**Status.** Conditional first-pass design proposal. It joins the current persistence, shifting-station, short-rescue and whole-station-connection proposals into one inspectable rule set. It does **not** answer any of the five pending owner questions named below. The protected retreat and rigid-network finish below are explicit candidate branches, not existing owner decisions, physical proofs or implementation specifications; population behavior and post-Sent mortality also remain design gaps.

| [Death And Persistence](/Hold%20The%20Flood/Death%20And%20Persistence) / [Shifting Station Options](/Hold%20The%20Flood/Shifting%20Station%20Options) | `8aa0e9585db2855f0411d60ea5c6c77b4881421e6be5fc118dfe476d3ef7d806` / `42f3351796b51e31675d147e3b422efdf7d4ebb21991257aab5950b5d64fda64` |

| [First Expedition Options](/Hold%20The%20Flood/First%20Expedition%20Options) / [Player Information](/Hold%20The%20Flood/Player%20Information) | `31a922142d0632efb43fe4c2641678339c996d7baf02ef20d5ab5fde58510fea` / `34f8d4a0c198e1250e08f2e2dc5fd314a5084b36bb6677e2cc566e75117474fd` |

| [Mechanical Interfaces And Opening Quantities](/Hold%20The%20Flood/Mechanical%20Interfaces%20And%20Opening%20Quantities) | `2e604fc2f31cf044237ae622658a110f34f2d40f4793f9f1bba455ef6c21697e` |

A placed room, threshold face, compact apparatus, persistent join, object, mechanism, evidence record and person keeps one stable identity. At death, all completed acts and actual locations seal; every still-carried astronaut object returns once; an eligible in-transfer survivor performs only a pre-prepared autonomous retreat to the named refuge during a bounded hostile-free transaction window; then unanchored rigid groups change only their unbound adjacency/orientation while the R01 ship-rooted group remains fixed. The old route becomes historical. Living return changes no adjacency and does not replace defeated enemies. A wrong join stays walkable and can be released from a reachable network-side control. Under the pending stabilization branch, physically latching every reachable R01–R40 room into the ship-rooted group ends rearrangement; optional diagnostics and story choices neither complete nor block that physical result.

| **Placed room and face** | R01–R40 and each named face retain identity, internal fixtures, completed work and attached objects. R01 Dock Mouth remains directly outside the ship airlock; its outer unbound face may gain a different neighbour after death. Other unbound faces may gain a different neighbour/orientation. | A current observation proves only the present arrangement. An older route remains dated evidence, not present access. |

| **Rigid group** | Rooms linked by persistent latches, plus each authored compact assembly, preserve one internal pose. An unanchored group may translate and rotate only as a whole; it may not reflect. The ship-rooted group containing R01 is anchored to the ship and neither translates nor rotates. Internal distances, passages, handedness and hard control conduits do not stretch, swap ends or teleport. | A walked internal path remains physically valid unless its own persistent door/iris state blocks it. External breadcrumbs may become historical. |

| **Body and survivor** | After the transaction the playable astronaut body is aboard; no second lootable astronaut body remains at the death site. This is continuity accounting, not an answer to revival metaphysics. Each survivor has one actual location/state and moves only by a named physical transition. | A witnessed arrival plus closed ship airlock proves Sent. A plan, radio promise or old location does not. |

- current accessibility through those new unbound relations;

3. **Resolve the survivor branch before geometry moves.** Waiting or Prepared people do not depart. A person already Sent remains aboard. Under the candidate safeguard below, an eligible person In transfer executes the already armed autonomous retreat to the named abort refuge; no new astronaut action, combat clear, door unlock, power routing or resource appears. From the lethal seal until the abort door closes, creatures and active encounter hazards are frozen and cannot act, pursue, collide with, damage, tether, displace or physically block the retreating survivor. Their last old-expedition state is otherwise unchanged until step 4, and no player action can use this window. The resulting **At abort refuge, alive, unsent** world state commits. If this protection or the other eligibility conditions were not armed, transfer could not have begun under this candidate.

5. **Shift once.** Keep the R01 ship-rooted group anchored and place each unanchored room or rigid group into one valid changed arrangement while preserving every persistent seam and compact boundary. A survivor at R12, for example, moves with R12's actual group unless that group is already ship-rooted; the person is not moved independently to a convenient new refuge. Then select one finite authored population list for the new arrangement. It may be a different disclosed variant, such as E03's later death-shift Presser state, but never a punitive extra wave reacting to a successful build. Stable rewards, part sources and spent inputs do not regenerate with it.

| **Prepared** | This life, the astronaut has personally walked ship→at most one exposed junction→counted abort refuge→survivor refuge; checked both-side controls; handed over travel air and received survivor flow confirmation; stocked the abort refuge; made the current encounter quiet; and armed a retreat path the survivor can operate without the astronaut. The travel canister must also read at or above that authored route's fixed **full-attempt return mark**: enough for the outward attempt plus the longest return from any committed segment, including the ship airlock before closure. The survivor confirms suit flow; the local preparation gauge confirms the marked fill. An under-supplied movement request refuses before the refuge door opens. Death before departure leaves the person in the original refuge. The shift invalidates the route check, so the state returns to **Waiting**, with committed supplies noted at their actual locations and no refund. |

A full-attempt return mark is authored only for that accepted short route and read against the actual handed-over canister; it does not calculate an unseen route, predict combat delay or validate numerical balance. If the route changes after death, the old mark and preparation are not current eligibility.

The safeguard's cost is real: each rescue variant needs an autonomous retreat line from every committed segment, two-sided or survivor-side controls, a locally marked full-attempt return margin, a separately stocked counted refuge, a local closure tell and a quiet precondition that remains valid long enough to arm the line. More consequentially, the visible creatures or hazards that may have just killed the astronaut are frozen and nonblocking for this survivor's bounded retreat. That is an artificial protection convention and can reduce rescue danger; it is the exact new tradeoff being proposed to the owner, not an implication of the quiet-window rule. Pressure can still force a living abort, spend supplies or delay departure before death commits, but cannot harm or obstruct this already-armed retreat during the transaction.

2. Preserve every persistent face-to-face latch and all fixed interior paths/control conduits. Do not reflect, stretch, reorder or overlap a rigid group. Unanchored groups may translate and rotate as units; the R01 ship-rooted group stays fixed in position and orientation, so a shift changes which unbound group meets its free outer frontier rather than which room touches the airlock.

At R03, the isolation bridge has been released and is carried; the one Fork is installed in R02's board; two fasteners and P01's alarm cut are committed; a Cycler sample spent earlier at R23 is already consumed. Death seals those facts. The bridge and other carried rig/cargo return once with the astronaut. Fork stays installed in R02, the sample stays spent, and the fasteners/alarm cut persist. R02–R03 move together with their throat and conduit intact; only their unbound external neighbours may change. The old R01→R02 route becomes historical. Revival still opens onto R01 Dock Mouth; crossing to its outer threshold reveals the new frontier room. A new finite placement-1 population may be selected for the new arrangement, but it cannot restore the sample, bridge source or completed work.

The current route R01→R11→R12→R13 has been walked; R12 is stocked; the R13 occupant has flow-confirmed travel air at or above the route's full-attempt return mark. If the astronaut dies **before** the refuge door opens, the survivor stays at R13. R12's reserve and the handed-over canister stay placed; after the shift, Prepared becomes **Waiting**, with those committed supplies still noted, because the route check is historical.

If death occurs after departure in R11, the candidate safeguard freezes hostile action/contact, spends the reserved return margin and lets the survivor operate the return controls into R12 before the shift. R12 then moves with its actual group; world truth is alive, unsent, at R12, while the astronaut aboard knows only the last witnessed state and armed plan. If death occurs while the survivor is inside the ship airlock but before closure, the result is the same: no Sent flag, no postmortem closure, actual retreat to R12 through the pre-armed return. The local R12 control/occupant confirms that result only when revisited. If the airlock closes first, Sent commits and later death leaves the person aboard. An ordinary living abort to R12 causes none of these shifts.

| **Save And Content State — death transaction steps 2–3; walkthrough 5; population/open decisions** | Keep its property-first partition/return after the sealed snapshot, then resolve the conditional retreat before geometry moves. Replace “unconfirmed” only as world outcome while retaining unconfirmed astronaut knowledge aboard; add the final-airlock case, playable-body single location, death-shift population boundary and living-return no-replacement rule. Preserve save-policy alternatives. |

| **Shifting Station Options — status/shared example; Option 3; old recommendation** | Preserve the three-option comparison as history, but do not carry forward its compact-rescue reconnection to a marked shipward collar. Align the current candidate with owner-selected persistent groups and label the old Option-2 recommendation historical rather than current direction. |

| **First Expedition Options — “First natural death,” item 2** | Keep R01 Dock Mouth directly outside the airlock and move the recognisably different-room reveal to R01's outer unbound face or, if already joined, the nearest free frontier of the fixed ship-rooted group. Preserve the opening-specific readable opportunity without promising a useful later face. |

| **Station Room And Module Inventory — counting/compact boundary and rescue-host access rows** | Add anchored-R01/unanchored-group placement language and the autonomous return/local-tell clearance obligation without changing 24 modules/40 rooms or turning a refuge door into a join face. |

| **5 rescue identities / 7 mutually exclusive host variants / 15 cast scenes** | Reuses R06, R12, R24 and R27 as the counted abort rooms already allocated. Each eligible host variant gains an autonomous-return clearance, fixed full-attempt return mark and one locally observed closure tell using its existing door/control apparatus. | **No new person, scene, refuge or room claimed.** The margin/tell presentation is real additional authoring, not free reuse. |

**Accepted costs.** Rigid groups reduce shuffle freedom with every join and can make valid arrangements increasingly difficult. Anchoring the growing R01 group reduces it further. A death-shift population refresh can incentivize or punish deliberate death unless rewards and encounter variants are authored carefully. Protected retreat adds fixed controls, full-attempt air margins, local closure tells and an explicit hostile-free/nonblocking transaction window, lowering danger at the exact moment the astronaut dies. The 40/40 roster reveals the existence/count of hidden rooms. None of these costs is shown to be fun, clear, balanced, feasible or sufficient for long-form pacing.

**Unresolved owner choices.** The PM reports exactly five owner questions still unanswered; this proposal does not convert, renumber or answer them: (1) whether full physical connection stabilizes the station; (2) whether Yeva or Aster is first; (3) working-part discovery versus fabrication; (4) apparent credits continuing before departure versus a permanent save ending; and (5) protected alive/unsent rescue retreat before the shift versus concrete injury/loss stakes or the bind-first alternative. Post-Sent mortality and whether the proposed living-return population rule is adopted remain article-level design gaps, not newly numbered owner questions. Story/core, diagnostics and acquisition choices do not repair or gate this continuity rule.

**Specific later discrimination.** In a later owner-authorized phase, validate—not assume—whether players can predict carried versus installed return across a death; distinguish current unbound passage, persistent seam and diagnostic signal; find a network-side release after a shift; understand the full-attempt return mark; and, on revisiting the local refuge, understand why an unclosed-airlock survivor is unsent but alive there. Compare the protected hostile-free retreat with bind-first or explicit-danger variants for perceived stakes, and observe tolerance for several deaths without a useful face. Static authoring checks should first enumerate identities, faces, rigid groups, recovery sides and each admitted arrangement for duplicates, broken compact paths, buried releases and unreachable R01–R40 interiors. Only later implementation and consenting-player observation could test comprehension, tension, farming behavior, rescue emotion, performance or pacing.

**Self-check.** The proposal seals the lethal instant and performs the property-first carried return before survivor resolution; conserves one instance of every object; leaves spent inputs spent; and preserves completed work. Its pending safeguard permits only an already armed retreat, freezes harmful hostile action/contact through abort-door closure, requires the survivor-confirmed and locally gauged full-attempt return margin, refuses an under-supplied departure, and leaves outcome proof local and astronaut knowledge aboard unconfirmed. A pre-completion death anchors the R01 ship-rooted group, translates/rotates only unanchored groups without reflection, and shifts once; living return never shifts. R01 Dock Mouth remains fixed outside the airlock and the changed-room reveal occurs at the fixed group's free outer frontier. The proposal keeps Sent's full predicate; separates world truth from proof and historical routes from current access; preserves R02–R03/R36–R40; gives wrong joins a reachable release; keeps physical completion independent of diagnostics/story; includes every actual R01–R40 room; changes none of the established content counts; promises no particular next face; and labels both protection and stabilization conditional. It provides no full arrangement proof, implementation, simulation, asset, playtest or answer to any of the five owner questions.