, building, staffing, input and storage checks. Compost land projects now declare their actual eight-compost output, used by both completion and dependency reachability validation. New chartered vegetationPlan/acceptance share exact checks and commit four saplings/four timber/one tool; completion reuses existing analytical woodland recovery. Pause/cancel follows the ordinary two-person crew ledger and rounds plant refunds down before storage allocation.

Whole saplings use cargo weight one and the existing indivisible-item checks across caravans, player trade, outposts and governor mandates. Stock and seed inputs stay local. Legacy shared-development planting and paid old orders retain their eight-timber terms. Procedural structure fallback and cached recipe version are updated. Tests cover real nursery production, imported first woodland, prerequisites, recovery, refunds, migration, offline equality, private projections and finite supplier custody. Stored stock mortality and seasonal seed behavior remain outside this model.

Construction equipment custody

construction-equipment.js owns constructionEquipment: { version: 1, policies, loans, held, history } and logistics.constructionEquipmentVersion: 1. Initialization preserves inventory and earlier paid jobs; default manual hauling creates no loans. A missing marked ledger, orphan job tag, inconsistent loan, malformed held return or duplicate collected receipt is rejected. Each job uses a separate buildingCart tag, not cargo transport equipment. The twenty-entry collected history is bounded per settlement; physically held carts remain represented until collected.

SET_CONSTRUCTION_EQUIPMENT and RECLAIM_CONSTRUCTION_CART use existing authority, revision, character and replay checks. New chartered structural quotes apply the selected cart multiplier and optional tool support. Funding reserves one serviceable cart outside payment.materials and payment.support; it therefore stays outside district/maintenance consumption ceilings. All structural completion paths, explicit cancellation and ruin interruption release custody. Active elapsed work determines wear, and completed work always returns worn equipment. Partial warehouse space cannot split a cart; a held return needs explicit collection but holds no workers. Warehouse wrappers record actual stock changes.

The legacy haulage support path is restricted to shared development regions. New chartered stables are blocked and their existing production becomes inactive without deleting animals, stock, staff or accepted orders. Paid old jobs retain their original terms. City, supply graphs, forecasts, regional collection alerts and briefings read the same ledger under existing private settlement access. See test/construction-equipment.test.js for physical competition, recovery, storage, migration, corruption, authority, offline and automatic-repair coverage.

Childhood, membership and maturation

household-children.js owns continuity.childhoodVersion: 1, an initially empty childAdoptions array per household and per-character childhood metadata. Existing family record version two and adult-adoption receipts remain compatible. Unmarked child data is rejected. Founding initializes an empty child ledger; migration never invents people or retroactive maturation. Mixed-adoption validation uses each child's prior adult-adoption count and generation to reconstruct living membership even when several orders share a timestamp.

ADOPT_HOUSEHOLD_CHILD requires the current lawful adult, explicit identity/world revision, a founding-home target, a valid name, a free household place and an actual unnamed dependent. It records age twelve and a village-check-aligned eighteenth-birthday deadline. household-aging.advance converts the resident once at that deadline: laborBase increases by one, worker becomes true, and a receipt retains prior population/labor and the resulting labor. Population and inventory do not change. The existing named-dependent/worker accounting protects this person from unrelated population moves.

Restore checks membership, guardian history, source age, lifecycle, deadlines and worker/receipt consistency. Adult eligibility is enforced at runtime and in persisted office, will, stipend, donation and specialist-history validation. The adult-kin estate fallback excludes minors at the actual death timestamp; later adulthood cannot rewrite an earlier estate. Public council succession uses adult candidates only. A newly mature adult may fill an otherwise vacant nomination, but does not automatically embody or assume office. Authorized City/overview and forecast reads expose the private household; stranger views remain restricted. Adoption/maturation events generate factual briefings. Named births use the separate household-births ledger; unnamed-cohort aging and child illness/mortality remain outside the current model.

Worked-site lease custody and Contract law

quarry-leases.js owns quarryLeasesVersion: 2, a version-two agreement book and compatible quarryLeaseVersion: 1 jobs. Coin initialization migrates a genuine marked version-one stone book, starts an empty book for older unmarked worlds or rejects unmarked existing data, then includes held rent in the fixed global monetary conservation equation. Full validation follows outpost/region initialization. It validates named owner/tenant/site references, the bound stone, clay or iron material and matching deposit, exclusive active leases, canonical routes, exact terms, tool and food conservation, finite extraction and physical return receipts. The latest 100 closed agreements are retained; live agreements are never pruned.

Six commands offer, accept, dispatch, cancel/recall and give notice. Acceptance reserves coins; dispatch pays actual material stock and assigns four resident workers; arrival transfers held coins to the host; completed full-day work consumes tools and reduces the real deposit. Held unpaid coins refund once at physical home arrival, even when material unloading waits. Every scheduled crew check emits a persistence event. Offer and unsent permission deadlines join the chronological scheduler. Loaded/returning receipts reconcile exact cargo and money without creating stock. Institutional checks apply to fresh commitments; already funded jobs remain communal through succession and service loss.

Primitive staffing, repair quoting and structural work check the site reservation, covering manual and automated callers. Environmental damage is still authoritative. The worker count integrates with labor, away meals, household adoption and migration protection. Travelling jobs do not occupy the home construction plot. City/forecast projections are authorized; shared chunk markers contain movement fields only. Briefing recipients are explicitly restricted to host, tenant and host site. Supply movements and regional warnings use the same ledger. Contract law requires Land registry/Public accounting, a staffed registry, eight practice days, four research days with 12 timber/eight food/one tool, adoption with six timber/one tool and one daily timber upkeep. Its physical manuscript uses ordinary study/trade custody.

Monetary terms on physical player trade

coin-trade.js owns the additive coinTradeVersion: 1 marker and coin-sale payment extension on existing bilateral trade contracts. Legacy worlds with no monetary contracts migrate without changing balances or goods; unmarked monetary records reject. PROPOSE_COIN_SALE uses the ordinary authority/revision/idempotency path, then the existing acceptance, dispatch and cancellation commands. Barter and relief retain their current terms and versions. Recurring schedules reject monetary terms.

A sale's payment records total price, four custody amounts and acceptance/exchange/credit/refund timestamps. Buyer acceptance deducts actual communal balance. Before exchange only the local reservation is funded; exchange transfers it into carried money. logistics.unload credits it exactly once at home independently of material storage. Cancellation and pre-exchange fish spoilage release uncollected buyer money locally, while the original goods use ordinary physical recall. Save validation checks whole quantities, phase-specific custody and chronological dates; credited money cannot appear before home unloading. The finite market conservation invariant adds reserved plus carried player-sale funds alongside communal treasuries, NPC market/caravans, military pay and personal estates. Credited/refunded historical amounts are not counted twice.

Public chunk caravans carry no monetary ledger: payment remains in private contract projections. Treasury views, supply movements, private forecast summaries and regional carried-coin fields expose the applicable owner's funds. Finite receipt pruning is safe only after the contract no longer holds coins. Existing fish, equipment, roads, escorts, food accounting, unknown-ack recovery and succession continue through the same caravan state machine. Monetary prices do not bypass protected export stocks, mint funds or grant rights.

Regional road custody, scheduling and rights

regional-roads.js owns regionalRoadsVersion: 1, an edge table keyed by sorted cell IDs and a bounded returned-crew history. DISPATCH_REGIONAL_ROAD and RECALL_REGIONAL_ROAD use ordinary command authority, revisions and idempotency. Each new regionalRoadVersion: 1 job records the canonical owned-outpost route, selected edge indices, current position, four workers, materials/food custody, completed sections and a full-day work deadline. Material conservation ties each completed section to fixed paid inputs; food distinguishes consumed, unmet, carried and returned quantities. Restore rejects invalid markers, routes, phases, custody, quantities and duplicate history IDs. Old worlds migrate to an empty book.

The scheduler walks twelve edges/day, works one full day/section, rechecks institutions/rights/food and unloads through actual capacity-aware credits. Every due check emits a state event, including intermediate work and storage waits, so paid meal/deadline changes persist. Routine movement does not create repeated arrival briefings. Daily meal accounting excludes away workers and includes their real carried meals; unloading restores home meals while retaining worker assignment until supplies fit. Travelling jobs do not occupy the home construction plot; their workers are excluded from local adoption and protected against hardship departures. Overdue road checks block new home commands until simulation catches up.

Road eligibility is a narrow released service right on the owned outpost route, excluding unrelated titles, other released founding parcels, generated natural features and unsuitable terrain. It changes no parcel/vegetation state. Analytic condition is 100 minus two per elapsed home village day since completion/repair, clamped to zero. roads.improved integrates usable regional edges with existing local road connections; new cargo steps use two-thirds walking time, while accepted step deadlines and noncargo movement remain unchanged. Chunk snapshots expose completed edge coordinates, condition and usability, with daily refresh events. Private City projections, supply graphs, forecasts, regional attention and briefings use the authoritative ledger; no road inventory or staffing is stored in the public edge marker. Public crew chunk records contain movement fields only; paid material and meal custody remain in authorized City reads.

Scriptorium commissions and manuscript custody

scriptorium.js owns scriptoriaVersion: 1 and a local version-one scriptorium ledger in every chartered community. Missing markers with existing records reject; older unmarked worlds receive empty ledgers. Founding and outpost arrival initialize the same neutral state. Commission funding validates current settlement authority/world revision, known topic, one-to-four whole books, the chosen staffed 65%-condition scriptorium, Scholarship, two extra workers, reserve floors and public timber limits. One timestamp anchors the acceptance and first full-day deadline.

The existing village-day scheduler calls scriptorium work after program upkeep and before public research. knowledge.workers counts its two scribes separately; labor loss releases them and retains the commission. Reconciliation blocks service/building loss without automatic resumption. Public succession keeps this community-funded order. Four timber/two food per copy are escrowed once, then half invested per completed day. produced distinguishes whole manuscripts already credited from a completed book held for storage. After a held book is released, another full day must pass before advancing new work. Cancellation checks space for unused inputs and held output before any transfer; the command transaction rolls back failures.

Restore validation reconciles quantity, progress, invested/reserved totals, produced/held books, known topic, selected institution and deadlines. Closed receipts retain produced books and unused refunds, capped at twenty per settlement; they are not evidence of current warehouse stock after later trade/study. Actual stock uses existing manuscript whole-unit transport and study rules. City projections, supply graphs, warehouse changes, private copied-engine forecasts, regional attention and typed briefings expose the same state. Shared overview responses omit both scriptorium commissions and named specialist ledgers for other owners; private City access alone is not the privacy boundary. The new catalog building declares its matching semantic visual fallback. No automatic manuscript output is added to recurring production estimates.

Allied watch agreement and force custody

allied-garrisons.js owns the marked alliedGarrisonsVersion: 1 book. Invitations bind both current founding-community leaders, host tower, donor, soldier ceiling and term. Acceptance rechecks readiness, separate stocks, route and purpose-specific transit, then attaches version-five garrison custody to the existing militia job. Each invitation/control command uses a single authoritative timestamp so live-clock reads cannot make acceptance, expiry and force custody disagree on restore. No second military unit or population is created. Old worlds receive an empty book; missing markers and inconsistent current custody reject.

The existing military scheduler handles walking, food, holding, expiry, fire and return. Shared garrison support recognizes the new remote version; actual arrival and daily payments use host operating budgets. Permission ends at acceptance plus its term, with host notice setting an earlier deadline three village days from notice, capped at the original expiry. Lost signing authority ends service. The garrison records arrival, preparation, fixed permission deadline, refill and daily receipts. Before removing custody on actual home arrival, the agreement retains its final receipt. Active force and returned receipt validation reconcile donor, host, route, timing and finite food. At most one unresolved host invitation/watch is allowed; recent closed records are retained separately from live commitments.

Military transit adds garrison without broadening old both clauses, which still mean relief plus trade escorts. Existing route requirements, treaty notice/expiry and save validation are reused with that purpose. City/forecast projections filter agreements to the relevant community; limited resident/production roles receive no new command authority. Copies and offline simulation run the same food and return rules. Occupation, permanent allied armies and siege combat are not implied.

Dated custody for player fish trade

fish-trade.js adds tradeContracts.fishVersion: 1 and a nullable per-contract fishTrade ledger. Acceptance selects actual recipient payment batches; dispatch selects actual sender batches. Each side records the resource, custody time and sorted original expiry buckets with quantity, remaining, spoiled, delivered and returned counters. Restoration validates exact totals, original age bounds, phase compatibility and matching contract/job containers. Old nonfish contracts migrate to null custody; fish without its marker rejects.

Accepted-payment aging runs at recipient daily checks. Travelling custody ages before caravan movement or unloading. Any new pre-exchange loss triggers existing physical recall and schedule closure; post-exchange loss only reduces returning cargo. Goods already delivered remain final. All transfers use perishable import dates, including local reservation release and partial return unloading. Reserved payment dates participate in the local 256-date capacity union; production and incoming transfer preflights prevent overflow. NPC caravans reject fish cargo because they lack this dated agreement custody.

Private contract projections and recurring round receipts expose the ledger. Copied-engine forecasts compare cumulative losses; regional attention and typed briefings report relevant active events. Contract history retains existing bounded rules, with linked rounds retained under their schedule. None of these reads creates stock or restarts dates. The later dated grain/flour extension above applies the same custody; prepared food remains unaged.

Council recovery before returning to public office

PETITION_COUNCIL_SUCCESSOR uses the existing owner command envelope, founding-home target and current world/target revisions, with an explicit current characterId (including null for an observer). household-adoption.councilQuote requires council stewardship, no living adult household member, an unresolved public handover chapter, a free place under the eight-living-member limit, a caught-up home and an eligible unclaimed local civilian. Ordinary cohort availability excludes named residents and travelling workers; recorded community-birth custody retains actual age instead of initializing that person at 24.

continuity.councilRecoveryVersion: 1 and a distinct household councilRecoveries array separate council enrollment from adoption by a living guardian. The new house-<account>-council-<sequence> character joins at the recorded generation. Its receipt links the exact pending public chapter and existing resident origin. Legacy saves receive only an empty versioned ledger. Restoration checks membership, chronology, the absence of an eligible household adult at enrollment, and both ends of any community-birth link. This narrowly permits a recorded later successor to hand over an earlier chapter; ordinary later adoptions cannot rewrite it. Cross-array admission counters order childhood/adoption membership when wall-clock timestamps coincide; death chapter sequences distinguish residents who were still living at the receipt’s recorded generation. An enrolled successor cannot retrospectively enter an earlier personal estate.

The command changes named membership and the council nomination only. It retains population, laborBase, worker assignments, stocks, personal estates, public obligations and the embodied state. EMBODY_KIN and character-bound REQUEST_HANDOVER remain separate. The CouncilSuccessorPetitioned briefing records the enrollment; Regional overview provides an owner-only continuity exception. City preserves an explicit null identity through review rather than dropping it. No candidate is created when the eligible local cohort is empty. This is a bounded recovery route, not general elections, global recruitment or a replacement founding grant. test/council-recovery.test.js covers command authority, local cohort and birth custody, repeated recovery, active independent lives and corrupted receipts. test/council-recovery-journey.test.js covers the full 57-year natural founder lifecycle, exact post-handover replay, earned sealed coins, equal-timestamp membership and empty-ledger legacy migration. The served-browser proof exercises the actual review and handover controls.

Independent career lifecycle and sealed records

career-aging.js manages per-character lifecycle arithmetic and natural death under career agingVersion: 1. Migration initializes life index one and an empty ended-life map without changing people or goods. Existing recorded ages begin tracking at migration; already elderly adults get one year. The clock advances on the adult's own daily checks at 24 village days per year, with warning age 80 and death at 85. careers.js excludes dead records from scheduler deadlines and processes death before same-check work, meals and walking.

Death moves unused work inputs back into the deceased adult's inventory and records the interrupted order and exact sealed estate; normal production/received/used/given conservation still applies. Journey termination retains its real route index and location with endedAt and no next step or invented arrival. The adult was removed from the origin cohort at claim time; death does not remove another resident or worker. A version-three personal career carries an optional exact community-birth key, with version-two saves migrated to a null link. New age-known claims preserve the birth date and age through local departure or waystation selection, then close the same birth receipt on personal death. Restore validates both ends of this link, its source and chronology; old unresolved career custody is not reconstructed. continuity.js rejects embodiment of a dead independent character while preserving the actual public office and household death chapters.

New continuation archives the complete dead career in careers.ended[accountId], advances the life index and claims another actual source civilian into an empty ledger. Identity is wayfarer-account for the initial adult and gains the life-index suffix thereafter. Archive ordering, character identity, lifecycle/death dates, interrupted inputs, sealed-goods equality and journey state are validated on restoration. Living careers resume without reinitialization. Forecasts use the same copied-engine lifecycle and private ledger; regional warnings and the Family panel respect the account's existing access. Sealed estate claims, starvation mortality, personal combat and wider NPC life simulation remain outside this implementation.

About this reference

This part of the wiki is for contributors, server operators and readers interested in how the game is built. It contains architecture, persistence, catalog provenance, hosting, implementation status and design documents. For rules, costs, controls and practical help, use the Gameplay guide.

The source library preserves complete documents, including historical decisions and proposals. The living world design is the primary design entry point; newer implementation entries can supersede earlier milestone descriptions. A sample interface or a listed design target is not proof that a mechanic has been delivered.

Simulation and persistence

The server is authoritative. Clients submit revision-bound commands; previews and forecasts do not mutate live state. Accepted commands have durable receipts so retries cannot duplicate payments or rewards. Current character, ownership, office and agreement permissions are validated at the command boundary.

Persisted world state, scheduled events and bounded offline catch-up preserve accepted work across reloads and server restarts. Generated geography remains the origin beneath sparse mutable vegetation, land use, deposits and structures. Multi-cell occupancy derives from structure footprints rather than painted assets.

Read the multiplayer architecture and living world design for the protocol, persistence, scheduling and migration contracts.

Field casualties and military custody

knowledge.js adds Army campaign-planning after Standing infantry service, Scouting and Field logistics. military-assistance.quote accepts an optional cautious contact stance only with its active barracks program and an actual home tool; ordinary relief quotes remain unchanged. CONTROL_MILITARY_ASSISTANCE acceptance debits that tool once alongside existing food and depot funding, then records contactStance: cautious and planningTools: 1 on the bilateral agreement. Old records omit both fields. Restore rejects an unmatched stance/payment, unaccepted stance or donor without the learned technique. At the outward step immediately before entering the camp, military-assistance.step evaluates professional-service.power on the next-step equipment/fatigue and actual camp cell. A weaker cautious force records an owner-scoped observation in both defense histories and calls the existing physical withdrawal path with no battle, casualties or archer volley. A strong force proceeds to the existing quarter-day contact and field-combat.resolve. Later suspension of the planning instructor does not rewrite a paid accepted stance; ordinary scout, quartermaster, consent, transit, provision, wage and hazard gates still run. This does not authorize combat outside the specific accepted camp.

formations.js adds the Army formations knowledge node after Drill and Standing infantry service. ORDER_MILITIA_FORMATION is an owner-authorized, revision-bound home order for a ready trained unit with at least four unwounded soldiers and active instruction. Each change debits four food and one tool with protected food and public-budget checks. The unit's optional version-one formation stores doctrine, order time and ordered cohort size; old saves without it remain neutral. Restore rejects unknown doctrines, implausible timestamps and a current unit larger than the ordered cohort. Reinforcement removes the order. professional-service.power multiplies its existing strength by a terrain and readiness factor at actual contact: shield wall is 1.25 on open defense and 0.9 on field attack; loose files is 1.2 on moderate-woodland field contact and 0.9 on open defense. All other cases are neutral, including fire, lost instruction, fewer than four unwounded soldiers, condition or morale below 50 and fatigue at least 80. Shared patrol/relief and guard/escort call sites therefore use the same current terrain and unit state; no new soldiers or supplies are minted. Broader combined formations and campaigns remain planned.

community-births.ageSoldiers runs on the home village daily check for ready, training, reinforcing, refitting and professional-training units, plus patrols, corridor guards and convoy escorts in their active or returning phases. The age-known service and cohort close once; population and mobilized strength each lose one, while civilian labor does not change. Stalled reinforcement updates its prior-soldier or recruit side, paid kits and weighted condition, and becomes ordinary training or ready service when one side reaches zero. A professional term active at death cancels, keeps earned days, refunds escrow and links oldAgeDeathId; historical fitting counts reconcile through the shared death count. Archer ammunition replays a distinct old-age quiver entry, reducing up to six carried arrows and one member's capacity at the actual location. Version-one ready-only receipts migrate through versions two, three and four to version five; version-two home receipts acquire null route fields, and version-three receipts acquire a null guard field, and version-four receipts acquire a null escort field. Patrol receipts retain the route and index; guard deaths also snapshot the assigned post, deadline and protected-crossing history. Restore cross-checks the death, route cell, birth service, cohort, contract, fitted kit and ammunition custody. A guard that falls below the surveyed threat strength withdraws physically after losing protection; a stronger survivor keeps the original deadline. Historical returned guard records remain with the unit but do not mark later home deaths as guard deaths. Linked field-supply troops use the version-eight transition above.

community-births.soldierOldAgeAt derives the earliest raw age-85 timestamp from active birth keys; requireSoldierAgeWindow rejects a planned finish at or beyond it. Recruitment and reinforcement check selected known civilians at the two-day training finish, and reinforcement checks existing members. Server quotes for patrol, guard, escort, local/remote and allied garrison, hosted relief and paid professional terms call the same gate. Standing garrison creation and food-allowance increases additionally bound the funded meal horizon. The owner projection exposes only the earliest timestamp, never the birth key. This guards new commitments; the separate daily death transition handles home soldiers, unaccompanied patrols, local corridor guards and convoy escorts, and unexpectedly delayed linked field-supply holds now receive coordinated death accounting.

field-combat.js resolves actual offensive patrol and relief contact after eligible archery fire. Defense combatVersion: 1 and permanent loss receipts conserve population, mobilization, carried food, fitted kits and ammunition. Unit roster totals reconcile enlisted residents minus cancelled recruits and fatalities with current soldiers. Military cohortVersion: 1 records each exact age-known enlistment by service ID alongside the unit's active birth keys; the birth receipt keeps its matching service history. Recruitment and reinforcement select age-unknown adults first, cancellation and demobilization return linked survivors, and fatal contact consumes age-unknown roster places first, then closes the most recently enlisted known birth keys when deaths exceed that anonymous remainder. Same-timestamp cancel/re-enlist actions receive distinct IDs. Restore cross-checks unit rosters, birth histories, ordered service periods, physical location and loss receipts; old units migrate to empty known-adult rosters without assigning ages. Public events and map chunks expose a known-soldier count instead of birth keys. The owner's City unit projection derives recorded ages at the last completed village check, while recruitment/reinforcement quotes select anonymous adults first, show the oldest selected known age and reject a known candidate aged 85 or more. Birth-linked soldiers at home, on unaccompanied patrols, on local corridor guard duty, on convoy escorts or on owned fortification watches now receive an age-85 death check; linked field-supply holds now receive coordinated accounting. The daily needs calculation adds the elapsed pre-contact demand of fallen residents to the current living count; already consumed travel meals therefore cannot replace surviving household meals. Legacy accepted trips receive contact policy one; a new patrol/relief acceptance sets policy two without retroactive losses. New recruit formations remain two/four/six; odd surviving cohorts can reinforce to those sizes.

Fatal contact cancels the active professional term, retains earned daily wages and refunds remaining escrow. Historical contracts/fittings keep original counts; casualty receipts prove reductions. Archer custody replays capacity from the original fitting through volleys, loads and linked casualty entries, including zero remaining arrows. A destroyed relief force ends at destroyedAt, with no fabricated returnedAt, and releases hosted reserves through the existing capacity-aware depot path. Surviving relief units retain physical return and original agreement commitments. Read-only city projections and briefings expose losses without granting foreign warehouse access. Named household civilians remain outside army recruitment.

Invited resident lifecycle records

resident-lives.js migrates membership ledgers through version three, adding a nullable communityBirthKey without inventing a link on old saves. When a legacy save lacks its continuity container, an empty version-two or version-three membership ledger can restore its matching marker without granting a resident. community-membership.js claims and releases the same birth key on accepted invitations and departures; birth and membership validators cross-check location, starting age, ordered periods and death closure. resident-aging.js owns per-character lifecycle arithmetic under membership agingVersion: 1. community-membership.js initializes it after resident-life migration, validates its dates/age/death evidence and advances active residents at actual community daily checks. Each clock records its source, start, initial age and full years. Twenty-four village days form a year; old age is 85 with warning age 80. Acceptance uses a single timestamp for the initial age and term; work renewal does not touch the lifecycle. Unmarked old saves receive migration-origin clocks at their existing age without retroactive simulation. An already elderly adult receives one full year. Historical left/dead records keep their last recorded age; leaving releases the civilian from individual tracking while a linked birth record retains its identity and past membership.

Resident mortality precedes founder-household continuity and specialist training at the same daily check. Natural death wins over simultaneous critical illness, removes one person and civilian worker, and reconciles actual labor without initiating host succession. Accepted work receipts remain historical; membership status denies future authority. Forecast summaries include resident identity/age/status/cause and report actual deaths on the copied engine. Host projections, resident continuation history, regional attention and factual briefings expose only their existing authorized scope. Restore and replay checks cannot reset an accepted clock or let former-life commands control a later adult. Independent-career aging is implemented above; unnamed/NPC aging remains unfinished.

Household lifecycle and named specialist records

household-aging.js advances named household ages on authoritative village checks: 24 four-hour village days per lifecycle year, warnings from 80 and old-age death at 85. Existing unaged saves start tracking their recorded ages at migration. continuity.js distinguishes relative death from ruler succession, preserves pending public handover chapters and reconciles actual residents and labor. Personal coin estates use historical ages and ordered death chapters, including deaths at one timestamp.

specialists.js owns version-five founding-household training ledgers, guarded by specialistTrainingVersion. Neutral migration creates empty courses, qualifications, appointments, backup plans and succession receipts; version-one saves gain only empty backup fields. A course holds paid materials, one named learner, integer progress and the next eligible full-day timestamp. Each stage invests cumulative rounded shares of the fixed cost. Cancellation uses ordinary storage-aware resource credit; rejected overflow rolls back with the command. Qualification proofs retain course identity and exact paid-stage data; the latest thirty course receipts record completed and cancelled courses. Appointments require matching qualifications and enforce one role per adult. SET_SPECIALIST_SUCCESSOR and CLEAR_SPECIALIST_SUCCESSOR require the same current founding-household authority and retain one living qualified, unassigned backup per named incumbent. Backup designation is exclusive with another appointment or course and costs no material. An optional planSuccessor on FUND_SPECIALIST_TRAINING stores the currently appointed incumbent ID in backupIncumbentId; invalid or foreign choices reject before resources move. At graduation, the course first records its paid qualification, then creates the ordinary successor entry only if that same incumbent is still living and appointed, no backup has intervened, and the graduate is free. Version-one and version-two courses and receipts migrate with a null instruction; marked version-three records validate the identity and field. This individual course instruction adds no automatic funding or active-post appointment. SET_SPECIALIST_TRAINING_PLAN authorizes a per-node cumulative one-to-twenty course limit with current founding-household authority and a living incumbent. Version-three ledgers migrate with empty trainingPlans; version-four plans gain recruitLearner: false on migration to version five. After continuity and community-birth checks, specialists.advance completes current course work then checks standing plans in node order. A qualified free adult is designated without payment; otherwise the youngest free living household worker starts a course only when mentor, Literacy, school, labor, finite materials, public timber budget and a two-day food buffer qualify. If no named worker is free and the reviewed plan has recruitLearner: true, the same check first verifies those course conditions plus current lawful human rule, an empty household place and an unclaimed local civilian. It then uses the ordinary adoption ledger at the exact village-day timestamp to name that existing worker and immediately funds the course. Failed checks and authorizing the flag alone change no household or goods. Funding uses the same cost, personal course ledger and warehouse-history path as manual work, increments the retained course count once and records the incumbent for graduation. Pausing retains paid courses and spent count. Restored plans validate node, authority-era timestamps, course limit and cumulative count; daily/offline processing uses the same check. Release or manual replacement clears the plan.

Knowledge worker accounting includes a running learner. Institution and population reconciliation can block the course and release that worker. The village scheduler resolves continuity and death before advancing the course, preventing a deceased trainee from graduating at the same check. continuity.die asks the specialist ledger to transfer a named post to its preauthorized backup only when that same adult is still alive, under the age-85 boundary, a civilian worker, qualified and free. A backup death removes its plan; absent eligibility leaves a real vacancy. The transfer stores a bounded receipt and happens before service reconciliation. Knowledge upkeep, food balances and supply-chain consumers share the same 0.75 multiplier for a named appointment; normal worker counts and all other service gates remain. Forecasts run this state on a copied engine rather than inventing graduation or savings. Private family details do not extend delegated production permissions.

These records cover named founding-household adults. Anonymous service staffing remains available, and existing saves gain no free qualifications. Regional specialist travel, recruitment, broader institutions and wider NPC lifecycle systems require further work; invited-resident aging is implemented separately above.

Catalog provenance and legacy fields

The gameplay reference tables are built from the startup-validated catalog bundle without creating or advancing a world.

Construction work is an effort quantity rather than real minutes. Runtime quotes apply staffing, construction support, reserves, active services, terrain and rights. Catalog quantities do not bypass those checks.

Some development-area data retains legacy abstractions: a town house has a laborCapacity field, while chartered-village rules grant four housing places without creating residents. haulage is legacy construction support, while stored tradeGoods from old fish-market batches remains an explicit legacy inventory type. Neither is interchangeable with physical handcarts or communal coins. The fish-market recipe itself is retired through fishMarketVersion: 1: old production times, priorities and mandates are archived without changing inventory or past receipts. New sales require a staffed, operational market, actual dated preserved fish, two carriers, provisions and a finite buyer fund. The separate marketFishVersion: 1 cargo ledger conserves each batch's remaining, spoiled, delivered and returned amounts through dispatch, expiry, recall, exchange and unloading; malformed custody rejects on restore. Buyer coins are held at departure and credited to the communal balance only after physical return. This is a conditional trade use in the supply graph, not an automatic workshop recipe or a material output.

Implementation status and planned systems

The M0–M8 foundations plan remains incomplete. Some bounded systems are delivered, including production offices, military passage, coin wills and shared well conduits. These do not imply that the entire politics, war, inheritance or water-engineering design is complete.

Open design areas include wider diplomacy, territorial conflict and occupation, elections and courts, extensive regional supply networks, major water engineering, fuller personal careers and inheritance, and progressively delegated realm management. Generated-city conversion, bespoke lifecycle artwork and demonstrated large-scale multiplayer capacity are separate engineering and art milestones.

Consult the implementation ledger, foundations plan and living world design for exact evidence and boundaries. Historical test totals describe their individual checkpoints, not a cumulative result for the current release.

AI factions — full design

Design status: the faction identities and roles are the current design direction; independent faction controllers, polar quest access and major-faction campaigns are not implemented. Names, exact territories, quest rewards and combat values remain proposals. Existing governors, production, trade and continuity provide foundations, not a completed AI society.

The complete design is published in two unabridged wiki documents:

• Neighbour Houses — full computer-controlled player design: neutral personalities, authority roles, player encounters, contact-panel layout, decision scoring, knowledge limits, relationships, population, scheduling, persistence, integration stages and acceptance scenarios.
• Major factions — full realm, quest and campaign design: the two polar mage domains, both long quest chains, the Lich King's continental dominion and undead economy, the orc royal dynasty, territorial expansion, faction interfaces, implementation dependencies and verification.

Decisions, authority and persistence

AI here means conventional game automation. All routine faction behavior uses engine scripts, authored plans, state machines, utility scores and seeded personality parameters, with zero language-model inference calls. There is no model agent per faction, settlement or citizen. Economies, trade, diplomacy, military plans, mage quest chains, undead upkeep and orc succession must all work without provider credentials or a local model service. Dialogue and explanations use factual templates by default.

Strategic governors identify goals, bounded planners propose actions, and ordinary command executors apply accepted orders. Independent factions, human-appointed governors and succession stewards have distinct authority. A human's logout grants no new strategic permissions. Every controller uses a filtered knowledge projection and obeys resource, labor, storage, route, charter and attention limits before personality influences its choices.

Decision sequences, policy versions, next scheduled evaluations, evidence and command receipts persist. Seeded decisions and bounded catch-up must produce the same logical outcomes when observed, unattended or restored after a restart. Multiple planners and subordinate settlements cannot manufacture extra strategic attention. Public explanations expose shared evidence, not private enemy inventories or plans.

Quests, magic and royal succession

The Concord's proposed twelve-milestone Long Winter chain begins through inscriptions, neutral scholars and proof sites, culminating in recognition and an audience. A second long chain, The Sealed Compact, earns a scoped trading license. Objectives track actual contributions and artifact custody, with recovery branches for unavailable objectives. The poles share recognition records while retaining separate physical inventories and armies.

Polar defenses derive from established forces and finite ward infrastructure. Undead armies use recorded remains, animating energy, equipment and command capacity instead of ordinary living food requirements. Each eligible remains record can be consumed only once. The Lich King's reconstitution requires a surviving soul anchor, resources and time; destroying every anchor can end its reign.

The horde has a persisted royal lineage, adult heirs and clan interests. Succession retains existing assets, obligations and treaty terms. Disputed inheritance can redistribute forces into competing camps, but cannot duplicate troops, replenish starting wealth or silently erase a caravan's safe-conduct.

Territory, delivery and acceptance

Major powers begin with explicit one-time historical allocations larger than a human starting village. Their later actions still obey the simulation. New-world placement reserves viable human founding areas; introducing factions into existing saves must not overwrite player land. Lich King and horde expansion requires reconnaissance, mustering, applicable notice, travel, siege, supply and occupation. Mage border defense is distinct from an offensive siege of a human estate. Shared newcomer protection and war windows remain binding.

Delivery starts with neutral-house controllers and their economic trial, then adds durable major-faction territory and access, quest evidence, magical and military economies, dynastic succession and supported territorial campaigns. The full documents specify checks for hidden-information isolation, finite resources, quest replay and recovery, border permissions, undead raising, final defeat, succession, safe migration and unattended/restart equivalence. Long seeded trials must establish sustainable frontier pressure and viable human opportunities before broader rollout.

Read the living-world design for the primary decision record and the implementation ledger for what has actually shipped. The complete specifications above are regenerated into this wiki from their repository sources, keeping the full design available without maintaining a separate abbreviated copy.

One-world scale and recommended stack

Proposed architecture; target capacity is not verified. For thousands of concurrent humans and hundreds of AI factions, retain the browser/Canvas client and Node.js 24 runtime, use TypeScript for new server contracts, and introduce PostgreSQL for authoritative durable world data. Separate WebSocket gateways, regional simulation workers and bounded faction planners. Add NATS JetStream with a transactional outbox/inbox when communication crosses processes; keep the database authoritative and deduplicate retries. CPU-heavy jobs use bounded worker pools. These technologies are recommendations, not currently installed infrastructure.

The complete stack recommendation and capacity assessment covers current bottlenecks, one-world ownership, large empires, persistence, Railway deployment, load calculations, validation gates and staged delivery. Current movement load tests do not certify equivalent economic or AI activity. Full-state copying and commit records, a single living-world mutation queue, repeated due-job scans and broad update fan-out need replacement before claiming the target scale.

One world can span multiple geographic simulation owners. A large faction spans regions, with one strategic policy and finite regional budgets; it does not force an entire continent onto one processor. Database-checked ownership epochs reject obsolete writers. Durable custody transfers prevent duplicate armies and cargo. Cohorts and formations bound work while scheduled events preserve unattended outcomes. Player connections route to the right owner without creating separate player worlds.

The proposed test envelope includes 5,000 concurrent humans, 25,000 persistent human identities, 300 AI factions, 30,000 total settlements and 100,000 active jobs, with three major-faction fixtures of 1,000 settlements each. These are test sizes, not world-generation changes or supported-capacity claims. Crowded cities, mass campaigns, command bursts, long-running saves and failed/restarted workers require distinct tests. Proposed gates include durable command p95 below 250 ms within the hosting region, bounded event lag, capacity headroom and conservation through retries and recovery.

Railway is a candidate host for the distributed services. App containers should not hold the shared authoritative save files when replicated. Its volume limitations currently exclude replicas on volume-attached services. Database and broker persistence, backup and failover need explicit infrastructure and restore evidence; ordinary service replication does not provide them. Start the distributed trial in one physical region with simulation sleeping disabled, and choose machine counts from measured workload rather than player count alone.

This recommendation refines the original small-slice advice: keep the prototype simple while preparing its state and command boundaries for migration. It does not require a full rewrite or an immediate live deployment. Current decisions and status are recorded in the living-world design.

Model cost limits and optional assistance

The user requires low model cost and avoidance of large-scale agentic inference. Optional models may help draft reviewed development content, analyze balancing reports or phrase non-authoritative historical summaries. They cannot decide strategy, execute commands, set prices, grant rewards or alter facts. Development output is reviewed and versioned before use; any runtime prose uses only information permitted for its audience and has a complete template fallback.

Runtime generation is planned as disabled by default with a zero world-wide budget. If explicitly enabled later, daily and monthly money ceilings apply across all factions and service replicas, with an atomic worst-case reservation before each call. Bounded tokens, finite jobs, low concurrency, evidence/audience-aware caching and no open-ended retries limit consumption. Unknown charges retain their reservations. Quota exhaustion, invalid output or provider failure selects the template immediately without delaying the simulation. This design enables no provider and authorizes no spending.

The full automation and spending policy specifies responsibility boundaries and acceptance checks. Verify zero inference calls in the default full-world workload and identical canonical decisions/outcomes with optional prose enabled or disabled. CPU, database, storage and network costs still require scale testing; inference is not a prerequisite for the world to function.

Verification and test scenarios

The integrated gameplay journey is a command-level acceptance scenario. It uses accelerated construction while retaining scheduled village needs, travel and research. Its times are test settings rather than player pacing promises.

Verification distinguishes normal-command journeys from injected shortage, illness, storage or timing boundary fixtures. Browser reload, saved-state restoration, actual process restart and offline equivalence establish different things; read each milestone's stated evidence and limits.

Hosting and contributing

Use Node.js 20 or newer. Install dependencies with npm install, start the server with npm start, and open http://localhost:3000 by default. The player guide is /wiki.html, guides and tutorials are /wiki/tutorials.html, and this technical reference is /wiki/technical.html. All are static, read-only pages and load no multiplayer client.

Edit docs/wiki/guide.md for player rules, docs/wiki/tutorials.md for beginner/start guidance and practical lessons, and docs/wiki/technical.md for implementation and operational detail. Run npm run wiki:build to regenerate all three pages, the gameplay catalogs and the source archive. Run npm run wiki:check to validate links and detect stale output, and npm run validate:gameplay to validate catalog dependencies.

Update docs/living-world-design.md whenever changing living-world rules, related UI or simulation architecture. Keep engineering notes, test reports and code paths in this technical reference. The player guide should explain what the player can do, what it costs and how to recover when an action cannot proceed.

Wiki synchronization is part of every gameplay change. Update the relevant authored guide, tutorials and living world design in the same commit as the behavior change. Revisit Beginner guide, Start guide and Getting started whenever starting choices, founding, controls, staffing, food, early supply chains or first projects change. For an internal change with no lesson impact, record the scoped tutorial review. Check instructions against the implementation and actual control labels, including prerequisites and unavailable features. Catalog generation does not update explanatory prose for you.

Before committing, run npm run wiki:build, stage the updated sources and generated pages, run npm run wiki:changes -- --staged, then npm run wiki:check. The coverage command also accepts --base <revision> --head <revision> for review ranges. GitHub checks gameplay code/interface changes for authored wiki/tutorial edits plus a living world design update, and rejects stale generated pages. npm test checks wiki freshness first; the Railway Docker build also rejects stale pages before deployment. Internal changes belong in this Technical reference; player-facing changes belong in Gameplay and Guides & tutorials. Passing checks proves that edits and generation are present, not that every sentence is accurate.

Keep project files in genuinely local folders under C:/Arkiv/Projects, never under OneDrive. The multiplayer architecture documents deployment and persistence. The source library below includes map rendering, asset metadata, art direction and historical performance reports.

Technical glossary

Finite fortification watch capacities and routes

fortification-watch.js centralizes post definitions and readiness: watchtower 4 soldiers/1 civilian, keep 6/2, castle 6/3, operational at condition 65 without a structural job. garrisons.js applies this gate to quotes, current warnings, withdrawal and persisted capacity checks. Local BFS searches only registered charter cells, validates walking adjacency and unique cells, and limits paths to eighteen steps. Quote food uses the actual round trip, rounded up, with duty plus one return-reserve day within four carried ration-days. Local saved routes validate the home anchor, fort endpoint, intermediate geometry and phase-specific index; a force can now restore while midway outward.

The existing GARRISON_WATCHTOWER command, historical event identifiers and versions 1–5 remain stable. Local short/funded watches remain versions 1/3; owned-outpost versions 2/4 retain their separate bounded arrival refill and daily support. Their post-capacity validator accepts the shared definitions. Allied version 5 remains tower-only under its existing agreements; consent is not broadened. The military projection adds immutable post name/capacity/lookout metadata for UI quotes. The City card exposes these requirements and physical distance.

Tests exercise paid keep construction on actual registered extensions, six-person recruitment and deployment, intermediate restore, two-lookout withdrawal, finite receipts, reserve-safe return, recall/structural custody, malformed saves and chronological/offline equality. Late-game material quantities are an explicit fixture boundary. Castle construction/deployment is now covered by the outer-charter scenario below; a developed outpost keep journey remains unverified. Starter outpost footprint constraints are asserted separately. Fort combat and permanent allied/multi-unit garrisons remain open; owned standing orders are implemented below.

Versioned outer charter plots

charter-extensions.js preserves the original distance-two fringe-v1 release and adds a separate distance-three fringe-v2 release. Both use canonical generated cells and the original excluded starting/base/feature/water sets. Projection exposes release version, radius and registry cost independently of current eligibility. Outer registrations require the existing registrar/office plus active Public accounting, a returned non-expired survey and adjacency to this community's current land. Costs are 12 timber/2 tools/6 food; inner costs remain 8/1/4. The existing command retains authority, world-revision, reserve and budget checks.

The first accepted outer registration upgrades only that settlement's extension ledger to version 2, keeping old entries as version 1. Version-one ledgers retain radius 2 and at most 12 entries; version two permits at most 30 paid entries within radius 3 and must include an actual version-two receipt. No automatic migration grants land. Restore validates release/entry versions, exact costs, reports, timestamps, chronological connected acquisition and the precise derived region/chunk membership. Founding validation still rejects overlapping charter cells. A version-one snapshot and its original offers restore unchanged.

The castle fixture uses paid surveys/titles, a replacement registry, four-person construction, demolition plus salvage, a real seven-cell castle footprint and six existing recruits with three lookouts. Controlled late-game stock is explicitly separate from the production-chain acceptance gate. Offline replay matches paid castle duty and food. Browser checks exercise an additional outer registration, cancellation, acceptance, private projections, responsive views, castle deployment and persistence through actual server restart.

Standing garrison custody and food authorization

standing-garrisons.js provides STATION_GARRISON quoting and AUTHORIZE_GARRISON_FOOD increases. Both require current owner authority and an expected world revision; dispatch uses the usual readiness/route/reserve checks and two attention. Standing duty requires active home Public accounting plus Record keeping. Authorizations add at least one whole group-day of food and retain spent totals, bounded by a one-million-food cumulative ceiling. The central durable command receipt prevents duplicate increases, including after restore. These commands do not broaden allied agreements or resident/delegated authority.

Garrison versions 6/7 identify local/owned-outpost standing custody, with days: 0, until: null and support version 2. Finite versions 1–5 remain unchanged. Shared garrison support records collections, exact cumulative spent, allowance, next collection time and only the latest thirty receipts. Validation binds count, spend, receipt ordinal timestamps, arrival, phase, host, capacity and normal route/refill rules. Null is a standing deadline only for those explicit versions; old arrival/expiry invariants are preserved.

The normal military scheduler consumes carried meals and performs daily collections. Household reserves, operating budgets and professional service expiry apply before payment. The standing funding horizon is the next collection plus the number of whole meals still authorized, capped by wage expiry for forecasts and supply planning. Unfunded remainder cannot buy a partial meal. Loss of services/stock or exhausted authorization stops future collections and retains physical return. Military headcount is unchanged. Return history preserves total spending; while holding, recent receipt details stay bounded.

City projections expose initial 30/90/180-day authorization choices and a thirty-day increment quote. The UI distinguishes authorized food from stock, retains expanded controls across refresh and shows no false zero-day expiry. Regional issues warn at at most three remaining meals or return; new briefing events explain increased ceilings and withdrawal. Tests exercise thirty-five collections, local/remote ledgers, immutable projections, offline equality, durable duplicate authorization, exact professional expiry and succession with actual lookout loss. Graded-outlet receiver flood exposure: major-waterworks-impact.history reuses the candidate interval's no-release simulation, already needed for receiving backwater. After simulating the selected release, it compares only the outlet receiver's closing inundation on the same opening sediment bed. receiverReleaseExposure unions newly wet receiver hexes over the verified window, with bounded display IDs, current public charter claims and existing structure/improvement/project counts; each interval reports its own count. A proposal with any such hex gains release-receiver-new-flood-exposure-recorded, recomputed for capacity and release variants. City shows the exact affected hexes. This isolates water-level change attributable to release rather than all natural-versus-candidate storage effects; it does not model a future design flood, hydraulic channel section, later sediment divergence or grant W3/W4 approval. See living world design, major waterworks plan and player guide. Receiver building pressure under graded release: major-waterworks-impact.history filters current operational or damaged structures to the selected receiver catchment, then calls the shared structurePressure rule on the paired no-release and release candidate simulations with the same opening sediment bed. Positive proposed-minus-closed flood-rate differences accumulate per interval; distinct structure IDs and newly wet usable village-center/camp wells are counted over the window. Public current charter names are reported without foreign condition. major-waterworks.review adds release-receiver-flood-pressure-recorded on positive added points and recomputes it for capacity/release variants; noticeParties includes those charter IDs even if no land crosses the wet threshold. No live water, condition or consent changes. See living world design, major waterworks plan and player guide.

Exact-file AI approval and world artwork

public/asset-approval.js provides the shared 100% approved by AI label and checksum-bound review.aiApproval predicate. Registry maintenance preserves explicit reviews and defaults new records to false. scripts/review-asset-approval.js applies a supplied decision ledger after checking actual approved bytes; scripts/build-approved-world-art.js verifies SHA-256 and regenerates the compact public/approved-world-art.json whitelist. Run npm run assets:world, then npm run assets:check after editorial changes. The October 7 decision ledger accepts 31 available files; it does not promote absent source paintings or derivatives.

The normal Region loader reads this whitelist directly. The art-review loader filters tile/profile variants, connector motifs, atlases, runtime derivatives and structures by it. Landmark selection, image requests and inspector previews refuse unapproved paths. No whole-library metadata fetch is needed by the game. Terrain without a reviewed file and entity stages without reviewed motifs use procedural presentation. Geography, seed identity and saved simulation state stay authoritative; regeneration rebuilds the artwork presentation. The Art Atlas filters at file level and sorts the full matching index before its 48-card batches; unknown size/date values remain last in either direction.

Landmark contact composition

public/landmark-composition.js defines reviewed normalized subject contours for the approved landmark set. The compositor changes alpha only, keeping source RGB/detail and a narrow smooth contact apron; game.js admits approved paths before using it. Region and Hex share the bounded 8 MiB contact cache (2,097,152 pixels at four bytes each). Hex terrain requests use the same approved biome sources; unpainted profiles use procedural geography. Its background and portrait refresh on selection, viewport or source readiness changes. Game script cache revision landmark-blending-2 ensures a reloaded client uses the updated renderer. No generated raster derivative is silently approved. Source checksum approval does not authorize opaque full-ground placement. The whitelist also records allowedProfiles and the required composition; landmark selection requires the actual biome to be in that list. Four incompatible forest/mountain sources were withdrawn, leaving 27 approved files.

Canonical feature and artwork identity

hexLandmarkFor(cell) binds only cell.feature to a semantically matching landmark pool, then checks the manifest biome, exact-file approval, reviewed allowedProfiles and required landmark-contact-1 composition. Region and Hex call the same selector. The former terrain and cell.art.category fallbacks are removed. Natural palms have no settlement portrait; resource deposits have no market fallback. City, town, cottage, farm and ruins pools are separate. Missing approved art returns null and leaves the Hex terrain visible. Hex scene keys include biome and feature, and canvas metadata exposes the feature and selected landmark ID. The visible eyebrow identifies the canonical feature, while More map options separates generated coordinate names from shared artwork titles. Saved world generation and the 27-file whitelist are unchanged.

Continuous regional composition

public/regional-composition.js plans fixed 480-unit world chunks with 64-unit overhang and stable jittered lattice IDs. Region IDs are absent from placement. Cube-rounded axial ownership, coherent density and effective cover/age/disturbance/hazard determine removable foliage. Revision signatures include effective growth fields as well as command revisions, occupied structure identity/stage and art version, so analytical growth also invalidates affected plans. Sparse living cover retains its lowest-ranked world candidate.

game.js depth-orders actual structures and canonical landmark contacts with foliage, suppresses canopy and canonical replacement portraits in occupied footprints, and separates dynamic ground from foreground structures. Quiet canopy bands are cached; a band containing a site retains individual objects for correct overlap. Cache creation and painting happen together so later eviction cannot close a pending image. Plans retain at most 256 chunks; sprite pixels cap at 2,097,152 (8 MiB), canopy bands at 8,388,608 (32 MiB), and the existing changing-ground cache at 8,388,608 (32 MiB). These are separate caches, not a total-memory claim. Viewport source preloading requests only matching visible age/profile/definition/stage.

Region and Hex share the one-hex woodland ground source, world-coordinate phase and global texture lattice indices. Hex uses native foliage sources at close range, includes actual growth and structure state in its scene key, reports a selected structure's stage, and replaces the old structure image rather than compositing both stages. Soft ground washes and contact gradients avoid opaque painted hex plates.

public/regional-art.json declares exact component roles. Editorial decisions in tile-library/region-review-2026-10-11.json bind SHA-256, biome, rendering role, age/stage and, for structures, definition and contact anchor; the ground contract includes reviewed world span. The builder regenerates a 35-file whitelist and nine painted terrain profiles; only forest was added to the prior terrain coverage. Missing profiles/stages remain procedural. Library components are searchable and sortable under Living region components; metadata and catalog visibility never grant artwork approval or simulation permission.

Pure planner, real ZoneEngine command/reload and approval-contract tests cover neighbor overlap, sparse growth, changed-state invalidation, footprint clearance and rejected contexts. The isolated browser fixture uses real canonical coordinates and disposable saved simulation state; its accelerated clock is QA evidence only. It is not shipped. The current world save and geographic generation are preserved. Full reference richness and other biome/building families remain planned. See the primary design and acceptance plan.

Forest contacts and observed-water projection

landmark-composition.js adds bounded forest-shrine and lumber-camp contours. forest-contact-review-2026-10-11.json binds the exact runtime hashes, forest context and canonical-landmark role. Canonical feature selection remains separate from actual constructed structures. The resulting approval whitelist contains 37 exact files; the new script cache key loads the updated contact contours.

src/living-world/surface-map.js indexes registered cells by canonical world chunk once per ledger tick/revision. chunkSnapshot().surfaceWater publishes version, tick, observed interval time, scale 1000, retained amounts and latest positive transfer edges. Copies prevent consumers mutating the ledger. A complete edge with stable surface:from:to identity is included in both endpoint chunks. Registered cells remain available during dry intervals so older wet appearances can be replaced. SurfaceWaterAdvanced identifies registered cells for chunk revisions/deltas, and the gateway subscribes newly observed public water chunks. No rainfall, routing, custody, inventory or private station/account data is added to this projection.

The first trial transfer painter was removed after visual review because scattered runoff became parallel channels. The later observed-moisture renderer now paints restrained damp earth from retained quantities and the latest actual interval; see the observed wet-ground explanation below. Potential drainage topology and historical flow totals are not evidence of current rivers; retained abstract water is not physical pond depth. Real paid station, wet/dry, boundary and save/reload tests verify the data contract. Richer geographic water scenery remains planned under the region goal.

matchesAssetFilters intersects intended compatible profiles with review.aiApproval.allowedProfiles when the approved filter is active. The regression fixture is intended for fields and forest but reviewed for fields, so approved + forest excludes it. The map’s existing biome gate remains authoritative.

Matched settlement source contracts

settlement-review-2026-10-11.json binds fifteen exact RGBA files to regional-structure-1, structure definition, lifecycle stage, anchor and reviewed rendering profiles. The regenerated whitelist now has 52 files and nine painted terrain profiles; this supersedes the prior 37-file count. Commons and community-field sources authorize grasslands only; lumbermill sources authorize grasslands and forest. A canonical fields biome may render as grasslands or hills using regional moisture/elevation, so structure selection checks terrainProfile(cell), not merely the catalog's compatible biome. Unsupported contexts remain procedural.

All three families have separate foundation/frame/operational/damaged/ruined sources. Native anchor contacts stay fixed; foundation interiors expose world-space ground. Food art depicts managed furrows at the construction stage, without adding crop growth, inventory, staffing or yield state. A ready, dedicated damaged source suppresses the generic crack overlay; a still-loading/procedural damaged fallback retains its existing damage marker. Actual occupied footprints continue to remove canopy and canonical portraits.

loadRegionalLibrary fetches the source manifest with approvedWorldArt.version and cache: no-cache; the client release key is regional-composition-2. This avoids stale manifest bindings surviving a new approval whitelist. Normal renderer checks and actual disposable demolition/rebuild/repair jobs verified family selection and saved reload. No live structures, stocks, world identity, construction prerequisites or simulation accounting are altered by the artwork release. Geographic water/shore composition and complete reference-level pilot acceptance remain planned.

Shared canonical geographic shore renderer

public/regional-water.js interpolates saved land/ocean/lake cell values on the canonical triangular lattice, then clips triangles on a fixed 24-world-unit grid. Each 480-unit chunk has stable segment IDs, independent of region identity and view selection. The 72-unit viewport halo includes neighboring contact geometry; plans are limited to 256 chunks per viewport and a 128-entry client cache. Canonical cell centers retain their land/water classification. Geometry is presentation only.

Region composition progressively prepares one chunk at a time and uses one shared half-resolution land mask. Ocean and lake materials use destination-out; land materials use destination-in. This prevents an opaque ocean foundation hiding unpainted land. Inland biome contacts now use normalized canonical triangle weights; see the shared continuous ground explanation below. Coastal Hex uses the same native world material phase and shore mask; its cached image invalidates when neighbor textures become ready.

The exact whitelist has 55 files: 17 atlas terrain, 13 canonical contacts and 25 region components (3 canopy, 19 structure, 2 ground and 1 shore detail). Eleven ground profiles are painted. regional-shore-1 contracts bind allowedProfiles, waterProfiles, anchor and nativeWidth, verified before a source enters the scene. Shore decoration uses stable segment identity and is removed from occupied/reserved footprints. It is not an authoritative water edge or a new resource. Existing observed transfers are not painted as perennial rivers.

Desktop and 390 px mobile reviews covered forest/wetland/upland lakes and ocean contacts. Warm mobile samples were about 4–5 ms; initial source preparation and progressive slices take longer and these samples are not a universal performance guarantee. Tests cover neighboring/reloaded geometry, canonical centers, occupied footprints, exact approval and the actual terrain painter's compositing operations. Review provenance and rejected soil draft are retained in tile-library/shore-review-2026-10-11.json.

State-driven wet earth

public/regional-moisture.js consumes surfaceWater version-1 chunk projections. It selects the latest available completed tick, deduplicates full surface:from:to edge IDs, uses retained quantities for soft irregular earth contact, and permits transfer traces only when observedAt is present and amount is positive. Abstract quantities control a bounded artistic contact intensity; they are not interpreted as physical water depth or permanent stream width. Canonical land geometry clips points before painting; open water and frozen-ground storage receive no wet-soil contact.

Identity is seeded from canonical cell/edge IDs and world coordinates, independent of administrative regions. Zero transfer intervals remove old traces; unchanged geometry and saved reload retain the same positions. The shared plan paints below real land works, foliage and buildings in Region and below subjects in Hex. Surface-only revision changes invalidate the 32-entry plan and eight-MiB image caches, including the Hex ground key. An oversized new image is drawn before cache eviction can close it.

Tests verify exact quantities, latest observation selection, deduplication, geographic clipping, overlapping neighbors, actual paid wet/dry intervals and save immutability. Browser review at desktop and actual 390 by 844 viewport covered wet/dry/wet-again updates and saved reload. The initial source/interval work takes longer than cached painting; a sampled warm mobile region frame was 6.2 ms, not a hardware guarantee. The whitelist remains 55 exact approved image files; this read-only procedural earth layer grants no additional raster approval or gameplay binding.

Canonical relief projection

public/regional-relief.js admits only checksum-whitelisted regional-relief-1 / terrain-relief sources whose allowed profiles, canonical features, contact anchor and native width exactly satisfy the review contract. The two current source images authorize mountain peaks, anchor [0.5,0.78] and width 168. Stable seeded canonical cell identity selects a sorted source list; region ID and camera bounds are absent from selection. The ground anchor sits twelve world units below the canonical center and participates in existing foreground depth ordering. Actual occupied footprints suppress decoration. Scenery never mutates the world kernel or resource definitions.

game.js requests relief only for relevant viewport peaks. Region caches 256-pixel sprites in the existing bounded shared eight-MiB cache; Hex draws native sources. Its full-viewport foreground canvas and container now share ground dimensions and transform. Selected ridge width expands the local world span, so the broad image fits instead of being cut by a 512-square intermediate. Neighboring geographic materials still come from the canonical world/shore compositor. Source readiness remains part of the Hex invalidation key.

The exact-file whitelist contains 57 images; ground remains eleven of eleven profiles. Three classic mountain sprites failed this seamless-role review because their oval ground bases stayed visible at enlarged scale, and remain unapproved. Focused tests cover canonical placement and variety, occupancy, overlapping neighboring views/reload, exact feature/biome/scale/anchor contracts, native alpha painting, and the actual Hex ground/foreground projection. The unchanged settlement, canopy, moisture and shoreline renderers were checked as affected regressions. Source/prompt lineage and decisions are retained in the relief review ledger and granite-ridge prompt files.

Canonical working-land renderer (implemented). public/regional-working-land.js paints saved land and currently projected outlet/offchannel records in world units: irregular clipped low-opacity soil contact, seeded furrows, terrace contours, road half-edges, directed local earth-channel stubs, reserved stakes, dry lining/controls and lift-count foundation courses. Geometry uses canonical plot identity and fixed world widths, without a camera/region salt or simulated water. Local road half-edges meet at the exact midpoint of the authoritative usable neighbor pair. Irrigation/drainage stubs are bounded to 0.96 hex radius so an endpoint relationship cannot invent a long surveyed route. The existing observed-moisture pass supplies actual wet contact.

The Region dynamic cache continues to key on chunk revision. Hex selects nearby saved renderables with a two-radius halo, includes relevant chunk revisions in its scene key and paints the same records under foreground objects with the same ground transform. Fallow operational community fields skip crop sprites and paint only their small built boundary; this does not mutate the structure stage or output calculations. No new source image is admitted: the exact 57-file whitelist remains unchanged. Engine tests exercise paid road construction/removal, paired drainage/basin construction/removal, immutable geography and exact saved rendering after reload. Existing knowledge, tools, staffing, costs, reserves and paused-project rules still govern completion.

Shared continuous ground (implemented). public/regional-ground.js constructs stable faces on the canonical axial triangle lattice. Each native land vertex contributes its own material with barycentric weights; profile weights sum to one. Complementary mask coverage and premultiplied material contributions use additive compositing in a temporary foundation, then the existing geographic land mask clips it once. Water vertices extend only the nearest land material within their own triangle, so the geographic shore painter still owns the exact water domain. Profile sampling keeps its native world texture phase. The former inland irregular-mask gaps no longer expose the coarse continent preview between approved ready land materials. Mixed-terrain and coastal Hex use the same plan and projection as Region.

The temporary ground canvas is limited to 4,194,304 pixels and immediately released after finishing. Plans accept at most 16,384 input cells; an extreme viewport falls back to the existing painter rather than throwing. Existing source readiness, image budgets and scene caches remain in force. regional-composition-2 changes the canopy lattice to 32 units with fifteen steps per unchanged 480-unit chunk, and samples balanced mature-source variants. Actual cover/maturity, stable sparse survivors, occupied exclusions and revision invalidation remain authoritative. Decorative placement changes with this renderer version; saved vegetation identities do not. The client release key is continuous-ground-1, the new ground module key is 1 and the canopy module key is 2. No artwork approval, geography, simulation, costs or commands change.

Combined pilot and exact registry stage contracts

'regional-art.json' adds five native 1254×1254 RGBA registry-office sources. Each is bound to one actual lifecycle state, 'registry-office', the reviewed 'grasslands' rendering profile and anchor [0.5, 0.8]. The generated whitelist contains 62 checksum-verified files. 'registry-office-review-2026-10-11.json' retains contextual decisions; original generation paths and exact prompts are preserved. Name changes cannot substitute a different building definition or grant gameplay permissions. Unsupported contexts remain fallback.

The consolidated review uses one saved ZoneEngine village: funded soil/irrigation/paths, real research/registry/runoff survey and monitoring, planted woodland, actual harvested logs processed into timber, genuine shortages, maintenance, damage/repair and paid rebuild. The production renderer and whitelist are used after removing the isolated candidate preview. Latest positive edge amount, retained quantity and geographic clipping remain the moisture inputs. The same canonical ground faces, scenery IDs and shore contacts cover neighboring views; source, scene, sprite, canopy, dynamic and moisture caches retain bounded budgets. Review evidence is in 'docs/regional-review/acceptance.json'; further biome/stage source families remain planned.

Complete regional landscapes — new active goal, October 11, 2026

The new regional completion goal requires all six outstanding presentation areas, not another isolated pilot. The initial derived coverage audit reads all STRUCTURE_DEFINITIONS and expands legal fields into fields/grasslands/hills rendering profiles. Only exact production structure contracts count; manifest registration, intended compatibility and operational artwork reused for damaged state cannot close coverage. The inventory is separate from native/context/lifecycle visual acceptance, authoritative state validation and live deployment. No simulation, persistence or renderer behavior changes in this planning/audit increment.

Current landscape contacts and canopy species (October 11, 2026)

regional-composition-3 selects conifer or mixed-broadleaf canopy by actual vegetation context, with cold implicit forest matching the engine's temperature threshold. Exact species and foot-anchor approvals are mandatory for explicit conifer sources. canopyContact preserves native aspect in both full images and reduced sprites; the cache uses the actual above-root bounds. Source choices and source records are reused during a redraw rather than searched per tree. Natural edges sample six canonical neighbors; stable candidate ranking includes the edge weight, preserving surviving identity through paid clearing and regrowth. Missing-neighbor readiness participates in plan invalidation. The client release key is regional-landscape-1; canopy module key is 3 and landscape module key is 1. This supersedes the earlier pilot version paragraph.

regional-landscape-1 uses a separate 48-unit world lattice, coherent detail clumps and a 256-chunk bound. Its source validator checks materialKind (foliage/mineral), exact profiles, natural features, wild/regrowth states, native width and contact anchor against the checksum-backed whitelist. Foliage responds to actual burning/clearcut and low forest cover. Native open ground with speciesGroup=open can retain decorative low scrub without adding tree cover. Mineral contacts remain geological detail after canopy clearing. Both are excluded from occupied and worked footprints. No entity, yield, site, watercourse or command is created. Region and Hex share placement and the existing sprite/source budgets.

Six new native sources bring the whitelist to 68 files; exact landscape context is limited to forest/grasslands and conifer canopy to forest. The audit calls the production landscape validator, including material and lifecycle fields, rather than a partial duplicate. Evidence and source hashes are recorded in docs/regional-review/landscape-increment.json and tile-library/landscape-review-2026-10-11.json. Actual mature conifer geography and phone views are distinct from the labeled native age illustration study. Paid clearing/planting/construction/reload regression uses the existing warm woodland. Full cold settlement lifecycle and worldwide performance remain open; the sampled warm desktop result is not a universal frame-time claim.

Live verification of 7cc8d4e confirmed exact renderer text after CRLF normalization, all 68 source hashes, healthy service and preserved world/instance identities. The immutable library script is versioned landscape-context-1 to deliver the landscape description branch to returning browsers. Captured review photographs retain their actual JPEG bytes and dimensions.

Terrain detail and observed-water contact release

The current client key is regional-terrain-details-2, landscape module key 2 and moisture module key 2; the library key is terrain-detail-context-2. These supersede the preceding increment's cache keys. regional-landscape-2 validates against the stable regional-landscape-1 source contract. Exact approval now covers 73 native files. Five new low details and narrowed scrub fields/hills and stone mountain extensions bring natural detail presence to 11/11 rendering profiles. The actual Region/Hex desktop and phone evidence, canonical coordinates and original native hashes are in docs/regional-review/terrain-detail-increment.json and tile-library/terrain-detail-review-2026-10-11.json. Dark arctic slate remains rejected. No full-goal gate closes from this inventory.

water-surface joins foliage/mineral as a separately reviewed material kind. It accepts only wild ocean/lake and feature none. All six canonical neighboring cells must be loaded water; missing neighbor readiness participates in cache invalidation. It never creates a bank, water quantity, current or gameplay entity. Natural declared features have one owning-chunk anchor with exact feature/profile/state approval, still suppressed by actual occupation/worked ground and applicable vegetation disturbance. drawVegetationState excludes ocean/lake and treats low cover as a forest scar only; actual burned land remains meaningful.

surface-map adds read-only junction records derived from the complete latest positive observed edge graph. Both endpoint chunks receive the same normalized tangent and maximum incoming/outgoing quantity. Edge identities and amounts remain intact; junctions retire with stale/dry intervals and reconstruct from saved state without entering water accounting. regional-moisture-2 uses these for cubic damp-earth contacts with exact shared endpoints, keeping the old curve fallback for older projections. Restricted-neighbor and paid wet/dry/reload regressions exercise the contract. The local phone monitor review covered wet ticks 110–114 and saved reload; dry/resumed UI, engineered works and broad performance acceptance remain open. No permanent river is inferred from accumulated flow.

Native rural place routing uses public/regional-places.js and the regional-place-1 exact-byte contract. The separate canonical-place role requires reviewed actual features, terrain profiles, sole existing presentation state, native width and foot anchor. The selector sorts eligible source IDs and hashes world seed plus canonical cell ID plus feature; planning-region IDs, camera position and source-array order cannot change the result. Fields/grasslands/hills are resolved from the actual whole-world region profile, rather than treated as interchangeable approval. Current village/cottage/farm pools contain two distinct native PNG layouts each; legacy gated portraits remain only where a reviewed native family is unavailable. Region and Hex paint the unchanged native source at its original aspect ratio, with the same shared world foot. Active authoritative structure footprints suppress the static illustration. Small-screen Hex framing reserves space for map controls. Native gaps retain shared ground without the legacy contact mask. This presentation does not mutate geography, player saves, entities, inventories or simulation accounting. The whitelist contains 79 exact files; only the six newly reviewed rural sources have this new contract. The other location and building contexts remain incomplete; see rural review evidence ../docs/regional-review/rural-place-increment.json and the primary living-world design.

The urban increment extends existing regional-place-1 canonical-place contracts with six native exact-byte sources: town street/square, city ward/gate quarter and castle courtyard/round keep, reviewed only on fields, grasslands and hills in existing canonical state. All twelve released rural and urban sources retain original aspect ratios, foot anchors and transparent gaps. Source selection remains independent of region borders and camera position; authoritative occupancy suppresses the static source. public/game.js labels canonical town as Town without inventing fortification state. scripts/regional-location-coverage.js enumerates actual kernel cells using whole-world region averages for fields/grasslands/hills and records both stable variant buckets where they exist. Its refreshBindings operation re-evaluates exact accepted feature-bound sources against preserved geography; unapproved candidates, generic species pools and mismatched states are not counted. The retained census covers 2,252,800 cells, sixteen feature types and sixty-two feature/profile contexts, with nineteen contexts containing two exact native sources. This is an inventory audit, not full visual acceptance. See urban evidence ../docs/regional-review/urban-place-increment.json and location coverage ../docs/regional-review/location-coverage.json. The whitelist contains 85 exact files; geography, saves and authoritative simulation rules remain unchanged.

regional-landscape-3 replaces coarse land-detail density blocks with two smooth fields sampled at fixed canonical world coordinates (432 and 192 world-unit spans). The fixed 48-unit candidate lattice, 480-unit chunks, source geometry and 256-chunk limit remain. regionalSceneryContext copies canonical cell moisture/elevation; detailDensity uses these only for presentation and revisionKey binds both, so a changed context retires an old plan. Open-water scatter retains its previous density and placement plus six-neighbor geographic safety checks. Natural feature anchors remain independent of incidental scatter. The unchanged woodland-floor-v1 PNG now has an exact regional-ground-1 approval and manifest spanHexes of 3, replacing the earlier one-hex calibration; complementary native material masks preserve shared phase across boundaries. The current whitelist remains 85 exact files. The meaningful regression covers shared coordinates across chunks, moisture density nesting, unchanged state, sparse exclusions, actual paid in-memory clearing/planting/construction/reload, ground contact and bounded cache reuse. Browser review retains eleven profile Region/Hex desktop/phone pairs and four connected views at ordinary/close zoom. These scoped checks do not close the full-world performance or scene-quality gate. See living world design and the active regional completion goal.

Six site sources extend the existing regional-place-1 contract without changing world-kernel geography or selection logic: ruins columns/walls and magic waystones/floating stones on fields/grasslands/hills/forest, resource strata/boulders on those profiles plus wetlands/mountain/desert. Built-in image_gen extracted four subjects from recorded library originals and generated two natural rock variants with a recorded style reference; the native output bytes and alpha are preserved. Per-file reviews bind exact SHA256, feature, profile, existing state, native width and foot anchor; no new structure or operational stage binding exists. The review retains30 real source/profile cases and120 source-specific ready desktop/375-CSS-phone Region/Hex captures. One transitional wetland phone frame was replaced. Page reload retains the forest resource variant and the backed-up disposable simulation save remains byte-identical. The world census updates exact approved bindings to34/62 contexts with two sources, while full stage coverage remains30/835. Source cache observations peaked at252/256MiB with five evictions; region cache9.8/64MiB and canopy32MiB. Cold scene build reached1233.7ms and max slice88.7ms; these samples do not establish worldwide performance acceptance. The whitelist is91 exact files. See site acceptance ../docs/regional-review/site-place-increment.json and location census ../docs/regional-review/location-coverage.json.

Graduated canonical bank rendering

public/regional-water.js version regional-water-2 keeps the existing canonical triangular shoreline plan. contactPlan groups exact ocean/lake segments by their actual land terrain palette; paintContact batches five bounded, overlapping native strokes per side. Soil is clipped to the canonical land path; shallow-water contact uses the complementary even-odd water path. Both Region cache construction and Hex ground construction call the same painter. No image bytes or context approvals change, and no region identifier selects geometry or palette. Bands sit below authoritative land/occupation layers. The72 actual renderer captures cover nine land profiles and connected coast approaches at1280/375CSS widths, Region0.3082/0.5617 and Hex. The26 scoped checks include side clipping, shared geometry, current wet/dry observation intervals, real in-memory paid state/reload and bounded caches. Bank evidence ../regional-review/connected-banks-increment.json records the acceptance limits; full landscape, water-state and worldwide performance gates remain open.

Canonical ridge masses

public/regional-ridges.js implements regional-ridges-1: fixed world chunks480, spacing240, irregular deterministic offsets, a shared672-unit density field and canonical elevation. Sources require an exact geographic-ridge role, mountain-only profile, natural none/peaks features, width336 and native anchor[.5,.8]. Every candidate tests15 physical contact points against mountain geography and real occupied/worked cells. Plans retain all read cells and unresolved neighbors; changes in occupation/land works or newly available geography invalidate cached plans. Vegetation clearing leaves geology intact. Camera/region ownership never selects or rotates sources. Region plans are LRU-bounded256; native sprites share the existing pixel budget and source preloads include the ridge role. Hex uses the same world coordinates; small-screen framing shifts ground, water, works and foreground together.

Four exact native PNGs were accepted after68 actual desktop/phone source/contact and connected-scene captures, including corrected mobile framing and replaced loading-stage captures. Original bytes, source/reference provenance and full prompts are retained. The separate contract preserves the earlier rare-peaks relief approval. No generation seed, geography, authoritative save, simulation command or resource inventory changed. Local bounded caches/reload observations are evidence for this increment, not worldwide performance acceptance. See review evidence ../regional-review/ridge-mass-increment.json; all six full-goal gates remain open.

Shared woodland masses and native crown forms

regional-composition-4 retains 480-unit world chunks, now using 12×12 jittered candidates at spacing 40 and conservative 192-unit overhang. Smooth fields at spans 672 and 176 modulate spatial woodland density independently of region membership. Candidate rank, source variant, position and mature width remain seed/world-coordinate deterministic. Cover scales the acceptance threshold; real clearing/fire and occupied-root cells remove samples. Natural forest edges taper through canonical neighbor queries. Retained sparse living regrowth remains visible without moving its roots; newly arrived geography invalidates affected cached plans.

Mature widths are 84..128; young/sapling widths are 64..84. Single-crown selection applies to mature mixed-broadleaf vegetation, while conifer and other age selection retain their matching source families. A declared canopyForm requires matching exact-source review and survives generated whitelist construction. The new oak has native root anchor [0.5,0.9]; grouped sources retain their existing reviewed contacts. Aspect and native alpha are preserved. Source-choice cache keys include crown form, so a prior group choice cannot poison the single-crown path. Portrait scale includes the selected conservative crown extents. Evidence: docs/regional-review/woodland-hierarchy-increment.json. Approval certifies these source/context projections only; full-world visual and performance completion remains open.

Exact structure stage and terrain contacts

The production structure painter uses GonzRegionalComposition.structureContact to retain native aspect at width110 and the reviewed root anchor, placing the anchor at local ground y18. Existing square originals retain their former coordinates. Source acceptance still requires exact checksum, regional-structure-1 composition, structure role, definitionIds, states, allowedProfiles and matching anchor. The forest-lodge-v2 contract narrows to operational; forest-lodge-damaged-v1 is a separate native transparent PNG for damage. Only ready dedicated damage imagery suppresses the procedural damage marker. Unsupported stages/profiles retain fallback and saved fallow fields bypass crop imagery.

Twenty-five native structure files now cover fifteen legal profile contexts and seventy-five stage/profile contexts across the five art-bearing definitions. scripts/regional-coverage.js still audits all44 definitions and835 requirements. scripts/review-structure-contacts.js replays labeled read-only source/ground illustrations using extracted production painter functions and actual canonical terrain coordinates. The thirty desktop/phone sheets in docs/regional-review/structure-context-increment.json establish exact source/contact acceptance; they do not exercise persisted paid browser commands or certify rich live neighborhood scenes. Real paid in-memory lifecycle/save tests and non-square renderer regression assertions are separate evidence. Full-goal completion remains open.

Native housing/storage lifecycle bindings

public/regional-art.json adds25 structure sources for storehouse/elevated-storehouse/town-house/timber-house/stone-house, each with one exact stage and all four legal rendering profiles. Native originals are byte-preserved; housing-storage-prompts.json records prompts, reference roles, dimensions, anchors and checksums. The exact approval ledger is tile-library/housing-storage-review-2026-10-12.json. Production uses its existing structure painter, native aspect/contact helper and checksum/profile/definition/stage gates. Loading, early work sites and unsupported terrain retain procedural fallbacks. Manifest fetching already keys its URL to the current approval version.

Forty actual desktop/phone capture sheets in housing-storage-increment.json review100 source/stage/profile contacts, separate from saved world state. test/regional-housing-storage-lifecycle.test.js verifies the production painter, unsupported/loading cases and funded engine construction/repair/rebuild with reload at foundation/frame/operational/damaged/ruined. Its helper uses actual founding, research, finite trade, quarry supply and material production; mill staffing frees a real crew. No existing local/live save is changed. Whole-world inventory increases to10 complete definitions,35 legal contexts and175/835 stage requirements. All six full-goal acceptance gates remain open.

Current observed-bank composition v3

surface-map junction projections add exact current incoming/outgoing totals and leg counts from the full latest positive transfer graph. These read-only fields are copied into both endpoint chunks, retired with stale/dry intervals and reconstructed without entering saved accounting. regional-moisture-3 builds shared cubic contacts, endpoint widths from junction wet quantities, and clipped left/right bank ribbons. Sparse bank visibility rises over32–128 game-water units per completed interval; a muted water highlight rises over128–256 units on a joined leg with real upstream incoming flow. These thresholds are artistic visibility, not channel capacity or physical cross-section. Shared endpoint shading uses minimum current incoming/outgoing quantity, fading terminal receivers instead of cutting off the last actual leg. Small/isolated and old projections without the required incoming totals receive retained-ground contact without colored channels.

The existing32-entry plan cache, bounded image cache and current-tick selection continue to invalidate on real projection changes. Region and Hex use the same painter. Exact1280/375 CSS visual contacts are recorded in review ../regional-review/observed-bank-increment.json; the desktop DOM viewport is1280. The dense initial runoff grid and terminal Hex truncation were rejected before acceptance. Native raster approvals remain122 unchanged files. Paid in-memory observations test wet/dry/reload authority separately from the read-only saved interval114 gallery. This does not close live engineered-works or worldwide performance acceptance.

Shared native landscape ensembles v4

regional-landscape-4 assigns each ensemble to a fixed shared-world160-unit center within480-unit planning chunks; extended192-unit view overlap admits crossing members without duplication. Shared432/192-unit smooth density fields create broad and fine masses. Mineral ensembles contain2–4 contacts and foliage3–6; irregular34–64-unit elliptical offsets orient positions without rotating source pixels. Native width scales remain0.85–1.10, with exact reviewed alpha, aspect and anchor. Every member reads its own profile, feature, vegetation maturity/cover/disturbance/hazard and occupied/worked footprint; center selection uses canonical context so a center clearing cannot suppress unaffected neighbor members. Missing dependencies invalidate on materialization. Canonical feature anchors and water-surface sources retain their separate roles.

The actual currently painted observed-water segments are indexed in96-unit buckets; native root radii avoid those segments only. The index uses current visible water levels and bank widths from the existing authoritative projection, with its cache key included in detail revisions. regionalMoisturePlan also includes materialized-cell readiness in its stamp so formerly missing endpoints are recomposed. Neither geometry nor the index changes saved water accounting. restoreRegionView reports the restored native zoom/resolution; drawCachedScene reports sceneCacheServing from exact view key, revision and overscan coverage. These data attributes prevent stale loading surfaces from being accepted as settled visual evidence. Thirty-two targeted regression checks and68 stable-before/after native desktop/phone captures are recorded in review ../regional-review/neighborhood-clumps-increment.json. Existing image256MiB, view64MiB and canopy32MiB budgets hold in this review; this does not close broad cold/warm world performance acceptance.

Exact timber-family stage and terrain bindings

public/regional-art.json adds ten regional-structure-1 sources for watchtower and forester-lodge. Each binds one definition, one exact stage and its reviewed legal profiles. Watchtower supports five profiles including mountain; forester lodge supports four. Raw1254x1254 native RGBA originals are byte-preserved. timber-families-prompts.json records the complete built-in generation/edit prompt set, edit-target roles, exact original paths, dimensions, anchors and SHA-256. tile-library/timber-families-review-2026-10-12.json binds approval to those same bytes and contexts. The existing production structure painter retains exact whitelist gating, aspect ratio and reviewed anchors. Manifest fetches already include the current approval version.

Eighteen actual contact sheets and nine phone-bottom supplements in timber-families-increment.json cover45 legal stage/profile combinations. These labeled read-only illustrations use the production painter over canonical terrain contacts, independent of saved structures. test/regional-timber-families-lifecycle.test.js separately validates exact stage selection, unsupported/loading/early fallbacks and actual funded engine construction/repair/rebuild with all five-stage reloads. Its memory-only baseline uses existing founding and paid material-production helpers, and does not grant stock or change an existing save. Derived world coverage is12 complete definitions,44 complete contexts and220/835 stage requirements. Native-contact approval is bounded; all six whole-goal acceptance gates remain open.

Catalog verification also found three older retained candidate files missing permanent IDs. They now have reference-only records with approval false and no production contexts. The catalog test resolves the public-root regional manifest correctly; these inventory fixes leave the132-source whitelist and its exact approval version unchanged.

Read-only canonical map-view links

public/world-view-link.js validates the world/cell/view/x/y/zoom query as one bounded request. The seed must match the prepared canonical world; duplicate keys, non-integer/out-of-range cells, partial/off-world camera coordinates, unsupported map scales and non-finite/out-of-range zoom reject the whole request. Region permits the existing.075–1.65 zoom range; Hex permits.72–1.2. URL generation starts with a fresh query and never carries actor/session or art-review parameters.

The actual game queues a valid request during lazy-world initialization and uses the existing setMapView after worker preparation. It applies once, and normal map controls can replace the pending view. The selected canonical cell is independent of Region's camera; Hex focuses its selected cell. ••• → Link to this view updates after camera constraints and when the panel opens. Link application changes no authoritative state or commands. The shared source whitelist, rendered source bytes and simulation remain unchanged. Navigation/invalid-input and existing scene-cache/world-space composition regressions verify these boundaries.

Mobile control review also found that hidden overflow allowed focus to scroll the entire overscanned map container, clipping the top of the options panel. The map now uses non-scrollable overflow clipping; the options panel keeps its own scroll area, and page navigation stays available. Native desktop/phone review verifies the full link and map rail remain reachable.

Reviewed visible-subject scale and water guide edges

Canonical-place approval now matches an optional nativeSubjectWidth as well as the exact nativeWidth, foot, semantic family, profiles and state. Full-canvas width is bounded32–384; a declared subject must be finite,32 or greater, no wider than its canvas and identical to approval. build-approved-world-art.js retains that value in the hashed whitelist. The two castle PNGs are unchanged; their reviewed canvas widths compensate for different transparent padding, and160-world-unit subject framing prevents Hex zoom from fitting empty margins. Phone offset keeps calibrated portraits left of the control rail. Shared Region/Hex painting retains source aspect and canonical feet.

Strategic-atlas viewport guides omit an edge only when both actual neighboring cells are ocean/lake. Board ownership and geography are unchanged; land/coast guides and the selected-region full outline remain available at restrained contrast. Global empty interest avoids regional scenery work. Regression coverage checks exact subject approval rejection, bounds, shared-water/coast edge retention, immutable ownership and existing canonical view restoration.

Shared shoreline field and painted-source readiness

regional-water-3 replaces linear triangular sampling with shape-preserving interpolation over canonical axial-lattice samples. Interpolation retains the exact signed value at each canonical center; bounded seed-derived variation affects only mixed near-zero shore bands. Global coordinates, deterministic context seed and fixed contour lattice make overlapping chunk and region results identical. All nine generated biomes retain their canonical centers, and homogeneous checks cover all eleven rendered profiles. Ocean/lake identity remains authoritative; dry wetland and elevation-derived runoff never create new waterways. Source hashes and approval version are unchanged.

Normal hexLandmarkFor waits for tileLibraryReady. resetHexScenePresentation clears the portrait, cached source identity and previous-ground presentation while catalog approval is pending. Landmark source/ID metadata is published only with a ready ground and actual sprite; updateHexDetail derives labels from that painted identity. The Hex draw path calls this update after image readiness changes, preventing a completed portrait from retaining a loading label. Deliberately delayed GET-only local catalog checks are loading regressions, not production connection or performance evidence. Canonical continuity, dry/wet material, isolated lake, occupied bank and delayed-label regressions are covered by focused tests.

Reviewed natural fields foundation

Exact native1254×1254 natural-meadow-v1 is eligible only for fields ground under regional-ground-1 at span10. Source/contact and ordinary canonical-game device review precede publication; original bytes, prompt and references are retained. Both former atlas fields PNGs keep historical approval records but current approval false; neither enters the runtime whitelist. The exact inventory is131 files, retaining all eleven painted profiles. Shared triangular biome weights, world-space material phase and canonical shore masks remain the rendering authority across administrative regions. Runtime source proof identifies the actual painted fields source; Hex proof clears while pending and records the ground only when ready.

Regional-working-land-1 remains a separate state projection for actual soil condition/fallow and other improvements. Paid soil tests check authoritative quote/stock changes, completion, absence on unworked ground, no state mutation during painting, and inventory-preserving reload. Local controlled contact and normal disconnected game captures do not imply connected live orders or full worldwide acceptance. The transparent map hint disables inherited backdrop blur to avoid a visual stripe over the map.

Catalog audit corrects decoded memory estimates for shore-bank-stones-v1 and both granite-ridge sources to match their existing decoded dimensions. Three retained rejected candidates receive measured reference-only rendering metadata: arctic-slate-v1, village-crescent-rejected-v0 and weathered-rock-cluster-v1. Their approval remains false with no placement contexts; no source bytes or game semantics change. The derived library index is rebuilt so memory/representation sorting reflects those exact records.

The canonical review.aiApproval record and derived metadata index reference the completed contextual review. Preliminary draft wording is cleared; exact native source hash, fields-only placement contract, world approval version and runtime behavior are unchanged.

The library reads approved-world-art.json alongside its catalog manifests. Unrouted inventory files become active terrain cards only if the current terrain source, exact SHA, ground role, profile and span match a present approved catalog record. Sources already covered by another card remain single entries. Missing, checksum/context-mismatched or unapproved files keep reference classification; grouping grants no approval or simulation binding. Regression checks cover all rejection branches and duplicate prevention.

Native cohesive town projection

public/regional-art.json binds town-market-lane-v2 and town-gabled-court-v2 to existing canonical town cells in fields/grasslands/hills/tundra. Exact nested review.aiApproval hashes and role/profile/state/anchor/native-width/visible-subject-width contracts feed the generated whitelist. Original1536×1024 RGBA pixels are preserved; market width272/visible198 with anchor[.5,.72], court width220/visible199 with anchor[.5,.77]. The shared place painter preserves source aspect. The stable seed/cell/feature hash selects the same eligible portrait across regions and views; occupied cells still reject static portraits. The old street/square source files remain references with current approval false.

The full-world census is refreshed against current bindings without changing geography:35/62 actual contexts have two native sources; town fields64, grasslands886, hills65 and tundra3 retain their canonical identities. All three tundra towns currently occupy the same hash bucket; their source-pool count is not proof of displayed diversity. Eight source/contact captures plus24 normal canonical desktop1280CSS/phone390CSS scenes document this scope. This local evidence does not certify live connection, paid changes, all building families, evolving waterways or the broader performance goal. Connected deployment checks are recorded separately.

Exact fortress state, terrain and size bindings

public/regional-art.json binds five original1536x1024 RGBA files each to keep and castle, one exact stage and fields/forest/grasslands/hills. fortress-families-prompts.json records full built-in generation/edit prompts, reference roles, original paths, SHA-256, canvas dimensions and reviewed anchors. fortress-families-review-2026-10-12.json binds approvals to those same bytes and contexts. Native pixels remain unprocessed. The production structure painter retains aspect ratio and uses reviewed nativeWidth208/260; earlier files retain110. GonzRegionalComposition.acceptedSources requires an explicit size in80–260 to match the whitelist exactly and rejects omission when approval requires a size. Composer6 refreshes both revision keys and its client query URL.

Sixteen labeled desktop/390CSS phone terrain-contact sheets with eight native bottom supplements cover40 new stage/profile contexts. They are source-contact illustrations using the actual painter over canonical ground. test/regional-fortress-families-lifecycle.test.js separately checks exact selection, unreviewed/early/loading fallback, size contract rejection and real paid commands with five-stage reload. Its existing military fixture uses an explicit finite late-game stock boundary, paid charter/research and full-footprint clearing; opening stock-production provenance and paid existing-world fort acceptance remain open. No renderer fixture creates live inventory. Derived coverage is14 complete definitions,52 legal contexts and260/835 stages; all six whole-goal gates remain open.

Compound building illustration origins now use the centroid of all actual footprint cell coordinates, with stable anchor fallback during incomplete loading. This corrects three-plot keep placement across all six orientations; the seven-plot castle is symmetric and single-plot buildings keep their centers. The exact approval contact describes the native source relative to this ground origin. Occupation and real clearing still govern foliage; neighboring vegetation is not removed for decoration. The game client query is fortress-frame-1 and the composition module is version7; geometry/loading regressions accompany the lifecycle tests.

Fortress Hex framing review: the close view now fits the exact reviewed keep/castle canvas around its actual footprint center and contact anchor. This fixes clipping caused by the previous single-plot camera span; phone framing reserves space beside the existing map controls. Other structure sizes and construction controls remain unchanged. The beginner, first-village and affected navigation tutorials were reviewed; this camera correction changes no prerequisites, orders, stock or timing. Actual live fortress lifecycle and full regional acceptance remain open.

Root-aware meadow habitat composition

Regional landscape version5 retains fixed shared-world groups and smooth432/192-world-unit density fields. Reviewed wide temperate foliage now forms7–11 members over60–112-world-unit irregular ellipses with quiet gaps; mineral groups and other profiles retain their established size ranges. Material-kind selection precedes source selection so more foliage variants cannot dilute mineral groups. Each individual and grouped land sprite checks its center and four root-contact samples against exact source/profile/feature/state availability, occupation, worked land, disturbance and current painted water. Unknown terrain is tracked as a cache dependency and fails closed until it arrives. Existing192-world-unit overhang covers the larger ensemble. Reload and adjacent views never use a region-specific seed. The canvas diagnostic regionalLandscapeSources reports actual selected source IDs, not approval inventory. No authoritative simulation rule or saved geography changes.

Two native originals are registered as WOG-A-003374/003375 under regional-landscape-1, with exact reviewed fields/forest/grasslands/hills, feature none and wild/regrowth contracts. The approval manifest and metadata index derive from the exact source hashes; broader contexts, roles, sizes or anchors fail closed. Complete prompts and native source-contact evidence are retained in meadow-habitat-prompts.json and docs/regional-review/meadow-habitat-increment.json. Inventory becomes143 exact approved files. Building coverage remains14/44 definitions,52/167 legal contexts and260/835 stage contexts; location variety remains35/62 actual contexts with two native sources. Source contacts and focused shared-boundary/state regressions do not establish reference-level landscape, all terrain/location gaps, coherent evolving waterways, all building families or broad world/device/performance acceptance. All six full-goal gates remain open. The maximum deadline remains18October2026 15:18:32UTC.

The meadow habitat regression review also checks complete root-footprint exclusion and exact unaffected neighboring members. Cold sparsity is compared with the new reviewed temperate family; legacy cold group counts remain unchanged in the measured fixtures. Navigation, costs and tutorial success checks remain applicable.

Shared geographic shore field and partial loading

regional-water-4 replaces the earlier separable row/column coastline field with a positive compact Gaussian blend of normalized saved land/water domains. Its 1.9-center-spacing support gives broad contact; a smooth convex constraint within 0.4 spacing restores each exact canonical signed shore value derived from saved elevation and material without a nearest-center jump. Seeded variation is limited to the mixed near-zero contact band. Existing 24-unit triangles and 480-unit world chunks produce the shared native ground mask and graduated independently clipped land/water banks. Administrative IDs, camera direction and viewport never seed geometry. Homogeneous terrain retains its material; this layer never infers water from drainage or alters saved geography.

contextSampler records every unavailable canonical coordinate. chunkPlan retains this dependency list; revisionKey includes the rendering version, world/grid identity and the current IDs at those coordinates. cachedRegionalShorePlan is the common consumer for mask preparation and bank placement. It replaces a partial plan when a missing cell arrives and bounds the cache at 128 entries. Actual painted polygons are checked against 250 real canonical mixed-profile centers, with independent continuity, missing-terrain repair and saved current-water accounting checks. Local native browser evidence and released-client baselines are recorded in docs/regional-review/curved-shore-increment.json; production acceptance is recorded separately. The exact 143-source whitelist and all image bytes remain unchanged.

Canonical-node metadata is memoized within each sampler to reduce repeated work without changing field arithmetic. All polygons, bank segments, materials and missing-coordinate lists remain exactly identical across 53 chunks in ten real mixed-profile windows. The current building audit is recalculated and native location-source bindings are refreshed to approval version a57abc85a31655bf against the unchanged full-world census; current counts and location coordinates are unchanged.

Regional ridge/peak hierarchy

regional-relief-hierarchy-1 preserves the regional-relief-1 and regional-ridges-1 exact source approval contracts. The client passes only ready approved geographic-ridge props to relief planning. A canonical mountain/peaks cell is represented by the ridge only when its cell ID is in the accepted footprint and its (x,y+12) ground contact lies in the root ellipse centered at (ridge.x,ridge.y−0.04×width), with radii0.4×width and0.12×width. The original individual relief remains when either check fails or the ridge is unavailable. Region and Hex call the same planner; occupation, actual works and missing-neighbor rejection remain in the ridge planner. The browser diagnostics regionalReliefHierarchy and regionalReliefIntegratedPeaks distinguish this presentation from source approval counts. No authoritative cell, land or building state is modified. See native review ../regional-review/ridge-hierarchy-increment.json for scope; broader scene richness and performance acceptance remain open.

Exact coherent city contracts

city-cohesive-ward-v2 and city-cohesive-gate-v2 use unchanged1536×1024 native RGBA outputs. Exact regional-place-1 contracts allow only featurecity,stateexisting,profilesfields/grasslands/hills/forest,width 256,anchor [0.5, 0.78]. The existing stable seed/cell/feature hash chooses between lexically sorted source IDs; the same painter preserves source aspect and foot contact in Region and Hex. Actual occupied structure footprints suppress canonical illustrations. Forest vegetation follows current state and is never silently cleared for artwork. Older detached city source files remain available as unapproved provenance; their manifest routes are retired.

The generated approved-world-art plan and metadata index must match current catalog source bytes and approvals. Existing shared-world scenery rebuilds against that plan without regenerating geography or authoritative saves. Twelve native contact proofs and42labeled controlled proposal views were reviewed before source approval. City evidence ../regional-review/cohesive-city-increment.json separates these from normal release and connected production checks. Paired city sources now cover the41 canonical forest cities; full-world feature/source binding inventory becomes36/62 paired contexts. The original2,252,800 cell census is unchanged; binding refresh is not a new enumeration. Broader visual and performance acceptance remains open.

Bakery native state contracts and small-building Hex camera

Five exact bakery source files route only the bakery definition and foundation/frame/operational/damaged/ruined states on fields, grasslands, hills and forest. Each retains original 1254 square RGBA bytes,110 canvas width and its individually reviewed anchor. The generated whitelist requires exact checksum, role, composition, definition, state, profile, anchor andwidth agreement. Unreviewed contexts, early work and unavailable sources retain existing truthful procedural fallbacks. Ordinary building recipes and simulation state are unchanged.

Hex uses structurePortrait for every ready accepted structure source, including 110 width and older sources with the reviewed default width. Native source dimensions and the complete authoritative footprint determine its center and span. Existing phone framed-subject width/offset reserves control space; loading images cannot claim ready native framing. The initial bakery control overlap was rejected. Exact state/painter, original-byte/context, paid construction/repair/rebuild, five-stage reload and grain/flour/logs production checks accompany separately labeled source-contact and paid-checkpoint visual evidence. Normal whitelist and production review are recorded separately in the bakery design and completion notes.

Bakery provenance dates distinguish the original native generation on 13 October from exact review and approval on 14 October. Original file creation timestamps and byte hashes are retained in the prompt book; approval sorting continues to use the review timestamp. This corrects metadata only and leaves source pixels, contracts, stage selection and simulation unchanged.

Grain-mill native lifecycle contracts

Five unchanged1254square RGBA files route only the grain-mill definition and foundation/frame/operational/damaged/ruined states on fields,grasslands,hills andforest. Each uses110world-unit fullcanvas width and[.5,.9]foot contact. Exact checksum, role, composition, definition, stage, profile, anchor and width must agree with the generated approval plan. Missing/unsupported/early/loading states keep procedural presentation. All original prompts, reference roles, creation timestamps and native hashes are retained with the sources.

Actual local paid construction/repair/rebuild, explicit damage, five-stage reload and16grain-to12flour production checks are separate from32native source contacts and28controlled checkpoint map views. Capture readiness requires the source/material, hex-ready state and completed Hex-layer opacity transition; a rejected transitional capture is preserved. No renderer or simulation code changes in this source-family increment. Normal whitelist and connected production evidence are recorded separately in the grain-mill design notes.

Grain-mill publication review, 14 October 2026: the client, catalog, sortable index and all 153 native image hashes match release 99caa3b, with unchanged world and instance identities. All 161 isolated and 161 merged regressions passed. Fourteen read-only connected production map views and ten final live library previews were individually inspected. Actual paid five-stage lifecycle and production evidence remains local. The grain-mill completion notes preserve these evidence boundaries and the next geological-composition audit.

Canonical peak mass composition and cache dependencies

regional-ridges-2 keeps regional-ridges-1 as its exact native source approval contract. It scans canonical peak centers in a bounded shared-world neighborhood, validates the same fifteen native root contacts against mountain profile/feature and actual occupation/worked state, then applies deterministic natural elevation and world-seeded local priority. Each focal group has one absolute chunk owner; neighboring approaches resolve the same source, anchor and position. Existing generic spines yield near valid canonical candidates; semantic peak fallback is suppressed only by the actual ready larger source and reviewed root coverage.

Unknown competing geography fails closed and remains part of the revision key, along with known feature, elevation, profile, occupation and worked state. Native file bytes, widths, anchors and source approval inventory do not change. Controlled native comparisons, actual-geography/state/cache regressions, normal release views and connected production evidence are distinct in the geological completion notes.

Geological composer publication, 14 October 2026: regional-ridges-2 is verified on the connected production client with exact regional-ridges-1 source contracts, all 153 native image hashes, catalog/index and unchanged world identities. All 166 isolated and 166 merged bounded checks pass; 16 native production views supplement the separately labeled proposal and normal local views. The geological completion notes record performance and City UI limits.

Desert location contracts, 14 October 2026: four exact original native transparent sources bind through regional-place-1 only to city/ruins, desert and existing. Deterministic canonical world/cell selection preserves variant identity through approach and reload; player occupation suppresses decorative places. Existing ground, simulation and renderer contracts are unchanged. The native desert review ../regional-review/desert-place-increment.json separates candidate source acceptance, superseded approach frames, normal-release and production evidence.

Normal desert source verification, 14 October 2026: thirty native canonical client views use the generated157-file whitelist961cefcd17ed2ea2 with no module/source/approval override. Four new desert-only contracts preserve all previous153 approvals and source bytes. Production acceptance remains separate in the desert review ../regional-review/desert-place-increment.json.

Desert source publication, 14 October 2026: connected production verification matches all157 exact native hashes, client/catalog/index and unchanged world identities. Thirty production views supplement the separately labeled30candidate and30normal local views. All166 isolated and166 merged bounded regressions pass; scope and performance limits remain explicit in the desert review ../regional-review/desert-place-increment.json.

Cooperative shore preparation, 14 October 2026: regional-water-4 geometry and exact regional-shore-1 artwork contracts are unchanged. cooperative-shore-1 schedules exact row generation and32-polygon independent Path2D batches; complete paths are weakly associated with plans in the bounded128-entry cache. A completely known uniform signed domain may return its exact solid result without triangles. Unresolved/mixed data uses the same sampler. Missing neighbors arriving during computation or after an earlier chunk was assembled invalidate work before the final mask; actual scene cancellation cannot publish partial rows or paths. The136 released geometry goldens and26 paired native static-terrain pixel hashes agree exactly. The performance review ../regional-review/cooperative-shore-increment.json keeps bounded browser observations separate from worldwide/device acceptance.

Normal cooperative preparation review, 14 October 2026:171 regression checks and14 individually reviewed native normal-client views cover neighboring approaches, close Region, peak Hex and reload. Known geometry remains regional-water-4; source approvals stay961cefcd17ed2ea2/157. Bounded quiet max slices12.6msdesktop/9.2ms390-CSS viewport do not establish physical-device or worldwide performance.

Cooperative shoreline release, 14 October 2026: exactcooperative-shore-1 client/water scripts and all157 original native source hashes are verified in production withregional-water-4 geometry and unchanged world identities.171isolated/171merged checks,52controlled views with26exact terrain-pixel pairs,14normal local and38normal connected views provide separately labeled evidence. Broad physical-device/worldwide/navigation performance acceptance remains open.

Canonical ground-foot placement, 14 October 2026: optional exactgroundFootprint/groundComposition fields are copied into the source whitelist and must match the manifest, original source hash, native size/anchor and existing semantic/profile contracts. The regional-place-ground-1solver clips a convex source foot against the actual regional-water-4triangular field and real playable parcels, then yields by field row and placement candidate within a shared frame budget. Numeric completed poses are bounded to128entries and reused independently of region/camera; unresolved geography cannot publish. Actual neighboring active structure occupancy suppresses the image without mutating its stable fit; draw depth and Hex framing use that same complete pose. regional-ground-2adds clipped material-only edge faces from real neighboring land; it neither creates canonical nodes nor changes the regional-ground-1source contract. Exact source pixels and water geometry remain unchanged. Review evidence ../regional-review/place-ground-increment.json keeps native contact, numerical census, presentation occupancy fixtures and later normal/live verification separate.

Normal ground-foot review, 14 October 2026:182regressions and44individually inspected native normal-client views confirm realf9a15a087bd8e6ad/157source contracts, stable canonical fits and complete source framing. No source/module/approval/painter overrides. Ground runtime isregional-ground-2with unchangedregional-ground-1source contract; water geometry remainsregional-water-4. Connected production and broad device/worldwide validation remain pending.

Ground-foot release, 14 October 2026: exactplace-ground-1/ground-fit-1/world-edge-2client modules, actualf9a15a087bd8e6ad/157source whitelist and all native source hashes verified in production.182isolated/182merged bounded regressions,62accepted controlled views/8exact static terrain pairs,44normal local and44connected production views are separately labelled; broad device/worldwide/evolution validation remains open.

Extraction native lifecycle contracts

Fifteen exact original transparent sources route only clay-pit,stone-quarry andiron-mine, five dedicated states each, with110world-unit fullcanvas width. Fixed foot anchors are[.5,.8],[.5,.86]and[.5,.77]respectively. Exact rendered contexts are3clay,4quarry and5iron profiles;60stage/profile contracts. Checksum, definition, role, composition, state, profile, anchor and width all remain part of approval. Early/loading/unsupported art retains procedural fallback. No renderer or simulation code changes in this increment.

Separate evidence covers72native source contacts,84controlled actual paid checkpoints,15saved-stage restores and3authoritative staffed extraction receipts. Ordinary finite founding and earned research/tools fund independent actual survey/title/founder/supply routes; explicit damage is a fixture. Normal generated-whitelist and connected production evidence are separate in the completion record.

Extraction publication verification,15October2026:172original image hashes, client, catalog/index andworldidentities matchadeed1a.186isolated and186merged regressions pass.14read-only connected native map captures and6live operational library views are inspected; all15stage previews per device load. Actual resource-funded five-stage/receipt evidence remains disposablelocal. See completion notes for evidence boundaries.

Marsh source contracts and Hex invalidation

Two unchanged native RGBA PNGs route only regional-landscape-1 foliage, wetland none/reeds contexts and wild state, at full canvas width 96. The ribbon is 1254 square with anchor [.5,.75]; the edited crescent is 1536 by 1024 with anchor [.5,.83]. Exact source hashes, role, material, profile, feature, state, width and anchor remain mandatory. Full generation/edit prompts, rejected initial source and exact reference roles are retained in marsh-family-prompts.json. No raster postprocessing is used.

regional-landscape-6 validates canonical natural-feature root probes through the same current-contact exclusions as incidental vegetation. Current centered reed probes remain within their canonical cells; an API fixture separately checks neighboring-root exclusions and missing-contact invalidation. Hex cache keys include landscape identity/source changes, diagnostics report ready painted source IDs, and a ready canonical natural feature receives complete phone framing. Source/contact, candidate canonical, normal whitelist and connected production evidence remain distinct.

Marsh live verification, 15 October 2026: exact 174 original hashes, client/catalog/index, five wiki pages and unchanged world identities match f9d100c. All 28 connected canonical/neighbor/reload map captures and four live library captures were individually inspected. Both isolated and merged 190-test regressions pass. Neighbor-root exclusion coverage is defensive for these centered native sources; full-world performance and City UI acceptance remain open. See completion evidence.

Exact native palm contracts

Two original RGBA PNGs route only regional-landscape-1 foliage on desert/palms/wild. The leaning source is1341 by1173 with anchor [.57,.91]; the open source is1536 by1024 with anchor [.5,.82]. Both use full native canvas width96. Exact hashes, dimensions, role, feature, profile, state and anchor remain mandatory; no source crop, conversion or alpha processing is used. Full text-only built-in generation prompts and original paths are retained in palm-family-prompts.json. Existing regional-landscape-6 root/occupation/work/disturbance checks and full-canvas Hex framing are reused without runtime changes. Source/contact, candidate, normal whitelist and live evidence scopes remain separate.

Palm live verification, 15 October 2026: exact 176 original hashes, client/catalog/index, five wiki pages and unchanged world identities match d128b69. All 28 connected canonical/neighbor/reload map captures and four live library captures were individually inspected. Both isolated and merged 192-test regressions pass. Full-world performance and City UI acceptance remain open. See completion evidence.

Bounded regional display cache

The native source LRU retains its existing128/192/256MiB tier limits. A separate32MiB PixelCache stores regional display canvases keyed by exact approval version, URL and zoom/DPR resolution. Only approved source objects enter it. Terrain and unknown URLs retain native delivery; Hex and art-review mode bypass regional display reuse. Canonical-place and structure canvases preserve the exact native aspect used by reviewed ground feet. Preload readiness follows the returned display records so native eviction cannot force an endless all-originals-ready cycle. These are separate cache budgets, not total browser memory. Original assets, approval contracts, hydrology and saves are unchanged.

A local actual-state weather sequence114/116/119 verifies wet/dry/resumed public observations after JSON reload. Browser ground clipping and final native views are separate checks. A canonical cottage currently intersects the observed channel; complete location/water contact and engineered-work evolution remain unaccepted. See completion status.

Regional loading live verification,15October2026:176original source hashes and exact client/catalog/index/wiki match b312604 with unchanged world identities.196isolated and196merged checks pass;60local map/state/cache captures and28connected production captures are inspected. Four live captures explicitly emulate the128MiB native tier. Actual natural flow114→116→119 remains disposable local evidence; full engineered-water/contact, physical-device and City UI acceptance remain open.

Exact cottage foundation routing

regional-place-foundation-1 annotations are accepted only when source and approval agree on the normalized convex foundation polygon, exact original aspect and composition version. Original images and allowed contexts remain unchanged. regional-foundation-routing-1 uses deterministic padded convex visibility paths, rounded corners and shared per-node anchors. regional-moisture-4 preserves the current observed edge IDs, quantities, scales and node levels, then applies the existing world land clip to the presentation geometry. Diverted branches share their authoritative node heading and bank width. No simulation routing, saved placement or engineered work changes.

Both map-background caches include exact approval/source readiness and current structure occupation; the pre-approval path accepts absent metadata safely. Missing valid geographic neighbors defer the trace and increment pendingFoundationRoutes; true world boundaries are distinguished explicitly. A source-qualified surface-only fixture contains real wet114/dry116/resumed119 observations from the disposable saved-world clone. Geometry and widest-bank regressions, actual native browser views, reload, same-page updates and camera-asserted normal map drags provide scoped evidence. They do not certify all foundations, water artistry, engineered works, total memory or physical devices.

Cartwright source family

Five exact unchanged native RGBA sources bind only the existing cartwright definition and their individual foundation/frame/operational/damaged/ruined states under regional-structure-1. Fields, grasslands, hills and forest are the four legal reviewed rendering profiles. Original1254square canvas,110world-unit width and fixed contact anchor preserve the existing Region/Hex painter and native portrait framing. Planned/site preparation and cleared state retain the existing procedural/occupation behavior. Dedicated damage and ruin sources do not reuse the intact operational image. No rendering or simulation code changes.

A finite-resource local engine route keeps the supporting lumbermill staffed for active Joinery, pays imports/construction/repair/rebuild, preserves stock and footprint on all five state reloads and records actual timber/iron/tools-to-handcarts output.24explicit source/painter contact captures cover20stage/profile pairs;28actual paid-state candidate captures exercise same-page evolution and12normal-whitelist captures verify operational reload and real camera drags. The preceding water/foundation build7feba7f also has30inspected connected production frames and exact client/176sources/catalog/index/wiki/world verification. The cartwright release requires its own final181source production verification.

A separate finite-resource engine replay also completed actual demolition and salvage, verified the cleared canonical plot and unchanged stock/occupation after save/reload, and paid for a new cartwright on the same cell. Supporting production and ordinary imports supplied the replacement; no goods were injected. This is engine evidence, not an additional inspected production lifecycle.

Exact low-slope geological hierarchy

Two native1536by1024RGBA sources use regional-ridges-1 plus exact regional-ridge-slope-1 approval fields: slope form, normalized conservative root envelope and2/3native aspect. The generated checksum-bound whitelist preserves these fields. Only mountain/eligible natural-feature context is reviewed. Background ridge placement chooses the low family, while canonical peak focal candidates retain the existing four mass sources and priority. regional-ridges-3 owns deterministic world-space identities; regional-relief-hierarchy-2 refuses to count a slope as representation of a canonical peak.

The complete visible-source envelope is tested against every intersecting canonical pointy hex, including tiny corner slivers, using the actual grid origin/size. Water, named places, other profiles, occupation or worked state reject the whole decorative placement; unresolved geography is tracked and invalidates the cache when it arrives. Exact browser read-only pixel analysis found no alpha above32outside either envelope and maximum1outside; no pixels or alpha were edited. Five new causal checks cover source-contract rejection, exact corner contact, unchanged canonical peaks, current land/occupation/missing dependencies and overlapping views. Ten baseline and ten candidate canonical Region views plus four candidate Hex views were individually inspected; these local clients do not provide connected settlement/production evidence.

The prior cartwright release17c2387 has separate exact181-source live/client/catalog/index/wiki/world verification and28inspected connected-map/library views. Its finite funded construction/repair/rebuild/output and demolition/salvage/newconstruction remain local engine evidence. No new simulation rule, good, geographic feature or save migration is introduced by low-slope artwork.

Exact charcoal-kiln and smithy source families

Ten unchanged1254square RGBA originals use the existing regional-structure-1 contract,110world-unit native width and fixed[0.5,0.8]anchor. Each checksum-bound approval binds exactly one definition, one of foundation/frame/operational/damaged/ruined and four reviewed profiles: fields, grasslands, hills, forest. Planned/site-preparation presentation remains procedural. Runtime renderer, authoritative state and all old image bytes are unchanged. Families do not imply active smoke/fire or output.

A disposable clone of a previously validated finite paid iron-mine checkpoint funded this review through actual mine staffing/finite deposit, actual arriving ore collection, ordinary harvest, food staffing and adopted precision-saw timber production.49resource-funded orders,10stock/footprint-preserving restores, charcoal output and smithy iron/tools receipts, unstaff/demolish/salvage/cleared reload and separately paid replacements passed. Explicit damage/collapse fixtures establish state routing only.16contact sheets cover40desktop stage/profile pairs plus8phone operational pairs;56actual paid-state Region/Hex frames cover both devices/all five stages, operational reload and actual camera drags. Fitted initial Region and closer reload zooms are not identical-zoom evidence. Final normal generated whitelist and connected production checks remain separate. See review evidence ../regional-review/metal-families-increment.json.

Prior geological release ef0205b/e997c368 has exact183-source live verification and32inspected connected/library frames; lower slope sources remain mountain-only. No new gameplay rule, inventory guarantee, deposit or permission comes from workshop or geological art.

Tundra canonical rural source contexts

Six unchanged1536x1024RGBA sources use the existing checksum-bound regional-place-1 contract: exactly tundra, one existing canonical feature each (cottage, village or farm), fixed anchor/native width and two meaningful layouts per feature. Existing deterministic cell/feature/seed selection and occupation suppression are unchanged. Initial hamlet widths142/154failed a coastal foundation contact; both now use100world-unit full native canvases without source processing.

Twelve final source/painter sheets and56finalcanonical frames cover ordinary/close Region, full native Hex, samezoom close reload and actual asserted pointer pans in two tundra neighborhoods on desktop/390CSSphone. The north desktop west pan changes the displayed region Silver Wilds to Silver March. Southern and smaller phone pans are camera approaches and do not necessarily cross a region boundary. Prior68frames with superseded widths remain private and do not satisfy final geometry acceptance. Local canonical clients have no connected settlement/server evidence. See source/context review ../regional-review/cold-rural-increment.json. Normal whitelist, full regressions and connected live acceptance are separate.

The prior two metal families have exact193-source live/client/catalog/index/wiki/world verification and44inspected connected/library frames. Their real resource-funded lifecycle/recipes remain local engine evidence. Tundra location artwork adds no new geography, goods, workers, simulation order, permission or save migration.

Exact terrain extensions for existing stone subjects

Six existing unchanged native sources gain sixteen reviewed terrain contacts: paired magic sites in tundra, desert, mountain and wetlands; paired ruins in mountain and wetlands; paired neutral exposed-rock sites in arctic and tundra. These are exact source/profile permissions. Native transparent gaps expose the same shared world ground across neighboring regions. Geography, seed, player occupation, simulation and source pixels stay unchanged. Arctic magic was rejected for conspicuous warm mossy bases on snow. The tundra castle extension was rejected because its actual coastal layout crowds a neighboring town.

The existing checksum-bound regional-place-1 contract receives sixteen exact source/profile permissions across six originals; no renderer or simulation changes. Fixed widths, anchors and original bytes/alpha are preserved. Native contact and actual Region/Hex context evidence includes40contact sheets and84canonical frames, with rejection scope retained. Normal source selection remains canonical cell/feature/seed based, independent of region ownership. There is only one actual tundra magic cell, selecting waystones: the second eligible source has native contact evidence, not a fabricated second normal location. Actual camera assertions use the existing finite-world viewport clamp, and real desert/arctic pointer pans record actual displayed regions. See stone context evidence ../regional-review/stone-context-increment.json. Normal generated whitelist/regression/connected live verification remains separate.

Prior tundra rural release is verified live with199original hashes, exact client/catalog/index/fivewiki/world identities and48inspected connected/library frames. This extension changes no deposits, stock, staffing, orders, construction permission, occupation precedence or saved world.

Stone-context normal acceptance: all70source/camera/readiness assertions passed on desktop/390CSSphone.53whole-file screenshots match individually inspected canonical candidates;17additional native screenshots were separately inspected.209isolated regression checks passed. Final permissions cover six existing originals and sixteen source/profile contacts across eight paired contexts. Rejected arctic magic/tundra castle extensions remain excluded. Merged regression and connected production acceptance remain separate.

Stone-context release acceptance:209isolated and209merged checks passed;70normal canonical views accepted. The exact eight additional paired contexts bring location coverage to51/62; all six full-goal gates remain open. Connected production verification follows deployment and is not implied by local results.

Cold native source families

Six new unchanged native transparent originals fill four cold location contexts: paired bare-stone arch/round ruins in arctic and tundra, paired pierced/levitating monolith sites in arctic, and paired compact square/drum keeps in tundra. Open interiors and detached stones expose the same surrounding ground across region borders. Grey bare masonry replaces the unsuitable cold-context proposal of warm mossy bases. Both full-native keep canvases use72world-unit widths, keeping their foundations dry and separate from the actual neighboring town. No old source pixels, renderer, geography, seed, save, occupation precedence or authoritative simulation changed.

Six exact checksum-bound regional-place-1 sources add eight source/profile contacts and four paired canonical contexts. All raw PNGs are1536x1024RGBA; original alpha and pixel hashes are preserved. Sixteen source/ground contacts and48actual canonical frames cover seven real locations, ordinary/close Region, native Hex, close reload and actual pointer pans on desktop/390CSSphone. A singleton tundra castle selects squarekeep normally; four additional forced drumkeep study frames prove alternate contact only. The forced manifest is private review machinery, never production content or a second world location. See evidence ../regional-review/cold-stone-increment.json; normal whitelist, regressions and connected live checks are separate.

The prior six-existing-source permission extension is verified live with199exact source hashes/client/catalog/index/wiki/world identities and54inspected connected/library frames. Current new inventory205originals brings paired exact canonical contexts to55/62. Static artwork adds no orders, resources, inventory, buildings, permissions or save migration.

Cold stone normal acceptance: all40source/camera/readiness assertions passed on desktop/390CSSphone. 30whole-file screenshots match individually inspected canonical candidates; 10additional native screenshots were separately inspected.209isolated checks passed. Six new unchanged originals cover eight exact source/profile contacts/four paired contexts. The alternate drumkeep remains an explicit singleton contact study, never a second normal world occurrence. Merged regression/connected production acceptance remain separate.

Cold stone release acceptance:209isolated and209merged checks passed;40normal canonical views accepted. Six unchanged new originals bring approved inventory to205 and exact paired location contexts to55/62. Four alternate drumkeep study frames remain explicitly separate from the only normal tundra castle occurrence. All six full-goal gates remain open. Connected production verification follows deployment and is not implied by local results.

Exact native city feet and terrain variants

Four unchanged native transparent city originals fill the arctic, mountain and wetland city contexts with paired silhouettes. Northern gateward and longward use cold slate and bare stone; neutral marketward and gatecluster suit mountain and wetland ground. Open crooked lanes and broken edge groups expose the existing shared terrain. Each source has an exact reviewed conservative convex foot envelope under regional-place-ground-1, using the existing dry-land fitter; this does not paint, clear or change land. Complete canonical enumeration found115cities in these contexts; all full envelopes fit dry land at their original scale and anchors, so this world required no coastal adjustment. No raw source pixels, old source contracts, renderer, seed, geography, saved state, occupation precedence or authoritative simulation changed.

Four regional-place-1 contracts bind exact original hashes, features, profiles, widths, anchors and regional-place-ground-1 foot envelopes. Deterministic cell/feature/seed selection remains unchanged. Geometry audit covers115cities;12native contact sheets and42actual canonical frames cover six representative locations on desktop/390CSSphone, ordinary/close Region, Hex, reload and real pans. Evidence ../regional-review/cold-city-increment.json distinguishes these scopes. Prior cold stone release is verified live with205exact original hashes and52connected/library frames. Current209originals provide58/62paired canonical contexts; remaining natural-feature contexts and broader state/richness acceptance remain open.

City normal acceptance: all36source/camera/readiness assertions passed on desktop/390CSSphone. 29whole-file screenshots match individually inspected canonical candidates; 7additional native screenshots were separately inspected.209isolated checks passed. Four unchanged originals cover six exact source/profile contacts/three paired contexts. All115actual city envelopes fit published dry land. Merged regression/connected production acceptance remain separate.

Current species and complete terrain triangles

Eight unchanged native transparent natural landmarks add distinct paired dunes, ice formations, broadleaf groves and conifer stands. Their irregular silhouettes expose the existing shared terrain rather than adding enclosing soil tiles. Four tree sources have exact speciesGroups contracts: mixed-broadleaf groves and conifer stands follow current vegetation, with the canonical climate fallback used only when no authoritative species override exists. Species-only changes invalidate the landscape cache. Existing cover, maturity, disturbance, hazards, occupation, worked ground and water eligibility remain in force. Canonical neighbors revealed missing terrain triangles in ice portraits: the horizontal cell margin was only two radii, shorter than a slanted lattice face. Three radii now include the full face origins using real canonical neighboring cells, without filling unknown terrain or changing geography.

regional-landscape-7 binds optional speciesGroups exactly between source and approval record; restrictions cannot be widened or removed. Current patch species takes precedence over the same temperature fallback as authoritative vegetation; revision keys include temperature and patch species. Both scattered and canonical foliage selection use the restriction. visibleCellsFor includes three horizontal radii, covering the maximum1.5horizontal-step reach of the triangular ground lattice. Real ice-border pixel diagnostics and a canonical full-viewport regression cover the previously missing face origins. Evidence ../regional-review/natural-identities-increment.json contains16native contact and60corrected representative visual frames.217approved originals and62/62paired identities are inventory, not full-world visual certification. Prior city release209sources and44connected/library frames is verified live; broader goal remains open.

Natural identity normal acceptance: all52source/camera/readiness assertions passed on desktop/390CSSphone. 39whole-file screenshots match individually inspected corrected canonical candidates; 13additional native screenshots were separately inspected.214isolated checks passed, including actual eight-source state and species regressions and complete canonical ice-border viewport coverage. Eight unchanged originals cover four paired natural identity contexts. Merged regression/connected production acceptance remain separate.

Exact kiln and smokehouse lifecycle sources

Brick kilns and fish smokehouses now have separate exact native transparent foundation, frame, operational, damaged and ruined sources. Their small irregular contact grounds sit on the shared regional terrain without enclosing hex soil tiles. The kiln shows its brick firing chamber, yard and chimney; the smokehouse shows a timber curing shed, racks and working materials. Kiln sources are approved only for fields/grasslands/hills/forest; smokehouses only fields/grasslands/hills/wetlands. These reviewed presentation contexts do not expand actual construction permissions. All original1536x1024RGBA files are unchanged, with nativeWidth110 and anchor[0.5,0.8]; no raster processing, simulation or renderer change. Existing stage, readiness, occupation and canonical neighboring-ground rules remain in force.

Ten unchanged native sources bind40reviewed stage/profile combinations. Three focused regressions cover exact raw hashes/header, stage/profile permissions, readiness and complete phone Hex framing beside controls. Evidence ../regional-review/firing-families-increment.json records16contact and56corrected canonical frames plus two independent finite-resource lifecycle branches with43orders. The adapter resets remembered Region camera per checkpoint and asserts actual target/pan coordinates; normal product code is unchanged. Existing simulation costs, recipes, construction permissions and saves are unchanged. Prior natural release217sources and68connected/library frames verified live; broader goal remains open.

Kiln/smokehouse normal acceptance: all24normal source/camera/readiness assertions and all24individual native screenshot reviews passed on desktop/390CSSphone.217isolated checks passed, including exact stage/profile/native hashes, unavailable/loading rejection and complete phone Hex framing. Ten unchanged originals cover40reviewed stage/profile pairs. Actual finite local lifecycle receipts, reloads and demolition/replacement are separate from unobserved production building stages. Merged and connected live acceptance remain separate.

Exact coastal lifecycle identities and shared water

The coastal fishery, fishing landing and fish market now use separate exact native transparent foundation, frame, operational, damaged and ruined sources. The fishery is a compact pair of boats and moorings on the existing coastal ocean; the landing is a small net/boat gear shelter on land; the market is two open fish sales stalls. Their irregular silhouettes and open gaps reveal the same continuous world terrain. Fishery art is restricted to ocean; landing and market to fields/grasslands/hills/wetlands, without expanding legal construction rules. All fifteen1536x1024RGBA originals retain nativeWidth110 and anchor[0.5,0.8], with no raster processing, renderer, simulation or geography change. The rejected first fishery painted water around the hulls; the selected object-only original lets canonical water supply the whole surrounding sea.

Fifteen unchanged sources bind45reviewed stage/profile combinations. Three focused regressions cover exact hashes/header, source permissions including water/land rejection, early/loading states on each allowed profile, and complete phone Hex framing. Evidence ../regional-review/coastal-work-families-increment.json distinguishes18contact sheets,84corrected canonical views and17actual resource-funded local orders. Fresh navigation between independent fixture worlds prevents their monotonic chunk revisions colliding; actual cached structure definition/stage is asserted before each capture. Same-page stage transitions remain covered within each world. This is a QA adapter correction, not a production runtime change. Prior227sources and40connected-ground/library views verified live; broader goal remains open.

Fishery/landing/fish-market normal acceptance: all36normal source/camera/readiness assertions and all36individual native screenshot reviews passed on desktop/390CSSphone.220isolated checks passed, including exact stage/profile/native hashes, unavailable/loading rejection and complete phone Hex framing. Fifteen unchanged originals cover45reviewed stage/profile pairs. Actual finite local lifecycle receipts, reloads and demolition/replacement are separate from unobserved production building stages. Merged and connected live acceptance remain separate.

Exact community-building lifecycle sources

School, care hall, community refuge and tree nursery now have distinct exact native transparent foundation, frame, operational, damaged and ruined artwork. The school keeps its schoolroom/bell/books, care hall its low hip roof and open care porch, refuge its broad braced gable and sleeping benches, and nursery its separate potting benches. Open gaps reveal the independently painted shared terrain on fields, grasslands, hills and forest. Twenty unchanged1536x1024RGBA originals use nativeWidth110 and anchor[0.5,0.8], without raster/alpha processing, crop or conversion. Authoritative building identity, stage, plot suitability, moisture, research, staff and actual resources remain decisive; no renderer, simulation, geography or construction-rule change.

Twenty sources bind80reviewed stage/profile contracts. Three focused regressions cover exact source/header/hash, stage/profile rejection including early/loading states, and full native phone Hex framing beside controls. Evidence ../regional-review/community-care-families-increment.json retains32contact sheets,112actual canonical saved-state views and four independent finite paid research/resource routes. Source approval does not establish care/school/refuge service delivery: no direct recipe output claimed. Nursery production was observed only after real composting, moisture/staff checks and mature seed retention. Prior242sources and60connected production ground/library frames verified separately; broader goal open.

School/care/refuge/nursery normal acceptance: all48normal source/camera/readiness assertions and all48individual native screenshot reviews passed on desktop/390CSSphone.223isolated checks passed, including exact stage/profile/native hashes, unavailable/loading rejection and complete phone Hex framing. Twenty unchanged originals cover80reviewed stage/profile pairs. Actual finite local lifecycle receipts, reloads and demolition/replacement are separate from unobserved production building stages. Merged and connected live acceptance remain separate.

Shared-world dominant mountain spacing

regional-ridges-4 widens dominant canonical peak priority to a1.1native-width by.52native-width ellipse. The candidate halo covers every possible competitor for an owned chunk peak; elevation and stable hash/cell priority stay deterministic. The exact fifteen-point source root band and .68/.32background exclusion stay unchanged. Existing regional-relief fallback represents subordinate canonical peaks, and region/cache borders do not seed or independently choose artwork. The client query changes to focal-breathing-room-1. Source contracts and all262native bytes are unchanged.

Two regressions cover world-scale spacing with truthful smaller fallback and independently planned neighboring windows, including negative coordinates. Existing occupation/worked/water/place/unknown-neighbor invalidation checks remain applicable.24baseline+24normal-approved actual canonical native views review desktop/390CSSphone, ordinary/close/detail zoom, main/west/east, reload and real pans; preparation/cache observations are scoped to those captures, with broad physical-device performance still unaccepted. See evidence ../regional-review/connected-focal-increment.json.

Exact workyard lifecycle sources

Mason workshop, textile workshop, livestock enclosure, managed pasture and waste yard have their own transparent foundation, frame, operational, damaged and ruined illustrations. Mason stone benches, textile loom/wheel, roofed enclosure, open pasture fence/trough and waste bins/cart retain distinct silhouettes through the lifecycle. Their open surroundings reveal the same independently painted terrain as adjacent cells and regions. Twenty-five unchanged1536x1024RGBA originals use nativeWidth110 and anchor[0.5,0.8]; no raster/alpha processing, crop or conversion. Mason/textile/enclosure/waste art is restricted to fields, grasslands, hills and forest; pasture to fields, grasslands and hills. Existing authoritative identity, stage, location, research, staffing and resources decide behavior. No renderer, simulation, geography or construction-rule change.

Twenty-five exact sources cover95stage/profile contracts; source readiness and actual saved stage remain prerequisites. Evidence ../regional-review/workyard-families-increment.json retains38source contacts and140canonical saved-state frames,66finite paid orders,25reloads,five demolition/replacement routes and three actual staffed production receipts. Same-world stage progression and independent-world reloads are distinguished; four routes share one canonical anchor. Artwork does not create animals or claim waste production. The existing source/hash, unsupported-profile, early/loading-state and full phone Hex framing regressions now cover these families too. Prior connected mountain release verified live separately; full composition/water/performance goal remains open.

Mason/textile/enclosure/pasture/waste-yard normal acceptance: all60normal source/camera/readiness assertions and all60individual native screenshot reviews passed on desktop/390CSSphone.225isolated checks passed, including exact stage/profile/native hashes, unavailable/loading rejection and complete phone Hex framing. Twenty-five unchanged originals cover95reviewed stage/profile pairs. Actual finite local lifecycle receipts, reloads and demolition/replacement are separate from unobserved production building stages. Merged and connected live acceptance remain separate.

Exact civic lifecycle sources

Academy, scriptorium, barracks and theater now have separate transparent foundation, frame, operational, damaged and ruined illustrations. The academy keeps its two-wing hall, scriptorium its copying porch, barracks its elongated hall/equipment porch and theater its open stage/separate benches. Their gaps expose the same continuous ground as adjacent cells and regions. Twenty unchanged1536x1024RGBA originals use nativeWidth110 and anchor[0.5,0.8] across fields, grasslands, hills and forest. Existing authoritative identity, stage, plot, research/adoption, staffing and resources still determine availability and behavior. No simulation, geography, construction-rule or renderer change.

Twenty exact originals cover80stage/profile contracts. Evidence ../regional-review/civic-families-increment.json records32native source contact sheets,112actual paid saved-state desktop/phone frames,95resource-funded orders and20stock/footprint-preserving stage restores. Four independent local branches pass construction/repair/rebuild/demolition/salvage/clearedreload; only scriptorium/barracks include optional replacement builds. Academy/theater deliberately stop after cleared reload; no service/military/cultural production receipt is claimed. The existing painter/source/header/hash, unsupported-context, early/loading-state and full phone Hex framing matrix now spans13community/workyard/civic families,65sources and255stage/profilecontracts. Actual state identity/readiness remains authoritative. Prior workyard deployment verified50ground+50library views separately; full world-composition/water/performance acceptance remains open.

Academy/scriptorium/barracks/theater normal acceptance: all48normal source/camera/readiness assertions and all48individual native screenshot reviews passed on desktop/390CSSphone.225isolated checks passed, including exact stage/profile/native hashes, unavailable/loading rejection and complete phone Hex framing. Twenty unchanged originals cover80reviewed stage/profile pairs. Actual finite local lifecycle orders, reloads and demolition/salvage/clearedreload (two optional replacements) are separate from unobserved production building stages. Merged and connected live acceptance remain separate.

Final supported structure identity contracts

The stone civic works hall, secondary groundwater well, founded outpost camp and legacy stable each have dedicated transparent foundation, frame, operational, damaged and ruined illustrations. Hall buttress feet and planning porch, open well ring/windlass, canvas camp/depot and empty two-bay stable remain distinct on shared ground. Twenty unchanged1536x1024RGBA originals use110world-unit canvas width and anchor[0.5,0.8], across the fifteen legal terrain contexts; camp excludes forest. True transparent exterior/interior gaps expose the existing ground across neighboring cells and regions. Planned/site preparation stays procedural. No simulation, geography, construction availability or renderer rule changed.

Evidence ../regional-review/final-families-increment.json retains30full native source sheets,112actual paid saved-state desktop/phone Region/Hex/reload/neighbor frames,299resource-funded orders,20stock/footprint-preserving stage restores and four completed demolition/salvage/clearedreload routes. Hall route includes real quarry transport, staffed stone/tool production and nine forge-tools batches; well uses suitable surveyed moisture; camp begins at founder arrival and foundation/frame arise during rebuild; stable route is explicitly unchartered legacy. Existing production rules and new-charter restrictions remain unchanged. Exact painter/hash/readiness/unsupported-context/fullphone framing regression matrix spans17community/workyard/civic/finalfamilies,85sources,330stage/profilecontracts. Overall inventory44/44definitions,167/167contexts,835/835stages is separate from six full-goal visual/worldwide acceptance gates.

Hall/well/camp/legacy stable normal acceptance: all48normal source/camera/readiness assertions and all48individual native screenshot reviews passed on desktop/390CSSphone.225isolated checks passed, including exact stage/profile/native hashes, unavailable/loading rejection and complete phone Hex framing. Twenty unchanged originals cover75reviewed stage/profile pairs. Actual finite local lifecycle orders, reloads and demolition/salvage/clearedreload (zero optional replacements) are separate from unobserved production building stages. Merged and connected live acceptance remain separate.

Combined regional acceptance and latest-interval channel projection

Regional scenery uses shared world coordinates across ownership and planning borders. The finer twelve-unit shoreline lattice refines close coastal curves while preserving the continuous water field and canonical geography. Decorative foreground canopy candidates leave the identifying core of an actual approved native location visible; surviving trees retain their positions and authoritative woodland is unchanged. Actual constructed outlet sections follow their surveyed neighboring cells through bends. A restrained wet center appears only for the latest completed, conserved commissioning interval; the next interval clears it while transfer history remains. Channel inspection describes that measured route transfer without claiming sustained flow.

regional-water-5 uses a12world-unit fixed mesh;272continuous-field probes remain identical to9532c7a across136golden geometry chunks. Bank sprite sampling is compensated for the finer mesh. regional-composition-8 performs bounded256unit world-halo native-place core checks; independent neighboring chunks agree, occupied sites respect existing precedence, and no authoritative vegetation is cleared. regional-working-land-2 connects actual surveyed half-sections. engineered-water-map projects currentFlow only when latest route row, surface tick, retained conserved receipt, authorization tick, fingerprint, connection and amount all match. SurfaceWaterAdvanced includes exactly the actual moved corridor on arrival and retirement so sparse chunk revisions clear stale wet rendering. History alone does not create a river.

Combined evidence ../regional-review/combined-world-acceptance.json separates the146frame normal production baseline from84corrective local candidates, exact field probes, actual consecutive2075/2076/2077intervals, route17sections/source/receiver/neighbors/reload,233isolated checks and pending new production acceptance. Physical major-waterworks prerequisite stocks/household clocks are controlled integration fixtures; no fully earned route claim or injected water. Prior resource-funded building journeys remain separately linked. All327native original bytes/approvals,44definitions/167contexts/835stage contracts and62paired location contexts stay unchanged. Desktop/phone headless native-size review and cache bounds do not certify physical hardware frame rate.

Native-place readiness is a canopy-cache dependency

regional-composition-9 includes placeWidth for actual tracked canonical cell dependencies in revisionKey, alongside current vegetation, occupation, missing-cell arrival and approval version. This corrects a connected phone case where an early empty regionalPlaceArt list produced plans later reused under the same approvedWorldArt version. Band raster stamps inherit the changed plan stamp; distant unaffected plans remain cached. The actual drawRegionalForeground harness reproduces oldcomposer8 failure at1495917and passes with9, including warm reuse, exact late readiness, unchanged vegetation/structure maps, unaffected chunks and a reverse readiness round trip. Evidence ../regional-review/native-place-readiness-increment.json separates two held-response incomplete screenshots, six accepted completed-source desktop/phone Region/reload/Hex screenshots,58prior live frames with retained rejection, and eight real consecutive physical-route warm-cache updates. No raster source or simulation rules change.

Regional visual-completion acceptance — 16 October 2026

The six documented regional visual-completion gates are accepted against the cumulative evidence, including corrected regional-composition-9 production 3bdf8c70c340e05d51061a39de86b525f3e2ed1c / 631509df-7ef2-4357-b5dc-566bcf647460 / wiki38891357235 SUCCESS. Regional ground and scenery continue across neighboring planning/ownership borders; native landmarks remain distinct and legible, current species/occupation/land use control scenery, matched building families evolve through their real stages, and waterways follow current authoritative geography and measured state. All 327 source originals and approvals remain exact. Existing player geography, ownership and saves are preserved.

Combined acceptance ../regional-review/combined-world-acceptance.json and readiness correction ../regional-review/native-place-readiness-increment.json separate full-world inventories, exact original source/context contracts, actual paid lifecycle fixtures, controlled physical commissioning prerequisites, broad146frame production audit/rejections, deterministic late-manifest proof and58corrected current connected frames. All 44 supported definitions/167 contexts/835 stage contracts,11 terrain profiles and62paired canonical place contexts are covered. Both isolated and merged234-check suites pass. Exact deployed originals, client, catalog/index, five generated wiki pages, health and persistent world/instance identities are verified. Composer 9 changes cache dependency invalidation only; current state layout rules are preserved. The closing documentation-only release has an unchanged-source guard. Earlier dated open/pending assessments remain historical and are superseded by this accepted decision. Actual preparation/cache metrics remain in the evidence; no hardware FPS or unrelated City-panel certification is implied.

Reopened regional art direction: shared ground and coastal contacts

regional-material-1 draws immutable approved terrain sources with deterministic staggered, overlapping patches, varying offsets and scale, preserving source orientation. Patch identity comes from source-space lattice coordinates and salt, so camera translation, zoom, reload and planning region selection do not reseed it. The patch count is bounded. Region and Hex use the same fillFeatheredAtlasMaterial integration. No new bitmap, source approval, geography or simulation state is introduced.

coastal-contact-2 adds continuous world-coordinate width fields to the shared regional-water-6 boundary. Ocean sand, rocky/high terrain, wetland, cold and lake contacts have separate land-side and shallow-water palettes. Each side is clipped to its actual land/water mask; the material treatment does not independently move the shoreline or imply drainage. The underlying continuous near-shore contour now combines broad and fine world-coordinate noise, with eight-unit triangles; canonical centers and homogeneous domains are unchanged. Shoreline shape requires renewed direct visual acceptance; landmark context still requires additional work. Review and open acceptance ../regional-review/reopened-regional-art-direction.json.

regional-landscape-8 adds up to six asymmetric low native contacts around an actual ready native site. Fixed canonical halo lookup and destination-chunk ownership prevent reseeding or duplicate details at planning borders. Root checks preserve true feature/profile/source/state permissions and exclude work, occupation, water and the native subject core. Cache revisions include actual place eligibility/width, preventing late-source arrival from retaining an early empty context.

The first irregular material candidate exposed a 192 ms wetland raster preparation task in a wide desktop view. Candidate display stamps now use screen-size-aware power-of-two runtime levels inside the existing 16-megapixel terrain PixelCache; original files stay unchanged and close views retain their native source. Far regional views have a bounded one-fill native pattern path rather than unbounded tiny stamps. This must be checked in the actual renderer; it is not physical-device FPS certification.

Dense small-scale soil materials use three native CanvasPattern fills with incommensurate scales and a fixed upright orientation, replacing thousands of individual stamps. Overlapping views retain the same native phase. This avoids both the former short repeated lattice and an unbounded giant supertexture; it changes neither source files nor canonical material ownership. Ordinary larger materials retain irregular native patches.

Regional material rendering also resumes across animation frames: each source-space patch batch or native pattern phase yields before the atlas task advances. Pending material tasks keep their own build iterator and are not counted as painted; an obsolete build token cannot publish them. Hex and synchronous callers consume the identical operation iterator to completion. This preserves composition while bounding per-frame preparation work.

Exact native coast/floor source contexts

The approved source set has328exact originals, version3aa7bd09c724e94f: two newly reviewed native files replace one old live material. wetland-floor-v3 is an opaque ground-only source for wetlands at spanHexes=8; the former striped wetland-soil-v2 stays archived and unapproved. The exact original native PNGs are copied unchanged; there is no offline pixel cleanup or generated runtime derivative. Full prompts/provenance are in public/assets/region-composition/shore-dune-grass-prompts.json and native-coast-floor-prompts.json; contextual review is in tile-library/native-coast-floor-review-2026-10-17.json.

The dune-grass contract is regional-shore-1/shore-detail, shoreKind=sand-grass, fields/grasslands, ocean-only, features=[none], states=[wild], width96and anchor[.5,.7]. The approval builder exports shoreKind; client checks bind source and review contract exactly. Nine real dry roots, current actual work/occupation/vegetation state and direction-aware setback fail closed. Legacy mineral contacts retain their reviewed scale/profile role and current work precedence. Selection ranks source IDs independently of source-array ordering. Hex cache keys include actual eligible shore props and display readiness, so neighbor work or delayed imagery repaints the scene.

Thirty-six canonical candidate captures were individually reviewed before contextual approval:20shore and16floor/neighbor/mixed-shore/Hex panels, both desktop and390CSSphone. The pale sandy-strip variant and diagonal floor edit were rejected. A private proposed whitelist was used only before approval and was clearly identified; the normal generated contract is separately rechecked with no source/geography/state interception. Actual live exact-byte and connected capture evidence remain separate from local acceptance. These are cosmetic refinements, without simulation commands or real-money spending.

Exact quiet dry-ground approval and relief framing

The current release contract contains 325 exact approved originals, version95d12af2e666dd9a. Two unchanged opaque native RGB ground files at spanHexes=8 replace five former directional grassland/hill/mountain paintings; the originals are retained as unapproved reference inventory. hill-soil-v1 is reviewed for grasslands/hills and corrected mineral-floor-v1 for mountain only. The grey first mineral draft failed canonical palette integration and remains unapproved. Full prompts, native hashes, generated paths and corrective edit/reference roles are in public/assets/region-composition/quiet-upland-prompts.json; exact context evidence is in tile-library/quiet-upland-review-2026-10-17.json. Material coordinates remain shared world coordinates, independent of camera or administrative region. No simulation, terrain identity or gameplay stock is added.

Forty candidate material captures cover actual three-neighbor boundaries, all three profile Region/Hex/neighbor/reload views, mixed soils, real sea/lake contacts and peaks on desktop and390 CSS phone. Two further phone captures verify selected relief framing. The normal renderer is rechecked separately after exact source approval; candidate evidence never substitutes for connected live verification. Current normal approval is generated from the catalog, with no proposed source, player, geography or state interception.

Selected native relief now uses the existing phone subject width and camera offset only when its display record is ready. A reliefKey joins the Hex cache key with actual prop ID, source, position, width and readiness. This prevents a previously cached portrait surviving a changed root-dependent relief or late ready image. Full native source bounds fit beside controls in the regression test; broad ridge, marsh, working-land and neighboring-water cache checks remain covered. Per-profile drawn material diagnostics identify the actual hill/grassland source. Five older archive paintings cannot return as fallback if the new exact approval is removed.

Canonical depth reconstruction and exact mineral-bank context

regional-water-7 / canonical-depth-1 reconstructs signed depth from existing elevation and basin values: min(elevation-0.41, max(elevation-0.52, 0.66-basin)). Three shape-preserving axial cubic reconstructions are normalized by reconstructed absolute depth; the median avoids directional bias while retaining true same-domain hex edges. Canonical centers retain their wet/dry classification and uniform dry/wet triangles cannot acquire an unsaved interior pond or island. Unknown or inconsistent scalar metadata falls back to the retained bounded domain renderer. No world-kernel or generator6 change is involved. Fixed eight-unit tessellation and shared world coordinates keep neighboring views consistent. Existing cooperative row/path preparation, partial-plan invalidation and cancellation checks remain required. The v6 golden fixture is retained; the v7 fixture binds136actual chunks and272continuous samples.

coastal-contact-3 uses sixteen land and twelve water opacity steps with bounded polynomial falloff, quieter underwash and a narrow tide contact. Geological beach width and terrain treatment remain deterministic in shared world coordinates. shore-props-3 binds the unchanged mineral PNG to bank-mineral, none/wild, permitted forest/mountain/wetland and ocean/lake contexts, anchor and nativeWidth46. nativeRockWidth84is allowed only on actual rocky treatment. One real dry center and nine known compatible land/water roots reject work, occupation, unsupported feature/profile/water, missing data, burning, burned or plowed ground. Clearcut alone retains geology. Exact root/source/readiness-dependent Hex caching and actual-draw diagnostics remain in use. Existing sand-grass rules remain separate.

The exact324-source contract, version9bcb2751e6fd8a1e, includes one unchanged opaque native desert-soil source at spanHexes8and retires two repeated baked desert archives. Ground has no baked vegetation, relief, water, roads or settlements. The source book is public/assets/region-composition/natural-banks-prompts.json; source/context decisions are in tile-library/natural-banks-review-2026-10-17.json. Native candidate, normal generated contract, merged regression and connected production evidence are separately recorded in docs/regional-review/natural-banks.json. Proposed whitelist interception is private review only and never substitutes for normal/live acceptance.

Exact cold/woodland ground contracts and retained dynamic layers

The322-source contract, version36c8e4b50c8cdeba, replaces five old ordinary ground approvals with three exact unchanged native RGB originals. tundra-earth-v1 and snow-earth-v1 are ground-only and restricted respectively to tundra/arctic at spanHexes8. Corrected forest-earth-v3 is forest-only at spanHexes6. The native source book, full prompts, original paths, hashes and four rejection decisions are in public/assets/region-composition/quiet-cold-floor-prompts.json; the contextual ledger is tile-library/quiet-cold-floor-review-2026-10-17.json. Initial reference edits retained directional grain. The first new woodland source was rejected because flat khaki material isolated the actual tree groups. The accepted correction uses finer nondirectional olive moss/humus pigment. No source pixels were cropped, filtered, recolored or composited offline.

Native material coordinates, deterministic overlap and source-phase blending remain shared world coordinates across regions and camera changes. Separate authoritative relief, ice, current vegetation/species, actual canonical-place identity, work and occupied structures retain their existing source and root contracts. No kernel, shoreline geometry, physical state or player/save change is involved. Exact approval revocation leaves these profiles without a candidate rather than restoring a retired baked source. Legacy atlas filter regression now uses a retained ocean archive; dedicated exact native-ground regressions cover cold and woodland replacements. Actual drawn-source diagnostics identify the painted native forest/tundra/arctic source. Candidate, normal, merged and connected live evidence stay separate in docs/regional-review/quiet-cold-floor.json.

Shared close coastal mesh —17October2026

regional-water-8 / canonical-depth-2 retains canonical elevation/basin reconstruction and adds world-seeded bounded shore-edge erosion. Local six-neighbor physical gradients and minimum/maximum saved node margins bound displacement; a zero-crossing gate fades before exact canonical centers. Uniform-domain triangle guards and missing-scalar fallback remain. Region uses8unit vertices/480unit chunks, Hex uses2/120; both have60rows and sample the same continuous scalar field with72unit halo and256chunk viewport cap. Both the water revision key and actual client plan cache include mesh quality. Native prop selection retains its existing coarse lattice and dry/root/work/hazard guards. The136chunk/272sample v8fixture supplements the retained v7history; actual client regressions cover separate mesh caches, late-neighbor repair, close painted canonical centers, overlapping neighbor views and exact reload. Native source manifest remains322/version36c8e4b50c8cdeba. Review ../regional-review/close-shores.json.

Final reopened regional acceptance — 17 October 2026

Implementation4e2d145 retains world generator6, saved world/instance identity, simulation and native place/building context declarations. Eight new exact native paintings and thirteen archived ground approvals reduce baked motif repetition; current322-source hash whitelist/version36c8e4b50c8cdeba remains enforced. Shared material phases, local foundation contacts, canopy/relief hierarchy and canonical-depth-2 shores use world coordinates. Region8/480 and Hex2/120 meshes share one field with bounded erosion and separate cache identities; native prop identity remains on its stable coarse lattice. Source/context audit finds38unique place hashes and no cross-feature identical-byte aliasing.

The current217checks cover rendering, context approval, saved domains, adjacent overlap, late dependencies, working land and navigation in isolated and merged trees.32normal plus36connected native production frames, exact322originals/16clients/5wiki/2metadata/health checks and actual warm return are accepted separately from cumulative44definition/167legal-context/835stage and16feature/62paired-context audits. Six pre-existing legacy source/reference failures are retained; this is not a full-suite-green claim. Source prompts, references, rejected drafts, unchanged native hashes, screenshots and viewport-performance limits are recorded in final evidence ../regional-review/reopened-final-acceptance.json.

Identity-preserving landscape distribution — 17 October 2026

regional-landscape-9 avalanches FNV before using incidental random variates. Previously adjacent member suffixes were strongly correlated, compressing clumps into narrow arcs and repeating choices. Fixed world coordinates, source-role/profile/state permissions, member/root exclusions, missing dependency tracking and cache bounds remain. Canonical natural-feature source selection retains the prior FNV mapping so known grove/pine/dune/ice/reed/palm identities stay fixed; the initial identity-changing prototype was rejected. The regression probes256fixed eight-member groups for broad angular coverage and the existing actual-context suites retain native silhouette, source-order, overlap, reload and current-state guarantees. Geography, generator6, source pixels and322-image approval/version36c8e4b50c8cdeba are unchanged. Broader original-vision acceptance remains open.

Native low outcrops and shared spacing — 17 October 2026

regional-ridges-5 replaces two bright slope sources with unchanged native low-rock-shoulder-v1/v3. Approval remains322originals, version2eb19862a776fc08; retired originals remain archives and are excluded from the active manifest/whitelist. Both256width sources use complete positive-alpha envelopes, checked directly from native RGBA bytes. A deterministic world-coordinate priority rejects nearby low slopes; density uses actual local elevation range and the existing shared geological mass field. Focal peak source selection and layout remain unchanged. Current work/occupation, mountain none/peaks permissions, full-root availability, overlap/reload and dependency invalidation remain covered. Twenty normal native panels and221affected isolated checks accept this increment; merged/live checks remain separate. See scoped evidence ../regional-review/vision-outcrop.json and the exact prompt/rejection ledger in public/assets/region-composition/vision-outcrop-prompts.json. Overall art-direction acceptance remains open.

Shared woodland hierarchy10 — 17 October 2026

regional-composition-10 increases the contrast of the existing672/176world-coordinate habitat fields. Mature quiet interiors can remain without a decorative crown; sparse low-cover regrowth keeps its deterministic retained candidate. Open mixed-broadleaf habitat favors the existing exact single-crown contract; dense habitat and conifers retain their appropriate groups. Root candidates, native scale, age/species approval, natural edge taper, canonical-site core clearance, real occupation and state revisions stay authoritative. No source,322-image approval/version2eb19862a776fc08, geography, simulation or yield changes. The complete-known-forest regression requires multi-cell visual gaps without simulated clearcuts and exact neighboring/reload agreement. Warm-cache clearing/regrowth/construction coverage selects an actual visible tree rather than assuming an arbitrary center is occupied. Scoped evidence ../regional-review/vision-woodland.json. Height lighting remains a private experiment.

Typed native beach material and coast field3 — 17 October 2026

regional-water-9/canonical-depth-3 adds bounded mixed-contact erosion to the existing reconstructed world field. Its gate vanishes at saved centers and same-domain edges; homogeneous triangles remain unchanged. Region8/480 and close2/120 still prepare60rows per chunk, share one world field, track missing dependencies and retain separate mesh cache identities. The old136coast fixture hashes remain reproducible; the new fixture intentionally changes62contour chunks and25of272field values. Three-world saved-center, six-direction edge, uniform-triangle and readiness assertions remain independent of fixtures.

regional-shore-material-1 admits only exact approved shore-material sources with sand/ocean permission, explicit allowed profiles, width/aspect and native readiness. quiet-beach-sand-v1 is unchanged opaque1536x1024RGB8 at768world units; its absolute pattern phase and land-side clip remain stable across regions, camera motion and reload. Per-profile treatment groups prevent unsupported nearby banks from suppressing a supported material. Missing images retain prior coast presentation; late native readiness/eviction changes the actual Hex ground key. No general-terrain, lake, rock, marsh or cold substitution is allowed. Current approval323/version4d8d1c59d90db875 retains every earlier322source hash. Scoped evidence ../regional-review/beach-material.json and full prompt/reference ledger in public/assets/region-composition/beach-material-prompts.json separate private source review, normal build and connected live acceptance.

The library catalog handles shore-material explicitly, with its own representation and beach-only description. Adding one exact native source gives305regional cards and323approved files; individual file/context approval remains the filter.

Canonical terrain form and coherent landmark settings — 17 October 2026

Historical lighting behavior, superseded on 19 October 2026: The preceding native-beach increment is verified on production at commit 595be6048dd333ebabf3ac1f3933152ffb62722c, deployment 5996f161-ed21-4a14-aecb-0da60b961d24: 34 connected native panels, 323 exact approved originals and unchanged authoritative world/instance. This next renderer increment adds restrained directional relief lighting from actual canonical elevation. A compact world-space quadratic reconstruction preserves affine slopes without hex-grid lighting artifacts; neighboring viewports share the same 16-unit raster phase. Preparation yields after at most 256 samples inside the existing scene frame budget. Incomplete elevations remain neutral, oversized views fail safely, and cancelled builds never publish partial lighting. Lighting composites over existing ground before the authoritative shore mask; uniform inland Hex views use the same pass. Original source pixels, water topology, resource yields, saves and commands are unchanged.

Incidental mineral ensembles now contain one or two members and occur less often, particularly on temperate ground; canonical grove, pine, dune, ice, geology and resource identities retain their existing hash and anchors. Real native landmarks may receive at most two compact groups of three small compatible details. Material follows actual surrounding climate, the source width respects focal scale, and all root samples still reject water, occupied, worked or incompatible ground and missing source readiness. Existing natural state changes continue to clear and regrow eligible vegetation.

The optional Regional hex grid defaults off for fresh preferences, giving terrain a continuous presentation. Existing explicitly saved on/off preferences survive; Settings → Map & controls → Regional hex grid restores the grid. Selected-hex and regional boundary cues remain. Getting started, Beginner guide and Start guide were reviewed: selection, founding reviews, staffing, food and first-project requirements are unchanged. The overall original-vision goal remains active pending continued visual comparison, connected landscape and coastline review; this increment does not claim the painterly reference has been fully matched.

Historical lighting behavior, superseded on 19 October 2026: Implementation: regional-height-1 reconstructs a weighted quadratic field over immutable elevation samples, emits a world-aligned bounded numeric light raster and composites with source-atop before the canonical shore clip. regional-landscape-10 preserves the separate canonical natural-feature hash and uses stable place-setting group identities. gonz-settings-v1 keeps explicit booleans while its fresh grid default becomes false.

Hex native-source readiness — 17 October 2026

Connected production review of the terrain-form increment exposed premature Hex readiness: a cold-load portrait could be labelled ready while its approved ground or canopy was still loading. The artwork was able to refresh, but that state could falsely accept fallback graphics as a completed scene. Hex now tracks the exact selected/visible terrain and native object source requests, includes their readiness stamp in its portrait cache key, and reports preparing until those requests settle. Unavailable requested art is reported separately as fallback; unrelated distant requests do not hold the local view. Image errors trigger the same bounded refresh as successful loads. This changes no original image, geography, save, costs or gameplay orders.

Getting started, Beginner guide and Start guide: your first village were reviewed: keep Global / Region / Hex and current site-inspection controls; allow the reviewed illustration to finish loading before judging the terrain or landmark. Founding, food, staffing, first projects and their live quotes remain unchanged. Overall original-vision goal remains active. The preceding deployment e9677dc30b9b3c5c2f06d850ce374894a3c48a56 passed243isolated/merged checks and exact323source/18client/wiki/catalog/world checks, but its full cold-load live visual acceptance was withheld for this fix.

Native crown keep and independent ground variation — 17 October 2026

The terrain-form and Hex-readiness release3ad6f881 is verified on live production:42completed native panels,246isolated/merged checks, exact323images/18clients/library/wiki/catalog and unchanged world/instance. This increment retains the existing feathered world-space material painter while strengthening its patch-parameter hash. The previous x/y and y/size correlations(-.256 and-.445 over6904patches) fall to-.020 and-.016. Native image pixels, source angles, material scales, physical terrain and shoreline contours remain unchanged. Opaque native-phase experiments were rejected for visible tile edges.

One exact new native transparent crown-keep castle adds a stronger connected skyline and a transparent courtyard showing the actual ground. It is an additional existing-castle variant on fields, grasslands and hills; the original courtyard and round keep remain. The actual stable three-variant selection resolves all518eligible castles:164new keeps,178courtyards and176round keeps. Two narrow shores rejecting a forced larger source retain their round keeps under actual selection; no foot/anchor/scale or water guard is relaxed. Original source/context review covered20native panels, and material review covered30neighbor/terrain panels. Approval becomes324exact images and306regional library cards; every prior323image file and preceding catalog record remains unchanged.

Getting started, Beginner guide and Start guide: your first village were reviewed against current navigation, site inspection, separate order reviews, staffing, food and first projects. This is presentation only: it creates no settlement, building, ownership, stock or order and changes no cost or prerequisite. The overall original-vision goal stays active for broader connected landforms and natural coastline composition.

Finer native ground and quiet water — 17 October 2026

Historical lighting behavior, superseded on 19 October 2026: The crown-keep and independent material-variation increment 6d1a89f4 is verified on live production: 50 completed native views, 251 isolated and shared-tree checks, 324 exact source files and unchanged authoritative world/instance. The next scoped increment keeps the same geography and height lighting while reducing land material span to four hexes and using two quieter native ocean/lake sources at two-hex span. Four older broad-ripple water variants are archived and lose AI approval; their original files remain. Every other 320 approved original is retained. Approval becomes 322 exact images and 308 regional library cards. All 74 private native contexts were inspected, including neighboring regions, eleven terrain profiles, actual castle surroundings and sand, marsh and cold banks. A brighter ocean candidate was rejected.

Existing feathered material preparation continues up to a bounded 4,096-patch estimate so finer regional materials do not prematurely switch to hard rectangular native repeats. Sixteen-patch steps use the remaining existing eight-millisecond frame budget; slow work and cancellation retain their guards. Building placement always uses the full native source geometry, including when Region paints a smaller display image. Hex readiness includes the actual placement job as well as image loading; a loading fit cannot be labelled complete. Narrow coastal-castle checks also verify that the foreground really contains painted native pixels. Unavailable fits remain explicit fallback, without relaxing dry-ground or occupation checks. Old links and restored region cameras use the same lower zoom limit as ordinary Region navigation, avoiding a stuck oversized shoreline request.

Getting started, Beginner guide and Start guide: your first village were reviewed against Global / Region / Hex, site inspection, founding reviews, staffing, food and first projects. No cost, prerequisite, timing, saved world, ownership or gameplay order changes. This scoped increment does not finish the original-vision goal: broad landform composition and straighter marsh-shore segments remain under review. Native provenance and review ../regional-review/quiet-water-ground-increment.json.

The image approval filter preserves exact native PNG source paths. Only the explicit legacy production-raster alias selects its reviewed runtime WebP; a native PNG is never silently treated as a WebP derivative.

Connected natural shores — 17 October 2026

The shoreline display now applies four gentle, seeded world-coordinate displacements to the previous canonical-depth field. This gives beaches and marsh banks less regular bends while preserving the existing field’s connected components. Each displacement has a conservative Lipschitz bound below 0.83 and is pinned at saved cell centers, every same-domain edge and uniform-domain triangles. A protected neighborhood around each saved center retains the complete previous eight-unit display triangle; this also preserves its actual painted material, rather than only the scalar at an infinitesimal point. Neighboring regions use the identical world function. A stronger additive erosion trial was rejected because it introduced an isolated water pocket beside an actual beach. The selected coordinate mapping leaves that witness connected. The mathematical guarantee concerns the continuous field; actual Region and Hex mesh output is separately checked.

Actual ocean/lake ownership and shore treatment still use the original point’s canonical neighbors. Geometry remains eight-unit Region / two-unit Hex, sixty resumable rows per chunk, with existing missing-geography, cancellation and occupied/worked-ground guards. The previous v9 module and 136-chunk fixture remain immutable regression history; the new v10 fixture covers the same locations. All 322 exact approved images, their pixels, source contexts and catalog records are unchanged. Existing worlds and player orders are unchanged.

This increment addresses coastline shape; the original-vision goal remains active through actual normal and connected production screenshots and final broad-landform comparison. See connected-shore evidence ../regional-review/connected-shores.json.

Mountain scale and current coastal verification — 17 October 2026

The connected shore release (12c835e) is verified on live production: 74 completed native panels, all 322 exact image hashes, client files, guides, catalog and healthy unchanged world identity. Both workspaces passed 264 scoped checks. Saved centers retain their complete coarse display neighborhoods; beaches, marshes and cold coasts share continuous neighboring geometry.

The two existing transparent granite peak sources now use a reviewed 104-world-unit width, replacing 168. Every actual secondary peak retains its canonical identity, position, anchor and full original aspect. Existing dominant 256-unit ridge masses, woodland, landmarks and actual living-world changes retain their own scales. This clearer size hierarchy makes repeated smaller silhouettes less prominent and leaves room around main terrain forms. Original source pixels, all other approval contexts and saved geography are unchanged. Both source shapes were inspected at actual uncovered canonical peaks in Region and Hex, alongside neighboring regions, eleven terrain profiles, castles and coasts: 82 private native contexts. Normal and connected production acceptance remain separate; the original-vision goal remains active until final live comparison. Scale review ../regional-review/secondary-relief.json.

Continuous Hex surroundings — 17 October 2026

The preceding mountain/shore release (75942ce) is verified live in 82 native desktop/phone panels, with all 322 exact image hashes and client, guide and catalog checks. Both workspaces passed 264 scoped checks.

Hex now gathers the same real canopy chunks, ridges, relief and landscape/shore props throughout its visible world bounds as Region. An inspected woodland glade can show neighboring trees rather than appearing bare because no tree is rooted in its center cell. Selected structures and canonical places retain their subject framing; natural woodland uses a wider context. Shared chunk revision keys and the foreground stamp follow actual neighboring growth, clearing, fire and occupation. Source readiness includes the whole painted foreground. The existing chunk budget is checked before surrounding cells are materialized.

A private full-context trial exposed oversized wetland reeds and was rejected. The three existing native reed sources now use widths24/40/40 instead of52/96/96, consistently in Region and Hex. Original pixels, approved climates/roles/states, saved geography and simulation remain unchanged. Private native visual acceptance is recorded separately from normal and live verification. The original-vision goal remains active until fresh production screenshots are assessed. Review ../regional-review/hex-botany.json.

Prepared terrain and close-view readiness — 17 October 2026

Shared Hex surroundings and smaller wetland reeds are deployed in 39e20e3. All 322 native image hashes, client files, wiki pages, catalog, health and world identity were verified; both workspaces passed 267 regional checks and 132 normal panels were accepted. Live visual review accepted 131 of 132 panels and rejected one magical-site desktop capture with flat green ground. Four fresh loads and 50 navigation views showed correct textured raw canvases; the cause of that single frame is not conclusively attributed. The failed frame remains recorded.

Hex readiness now waits for relevant terrain bitmap preparation as well as loaded source images. A late successful terrain bitmap increments a revision included in the Hex cache key and schedules a rebuild. Worker failure releases the preparation request into the existing main-thread fallback; unrelated jobs do not hold source readiness open. This closes an independently verified missing cache dependency without claiming a confirmed cause for the isolated rejected frame. Three behavior checks cover late completion, failure and relevant readiness. Eighteen private native desktop/phone panels were accepted, including actual ground-pixel diagnostics; normal and connected live verification remain separate. All source artwork, approvals, shared scenery identities, coast geometry, saves and simulation are unchanged. The regional art-direction goal remains active for final coast and original-vision review. Readiness review ../regional-review/hex-ground-readiness.json.

Natural coast field and bank composition — 18 October 2026

Production 'c84d012' has 132 accepted connected native panels and 96 actual Hex-ground checks; all 322 approved image hashes, clients, wiki, catalog and unchanged world identity were verified. Both workspaces passed 270 scoped checks.

'regional-water-11' / 'canonical-depth-5' pull back the retained base scalar field through four broad steps (amplitude .1size, wavelength 4size) followed by four fine steps (.05size, .65size). A continuous dry-weight gate fixes same-domain edges; radial disks of radius '8*sqrt(2)+.1' protect complete coarse saved-center neighborhoods, with a smooth .6size ramp. Independent displacement Lipschitz bounds are below .881 and .827. Original-point land/water owners remain unchanged; finite meshes and connected witnesses have separate checks. The exact published v10 module and 136-chunk/272-sample fixture remain independently reproducible alongside the unchanged v9 evidence. All 518 canonical castle footprints still fit the original guards and minimum scale.

'shore-props-4' reduces eligible bank-mineral candidates from the two triangles of one physical mesh square by a stable seed/identity priority. It retains the chosen candidate byte-for-byte, is input-order independent and preserves other props. Each square belongs to one chunk, so neighboring regions cannot choose separate copies. Native source bytes, all 322 approval contexts and simulation remain unchanged. Private 132-panel acceptance is separate from normal and live verification. Composition review ../regional-review/natural-coast-composition.json.

Coast publication cache correction — 18 October 2026

The first pre-deployment readiness probe cached the prior shoreline module at the proposed new asset URL. Production now uses a fresh coastline cache version; no renderer logic, approved source, geography, saved world or gameplay instruction changes. The accepted132normal native panels and274scoped checks remain applicable to the identical renderer bytes. Fresh standard connected production loads must verify the new module before live artistic acceptance. Beginner and village-start controls, prerequisites, costs, timing and success checks were reviewed and remain unchanged.

Current production visual acceptance — 18 October 2026

Runtime43ea180, Railwaydd71f278-fe79-43c8-9dbb-3cd70cbdd91d, is accepted in132 actual connected native panels. All96Hexgroundcanvases contain textured pixels with no reported lost context. Exact native SHA reuse and individually viewed new frames are recorded separately; failed prior evidence stays rejected. Both workspaces pass 274 scoped checks across 54 files. All 322 approved source hashes,19 client files, library, five wiki pages, catalog/index and healthy unchanged world identity were verified.

Final evidence contains the actual west/center/east camera URLs and five unmodified native map-panel screenshots. Their manifest records include per-capture production commit, world, time, viewport, dimensions and SHA256; historical local screenshots retain their original provenance. The phone view uses a 390x844 headless browser viewport and is not a physical-device FPS measurement. Five source-review prose records now reflect accepted live scale/context; generated approval permissions and source hashes are byte-for-byte unchanged. Current production acceptance ../regional-review/region-vision-production-acceptance.json.

Native Region-ground detail correction — 18 October 2026

User feedback rejected the soft grass/desert backgrounds after runtime b4a39c6. Matched-camera trials found that removing the intermediate terrain LOD alone did not restore enough tactile detail. Reverting physical source spans alone also left soft desert material and enlarged Hex grain, so neither renderer/sampling nor scale experiment is shipped.

Three native opaque 1254 × 1254 RGB8 source outputs replace the hill/grass, desert and wetland floors, retaining exact generated bytes. The wetland file is the final tool-generated palette variant. Source approvals bind the new hashes to ground roles, existing profiles and 4-hex spans; the three former sources retain their original files and lose active approval. 319 other active hashes/contexts are unchanged; 322 exact files remain approved. All previous source scales, world-phase placement, geometry, camera behavior, caches, masks, mutable land uses and simulation are unchanged. Existing exact-source/retirement tests cover the new files and the preserved archives. Ground-detail evidence ../regional-review/ground-detail-regression.json.

Vision-derived native ground materials — 18 October 2026

Five exact unedited 1254-square opaque RGB8 outputs replace natural-meadow-v1, forest-earth-v3, mineral-floor-v1, tundra-earth-v1 and snow-earth-v1. The original region vision is an art-direction reference only. Each new material has its own immutable hash, ground role, single allowed profile and four-hex context; archived originals retain their bytes and lose active approval. The 317 other active sources and contexts are unchanged, and the active set remains 322. No runtime renderer, mask, camera, geometry or simulation change is needed. The field source is now an explicit member of the ground manifest, allowing the same exact source/scale checks as the other profiles.

Native review includes all nine land profiles in Region and Hex on desktop and phone, neighboring views and castle/beach contacts: 54 private panels. Normal rendering and actual connected production are verified separately. This coverage checks source readability and style continuity; it does not claim a physical-phone frame rate or completion of all earlier regional-design work. Source hashes and provenance ../regional-review/vision-ground-detail.json.

Original-world deployment and separate-world removal — 18 October 2026

The original production service e6b2d196-f7c7-42aa-a700-966133aabef2 remains on main at https://worldofgonz.com, using WORLD_SEED=GONZ-CONTINENTS-01, generator 6, world ID gonz-world-v1:d755acd809b577448db348843599dff1 and the existing persistent instance. Retain volume a6027caa-5430-4cd2-90fd-864ec9715ee0 mounted at /data. Deploy artwork/client updates against that existing save; do not change the seed, import the second world's state, or reset the DATA_DIRECTORY.

The separate service d88c3230-a725-440c-98ec-d91b03fd1f48 and its dedicated 5 GB volume bb364848-7ca4-45de-a973-a7b075deb363 have been deleted as authorized. Its domain, deployment triggers and independent saved progress are retired. The codex/new-world-20261018 Git branch is historical source only and is not an active second service.

The original and former separate service shared the same 322-image approved-art manifest ab173645cf316d93 and renderer; this refresh changes availability guidance and deployment, not art sources or simulation rules. Verify healthy startup, unchanged authoritative world/instance identity, ownership of the original volume, exact approved asset checksums, connected region/shore views, and absence of both removed resources when accepting this release.

Art Atlas input and synchronization — 18 October 2026

The complete uploaded input contains 8,303 files with release SHA-256 checksums. The local mirror verified all hashes, retained every uploaded ID and added fourteen versioned corrections as WOG-A-008304 through WOG-A-008317. Metadata preserves provenance and approval decisions; measured raster dimensions take precedence over embedded SVG text. Header regression coverage prevents PNG metadata from being mistaken for the document format.

Atlas publication carries the catalog metadata, checksum manifest and exact native new images together. Added image files are bundled in the application image and the existing union inventory includes both bundled additions and volume artwork. The original art volume, world files, runtime mappings, game renderer and game approval whitelist are retained. Source approval, atlas presence and observed world rendering are distinct. Local working receipts bind downloads, candidate identities and canonical copies to SHA-256; subsequent uploads must be reconciled by path/hash and guarded against concurrent head changes.

Retired Region/Hex height-light overlay — 19 October 2026

The shared finishRegionalGround compositor now applies the canonical shore clip and a single untinted ground blit without the regional-height-1 sample/paint job. The client no longer loads regional-height.js; that retired rendering module is removed. Hex cache keys and the game script version identify terrain-lighting-off-1, and map diagnostics report regionalHeight=off / regionalHeightStatus=disabled. No elevation-light raster, extra brightness/darkness overlay, or lighting preparation wait is left in the Region/Hex ground path.

Ground texture sources, opacity normalization, cross-region material interpolation, shore coverage/contact blending and native landmark/tree imagery remain unchanged, as do globe lighting and saved geography. Regression checks exercise the actual ground compositor with a throwing retired-lighting stub, verify shore clipping and one full-opacity blit, surface release and cache behavior. Production checks must confirm native source hashes and unchanged authoritative world/instance identity; removal of terrain lighting is a renderer change, not a world reset.

Atlas-only source and relationship update — 19 October 2026

The registry and checksum inventory now contain 8,319 maintained files with 329 source approvals. Two new exact native PNGs are bundled alongside the previously published art; all 8,317 prior paths, IDs and native hashes remain unchanged. Reviewed source contracts, intended source/runtime links and replacement relationships are published with explicit evidence. Source approval and the separately pinned 322-source game whitelist are distinct snapshots; this publication does not run source approval generation into the game manifest.

The current game files and terrain-lighting correction remain byte-identical to the release base. Local continuous-material rendering and its candidate-world checks are pending their own rollout. Metadata review never authorizes world entities or planned gameplay. The catalog test pins both source and deployed snapshots, and the source/derivative review records preserve unknown generation provenance and rights.

Continued Atlas publication and renderer separation — 19 October 2026

The catalog/checksum snapshot contains 8,325 maintained records and 331 source approvals. All 8,319 prior identities and image hashes are retained; six new exact native PNGs and their generation/registration JSON are bundled alongside the unchanged original artwork volume. The source decisions, proposed replacement links and per-file findings remain independent of live placement. Four native additions stay unapproved; woodland and dark slate are approved only for their typed ground profiles/spans.

The game renderer/index, deployed art/terrain routing, compact metadata index and 322-source whitelist remain byte-identical to the prior a60698d release. Local renderer/performance changes are outside this Atlas payload. Neither metadata nor a source-role repair activates a gameplay system or construction stage. Before publication verify the isolated payload and current remote base; afterward verify complete live metadata/checksum values, every update image, union inventory and desktop/phone Atlas UI.

Next 100 native source inspections and two edge candidates — 19 October 2026

The Atlas catalog/checksum snapshot contains 8,327 maintained records and 331 source approvals. Exactly 100 prior native records gain SHA-256-bound individual source findings; two new native PNG candidates link to WOG-A-003887 and WOG-A-003897. All 8,325 prior IDs and native hashes remain unchanged. Fresh decode/alpha/bounds checks cover all 100 originals and both outputs. Native imagegen bytes are copied directly without resampling, compression or alpha normalization; output maximum alpha is 254. The date candidate retains eight alpha-1 left-edge pixels and remains pending final cleanup.

The 29 retain/contact decisions, 69 canonical-role decisions and two targeted correction decisions grant zero source approvals. Candidates remain unapproved pending independent role, lifecycle where applicable, actual Region/Hex scale, terrain/water contact and normal desktop/phone context. This Atlas payload preserves all deployed renderer/source-routing/compact-index/server boundaries and the 322-source game whitelist. It does not deploy local performance work or claim new world appearances.

Local native-ground context evidence synchronized — 19 October 2026

The Atlas retains 8,327 maintained records, 331 source approvals, 24 update paintings and every prior native hash. Only WOG-A-008324/008325 gain newer explicitly local QA context evidence. Their normal desktop/phone Region/Hex reload, neighbor and return captures use the actual 331-source local whitelist; all 24 final screenshots match the prior baseline exactly, alongside eight exact Edge shoreline RGBA cases. Full-game readiness is still open: forest scene slices are 14.4/24.3 ms and slate 11/23.9 ms against unchanged desktop/phone limits 12/20. Both phone drag p95 values are 33.4 ms within 34. Phone evidence is Edge at 4× CPU throttling, not a physical-device result.

The local candidate caches pure resolved paths while checking current approval every time and starts each original complete shoreline contact pass on a fresh frame. Native image bytes/detail, material grain, stroke order, widths, colors and opacity remain intact. The renderer candidate is archived as local evidence, not activated. The deployed renderer/index/source routing and 322-source game whitelist, saves, geography, simulation and controls remain unchanged. Specific place/state/lifecycle, broader performance/device and production evidence remains pending. See context release evidence.

Following 100 exact native findings and one alpha-repair candidate — 19 October 2026

The Atlas contains 8,328 permanent records, 25 update paintings and 331 source approvals. Exactly 100 originals (WOG-A-003934–WOG-A-004033) gain separate SHA-256-bound full-native findings: 9 retain/contact, 85 canonical-role definitions and 6 localized artwork corrections. Fresh preflight decode/alpha measurements and later exact-byte checks preserve all prior images. Diagnostic source-over views confirm selected fringe/color issues; they are not normal-world evidence.

WOG-A-008328 is an unapproved native 1254×1254 PNG repair candidate linked only to WOG-A-004028. Native generated bytes are copied without resizing, recompression or alpha normalization. The original has 116,565 enclosed pixels below alpha 128; the candidate has four, which still require inspection. The sampled solid regions have no enclosed low-alpha pixels in the candidate; exterior-connected transparency is measured separately. Most solid output alpha is 253/255, with 34 alpha-1 frame pixels. These diagnostics neither approve the source nor prove contact, lifecycle, normal rendering or live appearance. All deployed renderer/compact-index/server boundaries and the 322-source game whitelist remain unchanged.

Native repair provenance and remaining checks — 19 October 2026

WOG-A-008329–WOG-A-008333 are separate exact native 1254×1254 built-in imagegen outputs linked individually to WOG-A-003967, 003974, 004006, 004013 and 004033. No original overwrite, resizing, recompression or alpha normalization. SHA-256-bound input prompts, full decode/alpha diagnostics and ten new native light/dark candidate composites accompany authored individual reviews; ten identical published original composites are reused by hash. Most solid alpha is 253; frame alpha1 counts are respectively 20, 61, 17, 9 and 11. Neither the near-opacity nor native source-over checks prove full transparency/contact/style/game readiness. Interior pixels/line weight differ from the originals.

The catalog has 8,333 records / 30 update images / 331 source approvals. All 8,328 previous IDs, native hashes and approval objects remain intact. Every deployed renderer/server boundary and the 322-source whitelist stay pinned. Canonical finite roles, style, technical cleanup/disposition, states/lifecycle, normal desktop/phone Region/Hex, performance and live-world verification remain pending.

Bounded canonical-mask experiment — 19 October 2026

The archived prototype yields between original complete material passes and between bounded 64-face portions of canonical mask construction. Solid paths retain one original complete fill; transition faces keep their original order, clips, gradients and compositing operations. Partial mask state belongs to one active paint job and cancellation unwinds both nested saved contexts. No image downscale, new repetition, mask-resolution reduction, lower-quality interpolation or native-source replacement.

62 targeted checks pass, including original command parity and every pending cancellation phase. Eighteen nonempty native raster cases are exact for the two sources. Candidate and original-control runs each cover 24 normal Region/Hex desktop/phone captures. Actual per-context timing failures and nonzero whole-screenshot differences remain in the SHA-bound study; original-renderer controls establish baseline variation without assuming every difference is caused by the prototype. The original default is restored and all deployed game/server boundaries, including the ground module, are pinned. The two Atlas localRenderPrototype records explicitly state archived, non-default, non-deployed and fullGoalAccepted=false.

Exact native review records 4034–4133 — 19 October 2026

100 SHA-256-bound complete native inspections record 42 retention/context decisions, 52 role-definition decisions and six localized artwork corrections. All 8,333 prior native identities/hashes survive; no source approvals are added. The rejected oasis proposal documents a false-positive transparent-preview finding: native light/dark source-over crops do not reproduce the apparent gray patch. The dune proposal repairs a damaged outer ledge but changes native paint; output is 1313×1198 versus original 1314×1197, with no post-generation resizing, mostly alpha-253 solid pixels and 37 alpha-1 frame pixels. Neither proposal has source or world-readiness approval.

8,335 maintained / 8,379 working records; 331 source approvals, 32 update proposals/paintings, 7,343 first individual reviews remaining and zero full-goal accepted. Atlas metadata, exact checksum rows and bundled native files synchronize together. All 11 deployed runtime/server boundaries, compact routing index and the 322-source game whitelist remain pinned. No new world-context or live-world appearance is inferred from Atlas availability.

Exact native inspections 4134–4233 — 19 October 2026

100 SHA-256-bound complete native inspections record 42 retain/context decisions, 44 canonical-role decisions and 14 localized corrections. Seventeen native light/dark diagnostic pairs distinguish actual purple/gray cutout remnants and pink/gray paint damage from thin warm outlines requiring contextual style checks. None of the 100 originals reaches the image frame. All 8,335 prior identities and native hashes remain intact, with no added source approvals.

Two exact native built-in outputs stay separately registered: Island Passage water-edge and Lava Fields smoke repairs, both 1254×1254 with zero nontransparent frame pixels. Both repair the identified defect in native backings but change fine paint and have mostly alpha-253 solids; no claim of exact restoration or absence of detail loss is established. 8,337 maintained / 8,381 working records; 331 source approvals, 34 update images/proposals, 7,243 first individual reviews remaining and zero full-goal accepted. All 11 deployed runtime/server boundaries and the 322-source game whitelist remain pinned. Atlas metadata, checksum records and bundled outputs synchronize together; world appearance and mesh/performance acceptance are not inferred.

Native source inspections4234–4258 —20 October2026

25 exact native SHA-256/decode/alpha checks and separate complete-file views record five retain/context,14 canonical-role and six localized-correction decisions. Seven light/dark native diagnostic pairs confirm water-edge purple remnants, one smoke streak, a detached fleck, a small pale cutout patch and two damaged smoke transitions; a thin warm forest outline is retained for context review. All25 images have zero nontransparent frame pixels. Existing8337 identities, native hashes and all AI approval objects remain exact. 8,337 maintained / 8,381 working records;331 source approvals,34 update images/proposals,7,218 initial individual reviews remaining and zero full-goal accepted. No renderer, whitelist or simulation change; native dimensions and aspect ratios remain intact. See the review.

Removed readiness claims derived from five variant paths and three runtime/export card types. Classic cards report their actual catalogued variant count; runtime and production-file cards use catalog labels. Source approval remains governed by exact-file approval rules, not these availability labels.

Native source reviews4259–4283 —20 October2026

25 separate complete-native inspections and fresh exact SHA/decode/alpha checks record14 retain/context, six role-definition and five localized-correction findings. Seven native light/dark diagnostic pairs retain contact shadows and true transparent branch gaps while confirming pink edge residue, a hard mist boundary, crown contamination and two discolored smoke transitions. All25 sources have zero nontransparent frame pixels. All8337 existing identities/native hashes and complete AI approval objects remain unchanged. 8,337 maintained /8,381 working records;331 source approvals,34 update images/proposals,7,193 first individual reviews remaining and zero full-goal accepted. Exact findings are separate from source approval, canonical binding, normal desktop/phone context, lifecycle, nonrepeating mesh, performance, integration and live use. See the review.

Rejected native smoke edit —20 October2026

A separate native monastery-smoke edit removes the confirmed pale yellow/pink bulb, but native masonry crops and exact comparison expose changes beyond the smoke target.944,043 pixels outside the target differ, including912,604 visible RGB changes. The1038×1515 output has mostly alpha253 solids and15 alpha1 frame pixels. The broad generative output is explicitly rejected as an active replacement; all8,337 existing metadata records, artwork hashes and approval objects remain exact. The original chimney repair remains open. No generative output is downscaled,recompressed or alpha-normalized. 8,338 maintained /8,382 working records;331 source approvals,35 update images/proposals,7,193 first reviews remaining and zero full-goal accepted. No renderer,game whitelist,world,save,geography or player-control change.

Native source findings4284–4308 —20 October2026

25 complete mountain-themed originals4284–4308 have individually authored exact-SHA source findings: six retain native art for context checks,17 need canonical roles and two need targeted correction. Native light/dark crops confirm blue-purple/gray outlet residue4286 and detached pale marks plus pale green/pink water-edge residue4306. Thin warm mountain outlines and coherent white/gray town smoke are retained. Mountain Pass4296 has14 dark partial-alpha frame pixels,max81; the inspected area shows soft shadow contact rather than opaque cliff clipping,so a margin/explicit-disposition gate remains. All source detail,dimensions and existing approval objects remain exact. 8,338 maintained /8,382 working records;331 source approvals,35 update images/proposals,7,168 first individual reviews remaining and zero full-goal accepted. Basins,springs,citadels,bridges and towns must match saved elevation,flow,route/site footprints and legitimate states. Painted gates,banners,bridges,quays,mines,mills,goods and smoke do not create independent gameplay permissions,ownership,production or lifecycle stages. No repeating mesh pattern,renderer,whitelist,world,save,geography or control change. See the review.

Native masked smoke repair and preservation proof —20 October2026

The user explicitly authorized original-preserving masked edits. A separate1038×1515 native Monastery Hamlet repair replaces the yellow/pink smoke bulb using only a78×111 binary mask.4,835 pixels change;every decoded RGBA pixel outside the mask is identical to the authoritative original. The entire chimney masonry from native y351 down,all other structures,smoke,tree detail,water and transparent frame are preserved. The donor is the smoke portion of the previously rejected broad edit,not its changed masonry. Native light/dark and full-composition inspection accepts this localized smoke correction as a candidate. The original file and all8,338 prior complete metadata/approval objects remain exact.8,339 maintained /8,383 working records;331 source approvals,36 update images/proposals,7,168 first reviews and all role/context/state/lifecycle/nonrepeating-background/performance/integration/live gates remain open. No active replacement,whole-asset source approval,renderer,whitelist,world or save change.

Source-bound volcanic smoke masks —20 October2026

Twenty-five complete native originals4309–4333 were individually inspected with three approved references and four light/dark crop pairs:13 retain native detail for context,9 need canonical roles and3 need localized artwork repair. The mudflat cattail highlights remain intact;the oasis gap trace and two volcanic smoke defects are explicitly recorded. Two separate1254×1254 volcanic smoke candidates replace flat pink/gray patches while preserving every decoded original RGBA pixel outside their masks and all protected foreground rock/rim pixels. The lower smoke collar blends into the original warm vent transition;no resizing,detail filtering or whole-image generative replacement is used. An initial mask with a clipped plume was rejected and corrected before registration.8,341 maintained /8,385 working records;331 source approvals,38 update/proposal images,7,143 first reviews and all canonical role,style/scale/contact,state/lifecycle,existing nonrepeating mesh,complete performance,integration and actual live-use gates remain open. Zero source approvals,active replacements,original image overwrites or renderer/whitelist/world/save changes.

Exact Oasis residue mask and100 source findings —20 October2026

One hundred complete native originals4334–4433 were individually inspected against three separately viewed approved references,with18 light/dark native crop pairs:37 retain native detail for context,54 require canonical role definition and9 require localized corrections. The Oasis Town v5 gap cleanup is a separate native1313×1198 candidate:750 decoded RGBA pixels change within a1520-pixel residue mask,679 positive-alpha pixels are removed,and every pixel outside the mask is exact. Palm fronds,trunk,architecture,rocks,water and paths remain intact. No resizing,detail filtering or whole-scene regeneration.8,342 maintained /8,386 working records;331 source approvals,39 update/proposal images and7,043 first reviews remain. Full canonical role,style/scale/contact,state/lifecycle,all existing nonrepeating mesh backgrounds,complete performance,integration and actual live-use gates remain open. Zero source approvals,active replacements,original artwork overwrites or renderer/322-source whitelist/world/save changes.

Native localized donor masks with exact foliage preservation —20 October2026

Two separate native1024×1536 localized candidates correct Palm Oasis v4 inter-frond residue and Pilgrim Town v4 left-chimney smoke.3,902 and5,897 decoded pixels change inside explicit masks;every outside-mask original RGBA pixel stays exact. Original green palm pixels and their one-pixel neighborhoods,protected trunks,chimney masonry and adjacent rock remain exact. Full-weight local donor RGBA is exact;only the smoke’s five-pixel internal lower collar blends to original smoke. Three removal-mask attempts that left fragments or jagged leaf holes are rejected and retained;the accepted palm candidate uses a generated gap donor with original foliage preservation. The two full generated scenes are supporting intermediates and are excluded as whole-image replacements.8,344 maintained /8,388 working records,331 source approvals,41 update/proposal images and7,043 first reviews. No source approvals,active replacements,original overwrites,detail filtering,resizing or renderer/322-source game-manifest/world/save changes. All canonical role,actual style/scale/contact,state/lifecycle,existing nonrepeating mesh,complete exact-artwork performance,integration and actual live-world appearance gates remain open.

Exact native source triage4434–4533 —20 October2026

One hundred complete native originals4434–4533 were individually inspected against three separately viewed approved references,with20 light/dark native crop pairs:38 retain native artwork for context,51 require canonical role definition and11 require localized artwork correction. All100 uploaded originals remain byte-identical. Findings preserve full native detail and require original-preserving masks for proven defects;no whole-scene repaint,downsampling or filtering. Two River Village smoke plumes contain confirmed pink residue;other coherent neutral plumes are retained. Reef/headland/harbor/wetland water repairs require a defined actual boundary before local fill or alpha edits. Sacred Oasis v5 has22 positive-alpha right-frame pixels including8 opaque rock pixels;Salt Lake v5 has18 partial-alpha neutral shadow pixels,max73,with no opaque frame contact. These cases require different margin decisions.8,344 maintained /8,388 working records,331 source approvals,41 update/proposal images and6,943 first reviews remain. No source approvals,active replacements,original overwrites,new native images or renderer/322-source manifest/world/save changes. Canonical role,style/scale/contact,state/lifecycle,all existing nonrepeating mesh backgrounds,complete exact-artwork performance,integration and actual live-world appearance remain open.

Exact Ruined Oasis residue mask —20 October2026

One separate native1024×1536 Ruined Oasis v4 candidate corrects gray/pink palm-gap residue.1,415 decoded pixels change inside a1,472-pixel mask;197 hand-reviewed empty-space mask pixels clear the faint thread and one isolated gray-green artifact. Every outside-mask original RGBA pixel,protected column and green foliage pixel outside that empty-space polygon stays exact. Three earlier mask studies are rejected:residual specks,faint threads or a stepped edge are not accepted. The full generated scene is supporting donor material only;whole-image color/composition drift is excluded. Original leaflets,trunks,masonry,water and native detail are retained without resizing or filtering.8,345 maintained /8,389 working records,331 source approvals,42 update/proposal images and6,943 first reviews. Zero source approvals,active replacements,original overwrites or renderer/322-source game-manifest/world/save changes. All canonical role,actual style/scale/contact,state/lifecycle,existing nonrepeating mesh,complete exact-artwork performance,integration and actual live-world appearance gates remain open.

Native donor plume and131-pixel color correction —20 October2026

Two separate native River Village smoke candidates preserve the original scenes. v4 retains1023×1537:4,732 decoded pixels change only in the upper-chimney plume mask;identity donor coordinates from1023×1538 support material are consumed above147,with the extra bottom row unused and a five-row internal collar. Chimney masonry and every row147 onward remain exact. v5 retains1254×1254:only131 pink plume RGB pixels are neutralized with their original weighted luminance;all original alpha values,plume shape and edge detail stay exact. Neither source is resized,filtered or overwritten. Every outside-mask RGBA pixel and all village detail remain original. The full generated donor scene is excluded.8,347 maintained /8,391 working records,331 source approvals,44 update/proposal images and6,943 first reviews remain. Zero source approvals,active replacements or renderer/322-source game-manifest/world/save changes. All canonical role,actual style/scale/contact,state/lifecycle,existing nonrepeating mesh,complete exact-artwork performance,integration and actual live-world appearance gates remain open.

River Village preapproval placement experiment —20 October2026

Eighteen normal Region/Hex captures compare the approved village-lane source with exact native River Village smoke candidates8346/8347 at existing canonical coastal village1131528,including desktop1440,phone layout390 and Hex reload. A fresh disposable local QA world uses the deployed916dffcd renderer. Explicit browser-only synthetic manifests and exact-byte asset aliases enable preapproval testing;they are not production approvals. Both tested whole-scene placements fail water/ground contact;v4 also clips above the desktop Hex frame. The approved-only normal harness remains unchanged. Preserve native detail and resolve geography-aware role,framing,anchor/contact and subject scale/style before a new context test. No artwork file,source approval,active replacement,renderer,production322-source whitelist,canonical geography or save changes. All8,347 maintained records and44 update images remain. Performance,lifecycle,physical-phone and actual live-world acceptance remain open. See the context review.

Native alpha evidence and16-component gap mask —20 October2026

Individually inspected100 complete native originals4534–4633 against three separately viewed approved references,plus24 native light/dark diagnostic pairs:38 retain native artwork for role/context review,51 need canonical role definition and11 need targeted artwork work. All100 originals and all331 prior source approvals stay exact. Native alpha distinguishes actual Sea Caves v5 right-frame rock contact(8 opaque pixels) from Snowy Pines v1 faint alpha2 and Stone Castle v1 faint alpha1;castle backdrop RGB at alpha0 is already transparent. Preserve coherent deeper-blue Seagrass Meadow v4 water and neutral Salt Works v2 smoke. Spring Oasis v5 adds one original-preserving native1299×1211 candidate:clear13,252 alpha values across16 individually reviewed gray palm-gap components;every original RGB value,every pixel above alpha96 and all outside-mask RGBA stay exact. Earlier two incomplete mask drafts are not accepted. No generation,resizing or filtering. Ground-contact shadow remains untouched. This localized correction is not full-source/context approval.8,348 maintained /8,392 working records,45 update/proposal images and6,843 initial individual reviews remain;full-goal accepted0. Source approvals331 and deployed322-source game manifest remain unchanged. All canonical role/style/scale/contact,state/lifecycle,nonrepeating mesh,complete performance,integration and actual live-world appearance gates remain open.

###100 exact-source findings and45 native diagnostics —20 October2026

Individually inspected100 complete native originals4634–4733 against three separately viewed approved references,plus45 native light/dark crop pairs:28 retain native artwork for role/context review,48 require a canonical role definition and24 require targeted artwork correction. All8,348 maintained native identities and complete approval objects stay exact;no new image,source approval or renderer entry is added. Confirmed localized defects include flat pink sulfur/chimney smoke,purple water-edge bands,detached gray residue,a bounded blue-roof color patch and small oasis path/drain marks. Preserve coherent yellow/cream smoke,grass antialiasing,stone highlights,cool rock shading and intentional ground-contact shadow. Volcanic Seamount v2 has14 nonzero-alpha frame pixels,max213 and none fully opaque;do not describe this as opaque clipping. Cultivated,road,cave,wildlife and settlement composites need implemented canonical roles,state and actual geometry/contact before use. Specific complete island/road/field layouts must not be repeated across mesh backgrounds.8,348 maintained /8,392 working records,331 source approvals,45 update/proposal images and6,743 initial reviews remain;full-goal accepted0. Source approval,renderer availability and actual live-world use remain distinct. The deployed322-source game manifest and saved world stay unchanged. Full style/scale/contact,state/lifecycle,nonrepeating background,exact-artwork performance,integration and actual live-world gates remain open.

Native inspection measurements in this batch explicitly count every alpha>0 edge pixel and use inclusive maximum pixel coordinates. Earlier ledger edge measurements use alpha>32 and exclusive upper bounds;those earlier counts are preserved and labeled inside each inspection. This method difference explains Volcanic Seamount v2 having14 total nonzero-alpha edge pixels versus8 above alpha32;none is fully opaque. It grants no artwork approval.

Three-component original-preserving vineyard mask —20 October2026

Vineyard Hills v2 adds one separate original-preserving1254×1254 candidate. Only2,014 alpha values across three individually reviewed exterior-gray components change;every original RGB,every outside-mask RGBA pixel and every original pixel above alpha200 remain exact. Native vines,grapes,cypresses,roof,masonry,cart,stone contour,bridge,water and proper ground-contact detail stay intact. Complete native light/dark and final1:1 contour comparisons accept the localized cleanup;unselected contour remains authoritative and full edge/context acceptance is not inferred. Exact-byte archived export7401 links to the same candidate while both original records remain preserved and its separate role/disposition review stays pending.8,349 maintained /8,393 working records,331 source approvals,46 update/proposal images and6,743 initial reviews remain;full-goal accepted0. No generation,resizing,spatial filtering,source overwrite or quality reduction for performance. No source approval,active replacement or deployed322-source renderer/world/save change. Canonical vineyard role,actual scale/style,terrain/water contact,state/lifecycle,nonrepeating meshes,complete performance,integration and actual live-world appearance gates remain open.

Weighted local alpha plus explicit floating residue review —20 October2026

Turtle Sanctuary v2 adds a separate native1254×1254 upper-leaf candidate. Exactly2,501 alpha values change;all original RGB,outside-mask RGBA,strong original paint and rows223 onward remain exact. A guarded local collar and15 individually inspected disconnected residue components(42 pixels) reduce gray/pink matte around the selected leaf group. v1–v3 remain rejected;v4 is superseded by explicit inspection of five previously retained neutral fragments. Full native light/dark original/candidate/detail inspection accepts this bounded correction only. Remaining contour,canonical reef/scenery role,actual water/ground contact,scale/style,state/lifecycle,nonrepeating mesh,complete performance,integration and actual live-world appearance remain open. The complete turtle scene must not repeat across background meshes;painted turtles grant no simulated animals. A separate SHA-bound additive Walled Town v4 roof finding preserves the original until material intent is resolved;the earlier correction flag cannot trigger blind recoloring. All8,349 prior native identities and complete approval objects stay exact;only that additive guard changes prior metadata.8,350 maintained /8,394 working records,331 source approvals,47 update/proposal images,6,743 initial reviews and full-goal accepted0. No generation,resizing,spatial filtering,original overwrite,active replacement or deployed322-source renderer/world/save change.

Boundary-constrained native plume repairs and independent replay —20 October2026

Sulfur Springs v4 adds a separate native1050×1498 candidate correcting two flat pink plume cores. Local fills constrained by unchanged original boundary pixels retain coherent gray volume and the thermal-lit transition. Exactly1,565 RGBA pixels change within1,566 selected pixels;all outside-mask pixels and rows499 onward stay exact. Pools,sulfur drips,rocks,trees,ground shadows and unselected detail remain original. Direct clones v1/v2 and median-calibrated v3 remain rejected;upper-only v4 is superseded and retained exactly in the two-plume v5. Complete native light/dark and both detail inspections accept the bounded repair. Independent PNG decoding and a different sparse boundary solver agree within one8-bit unit in one masked channel;outside-mask identity is exact. Small unselected rock-rim/boundary traces still need separate review. This finite geothermal composition must not repeat across generic mesh backgrounds.8,351 maintained /8,395 working records,331 source approvals,48 update/proposal images,6,743 initial reviews and full-goal accepted0. All8,350 prior complete metadata/native/approval identities stay exact. No generation,resizing,whole-scene adjustment,source overwrite,active replacement or deployed322-source renderer/world/save change. Remaining boundary,canonical role,actual scale/style/ground contact,state/lifecycle,nonrepeating meshes,complete performance,integration and actual live-world gates remain open.

Boundary-constrained native plume repairs and independent replay —Sulfur Springs v5,20 October2026

Sulfur Springs v5 adds a separate native1254×1254 candidate correcting confirmed main-plume pink islands and transition plus five isolated right-plume pink pixels. Fixed original boundaries constrain the local premultiplied-RGBA fill. Exactly1,244 RGBA pixels change within1,260 selected pixels;all outside-mask pixels,rows346 onward and the protected orange vent rectangle remain exact. Complete native light/dark original/candidate and main/right detail inspections accept this bounded repair. Independent PNG decoding and a different sparse boundary solver match every decoded channel exactly. Pools,beige steam,minerals,rocks,trees,shadows and all unselected painting detail remain original. Upper-only v1 remains an unregistered incomplete study. This finite geothermal painting must not repeat across mesh backgrounds.8,352 maintained /8,396 working records,331 source approvals,49 update/proposal images,6,743 initial reviews and full-goal accepted0. All8,351 prior complete metadata/native/approval identities remain exact. No source overwrite,active replacement,resizing or deployed322-source renderer/world/save change. Unselected edge/material review,canonical role,actual scale/style/ground contact,state/lifecycle,nonrepeating meshes,full performance,integration and actual live-world gates remain open.

###100 exact-source findings and a detached-component repair —20 October2026

Individually inspected100 complete native originals3584–3683 against three approved native references and47 separate native light/dark diagnostic pairs:29 retain original artwork for role/context review,54 require canonical role definition and17 require localized correction. Add one separate1313×1198 Active Volcano v2 candidate removing a detached pink fragment:295 alpha pixels change,all RGB values and all outside-mask RGBA remain exact. Both complete native original/candidate light/dark views were inspected;only that bounded repair is accepted. The other16 confirmed repair targets include flat pink plume islands,blocky water-edge fragments and small ground/canopy residue. Retain legitimate thermal-lit smoke,foam,cool leaf/stone shadows,coral colors and star-bearing aurora sky pending role/lighting intent. Painted routes,ports,fields,settlements and animals need matching finite canonical roles,state and actual terrain contact;whole composed scenes cannot repeat across mesh backgrounds. All8,352 prior native identities and complete approval objects remain exact;100 metadata records gain independent findings and one pending candidate is added.8,353 maintained /8,397 working records,331 source approvals,50 update/proposal images,6,643 initial individual reviews and full-goal accepted0. Archive exact-byte links grant no role/disposition approval. Full style/scale/contact,state/lifecycle,nonrepeating backgrounds,performance,integration and actual live-world gates remain open. The deployed322-source renderer,canonical world and saves remain unchanged.

These100 native inspections distinguish fresh alpha>0 frame counts and inclusive pixel bounds from the retained earlier alpha>32/exclusive measurements. A nonzero frame pixel is a context/margin review flag,not automatic opaque clipping or an artwork failure.

Six plume-color repairs with exact alpha/shading retention —20 October2026

Six separate native smoke-color candidates preserve every original alpha value,green-channel shading value and outside-mask RGBA pixel. They correct bounded pink cores in Active Volcano v3,Basalt Columns v2,Ash Plain v1/v3/v4 andBasalt Columns v5. Exactly 16,294 pixels change inside 23,364 selected mask pixels;only red/blue values change. Original dimensions and complete fine detail remain. Individual full/detail light/dark comparisons accept only these localized repairs. Native neutral/warm reference patches keep each plume palette;explicit column-cap rectangles and warm-material feather exclusions protect stone/tree colors. The first alpha-changing Active Volcano v3 draft is rejected for thinning the plume. Earlier narrow/incomplete masks andmismatched warm-reference drafts remain QA evidence,not catalog replacements. Unselected exterior flecks,boundary/material intent and whole-source style remain pending;retain legitimate thermal-lit cream/brown smoke andcolored rock shadows. These complete volcanic scenes need finite canonical footprints/state andcannot repeat as mesh backgrounds. All8,353 prior complete metadata/native/approval identities and all 8,397 prior ledger records are retained,including44 historical/unregistered records.8,359 maintained /8,403 working records,331 source approvals,56 update/proposal images,6,643 initial individual reviews and full-goal accepted0. No original overwrite,resizing,active replacement,source approval or deployed322-source renderer/world/save change. Full Region/Hex scale/contact,state/lifecycle,nonrepeating background,performance,integration and actual live-world gates remain open.

Exact native masked repairs and retained reef cutout backlog — 20 October 2026

Eight additive native comparisons correct individually bounded artifacts in Abandoned Mine v3, Abyssal Deep v1, Ancient Metropolis v2, Ancient Oakwood v2/v3, Arctic Outpost v5, Bamboo Forest v3 and Barley Fields v5. Exactly 9,602 pixels change; every outside-mask RGBA pixel and native dimension remains exact. Five color repairs preserve all alpha and the original shading channel (green for four, blue for the cold-water repair). Three small alpha repairs change 697 alpha values while retaining every RGB value. No resizing, original overwrite, whole-scene filtering or performance-driven artwork reduction occurs. Water alpha-cleanup drafts are rejected for ragged gaps; blue-driven color drafts are superseded. Atoll Ring v2 and Barrier Reef v2 remain unregistered: neither reef study solves its wider cutout boundary. Retain all drafts and original/alias records. Unselected edge colors and boundary/material intent remain pending on the eight comparisons too. Complete scenes require finite canonical footprints and must never repeat as mesh material. All 8,359 prior complete metadata/native/approval identities and all 8,403 prior ledger records are retained, including 44 historical/unregistered records. The maintained catalog becomes 8,367 records, with 8,411 working ledger records, 331 source approvals and 64 update/proposal images. There are still 6,643 initial individual reviews; full-goal accepted remains 0. No source approval, active replacement, renderer/whitelist, game controls, save or canonical geography change is included. Full normal Region/Hex scale/contact, lifecycle, nonrepeating-background, performance, integration and actual game-world appearance gates remain open.

Native masked repairs and finite ground candidates — 21 October 2026

The requested next500 batch has165 individually inspected native sources and335 sources still awaiting inspection. This progress release records the165 SHA-bound observations, including85 artwork targets (80 native diagnostic findings andfive visibly patterned backgrounds), and adds15 separate native candidates:11 exact masked local repairs andfour regenerated finite ground alternatives. Masked candidates change7,848 pixels in total; every outside-mask RGBA pixel and native dimension is exact. Alpha-only repairs retain every RGB value; color repairs retain alpha and original green-channel shading. The four full ground revisions use built-in image_gen and retain1536×1024 native dimensions; they carry no original-pixel-preservation claim. Arctic, grassland, forest and wetland revisions replace the individually observed repetitive layouts; site markers are omitted only from these ground alternatives, and the forest floor excludes standing canopy. Original site scenes remain preserved. The desert drafts retain unwanted masonry/path implications and remain unregistered. All8,367 prior native and approval identities and8,411 prior ledger records remain, including44 historical/unregistered records. Only the authored review field changes on165 existing metadata records; source approvals stay331, maintained records become8,382, working ledger records8,426 and quality update/proposal images79. Initial individual-review backlog becomes6,478. Full-goal accepted remains0. No original overwrite, resizing, performance-driven artwork reduction, active replacement, renderer/whitelist, game-control, save or canonical geography change is included. The322-source production whitelist and world versionab173645cf316d93 remain exact. Full-source boundary/style, canonical role, normal Region/Hex scale/contact, lifecycle, nonrepeating placement, performance, integration and actual game-world appearance remain open. The full500 request and the all-assets goal continue after this release.

Preserved smoke shading and finite desert ground comparison — 21 October 2026

The requested 500-source batch now has 265 individually inspected native sources, with 235 still awaiting inspection. This release adds 100 exact-source observations: 92 repetitive background compositions require artwork updates; eight finite scenes remain pending role, style and context review. Five separate native comparisons accompany those findings: four bounded Caldera Basin smoke repairs and one finite desert ground alternative. The smoke repairs change 6,672 pixels while preserving every original alpha value, green shading channel, native dimension and RGBA pixel outside the masks. Neutral gray collars and warm cream ash remain distinct; lava, water, mineral color, trees and lower artwork remain exact. The sixth desert revision retains fine ochre sand, stone and dry branches around an uneven natural shelf. It omits the ruin from the original oasis scene, which remains available, and makes no original-pixel preservation claim. Five earlier desert revisions, five wildflower opacity studies and one flower reconstruction remain unselected. Stored RGB at near-zero alpha did not reliably recover the original flower paint. All 8,382 prior native and approval identities and all 8,426 prior ledger records remain, including 44 historical records. Maintained records become 8,387; working records become 8,431; quality update and proposal images become 84. Source approvals remain 331; the initial individual-review backlog becomes 6,378; full-goal acceptance remains zero. Originals retain their dimensions and detail. Complete artwork review, normal Region/Hex role, scale, contact, lifecycle, placement, performance, integration and actual world appearance remain pending. This Atlas release changes no game controls, renderer, 322-source production whitelist, saves or canonical geography. The 500-source batch and all-assets goal continue.

Native finite water, dune, basalt and woodland comparisons — 21 October 2026

All 500 selected sources now have individually authored native-image findings. This release records the remaining 235: 204 require nonrepeating background artwork changes and 31 retain their finite compositions pending role and normal game context. Inspection does not count as an artwork update or approval. Four separate native ground comparisons are added: unequal broken blue-water swells, eroded dune ridges, unequal basalt outcrops and varied autumn leaf-and-moss woodland. Each is an unresized 1536 × 1024 opaque painting, compared at full size and in two native detail crops; independent PNG and Sharp decoders agree. Fine ripples, sand grain, natural polygonal basalt, leaf veins and small ground detail remain visible. The second water and autumn studies are selected; earlier repeated water bands and oversized autumn details remain unselected. These are new paintings, with no original-pixel preservation claim. Remaining crest, leaf and rock scale, contrast, material/style, terrain height, contact and world placement are recorded explicitly. Originals and exact-byte aliases remain available. All 8,387 prior native and approval identities and all 8,431 prior ledger records remain, including 44 historical records. Maintained records become 8,391; working records become 8,435; quality update and proposal images become 88. The initial individual-review backlog becomes 6,143; source approvals remain 331; full-goal acceptance remains zero. Across this 500-source batch, 24 native comparisons are locally registered; many individually identified artwork corrections and all required normal Region/Hex role, scale, contact, lifecycle, nonrepeating placement, performance, integration and actual world appearance checks remain open. No performance-driven resolution reduction or whole-scene filtering is applied. At preparation, GitHub has the preceding 265 findings and 20 native comparisons, while production is still verified at 165 findings and 15 comparisons during Railway’s new-build pause. This release does not change game controls, renderer, 322-source production whitelist, saves or canonical geography. The all-assets goal continues.

Further finite-ground studies preserve native material detail — 21 October 2026

Ten further native finite-ground comparisons address already recorded artwork findings within the 500-source batch: ochre scrub, snow, dry steppe, fey woodland, calm lake, natural desert shelf, mangrove floor, small-crag mountain ground, oak woodland and golden grass with bluish scrub. Each preserves its full unresized 1536 × 1024 opaque output and was inspected as a complete image plus two native detail crops. Independent PNG and Sharp decoders agree. Fine sand, gravel, grass curls, snow strokes, leaves, roots, acorns, white flowers, cyan light specks and brown leafless plants remain visible. One regularly spaced desert draft and two mountain drafts remain unselected; the mountain revisions reject a crag parade and a U-shaped slab that could read as an artificial foundation. Whole-frame repeated groups are replaced with unequal finite compositions. Reusing similar broad mass arrangements across different materials remains an explicit concern for the snow and steppe studies; residual smaller-clump cadence is flagged where relevant. Selection is for Atlas comparison, not final artwork or game-readiness approval. Scale, contrast, material/style, painted relief, canonical role, terrain and water contact, nonrepeating placement, lifecycle, performance, integration and actual normal Region/Hex world appearance remain pending. No performance-driven resizing, whole-image filtering or original-pixel preservation claim is made. All 8,391 prior complete metadata, native and approval identities remain exact. All 8,435 prior ledger records remain, including 44 historical records. Maintained records become 8,401; working records become 8,445; quality update and proposal images become 98. Across this batch, 500 sources have findings and 34 separate native comparisons are locally registered. Those inspections do not mean 500 artwork updates. Source approvals remain 331; the initial individual-review backlog remains 6,143; full-goal acceptance remains zero. At preparation, all 500 findings and the preceding 24 comparisons are on GitHub; production is still verified at 165 findings and 15 comparisons while Railway reports new builds paused. The release changes no game controls, renderer, 322-source production whitelist, saves or canonical geography. The all-assets goal continues.

Final asset outputs and storage retention — November 2, 2026

Art Atlas publishes 9,185 registered files with their permanent IDs, exact original checksums and individual findings. All 8,401 files in the preceding GitHub catalog retain identical artist bytes; 784 additional registered files are bundled without resampling or recompression. The complete 9,208-row readiness ledger (including 23 historical null aliases) is retained as a lossless audit output. The full-library goal remains active: 418 initial reviews remain pending, 3,177 explicit dispositions are recorded, and no all-gates game-ready promotion is inferred. The next 100 native sources have completed visual observations, retained separately without claiming their draft archive decisions were registered. Both Citadel outer hamlets and all original library artwork remain preserved. The preferred local Alpine Tarn V5, Caravan Well V5, Sargasso Drift V5 and Sunken Shelf V9 repairs, plus explicitly referenced working outputs, are retained separately. They do not acquire live-world approval by publication. The live renderer and its existing 322-source whitelist remain those of the preceding GitHub commit, including the blue atlas interface; unfinished private renderer/artwork experiments are not installed. No repeatable mesh background, artwork downscale or lossy reencoding is introduced. The user requested removal of temporary files, drafts and inputs because the local drive was full. Redundant QA baseline copies, native preview duplicates, raw readbacks and rejected attempts are retired after preservation checks. Historical seals describe the checks performed at their recorded time; they no longer promise the presence of every retired temporary artifact. Current artist hashes, final selected outputs, individual catalog findings, the complete pending ledger, final observation notes and cleanup receipts remain authoritative. No persistent world, save, original artwork or other project is a cleanup target.

The wiki coverage checker permits 16 MiB of Git filename output so a new branch can compare the complete artwork repository against an empty tree without truncating the path list. This changes validation capacity only; the coverage rules and game behavior remain unchanged.

The Docker package copies native readiness, terrain and recovered-original directories in grouped layers while preserving their paths and exact image bytes. Grouping replaces hundreds of individual image-copy layers; it does not resize, repaint, recompress or approve any artwork.

The documentation workflow uses a sparse checkout of the complete required wiki source, generated pages, tutorial images, catalog-validation code and wiki tests. Git commit/tree history remains available for full change-coverage comparisons, while unrelated native artwork blobs are not checked out for this documentation job. The coverage, freshness and wiki regression steps remain enabled.

Verified asset publication and final-output retention — November 3, 2026

The November 3 final-output publication is live at commit e5b1cf3e81b80d56e650df3b39f5109b1d6a3d8e. Art Atlas contains 9,185 registered files; live readback verified every one of the 784 newly published artist files and both Citadel outer hamlets. All original artwork and the 16 selected working outputs retain their exact bytes. Temporary QA inputs, repeated metadata snapshots and duplicate previews are retired under the user-requested storage policy. The full-library quality goal remains active: 418 initial reviews and all unresolved canonical qualification gates remain pending. The next 100 observations remain recorded without registering their proposed reference dispositions. Local source contracts (354) and the deployed renderer whitelist (322) remain distinct; no private renderer or artwork study is promoted by cleanup. Local catalog and ledger JSON now match the published bodies without changing their data. The 43 private runtime sync rows remain pending. Final source hashes and compact historical review summaries replace the retired temporary artifact cache.

Retained native-export reviews and Sunken Shelf water-colour repair — November 3, 2026

The retained 100 individually authored native-export observations (WOG-A-007839 through WOG-A-007939, skipping previously reviewed records) are reconciled against current exact source/export bytes and the pure exporter mapping. Only their already archived copies receive internal reference dispositions; 100 canonical parents retain their source approvals and pending actions. Initial reviews decrease from 418 to 318, with WOG-A-007940 next. The complete catalog now has 9,187 artist files and the ledger 9,210 records. There are 3,277 explicit dispositions and zero new all-gates game-ready promotions. Sunken Shelf V9 is retained byte for byte as WOG-A-009253. Preferred V10 (WOG-A-009254) changes only 349 traced-domain water-colour pixels; all V9 alpha and outside-mask pixels remain exact at native 1,306 × 1,204. Other coloured residue, contact, finite role, scale, normal desktop/phone Region/Hex, performance, lifecycle and live-world gates remain open. All originals, both Citadel hamlets, source contracts and the 43 private runtime rows remain unchanged. No repeating mesh pattern, resampling, blur or lossy storage conversion is introduced. Complete comparisons are streamed or kept in memory. Retain the canonical previous/current finals, one compact before/after witness and per-asset findings; remove the single transaction rollback and redundant inspection image after verification. Asset review.

Canyon River outlet colour repair — November 3, 2026

Canyon River V4 (WOG-A-003757) and its named-export alias WOG-A-007873 retain their exact originals, approvals and existing actions. New WOG-A-009255 repairs 879 purple-stained RGB pixels in the finite lower outlet at native 1,024 × 1,536. All original alpha bytes, outside-mask RGBA pixels, cliff strata, needles, waterfalls and healthy foam remain exact; per-pixel luminance changes stay below 0.46. Native complete source/output and light/dark crop pairs were directly reviewed. Grey outlet residue remains; this is a preferred partial repair, with role, topology, relief/contact, scale, desktop/phone Region/Hex, performance, lifecycle and live-world gates open. The local catalog has 9,188 files and the ledger 9,211 records. The initial-review backlog stays 318 from WOG-A-007940; all 75 priority corrections and the complete pending ledger remain in scope. No source admission, world activation, gameplay change or quality waiver is introduced. The selected final is moved directly into the canonical library, with one bounded comparison witness and a compact receipt. No extra metadata rollback copies or native frame dumps are created.

Native bridge and route art review — November 3, 2026

Twenty native source/export pairs (WOG-A-007940–007959) were individually viewed and reconciled against exact SHA-256 bytes, independent PNG/Sharp decodes and the current pure exporter mapping. Canonical source approvals remain unchanged; the internal-reference dispositions grant no world permission or historical generation attestation. WOG-A-009256 is a non-destructive 1254 × 1254 Stone Bridge V5 repair: 65 RGB pixels, zero alpha differences and zero outside-mask differences. Existing finite road art requires two explicit ports under regional-road-plot-2; these composite junction/bridge scenes have no new renderer contract. Source permissions, renderer inputs and saves remain unchanged. Native browser, Atlas, complete artist-hash, wiki and release results are recorded separately from normal-world readiness. See individual findings.

Native ruins and aqueduct transparency — November 3, 2026

The twenty WOG-A-007960–007979 named exports match their canonical native PNGs byte for byte and match the current pure exporter mapping. Individual findings and independent PNG/Sharp decode/alpha measurements are SHA-256 bound. Canonical source approvals are preserved. WOG-A-009257 changes 2,035 alpha values in manually bounded empty upper arches of Broken Aqueduct V4; all original RGB and every outside-mask RGBA byte stay exact. Both native browser backgrounds preserve all outside-mask rendered pixels, and repeated stationary frames agree. Residual speckles and canonical site/hydrology, role/state, contact/scale, normal Region/Hex, lifecycle, full cost, source admission and live-world checks remain open. Source availability, Atlas observation and actual world appearance remain separate evidence. No repeated mesh background, renderer or source-whitelist change is included. See individual ruin findings.

Golden Veld fine-grain study — November 3, 2026

WOG-A-009258 is a native 1536 × 1024 built-in image_gen output, SHA-256 5621d4b99de9cca58252409e49596d349a0a88902fae0918d8a95c9906381179. Registration clears inherited crop, blend polygon, compatible-profile and world-scale contracts because the regenerated layout has not earned them. Sixteen isolated deployed Canvas/span-4 versus local CPU/span-1.25 references and eight local WebGL2 cases remain component evidence; CPU/GPU differences reach 3 channel levels with unchanged alpha. Forty normal local client observations use the unchanged renderer and one in-memory private primary-field substitution per art trial. The initial cell 373408 was invalid for this profile: client region averages select grasslands despite its natural fields classification. A read-only implementation-derived selection fixes the test site without changing geography or rules. Source-paint assertions, exact HTTP image hashes, zero gameplay commands and owned-resource shutdown are recorded. Whole-world nonrepetition, role/contact/scale/state, cost, lifecycle, admission and actual production-world use remain open. See Golden Veld evidence.

Preserved ruins, Arctic outposts and biome materials — November 3, 2026

WOG-A-007990–008014 contribute 24 newly inspected named exports, with WOG-A-008002 already resolved and excluded from the new-review count. Every selected export matches its canonical PNG and the current pure exporter mapping byte for byte; historical execution is not inferred. The new WOG-A-009259 changes only 791 neutral alpha samples in Lost Observatory V4, preserving all native RGB, all opaque/chromatic samples, colour metadata and all outside-mask RGBA. Two native browser comparisons have exact stationary and outside-mask pixels. Twelve source records also carry private crop/profile findings. Forty-four complete normal-client biome cases now provide 220 frames, including 110 with the private wider-crop sampler; expected sources are actually painted at real, profile-correct natural sites. Every tested Region return and Hex reload is exact; all 22 cross-cohort Hex foreground pairs match. Region composite canvases differ, so foreground equivalence is not inferred for Region. The experiment has no public-module, source-whitelist or gameplay changes. Actual production-world appearance, whole-mesh nonrepetition, perceptual fidelity, full contact/state/cost/pressure/lifecycle and runtime promotion remain unqualified. See individual native findings.

Preserved rural settlements and biome scene review — November 3, 2026

WOG-A-008025–008044 add 20 individually inspected source/export pairs, all byte-exact with the current canonical PNG and pure exporter mapping; historical export execution is not attested. WOG-A-009260 neutralizes 1,175 chromatic smoke pixels above Lumber Village V3 chimney masonry, preserving the complete native canvas, alpha field, silhouette and all outside-mask RGBA. Rec.709 luminance rounding stays below 0.5 in the 0–255 channel scale. The initial narrower unregistered mask left visible tint and was refined in place; no rejected native variant is retained. Ten native material records now include all eleven directly inspected biome profile findings for 44 saved desktop/phone Hex views. Current and private sampler findings retain recurrence and physical-grain uncertainty; unchanged Hex foreground pixels do not close Region, contact/state, cost/pressure/lifecycle or production-use gates. No public renderer or source-permission changes are included. See individual native findings.

Preserved rural and shallow-sea originals — November 3, 2026

Twenty-three separately viewed native source/export pairs are exact with current canonical PNGs and pure exporter mapping; historical execution is not attested. WOG-A-009261 changes only 215 smoke RGB pixels above Monastery Hamlet V3 chimney masonry using rounded Rec.709 luminance; native 1254 by 1254 size, all alpha and every outside-mask RGBA byte are exact. Three source-bound component findings cover current/factor-8/factor-16 sampling. A reused disposable local world supplies 60 normal Region/Hex frames across fields span1.25 and wetlands span2, three samplers and two widths. All 12 return/reload comparisons are exact; eight Hex foreground comparisons are exact. Region foreground is not separately isolated. Direct inspection of 24 saved Region-close/Hex scenes retains diagonal recurrence, grain and wetland contact/foreground concerns. No public renderer, source approval or admission changes are included; full performance/lifecycle and production appearance remain separate. See individual native findings.

Preserved shallow-sea originals and water-colour study — November 3, 2026

WOG-A-008070–008094 add 25 individually inspected native source/export pairs with exact current bytes and pure exporter mappings; historical export execution is not attested. Separate WOG-A-009262 reconstructs only 6,722 purple exterior-water RGB samples within 24 Manhattan pixels of exact source transparency, using nearby healthy source water chroma and preserved luminance. Native 1254 by 1254 canvas, every alpha sample, all outside-mask RGBA and interior sand/palm/rock/foam/underwater detail remain exact. Two full native browser comparisons preserve all outside-mask display pixels. The first narrow unregistered trial was refined in place; only the selected study remains. This does not repair ragged alpha geometry or establish finite coast/depth/scale/state, normal Region/Hex, full performance/lifecycle, admission or production appearance. Private mesh experiments retain their prior unresolved recurrence and grain/contact requirements. See individual native findings.

Private irregular material boundaries — November 3, 2026

The QA-only irregular sampler changes blend selection boundaries, not native paint coordinates. Factor 16 with coefficient 0.0625 preserves the analytic within-patch native sampling derivative. Boundary amplitude 1.10, secondary amplitude 0.08 and native margin 0.14 give a maximum axis offset of 0.13625. This analytic bound does not qualify perceived grain or nonrepetition. Eighteen component cases have maximum CPU/GPU difference 3, exact alpha and exact stationary/pan-return comparisons. Twelve profile-correct desktop/phone cases supply 60 normal-client frames, 40 private. Return/reload canvases and eight Hex foreground pairs are exact; Region foreground was not separately compared. All 24 retained scene witnesses are visually covered: nine unique new direct views and 15 complete-PNG byte-exact reuse of earlier direct views. Retiring those duplicates reclaimed 63,627,798 bytes. Browser contexts and the sole owned QA server closed normally, with no world commands, production-world frames or raw readback files. The original native source bytes, public sampler and source admissions remain unchanged. Registered findings retain full visual, contact, cost/pressure and lifecycle qualification requirements. See private irregular-boundary evidence.

Preserved coastal and town originals — November 3, 2026

WOG-A-008095–008119 add 25 individually inspected source/export pairs that match current canonical PNG bytes and pure exporter mappings; historical export execution is not attested. WOG-A-009263 preserves native 1312 by 1199 dimensions while neutralizing 428 free-plume smoke RGB samples with rounded source luminance, stopping before chimney masonry. WOG-A-009264 preserves native 1308 by 1202 dimensions and changes 3,649 selected lower/front water RGB samples within 24 Manhattan pixels of exact transparency, taking chroma from healthy original water at preserved luminance. Every alpha and outside-mask RGBA byte remains exact; four full-native light/dark browser comparisons have zero outside-mask display differences. Upper shore, residual colour, alpha geometry, finite role/depth/contact/scale/state and full runtime qualification remain open. Three private material-source findings and two normal-client field/wetland findings are registered from 18 component cases and 60 frames. All 24 saved scenes are visually covered: nine unique new direct views and 15 byte-exact reuse of previously viewed scenes; the redundant files were removed. Twelve return/reload comparisons and eight Hex foreground comparisons are exact; Region foreground was not separately isolated. Nonrepetition, perceived grain, contact, complete cost/pressure/lifecycle and public activation remain unaccepted. No public renderer or source-permission change is included. See individual native findings.

Separate wetland painting study — November 3, 2026

The generated wetland study is native 1536 by 1024 RGB PNG with exact independent PNG/Sharp RGB decoding. It is a new painting, with no claim of pixel-preserving edits to the approved original. Twelve component cases compare both native images at span2 using current, factor16 and irregular samplers at two scales. CPU/GPU differences reach three channel levels; alpha, stationary and pan-return comparisons are exact. Twenty normal-client frames use a legitimate empty wetland site, the unchanged public sampler and two explicit source controls. The study replaces only one source slot in an in-memory diagnostic manifest; the on-disk 354-source local manifest, production 322-source whitelist and original painting remain unchanged. Ten frames use the private source and no frame uses a private renderer. Four Region returns/Hex reloads and two Hex foreground pairs are exact; Region foreground was not separately isolated. All eight saved Region-close/Hex scenes were directly viewed. Prominent grass/leaf scale, dry warmth, recurring-looking directional grouping and weak reed contact remain unresolved. Both browser cohorts and the QA server closed normally without world commands or raw readback files. One duplicate control witness and the identical tool-output/workspace study copies now share native bytes through hardlinks, preserving every final path while reclaiming 11,548,115 duplicate physical bytes. The study is registered as WOG-A-009265 in the later town/wetland batch and remains unapproved for production activation. See wetland study findings.

Preserved town smoke and wetland diagnostic — November 3, 2026

WOG-A-008120–008146, excluding already reviewed WOG-A-008127/008128, add 25 SHA-bound individual native source/export findings and separate canonical follow-ups. WOG-A-009266 changes 2,537 chromatic free-plume RGB samples in two bounded Forest Town V1 domains; WOG-A-009267 changes 1,043 samples above the Pilgrim Town V4 chimney. Rounded source luminance, native dimensions, all alpha and all outside-mask RGBA remain exact. Four full-native light/dark browser comparisons have no outside-mask display differences. Smoke shape/contact and complete finite role/scale/state/world qualification remain open. WOG-A-009265 preserves the separate 1536 by 1024 RGB wetland study byte-for-byte, sharing storage with its native diagnostic. Its private QA label denotes neither catalog admission nor a new approved source: ten study frames and ten unchanged-control frames use the unchanged public sampler at wetland span2. Twelve component cases, four return/reload cases, two exact Hex foreground pairs and eight direct full-scene reviews retain nonrepetition, perceived grain/palette/detail, water/contact and complete cost/lifecycle gates. Region foreground was not separately isolated. Historical proof receipts remain immutable; the towns registration and current working state record their later catalog registration. No public renderer, source-contract or gameplay change is included. See individual native findings.

Private wetland grain calibration — November 3, 2026

The calibration uses the same naturally occurring empty wetland site and sole disposable QA world: original span2 control, identical original span1.25 and existing diagnostic span1.25, each at 1440/390 DPR2. Only the first wetland source slot changes in private in-memory manifests; ten frames use the diagnostic and twenty use private scale/source contracts. All 30 frames use the unchanged public sampler. Six Region returns and four cross-mode Hex foreground pairs are exact. Five of six Hex reload ground comparisons are exact; originalFine at1440 differs at 32 pixels with maximum channel difference 245 despite matching context bounds. This discrepancy is retained, with deterministic reload unaccepted. Region foreground was not separately isolated. All 12 full scenes were directly reviewed; scale, perceived grain/detail, recurrence, wetness/palette/contact and complete cost/lifecycle remain unapproved. Browser contexts and server closed normally without world commands. Four byte-exact control witnesses now share existing native PNG storage, preserving every path and reclaiming 17,229,069 duplicate physical bytes. No new painting, native downscale, public sampler/source-contract change or activation is included. See calibration findings.

A separate focused desktop replay adds ten normal-client frames using only the unchanged original at spans 2 and 1.25. Both fresh Region returns and Hex reloads are exact. Four complete PNG witnesses match the previously viewed calibration scenes byte-for-byte and share their storage. The initial finer-original ground hash matches both replay captures; only the earlier reloaded frame has the distinct 32-pixel result. The original failure remains retained, its cause is not established and deterministic reload remains unaccepted. No player control, prerequisite, cost, staffing, timing or success check changes.

Registered town and volcanic native reviews — November 3, 2026

The 25 next native findings retain exact current source/export SHA-256 identities and independent decoder agreement; historical export execution is not attested. They are registered after the preceding verified live release closeout. Reserved WOG-A-009268 preserves native Walled Town V3 dimensions and changes 535 free upper-plume RGB samples at rounded source luminance; alpha and every outside-mask RGBA byte remain exact. The initial two-trial run completed four full-native light/dark browser comparisons. Its Basalt trial WOG-A-009269 is subsequently rejected: all 666 changed pixels are inside the existing WOG-A-008355 correction, which changes 2,059 pixels with exact original alpha and green channel. Native full-image and selected light/dark comparison review prefers the existing final, preserving lower cream/orange heat glow, columns, lava and crystals. The redundant unregistered trial and its trial preview are retired after exact preservation checks; compact executed evidence, all hashes and an explicit registered historical disposition retain its scope, and the permanent ID must not be reused. Whole-artwork/world approval and every existing gate remain separate. No renderer or source-contract change is included. See individual native and selection findings.

The registered library now contains 9,201 present catalog files and 9,225 goal records. One deliberately retired private trial has an accepted provenance-only disposition and an intentionally absent binary; it is distinct from an unresolved missing original. The retained native successor remains unapproved for complete world use. Fifty-four present records and one historical-only record await publication; 111 initial reviews and 5,740 qualification records remain open. The wetland original receives only its 30 observed source frames, the diagnostic only its ten; private-contract frames total25 across both runs. No complete-source approval or new live-world appearance is inferred.

Registered remaining volcanic native reviews — November 3, 2026

The next 31 native source/export reviews are SHA-256 bound, with exact current mapping and independent PNG/Sharp agreement. Twenty linked candidates are fully compared in memory, including thirteen fresh direct native candidate inspections. Geothermal 8333 changes888,138 RGB pixels and889,129 alpha samples; Obsidian8340/8341 changes50,277/14,776 alpha samples. Keep these catalogued diagnostics separate from original-preserving selection. New9270/9271 retain native1254×1254, all alpha and every outside-mask RGBA byte while neutralizing4,255/8,001 pink-classified smoke pixels at rounded source luminance. All four native browser backing comparisons pass, with zero outside-mask display differences, exact stationary redraw and no errors. Raw buffers are not persisted. Complete cloud material, edges, source role/contact/scale/state and runtime/lifecycle qualification remain open; registration follows the prior verified live release. See individual native findings.

This registration adds 31 restricted named-export reference dispositions, separate canonical followups, 20 exact existing-candidate comparisons and two new partial smoke studies. The current catalog has 9,203 files and the ledger has 9,227 records; 84 metadata rows await focused publication. There are 80 initial reviews and 5,711 pending qualification records, with one previously published intentionally retired private trial. No source approval, 322-source production whitelist or public renderer change is included.

Registered remaining wetland native reviews — November 3, 2026

The37 registered wetland native source/export findings are individually SHA-256 bound, with exact current exporter mapping and independent decoder agreement. Current9272/9274 use the original local leaf/wood palette for1,213/428 selected red semi-transparent edge pixels, preserving every alpha, opaque painted sample and outside-mask RGBA byte. Whole native originals/finals and light/dark crops were directly viewed; four selected browser comparisons have exact stationary redraw and zero outside-mask display differences. The broader initial9273 mask reached109 protected neighbouring samples; reject the unregistered trial, restore all109 in9274, retain compact source/output hashes and executed initial proof, and register an explicit historical disposition linked to9274. Two initial duplicate diagnostic previews and the rejected trial/preview are retired only after complete selected source-backing and artist-preservation checks. No raw buffers or rollback snapshots are retained. Grey halo, complete cutout/role/contact/scale/state and normal-world performance/lifecycle remain open. See individual native and preservation findings.

This registration adds37 restricted named-export reference dispositions, separate canonical followups, two selected partial fringe studies and the explicit rejected9273 disposition linked to retained9274. The current catalog has9,205 files and the ledger has9,230 records;76 present metadata rows and one historical row await publication. There are43 initial reviews and5,676 pending qualification records, with two intentionally retired private trials. No source approval, 322-source production whitelist or public renderer change is included.

Registered final initial native reviews — November 3, 2026

The final43 native findings bind exact SHA-256 and dimensions. Each of22 duplicate WebP files is byte-identical to an already source-bound historical encoding; fresh full-buffer source comparisons show quantization without resizing, preserving source masters and every canonical gate. Independent PNG/Sharp decoding agrees for43 native PNGs;43 browser native loads pass and22 opaque WebP browser RGBA readbacks match Sharp exactly. The20 catalogued historical originals retain exact legacy links and recorded feedback. No new artist output, raw buffer, duplicate preview, source approval, renderer change or production placement is added. The prior32-pixel wetland reload discrepancy remains unresolved. See individual native findings.

All43 final reference/history decisions are registered, with no artist-byte change or new complete game approval. Initial-review backlog:0; pending qualification records:5,633. The9,205-file catalog and9,230-record goal ledger remain intact, with44 present metadata rows awaiting publication. The exact generation manifest also recovers WOG-A-008479's missing target link to WOG-A-003279, with WOG-A-003578 supporting material grain only; the prior wetland rejection and later study's pending-review status remain distinct.

Ten further normal-client wetland frames use observation-only base-paint tracing at the existing natural desktop site, retaining original source bytes and public algorithm files. Current span2 and original span1.25 each match their reload in base and final ground for this repeat; four complete PNG witnesses are byte-identical to retained prior witnesses, so no new screenshots or raw readbacks are saved. Cumulative wetland evidence is50 frames:40 original-source and10 prior diagnostic-source frames, including30 private-contract frames. The original32-pixel discrepancy remains unresolved; no root cause, deterministic-reload, nonrepetition, fidelity, performance or lifecycle acceptance is granted. See wetland paint-stage evidence.

Production-compatible artwork review control — 4 November 2026

The native-master/history gallery loads its button handler from /asset-quality/gallery-backdrop.js with a deferred same-origin script. Production blocks inline click handlers through Content Security Policy, so the gallery generator must emit the external controller. Verification reproduces the policy from server.js and checks all 65 images, both viewport widths, pointer and keyboard round trips, overflow and resource/security errors. The renderer, 322 production source contracts, catalog, native artwork and /data volume are unchanged. See the focused release review.

Registered Bridge Town and ground qualification — 4 November 2026

Guarded registration preserves all9,205 prior artist checksums and every existing approval while adding one1237-pixel native water-colour study and eleven metadata updates. Of the changed water pixels,302 are opaque; all source alpha,town,bright foam and outside-mask RGBA remain exact. Four ground-role records preserve the complete intended source roles. Two source-bound observation records distinguish20 original-source frames from10 private diagnostic frames in the30-frame full repeat; measured cumulative wetland evidence is80 frames. The original32-pixel failure,unknown cause,nonrepetition,fidelity,full performance/lifecycle and actual-live requirements stay open. Two inherited wetland display labels now say fringe. Source approvals,322 production contracts,renderer and /data saves are unchanged. See the exact qualification review.

Normal local town sampling verification — 4 November 2026

Normal read-only canonical selection at grasslands town248797 chooses the exact original Gabled Court3363. The retained52 client observations include28 corrected cases across desktop/phone DPR2,with26 private-planner frames. At zoom1.16,four cold/warm source transforms are exactly equal. The current planner selects513×342 cold and1536×1024 warm;full foreground differences are81,836 desktop and81,778 phone pixels. The private boundary fallback selects1536×1024 for both histories,with zero foreground differences in both matched pairs. Ten final/cold/return/reload isolated source replays are native-exact. The1.14 warm-up still uses a portrait and is not claimed native-exact.

WheelEvent integer pointer coordinates on a fractional-height phone canvas can shift the camera. The first native-wheel path ended at1.15;the subsequent strict phone failure remains retained. Corrected tests dispatch a synthetic wheel through the unchanged normal handler,then reproduce its resulting camera through the ordinary map-link parser. Exact actual six-element transforms are required;rounded datasets and rounded links are insufficient. Full raw base/foreground/static/auxiliary results remain available separately. Raw cache-surface differences are not waived or treated as a visible-scene proof;composited viewport,pressure and complete cost/lifecycle qualification are still required. This is device emulation,not physical-phone certification.

Source SHA-256 remains7ba2c669cf81289dce6d88c29ac7097693ac6babe7fe70992f49c52d6d5eb3fc. Public source contracts,artist bytes and renderer modules are unchanged. The deployed place module differs,so production applicability and earlier Hex failures remain open. No world command,source alias,source admission or production-world mutation is used. Browser contexts and the owned server are terminal;comparisons remain in memory and the corrected run adds no screenshots. See the exact observations ../art-direction/display-cache-history-20261104/normal-context-summary.json and review.

Bridge Town release74e7569 is verified live with9,206 files,46 exact native HTTP responses,22 desktop/phone Atlas views and four galleries. This closes publication of that partial study and its eleven metadata findings;all5,634 qualifications and the prior wetland/pressure failures remain open.

Visible-map and cache-pressure qualification — 4 November 2026

The68-frame continuation measures the actual visible map panel,active terrain surface and raw auxiliary canvases separately. Gabled Court contributes36 new own-source frames;four primary materials contribute8 each. The cumulative client total is120,and the town-specific total is88. Region/Hex controls and canonical selection remain unchanged;the only private override is the place display planner. Exact source transforms are required in all cold/warm and pressure-return pairs.

Visible cold/warm control differences are81,513 desktop and81,196 phone pixels. Pressure-return control differences are81,521 desktop and0 phone pixels. The private native-boundary planner has0 in all four displayed-map pairs and14 native-exact isolated source replays. Actual native-cache evictions are94/93 desktop and80/70 phone for control/candidate,using unchanged256MiB native and32MiB display defaults. The128/192MiB adaptive defaults are not covered by this run. A CSS phone layout is not physical-phone certification.

Scene completion can swap worldStatic and worldStaticNext;opacity/transform and the visible surface must be recorded. The matched cold/warm active surfaces are all exact. One control-phone pressure surface has4 raw differences,max44,while its displayed map is exact. Those pixels are not localized,the cause is not established,and raw-buffer stability is not waived. This observation is separate from the earlier32/max245 wetland and larger Hex pressure failures.

The corrected pressure route returns from Hex to Region before focusing another canonical site;direct focus can otherwise restore the old Region camera. It rechecks camera and actual primary material paints rather than treating selection as visibility. The observer releases its own retained source-image reference before departure. All68 pixel comparisons remain in memory,and no new passing screenshot is persisted. Thirty-six navigation/CDP observations are descriptive only:eight cross-document task-counter resets invalidate negative deltas,JavaScript heap excludes aggregate native/GPU memory,and full controlled cost/lifecycle remains unaccepted.

The exact originals remain bound to their individual source SHA-256. WOG-A-003583(arctic),003577(desert),003580(forest) and003578(wetlands) each report four Region/four Hex primary-source paints. This does not isolate their final pixel contribution or accept repetition,grain,palette,scale,contact or state. No new artwork approval,source admission or public module change is made. See the complete bounded findings. The precedingee6d764 Atlas release is fully live-verified;the five new findings are queued separately.

Adaptive cache profiles and separate cost qualification — 4 November 2026

The adaptive continuation records 204 completed normal local client frames across 12 cohorts, with 0 failed cohorts retained separately. The unchanged client selects its own 128/192/256 MiB native-cache limits from emulated 2/4/8 GiB deviceMemory hints. Both 1440-pixel desktop and 390-pixel phone layouts use DPR2. These hints do not cap physical RAM or certify physical phones.

The private planner has 12 exact displayed-map pairs and 42 native-exact isolated town replays in the completed cases. Gabled Court contributes 108 new own-source frames; arctic, desert, forest and wetland primary materials contribute 96. The cumulative completed client count is 324, and the town's own-source count is 196. Each material is source-hash bound and reported painted; final material pixels, nonrepetition, palette, grain, contact and state are not approved by source invocation. The 6 completed private cohorts preserve their measured cold/warm and eviction-return visible map panels exactly; actual six-element source transforms and real native-cache evictions are required. The existing normal Region/Hex route restores Region before focusing another destination, and the observer drops its retained image on departure. No geography or QA world command is fabricated.

The default-256 MiB control-phone pressure repetition is exact in this run. That does not erase the earlier four-pixel/max44 raw terrain finding or establish its cause. Rounded map-link reloads may change actual transforms and are reported separately. Earlier terrain and Hex discrepancies remain unresolved without an acceptance waiver. The interrupted attempt and the abandoned-claim startup failure contribute no completed frames. Only the abandoned disposable-world claim was recovered, with all 18 durable files preserved; runtime locking and production saves were unchanged.

Owned-process OS CPU counters survive page-document resets. Browser/server private commit and working-set samples plus nonpeak GPU checkpoints are retained. Earlier diagnostic image reads can affect later allocation and garbage collection even when they occur outside timed operations. These are instrumented cost observations, not a controlled performance pass. A separate cost-only harness is prepared with a fresh browser per case, no diagnostic pixel readbacks or retained source-image references, and two counterbalanced repetitions. It has not earned performance acceptance merely by compiling. Shared pages, exited-process CPU bounds, physical hardware, crowded contexts and lifecycle remain relevant limits.

The preceding five-source release edc632141c32298b84ef57304ccd6ffe9e3a8646 is verified live: all 9,206 inventory members and exact metadata, eight native HTTP identities including both Citadel hamlets, ten desktop/phone Atlas finding views, six generated wiki pages and zero browser errors. Its five metadata rows are synchronized. The adaptive findings are a separate local continuation until their own registration and publication. The 9,231-record ledger retains 5,634 open qualifications; no source approval, admission, public renderer activation, artwork downgrade or production-world placement is made. See the detailed measurements and retention record.

Completed cost observations and natural place-selection inventory — 4 November 2026

The independent cost-only counterpart has completed24 cases and408 nonoverlapping measured operations across two counterbalanced repetitions of desktop/phone layouts and the128/192/256MiB native-cache defaults. Every case used a fresh owned browser without diagnostic image reads or a retained observer source-image reference. All216 town source-input/transform records match the separate204-frame pixel study. The408 metadata observations do not add408 pixel-fidelity frames. Each completed case records17 measured operations,including cold/warm navigation,Hex/Region return,map-link reload and four-biome eviction routes. Source identity,actual six-element draw transform,input dimensions,canvas target and smoothing history match the independent fidelity run. Full pixel comparisons remain in that earlier study;cost-only metadata is not pixel evidence.

The paired CPU difference changes sign between repetitions in3 of six profile/layout groups. Two repetitions do not establish statistical or whole-world performance acceptance. Browser/server OS CPU is a lower bound for exited processes. Sampled private commit and working sets are process observations;working sets can share pages,and private/working-set/GPU values must not be summed as unique physical memory. GPU checkpoints are outside timing and are not peaks. Emulated deviceMemory selects cache defaults without capping physical RAM or certifying phones. The shared server and machine background effects are not eliminated. Full cost/aggregate memory,crowded contexts and lifecycle remain open. The192MiB desktop and256MiB phone repetitions particularly need follow-up before attributing broad cost changes to the place planner. No detail reduction,lossy encoding or lower source resolution is accepted as a remedy.

A complete scan of2,252,800 unchanged canonical cells now maps all51 admitted place descriptors across125 declared existing-state profile/feature combinations. Fifty descriptors and121 combinations have natural candidate sites;four tundra combinations have none. The1191 tundra cells include the relevant feature types,but their one magic site,three towns,three ruins and one castle deterministically select other eligible variants. The unmatched combinations are Floating Stones/magic,Gabled Court/town,Cold Roundwall/ruins and Drumkeep/castle. Drumkeep is the only source without any natural selection in this seed. Its artwork and approval are preserved;absence from this seed is not an artwork-defect finding. This candidate inventory supplies0 normal-client frames and grants0 new game-ready approvals. Effective occupancy and actual normal rendering are still required. The source stream hashes,header formats,individual permission hashes and full source contracts bind the matrix. Complete natural occurrence counts are distinct from at most five retained interior candidates plus a boundary witness. No-match combinations are kept. Normal-client checks must use an actual effective,unoccupied site and source paint;they must not force a different variant,alter geography or infer visibility from selection alone.

The preceding349e1ac release is fully verified live and its five metadata rows are closed:exact9,206-member inventory and metadata,eight native image identities including both hamlets,ten desktop/phone Atlas views,seven wiki pages and0 browser errors. The new cost observations and source-selection inventory are local findings awaiting their next focused Atlas publication. All9,231 goal records,5,634 open qualifications,43 runtime entries,originals,preferred studies,both hamlets and saves remain. No public renderer activation,new admission or artwork downgrade is made. See full costs and limits and all candidate/no-match cases.

First ten normal place-source reviews — November 4, 2026

Ten unchanged originals now have40 observed local Region/Hex frames across desktop and phone layouts. The village,cottage,farm,forest columns,tundra waystones,wetland strata,desert courtyard city,field castle,market town and mountain walls were each inspected at native source resolution and in all four context panes. Exact native HTTP identities and source bounds passed;20 native-dimension source replays were pixel exact. The other20 Region comparisons use the normal renderer's actual mip inputs and remain descriptive. These are emulated phone layouts,not physical-device certification. The observer records actual cell/source identity,input dimensions,six-element draw transform,target canvas,smoothing and native SHA-256. An isolated source replay is not final composite pixel attribution. Source bounds inside the map do not independently establish absence of UI or foliage occlusion;the four panes were also directly reviewed.

The scoped subject reviews found no demonstrated reason to repaint these samples. They grant no whole game-ready approval. Directional/woven field and hills grain,coarse forest/mountain floors and particularly oversized wetland leaf/stem grain remain mesh-background quality concerns. Exact periodicity is unmeasured;an algorithm name does not prove nonrepetition. All declared profiles,physical scale,crowding,terrain contact in other settings,lifecycle,full performance and earlier raw terrain/Hex failures remain open. Finite architecture and scenery portraits must never be tiled as mesh backgrounds.

The complete plan retains125 declared combinations:121 have effective eligible candidate sites and four remain naturally unselected. This batch covers ten combinations,leaving111 eligible contexts. Candidate eligibility,actual local source paint,production-world appearance and final quality approval remain distinct. These local observations do not prove any new production-world appearance,change source admission or activate a public renderer.

Five native previews show exact red/yellow contour colours at alpha1–2 of255. No opaque boundary contamination was established in the sampled composites. The exact colour/alpha histograms are retained;no arbitrary low-alpha shadow,foliage or source pixel is removed. Every original,preferred final,both Citadel hamlets and persistent save is preserved. Ten bounded lossless context sheets are retained;raw pixels and full map images remained in memory. A proven duplicate progress payload was replaced by a pointer after exact comparison. See per-source findings and measurement limits.

Second ten normal place-source reviews — November 4, 2026

A second distinct ten originals have40 normal local Region/Hex desktop/phone frames and individual native/context reviews. Together the first two batches cover20 distinct sources and80 frames;101 effective eligible combinations and all four naturally unselected combinations remain. Twenty more native-dimension source replays are pixel exact. The20 normal Region mip comparisons remain descriptive. All ten browsers,twenty contexts and the owned QA server closed cleanly. No source,approval,renderer,canonical geography,production world or save was changed.

Matched-context replay withdrew the initial Squarekeep/town-occlusion attribution:all98,306 tested source-alpha128 pixels match across four source canvases. Its small Region presentation remains a scale/readability question. Desert Gate has confirmed source/control hit-area overlap in the sampled phone Region camera. Floating-stone outer rubble also approaches phone controls,so its clearance remains open. Actual source paint and map-bounds inclusion do not establish a readable unobscured subject. Preserve the detailed originals while investigating normal framing and crowded composition;do not conceal failures through repainting,lossy reduction,blanket shrinking,feature relocation or approval changes. The unchanged-source hashes,four actual draw transforms per source and bounded native-resolution sheets retain the failures. The source-only native replay is not final composite pixel attribution. Raw map/RGBA buffers are not persisted;duplicate progress frames were retired only after exact comparison to the final report.

Wetland leaf/stem grain and grassland straw-like grain remain conspicuously oversized;forest,hills,mountain and field grain also need separate aesthetic and nonrepetition work. Exact periodicity is unmeasured. No whole-scene,physical-scale,all-profile,crowded-context,lifecycle or full performance acceptance is granted. Earlier raw terrain/Hex differences remain unresolved. Finite portraits must never repeat as mesh backgrounds. See second-batch evidence.

Thirty source reviews, visibility attribution and native tower study — November 4, 2026

The first three batches now contain30 distinct source/context combinations and120 normal local Region/Hex desktop/phone frames with individual native and four-pane visual reviews. Twenty further original sources are still naturally selectable but unobserved in this series;the complete plan retains91 eligible combinations plus four naturally unselected combinations. These counts cover admitted place art,not all5,634 remaining library qualifications. All source approvals and renderer contracts remain unchanged.

The initial claim that a town hides most of Tundra Squarekeep was withdrawn. Replaying its source over the actual before-draw canvas,with identical context attributes,reproduces98,306 source-alpha128 pixels exactly across desktop/phone Region/Hex. Its72-world-unit canvas remains a physical-scale/readability question. An initial Hex mismatch was caused within this diagnostic by different willReadFrequently context choices;matching them gives0 differences. The alpha255-only attempt tested0 pixels and grants no visibility evidence. None of this resolves earlier terrain/Hex failures or certifies CSS,other canvases,soft edges,performance or lifecycle. The exact comparison uses the browser’s own source-over renderer and real before-draw pixels;its selected-pixel gate isalpha>=128. Region contexts report willReadFrequently=false and Hex=true. All actual,expected and baseline context attributes match in the valid replay. The first trace’s strict clear detector could retain phone prefix calls at fractional canvas edges;do not use its prefix counts as frame draw counts. Control hit-area counts do not depend on those prefix counts.

Actual DOM control hit areas intersect2,347 Desert Gate,804 Cohesive Ward and1,599 Cohesive Gate source pixels in sampled phone Region cameras. They are source-alpha128 hit-area overlaps,not opaque UI-alpha counts. Sampled phone Hex/floating-stone views have0 such hits,so proximity alone is not called a failure. Mountain Gate Cluster overlaps ridge scenery and retains its contact/crowding gate. Round Keep phone Hex has one nonzero-alpha apron bounds exception;independently decoded alpha128 subject bounds fit inside the map. Both facts remain recorded.

The existing forest tower has heavier outlines,saturated yellow-green ground and a distinct ground disk relative to the approved material benchmark. Its catalogued original remains exact. A non-destructive V6 alternative now exists as an explicitly linked unregistered preferred study:1254×1254 RGBA PNG,unchanged generated native bytes,two independent decoders agreeing,758,407 fully transparent pixels and0 alpha128 border pixels. It is a generated style alternative,not a pixel-exact masked edit. Ground blending,alpha edges,projection/role/scale,all context views,performance and lifecycle remain unaccepted;its initial review had0 contextual frames. The later matched comparison now has4 private study and4 original-control views,with no admission or game-ready approval. The published catalog remains9,206 files plus this one explicitly tracked unregistered study. No finite portrait becomes a repeating mesh background. Original source hashes,actual transforms,method failures and bounded native witnesses remain. Raw RGBA/map buffers stay in memory and byte-identical repeated witnesses reuse existing files. See visibility evidence and native tower provenance.

Next twenty Atlas reviews and private native tower comparison — November 4, 2026

The preserved V5 tower and the V6 preferred native study have now been compared at the same legitimate canonical site in four original-control and four private-candidate Region/Hex desktop/phone views. All four actual draw transforms and declared widths match. Both candidate native-dimension Hex source replays are pixel exact;the two normal Region mip comparisons remain descriptive. The native study and all eight panes were directly reviewed. Finer masonry,more restrained moss/ground colour and less disk-like contact are preferred in this sample. Original bytes remain exact. Both variants use the original alpha-bounds camera geometry,so framing is not fitted independently to make the candidate appear better. The candidate image was served through an explicit browser-private route and exact-SHA binding. Public native files,manifest,permissions and renderer modules were rehashed unchanged. All owned browsers,contexts and QA servers closed.

The candidate used one browser-private source URL and matching permission replacement,with all other contracts unchanged. This is a preview binding,not public source admission or normal approved-source appearance. The old ground footprint was inherited only for preview;it is not approved for V6. Physical scale,alpha edges,broader/crowded contexts,lifecycle and full performance remain open. No production-world appearance,public renderer activation or game-ready approval follows. The9,206 published catalog files and original source remain separate from the one explicitly linked unregistered native study.

Twenty individually reviewed source records from the second and third batches now have registered normal-context findings and specific ledger next actions. They bind80 existing-source frames,corrected Squarekeep attribution,actual phone Region control-hit overlaps,the Round Keep apron/subject bounds distinction,Mountain Gate Cluster relief/contact and the tower’s style-study follow-up. All goal statuses,unreviewed rows,source approvals,5,634 qualifications and43 runtime entries are preserved. This new registration awaits its own focused Atlas publication and live verification. The preceding499e241 first-ten release is fully verified live:18 native identities,20 finding views and ten wiki pages. Source/control hit areas are not opaque UI-alpha measurements;source replay is not final composite attribution. Earlier terrain/Hex failures remain open. See registered source findings and private tower comparison.

Native tower study registered in the Atlas — November 4, 2026

The exact native V6 tower PNG is now separately catalogued as WOG-A-009276,linked as a proposed alternative for preserved original WOG-A-008756. It is a reference/study asset with approved=false,whitelisted=false,no public gameplay binding and a pending qualification. Its four private candidate views and four original control views are recorded separately from normal admitted-source appearance. The original’s artwork and source contract remain unchanged. The Atlas can now show the actual V6 native image without granting world-use rights.

The local catalog has9,207 files and the complete ledger has9,232 records. Pending qualifications increase from5,634 to5,635 because the newly retained study is explicitly included;no older record or readiness gate disappears. All3,597 explicit dispositions,354 local source permissions,322 production permissions,43 runtime entries,originals,prior finals,both Citadel hamlets,canonical geography and saves remain. There are37 retained preferred outputs/studies and0 newly complete game-ready approvals. The21-row release includes the twenty source reviews plus the native study and awaits focused publication/live verification. Every prior checksum row is preserved exactly and one new SHA-256-bound native row is appended. The original8756 relationship links the new study without overwriting its original technical hash or approval. Global source approvals and the compact runtime metadata index remain byte/structure compatible. The private candidate source URL is a test binding,not a public renderer import.

The native V6 bytes remain1254×1254 RGBA without resampling or lossy encoding. Sampled finer materials and less disk-like contact are preferred,but the inherited private footprint,physical scale,alpha edges,broader/crowded contexts,state/lifecycle and full performance remain open. This finite ruin portrait must never tile a mesh background. Earlier terrain/Hex failures and the recorded control/relief/bounds concerns remain explicit. The twenty reviewed next actions and the new study action are reflected in recomputed ledger action counts. See intake and native identity.

Fourth ten preserved sources in normal local contexts — November 4, 2026

Ten additional distinct original sources were directly reviewed at native resolution and in40 actual normal local Region/Hex desktop/phone frames. This brings the series to40 distinct sources and160 frames,with81 eligible profile/feature contexts and four naturally unselected declared contexts still open. These local observations do not establish production-world appearance. Artist bytes,source permissions,gameplay rules,geography and saves remain unchanged.

All40 nonzero-alpha source bounds fit their map,but map bounds do not prove visibility. The actual input dimensions yield22 exact isolated native replays:20 Hex plus both Region views of the519×448 limestone arch. The other18 Region mip comparisons are descriptive. Source-only replay is not final composited contribution. All ten browsers,twenty contexts and the disposable QA server closed with zero capture failures or browser errors. Raw pixels and full-map PNGs were not retained.

The Crown Keep phone Region sample visibly intersects the control column at its right round tower. The grassland arch Region sample has a foreground town roof overlapping its lower left base;no quantified final-source pixel attribution is claimed. Preserve both originals and review camera/control clearance and composition separately. Surrounding ground grain/nonrepetition,physical scale,broader/crowded contexts,lifecycle and complete performance remain unaccepted. The separate native tower V6 study also remains unapproved. The four naturally unselected contracts remain in scope rather than being forced or silently dropped. See fourth-batch evidence.

Fifty original-source contexts and explicit ground labels — November 4, 2026

Twenty additional preserved originals have80 individually reviewed normal local Region/Hex desktop/phone frames. The series now covers50 distinct naturally selected sources and200 frames;71 eligible profile/feature contexts and four naturally unselected declared contexts remain. Forty-eight actual native-dimension isolated replays are exact;32 Region mip comparisons remain descriptive. Exact replay does not make limited native detail sharp when enlarged. Chalk masonry8816,desert floating stones8827 and desert paving8831 retain close-Hex detail/contact gates. Crown Keep3573 retains its phone-control intersection;grassland arch8860 and paving8862 retain foreground-building composition gates.

All ten regional ground materials now derive their purpose and semantic family from the explicit ground role and profiles. Snow,desert,wetland,lake and ocean sources no longer inherit a woodland-floor classification. The compact descriptive UI labels receive the same ten purpose corrections. The isolated production index preserves every other published row and alias;the larger local index retains its unrelated queued changes. All43 runtime entries remain,with only the local index entry hash refreshed. Artist bytes,placement/scales,source approvals,renderer sampling,geography and saves are preserved. The enrichment helper handles only role=ground with declared nonempty profiles;canonical places,canopy and structures retain their own metadata rules. Exact-file approvals and technical measurements are unchanged. The local4535-row and production3855-row compact indexes retain their separate baselines;only ten purpose labels change in each.

The existing1520×1035 native masonry study9215 is visibly sharper than the preserved194×132 original8816. Eight private diagnostic views add no normal-source or production appearance. Four current independent native-image replays with actual canvas attributes reproduce184195 tested source-alpha128 body pixels exactly;default contexts produce144098 Hex differences,maximum16. The historical max31 phone failure is retained and is not retrospectively assigned a proved cause. Material/palette,finite contact,physical scale,alpha1edges,broader/crowded sites,lifecycle,full performance and source admission remain open. No new image was generated or resampled. Region uses willReadFrequently=false and Hex uses true in these captures. The diagnostic matches actual six-element transforms,canvas dimensions and context attributes;its source-canvas proof excludes CSS,other canvases,the soft-alpha exterior and full-scene attribution. One private candidate witness is reused byte-exactly,with no raw readbacks or full-map files retained.

The previous21-record commit37e8ae0 is live and verified. This new31-record intake combines20 source reviews,ten ground-label corrections and one existing-study finding;it awaits its own publication and live verification. The complete scope remains9207 catalog files,9232 ledger records,5635 pending qualifications,3597 explicit dispositions,37 preferred outputs/studies,354 local source permissions and322 production permissions. There are0 new complete game-ready approvals. Every original,prior final,both Citadel hamlets and all earlier terrain/Hex failures remain. Ground nonrepetition and physical grain still require separate qualification;finite portraits must never tile a mesh background. See individual reports.

Additional profile histories and two native desert studies — November 4, 2026

Ten preserved sources now have40 additional normal local Region/Hex desktop/phone frames at ten further naturally selected profile sites. Per-profile histories append to the prior findings. The series covers60 profile contexts and240 frames from50 distinct sources,with61 eligible contexts and four naturally unselected contracts remaining. No production-world appearance or approval is inferred. Native source hashes match the earlier individual native reviews;the additional context sheets were directly inspected. The additional-context batch does not claim a fresh native-art inspection. Twenty native-dimension Hex source-only replays are exact;twenty Region mip comparisons are descriptive. Bounds fitting does not establish dry support or final visibility.

Two separate native1536 by1024 desert studies preserve the small floating-stone original8827 and paving original8831 plus both full landscape parents. Floating-stone study9277 resolves finer fractures and masonry;its two Region camera transforms match the original while its two Hex focus transforms differ. Paving study9278 has finer low chipped slabs and a narrower sampled contact seam;all four camera transforms match. Its provisional alpha250 stone-body width/center/bottom proxy adjusts the preview footprint,not an approved physical-scale contract. Both studies retain their generated RGBA bytes with independent scanline/libvips decoder agreement. Four private views per study and reused original controls do not add normal-source context coverage.

The field farm fence extends into shoreline water,wetland city ground grain is oversized relative to its architecture,and forest waystones require canopy clearance/crowding checks. Preserve those originals while resolving placement,terrain support and ground presentation. Study alpha edges,palette,contact,physical scale,broader/crowded contexts,state/lifecycle,full performance and source admission remain open. Earlier terrain/Hex failures remain unresolved. There is no renderer activation,source approval,new complete game-ready classification or change to geography,saves or player rules.

The complete baseline now includes9,209 catalog files,9,234 goal records,5,637 pending qualifications and39 preferred outputs/studies. The two extra pending qualifications belong to the two added studies;all3,597 explicit dispositions and43 runtime entries remain. Fourteen changed records require focused Atlas publication and live verification. The preceding5f2d0e2 release is fully verified live:38 native identities,62 desktop/phone finding views,ten wiki pages and ten purpose-only compact labels. See intake and preserved gates.

Seventy reviewed terrain contexts and private ground grain — November 4, 2026

Ten further unchanged sources have40 new normal local Region/Hex desktop/phone frames at additional declared profile sites. All ten four-pane sheets were inspected;native hashes match prior individual native reviews without claiming a fresh native inspection. The reviewed series reaches70 contexts and280 frames from50 distinct sources. The latest ten profile findings and two exact-source private primary-ground findings are registered locally for Atlas publication,with51 eligible and four naturally unselected contracts retained. A dry grassland farm does not retire its field-profile fence-in-water failure. Wetland ground grain,coastal support,phone controls and moss-rich waystone material at a desert/grass transition retain explicit gates.

A browser-private primary-grain proposal compares1.25 against2 hexes for grass source3576 and wetland source3578 at a market,wetland columns and wetland city. All twelve actual foreground camera transforms,canvas sizes and selected-source-only replay RGBA hashes match the controls;all twelve map hashes change. The twelve panes were directly inspected and the finer sampled ground grain is preferred while native architecture remains intact. Secondary grass/wetland variations and the existing1.25-hex hills overrides remain unchanged. Native artist bytes,public renderer,production contracts and saves are untouched. The active ground binding is approved-world-art.json terrain.profiles variations;changing descriptive regional ground or approvedAssets rows alone does not alter terrain rendering. The private test verifies this distinction rather than treating an intended manifest edit as observed output. Nonperiodic crops and no-wrap source sampling already exist;visual grain size and perceptual repetition remain separate checks.

The initial twelve-frame test changed descriptive rows but missed the renderer terrain-variation binding. Its three sheets were byte-exact controls and were deduplicated after verification,retiring17,839,400 bytes;compact failure evidence and all frames remain. The corrected preview changes both primary terrain variations and matching private rows. Neither attempt adds normal-context coverage. Source-only equality does not prove whole final-composite fidelity. World-wide perceptual nonrepetition,physical scale,contact,crowding,lifecycle and full performance remain open;earlier terrain/Hex and pan-return failures are retained. No public activation or new game-ready approval is granted.

The preceding14-record94a4c6d release is fully verified live:9,209 catalog files,27 checked native identities,28 desktop/phone Atlas finding views and ten wiki pages. Both native desert studies are available in the Atlas alongside preserved originals and remain unapproved for world use. All9,234 goal records,5,637 pending qualifications,3,597 explicit dispositions,43 runtime entries,both Citadel hamlets,source permissions,geography and saves remain. See normal profile findings and private ground validation.

Ninety default-world context reviews and four alternate-world roles — November 4, 2026

Twenty additional declared default-seed contracts have80 newly reviewed normal local Region/Hex desktop/phone frames. The default-seed series reaches90 source/profile/feature contexts and360frames from50 distinct sources,with31 eligible contexts still open. Four additional tundra contracts were naturally selected in two legitimate disposable QA worlds using short seeds accepted by the normal client. Those16frames include the first normal local Drum Keep observation,bringing the combined review to94 context samples and376frames across51sources. These are observations of the current local renderer,not production-world appearance evidence.

The default seed still has four naturally unselected contracts. Alternate QA observations do not change those facts or canonical geography. No source variant was forced and no world command was issued to make art appear. Both owned temporary alternate worlds were retired only after their browsers and servers closed and the existing canonical QA save hashes matched. Long seeds rejected by the normal client contributed zero accepted frames. Production saves were not opened or altered.

Original fine stone,timber,slate and thatch details are retained. The Round Keep phone Hex all-nonzero-alpha apron crosses the map boundary;separately measured alpha128/250 body rectangles fit in all four eighth-batch maps,which does not prove full visibility or control clearance. Field-farm shoreline support,forest vegetation and ridge overlap,wetland grain/contact,phone controls,moss-rich material/state suitability,Drum Keep physical scale and broad translucent surrounds remain individual gates. Floating-stone red native-edge samples are all below alpha16;this descriptive color count does not prove an opaque world fringe. Source-only native replay equality does not prove final composited contribution. Physical scale,broader contact,nonrepetition,crowding,states,lifecycle,complete performance and earlier terrain/Hex/pan-return failures remain unaccepted.

The metadata-only intake appends profile histories without replacing earlier findings. It preserves9,209 catalog files,9,234 goal records,5,637 pending qualifications,3,597 explicit dispositions,39 preferred outputs/studies,43 runtime entries,354 local/322 production source contracts,all native artist bytes,both Citadel outer hamlets,gameplay rules and saves. No new source admission,renderer activation or complete game-ready approval is granted. The preceding42b570c release was verified live against28 native image identities,24 desktop/phone Atlas finding views and ten wiki pages;this new intake requires its own Atlas validation and live closeout. Native HTTP bytes,actual paint source/cell/transforms,desktop1440 and phone390 canvases,and per-source projected alpha bounds are retained with hashes. Raw readbacks and full-map PNGs are not stored. See contract findings and short-seed evidence.

All declared place contracts sampled; readiness gates retained — November 4, 2026

The initial source/profile/feature context matrix now has individually reviewed QA samples for all125declared contracts. All121naturally eligible default-seed contracts have484 normal Region/Hex desktop/phone frames from50sources. Four naturally selected contracts in legitimate alternate QA worlds add16frames and one source,for500frames across51native sources. Four default-seed no-match facts remain unchanged. This completes initial context sampling,not acceptance of every contract,production-world appearance evidence or full-library game readiness.

The final31default-seed findings and three private canopy findings are registered on11existing source records for the next Atlas release. This supersedes the earlier local pending-registration note in the100-context review. All source/profile histories and earlier individual failures remain. The prior17-record81d2725release is fully live-verified:34native identities,34desktop/phone Atlas finding views and ten wiki pages passed. The new11-record intake requires its own publication and live closeout.

Phone Region controls overlap the large cities and Crown Keep. The Hills Cohesive Ward also has a neighboring farm overlapping its right-hand side. Forest crowns,other neighbor/ridge composition,coarse mesh-ground grain and perceptual nonrepetition,alpha/contact,physical scale,biome/season/state,lifecycle,complete performance and previous terrain/Hex/pan-return failures remain open. All84 final-batch projected nonzero-alpha bounds fit the map and42native Hex replays match exactly;neither proves final source contribution or phone clearance. Region mip comparisons remain descriptive. The nine distinct sources in the final21contract batch recur in different profiles and must not be collapsed into one approval.

The12-frame browser-private canopy study makes the walled city gateway clearer with identical native art. Ten foreground transforms,canvases and source-only RGBA hashes match controls;two ruin Hex cameras differ. Broader surrounding-crown removal,phone framing,whole-ruin clearance,shape/depth-specific exclusion,preservation of unrelated trees,cache/lifecycle and full performance remain unaccepted. The study is not activated. Public renderer,source permissions,simulated vegetation,canonical geography and saves are unchanged;private frames add zero normal-context coverage.

The full baseline remains9209catalog files,9234goal records,5637pending qualifications,3597explicit dispositions,39preferred outputs/studies and43runtime entries. Preserve every original,selected final,approved reference and both Citadel outer hamlets. No source admission,new native image,artist-byte change or new complete game-ready approval is granted. The final matrix compares exact source/profile/feature keys against every effective eligible contract,and separately matches all four alternate-world samples to the four default no-match keys. Raw readbacks and duplicate catalog baselines are not stored. See full context evidence and registered findings.

<!-- hex-physical-density-20261104 -->

Native place clearance and physical Hex detail — November 4, 2026

The renderer binds foreground body-clearance geometry for two existing forest city sources and a ruin to their exact native file hashes,dimensions,widths and anchors. The original quiet-core/background rules remain. Width,bounds and source revision share one natural selection. Composition revisions include geometry/source/profile identity,so a same-width source change cannot reuse stale layout. This is decorative visibility,not simulated tree clearing or a new building permission.

Hex ground and foreground now share a physical pixel layout at the existing selected resolution. DPR is part of scene cache identity;ground planning keeps logical dimensions,and both foreground branches retain the same CSS/world placement. Loading resets clear the full canvas with the identity transform. Original artwork,source selection,geography and gameplay rules are unchanged.

Forty normal Region/Hex desktop/phone candidate views across ten naturally selected production sources passed with zero browser errors. Twenty native Hex source-only replays are exact and both surfaces use physical DPR2 on the tested DPR2 display. Twelve paired body-site observations preserve CSS placement within0.001pixel;the six Region maps remain byte-exact and the six Hex maps change. Six actual pointer-return/reconnect checks reproduce exact maps/transforms. All panes were directly inspected;the earlier body-only DPR1 finding is superseded for this candidate.

Readback-free headless Edge timing on one natural forest city measured published/candidate Region pointer p95 at19.4/19.5ms desktop and11.3/12.1ms phone. Three Hex switch samples stayed in a similar range. Those four pages used no source-paint hooks or RGBA readbacks and do not certify full-library performance. Disposable worlds were retired after browser/server terminal proof;compact findings and bounded decisive witnesses remain.

These are scoped renderer checks,not complete game-ready asset approval. Phone control overlap,coarse ground grain/nonrepetition,shoreline/fence and neighbor/contact failures,physical scale,biome/material/state suitability,full state lifecycle,complete performance and earlier terrain/Hex failures remain explicit. Ten local Atlas source records preserve all prior individual findings. The full baseline remains9209catalog files,9234ledger records,5637pending qualifications,3597explicit dispositions and39preferred native outputs/studies. Source permissions stay354local/322production;no native image,new source admission or complete game-ready approval is created. See the review and verification record.

<!-- phone-native-ui-coverage-20261104 -->

Phone framing evidence — November 4

A local20-view follow-up measures actual source alpha>=128against a two-background UI matte with opacity>=0.85. It confirms669/102678covered body pixels for the Cohesive Ward and1349/117437for the Walled Gate Quarter in390px Region views. Eighteen other measured views,including all ten Hex views,have zero overlap at these thresholds. All transforms match controls,but nine whole-map hashes differ and remain unexplained. Preserve broader pixel,ground,scale,state/lifecycle and performance gates;no source approval changes. See the scoped review.

<!-- phone-native-ui-pan-20261104 -->

Two ordinary 40 CSS pixel left drags in the unmodified production d111bb3 renderer clear the earlier669/1349 strongly opaque Region UI intersections. Four Region/Hex source-alpha/UI-matte measurements have zero overlap at alpha>=128 and UI opacity>=0.85. Native width,world positions and projection scale remain unchanged;full alpha>=1 image bounds fit both Region frames. Two Hex transforms match controls but whole-map hashes differ:keep composite determinism and final-pixel attribution unresolved. This camera diagnostic grants no artwork approval or production-world appearance. See the phone camera follow-up.

<!-- native-ground-viewport-20261104 -->

At a controlled16physical-pixel material span,the production renderer changes from irregular stamps at320x240 to a repeat-pattern fallback at640x480. The three exact native grounds change76689,76731 and76735 of76800shared pixels respectively. The nonperiodic WebGL2 candidate has zero changed shared pixels in each measured resize and offset comparison and no repeating-source pattern calls. Same-view repeats are exact for both algorithms. The offset comparison changes viewport size too;it is not a fixed-size pan test. Initial raw production backend strings are generic;repeat-call counts identify the fallback. Finer80-pixel-span candidate views still require visual qualification for softness/mottling. This isolated algorithm study explains neither the earlier nine same-viewport composite differences nor total production prevalence,and grants no activation,approval or full performance/lifecycle acceptance. See the native ground diagnostic.

<!-- native-ground-context-study-20261104 -->

The private material candidate receives native ground images rather than feathered stamps. The corrected1.25hex test normalizes versioned source URL pathnames and asserts the actual tile-width ratio1.25/4before retaining each frame. All twelve finer frames preserve foreground transforms/source-only RGBA;all six Hex subjects replay exactly. The preceding twelve4hex controls plus twelve effective finer frames are private contextual evidence. A separate twelve-frame no-op request is excluded. Inherited raw publicRendererChanged:true fields refer to private response overrides;protected production runtime files remain byte-identical. No production activation,admission,new approval,full performance or full lifecycle acceptance is implied. The nine earlier same-viewport composite differences remain open. See the private native-ground context study.

<!-- native-ground-performance-followup-20261104 -->

A four-page,one-site performance follow-up measured desktop Region p95 production/candidate27.6/27.7ms and phone14.9/14.4ms. The desktop cold Hex switch was210/311ms with a115ms candidate long task. Preserve this gap and full lifecycle/CPU-fallback/context-loss gates. Native fidelity proof does not replace performance qualification,and this single grassland site does not certify the wetland or fields. See the scoped ground performance review.

<!-- native-ground-fixed-backing-20261104 -->

Profiling attributes about98ms of the private desktop cold switch to repeated GPU backing resizes. A fixed backing within the existing2,097,152working-pixel budget keeps tile shader coordinates and native output dimensions unchanged,and crops each active bottom-left WebGL viewport to its exact destination. Twelve complete GPU comparisons match28,207,710pixels;real context-loss recovery matches3,387,488CPU-reference pixels without partial publication. Twelve normal whole maps and six pointer-return/reconnect maps are exact. Four separate uninstrumented cottage pages measure desktop cold Hex344→222ms and the149ms long task is absent in the fixed candidate;phone cold Hex134→115ms,with both surfaces at physicalDPR2. This resolves the measured preview gap at that site,not full hardware/memory/state-lifecycle qualification or earlier composite failures at other cases. No public renderer activation or artwork approval follows from these checks. See the native ground fixed-backing review.

<!-- native-palette-backing-parity-20261104 -->

The current production/local terrain variation bindings reconcile to19unique catalog files:10production and19local. Five complete WebGL2 comparisons per exact native source cover95outputs and243,081,117RGBApixels with zero differences,including nonsquare inputs,fractional viewport extent and partial tiles. Every source retains its existing individual next action;renderer membership and existing AI approval labels are not game-ready decisions or observed-in-world proof. No new normal-world frames,artistic approvals or production activation are added by this direct palette probe. See the terrain palette parity review.

<!-- native-lake-windpatch-context-20261104 -->

The lake study is a native 1536×1024 opaque PNG, linked to WOG-A-008307 and WOG-A-003575 without overwriting either source. Twelve actual private client frames use exact-byte response substitutions at one natural fields/lake contact, identical camera and source scale, production permission count 322, and the existing native/fixed-backing preview. These are explicitly private substitutions, not source contracts or production observations. Five real-GPU comparisons preserve 12,793,743 pixels and abandoned jobs publish nothing. All 9,210 catalog file hashes pass a complete streaming check. Direct desktop/phone board review rejects composed Region recurrence; Hex water-interior detail is preserved, but Hex shore contact is untested in these crops. The sampler selects centers within about 17% of source width/height (margin 0.415); broader source coverage is a hypothesis to test with CPU/GPU parity, not an accepted algorithm change. Two rejected generation inputs were retired after preservation, reclaiming 3,729,573 bytes. See the lake study context review.

<!-- native-lake-sampler-coverage-20261104 -->

The private lake sampler doubles blend frequency from 4 to 8, halves source patch footprint from 0.25 to 0.125, and halves its edge margin from 0.415 to 0.2075. The source-coordinate derivative stays unchanged, without rotating or blurring source grain or expanding edge clamping. An initial uniform-arithmetic implementation changed 1,055 default ocean pixels and was rejected. The corrected branch preserves original default fragment arithmetic and passes 95 real-GPU comparisons over all 19 terrain inputs (243,081,117 pixels). Seven CPU behavior checks and real context-loss recovery against an independent constant-frequency CPU reference pass; recovery compares 3,387,488 pixels and publishes no partial surface. Eight actual normal-client frames still fail visual recurrence review. Three of four historical whole-map controls are exact; the phone Hex retained crop differs at 410 pixels, by at most one channel level, in the visible Hex-control corner. That diagnostic does not explain all unretained full-map pixels, so full composite parity remains open. No production activation, source admission or new approval follows. See the lake sampler review.

The read-only natural lake component at the sampler site has 568 cells. Maintaining the current source density over its full bounding rectangle would require at least 74,112×8,869 native pixels; stretching the existing study would reduce detail. A finite composition must therefore use a bounded, density-preserving design rather than one enlarged bitmap. See the density analysis ../art-direction/display-cache-history-20261104/lake-sampler-coverage-20261104/finite-domain-density-analysis.json.

<!-- native-lake-short-wavelets-20261104 -->

The selected short-wavelet lake artwork is an exact native 1536×1024 opaque PNG, WOG-A-009280. Built-in image editing changes highlight grouping, followed by a palette/microcontrast correction; no resampling, source overwrite or renderer change is used. Twenty-four actual private Region/Hex frames cover the initial and corrected studies with two retained references at one unchanged natural site; four corrected-study frames support the scoped preference. The corrected native one-pixel luminance contrast is 0.854 of the original, improved from the initial study’s 0.621; that diagnostic is not a sharpness approval by itself. Five real-GPU comparisons preserve 12,793,743 pixels relative to the existing native material kernel. Wider recurrence, Hex shore contact, lifecycle, performance and source admission remain explicit. Cleanup retires five temporary inputs/duplicate previews after preservation, reclaiming 10,171,495 bytes; two final native context boards remain. See the short-wavelet lake review.

<!-- native-lake-shore-domain-20261104 -->

The canonical scan examines 2,252,800 cells, including 34,988 lake cells, and inventories seven adjacent land biome types. One effective-world-validated representative per type yields 56 initial native original/study views with 28 matching source-pair geometries and actual pixels contributed outside UI. Fourteen shore pan-return maps are exact. The first 28 reload observations are invalid because the harness clicked before semantic initialization and reused a Region URL for Hex. The corrected test follows the real Share view link, waits for the intended settled view, and proves matching full camera and scene bounds; all 28 reconnect maps are exact. Added field GPU/CPU and mountain interior checks bring this package to 108 base views and 58 valid exact lifecycle comparisons. Eight GPU/CPU whole-map comparisons cover 16,761,344 pixels; 9,211,580 differ, with maximum channel differences of 2 to 8. Bounded native source-contribution crops differ by 2 to 6 channel levels and retain one-pixel contrast ratios of 0.986 to 1.001; direct inspection supports retained painted detail at this field site, not universal parity. Field Hex detail and mountain desktop Hex bank-contact witness gaps are resolved at the tested sites. Ten native sheets are retained; comparison buffers remain in memory. All artist bytes, approvals, source permissions and pending whole-readiness gates are preserved. See the shore-domain review.

Index freshness follow-up: the local descriptive index now includes the two planned native lake studies,while preserving all 4,535 prior entries and aliases exactly. It has 4,537 descriptive entries. This grants no source permission. The existing queued index declaration is updated;the other 42 runtime declarations and the production index stay intact.

<!-- native-ground-fine-wide-sampling-20261104 -->

The private fine-ground comparison uses the same exact 1254×1254 sources and 1.25-hex logical span under sampler frequencies 4 and 8. The native coordinate derivative stays one; crop-center coverage changes from about 0.17 to 0.585. Actual material calls record dimensions, frequency, source path and extent. All 12 original/cohort pairs contribute different pixels outside UI across 24 normal-control views. Eighteen candidate pan-return/reconnect maps and six separate Hex foreground canvases are exact. The selected cottage/grasslands, strata/wetlands and courtyard/fields controls occur in two effective natural biome types; profile labels do not prove natural biome coverage. Three unresampled native sheets retain the decisions, with no full-map or RGBA cache. Ground recurrence, all-view artistic preference, contact/state coverage, CPU fallback and relevant performance remain open. No source admission or public renderer change occurs. See the fine-ground review.

<!-- native-wetland-bank-sampling-20261104 -->

The native wetland bank test binds WOG-A-003578 to its exact 1254×1254 PNG. A read-only effective-world probe validates lake and wetland neighbors. Sixteen actual current/wider-sampling GPU/CPU views and 12 exact candidate pan/reconnect maps preserve the observed bank geometry. Eight complete backend comparisons cover 16,761,344 pixels; 8,828,693 differ, with channel maxima 3–8, so backend pixel parity remains unaccepted. A separate actual-image material test forces context loss after one complete GPU tile: no pixels publish early, that tile is discarded, and all 3,387,488 recovered pixels equal an independent literal-frequency-8 CPU reference. Source bytes and decoded pixels stay unchanged. This proves the scoped recovery case while preserving broader client, state, physical-grain, wetness, contact and performance gates. Two native sheets remain; comparison buffers stay in memory. See the wetland bank review.

<!-- native-mire-fine-ground-contact-20261104 -->

The exact 1584x1072 finite Mire alpha image was drawn once with no pattern or crop over the private 1.25-span native floor. Current no-overlay, retained width 240.66390168325452 and smaller width 150.41493855203407 cohorts produced 12 normal views, 12 exact lifecycle maps and 4 identical actual Hex foreground comparisons. A fresh read-only connected probe validates 11 canonical cells. The origin-anchored CPU display surface is transient; recorded RGBA allocation estimates do not establish total process/GPU performance. All 1,572,864 original RGB pixels remain exact under declared integer 24-pixel padding/alpha threshold. Complete Region perimeter is visible; bounded Hex crops prove central contact only. Preserve prior failures and all remaining wetness, contact, state, admission and performance gates. See source-bound review.

<!-- native-mire-perimeter-alpha-20261104 -->

A native-alpha canvas sampled separately with destination-in changed 516 previously opaque display pixels in four browser geometries taken from actual prior Mire captures. The core guard is retained; isolated diagnostics that suppress its throw are used only to measure the defect, never as an accepted renderer. Normal masked cases failed readiness. The proposed correction modifies only display alpha in1..254 and preserves every255-alpha pixel; four isolated guarded geometries pass with 1,111,595 opaque pixels unchanged. Whole-client visual/lifecycle/performance qualification remains pending. Normal portrait framing still centers the admitted foreground reed and clips part of the unadmitted finite overlay; no camera override is used to hide this gate. See exact-source failure evidence.

<!-- native-mire-display-fringe-alpha-20261104 -->

The display-fringe proposal modifies only already-translucent display alpha and retains its opaque-core guard. Six base masked views preserve 1,238,996 opaque pixels exactly; 12 normal views have 18 exact pan/reconnect maps and 3 unchanged Hex foreground comparisons. Whole source rectangles fit desktop/landscape Hex framing; portrait clipping includes 564 opaque native pixel centers geometrically, which is not a screen-visibility measurement. Keep state, wetness/contact and full performance gates open; readback allocations are not a production performance acceptance. Current scope summaries now derive current index/contract counts and verified deployment from canonical files/closeouts; older aliases and actual production-world evidence remain separately preserved. Contract availability does not imply artwork approval. See exact-source review.

<!-- native-mire-native-edge-repair-20261104 -->

The private native-alpha repair changes only existing translucent source alpha, preserving all original RGB and 1,009,237 opaque native RGBA pixels. Actual Chromium native decode verifies that preservation. Twelve source-pair Region/Hex views use the same painter and differ only in PNG input; 18 lifecycle maps are exact and three Hex foreground comparisons stay unchanged. Input-core preservation does not imply unchanged interpolated world-edge pixels. The original remains preferred because direct inspection shows no clear contact advantage. The canonical ledger now replaces its stale no-context explanation with retained private placement and explicit scoped progress, without admitting a source contract, changing the false approval flag or claiming production appearance. Relevant GPU/state and full performance gates remain open. The unselected donor/proposal may be retired after final checks while hashes, method, original and native context witness remain. See exact evidence.

<!-- native-arctic-finite-ground-20261104 -->

The finite arctic source is drawn once in twelve normal desktop/portrait-phone Region/Hex views under the private material CPU-fallback path. Twelve pan/shared-view reconnect maps are byte exact. Native foreground RGBA comparisons pass three pairs but fail the full-size desktop pair at 24,610 of 3,387,488 pixels with a maximum channel difference of 255; this is a real unresolved difference, not just PNG compression. The package remains failed. All actual draw traces validate 27 client-visible canonical cells; verified outside-view fallback has isolated fixture coverage only. The two setup failures and an earlier PNG-check failure remain separate from accepted evidence. No inherited metadata polygon is applied; its 27.12% geometric coverage remains a future domain question. Native artist bytes and approval flags remain exact. Boundary, snow contact, foreground attribution, landscape-phone, GPU/state and full performance gates remain open. See source-bound evidence.

<!-- native-arctic-domain-study-20261104 -->

WOG-A-009281 retains all native RGB pixels of WOG-A-008379 while baking the inherited alpha domain into a separate 1536 × 1024 PNG. Future integration must avoid a second domain mask and decode once into a native-size canvas: direct HTML-image substitution fails eight recorded geometry comparisons, whereas native-canvas preparation matches all eight and all native RGBA pixels. The private normal-client PNG test has four candidate views, four controls and six exact lifecycle maps; it does not resolve the 24,610-pixel desktop limestone foreground discrepancy. The 48-state warmup diagnostic and stable/full-size retests do not establish its cause. There is no public renderer change or source admission. Broader role/state/GPU/total-cost qualification remains required. Native representation and context evidence.

<!-- native-arctic-raster-attribution-20261105 -->

Arctic attribution now covers five exact source records. Full-operation tracing passes one foreground pair with ten identical calls and reset/context fields;the minimal image-input collector retains a24,610-pixel foreground failure. Four submitted native PNGs are SHA-bound,and their post-capture decoded RGBA hashes match across6,291,904pixels per cohort without changing the captured foreground. This is not proof of image backing at original draw time or a hardware raster diagnosis. CSS/DPR geometry places the historical bounds inside the viewport and recorded clips;complete UI occlusion remains unproved. Both four-view normal-client runs have three exact lifecycle maps. Retain the failure while investigating bounded native-canvas preparation and controlled raster history;no production renderer/source-contract change follows from this diagnostic. Methods and exact findings.

<!-- native-arctic-canvas-study-20261105 -->

A private single-source preparation copies3298once at native1586×992into a frequent-read canvas. All1,573,312decoded pixels match the native reference. Eight normal desktop/phone views,six lifecycle comparisons and both foreground pairs are exact;current HTML/native-canvas replays match the actual frames across4,168,400pixels. This does not reconstruct the older phone hash or erase the original-path desktop failure. The declared6,293,248native backing bytes omit total driver/process/storage costs. Production ownership,cache replacement,permission revocation,pressure,state,cost and combined9281testing remain open. No public renderer/source permission is changed. Exact comparisons and limits.

<!-- native-arctic-owned-lifecycle-20261105 -->

The private native owner now checks the exact approved source contract even on cache hits,handles same-key image replacement and releases backing on pressure/revocation. Actual application LRU/approval paths are exercised in four desktop/phone Hex cases:removing/reloading the real record,revoke/regrant,and path-allowed but fingerprint-mismatched input. The source stops painting and all12restorations are exact;other three image draw identities/geometry/styles remain exact. The source cache model reserves native backing before allocation and stays within the existing256MiBhost tier. All16normal views/12regular lifecycle comparisons and80isolated checks pass. This is private native-harness integration,not production activation or total-memory/performance acceptance.128/192MiBtiers,physical phones,full cost/state and combined9281scope remain open. Methods and precise limits.

<!-- native-arctic-memory-qualification-20261105 -->

The source-cache128MiBtier is exercised with actual LRU/reload and separate raw-canvas/visible-world comparisons. Complete projected boulder rectangles change25,098visible opaque-composite pixels,max channel delta53,although raw source PNG/nativeRGBA and full-number draw-state programs match. The old alpha255-only core metric is insufficient because the limestone has only51fully opaque source pixels and the glyph painting has none. A frequent-read target passes8views/6lifecycle maps/12policy restorations but changes prior reference pixels;native materialization and explicit-false context variants still fail desktop LRU. All remain private and unselected.36observed views/23regular lifecycle maps are not complete memory-tier/performance acceptance. Methods,failures and native witnesses.

<!-- native-cpu-and-tundra-20261105 -->

The new1536×1024Ice Bastion study uses a built-in image generation background edit and a lossless original-preserving RGB composite. All84,240pixels in the original subject/contact rectangle remain exact;the outer transition is28native pixels and no resize or lossy encoding is used. It is an opaque source study needing an explicit finite domain rather than a repeated mesh texture. In separate actual normal renderer tests,native-copy CPU rendering passes the128MiBwhole-foreground references and4full-visible-map/complete-boulder LRU comparisons,plus12LRU/approval/fingerprint restorations. Bitmap ownership passes150isolated checks but still fails two desktop normal-LRU cases;the direct-original CPU phone output misses independent replay. The24-case readback-free cost comparison changes only first-context options on the published game plus native owner. Emulated tiers,headless desktop/phone and sampled process/GPU metrics do not establish physical-device or combined fine-ground/alpha9281acceptance. Existing source approvals and322production contracts remain unchanged. Source-bound methods and remaining gates.

<!-- native-ground-family-20261105 -->

The new quiet-ground PNG remains1536×1024and byte-identical to its selected built-in generation,with no resizing or lossy reencoding. The legacy Ice Bastion family has only catalog-manifest routing:two detail and six ground slots,with a detail sampleRect spanning30%width×44%height. Those declarations neither cover the complete new landscape nor grant normal placement. A precise finite parent/ruin-state hierarchy is required. The manual parent alpha trial is rejected after native light/dark composites reveal a polygonal terrain collar despite all1,572,516original RGB pixels remaining exact. In combined native-alpha9281/native-copy CPU tests,the eight views,six lifecycle maps,12Hex policy restorations and four complete visible Hex LRU comparisons pass numerically,but native inspection finds the glyph triptych absent from the desktop Region candidate. No cause is established. Region source draw/actual pixel contribution must be checked explicitly. The additional6,291,456byte ground backing and image decode remain outside application-cache accounting;earlier foreground-only cost measurements do not approve the combined system. Methods and unresolved gates.

<!-- native-ground-family-region-followup-20261105 -->

The read-only selected-landmark observer records normal source selection,regionalDisplayRecord status,display dimensions and the existing canonical painter call without requesting additional loads or pixel readbacks. Four Region-only captures retain the glyph with a ready510×340display canvas;both desktop native LRU records are absent while display sprites remain visibly painted. The previous combined desktop counterexample is not reproduced and remains unresolved;neither a ready record nor a paint call alone proves complete final-pixel contribution. Four planned observations and four exact pan/reconnect maps were recorded. Raw complete:false is preserved because its inherited result predicate still expected eight views. Exact observations and scope ../art-direction/display-cache-history-20261104/arctic-region-body-20261105/analysis.json.

<!-- native-matte-contribution-20261105 -->

The preferred 1254×1254 ruin matte discards generated RGB and preserves every native original RGB value. Alpha uses a transparency guide, conservative opaque-core restoration, recovery of the original blue cloth silhouette and removal of 15 exterior border-connected alpha-1 specks. Native light/dark composites show no geometric terrain collar; full matching-tundra contact and role/state/context qualification remain pending. For the separate arctic glyph, controlled omission of its selected normal paint call changes 11,848/11,840 desktop and 11,946/11,939 phone composited pixels. Zero changes occur outside the entire projected source rectangle, and restoring the call reproduces every map pixel exactly. Four initial snapshots and pan/reconnect maps remain exact. A ready 510×340 display canvas can still paint after desktop native-LRU removal, but these cases do not establish the earlier missing-glyph cause or combined memory/performance acceptance. No public runtime change or source admission. Methods and exact findings.

Before publication, a full component audit removes 1,558 disconnected alpha-1-only specks; all 141,129 connected ruin/contact pixels and every original RGB value remain exact. The resulting alpha bounds are [314,412,915,832], rather than a nearly full-image speck domain.

<!-- ice-bastion-canonical-context-20261105 -->

Read-only canonical qualification scans all 2,252,800 default-world cells and retains exact native family hashes. Three natural tundra ruins and 55 arctic ruins exist; the private proposed existing-ruins contract remains tundra-only. Native alpha bounds [314,412,915,832] at 1254-square dimensions produce a 124.8-world-unit visible body from a 260-unit full-source width. Anchor [0.49,0.65] is proposed for courtyard/contact alignment. The published canonical matcher requires literal URL/permission equality, so the private candidate serves exact PNG bytes through a source alias with one temporary contract, preserving the published renderer. No public source copy or admission is made. A dependency-only initial server failure and its terminal evidence remain retained. A read-only browser selector diagnostic corrects the initial single-candidate sourceFor probe: the full private canonical pool accepts the candidate, but chooses the old cold round wall at cell 2027561. The other retained interior tundra ruin, 2035674, naturally chooses the new candidate. Source IDs, seed, biome, features and selector code remain unchanged. Four private normal desktop/phone Region/Hex views now visibly retain the ruin, with exact native HTTP bytes and complete projected subject bounds. Normal Region uses 512x512 preparation and differs from native isolated source replay by 31,692 desktop / 31,760 phone pixels, maximum channel difference 255. Hex uses the 1254x1254 native source and both isolated replays are exact. These comparisons are isolated source replays, not final-pixel attribution or proof of edge-only differences. The preferred detail and quiet-ground studies were not painted in these parent frames. Region fidelity and complete family/contact/occlusion/lifecycle/full-memory/performance acceptance remain pending. Methods and limits.

<!-- canonical-native-region-fidelity-20261105 -->

The preferred private canonical-place candidate checks current permission, then reuses a version/URL-keyed holder of the exact decoded HTML image before asking the original native cache to load again. Its complete native pixel area is charged against the existing 8,388,608-pixel/32 MiB display LRU; oversized images fall back to the existing native record. Eviction releases only the holder reference and does not mutate the shared artist image. The native-sized CPU-canvas candidate fails its first isolated replay by 31,134 pixels and is unselected. The holder matches eight current-state complete native-reference/restoration pairs. Controlled normal-paint omission contributes 30,799 desktop/30,901 phone pixels with zero outside-source changes. Actual 64-image native pressure evicts 35/54 records within 256/128 MiB logical native budgets; the complete map remains exact after target-record eviction and display clear/rebuild. These are separate from raw initial-versus-return differences, which remain unresolved. The production 512 control differs from native in all eight same-current-state comparisons; its own return differences are retained. The phone-only successful run has 2 views/3 lifecycle maps; inherited 4/6 descriptive header fields are an explicit erratum, not extra coverage. Generic qualification covers 40 sources/114 contracts; the full default-world scan finds 110 contexts and retains 4 absent contexts for alternate seeds. Cost measurement uses fresh browsers and no diagnostic pixel reads; emulated deviceMemory is not physical-device certification and sampled working sets are not unique physical memory. No production renderer/source permission or artist bytes change. Exact findings and limits.

<!-- canonical-native-regression-20261105 -->

The private direct-native candidate performs the existing permission checks and returns the existing native image record for canonical-place sources. It makes no intermediate raster, resize, crop or holder charge in the 32 MiB raster display LRU; other roles retain their previous preparation. Ten original sources complete 40 actual desktop/phone Region/Hex views and isolated native replays, plus 80 exact same-current-state complete-map native-reference/restoration pairs. The village, farm, desert city and courtyard castle all complete after the earlier holder policy failed their readiness. This proves the tested preparation fidelity and readiness, not broad performance or full source suitability. 21 of 60 raw return maps are exact; all remaining differences and current-pose comparisons stay explicit. The exact production pool remains 39 canonical sources / 322 permission records / 113 profile-feature contracts. The separate private candidate pool remains 40 / 323 / 114. All 39 existing descriptors, permissions and native hashes agree; 80 of 81 choice vectors are identical. Only tundra/ruins changes: the actual production pool selects cold-arch-v1 at 2035674, while the private pool selects the proposed matte. Fresh read-only occupancy/effective-state probes of all 509 retained candidate cells find 110 eligible production contexts and three natural absences (tundra floating stones, gabled town and drumkeep). The private pool has four absences including cold arch. Both full scopes remain explicit; selected-source equivalence does not establish complete-map production-pool equivalence. Continue the remaining contexts with the actual 39-source pool, including the original cold arch, and retain the private candidate separately. No public renderer, permissions, geometry, artist bytes or gameplay rules change. Exact results and limits.

<!-- canonical-village-native-cache-20261105 -->

The generic regression found a native-holder working-set failure at village-crescent-v1, WOG-A-003299, real cell 254896, phone width 390, emulated native budget 128 MiB and raster display budget 32 MiB. The holder run records 13,991 native evictions and never reaches a ready scene. Non-retaining metadata observers on the same already owned server verify that published 510×340 preparation settles after 19 evictions and direct original 1536×1024 input settles after 24, with the same source pool, source hash, camera and budgets. Timings are not a performance benchmark because another private cohort may be active. Native holders share the raster display cache; the evidence supports display-working-set contention but does not prove every underlying eviction path. Direct native preparation is the next qualification candidate. Keep the holder failure, unchanged native artwork, all 114 contracts and physical-device/full-memory/lifecycle gates explicit. Exact controls ../art-direction/canonical-native-regression-20261105/village-cache-controls/analysis.json.

<!-- canonical-production-native-qualification-20261105 -->

Actual-production-pool native qualification now contains thirteen source/profile contexts across eleven unchanged original files: ten default-seed contexts plus three naturally selected contexts in a single fresh alternate-seed04 disposable world. Exact production descriptors and 322 permission records remain unchanged; every frame records and asserts the runtime selector profile, source ID, cell and full 39-source pool. Fresh probes preserve the engine snapshot and check occupancy/effective terrain. All 52 normal desktop/phone Region/Hex frames and isolated source replays retain native inputs, and 104 current-state full-map native-reference/restoration pairs match. Raw initial-return comparisons remain separate (31/78 exact). The entire 113-contract production scope remains explicit: 13 contexts have this fidelity evidence and 100 still need normal checks. All 114 private declarations remain; the earlier private-pool maps are not silently transferred to actual-pool map coverage. Native boulder source bounds end 12.0143 screenshot pixels before the first blue phone-control pixel in the retained witness, rejecting an initial visual overlap suspicion; DOM shadows and other UI states remain unqualified. Full finite-contact/foundation/neighbor composition, lifecycle cause, complete renderer memory/performance and actual-device gates remain open. The continuation runner handles remaining unseen sources and every remaining profile contract without forcing a selection. No public renderer activation, artwork edit or source admission follows. Exact source and context findings.

<!-- canonical-native-followup-20261105 -->

Native source contract continuation

The November 5 followup checks ten additional source/profile contracts through the production pool and the original cold arch through the separate private alternate-world pool. Its 44 normal local Region/Hex desktop/phone views retain exact native inputs, with 88 exact current-state reference/restoration pairs. Raw initial-return equality passes only 26 of 66 comparisons; preserve all mismatches and camera/cache records. Actual production-pool fidelity coverage is 23 of 113 contracts; the 90-contract sequential run remains active and excluded from completed findings. These are local candidate checks and do not activate the renderer or certify final composited contribution, complete performance or physical devices. See the exact-source followup.

<!-- canonical-lifecycle-settled-analysis-20261105 -->

Retrospective native-map return analysis binds all 204 raw comparisons from 34 completed contexts to their stable initial and later stable PNG hashes. Counts are 78 raw/stable exact, 27 raw mismatches followed by exact stable initial maps, 34 stable differences with recorded pose/interaction changes and 65 unresolved differences at matching recorded visual pose. The 65 share captured scene-cache geometry and differ only in revision counters among those scalar fields; this does not prove every internal state or identify the differing layer. All original failures remain. Direct-native current-state reference parity uses the same original-image path and cannot independently certify selected-source contribution or full lifecycle/performance readiness. A bounded same-state temporal/compositing diagnostic follows the active default-world run; then repeat the complete applicable contract regression. Source-bound analysis.

<!-- keep-rubble-native-matte-20261105 -->

The keep-rubble finite-site study discards generated RGB and copies every native RGB sample from WOG-A-001710. Its alpha uses an aligned built-in imagegen guide plus an authored opaque protected-ruin region. Independent PNG/Sharp proof is exact;normal browser decode preserves all opaque RGB and protected RGBA.6339partial-alpha fringe readbacks differ,max14,and remain an explicit edge gate. The original and accepted historical1024lossy comparison remain retained. Candidate WOG-A-009285 has no source permission or active renderer binding. Its future finite ruin contract needs normal profile/scale/anchor/contact,state,lifecycle,cost and final-composite qualification. The static proof is separate from the active90canonical context run. Native proof and proposal scope.

<!-- keep-lodge-native-matte-20261105 -->

The keep-lodge finite-site study retains all1572516nativeRGBpixels and20863protected opaque site pixels. PNG/Sharp and normal browser checks preserve the protected subject exactly;1065partial-alpha RGB readback differences(max14) remain explicit. The source and mask are not resampled. This is an unadmitted finite scenery study with normal source/profile,contact,state,lifecycle and performance gates open;metadata availability does not establish world appearance. See study evidence.

A separate in-memory alpha-zero RGB normalization trial reduces prospective encoded transfer sizes from 3,127,867 to 679,031 bytes for the wall and from 3,382,458 to 85,440 bytes for the lodge. Normal HTMLImageElement and ImageBitmap readbacks match every native RGBA pixel exactly. Each still decodes to 6,290,064 bytes; no runtime file is installed and no normal-world or physical-device performance claim follows. See native delivery measurements.

<!-- woodland-edge-native-matte-20261105 -->

The woodland-edge study copies all 1,572,516 native RGB pixels exactly and protects 48,732 tree/rock/contact pixels at full opacity. Independent decoders and normal browser checks preserve the protected subject; 12,875 partial-alpha readback differences (maximum 14) remain explicit. No source or mask is resized. The finite cluster is unadmitted scenery, with normal forest/hills/grasslands source/profile, edge, contact, shadow, state, lifecycle and performance verification pending. See native evidence.

Two inherited WOG-A-009286 classifier labels are corrected to proposed-finite-service-lodge:keep-guardhouse and finite-service-lodge-native-matte-study. The lodge file, role, placement, source permissions, existing approval and all pending gates remain unchanged. Exact correction ../art-direction/woodland-edge-native-matte-20261105/lodge-classification-refinement.json.

Source library

Full design, implementation, architecture, map and art documents. These include historical and planned material. Search here matches document titles; use your browser’s Find within a source for its full text.

• World of Gonz — Game VisionGAME_VISION.md
• Unnamed adult cohort ledger — implementation designdocs/adult-cohort-ledger-plan.md
• AI factions — Server gameplay, architecture and cost policydocs/ai-factions-server-design.md
• Animal husbandry and physical transport implementation plandocs/animal-husbandry-transport-plan.md
• Canyon River native outlet colour repairdocs/art-direction/asset-continuation-20261103/canyon-review.md
• Native-export reconciliation and Sunken Shelf final colour repairdocs/art-direction/asset-continuation-20261103/review.md
• Native-ground local-context Atlas syncdocs/art-direction/atlas-context-20261019/release-review.md
• Art Atlas follow-up releasedocs/art-direction/atlas-followup-20261019/release-review.md
• Native bridge and route continuationdocs/art-direction/bridge-native-review-20261103/review.md
• Bridge Town V1: native water-colour studydocs/art-direction/bridge-town-water-native-20261104/review.md
• Raw and stable native-map return findingsdocs/art-direction/canonical-lifecycle-settled-analysis-20261105/review.md
• Original-native followup: ten production-pool contexts and one private alternate contextdocs/art-direction/canonical-native-followup-20261105/review.md
• Generic native-image regression across existing canonical placesdocs/art-direction/canonical-native-regression-20261105/review.md
• Retry of the verified Atlas release after a snapshot failuredocs/art-direction/canonical-production-native-qualification-20261105/failed-snapshot-4c8215bb/review.md
• Native qualification of actual production place sourcesdocs/art-direction/canonical-production-native-qualification-20261105/review.md
• Preserved coastal and town originalsdocs/art-direction/coasts-towns-native-20261103/review.md
• Complete illustrated-map goal — handoff specificationdocs/art-direction/complete-map-goal-handoff.md
• Complete illustrated-world goaldocs/art-direction/complete-map-goal.md
• Desert floating-stone native studydocs/art-direction/desert-floating-native-study-20261104/review.md
• Desert paving native detail studydocs/art-direction/desert-paving-native-study-20261104/review.md
• Adaptive native-cache fidelity and instrumented cost observationsdocs/art-direction/display-cache-history-20261104/adaptive-cost-20261104/recovered/review.md
• Arctic finite ground: domain and blend qualificationdocs/art-direction/display-cache-history-20261104/arctic-finite-ground-20261104/review.md
• Arctic finite ground: context outcome and remaining correctionsdocs/art-direction/display-cache-history-20261104/arctic-finite-ground-20261104/world-review.md
• Arctic foreground stability diagnosis — November 4, 2026docs/art-direction/display-cache-history-20261104/arctic-foreground-stability-20261104/review.md
• Arctic source-cache qualification — November 5, 2026docs/art-direction/display-cache-history-20261104/arctic-memory-qualification-20261105/review.md
• Native limestone canvas representation — November 5, 2026docs/art-direction/display-cache-history-20261104/arctic-native-canvas-20261105/review.md
• Native arctic domain study — November 4, 2026docs/art-direction/display-cache-history-20261104/arctic-native-domain-20261104/review.md
• Arctic raster attribution — November 5, 2026docs/art-direction/display-cache-history-20261104/arctic-native-inputs-20261105/review.md
• Owned native limestone preparation — November 5, 2026docs/art-direction/display-cache-history-20261104/arctic-owner-client-integration-20261105/review.md
• Complete natural selection inventory for admitted place sourcesdocs/art-direction/display-cache-history-20261104/canonical-place-context-matrix-20261104/review.md
• Fresh-browser cost-only counterpartdocs/art-direction/display-cache-history-20261104/clean-cost-20261104/review.md
• Place visibility diagnosis — November 4, 2026docs/art-direction/display-cache-history-20261104/context-visibility-20261104/review.md
• Complete declared context sampling and private canopy findingsdocs/art-direction/display-cache-history-20261104/context125-canopy-findings-20261104/review.md
• Ten additional normal profile contexts — batch eightdocs/art-direction/display-cache-history-20261104/eighth10-normal-context-20261104/review.md
• Fifth ten distinct normal-client source contextsdocs/art-direction/display-cache-history-20261104/fifth10-normal-context-20261104/review.md
• First ten normal place-source context reviewsdocs/art-direction/display-cache-history-20261104/first10-normal-context-20261104/review.md
• Fourth ten distinct normal-client source contextsdocs/art-direction/display-cache-history-20261104/fourth10-normal-context-20261104/review.md
• Private grassland and wetland grain comparisondocs/art-direction/display-cache-history-20261104/grass-wetland-grain-preview-v2-20261104/review.md
• Fine native ground with wider crop coveragedocs/art-direction/display-cache-history-20261104/ground-fine-wide-sampling-20261104/review.md
• Physical Hex pixel density without changing native artworkdocs/art-direction/display-cache-history-20261104/hex-physical-density-20261104/review.md
• Lake sampler experiment: retain the artwork, reject the patterned resultdocs/art-direction/display-cache-history-20261104/lake-sampler-coverage-20261104/review.md
• Lake study across natural shore biomesdocs/art-direction/display-cache-history-20261104/lake-shore-domain-20261104/review.md
• Native lake artwork: shorter isolated highlightsdocs/art-direction/display-cache-history-20261104/lake-short-wavelets-native-20261104/review.md
• Native lake study: actual context findingsdocs/art-direction/display-cache-history-20261104/lake-windpatch-native-20261104/context-review.md
• Irregular native lake wind-patch studydocs/art-direction/display-cache-history-20261104/lake-windpatch-native-20261104/review.md
• Preserved high-detail masonry: current native replaydocs/art-direction/display-cache-history-20261104/masonry-native-cold-replay-20261104/review.md
• Corrected display-fringe comparisondocs/art-direction/display-cache-history-20261104/mire-display-fringe-alpha-20261104/review.md
• Native finite Mire against finer wetland grounddocs/art-direction/display-cache-history-20261104/mire-fine-ground-contact-20261104/review.md
• Native edge repair: original retaineddocs/art-direction/display-cache-history-20261104/mire-native-edge-repair-20261104/review.md
• Rejected native-alpha-mask perimeter pathdocs/art-direction/display-cache-history-20261104/mire-perimeter-alpha-20261104/review.md
• Native rendering qualification and nonrepeating tundra artworkdocs/art-direction/display-cache-history-20261104/native-cpu-and-tundra-20261105/review.md
• Native tundra family and combined arctic qualificationdocs/art-direction/display-cache-history-20261104/native-ground-family-20261105/review.md
• Native ground performance follow-updocs/art-direction/display-cache-history-20261104/native-ground-fine-candidate-v2-20261104/performance-review.md
• Private native ground context calibrationdocs/art-direction/display-cache-history-20261104/native-ground-fine-candidate-v2-20261104/review.md
• Native terrain palette allocation paritydocs/art-direction/display-cache-history-20261104/native-ground-fixed-backing-20261104/palette-review.md
• Native ground fixed GPU backing previewdocs/art-direction/display-cache-history-20261104/native-ground-fixed-backing-20261104/review.md
• Native ground viewport and repetition diagnosticdocs/art-direction/display-cache-history-20261104/native-ground-viewport-20261104/review.md
• Native ruin matte and actual Region contributiondocs/art-direction/display-cache-history-20261104/native-matte-contribution-20261105/review.md
• Additional profile findings and two native desert studiesdocs/art-direction/display-cache-history-20261104/next10-and-desert-native-20261104/review.md
• Ten additional profile histories and private primary-ground findingsdocs/art-direction/display-cache-history-20261104/next10-ground-preview-20261104/review.md
• Twenty original reviews and native tower studydocs/art-direction/display-cache-history-20261104/next20-and-tower-native-20261104/review.md
• Twenty preserved source reviews and explicit ground rolesdocs/art-direction/display-cache-history-20261104/next20-ground-role-20261104/review.md
• Next twenty individual normal-context reviewsdocs/art-direction/display-cache-history-20261104/next20-normal-context-20261104/review.md
• Ninth ten default-seed profile-context reviewsdocs/art-direction/display-cache-history-20261104/ninth10-normal-context-20261104/review.md
• Measured phone UI coverage of native source pixelsdocs/art-direction/display-cache-history-20261104/phone-native-ui-coverage-20261104/review.md
• Phone native-art camera pan follow-updocs/art-direction/display-cache-history-20261104/phone-native-ui-pan-20261104/review.md
• Native body clearance: source-bound runtime candidatedocs/art-direction/display-cache-history-20261104/place-body-runtime-20261104/review.md
• Private foreground body-clearance refinementdocs/art-direction/display-cache-history-20261104/private-place-body-clearance-20261104/review.md
• Private decorative canopy-clearance studydocs/art-direction/display-cache-history-20261104/private-place-canopy-clearance-20261104/review.md
• Ninety default-seed contexts and four alternate-seed role samplesdocs/art-direction/display-cache-history-20261104/profile94-findings-20261104/review.md
• Final twenty-one eligible default-seed contract reviewsdocs/art-direction/display-cache-history-20261104/remaining21-normal-context-20261104/review.md
• Local portrait sampling depends on cache historydocs/art-direction/display-cache-history-20261104/review.md
• Second ten normal place-source context reviewsdocs/art-direction/display-cache-history-20261104/second10-normal-context-20261104/review.md
• Ten further normal profile contextsdocs/art-direction/display-cache-history-20261104/seventh10-normal-context-20261104/review.md
• Ten additional normal profile contextsdocs/art-direction/display-cache-history-20261104/sixth10-normal-context-20261104/review.md
• Tenth ten default-seed profile-context reviewsdocs/art-direction/display-cache-history-20261104/tenth10-normal-context-20261104/review.md
• Third ten normal place-source context reviewsdocs/art-direction/display-cache-history-20261104/third10-normal-context-20261104/review.md
• Four naturally selected alternate-seed tundra reviewsdocs/art-direction/display-cache-history-20261104/unselected-short-qa-seed-search-20261104/review.md
• Actual visible-map and default-budget pressure qualificationdocs/art-direction/display-cache-history-20261104/visible-pressure-v2/review.md
• Native wetland bank and recovery checksdocs/art-direction/display-cache-history-20261104/wetland-bank-sampling-20261104/review.md
• Final asset outputs and storage retention — November 2, 2026docs/art-direction/final-asset-release-20261102/final-output-review.md
• Final initial native reviews — November 3, 2026docs/art-direction/final-initial-native-20261103/review.md
• Native alpha delivery without visible artwork lossdocs/art-direction/finite-native-alpha-delivery-20261105/review.md
• Golden Veld fine-grain continuationdocs/art-direction/golden-veld-fine-grain-20261103/review.md
• Native ground-role qualificationdocs/art-direction/ground-candidate-qualification-20261103/review.md
• Finite native tundra ruin: canonical context qualificationdocs/art-direction/ice-bastion-canonical-context-20261105/review.md
• Ice Bastion nonrepeating tundra studydocs/art-direction/ice-bastion-nonrepeating-20261105/review.md
• Native Region fidelity: exact image retention under qualificationdocs/art-direction/ice-bastion-region-native-fidelity-20261105/review.md
• Ice Bastion family placement auditdocs/art-direction/ice-bastion-role-20261105/review.md
• Illustrated Atlas v1docs/art-direction/illustrated-atlas-v1.md
• Illustrated Atlas v2 — production specificationdocs/art-direction/illustrated-atlas-v2-production-spec.md
• Original-RGB finite keep service-lodge studydocs/art-direction/keep-lodge-native-matte-20261105/review.md
• Original-RGB finite ruined-wall studydocs/art-direction/keep-rubble-native-matte-20261105/review.md
• Landmark blending review — October 10, 2026docs/art-direction/landmark-blending-review-20261010.md
• Mana Spring desert companion reviewdocs/art-direction/mana-spring-desert-companion-review.md
• Native Oasis palm-gap cleanupdocs/art-direction/masked-oasis-trace-20261020/review.md
• Two original-preserving native repair candidatesdocs/art-direction/masked-palm-pilgrim-20261020/release-review.md
• Palm and Pilgrim native localized repairsdocs/art-direction/masked-palm-pilgrim-20261020/review.md
• Two original-preserving smoke candidatesdocs/art-direction/masked-river-village-20261020/release-review.md
• Native River Village smoke correctionsdocs/art-direction/masked-river-village-20261020/review.md
• One original-preserving palm-gap candidatedocs/art-direction/masked-ruined-oasis-20261020/release-review.md
• Native Ruined Oasis palm-gap repairdocs/art-direction/masked-ruined-oasis-20261020/review.md
• Original-preserving masked smoke repair releasedocs/art-direction/masked-smoke-repair-20261020/release-review.md
• Original-preserving monastery smoke repairdocs/art-direction/masked-smoke-repair-20261020/review.md
• Native turtle upper-leaf correction and roof-preservation findingdocs/art-direction/masked-turtle-leaf-20261020/release-review.md
• Turtle Sanctuary upper-leaf cleanup:three rejected local draftsdocs/art-direction/masked-turtle-leaf-20261020/review.md
• Original-preserving vineyard exterior-gray correctiondocs/art-direction/masked-vineyard-gray-20261020/release-review.md
• Original-preserving vineyard exterior-gray mask studydocs/art-direction/masked-vineyard-gray-20261020/review.md
• Original-preserving volcanic smoke repairsdocs/art-direction/masked-volcanic-smoke-20261020/review.md
• Normal biome material observationsdocs/art-direction/material-crop-coverage-20261103/all-biome-world/review.md
• Private irregular material boundariesdocs/art-direction/material-crop-coverage-20261103/irregular-world/review.md
• Private native-material crop coverage investigationdocs/art-direction/material-crop-coverage-20261103/review.md
• Eight original-preserving native repairsdocs/art-direction/native-boundary-batch-20261020/release-review.md
• Six original-preserving native smoke-color repairsdocs/art-direction/native-plume-batch-20261020/release-review.md
• Five native color and matte repair proposalsdocs/art-direction/native-repairs-20261019/release-review.md
• Reviewable rejected-proposal Atlas publicationdocs/art-direction/native-smoke-repair-20261020/release-review.md
• Monastery smoke repair: rejected broad-edit outputdocs/art-direction/native-smoke-repair-20261020/review.md
• Two original-preserving native plume repairsdocs/art-direction/native-sulfur-smoke-20261020/release-review.md
• Sulfur Springs v4:two rejected native plume studiesdocs/art-direction/native-sulfur-smoke-20261020/review.md
• Two original-preserving native plume repairsdocs/art-direction/native-sulfur-v5-smoke-20261020/release-review.md
• Local readiness continuation — 19 October 2026docs/art-direction/readiness-continuation-20261019/review.md
• release-review.mddocs/art-direction/readiness-eighth100-20261020/release-review.md
• Following 100 native reviews and cavern alpha-repair proposaldocs/art-direction/readiness-following100-20261019/release-review.md
• Reviewable Art Atlas publicationdocs/art-direction/readiness-following25-20261020/release-review.md
• review.mddocs/art-direction/readiness-following25-20261020/review.md
• Next 100 originals: Ice Cave through Mangrove Coastdocs/art-direction/readiness-fourth100-20261019/review.md
• Reviewable mountain-source Atlas publicationdocs/art-direction/readiness-mountain25-20261020/release-review.md
• review.mddocs/art-direction/readiness-mountain25-20261020/review.md
• Next 100 native asset reviewsdocs/art-direction/readiness-next100-20261019/release-review.md
• Reviewable Atlas publicationdocs/art-direction/readiness-next25-20261020/release-review.md
• review.mddocs/art-direction/readiness-next25-20261020/review.md
• Next500 progress:165 sources and15 native candidatesdocs/art-direction/readiness-next500-20261021/release-first165/release-review.md
• Next 500: 100 further observations and five native comparisonsdocs/art-direction/readiness-next500-20261021/release-next100/release-review.md
• Next 500: remaining 235 findings and four finite ground comparisonsdocs/art-direction/readiness-next500-20261021/release-remaining235/release-review.md
• Next 500: ten further finite ground comparisonsdocs/art-direction/readiness-next500-20261021/release-ten-grounds/release-review.md
• release-review.mddocs/art-direction/readiness-ninth100-20261020/release-review.md
• release-review.mddocs/art-direction/readiness-seventh100-20261020/release-review.md
• review.mddocs/art-direction/readiness-seventh100-20261020/review.md
• release-review.mddocs/art-direction/readiness-sixth100-20261020/release-review.md
• review.mddocs/art-direction/readiness-sixth100-20261020/review.md
• release-review.mddocs/art-direction/readiness-tenth100-20261020/release-review.md
• Next 100 original paintingsdocs/art-direction/readiness-third100-20261019/review.md
• release-review.mddocs/art-direction/readiness-wetland-prairie25-20261020/release-review.md
• Wetland,prairie and volcanic native reviewdocs/art-direction/readiness-wetland-prairie25-20261020/review.md
• Remaining volcanic native reviews — November 3, 2026docs/art-direction/remaining-volcanic-native-20261103/review.md
• Remaining wetland native reviews — November 3, 2026docs/art-direction/remaining-wetlands-native-20261103/review.md
• Native River Village world-context reviewdocs/art-direction/river-village-context-20261020/review.md
• Native ruin reviews and preserved aqueduct transparencydocs/art-direction/ruin-native-review-20261103/review.md
• Preserved ruin/outpost originals and observatory repairdocs/art-direction/ruins-outposts-native-20261103/review.md
• Preserved rural and shallow-sea originals, smoke study and material scenesdocs/art-direction/rural-sea-native-20261103/review.md
• Preserved rural originals, smoke-colour study and biome scenesdocs/art-direction/rural-settlements-native-20261103/review.md
• Canonical mask scheduling studydocs/art-direction/scene-phase-20261019/review.md
• Scenes 314 — locked art-direction reviewdocs/art-direction/scenes-314-style-lock-review.md
• Preserved shallow-sea originals and water-colour studydocs/art-direction/sea-coast-native-20261103/review.md
• September 8 course-correction review queuedocs/art-direction/september-8-course-correction-review.md
• Forest tower native style study — November 4, 2026docs/art-direction/tower-native-style-20261104/review.md
• Preserved town originals, bounded smoke studies and wetland diagnosticdocs/art-direction/towns-native-20261103/review.md
• Individual port, university, walled-town and volcanic findingsdocs/art-direction/towns-volcanic-native-20261103/review.md
• Walled Town roof:preserve the original while material intent is unresolveddocs/art-direction/walled-town-roof-inspection-20261020/review.md
• Wetland full-sequence paint trace — November 3, 2026docs/art-direction/wetland-fine-grain-calibration-20261103/reload-full-trace/review.md
• Wetland base-paint reload trace — November 3, 2026docs/art-direction/wetland-fine-grain-calibration-20261103/reload-trace/review.md
• Private wetland ground-scale calibrationdocs/art-direction/wetland-fine-grain-calibration-20261103/review.md
• Separate wetland ground painting studydocs/art-direction/wetland-native-study-20261103/review.md
• Original-RGB finite woodland-edge studydocs/art-direction/woodland-edge-native-matte-20261105/review.md
• Every library asset game readydocs/asset-library-readiness-goal.md
• Asset identification and purposedocs/asset-metadata.md
• Neighbour Houses — Computer-controlled playersdocs/computer-controlled-players.md
• Gameplay design verification — 9 September 2026docs/gameplay-design-verification.md
• World of Gonz — Gameplay foundations and progression plandocs/gameplay-foundations-plan.md
• Gameplay implementation statusdocs/gameplay-implementation-status.md
• World of Gonz — Gameplay Interfacedocs/gameplay-interface.md
• First integrated gameplay journeydocs/integrated-gameplay-walkthrough.md
• World of Gonz — Living World Designdocs/living-world-design.md
• Major factions — The powers beyond the neighboursdocs/major-factions.md
• Major watershed works delivery plandocs/major-waterworks-plan.md
• World of Gonz — MMO gameplay designdocs/mmo-gameplay-design.md
• World of Gonz — gameplay screens and interaction specificationdocs/mmo-ui-screens.md
• Multiplayer architecture and operationsdocs/multiplayer-architecture.md
• Off-channel reservoir implementation checklistdocs/off-channel-reservoir-plan.md
• Restore production gallery backdrop controldocs/operations/gallery-backdrop-20261104/review.md
• WorldOfGonz Railway release operationsdocs/operations/railway-releases.md
• Continuous evolving regions — one-week goaldocs/regional-composition-goal.md
• Complete regional landscapes — visual goal reopeneddocs/regional-world-completion-goal.md
• Startup performance — September 20, 2026docs/startup-performance-20260920.md
• Mutable terrain and the building librarydocs/terrain-and-buildings.md
• Three-scale map designdocs/three-scale-map-design.md
• World of Gonz — Version 1docs/version-1-release-notes.md
• Version 1 release plandocs/version-1-release-plan.md
• Version 2 implementation plandocs/version-2-plan.md
• One-world scale — Stack recommendation and capacity assessmentdocs/world-scale-architecture.md