Within one loaded continuity, the same completed act remains true after return, death, quit, load, or a later shift unless its owning rule says it is temporary. Under the single-line save policy, ordinary loading does not roll it back; the recovery fallback and the reloadable alternative are the exceptions. One item cannot exist in two places and spent oxygen or material cannot reappear within the loaded history. Everything in the astronaut's carried property at death returns aboard, including each active rig part and each inactive or loose cargo item once. Something dropped, consumed, handed over, or installed in a station/ship fixture or another location outside that carried set does not.

Temporary combat upgrades and earned-but-unchosen offers end whenever the astronaut returns aboard, alive or revived. This reset changes expedition power, not physical property: carried parts and exact canister contents remain. Every new expedition renews combat populations and growth opportunities while permanent changes remain. Expedition identity is separate from arrangement generation: a living return ends an expedition without shifting the rooms. Loading and quitting preserve the ongoing expedition; they cause no return, death, shift, replacement population, delivery, completed work, new upgrade or new knowledge.

| **Reusable room-module definition** | Layout/behavior shared by possible uses | Not a placed room. Editing a definition cannot merge the histories of its instances. |

| **Mechanism instance and checkpoint** | The placed machine, each named completed stage, deliberate mode/disable state, and reset rule. Local commits include R26 selector/final detent separately from current diagnostic power; collar buffer/latch/clear; and bench vessel secure/clamp plus each exact fill increment. | Current animation/timer and enemy occupancy are transient unless that machine explicitly commits them. An R26 mode can commit without a powered pulse; R33's A→R behavior is fixed, while current pulse result still depends on power/input. |

| **Evidence record** | One committed capture, note revision, testimony, or instrument report with provenance, room instance, arrangement/life, and factual limit | Record existence, player annotation, attributed interpretation, and present truth. A historical mark never becomes current automatically. |

| **Population/transient hazard state** | Physical source identities, the current expedition's committed arrivals and surviving creatures, and exact hazard state needed to suspend that expedition | Each new expedition renews combat populations after living return or revival. Loading the ongoing expedition preserves its population. Current flow, temporary interruption and a permanent physical seal are separate facts; earned world work follows its owning rule. |

Every transition names the identity it mutates, its precondition, the point at which it commits, and what an interruption preserves. A collectible changes from source to carried in one commit; it is never copied and then deleted later. Incremental oxygen transfer moves exact O between the same two object states, stops at suit 12 O or vessel 0 O, and leaves untransferred gas in place. Capacitor acceptance/release records exact U and whether the first receiver accepted. Ordinary chosen release commits 2 U; temporary Thunderhead, Foundry Drop and Furnace Burst commands commit a full 4 U only at their stated first-receiver acceptance boundary after preflight. Cancellation, refusal or expiry of an uncommitted manual-ready opportunity retains charge and commits no burst heat; acceptance reserves the complete stated action heat and operating demand. Later refusal cannot reverse either committed release.

**Recommended default: one authoritative continuity line with suspend-anywhere resume.** Durable commits are recorded after each completed atomic change, and quitting records a suspend point containing the current live state without advancing it. Loading resumes the newest verified point. A save records state; it is not a world action and cannot finish an action, consume time, trigger an alarm, return property, shift the station, complete a horde milestone or choose an upgrade. The journal pauses everything; whether any other menu pauses play is open.

An unfinished action remains unfinished at its recorded phase. Resume does not round it forward to a checkpoint or backward across a completed increment. Ordinary cancel, displacement, withdrawal, and death still apply their owning interruption rules. Quit does none of those things. Deliberate death is a gameplay choice and uses the same death transaction as any other death. Loading is not revival or a new departure and creates neither a new arrangement nor a fresh expedition population.

The default offers no selectable earlier timeline. Its strength is one clear consequence chain: installed parts, consumed resources, discoveries, and shifts cannot be casually undone, and the state space for a long mystery is narrower. Its cost is less freedom to revisit an accidental choice and greater dependence on reliable recovery. If the newest record cannot be verified, the player may be offered the last verified compatible point with an explicit statement of what boundary would be rolled back; the game must never perform that rollback silently.

**Credible alternative: manual named checkpoints plus autosave.** Players could preserve and reload earlier branches. This supports experimentation, shared households, accessibility needs, and recovery from misunderstood commitments. It also lets a player search death shifts or undo installs, spends, and story choices; authoring and support must tolerate more divergent histories. If adopted, no in-fiction punishment, weakened reward, or “save-scumming” label is added.

2. **Partition property once and apply the aboard reset.** Snapshot the astronaut-carried membership by object identity: every active rig part plus every inactive/loose cargo item, each once. Move those same instances aboard, preserving rig-versus-cargo substate and each canister's exact O. Leave station/ship-fixture installations, deposits, handovers, world-source objects, and consumed resources outside the return set in their actual states. Remove temporary combat upgrades, pending offers and temporary routing/mode state at this return boundary. For example, an active Sensor and Projector, an inactive loose Fork, and a carried partial canister return once each; a different Fork in a station fixture and scrap already consumed by a Cycler do not. Restore ordinary condition for the next expedition under the current rule; ship-side refilling remains separate. Preserve the sealed exact pre-death Capacitor U until the retained-charge decision is made; do not silently keep or clear it in the playable aboard result. The playable astronaut body has one location: aboard. The sealed membership cannot change during the rest of the transaction, and the player receives no control aboard until the final step.

5. **Reclassify knowledge.** Retain records and notes. Mark prior-life route and adjacency claims historical; keep completed work and join facts known. Reveal only what can currently be sensed from the ship/airlock or another valid instrument.

| **5. Rescue near delivery** | The named survivor is In transfer and the ship airlock has not closed. A quit suspends that exact state; it does not send them. | Loading after quit resumes In transfer. Sent commits only if that same survivor completes arrival aboard **and the ship airlock closes before the lethal boundary**; an empty closure, or one with them outside, does nothing. If death commits before that complete predicate, the transaction records last confirmed In transfer as the astronaut's knowledge. Under the safeguard pending owner decision, the stored **world** outcome is at abort refuge, alive and unsent, reached by the armed retreat; the abort door leaves a closure tell on that refuge's local control only, nothing reaches the ship, and the astronaut's knowledge stays unconfirmed until a later direct observation there. Storage must keep those two facts distinct and must still invent no delivery, loss or safety. |

- Stable, never-reused identities for definitions, placed rooms, faces, joins, mechanisms/checkpoints, objects, evidence, survivors, physical crowd sources and releases, expeditions and their growth/milestone state, objectives/scenes, and arrangement generations. References name an identity, not a display name or current coordinate.

- Placement constraints for required entrances, compatible faces, control access from the necessary sides, safe recovery from reversible mistakes, mechanism clearance, short-rescue geometry, and objects attached to stable room/fixture identities.

- Exact mechanical amounts and local commits from [Mechanical Interfaces And Opening Quantities](/Hold%20The%20Flood/Mechanical%20Interfaces%20And%20Opening%20Quantities): suit/canister O, Capacitor U, Fork output order/allocation result, each actuator's source/target/readiness commitment, causal-sequence identity and remaining route/body/rebound/fragment/bloom allowances, exact local heat and recovery, visible concurrent power state, launch/Barrier interlock, parent reservations and ordinary/master slots through final fragments, bank/terminal state, armed manual intent and remaining hold time, in-flight effects, Thunderhead/Foundry/Furnace modes, Inward Draft behavior and burst ancestry, collar buffer/latch/clear, bench secure/clamp/fill, R26 selector/detent/power and R33 fixed A→R/current power.

- Separate author facts from discoverable facts and player records. A condition may test real state, but its presentation may expose only authorized observation, testimony, or instrument output.

Before content is admitted, a paper/static check must find no duplicate object location, rolled-back completed work, repeated death shift, orphaned persistent join, unreachable required recovery control, current label on historical geography, survivor state stronger than its confirmation, an award created by loading or by the act of returning rather than later fighting, or temporary upgrade surviving an aboard boundary.

- Single-line versus reloadable saves, and any slot/overwrite restrictions.

- The player-facing recovery policy for incompatible or damaged saves.