Keep scenario generation out of tutorial progression

Aetheria.State.Daemon/AetheriaDaemonZoneGenerator.cs

@@ -80,7 +80,6 @@ internal static class AetheriaDaemonZoneGenerator
             .ConfigureAwait(false) ?? new AetheriaPlayerSettings();
         settings.ActiveRunKey = runKey.ToString();
         settings.PlayerName = string.IsNullOrWhiteSpace(settings.PlayerName) ? "Terminus Pilot" : settings.PlayerName;
-        settings.TutorialPassed = true;
         settings.LastUpdatedAtUtc = now;
         await node.MutableDocument<AetheriaPlayerSettings>(AetheriaStateNode.PlayerSettingsKey)
             .ReplaceAsync(settings)

Aetheria.State.Verify/Program.cs

@@ -12219,6 +12219,12 @@ static void RequireDaemonVersePublication(string root)
             "Daemon zone generation must not restore invented scenario cargo as a second item-identity authority.");
     }
 
+    if (daemonZoneGenerator.Contains("settings.TutorialPassed = true", StringComparison.Ordinal))
+    {
+        throw new InvalidOperationException(
+            "Generating a Terminus scenario must not award tutorial completion; progression requires its own daemon-owned completion fact.");
+    }
+
     var requiredDaemonHostSymbols = new[]
     {
         "<OutputType>Exe</OutputType>",

docs/aetheria-perfect-machine-map.md

@@ -1076,6 +1076,12 @@ scenario selects a distinct run identity, so an existing proof run cannot
 impersonate ordinary play. Unity selects the scenario only as a launch input and
 cannot write cargo, hull, pickups, or feedback.
 
+Scenario generation may select an active run and default pilot name, but it is
+not tutorial progression authority. It preserves `TutorialPassed`; only a
+future daemon-owned tutorial completion transaction may cross that flag. The
+fossil selected tutorial New Game while the flag was false, so merely entering
+the Terminus proof arena cannot award completion.
+
 ### Daemon Pickup Contact Transaction
 
 - Owner: the daemon simulation owns pickup collection by interpreting typed

docs/original-game-migration-matrix.md

@@ -15,7 +15,7 @@ validation proves contract shape, not wiring, exclusivity, lowering, or parity.
 
 | Organ | Original authority/evidence | Target owner | Eve contract | Runtime lowering | Current status | Required proof |
 |---|---|---|---|---|---|---|
-| Run/session state | `ServerShared`, `ActionGameManager` | Aetheria daemon/CultCache | provider/session advertisement plus run lifecycle bindings | all clients | active/failed lifecycle is daemon-owned and restart-stable: controlled-entity destruction commits the fossil cause, terminal frame, one `run.failed` fact, releases control, rejects later gameplay commands, and freezes the world; Eve receives terminal presentation/input levers without becoming an owner. Docked, travelling, fighting, mining, looting, and refitting remain derived world conditions rather than counterfeit durable phases | full-daemon death/restart witness, multi-client convergence, and a source-backed game-mode completion rule; the fossil supplied no victory transition |
+| Run/session state | `ServerShared`, `ActionGameManager` | Aetheria daemon/CultCache | provider/session advertisement plus run lifecycle bindings | all clients | active/failed lifecycle is daemon-owned and restart-stable: controlled-entity destruction commits the fossil cause, terminal frame, one `run.failed` fact, releases control, rejects later gameplay commands, and freezes the world; Eve receives terminal presentation/input levers without becoming an owner. Docked, travelling, fighting, mining, looting, and refitting remain derived world conditions rather than counterfeit durable phases. Terminus scenario generation preserves `TutorialPassed`: entering a generated/proof arena cannot impersonate the missing tutorial-completion transaction | full-daemon death/restart witness, multi-client convergence, daemon-owned tutorial generation/completion, and a source-backed game-mode completion rule; the fossil supplied no victory transition |
 | Entity identity/loadout | `ServerShared/Entity*` | daemon | typed entity and inventory surfaces | EveUnity/Electron | daemon-owned hull identity, exact installed placement/rotation and instance state, cargo stacks, weapon membership/held state, equipment wear, executable behavior state, weapon chronology, active-effect state, and loadout-generation provenance survive a hard CultCache close/reopen through the durable latest-frame checkpoint. An advertised generic Eve equip operation now translates into the typed daemon transaction before that checkpoint; its accepted placement survives restart and its consumed station-cargo source does not resurrect. Generic Eve rebuilds weapon and scalar thermostat controls from that restored truth; legacy per-entity documents are bootstrap inputs only when no live frame exists | live client refit witness and multi-client convergence |
 | Loadout generation | map/faction availability, item cost, hull hardpoints and role constraints | daemon using canonical galaxy, faction knowledge/economy and typed catalog | generated loadout plus provenance/availability facts | Eve inspection and refit surfaces | daemon now uses the fossil candidate filter and seeded weighted selection: manufacturer must be present and allied, ally weight decays by home-zone graph distance, price uses the authored exponent, and hardpoints require matching semantic type, rotated footprint containment, and controller role; the April 2021 catalog fossil restores the distinct common `Longinus`, rare AetherDrive-compatible `LonginusX`, and `Djinni` rows with their original IDs, shapes, hardpoints, prices, drag, and prefabs, plus missing Thruster rows required to fill their authored mounts; typed `rarity:rare` tags apply a 0.05 generation multiplier to `LonginusX` and AetherDrive equipment; the generator owns one mutable CultMath stream, fixing the readonly-struct defensive-copy bug that restarted every weighted draw; placement rotation survives durable state and reconnect; generation fills the largest compatible footprint before economic weighting; cargo/capacitor plus station docking equipment must fit remaining hull space; stations pack faction-available inventory largest-first; ordinary ships begin without invented scenario cargo; every generated entity persists a source/selection receipt that reaches Eve as `loadout.item` semantics | multi-zone generated-world parity and exact root-to-zone stream sequencing against the fossil |
 | Flight intent | `Ship`, `Thruster`, `AetherDrive`, `VelocityConversion`, `VelocityLimit`, input paths | daemon actuator simulation + Ymir integration | analog local helm/look/tractor plus actuator state | generic Eve input and scene lowerers | direct faction-speed velocity ownership is deleted; daemon persists local strafe/forward helm and desired look, allocates ordinary directional thruster banks by authored rotation, derives torque from hull/item placement, compensates lateral torque, gates execution through the shared energy ledger, deposits equipment-cell heat, publishes plume visibility and actuator state, applies hull drag, then runs operational velocity conversion with the fossil exponential damp equation and clamps the result through evaluated velocity limits before giving velocity/direction to Ymir. The evaluated limit remains in durable behavior state for reconnect and Eve inspection. Autonomous tasks translate world travel into the same local helm axes and issue look commands instead of mutating heading. AetherDrive rotor/coupling simulation is additive and explicitly non-default: common `Longinus` and `Djinni` hulls use ordinary thrusters; the rare `LonginusX` replaces those mounts with the single rare `Traction` AetherDrive path | hardpoint-transform direction parity, exact cross-equipment behavior execution ordering, CultMath/float32 parity harness, live production-frequency evidence, generic thrust/turn feedback lowering, and live handling screenshots |