**Status.** Conditional first-pass design proposal. It joins the current persistence, shifting-station, short-rescue and whole-station-connection proposals into one inspectable rule set. It does **not** select the owner's pending preferences about survivor danger, full-station stabilization, saves, first survivor, population behavior or later mortality. The protected retreat and rigid-network finish below are explicit candidate branches, not existing owner decisions, physical proofs or implementation specifications.

| Current source read | SHA-256 |

|---|---|

| [Owner Brief](/Hold%20The%20Flood/Brief) | `4b0a3bcbc339029c682b287c1ea25ee2f721066f68d8b27774874e8cd15808e4` |

| [Save And Content State](/Hold%20The%20Flood/Save%20And%20Content%20State) | `438cdf35f53bb537aed50bb8efab810866b289d6cf401b949d95bc7e27e8938c` |

| [Connecting The Station](/Hold%20The%20Flood/Connecting%20The%20Station) | `f13d8232104e950b1de7336db6cf0ba5e3e3c667a01979ee4f074e8d34c3a0cc` |

| [Rescue Rules](/Hold%20The%20Flood/Rescue%20Rules) / [First Survivor](/Hold%20The%20Flood/First%20Survivor) | `8fb4a395bf0486ea13d91377035042b8f276b321fbfd6aaf5765ed672a8a48de` / `0d6d99c0989089a95ebd715bbee932fc44fcbe900b852dac4ad210e59024d8ce` |

| [Station Room And Module Inventory](/Hold%20The%20Flood/Station%20Room%20And%20Module%20Inventory) / [Encounter And Mechanism Placement Inventory](/Hold%20The%20Flood/Encounter%20And%20Mechanism%20Placement%20Inventory) | `d4ef2497568d6d7924f929ad0abb96cffb41f4df61357f59cf2722b757580b99` / `5c1a9ad663ead360b3b80a66caca4e724d91dac38d50979d70f1d460bd0c23d2` |

| [Cast And Short Rescue Map](/Hold%20The%20Flood/Cast%20And%20Short%20Rescue%20Map) | `6456406b101845e6c9a6563a69fc7f56c1dcc7bf8227445bf14a03fa072f5514` |

The PM's two independent Global04 positions, registered in chat 485 as `b387d62f…` and `6b848b56…`, agree on the protected-retreat candidate and identify binding the whole short route first as its strongest alternative. Agreement is not approval. The PM reports all five current owner questions unanswered at assignment.

A placed room, threshold face, compact apparatus, persistent join, object, mechanism, evidence record and person keeps one stable identity. At death, all completed acts and actual locations seal; an eligible in-transfer survivor performs only a pre-prepared autonomous retreat to the named refuge; every still-carried astronaut object returns once; then joined rooms move as one rigid physical group while only unbound adjacency and allowed transient state change. The old route becomes historical. Living return changes no adjacency and does not replace defeated enemies. A wrong join stays walkable and can be released from a reachable network-side control. Under the pending stabilization branch, physically latching every reachable R01–R40 room into the ship-rooted group ends rearrangement; optional diagnostics and story choices neither complete nor block that physical result.

Outside the bounded return transaction, oxygen use, equipment readiness, threats, mechanism motion and ordinary work all advance in world time under their owning rules. Opening the journal freezes all of them and cannot move a person, finish a stage, operate a latch or create evidence. Quit/load records or resumes state; it is not a death, shift, withdrawal, rescue action or discovery.

| Kind of state | Candidate world truth | What the astronaut may claim |

|---|---|---|

| **Placed room and face** | R01–R40 and each named face retain identity, internal fixtures, completed work and attached objects. An unbound face may gain a different neighbour/orientation after death. | A current observation proves only the present arrangement. An older route remains dated evidence, not present access. |

| **Ordinary walkability** | A currently open door or aligned unbound threshold can be walked this life. It is a physical passage, not necessarily a durable connection. | Personally walking it proves current traversal and supports a short-rescue check. It promises nothing after death. |

| **Persistent latch** | One completed latch joins two specific placed faces, opens a walkable seam and fixes their relative pose until deliberate release. Power and diagnostic signal are separate. | The player can know the seam remains joined after death without learning the group's new external neighbours. |

| **Rigid group** | Rooms linked by persistent latches, plus each authored compact assembly, translate and rotate only as a whole. Internal distances, passages, handedness and hard control conduits do not stretch, swap ends or teleport. | A walked internal path remains physically valid unless its own persistent door/iris state blocks it. External breadcrumbs may become historical. |

| **Object and mechanism** | Every part, canister, objective item and loot instance has exactly one location. A mechanism remains attached to its stable room and retains committed checkpoints/mode; temporary phase follows its reset rule. | A known installed Fork remains known at R02 even when the player does not know a current route to R02. A record never retrieves it. |

| **Body and survivor** | After the transaction the playable astronaut body is aboard; no second lootable astronaut body remains at the death site. This is continuity accounting, not an answer to revival metaphysics. Each survivor has one actual location/state and moves only by a named physical transition. | A witnessed arrival plus closed ship airlock proves Sent. A plan, radio promise or old location does not. |

| **Evidence** | Captures, notes and testimony keep source, room, arrangement/life and factual limit. World truth can change without rewriting the record. | Persistent work/join facts stay current; unbound adjacency claims become historical. Diagnostic reach and story interpretation remain optional, fallible layers. |

An installed object travels with its room/group, not with the astronaut. A dropped object stays at its placed location in that room. A canister handed to a survivor or deposited in R12/R24/R27/R06 has left carried property. A consumed sample or breathed gas has no location to return from. No category called “collected” overrides the current one-location fact.

Every death advances one arrangement generation. Before full connection under the conditional stabilization branch, the new generation may change only:

- adjacency and orientation of **unbound** external faces and rigid groups;

- current accessibility through those new unbound relations;

- transient power, hazard phase and mechanism warning/charge where the owning reset rule permits it; and

- the next finite authored encounter population variant, selected at the death-shift boundary independently of the player's successful build, kill speed or reward.

It may not split a rigid group, move one room twice, duplicate or recall an object, undo a completed latch/door/cap/clamp/pin/capture, refill a spent input, alter a committed converter mode, turn an unknown route into journal knowledge, open a survivor refuge, or complete a rescue. R02–R03 always retain their glazed throat and hard board/rack conduit. R36–R40 always retain the R36-to-clamp passages and, once the iris is open, the actual return paths to R39/R40. R35 is only an external approach and may change; an absent R35 approach defers access without disassembling R36–R40.

1. **Seal the lethal instant.** Freeze the current action boundary. Commit only pickups, drops, installations, handovers, incremental gas transfers, spent material and work checkpoints already completed. Interrupt the unfinished stage. Snapshot every object's actual location and the astronaut-carried membership once. No saveable gap exists before the transaction identity.

2. **Resolve the survivor branch before geometry moves.** Waiting or Prepared people do not depart. A person already Sent remains aboard. Under the candidate safeguard below, an eligible person In transfer executes the already armed autonomous retreat to the named abort refuge; no new astronaut action, combat clear, door unlock, power routing or resource appears. The resulting **At abort refuge, alive, unsent** world state commits. If the safeguard was not eligible, transfer could not have begun under this candidate.

3. **Return the astronaut and carried set once.** Move the playable astronaut body and every still-carried active rig part, inactive part, loose loot and canister aboard, preserving object identity and rig/cargo substate. Leave installed, dropped, deposited, handed-over and consumed items where step 1 put them. Restore ordinary condition for the next expedition; canister refill/repacking are later ship actions.

4. **Close the old expedition.** Defeated enemies remain defeated for that expedition and do not rise during the transaction. Retire its remaining live attack/warning/tether state. Creature bodies and surviving group members belong to that closing transient population state rather than becoming stable loot or room objects; this continuity rule does not claim an in-fiction teleport or resurrection explanation. Persistent encounter work remains.

5. **Shift once.** Move each unbound room or rigid group into one valid new arrangement while preserving every persistent seam and compact boundary. A survivor at R12, for example, moves with R12's actual group; the person is not moved independently to a convenient new refuge. Then select one finite authored population list for the new arrangement. It may be a different disclosed variant, such as E03's later death-shift Presser state, but never a punitive extra wave reacting to a successful build. Stable rewards, part sources and spent inputs do not regenerate with it.

6. **Reclassify knowledge and commit aboard.** Keep records, annotations, stable object locations and join facts. Mark prior unbound routes historical. Add only the death fact, carried-return facts, and any pre-shift refuge closure receipt the prepared rescue apparatus actually recorded; reveal no new neighbours. The next resumable state is aboard. Save/load resumes this committed sequence or its result and never creates another death, shift, delivery, work step or clue.

Deliberate death uses exactly this order. It can request a new arrangement, but it does not refund oxygen/material, retrieve installed property, manufacture enemies for reward or guarantee that any particular useful face appears next.

A living return completes only when the astronaut physically reaches R01, enters the ship and closes the ship airlock. It causes no shift and preserves the current arrangement generation. Carried property remains carried until the player stores, installs or hands it over; ordinary refill, repair and repacking are separate aboard actions. Completed station work, dropped/installed objects and historical evidence remain unchanged.

The current arrangement's finite population membership also remains. Defeated creatures stay defeated; no replacement, elite or reduced reward reacts to the clean result. Surviving creatures retain their room/group membership. At a named physical withdrawal boundary, their active attacks, last-seen pursuit and mechanism occupancy may settle to a visible authored hold state reachable within the same current walkable encounter volume; they may not cross a sealed shutter, released seam or shifted route to reach it. If no such hold is reachable, their exact suspended location remains. Re-entry restarts ordinary perception/warnings, not population creation. A later **death shift**, not a living return, may select a new finite authored population variant as step 5 states.

This candidate makes living scouting materially different from death-cycling: alive return preserves a partially cleared opportunity and current map, while death returns carried goods but spends inputs, retires that expedition's combat state and changes unbound geography. It does not claim that this rhythm is balanced or resistant to farming.

The following safeguard is **new and pending owner reaction**. It is not implied by a quiet window, carried-property return or the fact that the route is short. It protects one eligible transition, not all survivors from later harm.

| State | Physical requirements and death result |

|---|---|

| **Waiting** | The person is inside the named intact refuge. Death moves that refuge only with its room/group. No route or departure is inferred. |

| **Prepared** | This life, the astronaut has personally walked ship→at most one exposed junction→counted abort refuge→survivor refuge; checked both-side controls; handed over and received flow confirmation for travel air; stocked the abort refuge; made the current encounter quiet; and armed a retreat path the survivor can operate without the astronaut. Death before departure leaves the person in the original refuge. The shift invalidates the route check, so the state returns to Waiting-with-actual-supplies; committed air/objects remain where placed and are not refunded. |

| **In transfer** | The survivor has opened the refuge door and physically departed. If either party calls ordinary abort while the astronaut lives, the person visibly returns to the named refuge/abort place and the station does not shift. If the astronaut dies, the armed pre-shift safeguard consumes the already committed travel margin/reserve and the survivor operates the actual doors to reach the named abort refuge before step 5. World truth becomes alive/unsent at that refuge. |

| **At abort refuge** | The person waits in the actual counted R06, R12, R24 or R27 instance chosen by their accepted scene. Its staged supply is spent according to the rescue. After a death shift that room/group has a new external location; the old route is historical and a new rescue attempt needs fresh air, stocking and a personally walked current check. |

| **Sent** | The same person has physically crossed aboard **and the ship airlock has closed before the lethal boundary**. Only that complete predicate commits Sent. Later astronaut death leaves them aboard, but this proposal does not grant general survivor immortality or answer post-Sent mortality. |

A person physically inside an **unclosed** ship airlock is not Sent. At step 1 the incomplete delivery freezes. Their prepared final-segment abort control must let them cycle stationward and reach the counted last refuge without astronaut input; under this candidate they do that before the shift. They do not close the ship airlock after the player's death to finish the mission. The abort-side door closure creates a fixed local receipt before geometry moves. On revival, that receipt can prove only “the named refuge closed before shift”; it reveals no new route to the refuge. If a final approach cannot provide this survivor-operated return and receipt, it is not eligible to start; the person waits rather than receiving an invented outcome.

The safeguard's cost is real: each rescue variant needs an autonomous retreat line from every committed segment, two-sided or survivor-side controls, staged travel air, a stocked counted refuge, a fixed closure receipt and a quiet precondition that remains valid long enough to arm the line. This can make rescues safer and more authored than the surrounding station. It still allows pressure to force living abort, spend supplies or delay departure; it does not allow hidden hostile movement to sever an already armed corridor during the transition.

Require every seam from the refuge through the abort room to the ship-rooted network to be persistently latched before departure. A death may then shift immediately because the whole retreat remains one rigid group. This uses the owner's connection direction more directly and removes the special pre-shift hold, but it delays early rescue until the exact route faces have appeared, requires several latch/release operations and can turn a one-junction human scene into network preparation. It still needs travel air, survivor-operated controls and an explicit injury/loss rule; binding geometry alone does not make a person safe. If selected, the first-survivor timing and each rescue host need re-authoring rather than a free join.

A compatible latch consumes no portable part and joins two specific adjacent faces only after its world-time hand-cycle commits. The connected rooms remain ordinary walkable space; the join is not a menu edge or teleport. A group can acquire more external faces as it grows, but its existing internal pose cannot change without releasing the seams that establish it. Converter modes may change diagnostic pulses while every walking seam remains intact.

Every permitted pre-completion arrangement must satisfy all of these visible physical obligations:

1. Place every stable R01–R40 room identity exactly once, contained in exactly one rigid group; place each survivor, object and mechanism with its owning room/fixture exactly once.

2. Preserve every persistent face-to-face latch and all fixed interior paths/control conduits. Do not reflect, stretch, reorder or overlap a rigid group. Keep R01's ship threshold fixed.

3. Preserve R02–R03 as a two-room compact group and R36–R40 as a five-room compact group even before either is latched externally. External faces may change; internal throats do not. R39/R40 count as physically included only after the R36 iris/path makes them actually reachable.

4. Pair only free external faces for current unbound adjacency. A current ordinary passage must have compatible physical openings, clear volume and a usable return; adjacency never completes a latch or diagnostic state.

5. Keep every critical release reachable from the ship-rooted side of its join or from a fully walkable island immediately after merge. A refuge door is separate from a join face; latching R13/R19/R22/R18/R26/R05 never sends its occupant.

6. Leave every not-yet-joined playable room/group eligible for at least one later valid arrangement and give the current layout at least one real exploration frontier. This does not promise that the next death presents a useful signature, rescue host or missing final face.

7. Place only one finite authored population at each active encounter, with warning routes that exist in that arrangement. Never repair an invalid layout with a creature, survivor, object teleport or invisible conduit.

The central rule is therefore not “a generator handles it.” A candidate arrangement is invalid if any identity duplicates, a persistent seam separates, a fixed conduit bends, a release is buried, an interior room becomes unreachable, or an unbound passage intersects solid geometry. This article does not prove that all forty-room states can meet those obligations.

**Honest fallback.** Content must provide a different valid arrangement for every reachable pre-completion persistent-group state. If arrangement selection cannot find one, it may try another already authored valid placement; it may not break a join or promise a desired face. If none exists, the safe continuity fallback is to retain the last valid physical arrangement and return the carried set without inventing a shift, while clearly recording an invalid-content failure. That preserves access and conservation but violates the owner requirement that every death shift the station; it is a blocker to shipping that content state, not an acceptable hidden player rule. The repair is to change face/clearance authoring or disallow the impossible content before release—not to roll back the player's join.

Persistent work must be reversible where it can occupy a face needed later. Suppose the ship-rooted network latches R33 Imaging Exchange's R-output to an irrelevant compatible R-input branch, occupying the face eventually useful to R32's R-input.

- **Before death:** the player walks through the completed seam to R33's network-side release and opens that one latch in world time. The two faces remain physically adjacent and ordinarily walkable for the rest of the current arrangement, so the player may inspect or relatch. Other joins, R33's fixed A→R behavior and R34's mode do not change.

- **After death while still joined:** R33 and the irrelevant branch move as one rigid group, so the release remains reachable. The player can release the same seam on a later visit. They do not need an item, story clue or exact new neighbour. The unlatched rooms remain adjacent until the next death; only then may their external relation change.

- **After release, then death:** the next arrangement may separate them and expose different free faces. It does not guarantee R32, refund travel air or announce the correct construction.

Recovery costs current-route discovery, oxygen, exposure and a completed release action, followed perhaps by ordinary play through several shifts. It never erases unrelated latches or requires a terminal stranded behind the join it controls.

At R03, the isolation bridge has been released and is carried; the one Fork is installed in R02's board; two fasteners and P01's alarm cut are committed; a Cycler sample spent earlier at R23 is already consumed. Death seals those facts. The bridge and other carried rig/cargo return once with the astronaut. Fork stays installed in R02, the sample stays spent, and the fasteners/alarm cut persist. R02–R03 move together with their throat and conduit intact; only their unbound external neighbours may change. The old R01→R02 route becomes historical. A new finite placement-1 population may be selected for the new arrangement, but it cannot restore the sample, bridge source or completed work.

The current route R01→R11→R12→R13 has been walked; R12 is stocked; the R13 occupant has travel air and control confirmation. If the astronaut dies **before** the refuge door opens, the survivor stays at R13. R12's reserve and the handed-over canister stay placed; after the shift, Prepared degrades to Waiting-with-supplies because the route check is historical.

If death occurs after departure in R11, the candidate safeguard spends the committed margin and the survivor operates the return controls into R12 before the shift. R12 then moves with its actual group; world truth is alive, unsent, at R12. If death occurs while the survivor is inside the ship airlock but before closure, the result is the same: no Sent flag, no postmortem closure, actual retreat to R12 through the pre-armed return. If the airlock closes first, Sent commits and later death leaves the person aboard. An ordinary living abort to R12 causes none of these shifts.

R33's R-output is latched to an irrelevant branch while R32's R-input remains unjoined. Releasing at R33 before death frees the face but keeps the rooms adjacent this life. If the player dies first, the wrong join remains a traversable seam inside one rigid group and R33's network-side release remains reachable. Releasing it later changes only that join; the following death may separate the faces. The journal retains “R33 fixed A→R” and the released join record, but any old route to R32 is historical. A diagnostic pulse is useful troubleshooting, not the physical release or completion condition.

Assume thirty-five rooms are already one ship-rooted rigid network and the last unjoined group is the compact R36–R40 assembly. Its iris is physically open, so R39 and R40 are actually reachable from R36; a roster count cannot substitute for that. In a current arrangement, R36's external A face meets a visibly compatible free counterpart presented at R34's network edge. The player inspects and latches those actual faces. Walking from R01 through the seam and through R36 to R37, R38, R39 and R40 establishes physical inclusion. The R34 roster may now report 40/40 joined identities, including previously anonymous rooms, but it neither performs the latch nor reveals what those rooms contained.

Under the pending stabilization branch, all forty rooms are now one rigid group. A later death still performs carried return, rescue resolution, transient reset and knowledge bookkeeping, but there is no unbound room adjacency left to rearrange; the station remains physically stable as the proposed late consequence. Diagnostic A/B/R reach may still fail because a converter mode is wrong, and R39 evidence or R40 isolation may remain untouched. Neither blocks physical completion or becomes an ending. If the owner chooses continued rearrangement after 40/40, this rigid-group result cannot stand: the physical meaning of every earlier bind must be reopened, not patched only at the finale.

“Shuffle every room independently, then restore the saved joins” breaks both access and conservation. After death at R03 it could place R02 elsewhere, stretch the fixed board/rack conduit across space, and later snap the rooms together around occupied geometry. The same policy could strand R39 beyond an R36 iris with no actual passage while counting it joined. Restoring only labels would turn a physical seam into teleportation and make network-side releases meaningless.

The repair is to treat compact assemblies and latched components as rigid placement units **before** arranging any unbound faces, then reject any placement that cannot preserve their volume, returns and controls. The cost is fewer degrees of shuffle as the network grows, harder content validation and eventual stabilization under this branch. That shrinking possibility space is the physical price of the player's permanent construction, not a hidden exception.

The bind-entire-short-route-first alternative is the smaller continuity rule: remove protected pre-shift retreat entirely and allow rescue movement only once refuge, abort room and ship-rooted route are one persistent group. Death then uses ordinary rigid-group preservation; an in-transfer survivor can physically abort without a special pre-shift ordering convention. It is easier to explain and gives connections immediate human value. Its cost is substantial: first rescue may wait for several exact latch opportunities, each later rescue repeats network chores, and a short emotional crossing risks becoming a late construction reward. It also does not answer injury/loss outside the bound corridor or post-Sent mortality. Choose it if the special safeguard proves harder to understand than the delay it avoids.

No parent is edited by this draft. If the candidate survives review and owner branching, the finite lateral alignment is:

| Owning article / passage | Required alignment |

|---|---|

| **Save And Content State — death transaction step 3; walkthrough 5; population/open decisions** | Replace “unconfirmed” as world outcome with the conditional Prepared/In-transfer retreat result while keeping astronaut knowledge/provenance separate; add the final-airlock case, playable-body single location, death-shift population boundary and living-return no-replacement rule. Preserve save-policy alternatives. |

| **Connecting The Station — local join, recovery, completion and conditional consequence** | State that compact assemblies and joined components are rigid physical placement units; add minimum release/placement obligations and the invalid-arrangement blocker. Keep diagnostics separate and stabilization conditional. |

| **Rescue Rules — timing assumptions and failure table** | Mark protected retreat as the new pending global candidate, add its extra controls/air/receipt obligations and unclosed-airlock result; do not present Dorn's local intention as universal safety. |

| **First Survivor — timing assumptions and both death/abort paragraphs** | Replace the unresolved R-3 ordering placeholder only if the branch is selected; retain the one-junction eligibility, intact ward and Yeva/Aster choice. |

| **Cast And Short Rescue Map — shared boundary and Y1/A1/D1/M1/I1 interruption cells** | Align each named R06/R12/R24/R27 abort host with the same Prepared/In-transfer/Sent transitions and make clear that a quiet window alone does not arm protection. Keep five people/fifteen scenes unchanged. |

| **Station Room And Module Inventory — counting/compact boundary and rescue-host access rows** | Add rigid-group placement language and the autonomous return/receipt clearance obligation without changing 24 modules/40 rooms or turning a refuge door into a join face. |

| **Encounter And Mechanism Placement Inventory — shared encounter contract and five rescue extensions** | Adopt living-return versus death-shift finite-population behavior and state that encounter quieting is necessary but insufficient for the candidate safeguard. Keep 10 encounters/2 setpieces/13 mechanisms. |

These patches require explicit ownership transfer and a fresh source check. Global04 cannot close on this new article alone.

| Existing inventory | What this candidate reuses or adds | Count effect |

|---|---|---|

| **24 modules / 40 placed station rooms** | Reuses every stable identity and face. R02–R03 and R36–R40 become two explicit compact placement units; persistent joins can grow larger rigid groups. | **No room or module increment.** Ordinary latches remain authored interfaces, not P14+. |

| **10 encounters / 2 setpieces / 13 major mechanisms** | Adds one global distinction between same-arrangement living return and death-shift population selection; mechanism checkpoints/reset rules stay owned by Encounter33. | **Counts unchanged.** Exact next-generation population lists and reward consequences remain a gap. |

| **5 rescue identities / 7 mutually exclusive host variants / 15 cast scenes** | Reuses R06, R12, R24 and R27 as the counted abort rooms already allocated. Each eligible host variant gains an autonomous-return clearance and one visible closure-receipt state using its existing door/control apparatus. | **No new person, scene, refuge or room claimed.** The receipt/control-state presentation is real additional authoring, not free reuse. |

| **Objects, evidence and player information** | Reuses stable object locations, provenance records and current/historical route labels. Adds no portable part, consumable, resource or stat; the death/refuge receipt is a bounded state record, not a map reveal. | **Zero new gear/resources.** Exact UI/cue forms and accessibility equivalents remain later work. |

The largest unfilled obligation is a finite admissible arrangement catalogue or equivalent authored evidence that every reachable persistent-group state has a valid changed successor until conditional 40/40 stabilization. This paper gives constraints and failure handling, not that proof. Exact rigid clearances, face orientations, population variants, offscreen surviving-enemy holds, rescue return timing, air consumption and compatibility with every story/object state also remain unallocated detail.

**Strongest case.** The candidate makes permanent construction physically legible while preserving discovery: the player can trust completed joins, installed objects and survivor locations without trusting an old route. Death still changes the unexplored frontier, while living return preserves a deliberately cleared opportunity. A failed rescue has a real, costly continuation state rather than a knowledge placeholder or teleport.

**Accepted costs.** Rigid groups reduce shuffle freedom with every join and can make valid arrangements increasingly difficult. A death-shift population refresh can incentivize or punish deliberate death unless rewards and encounter variants are authored carefully. Protected retreat adds fixed controls, staged air, closure receipts and safe transition assumptions to every rescue variant, potentially lowering danger. The 40/40 roster reveals the existence/count of hidden rooms. None of these costs is shown to be fun, clear, balanced, feasible or sufficient for long-form pacing.

**Unresolved owner choices.** The PM reports five owner questions still unanswered; this proposal does not convert or renumber them. Its two direct branches need taste decisions: (1) protected alive/unsent retreat with spent supplies and changed refuge location, versus concrete injury/loss stakes or the bind-first alternative; and (2) full physical connection stabilizes the station, versus continued rearrangement that reopens the rigid first-bind model. Other inherited unresolved choices include save-line policy, first-survivor selection, post-Sent mortality and whether the proposed living-return population rule is adopted. Story/core, diagnostics and acquisition choices do not repair or gate this continuity rule.

**Specific later discrimination.** In a later owner-authorized phase, validate—not assume—whether players can predict carried versus installed return across a death; distinguish current unbound passage, persistent seam and diagnostic signal; find a network-side release after a shift; understand why an unclosed-airlock survivor is unsent but alive at a moved refuge; and tolerate several deaths without a useful face. Static authoring checks should first enumerate identities, faces, rigid groups, recovery sides and each admitted arrangement for duplicates, broken compact paths, buried releases and unreachable R01–R40 interiors. Only later implementation and consenting-player observation could test comprehension, tension, farming behavior, rescue emotion, performance or pacing.

**Self-check.** The proposal conserves one instance of every object; returns all and only still-carried property; leaves spent inputs spent; preserves completed work; shifts once per pre-completion death; never shifts on living return; gives an actual survivor world outcome without postmortem astronaut action; keeps Sent's full predicate; separates world truth from proof and historical routes from current access; preserves R02–R03/R36–R40; gives wrong joins a reachable release; keeps physical completion independent of diagnostics/story; includes every actual R01–R40 room; promises no particular next face; and labels both protection and stabilization conditional. It provides no full arrangement proof, implementation, simulation, asset, playtest or owner answer.