| **Placed room instance** | One actual playable room with a stable identity across shifts | Current neighbours, orientation, transient power/population, and durable internal work. A shift changes arrangement, not identity. |
| **Arrangement generation** | The current post-death arrangement plus stable identities for every older generation still referenced by evidence | Not a map reveal. It dates observations and prevents applying one death twice. |
| **Threshold face and selected join** | The two specific placed faces and a stable join identity; whether the persistent latch exists | Walking connection, mechanical latch, and diagnostic power remain separate. Unbound adjacency is transient. |
-
| **Mechanism instance and checkpoint** | The placed machine, each named completed stage, deliberate mode/disable state, and reset rule | Current animation/timer/charge and enemy occupancy are transient unless that machine explicitly commits them. |
-
| **Object instance** | One reusable part, canister, objective item, or loot object with one definition and exactly one current location/state | Astronaut-carried property contains active rig equipment and inactive/loose cargo as distinct substates, each counted once. Station/ship fixture, deposit/recipient, world source, and consumed are outside that set and mutually exclusive with it. “Collected” is a past event, not a current location. Fill, stored charge, and rig links belong to the same instance. |
-
| **Astronaut expedition state** | Current place, carried manifest—including every active rig part and inactive/loose cargo item once—rig arrangement, suit oxygen, condition, and active life/expedition identity | Ship oxygen supply is unlimited, but gas already breathed remains spent. Moving a carried part between rig and inactive cargo changes operation, not return membership or carrying count. Ordinary condition restoration aboard does not refill canisters or reset parts. |
+
| **Mechanism instance and checkpoint** | The placed machine, each named completed stage, deliberate mode/disable state, and reset rule. Local commits include R26 selector/final detent separately from current diagnostic power; collar buffer/latch/clear; and bench vessel secure/clamp plus each exact fill increment. | Current animation/timer and enemy occupancy are transient unless that machine explicitly commits them. An R26 mode can commit without a powered pulse; R33's A→R behavior is fixed, while current pulse result still depends on power/input. |
+
| **Object instance** | One reusable part, canister, objective item, or loot object with one definition and exactly one current location/state | Astronaut-carried property contains active rig equipment and inactive/loose cargo as distinct substates, each counted once. Station/ship fixture, deposit/recipient, world source, and consumed are outside that set and mutually exclusive with it. “Collected” is a past event, not a current location. Exact canister O, exact Capacitor U, rig links, Fork output order and any home-fixture seat belong to the same instance. |
+
| **Astronaut expedition state** | Current place, carried manifest—including every active rig part and inactive/loose cargo item once—rig arrangement, exact suit O, condition, and active life/expedition identity | Ship oxygen supply is unlimited, but gas already breathed remains spent. Moving a carried part between rig and inactive cargo changes operation, not return membership or carrying count. Ordinary condition restoration aboard does not refill canisters or decide stored-charge behavior. |
| **Evidence record** | One committed capture, note revision, testimony, or instrument report with provenance, room instance, arrangement/life, and factual limit | Record existence, player annotation, attributed interpretation, and present truth. A historical mark never becomes current automatically. |
| **Survivor** | One authored person, last confirmed transfer state and source, and—once resolved—their actual location/state | Never cargo. Waiting, Prepared, In transfer, At abort refuge, and Sent are not interchangeable. Sent commits only when this same survivor has completed arrival aboard and the required ship airlock is closed; confirmation provenance remains separate from world state. |
| **Population/transient hazard state** | Exact state needed to suspend a live expedition | Not durable clearance beyond its owning encounter rule. Later population may differ without replacing earned world work. |
-
Every transition names the identity it mutates, its precondition, the point at which it commits, and what an interruption preserves. A collectible changes from source to carried in one commit; it is never copied and then deleted later. Incremental oxygen transfer is the exception in granularity, not conservation: each committed increment moves gas between the same two object states.
+
Every transition names the identity it mutates, its precondition, the point at which it commits, and what an interruption preserves. A collectible changes from source to carried in one commit; it is never copied and then deleted later. Incremental oxygen transfer is the exception in granularity, not conservation: each committed increment moves exact O between the same two object states, stops at suit 12 O or vessel 0 O, and leaves untransferred gas in place. Capacitor acceptance/release likewise records exact U and whether the first receiver accepted; later refusal cannot reverse a committed 2 U release.
## Provisional save and resume policy
@@ 42,7 42,7 @@
A lethal condition and a unique death-transaction identity are committed together. There is no saveable gap in which the astronaut is lethally dead but the transition does not exist.
1. **Seal the death instant.** Commit gas actually transferred or breathed, material already consumed, completed pickups/drops/installs and completed work checkpoints. Mark the current incomplete stage interrupted; do not complete it.
-
2. **Partition property once.** Snapshot the astronaut-carried membership by object identity: every active rig part plus every inactive/loose cargo item, each once. Move those same instances aboard, preserving rig-versus-cargo substate. Leave station/ship-fixture installations, deposits, handovers, world-source objects, and consumed resources outside the return set in their actual states. For example, an active Sensor and Projector, an inactive loose Fork, and a carried partial canister return once each; a different Fork in a station fixture and scrap already consumed by a Cycler do not. Restore ordinary condition for the next expedition under the current rule; ship-side refilling remains separate. **The property-first order here is preserved by the accepted candidate**, and the playable astronaut body has one location: it is aboard after this step, leaving no second lootable body at the death site. The sealed membership cannot change during the rest of the transaction, and the player receives no control aboard until the final step.
+
2. **Partition property once.** Snapshot the astronaut-carried membership by object identity: every active rig part plus every inactive/loose cargo item, each once. Move those same instances aboard, preserving rig-versus-cargo substate and each canister's exact O. Leave station/ship-fixture installations, deposits, handovers, world-source objects, and consumed resources outside the return set in their actual states. For example, an active Sensor and Projector, an inactive loose Fork, and a carried partial canister return once each; a different Fork in a station fixture and scrap already consumed by a Cycler do not. Restore ordinary condition for the next expedition under the current rule; ship-side refilling remains separate. **Retained Capacitor charge across death is unresolved:** this transaction must preserve the sealed exact pre-death U as state needed for the eventual decision, but it must not silently keep or clear that charge in the playable aboard result. **The property-first order here is preserved by the accepted candidate**, and the playable astronaut body has one location: it is aboard after this step, leaving no second lootable body at the death site. The sealed membership cannot change during the rest of the transaction, and the player receives no control aboard until the final step.
3. **Resolve the survivor branch before geometry moves.** A person already Sent remains aboard; Waiting and Prepared people do not depart. If death occurs during transfer, the accepted **conditional** candidate in [Death Shift and Rescue Continuity](/Hold%20The%20Flood/Death%20Shift%20And%20Rescue%20Continuity) resolves it here, before the shift: an eligible survivor runs the retreat line already armed at Prepared, inside a bounded window in which creatures and hazards cannot act on or block them, needing no new astronaut action or resource, and the world state **at abort refuge, alive, unsent** commits. A person inside an **unclosed** ship airlock is not Sent; they cycle stationward on their own reserved margin and do not close the airlock themselves to finish the delivery. That safeguard is pending owner reaction — if it is not selected, this step returns to recording last confirmed state with the outcome unresolved rather than inventing one. **Either way the astronaut's knowledge is unchanged:** no result is transmitted aboard, so persistence must store the world outcome and the astronaut's unconfirmed knowledge as separate facts.
4. **Shift exactly once.** Advance the arrangement generation once. Preserve selected joins and their bound groups, stable room identities, completed mechanism/checkpoint states, and objects attached to their room/fixture identities. Recompute only the unbound arrangement under the eventual shift rules. Do not use a rescue or installed object as an unchosen joining exception.
5. **Reclassify knowledge.** Retain records and notes. Mark prior-life route and adjacency claims historical; keep completed work and join facts known. Reveal only what can currently be sensed from the ship/airlock or another valid instrument.
@@ 68,6 68,7 @@
- For every action, an explicit precondition, commit boundary, interruption result, persistence class, and owning article/rule. Temporary state must name its reset boundary; persistent state must name any deliberate reversal.
- Placement constraints for required entrances, compatible faces, control access from the necessary sides, safe recovery from reversible mistakes, mechanism clearance, short-rescue geometry, and objects attached to stable room/fixture identities. A constraint declaration is not proof that all generated arrangements satisfy it.
- Explicit allowed destinations for each object and survivor transition. Collection, installation, consumption, deposit, handover, and return must conserve one instance. Critical controls cannot be authored only on a side made unreachable by their own persistent state.
+
- Exact proposed mechanical amounts and local commits from [Mechanical Interfaces And Opening Quantities](/Hold%20The%20Flood/Mechanical%20Interfaces%20And%20Opening%20Quantities): suit/canister O, Capacitor U, Fork output order/allocation result, designated launch reservation/one execution, collar buffer/latch/clear, bench secure/clamp/fill, R26 selector/detent/power and R33 fixed A→R/current power. Recording these facts does not select their tuning or decide retained charge across death.
- Separate author facts from discoverable facts and player records. A condition may test real state, but its presentation may expose only authorized observation, testimony, or instrument output.
- Content version and compatibility requirements. Removed or changed content needs an authored compatibility/migration decision later. An unknown identity, invalid reference, impossible placement, or contradictory lifecycle must produce an inspectable authoring/load error; it must not silently substitute a similarly named room, drop an item, reset a checkpoint, or invent a survivor result.
