Ripped racing-game vehicle → DayZ — family B adapter (CAMBIO-2)

Day-0 critical path for the next source game Grub car, proxy-split and with moving parts. If the asset is in flight, use its frozen runbook. If an applicable entry is missing: STOP. The previous runbook is in history/pre-cambio-1-family-b-runbook.md and is not executable.

Seis deltas obligatorios

Source door inventory (measured 2026-08-06 on the library of 651 rips)

• Bilateral door container can come from EITHER side: the BRZ provides only doorlf, SUB_WRXSTi_04 provides only doorRF_a, FOR_BroncoRaptor_22 mixes sides (doorLF_a, doorLF_b, doorLR_b, doorRF_a). The real rule is "a single side per container, whichever it is" — do not assume LF when classifying, counting doors, or synthesizing the mirror.
• Variants _a/_b of the same door container = interchangeable platforms (removable Bronco doors): session A chooses ONE variant as INCLUDE and justifies the rest as EXCLUDE.
• jamb/handle/card of a door WITHOUT its door<side>_<x> panel = door merged into the bodywork (BMW_M4_14, FOR_2_GT40_66): this is not another naming convention; the openable part does not exist in the rip.

Single ledger entry and identity checkpoint

• Full template: <vehicle-import>\contracts\asset-contract.json; review schema: <vehicle-import>\contracts\asset-contract.schema.json.
• The per-asset copy is named exactly asset-contract.json; it is the third and final day-0 file. It replaces parallel inventory/decisions: do not produce source_inventory.json, manifest_decisions.json, separate tombstones or any other list.
• Session A/B export: the human runs <vehicle-import>\scripts\blender_export_asset_contract.py on collections DZ_INCLUDE / DZ_EXCLUDE / DZ_MOVABLE. The JSON is import evidence; afterwards the ledger entry rules.
• Single primitive: <vehicle-import>\scripts\asset_contract_checkpoint.py, version declared in stdout. Copying it to a run is forbidden.
• Session A/B is imported with import-blender; after converting, check is the only capability=LINEAGE_CHECKPOINT.
• PASS allows continuing only within the issued capability. DECISION_REQUIRED returns to the human. TOOL_FAIL blocks and does not authorize touching geometry nor is it recorded as an asset failure.
• Coverage is N:M: every INCLUDE/MOVABLE appears in a derived_from within an authorized operation; each justified EXCLUDE is the tombstone. Source/output equality is not required.

Allowlist B1-B6 and canonical location

Single location: each primitive/gate is executed only from its canonical path above. It is forbidden to copy it to work\, sNN\, _validation\, .superpowers\sdd\ or any run workspace. Existing copies are evidence snapshots: they are preserved, can be hashed, and are not executed. If the canonical path is missing, the result is STOP, never "use the newest copy".

Classification viewer (session A review without Blender)

assets/classify-viewer/ — Three.js viewer to review/reclassify session A by click (GLB with extras + deltas that the agent applies to the .blend via headless script). Advisory: authority remains .blend → export → ledger entry. Usage and data contract in its README.md. Debuted with sub_wrxsti_04 (2026-08-06).

B7 — visual signoff before build (debuted 2026-08-16, sub_wrxsti_04)

B1-B6 measure names, face counts, hashes and logical matrices. Neither can see a color nor the orientation of a proxy. On 2026-08-16 the user opened the WRX in a viewer for the first time and found in minutes four defects that the entire allowlist had passed as good:

• 64% of the car in ONE material and the entire interior in another — the import recorded material_map: null and sent 37 named parts (badges, mirrors, exhaust, jambs, skirts, underbody, suspension arms) to the bodywork paint bucket;
• the four wheel proxies written with the IDENTITY matrix, all four identical, when vanilla writes TWO mirrored frames, one per side. Same frame + mirrored anchors = one side mounted backwards by mathematical obligation;
• 176 mm vanilla sedan wheel instead of the car's wheel;
• a bodywork color that no one had verified.

The tool existed halfway: rip_visual_sheet.py already renders artifacts and its own docstring says "renders, does not judge" — but it draws geometry in GRAY and separately, so it could not show any of the four. B7 is the other half.

How to run it, in this order and without skipping the middle. ABSOLUTE PATHS: this project has TWO trees — <vehicle-import> (scripts, profiles, work) and C:\Users\<you>\OneDrive\Documentos\DayZ Projects (= P:\, the deployed mod) — and a relative command only runs from one. The actual debut of B7 failed with can't open file ... No such file or directory precisely because of that.

set FZ=<vehicle-import>

python "%FZ%\scripts\rip_visual_signoff.py" --car "%FZ%\profiles\<car>.json" ^
       --render "%FZ%\work\<car>_viewer.html"
   REM  (el humano lo abre y lo mira -- este paso no lo puede hacer el agente)
python "%FZ%\scripts\rip_visual_signoff.py" --car "%FZ%\profiles\<car>.json" ^
       --verdict pass^|fail --by "human:<quien>" --note "<que viste>"
python "%FZ%\scripts\rip_visual_signoff.py" --car "%FZ%\profiles\<car>.json" ^
       --out "%FZ%\work\_gates\b7.json"

Three rules that make it a gate and not a rubber stamp:

1. The render must be ASSEMBLED and with materials. Shell + chunks + interior + removables in their proxies + wheels in theirs, with the colors of the rvmats that ship. Floating doors and inverted rims ONLY appear when assembled; not in loose parts and in gray.
2. The verdict is tied to the bytes. It carries the sha256 of each artifact that was viewed, and the check hashes them again. Rebuilding a part renders the signoff STALE, not old, and the gate turns red until someone looks again. It is the same lesson already paid by positive_control: a control pointing to a path that the next build overwrites is a tautology.
3. Fail-closed. Without a verdict it is NO_EVIDENCE, never PASS. A verdict covering fewer artifacts than the car currently has is FAIL: a part that was not shown cannot be approved.

Signing on behalf of the human invalidates the entire gate. The --verdict command exists so that the signature has a name and date; using it instead is forging it.

Two traps encapsulated by the render, paid on the same day: DayZ is LEFT-HANDED and three.js RIGHT-HANDED, so passing the coordinates as-is is a reflection — a mirrored car looks perfectly plausible until you read a badge, and the calibrator is brand text. And proxy placement is vertices @ effective_frame.T + anchor with effective_frame = MLOD_PROXY_CONVENTION_FRAME @ raw_frame (rip_detachable_doors.py:55-61,171-176): deducing it by eye from the triangle placed each door one meter from the car.

Single symptom → cookbook index

Do not create INDEX.yaml, a cookbook router or any other symptom→cookbook table. This is the only index.

Secuencia day-0

1. Open this adapter from the dayz-vehicles selector.
2. Open a single ledger entry asset-contract.json, created from the canonical template, and verify source revision, Y0, golden revision and status.
3. The human classifies in Blender; the primitive captures hash/inventory and imports lists/transforms into that same ledger entry. The agent neither opens nor maintains schema/export as state documents.
4. Check canonical presence of B1-B6 without executing snapshots. The B1-B7 allowlist is complete; any canonical absence results in STOP.
5. Convert while preserving provenance and require LINEAGE_CHECKPOINT=PASS; the other two states block.
6. Execute only the allowlist; the final live test remains separate from preflight.
7. If one of the five symptoms appears, open only its cookbook. For other symptoms, STOP and explicit diagnosis.

Step 5 conversion rail (SP-363; debuted sub_wrxsti_04, 2026-08-06)

The car profile declares source.asset_contract (path to ledger entry) — this activates the contract mode of rip_p2_import.py: INCLUDE/SHADOW lists projected from the ledger entry by scripts/rip_contract_source.py (fail-closed per-container homogeneity; rip_p2_import.py and rip_contract_source.py are scripts of the import project and are not shipped in this pack), never with manifest_decisions.json, far-shell deferred to human classification, G0 anchors per profile (source.g0_anchors = pairs [part, locator]). The three commands, in order:

blender --background --factory-startup --python-exit-code 1 --python scripts\rip_p2_import.py -- --car profiles\<car>.json
python scripts\asset_contract_checkpoint.py import-conversion --contract <ficha> --import-report <report> --contact-y-m C --hub-y-m H --lift-m L --y0-m Y0 --responsible "machine:rip_p2_import@<car>" --approved-by "human:<quien>" --out <ficha>
python scripts\asset_contract_checkpoint.py check --contract <ficha>

• --python-exit-code 1 is MANDATORY: without it Blender returns exit 0 even if the python script dies (a G0 FAILED passed as "completed" at debut). Applies to ALL headless Blender launches, not just this step.
• import-conversion validates the derivation Y0 == contact − hub + lift, the MULTISET correspondence of object names per container (report vs inventory, blind to Blender .NNN suffixes) and that no excluded part was imported; seals 1:1 lineage AXIS_UNIT_TRANSFORM + frame, and is seal-once (retry = CONVERSION_ALREADY_IMPORTED).
• The new profile starts MINIMAL (see profiles/wrx.json): source block + anchors + measured transform + WHEEL_R == mounted wheel radius. Copying keys from profiles/brz.json is forbidden: they are scars specific to that car.
• Known downstream landmines (next surgery): rip_p2_group.py:33 IN_BLEND hardcoded BRZ; rip_p3_structural.py:715 defaults to brz.json.