docs: repair onboarding presentation flow

docs/presentation/SCREEN_AND_STATE_MAP.md

@@ -40,6 +40,7 @@ UI must not substitute a guessed number, price, formula, or probability.
 |---|---|---|---|
 | `BIND:RUN_PHASE` | current loop step and legal destinations | core systems | named phase plus `Rules pending integration` in design fixtures |
 | `BIND:DIFFICULTY_RULES` | run setup options, consequences, and postgame compatibility | difficulty/core systems | Begin remains disabled until resolved |
+| `BIND:PROVISIONAL_RECRUIT_OFFERS` | one stable four-offer set, generated Recruit fields, selected stable IDs, and run-creation receipt | recruitment/save | `SYS-005` cannot create a run until exactly four unique complete offers resolve |
 | `BIND:RUN_RESOURCES` | balances, deltas, affordability | economy | label and non-numeric placeholder |
 | `BIND:SHOP_OFFERS` | available recruit and item offers | shop/content | structurally complete sample rows with no authoritative values |
 | `BIND:SHOP_REFRESH` | refresh cost, limit, result policy | economy/shop | disabled action with binding name |
@@ -146,7 +147,7 @@ focus order plus pointer shortcuts; no workflow depends on hover.
 | `NAV` | tap destination; horizontal swipe is optional | directional focus; shoulder buttons change top-level destination | focus enters heading then primary content; Cancel returns to parent |
 | `LIST` | tap row; drag scroll; long press opens the same inspect action | vertical focus; left/right changes defined filter or comparison target | virtualization preserves logical focus by stable item ID |
 | `SELECT` | tap option then explicit action | focus option, South selects, South on primary commits review | selection is not commitment; Cancel clears selection first |
-| `ORDER` | tap recruit then destination; drag is optional | select recruit, move focus, confirm destination; bumpers shift one place | undo is available until readiness commitment |
+| `ORDER` | tap Recruit then destination; drag is optional; left moves toward protected rear and right toward exposed front | select Recruit, move focus left/rear or right/front, confirm destination; bumpers shift one logical position | undo is available until readiness commitment; position `0` remains the rightmost exposed front |
 | `BATTLE` | tap actor/event to inspect; dedicated pause and speed controls | bumpers cycle actors/events; face buttons open inspect and pause | focus never enters moving world elements; closing inspect resumes prior playback state |
 | `MODAL` | tap explicit action; destructive hold duration is setting-aware | focus starts on Cancel; destructive action requires second explicit input or hold | Cancel spends nothing and returns focus to invoker |
 | `SETTINGS` | native toggle, segmented control, slider, menu, remap row | predictable row navigation; left/right adjusts; South activates | uncommitted changes prompt Apply/Discard on exit |
@@ -169,11 +170,52 @@ that are not expected to be empty during ordinary play.
 | `SYS-002` First-launch setup / `SETTINGS` | Establish language, safe area, 100/115/130% text, contrast, reduced motion/flashes, captions, and input prompts. | Apply settings; writes preferences only. | Missing locale falls back to sourced English text and names the missing pack. Loading renders the preview inline with text status. | Invalid safe area or unavailable output is explained. Apply review lists changed accessibility settings. | Device change refreshes prompts without reset. No Back until one usable preset has been applied; later visits return to caller. |
 | `SYS-003` Title / `NAV` | Identify the game, current safe resume state, save health, and legal entry paths. | Continue; opens `SYS-006` and does not immediately advance simulation. | No run promotes New Run. Loading affects only the run summary and keeps Settings usable. | Save warning links to `SYS-007`; offline optional service warning does not block local play. No confirmation. | Suspend returns to the same selection. Back invokes platform exit review; child pages return here. |
 | `SYS-004` Run ledger / `LIST` | Inspect run slots, last safe state, play time, difficulty, and health. | Open selected run; opens resume or recovery review. | No runs explains New Run. Loading uses per-slot skeletons with slot names retained. | Corrupt, incompatible, conflict, and migration states name their safe next action. Delete and overwrite require `SYS-005` or `SET-009` review. | Refresh or cloud interruption keeps the last verified local list. Back returns to Title. |
-| `SYS-005` New run setup / `SELECT` | Choose sourced difficulty and initial options without making the opening plan for the player. | Begin run; creates a run then enters Guild desk. | Missing difficulty binding disables Begin with source reason. Loading previews locally. | Slot collision, unsupported ruleset, or write failure preserves choices. Begin review states difficulty, irreversible options, and slot. | Suspend saves the uncommitted form. Back returns to the run ledger with no run created. |
+| `SYS-005` New run setup / `SELECT` | Review Contract/difficulty, then inspect and compare four stable provisional generated Recruit offers and choose exactly two at no Coin cost before run creation. | With exactly two selected, Review Company opens the creation review; Create Run commits those two stable Recruit IDs, leaves the other two unretained, creates the run, and opens the first Market. | Empty or non-four offer output is invalid, not a legal empty choice. Loading shows four fixed positions, the named operation, and no selectable identity until its stable ID and required fields resolve. | Duplicate IDs, missing Profession/Trait cost, stale offer-set revision, slot collision, unsupported ruleset, or creation failure blocks commit with retained safe setup. Review names both selected Recruits, the two unchosen offers, no-Coin cost, slot, difficulty, and `Revise Recruits`; zero, one, three, or four selected cannot open review. | Touch and controller can inspect, compare, toggle, revise, cancel, and create without drag. Suspend preserves the verified offer-set ID and selected stable IDs without creating a run; resume revalidates the same set. Back before commit returns to Run Ledger; interruption after receipt resumes at the first Market. |
 | `SYS-006` Resume review / `SELECT` | Explain current phase, last committed transaction, unresolved consequence, and resume destination. | Resume; enters the exact safe state from `BIND:SAVE_STATE`. | No active run offers Run Ledger. Loading shows the saved destination name. | Invalid snapshot routes to Save Recovery. Resuming battle requires explicit review of playback state. | Suspend changes nothing. Back returns to Title or Run Ledger, whichever invoked it. |
 | `SYS-007` Save recovery / `SELECT` | Compare valid save lineage, migration, conflict, and known lost interval. | Load selected valid state; changes active lineage and records a receipt. | No valid recovery offers diagnostics and safe deletion path. Loading validates and names each candidate. | Failed recovery cannot overwrite the last valid source. Selection review lists timestamp, ruleset, lost interval, and reversibility. | Suspend retains candidates but makes no choice. Back returns to Run Ledger. |
 | `SYS-008` Credits, licenses, and data notice / `LIST` | Present authorship, licenses, privacy, local/offline behavior, and external-link policy. | Open section; no run consequence. | No search result offers Clear Search. Loading long text retains the current local section. | Missing license is a blocking production defect with diagnostics. External links require destination confirmation. | Suspend preserves scroll position. Back returns to the invoking Title or Settings screen. |
 
+#### 5.1.1 `SYS-005` Staged-State Contract
+
+`SYS-005` is one player-facing page with staged states. Stage changes preserve
+the page ID, safe-area layout, offer-set ID, selected stable IDs, and focus
+history; they do not create hidden pages or increment the 50-page inventory.
+
+| Stage | First-viewport surface | Primary action | Required boundary and return |
+|---|---|---|---|
+| `A` Contract setup | selected Contract, enemy families, boss rule, reward breadth, difficulty consequence, target slot | Load Provisional Offers | no Recruit is selected or generated by a tutorial recommendation; Back returns to Run Ledger |
+| `B` Four-offer choice | four equally weighted stable offer markers; generated name, base Profession job, Trait benefit/cost, rolled read, default equipment read, `No Coin cost`; selected count `0/2..2/2` | Review Company, enabled only at `2/2` | Inspect changes no selection; Compare accepts any two offer IDs; selecting a third is rejected until one current selection is cleared |
+| `C` Creation review | the two selected Recruits together, two explicitly unchosen offer IDs, Contract/difficulty/slot, no-Coin transaction, first-Market handoff | Create Run | `Revise Recruits` returns to stage `B` with the same four offers and two selections; Cancel changes nothing |
+| `D` Pending creation | stable two-Recruit summary, named creation operation, progress and Cancel only when save authority permits | none while pending | duplicate Create input is ignored; failure returns to stage `C` with no run and no changed offer set |
+| `E` Receipt and handoff | created run receipt, selected two as living Company, opening Line capacity, first-Market objective | Open First Market | the two unchosen offers are not retained; first Market must expose two affordable base-Profession hire opportunities without auto-selecting either |
+
+Every offer exposes `BIND:RECRUIT_SCHEMA` through one common comparison order:
+generated name, base Profession job and target/reach responsibility, Trait
+benefit, Trait cost, rolled attribute distribution, default Profession
+equipment, and stable offer ID. Rarity, portrait prominence, offer position,
+animation, or a tutorial highlight cannot imply a recommended opening pair.
+
+Required invalid and interruption states:
+
+- zero, one, two, three, or more than four returned offer rows are an invalid
+  source result; the page shows expected `4`, received count, Retry Same Set,
+  and Return to Run Ledger, with Create Run unavailable;
+- duplicate stable IDs, unresolved Profession, unresolved Trait benefit/cost,
+  or incompatible content revision marks the affected offer and blocks all
+  selection commitment;
+- before any stable IDs resolve, loading reserves four positions but exposes no
+  generated identity; after an ID resolves, sort/filter/animation cannot move
+  it to another position;
+- suspending stages `B` or `C` stores no run creation receipt. Resume restores
+  the same verified offer-set ID, selections, comparison pair, and focus. If
+  that set cannot be verified, a recoverable error replaces the choice; the UI
+  never silently rolls four new offers; and
+- `LOC:PROVISIONAL_SELECTED_COUNT`, `LOC:PROVISIONAL_NO_COIN_COST`,
+  `LOC:PROVISIONAL_UNCHOSEN_NOT_RETAINED`, `LOC:REVISE_PROVISIONAL_RECRUITS`,
+  and every Profession/Trait comparison require English (`en`) and Simplified
+  Chinese (`zh_CN`) fixtures at 100/115/130% without obscuring selection,
+  Inspect, Compare, Back, or Create Run.
+
 ### 5.2 Guild, Shop, And Recruits
 
 | ID / screen / input | Purpose | Primary action and consequence | Empty / loading | Error / confirmation | Interruption / return |
@@ -194,8 +236,8 @@ that are not expected to be empty during ordinary play.
 | `EQP-001` Equipment workbench / `LIST` | Equip a selected recruit while showing eligible inventory and sourced behavior changes. | Equip selected item; changes loadout only after comparison review. | No owned items points to Shop. No eligible item explains profession/slot requirements. Loading retains current loadout. | Incompatible, already used, stale inventory, or ruleset error blocks commit with reason. Confirmation states replaced item, conflicts, and before/after behavior. | Suspend before receipt keeps the old loadout; resume reconciles receipt. Back returns to Recruit Detail or Party Line caller. |
 | `EQP-002` Item comparison / `SELECT` | Compare current and candidate item in the vocabulary used by party preview, battle, and results. | Apply candidate; returns to workbench with changed effects highlighted. | Empty candidate keeps current item and offers Choose Item. Loading never clears current values. | Unknown derived effect is labeled unresolved and blocks Apply when consequence-critical. Confirmation lists all sourced changes and affected saved plan references. | Suspend keeps comparison but performs no equip. Back returns to Equipment with selection intact. |
 | `ART-001` Active artifact ledger / `LIST` | Inspect run-wide artifact rules, acquisition source, interactions, conflicts, and lifecycle without treating them as recruit equipment. | Inspect artifact; changes nothing unless `BIND:ARTIFACT_RULES` supplies a separate legal action. | No active artifacts explains their sourced acquisition route. Loading retains verified active rules. | Missing or conflicting artifact references identify stable IDs and block dependent commitment. Any lifecycle-changing action requires a separate sourced confirmation. | Suspend preserves selection. Back returns to Guild desk or the Reward caller. |
-| `PTY-001` Party line / `ORDER` | Select simultaneous Recruits and order them from first exposure to last, with sourced targeting, protection, reach, healing, movement, and replacement previews. | Save order; changes the prepared party snapshot but does not start battle. | Zero live Recruits is a casualty/Company-collapse settlement state and routes to sourced recovery or run close; ordinary dismissal never creates it. No eligible deployable Recruit explains the recovery or roster reason. Loading preserves last committed order. | Invalid count, duplicate Recruit, incompatible state, or stale capacity identifies the exact position. Confirmation is required only when removing a currently prepared Recruit has a sourced consequence. | Suspend stores only the last committed order; uncommitted moves are offered to Restore or Discard. Back returns to Guild desk. |
-| `PTY-002` Readiness review / `SELECT` | Summarize prepared recruits, order effects, equipment issues, known pressure coverage, reserve state, and `BIND:PARTY_CAPACITY`. | Accept preparation; records a reviewable battle-plan snapshot. | Empty party blocks acceptance and points to Add Recruits. Loading verifies all stable IDs. | Invalid or outdated effect opens the owning edit screen. Confirmation states warnings that are allowed but does not overstate outcome prediction. | Suspend preserves the last accepted snapshot. Back returns to Party Line. |
+| `PTY-001` Party line / `ORDER` | Select simultaneous Recruits on one visual line from protected rear at left to exposed front at right, with position `0` at the front and larger numbers extending leftward; preview sourced targeting, protection, reach, healing, movement, and replacement changes. | Save order; changes the prepared party snapshot but does not start battle. | Zero live Recruits is a casualty/Company-collapse settlement state and routes to sourced recovery or run close; ordinary dismissal never creates it. No eligible deployable Recruit explains the recovery or roster reason. Loading preserves last committed order and rear-left/front-right endpoints. | Invalid count, duplicate Recruit, incompatible state, or stale capacity identifies the exact numbered position. Confirmation is required only when removing a currently prepared Recruit has a sourced consequence. | Suspend stores only the last committed order; uncommitted moves are offered to Restore or Discard. Back returns to Guild desk. |
+| `PTY-002` Readiness review / `SELECT` | Summarize the frozen rear-left/front-right order, position numbers, protection contributors toward the right/front, equipment issues, known pressure coverage, Reserve state, and `BIND:PARTY_CAPACITY`. | Accept preparation; records a reviewable battle-plan snapshot. | Empty party blocks acceptance and points to Add Recruits. Loading verifies all stable IDs without reversing visual order. | Invalid or outdated effect opens the owning edit screen. Confirmation states warnings that are allowed but does not overstate outcome prediction. | Suspend preserves the last accepted snapshot. Back returns to Party Line. |
 | `RSK-001` Risk board / `SELECT` | Compare sourced risk options by known pressure, uncertainty, entry cost, reward class, recovery exposure, and current party coverage. | Review selected risk; selection alone changes nothing. | No legal option explains whether preparation, progression, or recovery is required. Loading retains accepted party summary. | Unresolved or stale option cannot be committed. No confirmation until `RSK-002`. | Suspend preserves selection only locally. Back returns to Guild desk. |
 | `RSK-002` Risk commitment / `MODAL` | Present the chosen option, known threats, uncertainty, cost, reward class, retreat implication, and frozen party snapshot. | Begin battle; commits the sourced risk transaction and opens Battle Opening. | Missing party snapshot or option returns to the owning screen. Loading verifies all dependencies. | Stale resources, changed recruit state, or invalid rule reopens the changed source. Confirmation is the page's purpose and names irreversible effects. | Suspend before receipt changes nothing; after receipt resumes at Battle Opening. Cancel returns to Risk Board. |
 
@@ -203,7 +245,7 @@ that are not expected to be empty during ordinary play.
 
 | ID / screen / input | Purpose | Primary action and consequence | Empty / loading | Error / confirmation | Interruption / return |
 |---|---|---|---|---|---|
-| `BAT-001` Battle opening / `BATTLE` | Establish objective, ordered party, enemy order, first known threat, playback speed, and inspection affordance. | Start observation; releases the deterministic timeline. | Missing actor data blocks start and names the binding. Loading shows verified actor silhouettes and progress. | Snapshot mismatch returns safely to Risk Commitment or Resume Review. Start needs explicit input only on first onboarding or resumed state. | Suspend preserves an unopened snapshot. Back is disabled after risk commitment; Pause offers legal exits. |
+| `BAT-001` Battle opening / `BATTLE` | Establish objective, player order from protected rear at left to position `0` exposed front at right, enemy-facing direction, first known threat, playback speed, and inspection affordance. | Start observation; releases the deterministic timeline. | Missing actor data blocks start and names the binding. Loading shows verified actor silhouettes, position markers, and progress. | Snapshot mismatch returns safely to Risk Commitment or Resume Review. Start needs explicit input only on first onboarding or resumed state. | Suspend preserves an unopened snapshot. Back is disabled after risk commitment; Pause offers legal exits. |
 | `BAT-002` Live battle / `BATTLE` | Make automatic resolution readable: current objective, urgent cause, actor state, target relation, event sequence, pause, speed, inspect, and retreat access. | Inspect the highlighted cause; battle decisions are diagnostic controls only. | No current event shows `Waiting for next event`, not a blank field. Loading occurs only during safe resume and the timeline does not advance. | Invalid event data pauses and offers Retry Snapshot or Safe Exit. Speed change needs no confirmation; retreat is separated. | Backgrounding or device loss freezes according to save rules and routes to `BAT-006`. Closing inspect restores the prior legal playback state. |
 | `BAT-003` Actor and event inspect / `BATTLE` | Explain selected actor, action, target, status source, order interaction, equipment contribution, and causal neighbors. | Pin event or close; changes no battle result. | No related event states why. Loading pauses inspect data at the selected event ID. | Hidden information states the discovery rule; missing required cause pauses with diagnostics. No confirmation. | Suspend routes to Resume Review with the selected event remembered. Back closes inspect to Live Battle. |
 | `BAT-004` Pause and speed / `BATTLE` | Freeze observation where rules allow, expose playback options, settings, event log, controls, and retreat entry. | Resume; restores the selected legal speed. | No speed alternatives shows one sourced speed. Loading settings does not resume time. | Disallowed speed explains the rule. Applying settings may require its own Apply/Discard review. | App suspend remains paused. Back resumes only when the player explicitly chooses Resume; Settings returns here. |
@@ -310,17 +352,24 @@ one decision at a time and never completes a build choice for the player.
 
 | Moment | Base screen | Teaching focus | Completion evidence | Skip/return behavior |
 |---|---|---|---|---|
-| First launch | `SYS-002` | language, text preview, reduced motion/flashes, captions | one usable preset applied | cannot skip before usable settings; later returns to Title |
-| Opening choice | `SHP-001/002` | compare a small sourced offer set by profession and trait tradeoff | player inspects then recruits one legal offer | skip hides callouts, never picks an offer |
-| First preparation | `EQP-001/002` | one behavior-changing equipment comparison | player identifies before/after behavior | back returns to Recruit Detail |
-| First order | `PTY-001` | move one recruit and read changed exposure/reach preview | tap-select/tap-destination or controller move completed | drag is never required |
-| First risk | `RSK-001/002` | known pressure, uncertainty, cost, and recovery exposure | player reviews and commits a legal option | no recommended option is auto-selected |
-| First battle | `BAT-001/002/003` | observe target choice, pause, inspect one cause | player opens a causal explanation | speed remains sourced; no combat action prompt |
-| First result | `OUT-001` | locate earliest divergence and downstream consequence | player follows one cause chain | Continue remains available after review |
-| First casualty | `OUT-002/004` | distinguish committed loss from the next recovery decision | player acknowledges receipt and inspects legal recovery | no loss is silently undone |
+| Before `0:00` | `SYS-002` | language, text preview, reduced motion/flashes, captions | one usable preset applied | cannot skip before usable settings; later returns to Title |
+| `0:00-1:00` provisional Company | `SYS-005` stages `A-C` | inspect four stable offers, compare Profession jobs and Trait costs, choose exactly two, then review both together | player states one Profession job and one Trait cost and reaches creation review at `2/2` | skip hides teaching layers only; it never preselects, recommends, removes, or commits an offer |
+| `1:00` run creation | `SYS-005` stages `D-E` | confirm selected two, unchosen-not-retained consequence, Contract/difficulty, and first-Market handoff | one run-creation receipt owns exactly the selected two and opens the first Market | `Revise Recruits` remains legal before commit; interruption resumes the same pending/receipt boundary |
+| `1:00-3:00` first Market hires | `SHP-001/002` | inspect the protected affordable base-Profession opportunities and complete two separate hire reviews | two hire receipts move opening Company from two owned Recruits to filled Line capacity four; player distinguishes Line capacity from owned Company | no offer is auto-selected or labeled correct; skip removes callouts but never buys, refreshes, locks, or spends |
+| `3:00-5:00` first order | `PTY-001` | swap protected rear-left and exposed front-right Recruits and read changed targets/protection/reach | tap-select/tap-destination or controller move completed; player identifies position `0` at right/front and who protects whom | drag is never required and the original order can be restored before commit |
+| `5:00-7:00` first risk | `RSK-001/002` | known pressure, uncertainty, cost, and recovery exposure | player reviews and commits a legal option | no recommended option is auto-selected |
+| `7:00-9:00` first battle | `BAT-001/002/003` | observe target choice, pause, inspect one cause | player opens a causal explanation | speed remains sourced; no combat action prompt |
+| `9:00-12:00` first result/adaptation | `OUT-001/003` and `EQP-001/002` | locate earliest divergence, choose reward, and compare one behavior-changing equipment/order adaptation | player follows one cause chain and identifies a before/after behavior | Continue remains available after review; no build change is applied without commit |
+| `12:00-16:00` first casualty | `OUT-002/004` | distinguish committed loss, equipment return, and Credit from the next recovery decision | player acknowledges receipt and inspects legal recovery | training fixture grants no persistent reward or death; no loss is silently undone |
+| `16:00-20:00` independent Round | production screens | buy, order, commit, and diagnose without a pointer | one complete independent Round | one no-reward reset is available before commitment when supplied by product rules |
 | First final-survivor dismissal attempt | `REC-002` | explain why ordinary dismissal is disabled and where explicit run abandonment lives | player dismisses the explanation or opens `OUT-006` | disabled action changes nothing and does not auto-open confirmation |
-| First reward | `OUT-003` | compare changed decisions, not rarity alone | player claims one sourced option | skip only when product rules allow it |
-| First adaptation | `HUB-001` | highlight what changed in Shop, Roster, Equipment, Party Line, and Risk | player opens any affected preparation page | all teaching highlights end after one independent loop |
+
+The `SYS-005 -> SHP-001` handoff preserves the two selected stable Recruit IDs,
+shows opening Company `2` separately from Line capacity `4`, and points to the
+first hire decision without choosing an offer. After each authoritative hire
+receipt, the same status region updates `Company 2 | Line capacity 4` to
+`Company 3 | Line capacity 4`, then `Company 4 | Line capacity 4`; the two-step
+progress is never faked by a tutorial-only counter or a combined purchase.
 
 After repeated failure, Result may offer a replayable explanation or training
 surface only if supplied by product rules. It may identify the earliest
@@ -351,6 +400,19 @@ transaction status stay in the first viewport. Battle inspection becomes a
 pauseable full-screen linear view when a side drawer would make actors
 unreadable.
 
+`SYS-005` keeps all four stable offer markers, selected count, Inspect/Compare,
+Back, and the disabled/enabled Review Company state visible at 130%. On a short
+landscape phone the four markers use a fixed `2 x 2` arrangement and selected
+detail replaces the secondary region; on tablet/reference they use one fixed
+four-offer row. Text growth never hides an offer, changes offer order, or makes
+Create Run appear before the review stage.
+
+The visual Party line is not mirrored by locale: protected rear remains left,
+exposed front and position `0` remain right, and larger position numbers extend
+left in both `en` and `zh_CN`. Text labels, front/rear icons, protection
+connectors, and screen-reader order carry the meaning without relying on
+reading-direction inference.
+
 At every text scale, the final-survivor dismissal reason and separate
 abandonment action remain visible without overlap. Touch can inspect the
 disabled reason and activate the separate abandonment action without precision
@@ -396,6 +458,15 @@ The screen authority is candidate-ready only when:
   automatic battle, pause, speed, inspect, retreat, result, death, reward,
   recovery, progression, Settings, and postgame form complete paths;
 - all product values appear through Section 2 bindings or an integrated source;
+- `SYS-005` remains one page while covering four unique stable provisional
+  offers, no-Coin Inspect/Compare, exactly-two selection, revision, creation
+  review, invalid/empty/loading/error, interruption, and first-Market handoff;
+- the `0:00-3:00` onboarding path produces one provisional choose-two receipt
+  and two separate affordable first-Market hire receipts without recommending
+  or auto-selecting the opening build;
+- Party-line preparation and battle stage protected rear on the left and
+  exposed position `0` front on the right; larger numbers extend leftward and
+  protection remains explicit;
 - no interaction inserts a combat action into the automatic timeline;
 - every destructive or costly action has a stale-preview and duplicate-receipt
   path;

docs/presentation/UI_AND_VISUAL_SYSTEM.md

@@ -39,12 +39,13 @@ lead who must remain in the party.
 | Moment | First read | Second read | Third read | Desired feeling |
 |---|---|---|---|---|
 | Title | active guild threshold and distant unstable route | current safe run state | Continue and accessibility access | invited, not advertised to |
+| New run setup | four equally weighted provisional Recruit offers | selected `0/2..2/2` and comparison | Review Company then Create Run | consequential choice without a recommended build |
 | Guild desk | next pressure or opportunity | what changed after the last result | available preparation destinations | purposeful freedom |
 | Shop | materially different offers | cost and current fit | refresh or return consequence | constrained possibility |
 | Recruit review | profession responsibility and trait tradeoff | rolled strengths and limitation | price and party effect | informed attachment without narrative obligation |
 | Final-survivor dismissal | disabled Dismiss and `One member must remain` | separate run-abandonment action | retained Recruit and zero-delta result | protected consequence without a dead end |
 | Equipment | changed behavior and eligible wearer | conflict or replacement | cost and reversibility | deliberate construction |
-| Party line | order from first exposure to last | protection, reach, movement, and target effects | validation and undo | readable planning |
+| Party line | protected rear-left through numbered positions to exposed front-right | protection, reach, movement, and target effects | validation and undo | readable planning |
 | Risk choice | known pressure and uncertainty | reward class and recovery exposure | committed party snapshot | chosen tension |
 | Battle | most urgent event and affected actors | why the current target or protection relation exists | pause, speed, and inspect | trust in automatic resolution |
 | Result | earliest meaningful divergence | downstream losses and survivors | next adaptation | diagnosis, not spectacle alone |
@@ -141,6 +142,7 @@ readable silhouette.
 | Decision surface | Primary | Secondary | Deferred to inspect |
 |---|---|---|---|
 | Guild desk | upcoming pressure, latest change, preparation readiness | sourced resources and open decisions | complete run history |
+| New run setup | four stable provisional identities, Profession job, Trait benefit/cost, selected count | rolled distribution, default loadout, Contract/difficulty | unrelated catalog and future progression |
 | Shop | offer behavior, price, immediate fit | future eligibility and refresh consequence | full discovery provenance |
 | Recruit review | profession responsibility, trait benefit/cost, rolled constraint | equipment eligibility, level, survival history | full attribute derivation |
 | Dismissal/abandonment | eligibility and affected scope | returned equipment, rebate or run-close consequence | unrelated Recruit history |
@@ -295,7 +297,69 @@ Rows share stable height per text scale. Selection adds an external contour and
 comparison region; it does not push adjacent rows. Sold, expired, unaffordable,
 and selected states keep the original stable ID visible.
 
-### 8.4 Recruit Identity
+The first-Market variant marks at least two sourced base-Profession Recruit
+offers as affordable without marking either `recommended`. A persistent opening
+status reads owned Company separately from Line capacity and updates only from
+authoritative hire receipts: `Company 2 | Line capacity 4`, `Company 3 | Line
+capacity 4`, then `Company 4 | Line capacity 4`. Each hire keeps its own review,
+cost, receipt, and focus return; no combined `Hire two` action exists.
+
+### 8.4 Provisional Recruit Selector
+
+`SYS-005` uses a dedicated provisional variant, not the Shop offer row. It
+renders exactly four stable positions from `BIND:PROVISIONAL_RECRUIT_OFFERS` and
+never shows price, refresh, lock, rarity promotion, or purchase language.
+
+Each overview marker has stable dimensions and contains:
+
+- generated name and stable offer ID;
+- Recruit figure/portrait at the common marker scale;
+- base Profession icon, localized job sentence, and target/reach read;
+- Trait seal with one benefit and one cost;
+- one decision-relevant rolled distribution read;
+- `No Coin cost`;
+- a Select checkbox with a checkmark that does not imply Party-line order; and
+- a separate Inspect icon with accessible label.
+
+Touch activation on Select toggles Company selection; tapping the marker only
+focuses it and opens no destructive state. Controller focus enters offers in
+stable source order; Select toggles the focused offer, while Inspect opens and
+closes its full details without changing selection. Compare is a separate
+command: it pins offer `A`, then offer `B`, and opens an aligned Profession,
+Trait, attribute, and default-loadout comparison. The A/B pair may use any two
+offer IDs and never changes the two Company checkboxes.
+
+The selected-count component has fixed dimensions and explicit states:
+
+| State | Label and control state | Result |
+|---|---|---|
+| none | `Choose two - 0/2`; Review Company disabled | Inspect, Compare, Back, and first selection remain legal |
+| one | `Choose one more - 1/2`; one stable ID checked | selecting a second enables review |
+| two | `Company selected - 2/2`; both stable IDs checked; Review Company enabled | either selection may be cleared or replaced before review |
+| third attempt | `Two already selected`; current two remain unchanged | focus moves to the selected-count explanation; no automatic eviction |
+| invalid source | expected four/received count or affected stable ID; all Select controls disabled | Retry Same Set or Return to Run Ledger |
+| loading | four fixed skeleton positions, named operation, no identity or selection | resolved stable ID stays in its original position |
+
+Review replaces details without discarding the four-offer strip. The selected
+two occupy the main Company comparison; the two unchosen stable IDs remain in a
+quiet `Not retained` summary. `Revise Recruits` returns to the same four
+positions, selected IDs, A/B comparison, and focus. Create Run is the only
+primary action and enters a fixed-size pending state, so a spinner or long
+localized status cannot shift Revise, Cancel, or offer markers.
+
+On a short landscape phone, the four markers form a fixed `2 x 2` layout; the
+selected marker's details replace the context rail. On tablet/reference they
+form one four-marker row above one comparison region. At 130%, generated names
+may wrap to two lines and the Profession/Trait text moves to Inspect, but all
+four identities, checked state, `0/2..2/2`, Select, Inspect, Compare, Back, and
+Review Company remain visible. English (`en`) and Simplified Chinese (`zh_CN`)
+share offer order and control geometry.
+
+No offer starts selected, pulses as preferred, receives a larger portrait,
+sorts by a hidden score, or gains a tutorial arrow. Teaching may highlight the
+Select and Inspect controls as a group, never one Recruit.
+
+### 8.5 Recruit Identity
 
 The component has four canonical scales supplied by
 `BIND:ART_RECRUIT_PRESENTATION`:
@@ -312,7 +376,7 @@ color alone. Trait shows exactly one benefit edge and one cost notch before its
 expanded mechanical sentence. Survival history uses a small set of sourced
 marks and never becomes a fixed personal-story track.
 
-### 8.5 Equipment Row And Comparison
+### 8.6 Equipment Row And Comparison
 
 An item row shows object, name, equipment position from `BIND:EQUIPMENT_RULES`,
 current wearer, one behavior sentence, eligibility, and relevant sourced delta.
@@ -323,7 +387,7 @@ Apply does not enable until replacement, returned item, invalidated reference,
 and reversibility are known. Raw power score, rarity, or price is never the sole
 or largest comparison read.
 
-### 8.6 Dismissal And Run Abandonment
+### 8.7 Dismissal And Run Abandonment
 
 Dismiss is a destructive text-and-icon action below routine Recruit actions.
 Its state comes from `BIND:DISMISSAL_ELIGIBILITY`, which uses the total live
@@ -360,18 +424,20 @@ separate abandonment action occupy three stable rows. They do not overlap the
 Recruit name, Back, or safe-area inset. The Simplified Chinese (`zh_CN`) fixture
 may wrap each label to two lines without merging the two actions.
 
-### 8.7 Party-Line Editor
+### 8.8 Party-Line Editor
 
-One horizontal cord runs from `First exposed` at left to `Last` at right. Every
-prepared recruit occupies a stable numbered marker joined to that cord. The
-component renders the count from `BIND:PARTY_CAPACITY`; it never labels an
-assumed maximum.
+One horizontal cord runs from `Protected rear` at left to `Exposed front` at
+right. The rightmost occupied marker is authoritative position `0`; larger
+position numbers extend leftward toward the rear. Every prepared Recruit
+occupies a stable numbered marker joined to that cord. The component renders
+the count from `BIND:PARTY_CAPACITY`; it never labels capacity as owned Company.
 
 Each marker has a fixed aspect ratio and minimum size. At dense target widths,
 all order markers remain visible while the selected recruit expands into the
 context rail; nonselected figures use simplified but distinct silhouettes. If
 future sourced capacity cannot fit at minimum size, the cord scrolls by whole
-positions with sticky First/Last indicators and a full miniature order strip.
+positions with sticky Rear/Front indicators, position `0` pinned at the right
+edge indicator, and a full miniature order strip.
 
 Selecting a recruit then a destination previews only sourced changes:
 
@@ -385,7 +451,13 @@ Changed relations draw direct shaped connectors above the cord and list the
 same changes in text. Undo and Reset are familiar icon controls with tooltips.
 Drag is optional; tap-select/tap-destination and controller move are complete.
 
-### 8.8 Active Artifact Ledger
+Protection connectors point from the protected Recruit toward contributing
+actors ahead of it on the right. Front and rear use icon, localized text, edge
+shape, and position number; color or reading direction alone is insufficient.
+English, Simplified Chinese, touch, controller, and screen-reader fixtures keep
+the same spatial orientation rather than mirroring the line by locale or input.
+
+### 8.9 Active Artifact Ledger
 
 Artifacts are presented as run-wide rule modifiers, never as equipment attached
 to a recruit. Each ledger row shows sourced emblem, name, changed rule,
@@ -394,7 +466,7 @@ lifecycle from `BIND:ARTIFACT_RULES`. Inspect uses the same vocabulary in Shop,
 Reward, Guild, Battle, Result, and Records. Missing rules block dependent
 commitment instead of reducing an artifact to rarity or flavor.
 
-### 8.9 Risk Choice
+### 8.10 Risk Choice
 
 Risk options are aligned by known pressure, uncertainty, entry cost, reward
 class, recovery exposure, and current coverage. Options use different threat
@@ -404,13 +476,13 @@ The selected option expands in place. The commitment surface remains attached
 to it and displays the accepted party snapshot. Unknown information is a
 sourced uncertainty state, not an empty value or hidden tooltip.
 
-### 8.10 Battle Actor And Event Projection
+### 8.11 Battle Actor And Event Projection
 
-The battlefield owns at least `68%` of usable area. Party and enemy actors
-occupy one readable horizontal encounter space with depth offsets and authored
-staging from media bindings. Order remains legible through numbered ground
-marks and target/protection connectors; the planning cord itself is not drawn
-as a large HUD over combat.
+The battlefield owns at least `68%` of usable area. Player actors stage from
+protected rear at left to exposed position `0` front at right and face the
+enemy across the central action gap. Enemy staging faces toward that front.
+Order remains legible through numbered ground marks and target/protection
+connectors; the planning cord itself is not drawn as a large HUD over combat.
 
 Actor-attached information is limited to:
 
@@ -424,7 +496,7 @@ compact and are available through Inspect. Event projections originate at the
 acting subject, name affected targets, include time/order, and keep actors
 visible.
 
-### 8.11 Playback And Inspect Tools
+### 8.12 Playback And Inspect Tools
 
 Pause, play, speed, and inspect use symbol-first controls with tooltips and
 accessible labels. Speed is a segmented symbol control populated by
@@ -442,7 +514,7 @@ Inspect freezes or preserves playback according to sourced rules and opens:
 On short phones or at 130%, this becomes a full-screen linear view. Closing it
 restores the exact prior playback state.
 
-### 8.12 Causal Timeline
+### 8.13 Causal Timeline
 
 Result uses a two-track timeline: expected responsibilities from the accepted
 party snapshot above, actual events below. The first meaningful divergence has
@@ -453,7 +525,7 @@ Every event has a stable icon, timestamp/order, source, target, outcome, and
 accessible text. `Cause unavailable` is an error state. A neutral result may
 state that no preventable divergence was detected.
 
-### 8.13 Death And Party Gap
+### 8.14 Death And Party Gap
 
 Loss presentation is quiet and explicit. The affected recruit remains visible
 at a respectful readable scale with generated name, stable ID, profession,
@@ -464,7 +536,7 @@ The Acknowledge action does not suggest reversal. Recovery and replacement are
 separate next decisions supplied by their bindings. No celebratory particles,
 rarity framing, or generic red overlay accompanies death.
 
-### 8.14 Reward Choice
+### 8.15 Reward Choice
 
 Rewards appear as actual object, profession, recruit, or rule presentations
 supplied by content and media bindings. Equal-size decision regions prevent
@@ -479,14 +551,14 @@ object scale from implying value. Each option names:
 Claim animation begins only after receipt. The final state is a persistent
 named ownership change, not particles alone.
 
-### 8.15 Recovery Choice
+### 8.16 Recovery Choice
 
 Recovery options are unframed paths leaving the causal result: reconfigure,
 replace, restore, or end the run only when supplied by `BIND:RECOVERY_OPTIONS`.
 Each shows full cost, retained state, recruits affected, and next destination.
 Unavailable paths remain inspectable with reason.
 
-### 8.16 Empty, Error, Notice, And Receipt
+### 8.17 Empty, Error, Notice, And Receipt
 
 | Component | Required content | Forbidden behavior |
 |---|---|---|
@@ -511,6 +583,13 @@ cover the primary action, Back, playback tools, target projection, or focus.
 - Run ledger uses one unframed vertical list and one details rail.
 - Accessibility, Settings, and run selection are compact tools, always visible.
 - Save recovery uses an aligned lineage comparison, not competing alert cards.
+- `SYS-005` begins with Contract/difficulty review, then gives the main surface
+  to four equally weighted provisional Recruit markers and a stable `0/2..2/2`
+  selection status. Inspect/Compare uses the context region; Review Company is
+  the only primary action after `2/2`.
+- The creation review keeps the four-offer strip, expands the selected two,
+  labels the unchosen two `Not retained`, and separates `Revise Recruits` from
+  Create Run. Pending/error states cannot rearrange or replace offer IDs.
 
 ### 9.2 Guild Desk And Forecast: `HUB-001/002`
 
@@ -518,6 +597,9 @@ cover the primary action, Back, playback tools, target projection, or focus.
 - Shop, Roster, Equipment, Party Line, and Risk are stable edge destinations.
 - The prepared party occupies a shallow muster strip that reflects current
   profession, condition, equipment, and order.
+- The first-Market variant keeps Company count and Line capacity separate and
+  exposes two individual affordable-hire reviews; no visual treatment chooses
+  either base-Profession offer for the player.
 - Latest result change uses one attached receipt strip and disappears only after
   inspection, not on a timer.
 
@@ -555,10 +637,13 @@ cover the primary action, Back, playback tools, target projection, or focus.
 
 ### 9.6 Party Line And Readiness: `PTY-001/002`
 
-- The ordered cord spans the main surface with clear First and Last endpoints.
+- The ordered cord spans the main surface from protected Rear at left to
+  exposed Front at right. Position `0` is the rightmost front; larger position
+  numbers extend left toward the rear.
 - Available recruits use a lower muster strip; selected recruit expands in the
   context rail without changing marker positions.
-- Relation connectors use distinct patterns and remain under a text summary.
+- Protection/target/reach connectors use distinct patterns, name their numbered
+  endpoints, and remain under a text summary.
 - Readiness replaces editing with a frozen party snapshot and grouped warnings.
 - Save Order is the only primary action; undo/reset are icon tools.
 
@@ -572,7 +657,9 @@ cover the primary action, Back, playback tools, target projection, or focus.
 
 ### 9.8 Battle: `BAT-001..006`
 
-- Actors and event projections dominate the scene; UI follows edges.
+- Player actors stage rear-left to front-right, with position `0` and the enemy-
+  facing action gap at the right; actors and event projections dominate the
+  scene while UI follows edges.
 - Objective and next urgent event sit top-left; pause/speed/inspect sit top-right.
 - Actor markers attach to subjects and collapse when not urgent.
 - Inspect uses the context rail or a full-screen linear surface at 130%/phone.
@@ -625,6 +712,13 @@ Controller focus uses a `3 px` white outer and `2 px` ink inner contour plus a
 small cobalt corner mark. Touch selection uses the same contour and a selected
 label. Pointer hover may preview focus but cannot reveal unique content.
 
+In `SYS-005`, focus enters Contract/difficulty, then the four offers in stable
+source order, selected count, Compare, Review Company, and Back. Inspect returns
+to the invoking offer; comparison returns to its last pinned offer; Revise
+returns to the first selected offer still present. Offer focus order never
+changes because of selection, generated-name length, loading completion, or a
+tutorial highlight.
+
 A policy-disabled destructive control remains focusable so its reason is
 readable. It is skipped only after the same reason has been announced by an
 adjacent required notice. Focus order never treats the separate abandonment
@@ -635,8 +729,11 @@ the separate abandonment action on the player's next navigation input.
 ### 10.2 Ordering And Selection
 
 - Selection and commitment are separate states.
+- Provisional Company checkboxes, A/B comparison pins, and Create Run are three
+  separate state machines; changing one never silently changes another.
 - All drag operations have tap-select/tap-destination and controller paths.
-- Reorder controls preserve stable IDs and announce old/new positions.
+- Reorder controls preserve stable IDs and announce old/new numbered positions,
+  front/rear meaning, and movement left/rear or right/front.
 - Lists retain focus through sort/filter when the stable ID remains visible;
   otherwise focus moves to Clear Filters or the first result with an
   announcement.
@@ -691,8 +788,13 @@ short phone. They freeze under overlays and never resemble event warnings.
 - High contrast simplifies region textures behind labels and actors without
   replacing region identity.
 - Screen-reader order follows the focus order. Party positions are announced as
-  `position [index], [name], [profession], [condition]`; battle events announce
-  source, action, target, outcome, and time/order.
+  `position [index], [front/rear meaning], [name], [profession], [condition]`;
+  position `0` is announced as exposed front/right and larger positions as
+  progressively rear/left. Battle events announce source, action, target,
+  outcome, and time/order.
+- `SYS-005` announces `four offers`, the current checked count, each offer's
+  stable position and checked state, Profession job, Trait benefit/cost,
+  no-Coin cost, Compare A/B state, and whether Review Company is available.
 - A pauseable full-screen event log provides all urgent automatic battle
   information in chronological text.
 - Controls retain at least `48x48` targets at every scale and do not overlap
@@ -768,13 +870,22 @@ Every gallery frame must record:
       their pages.
 - [ ] Generated recruits remain replaceable run participants and still read as
       distinct mechanical identities at roster, planning, and battle scales.
+- [ ] `SYS-005` visibly holds four unique stable provisional offers, separate
+      Inspect/Compare/Select controls, exactly-two gating, review/revision,
+      no-Coin and unchosen-not-retained consequences, complete invalid/loading/
+      error/interruption states, and no tutorial-selected build.
+- [ ] The `0:00-3:00` path commits one choose-two run creation and then two
+      separate affordable first-Market hires, ending at Company/Line capacity
+      labels `Company 4 | Line capacity 4` without combining purchases or
+      preselecting an offer.
 - [ ] At one total live Recruit across deployed and reserve, Dismiss is visible
       and disabled with `One member must remain`; explicit abandonment is a
       separate run-level action and review.
 - [ ] A stale final-survivor dismissal confirmation closes with no Recruit or
       equipment mutation, no rebate, a readable reason, and deterministic focus.
-- [ ] The ordered party is immediately readable from First to Last on landscape
-      phone and tablet without moving controls or shrinking labels below tokens.
+- [ ] The ordered party is immediately readable from protected rear at left to
+      exposed position `0` front at right on landscape phone and tablet; larger
+      numbers extend left and protection contributors remain explicit.
 - [ ] Automatic battle prioritizes urgent cause, affected actors, objective,
       playback state, and inspect; no control implies insertion of an attack or
       skill into the timeline.