fix(ADR-0015): save/load determinism + migrate doom-assertion tests

- Quantize doom-adjacent live floats (streams, stocks, level, momentum) to a
  BINARY-EXACT grid (2^-20). Godot's JSON parse is not correctly-rounded
  (calibration section 7.2); power-of-two-grid doubles round-trip losslessly,
  so save/load + the "next turn identical" replay stay bit-stable. Sweep
  medians are byte-identical (grid ~1e-6, far below any gameplay scale).
- Migrate the doom-assertion unit tests to ADR-0015: safety_research/audit/
  team_building/desperation_lever assert intermediary writes (absorption),
  not a printed doom delta. test_liability_ledger detaches doom_system so the
  ledger's isolated synchronous-doom soak keeps its hand-rolled arithmetic.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: PipFoweraker

godot/scripts/core/doom_system.gd

@@ -142,13 +142,16 @@ func calculate_doom_change(state: GameState) -> Dictionary:
 
 	# (6) Integrate: the LEVEL accumulates the RATE. May FALL on net-negative ticks (legal —
 	#     "pulled something impressive off"). Clamp 0..100 is a display/lethality bound.
-	doom_rate = total_rate
-	current_doom += total_rate
-	current_doom = clamp(current_doom, 0.0, 100.0)
+	#     Snap the persisted scalars to the binary-exact grid (SAVE_QUANTUM) so save/load is
+	#     LOSSLESS (the "next turn identical" replay must match bit-for-bit — see SAVE_QUANTUM).
+	doom_rate = _snap(total_rate)
+	current_doom = _snap(clamp(current_doom + total_rate, 0.0, 100.0))
+	doom_velocity = _snap(doom_velocity)
+	doom_momentum = _snap(doom_momentum)
 
 	# (7) Publish the streams for L6 chips / dev overlay / sweep, and run the trend invariant.
 	doom_sources = streams
-	rate_history.append(total_rate)
+	rate_history.append(doom_rate)
 	_check_trend_invariant(state, streams)
 
 	return {
@@ -226,8 +229,20 @@ func _advance_intermediaries(state: GameState) -> void:
 	state.global_alarm *= _w("alarm_decay", 0.985)
 	state.global_panic *= _w("panic_decay", 0.97)
 
+	# --- Snap every persisted intermediary to the binary-exact grid (SAVE_QUANTUM). The decay
+	#     multiplies produce arbitrary-precision doubles that fail Godot's JSON parse round-trip
+	#     (§7.2); keeping the stocks on a power-of-two grid makes save/load LOSSLESS (the
+	#     "next turn identical" replay must match bit-for-bit). Gameplay-invisible (grid ~1e-6).
+	state.frontier_capability["player"] = _snap(float(state.frontier_capability["player"]))
+	state.safety_absorption = _snap(state.safety_absorption)
+	state.general_capability = _snap(state.general_capability)
+	state.dedicated_ai_compute = _snap(state.dedicated_ai_compute)
+	state.ambient_risk = _snap(state.ambient_risk)
+	state.global_alarm = _snap(state.global_alarm)
+	state.global_panic = _snap(state.global_panic)
+
 	# --- political_pressure tracks the alarm/panic balance (signed disposition; gate only).
-	state.political_pressure = state.global_alarm - state.global_panic
+	state.political_pressure = _snap(state.global_alarm - state.global_panic)
 
 func _compute_streams(state: GameState) -> Dictionary:
 	"""Read the intermediaries and produce the named hazard/relief streams (all Balance-priced).
@@ -463,29 +478,52 @@ func set_doom_multiplier(source: String, multiplier: float) -> void:
 # SERIALIZATION (save/load)
 # ============================================================================
 
+## Doom-adjacent float quantum — a BINARY-EXACT grid (2^-20 ≈ 9.5e-7). Godot's JSON parse
+## is not correctly-rounded (L1 calibration §7.2): a full-precision double can come back
+## from a save 1 ulp off, breaking save/load deep-equality. The fix is to keep every
+## doom-adjacent LIVE value on a power-of-two grid: snappedf(v, 2^-20) yields N·2^-20, which
+## is an exactly-representable double whose decimal string round-trips through Godot's parser
+## intact (0.25 survives, 0.008 does not — §7.2). A decimal quantum (1e-6) does NOT work: it
+## sits between representable doubles, so a 1-ulp parse drift can cross a snap boundary and
+## AMPLIFY into a full-quantum divergence. The grid is far below any gameplay scale (doom
+## deaths at 100, streams ~0.01–10), so the live dynamics are unaffected (sweep-verified).
+const SAVE_QUANTUM := 1.0 / 1048576.0  # == 2^-20, binary-exact (computed so the const is precise)
+
+static func _snap(v: float) -> float:
+	return snappedf(v, SAVE_QUANTUM)
+
+static func _snap_dict(d: Dictionary) -> Dictionary:
+	var out := {}
+	for k in d.keys():
+		out[k] = snappedf(float(d[k]), SAVE_QUANTUM)
+	return out
+
 func to_dict() -> Dictionary:
+	var hist: Array = []
+	for v in rate_history:
+		hist.append(_snap(v))
 	return {
-		"current_doom": current_doom,
-		"doom_rate": doom_rate,
-		"doom_velocity": doom_velocity,
-		"doom_momentum": doom_momentum,
-		"pending_rival_doom": _pending_rival_doom,
-		"pending_stream_inputs": _pending_stream_inputs.duplicate(),
-		"doom_sources": doom_sources.duplicate(),
-		"rate_history": rate_history.duplicate(),
+		"current_doom": _snap(current_doom),
+		"doom_rate": _snap(doom_rate),
+		"doom_velocity": _snap(doom_velocity),
+		"doom_momentum": _snap(doom_momentum),
+		"pending_rival_doom": _snap(_pending_rival_doom),
+		"pending_stream_inputs": _snap_dict(_pending_stream_inputs),
+		"doom_sources": _snap_dict(doom_sources),
+		"rate_history": hist,
 	}
 
 func from_dict(data: Dictionary) -> void:
-	current_doom = float(data.get("current_doom", 50.0))
-	doom_rate = float(data.get("doom_rate", 0.0))
-	doom_velocity = float(data.get("doom_velocity", 0.0))
-	doom_momentum = float(data.get("doom_momentum", 0.0))
-	_pending_rival_doom = float(data.get("pending_rival_doom", 0.0))
+	current_doom = _snap(float(data.get("current_doom", 50.0)))
+	doom_rate = _snap(float(data.get("doom_rate", 0.0)))
+	doom_velocity = _snap(float(data.get("doom_velocity", 0.0)))
+	doom_momentum = _snap(float(data.get("doom_momentum", 0.0)))
+	_pending_rival_doom = _snap(float(data.get("pending_rival_doom", 0.0)))
 	if data.has("pending_stream_inputs"):
-		_pending_stream_inputs = data["pending_stream_inputs"].duplicate()
+		_pending_stream_inputs = _snap_dict(data["pending_stream_inputs"])
 	if data.has("doom_sources"):
-		doom_sources = data["doom_sources"].duplicate()
+		doom_sources = _snap_dict(data["doom_sources"])
 	if data.has("rate_history"):
 		rate_history.clear()
 		for v in data["rate_history"]:
-			rate_history.append(float(v))
+			rate_history.append(_snap(float(v)))

godot/scripts/core/game_state.gd

@@ -813,6 +813,14 @@ static func format_score(turns: int, integral: int) -> String:
 # fidelity for mid-game save/load (and later DQ-11 fork/divergence).
 # ============================================================================
 
+static func _snap_array(arr) -> Array:
+	## Serialization-boundary float snap for arrays (see DoomSystem.SAVE_QUANTUM).
+	var out: Array = []
+	for v in arr:
+		out.append(DoomSystem._snap(float(v)))
+	return out
+
+
 func to_dict() -> Dictionary:
 	"""Serialize state for UI + save/load (see convention block above)"""
 	var rival_summaries = []
@@ -831,7 +839,7 @@ func to_dict() -> Dictionary:
 	var doom_data = {}
 	if doom_system:
 		doom_data = doom_system.to_dict()
-		doom_data["doom"] = doom
+		doom_data["doom"] = DoomSystem._snap(doom)
 		doom_data["doom_trend"] = doom_system._get_doom_trend()
 		doom_data["doom_status"] = doom_system.get_doom_status()
 		doom_data["momentum_description"] = doom_system.get_momentum_description()
@@ -874,18 +882,23 @@ func to_dict() -> Dictionary:
 		"ledger": ledger.to_dict() if ledger else {},
 		"month_plan": month_plan.to_dict() if month_plan else {},  # L1/ADR-0009 Attention + reserve + WIP
 		"cause_log": cause_log.duplicate(true),  # EE-8 attribution trail
-		"doom": doom,
-		"doom_history": doom_history.duplicate(),  # #512 trend graph
+		# Doom-adjacent floats are SNAPPED at the serialization boundary (both directions,
+		# same quantum as DoomSystem.SAVE_QUANTUM): the stream model produces full-precision
+		# doubles, and Godot's JSON parse is not correctly-rounded (calibration §7.2) — a
+		# 1-ulp corrupted parse re-snaps to the identical double, keeping save/load
+		# deep-equality byte-stable. Live dynamics never see the quantum.
+		"doom": DoomSystem._snap(doom),
+		"doom_history": _snap_array(doom_history),  # #512 trend graph
 		# ADR-0015 / DQ-21 world-state intermediaries (doom is computed from these)
-		"ambient_risk": ambient_risk,
-		"frontier_capability": frontier_capability.duplicate(),
-		"general_capability": general_capability,
-		"global_compute": global_compute,
-		"dedicated_ai_compute": dedicated_ai_compute,
-		"safety_absorption": safety_absorption,
-		"global_alarm": global_alarm,
-		"global_panic": global_panic,
-		"political_pressure": political_pressure,
+		"ambient_risk": DoomSystem._snap(ambient_risk),
+		"frontier_capability": DoomSystem._snap_dict(frontier_capability),
+		"general_capability": DoomSystem._snap(general_capability),
+		"global_compute": DoomSystem._snap(global_compute),
+		"dedicated_ai_compute": DoomSystem._snap(dedicated_ai_compute),
+		"safety_absorption": DoomSystem._snap(safety_absorption),
+		"global_alarm": DoomSystem._snap(global_alarm),
+		"global_panic": DoomSystem._snap(global_panic),
+		"political_pressure": DoomSystem._snap(political_pressure),
 		"doom_dampers": doom_dampers.duplicate(true),
 		"doom_pulses": doom_pulses.duplicate(true),
 		"sacred_chain_log": sacred_chain_log.duplicate(true),
@@ -910,7 +923,7 @@ func to_dict() -> Dictionary:
 		"management_capacity": get_management_capacity(),
 		"unmanaged_count": get_unmanaged_count(),
 		"turn": turn,
-		"doom_integral": doom_integral,
+		"doom_integral": DoomSystem._snap(doom_integral),
 			"turn_display": get_turn_display(),
 		"calendar": get_current_date(),
 		"game_over": game_over,
@@ -955,22 +968,24 @@ func from_dict(data: Dictionary) -> void:
 	papers = float(data.get("papers", 0.0))
 	reputation = float(data.get("reputation", 10.0))
 	governance = float(data.get("governance", 50.0))  # was forgotten pre-L7
-	doom = float(data.get("doom", 50.0))
+	# Doom-adjacent floats re-snap on load (idempotent under the 1-ulp JSON parse
+	# corruption — see the to_dict comment + DoomSystem.SAVE_QUANTUM).
+	doom = DoomSystem._snap(float(data.get("doom", 50.0)))
 	doom_history.clear()
 	for d in data.get("doom_history", []):
-		doom_history.append(float(d))
+		doom_history.append(DoomSystem._snap(float(d)))
 	# ADR-0015 / DQ-21 world-state intermediaries
-	ambient_risk = float(data.get("ambient_risk", Balance.num("doom.base_per_turn", 0.06)))
-	frontier_capability = (data.get("frontier_capability", {"player": 0.0}) as Dictionary).duplicate()
+	ambient_risk = DoomSystem._snap(float(data.get("ambient_risk", Balance.num("doom.base_per_turn", 0.06))))
+	frontier_capability = DoomSystem._snap_dict(data.get("frontier_capability", {"player": 0.0}) as Dictionary)
 	if not frontier_capability.has("player"):
 		frontier_capability["player"] = 0.0
-	general_capability = float(data.get("general_capability", 0.0))
-	global_compute = float(data.get("global_compute", 0.0))
-	dedicated_ai_compute = float(data.get("dedicated_ai_compute", 0.0))
-	safety_absorption = float(data.get("safety_absorption", 0.0))
-	global_alarm = float(data.get("global_alarm", 0.0))
-	global_panic = float(data.get("global_panic", 0.0))
-	political_pressure = float(data.get("political_pressure", 0.0))
+	general_capability = DoomSystem._snap(float(data.get("general_capability", 0.0)))
+	global_compute = DoomSystem._snap(float(data.get("global_compute", 0.0)))
+	dedicated_ai_compute = DoomSystem._snap(float(data.get("dedicated_ai_compute", 0.0)))
+	safety_absorption = DoomSystem._snap(float(data.get("safety_absorption", 0.0)))
+	global_alarm = DoomSystem._snap(float(data.get("global_alarm", 0.0)))
+	global_panic = DoomSystem._snap(float(data.get("global_panic", 0.0)))
+	political_pressure = DoomSystem._snap(float(data.get("political_pressure", 0.0)))
 	doom_dampers = (data.get("doom_dampers", []) as Array).duplicate(true)
 	doom_pulses = (data.get("doom_pulses", []) as Array).duplicate(true)
 	sacred_chain_log = (data.get("sacred_chain_log", []) as Array).duplicate(true)
@@ -990,7 +1005,7 @@ func from_dict(data: Dictionary) -> void:
 
 	# Game state
 	turn = int(data.get("turn", 0))
-	doom_integral = float(data.get("doom_integral", 0.0))
+	doom_integral = DoomSystem._snap(float(data.get("doom_integral", 0.0)))
 	game_over = bool(data.get("game_over", false))
 	victory = bool(data.get("victory", false))
 	has_cat = bool(data.get("has_cat", false))

godot/tests/unit/test_actions.gd

@@ -95,15 +95,19 @@ func test_hire_alignment_researcher_execution():
 	assert_eq(state.get_researcher_count_by_spec("alignment"), before + 1, "Alignment researcher should join")
 
 func test_safety_research_execution():
-	# Test safety research action - doom reduction scales with safety_researchers count
-	# Need at least 1 safety researcher for any doom reduction
+	# ADR-0015: no action writes doom. Safety research raises the safety_absorption
+	# intermediary (Balance-scaled); the overhang stream converts it on the doom tick.
 	state.safety_researchers = 1
 	state.research = 20.0  # Ensure enough research to pay cost
 	var initial_doom = state.doom
+	var initial_absorb = state.safety_absorption
 
 	var result = GameActions.execute_action("safety_research", state)
 
-	assert_lt(state.doom, initial_doom, "Doom should decrease when safety researchers > 0")
+	assert_eq(state.doom, initial_doom, "No printed doom delta (ADR-0015)")
+	assert_almost_eq(state.safety_absorption,
+		initial_absorb + 1.0 * Balance.num("doom.streams.action_safety_absorb", 0.0), 0.0001,
+		"Safety research raises safety_absorption by the Balance-priced amount")
 
 func test_team_building_execution():
 	# Test team building action
@@ -113,7 +117,7 @@ func test_team_building_execution():
 	var result = GameActions.execute_action("team_building", state)
 
 	assert_gt(state.reputation, initial_reputation, "Reputation should increase")
-	assert_lt(state.doom, initial_doom, "Doom should decrease")
+	assert_eq(state.doom, initial_doom, "No printed doom delta (ADR-0015)")
 
 func test_media_campaign_execution():
 	# Test media campaign action
@@ -170,8 +174,8 @@ func test_safety_audit_execution():
 
 	var result = GameActions.execute_action("audit_safety", state)
 
-	# Safety audit should reduce doom and increase reputation
-	assert_lt(state.doom, initial_doom, "Doom should decrease")
+	# ADR-0015: the audit raises safety_absorption (Balance-priced), never doom directly
+	assert_eq(state.doom, initial_doom, "No printed doom delta (ADR-0015)")
 	assert_gt(state.reputation, initial_reputation, "Reputation should increase")
 
 func test_action_execution_returns_result():

godot/tests/unit/test_ledger_actions.gd

@@ -23,11 +23,18 @@ func test_funding_strings_bills_governance():
 	assert_eq(s.money, before + 40000, "funding pays out")
 	assert_eq(s.ledger.entries[0].currency, "governance", "strings bill in governance")
 
-func test_desperation_lever_suppresses_doom_and_plants_secret():
+func test_desperation_lever_plants_secret_without_printed_doom():
+	# ADR-0015: no action writes doom. The lever's catch-up benefit is now a
+	# safety_absorption reprieve (Balance doom.streams.action_desperation_absorb,
+	# priced 0 in v1); the SECRET compounding liability (the real teeth) is unchanged.
 	var s = _fresh_state()
 	var before_doom = s.doom
+	var before_absorb = s.safety_absorption
 	GameActions.execute_action("desperation_lever", s)
-	assert_lt(s.doom, before_doom, "desperation suppresses doom now")
+	assert_eq(s.doom, before_doom, "no printed doom delta (ADR-0015)")
+	assert_almost_eq(s.safety_absorption,
+		before_absorb + Balance.num("doom.streams.action_desperation_absorb", 0.0), 0.0001,
+		"the catch-up benefit is a Balance-priced absorption reprieve")
 	assert_eq(s.ledger.secret_entries().size(), 1, "desperation plants a SECRET liability")
 
 func test_staff_rider_grants_ap_and_rider():

godot/tests/unit/test_liability_ledger.gd

@@ -12,6 +12,15 @@ func _fresh_state(seed_str: String):
 	s.money = 245000.0
 	s.governance = 50.0
 	s.reputation = 50.0
+	# ADR-0015: these tests exercise the LEDGER's own conversion contract in isolation
+	# (synchronous doom arithmetic, controlled soak). With a doom_system attached the
+	# ledger routes doom as a buffered STREAM INPUT (applied on the next doom tick) —
+	# correct in the real loop, but it would decouple the soak's hand-rolled doom math.
+	# Detach the authority so Ledger._add_doom takes its documented lightweight-double
+	# fallback (state.doom +=). Stream routing is covered by test_doom_system + the sweep.
+	if s.doom_system:
+		s.doom_system.free()
+		s.doom_system = null
 	return s
 
 

godot/tests/unit/test_turn_manager.gd

@@ -434,21 +434,26 @@ func test_insider_threat_key_resignation_removes_a_researcher():
 	assert_string_contains(joined, "Fickle Fran", "Departure is named in the risk-event log line")
 
 func test_insider_threat_key_resignation_safe_with_no_researchers():
-	# No researchers on staff -> the scalar effects (research/reputation/doom)
-	# still apply, but the staffing loss is a safe no-op (no crash, no phantom note).
-	# Doom for risk events routes through state.doom_system (synced to state.doom
-	# later in the turn pipeline, not within _step_process_risk_pools itself), so
-	# assert on doom_system.current_doom directly rather than state.doom.
+	# No researchers on staff -> the scalar effects (research/reputation/doom) still apply,
+	# but the staffing loss is a safe no-op (no crash, no phantom note).
+	# ADR-0015: a risk shock's doom is not a direct level write — it routes as a buffered
+	# `panic` STREAM INPUT (add_event_doom -> add_stream_input) that the DoomSystem folds into
+	# the rate on the next tick. So it lands as a pending panic input here, not on current_doom.
 	assert_eq(state.researchers.size(), 0, "Start empty")
 	var initial_reputation = state.reputation
-	var initial_doom: float = state.doom_system.current_doom if state.doom_system else state.doom
 
 	state.risk_system.pools["insider_threat"] = 55.0
 
 	var results: Array = []
 	turn_manager._step_process_risk_pools(results)
 
 	assert_eq(state.researchers.size(), 0, "Nobody to remove, nobody removed")
-	var after_doom: float = state.doom_system.current_doom if state.doom_system else state.doom
-	assert_gt(after_doom, initial_doom, "Scalar doom effect still applies")
+	var pending_panic: float = float(state.doom_system._pending_stream_inputs.get("panic", 0.0)) if state.doom_system else 0.0
+	assert_gt(pending_panic, 0.0, "Risk-shock doom routes to a buffered panic stream input (ADR-0015)")
+	# Confirm it actually LANDS on the next doom tick (raising the level).
+	var before_level: float = state.doom_system.current_doom if state.doom_system else state.doom
+	if state.doom_system:
+		state.doom_system.calculate_doom_change(state)
+	var after_level: float = state.doom_system.current_doom if state.doom_system else state.doom
+	assert_gt(after_level, before_level, "the buffered risk shock lands on the next tick")
 	assert_lt(state.reputation, initial_reputation, "Scalar reputation effect still applies")