[valzargaming]

Paid chamber-to-habitat recovery now has a Phase 1 backend prerequisite: detached gas/work calculation, paid assembly and Inventory ownership, fixed-budget jobs, reciprocal accounting, and four-owner publication guarded against stale or restored state. No player pump commands, scheduler, UI or physical presentation are added. Main retains review and merge.

Frozen source head: 626822c. Accepted amendment: c198e59.

The backend requires full condition for start/resume/batches, exact pinned catalog and restore values, ledger-version-correct mounted roots, and unchanged paid identity and provenance. Authored controls cover genuine charged whole-world reload, fresh resume timing, damaged conditions, stale owners, ABA/exhaustion, work limits and strict emitted schemas. Windows/Linux CI uses the existing bounded runners.

The latest source amendment corrects the transaction test's positive setup. The inherited paid route ends vented (1.834981191161433 mol in 3.6 cubic metres). Its proposed 0.1 mol batch would end at a pressure ratio of 85.63594, exceeding the existing 16:1 guard; the uncapped formula would require 3101 J against the 250 J cap. The test retains this real state as a work-limit negative, then refills via the actual inner bypass for 600 simulation ticks, consuming finite habitat gas and asserting total conservation. It assigns no successful owner/gas fixture. Exact tick, authority/pose/tool/doors/item, epoch, owner and work assertions now include ServiceResult codes/messages. Damaged 999/1/0 negatives run only after the undamaged step positive prepares.

Validation:

• Local git diff --check passed for this amendment; source/retained-fixture arithmetic identifies the physical-limit rejection. No native process was launched for this amendment.
• Schema syntax/identities reuse the unchanged dd14acc result. Local metaschema validation remains unavailable because jsonschema is absent.
• Prior frozen f3f5094: import passed 6.7586497s, startup passed 3.6816917s, transaction failed 24.5767754s at undamaged eligible step. Pressure stability skipped. Empty pre/post process inventories; lease released and logs preserved. The prior assertion omitted its ServiceResult, so source diagnosis cannot exclude an earlier admission rejection.
• Earlier a111c31 and 1fc11c8 failure packets remain preserved.
• New-head CI/runtime results are pending; no passing runtime, graphical, merge or deployment claim. Local native work requires a fresh exclusive lease.

The milestone document records APIs, save16/Pressure6 migration, unchanged observation17/paid-door6 projection and publication boundaries. Old snapshots grant no pump, gas or energy. Phase2/device expansion remains outside scope.

Required CI at d11b1a1 failed on both Windows/Linux (CI40837119737; production40837119777). Actual failed-job logs identify two test setup defects: the owner-fence bank case attempted an invalid modified revision-zero restore, and transaction bypass refill happened after adding a mounted pump world root unsupported by the legacy swing classifier. The new source amendment directly injects the stale canonical bank quantity without changing the restore seal, and refills while the paid pump is still carried, before mounting. Separate restore/ABA tests, original guards and all finite-gas/payment/damaged positives and negatives remain. No runtime source, schema or physical device expansion. New-head CI pending; work remains active and required checks still apply before Main's merge.

Exact-head verification update: production run40840561271 at626822c391ea0805677bddc550ddd139ee3b3369 PASSED on Windows and Linux, including chamber recovery work, owner fence, transaction, and genuine paid-route emitted schema negatives. Main CI40840561384 remains in progress. Local native checks remain unrun; no merge/deployment claim.