# Third-phase public API delta

The initial review found no serious flaw in the requested architecture. This phase changes reusable
architectural components, not the kernel protocol. It is a self-authored development and review,
not an independent audit. The user's earlier external browser results remain historical evidence.

The pre-edit [baseline](baseline-hashes.json) and final [module comparison](module-delta.json) show:

- All six `hearth/kernel/*.py` modules are unchanged.
- `hearth/persistence.py`, geometry, block-state and random-scope services are unchanged.
- All eleven `hearth_extensions/*.py` modules are unchanged.
- All seven previously captured `test/test_*.py` files are unchanged. The pre-existing `conftest.py`
  was outside that baseline's test-file pattern; it is not a new fixture.
- `generate.py` retains its public command contract and implementation. Version 1.3 deliberately
  changes generated geometry through shared building rules. Version 1.2's default pair is retained
  under `samples/building-quality/baseline-default/`.

## Additions

| Interface | Semantics |
|---|---|
| `Blueprint.roof_design` | Optional policy with `heights(span)` and `component(width, depth, axis, material)`; the returned object implements the ordinary component lifecycle |
| `Blueprint.porch_depth`, `.balcony`, `.chimney` | Explicit bounded attachment intent; balcony requires the front upper room and a porch |
| `RoofDesign`, `ProfileRoof` | Repeating rise profile, existing supports, longitudinal frame and a nested weather cover |
| `RoofCover` / `roof-installation` | Framed 5-by-3 mounting regions, capacity one, measured height envelope and scoped replacement grants; `populate=False` leaves mounts for another composition |
| `Dormer`, `DormerFace`, `FlushWindow` | Real nested roof installation, wall and glass ownership, opening into a nonhabitable attic; actual cover and enclosure rules |
| `FacadeRelief` | Read-only wall-interface binding and supported framing outside preserved openings |
| `FurnishingLayout`, `FurnitureGroup`, `TableSetting` | Functional groups and interaction ports; routes and two-cell clearance checked over actual blocks |
| `Chimney`, `BearingCourse` | Supported exterior shaft and bounded plate between measured anchors, without taking ownership of unchanged supports |
| `GardenCourt`, raised-bed components | Public entrance connection, bounded bed support and substrate, lights and constrained planting |
| `Landscape.sample_step`, `.spacing`, `.heights` | Explicit feasible sampling controls; garden clients retain their minimum tree count |
| `hillside_home`, `gabled_hall`, `high_house`, `lodge_scene` | Lightweight intent programs and terrain-first composition, with independent structure/environment seeds |
| `vertical-cover` rule | Registered outside the kernel, checks actual cover above each intended course column; existing exact enclosure rules protect dormer boundaries |

`roof_runs` is a shared architectural planner used by both facades and roofs. It prevents projecting
windows into a lower roof or placing concealed openings behind a lower gable. The approach's bounded
elevation observation excludes overhead facade beams while retaining nearby upward terrain steps.
The building's reachability obligation includes its exposed street endpoint.

No new component accesses private scene storage, assigns per-voxel owners, or supplies ancestry.
The public roof-installation test creates a dormer from another program and recovers the real host
chain. Replacement and rollback use the original kernel. Negative tests deliberately corrupt a
forked scene to exercise actual-geometry validators; this is test damage, not a component bypass.

## Boundaries

Clients still need public contract facts and architectural intent. Component authors implement
geometry and validators when introducing a new technique; this is not arbitrary prose-to-building
generation. The roof policy is a Python structural interface, not a serialized executable plugin.
Reload preserves its recorded inputs but requires an explicitly supplied implementation for replay.

Regular bay rooms, six-cell storey spacing, bounded contact strategies, nonhabitable attic voids and
the original discrete support/movement/light models remain. The new roof rule does not prove
universal watertight flashing. No port or kernel mechanism was weakened to make the corpus pass.
The browser host was not rerun; the native import guard confirms generation still excludes native
transport dependencies, and full paired records remain verified.