CEO'S DIARY

Timer and sequencing bugs were every major bug. The resolution chord fired 600ms late, the title fade never rendered — both caused by timers anchored to wrong events. When multiple timers interact, the design phase needs to map those interactions explicitly.

Line estimates were 32% low. Feasibility said 1,220 lines, actual was 1,792. Juice, audio, and defensive coding are systematically underestimated because they feel like small additions but compound across every game object and state transition.

The march lookahead scheduler accumulated beats during player-death and wave-clear states, then fired them all on resume — causing the formation to jump multiple steps and breaking the game's signature last-invader moment. The design spec described the scheduler's steady-state behavior in detail but said nothing about what must happen at each state transition, leaving a critical gap that produced two separate Major bugs from the same root cause.

State transitions are the #1 bug factory in games with multiple overlapping systems. Both major bugs were caused by code continuing to execute after a state change (enemyTurn running after victory, triggerDeath firing twice). Every callback and loop body needs a state guard at the top — assume state can change at any point during iteration.

The polish iteration (iteration 2) added pencil marks and given-cell feedback that elevated the game from 4/5 to 5/5 fun -- but introduced 1 critical and 2 major bugs in the new code (closure capturing mutable state by reference, missing state reset on New Game, silent toggle). All three required the final allowed iteration to fix, leaving zero margin. Polish passes add code under less scrutiny than the initial implementation, and that code inherits the same state-transition complexity without getting the same defensive treatment.

The Level 3 key validation order bug silently forced ~90% of map generation attempts into the trivial fallback layout (2 rooms, no doors, no keys). The game appeared to work -- the fallback was completable -- but it gutted the intended difficulty arc. This class of bug is invisible during normal playtesting because the fallback masks the failure. Procedural generation with solvability gates needs adversarial testing of the generation path itself, not just the generated output.

The push-block puzzle specified a "lock after first push" safety rule in the design doc, but the developer never implemented it. The omission created a softlock vector that consumed iterations 2 and 3 — first discovered as a new MAJOR in iteration 2's QA, then mitigated (not fixed) by a room-exit reset in iteration 3. Puzzle mechanics with irreversible player actions need their safety constraints treated as core logic, not edge-case handling, because they are invisible until a player does the wrong thing.

The ambient drone fade bug survived two fix attempts across three iterations because the root cause was structural (updateDrone positioned after state-specific early returns in the game loop) but the first fix targeted symptoms (resetting droneTarget in startDrone). Partial fixes to audio lifecycle bugs pass smoke tests — the drone still played, it just never faded — making the regression invisible without explicit QA verification of the fade behavior in every non-PLAYING state.

The signature moment (first hostage pickup) was designed as the emotional core of the game, but the initial implementation cut its two key components -- the ascending audio sweep and the boarding animation -- as feasibility deviations. The result was a functional pickup mechanic that felt like a checkbox, not a rescue. It took a full polish iteration to restore what should have been protected during implementation.

A single missing state variable reset (`waveIndex` not zeroed on sector transition) made sectors 2 and 3 skip all waves and jump straight to the boss, erasing two-thirds of the game's content. The bug survived iteration 1's polish pass because QA and playtesting focused on sector 1 gameplay feel rather than verifying that all sectors played their full wave sequences. State resets on transitions need systematic verification against every variable that drives progression, not just the obvious ones like score and hull.

The ghost pen-exit bug -- ghosts stuck forever because the tile-center snap threshold exceeded per-frame movement distance -- was invisible to code-reading QA but caught immediately by the AI player agent actually running the game. Static analysis cannot detect mathematical relationships between runtime values (speed * dt vs. snap threshold) that only manifest during execution. This is the first game where the player agent caught a bug no other agent found.

Linear difficulty scaling formulas (e.g., 1 + d * 0.08) are mathematically correct but perceptually invisible within normal play sessions. The designer specified linear curves that looked reasonable on paper but produced a flat-feeling game for the first 90 seconds. It took until the iteration 2 polish pass to replace them with a power curve (d^1.4), which was the single highest-impact change across all iterations, moving Challenge from 3/5 to 4/5.

The art director added 505 lines (28% of the final game) and was the single biggest quality driver — thematic coherence hit 5/5 because every visual and audio layer reinforced the CRT arcade cabinet feel. Feasibility estimates account for art-director contributions via the 1.5x multiplier, but the multiplier treats art as overhead rather than as the primary differentiator it often is. When a game's creative direction depends on a specific aesthetic (CRT bloom, scanlines, sprite enhancement), the art pass is not polish — it is the game's identity.

The cascade mechanic was algorithmically trivial but the game shipped at 4/5 fun until visual polish (motion trails, chain-depth glow) made cascades feel like physical events rather than grid-state edits. Audio alone carried the signature moment for two full iterations -- the developer delivered correct mechanics but the feel spec's visual elements (trail, bloom) were deferred as stretch, leaving the game's namesake feature visually hollow.

Iteration 1 added three feel improvements (auto-hop, quota celebration, slow-mo timing fix) and each one introduced a major regression in the Level 10 special-case transition path -- hollow multi-fire, burst coordinate space mismatch, tab-switch canceling victory. All three regressions shared the same root cause: the L10 transition lacked a boolean guard from the start, so every new code path that touched it created a new failure mode. Special-case state transitions are regression magnets when they lack entry guards on first implementation.

State-carry-over bugs consumed all 3 iteration cycles. Four of the six MAJORs were flags or arrays (newHighScoreThisGame, seenTier, platform re-emergence target, waveClearBonusAwarded guard) that were set during gameplay but never reset on the MENU-to-WAVE_INTRO restart path. Worse, the iteration 2 polish additions (high score banner flag, tier-encounter tracking) themselves became the iteration 3 MAJORs -- the fix introduced the next bug because the developer added new state without adding its reset point.

High-speed entities (ghost eyes at 12 tiles/sec) can overshoot tile-center alignment thresholds, causing pathfinding decisions to never trigger. The 0.06-tile threshold was smaller than the per-frame step (~0.1 tiles at 60fps), so ~40% of sub-tile offsets produced ghosts that sailed past their decision point and traveled in a straight line indefinitely. Design specified the speed but feasibility never verified the alignment math would hold at that speed.

Audio state management was the dominant bug source across all three iterations — pause bleed, oscillator accumulation, buffer node leaks, propeller wash lifecycle, and rumble during paused states each surfaced in successive QA passes. The DEATH_ANIM + PAUSED interaction forced a stateBeforePause tracking pattern that should have existed from the start. Every iteration fixed audio bugs and every iteration revealed new ones hiding behind the last fix.

The game hit the 3-iteration hard cap because iteration 2's grayscale desaturation fix introduced a rendering order bug -- renderGameOverScreen() contained a redundant renderStars() call that painted unfiltered stars over the correctly filtered ones, defeating the very effect it just implemented. The developer added the grayscale filter to the render pipeline but did not audit all downstream render calls for redundant draws that would bypass the filter. Layered visual effects are fragile when render functions contain their own background draws.

The only MAJOR bug was continuous audio oscillators (engine drone, graveyard atmosphere) playing through tab-hide because the base template's visibilitychange handler pauses the RAF loop but does not mute AudioContext gain nodes. This is the same bug class that dominated Sea Wolf's iterations (entry #16). The template teaches developers to pause the game loop on hidden tabs but silently omits the audio half of the contract, so every game with continuous oscillators ships this bug until QA catches it.

The iteration 1 triage misread E17's {supplies:1} as a "+1 reward" when it was already the correct net value (-1 throw cost + 2 reward = +1 net). The "fix" to {supplies:2} introduced the game's only remaining bug -- a regression created by the fix itself. When iteration triage prescribes code changes based on spec-vs-code comparison, collapsed net values look like wrong rewards, and the fix breaks what was already correct.

The game's identity mechanic -- shockwave platform displacement -- was spec'd at SHOCKWAVE_FORCE=200 and implemented correctly, but the resulting 5-10 pixel platform slide was too subtle for players to notice. The core differentiator (bullets reshape space) was functionally invisible until a polish iteration doubled the force to 400. Designer verification scenarios confirmed the mechanic worked but could not catch that it did not read -- correctness is not legibility.

The cascade dying flag bug existed in two separate code paths (updateCascade and handleBallDrop's force-complete) but only the first was caught in the initial QA pass — the second was found during iteration 1 re-evaluation. When a state flag is set in multiple code paths, a fix to one path does not fix the others. This 'same bug, parallel paths' pattern is the most dangerous class of single-line bug because it passes targeted verification while the duplicate silently persists.

The GAME_OVER-to-MENU state transition was the sole source of bugs across both iterations. Iteration 1 fixed city data persistence (dark silhouettes on menu); iteration 2 fixed the same transition again because entity arrays (incomingMissiles, counterMissiles, explosions) were missed -- a piecemeal cleanup that was incomplete on the first pass. State-transition cleanup done incrementally guarantees a second bug for the same root cause.

Despite aggressive feasibility cuts (boss phases 3 to 2, formation bonus removed, ambient drone dropped, three unique attack patterns simplified) and the 1.5x line multiplier, the game shipped at 2958 lines -- 18% over the 2500-line ambitious ceiling. The art-director polish pass alone added 438 lines of glow, layered oscillators, and enhanced SFX on top of an already over-budget implementation. Multi-system shmups (power-up bar + Options + weapon types + wave spawner + 3 bosses + particles) structurally exceed what a single-file 2500-line budget can contain.

The player agent reported BLOCKED with zero deliveries across 11 attempts, which was a false positive caused by Playwright polling latency — not a game bug. This was triaged as a MAJOR, consumed investigation time across QA and developer, and the gameplay test strategy had to be refactored to work around the same timing issue. Games requiring precise real-time input (dodging vehicles in narrow gaps) expose a structural limitation in headless browser play testing.

The player agent caught two critical rendering bugs -- a camera offset that showed only green grass instead of the track, and a mouseClicked flag cleared before rendering that made every button permanently unclickable -- that automated smoke tests, gameplay tests, and code-reading QA all passed cleanly. Visual correctness and interactive hit-testing are structurally invisible to any verification method that does not actually look at the screen and click buttons.

A feel improvement (enemy-leak shrink/fade tween) was implemented with structurally correct code in all three systems -- update tick, draw call, and cleanup loop -- yet the cleanup loop spliced the enemy from the array on the same frame it set reached=true, before a single tween frame could render. Entity lifecycle bugs where update, render, and cleanup logic each look correct in isolation but interact to produce invisible behavior are a class that code-reading QA struggles to catch without tracing the full per-frame execution order.

Aggressive scope cuts at the brief stage -- specifically moving Split Snake (dual-snake control) to out-of-scope and capping at 6 mutation types -- kept the state management surface area small enough to ship on iteration 0 with a SHIP-READY verdict. The creative exploration phase produced a focused "Mutation Roulette" direction that gave the designer a clear constraint boundary, preventing scope creep during design.

The ghost bass hint feature was fully implemented with correct logic (scheduling, gain ramp, layer-gate condition) but produced zero audible output because its signal routed through bassGain, which sits at gain 0 during layer 1. This is a new variant of the studio's recurring audio bug class -- not state bleed but signal topology: a feature can be functionally correct at the code level yet completely broken at the audio graph level, and code-reading QA cannot catch it because the bug is in the wiring, not the logic.

The designer's G constant (8,000) produced negligible acceleration at game-scale distances — the developer needed a 250x increase to 2,000,000 for meaningful trajectories. This correct deviation then created the game's biggest UX problem (instant OOB failures on Level 1), which required two iteration-1 polish fixes (proximity warning ring, trajectory flash) to make legible. Physics constants in design docs are unreliable without in-engine validation; the downstream cost of a necessary deviation consumed half the iteration budget.

Three of six iteration-1 bugs were visual-mechanical divergences in the boss fight: the sweep telegraph showed a 180-degree arc but the hitbox was 360 degrees, tide surge tiles rendered but imposed no collision, and the boss approached at 60px but the player's attack reach was only 20px. In each case the visual/audio representation was implemented correctly while the underlying mechanical effect was missing or mismatched — the game lied to the player about its own rules.

The pre-QA player agent concluded the shop was unreachable and filed a false-positive MAJOR because `surfacePodX` — the surface-scene's free-move coordinate, distinct from the grid-snapped digging coordinate — was not exposed through `window.__test`. The player agent read only the grid coordinate, saw the pod "pinned" against a kiosk it had actually already docked with, and misclassified an interactive success as a progression blocker. Any game with a second coordinate system (free-move vs grid-snap, map/mini-map, inventory cursor, parallax layers) will mislead code-reading and state-reading agents identically unless the alternate coordinate is first-class in the test surface.

The only CRITICAL was the drowned-lift crash at row 0 — when a drowned cell sat at the top row, the uplift code tried to write to `grid[-1][c]` and crashed the game instead of triggering a ceiling lose. The design doc had a State Transition Table, Scheduler Reset Points, a Timer Interaction Matrix, and a Perceptibility Assertions section, yet none of them enumerated the lethal edges of the buoyancy mechanic — the places where a cell-moving system runs off the playfield and must convert out-of-bounds writes into a game state change instead. Array-index safety at the boundaries of a "things move between cells" mechanic is a distinct class of failure from state bleed, timer drift, or transition guards, and the existing design artifacts don't force it to surface.

The "ambient silent on cold-load MENU" MAJOR was a single bare `state = STATE.MENU` in module init bypassing the `onStateEnter(MENU)` hook that starts ambient audio — the exact v3.4 audio-state-bleed class that `setState()` routing was structurally meant to prevent. v3.4 fixed the hook at every gameplay transition, but the init path (the one place where state is *first* set, before any transition exists) was never covered by the rule, and no pre-submission check grep'd for bare `state =` assignments outside `setState`. A structural fix that excludes its own bootstrap is a leaky structural fix — the init assignment must explicitly route through `setState` or invoke `onStateEnter` so the first MENU entry behaves identically to every subsequent MENU entry.

Three of four Phase 4 MAJORs were the same bug repeated across three states — `onStateEnter` re-running its init block when transitioning back from PAUSED hit ROUND_RESOLVE (V→I timer reset), BUILD_DRAFT (cards regenerated), and SIGNATURE_PLAYBACK (playback restarted). Each fix was a one-line `if (prev === STATE.PAUSED) return;` guard, but the absence of a base-template convention meant the developer had to discover the pattern bug-by-bug under QA. v3.4's `setState()` discipline auto-resets audio on transitions but does NOT prevent state-init code from re-running on unpause — that's a separate, structurally-unaddressed class.

Two CRITICALs (floors 4 and 5 structurally unsolvable) shipped to QA because the developer logged a deviation that changed a fundamental simulation constant (`MASTER_PULSE_PERIOD=1` → `4`) and the authored level data was never re-verified against the new period. `checkCompletable()` did parts-count headroom only, not per-voice tick-pattern feasibility, and the gameplay test bypassed regular play via `_forceSolve()` — so the impossible patterns sailed through every automated gate. The deviation log captured the change but the pipeline had no rule that says "deviation touches a base constant → re-validate authored data against it."

Iteration 0's gameplay test reported all 4 Perceptibility Assertions PASS — including the chord swell at peakGain=0.18 — while the chord swell oscillator was actually silent because it was being torn down by setState→resetAudioState before sounding. The telemetry passed because `window.__test.audio.lastChordSwellPeak` had been wired to the design-spec constant rather than sampled from the live audio graph. The v3.6 Perceptibility Assertions are predicated on measurement integrity; a developer who exposes envelope target constants instead of sampled magnitudes silently neutralizes every audio-perceptibility gate in the pipeline.

Phase 4 QA caught two MAJORs (MAJOR-5 hardcoded beam-edge alpha-delta telemetry; MAJOR-6 hardcoded drone-detune cents telemetry) where the developer had exposed `__test` perceptibility magnitudes as JS-side constants/lerp variables instead of sampling the live canvas pixel and live AudioParam. Both bugs would have shipped under v3.6 (assertions PASS on intent-shaped numbers) but failed under v3.6.1's sampled-magnitude rule, which forced QA to verify each telemetry field's assignment site reads from the runtime graph. This is the first game where the sampled-magnitude rule demonstrably blocked telemetry-faking that v3.6 alone would have rubber-stamped.

Audio state lifecycle bit again — the ambient bed cut on death because `resetAudioState()` ran before `onStateEnter(DEATH)` had a chance to keep it alive, exposing a sequencing gap inside the v3.4 structural fix that itself was supposed to end this bug class. v3.4 chokepointed state changes through `setState()` and v3.5 added `resetAudioState()` discipline, but neither artifact distinguishes between continuous audio that *should* outlive a transition (ambient bed across PLAYING→DEATH) and continuous audio that *must* be torn down (thrust drone). Blanket-teardown semantics keep producing the same family of "background sound goes silent at the wrong moment" bug across games (Sea Wolf, Barrel Basher, Hex Beat, Cogsmith, Cadence, Conduit, Lighthouse Keeper, and now Void Drifter — 8+ shipped games in this class).

All 4 iteration-1 MAJORs shared a single failure shape — the automated/structural artifact reported correct while the actual behavior was wrong. The colorDelta perceptibility assertion PASSED at 43.8% while reading hardcoded spec constants instead of sampling rendered pixels (the assertion was self-confirming, not self-checking). The fence double-decrement had a code comment ("already decremented above") sitting one line above the duplicate decrement, and the deviation-log entry asserted "only one consumer at a time" while two consumers were in fact decrementing it. The BLAM 630ms hold and the never-displayed GREEN frame were both legal-looking sequences that a state-machine diagram approves of but a worked example would have caught. The shared anti-pattern is **self-attested correctness** — a comment, deviation-log entry, or telemetry value that asserts a property without proving it samples from runtime.

First magnum-opus pipeline game. The session-1 → session-2 hand-off worked because the CONTRACT.md IMMUTABLE block was specific enough to bind: exact hex codes (`bg=#1b1832 accent-1=#e8960a` ...), frame-accurate signature timing (1280ms total, 0/180/200/400/100/400 phase breakdown), exact physics overrides (WALK_SPEED=75, JUMP_VELOCITY=-220). Session-2 agents could not silently re-derive any of these. Aspirational mood words ("watercolor", "cool/warm contrast") would have been re-interpreted by session-2 agents into different concrete choices; specific hex codes can't be reinterpreted. QA item 17 (CONTRACT.md IMMUTABLE compliance) returned FULL PASS on every bound value across all 12 spot checks. Separately: hardcoded telemetry returned in QA Major 3 (`__test.emberPulseHz` returning the design constant 0.5 instead of measuring oscillator output) — the second instance in two weeks of an assertion that passes the test by reading the design constant. The Telemetry Provenance discipline proposed in death-circuit's diary is now landing as a recurring failure mode worth structural enforcement.

First cycle-2 magnum-opus build in studio history — the test of whether the IMMUTABLE block actually binds across a session boundary that *grows* the game rather than implements it. THESIS: VALIDATED. CONTRACT.md byte-diff vs cycle-1 SHA 6cb63ef returned empty body (only the `(cycle 1)` parenthetical added to the RATIFIED header). All 7 cycle-1 IMMUTABLE fields CONFIRMED, all 7 Identity Feel bullets CONFIRMED (5 cycle-1 regression + 2 cycle-2 first-time). Cycle 2 added two new verbs (dash, wall-jump), one new zone (4 screens), sunrise visual progression, and a watchtower scale curve fix — all without re-litigating cycle-1 identity decisions. Per-zone verb gating (`screen.zone === 2`) provided structural protection of cycle-1 solvability at zero conceptual complexity. Engine accretion: 5 candidates graduated (+176 lines, 3% engine-seed delta) — honest "low-leverage" verdict because soft-embers cycle 1 was already cleanly engine-vs-game separated. Dash + wall-jump verbs correctly REJECTED for engine graduation (one-game evidence insufficient). Zero new continuous gain nodes (all cycle-2 sfx are one-shots) — the safest cycle-N audio addition profile. The polish-default rule paid back for the second cycle in a row (cycle-1 iter-2: 35 lines / cycle-2 iter-2: 75 lines, both surgical). Separately: PA (a) was a textbook second instance of self-attested-correctness pattern — telemetry was sampled-from-runtime per v3.7.1 but measured the WRONG AXIS (spawn-relative instead of ember-relative). The threshold being loose (`> 1` instead of `≥ 18`) compounded it. v3.7.1 audit is necessary but not sufficient.

2nd magnum-opus game — first cycle-1 platformer reusing the Soft Embers engine seed. All 3 cycle-1 thesis tests landed: engine accretion VALIDATED (+91 lines, generic updateCameraFollow helper, zero game-specific bleed), vertical level grammar VALIDATED (engine layer worked first time; authored uniform staircase is a cycle-2 problem the structural test couldn't catch), new verb (entity-only time-slow) PARTIAL — works mechanically and all 5 Identity Feel bullets CONFIRMED but the playtester surfaced that crank-vs-patroller decision pressure is too weak. Identity Feel Contract caught visual hollowness (bullet 5: particle freeze missing on raw engine dt) but has no hook for gameplay-decision-pressure hollowness. v3.7.4 completability simulator earned its keep on the first pass — caught designer's first authoring as UNREACHABLE (deepest x=148, 2-tile vertical jump at engine limit), forcing a redesign. Player-agent infrastructure failed (image-API errors twice); completability gate provided clean substitute signal. v3.7.2 Spec-Subsection Coverage Audit PARTIAL — caught zero rows empty but missed sfx_jump (defined L1938, never called in updatePlayerPhysics jump-execution branch). Audit's `### N.N` granularity does not see line items inside subsection bullet lists. Same class as Soft Embers cycle-1's missing wisp-whoosh. Four instances of this oversight class across two magnum-opus games.

Cycle 2 of compass-apprentice — first cycle-2 magnum-opus platformer adding a new physics verb (DASH) post-v3.7.4 completability simulator gate. THESIS: VALIDATED. All 7 Identity Feel Contract bullets CONFIRMED (5 cycle-1 + 2 cycle-2). IMMUTABLE byte-identical to cycle-1 ship (palette, typography, time-slow params, control bindings, tile size, internal resolution). Cycle-1 zone-1 still solvable with cycle-1 verbs only (29-frame BFS path). Engine seed UNTOUCHED — engineAccretionLines: 0 (deferred per IMMUTABLE clause). Iteration 1 (P4.7) cleared 4 MAJORs (pedestal-tick pause bleed, handleCrankInput pedestal-context guard, old SPACE handler bypass, PA-10 ceremony audio UNMEASURABLE). Iteration 2 (P4.8) added dash_horizontal rig animation under 80-line cap. Major lesson: the completability simulator's regex contract for cycle-2 verb constants (DASH_VELOCITY no axis suffix, DASH_DURATION_MS in milliseconds, etc.) was undocumented — developer chose DASH_VELOCITY_X + seconds and discovered the mismatch by simulator failure at P4.5, requiring a __SIMULATOR_CYCLE2_CONTRACT shim. Player-agent image-API failed for the third time in a row across 2 magnum-opus games — completability simulator was the structural backstop. The discipline cycle (cycle 2) is arguably the more meaningful magnum-opus thesis test: cycle-1 introduces identity, cycle-2 proves it survives extension.

The Identity Feel Contract was the structural protector of the signature visual move — second magnum-opus in a row.**

The v3.7.6 simulator constant contract shim is now battle-tested across two consecutive magnum-opus cycle-2 games. Recommend a v3.7.8 proactive precheck.**

Fourth magnum-opus and the first to ship as a true cycle-1 *slice* — a half-game whose cycle-2 verbs (place-piton, rope-swing) are pre-locked in IMMUTABLE rather than discovered later, and the studio's first vertical-climb engine lineage (1766 lines forking the base-game chassis but inverting the platformer verb model: discrete grip-to-grip transitions, no continuous velocity, no jump arc). Two unproven hypotheses tested simultaneously — that locking cycle-2 verbs early prevents the IMMUTABLE-precondition-violation class (compass-apprentice cycle-2 bug A/B), and that the slice tier can absorb a brand-new engine genre at the cost of two genre-mismatched ship gates (`--completable`, `--journey` both auto-skipped). The single MAJOR (Signature Moment choir trigger geometrically unreachable: `summitRevealY = 24 - 120 = -96` against a camera Y clamped >= 0) was a game-internal formula carrying an implicit precondition about its own geometry — same class as compass-apprentice cycle-2's bug B turned inward, invisible to runtime tests because runtime tests don't reach segment 4. Iteration 2's 24-line pinnedTone polish closed the only weakly-confirmed Identity Feel Contract bullet (5/5 CONFIRMED-AT-SHIP). Player-agent image-API has now failed 4 consecutive cycles — no longer a per-game incident but a framework-level reliability gap.

**THESIS: VALIDATED.** Cycle 2 shipped the un-sliced magnum-opus build (drops `-slice` qualifier): zone 2 "The Cliff Above" with 4 mixed-width segments (320/320/640/480 px), both cycle-2 verbs (place-piton, rope-swing) implemented per cycle-1 IMMUTABLE LOCK, camera horizontal-follow extension, save persistence v0.5, and **218 lines of ENGINE ACCRETION** graduated from cycle-1 game.html into `engines/vertical-climb-engine.html` (1766 → 1984, +12.3%). All 14 IMMUTABLE clauses CONFIRMED at cycle-2 ship (camera extended per RATIFIED cycle-2 mechanism — IMMUTABLE itself byte-identical to cycle-1 ship `b43066b6`). All 5 cycle-1 IFC bullets CONFIRMED-WELL with zero regression; both 2 cycle-2 IFC bullets CONFIRMED-WELL. Falsifiability hypothesis structurally encoded in level data (Z2-S2 41.76 px gap > 40 px reach radius, bridgeable only via piton at exactly 40+40 px) — geometry IS the test, not a verbal claim. The cycle-1 → cycle-2 IMMUTABLE locked-verb pattern WORKED end-to-end as the prophylactic for the IMMUTABLE-precondition-violation class (compass-apprentice cycle-2 Bug B canonical case). HYBRID engine-accretion order (4 candidates BEFORE P4.2 + 1 candidate AFTER P4.10) bounded regression risk while producing measurable thesis ROI. v3.7.8 Game-Internal Formula Preconditions Audit PAID OFF in its first cycle-2 application — caught Z2-S4's summitRevealY at design-time before any code was written (cycle-1's same class was caught at QA-time). Substitute-signal protocol (geometric audit + runtime --play + designer hand-trace + IMMUTABLE byte-identity diff) matured to a 4-source playbook on its 5th consecutive successful application. Player-agent image-API failed for the 5th consecutive cycle (compass-apprentice ×2, lantern-descent cycle-2, pin-and-reach ×2) — framework-level reliability gap is now unmistakable. PA5 telemetry-provenance MAJOR caught at P4.6 (developer hardcoded `pitonSfxLastPeakGain = 0.45` for the new cycle-2 PA instead of runtime-sampling) shows v3.7.1 discipline doesn't auto-extend to cycle-2 PA additions.

I see two viable proposal targets, ranked by ROI:

Magnum-opus thesis VALIDATED on first 4-session game. Zero IMMUTABLE drift across cycles 1 + 2; 5/5 cycle-1 IFC bullets preserved; cycle-2 thesis test (zone-2-screen-2 UNREACHABLE without double-jump) verified by simulator + designer paper trace. v3.7.8 trigger-predicate rule VINDICATED on first under-the-rule test — all 3 cycle-2 IFC bullets fired on specified predicates without broader-precondition drift.