build/qa: kit-scene contamination gate — auto-strip KitRoom_* roots at build + sandbox level-file scan

extensions/renderers/unity/scripts/BuildMacOSPlayer.cs

@@ -188,6 +188,10 @@ public static void Build()
         // player can runtime-spawn actors for any campaign (not just the baked scene's cast).
         EnsurePackaged();
 
+        // Kit rooms (build_room_kit.cs) are QA constructions; a capture flow that saves the scene while
+        // one exists would otherwise ship it inside the player, drawing grey kit masses over every plate.
+        string[] strippedQARoots = StripQAConstructions();
+
         // --- Player identity (was DefaultCompany/WorldOS-Unity-spike) ---
         PlayerSettings.companyName = "worldos";
         PlayerSettings.productName = "WorldOSPlayer";
@@ -259,13 +263,44 @@ public static void Build()
             "platform=" + s.platform + "\n" +
             "architecture=" + archResult + "\n" +
             "alwaysIncludedShaders=" + string.Join(",", includedShaders) + "\n" +
+            "strippedQARoots=" + (strippedQARoots.Length == 0 ? "(none)" : string.Join(",", strippedQARoots)) + "\n" +
             "scenesBuilt=" + string.Join(",", options.scenes) + "\n");
 
         Debug.Log("[BuildMacOSPlayer] DONE result=" + s.result + " errors=" + s.totalErrors
             + " warnings=" + s.totalWarnings + " size=" + s.totalSize + " time=" + s.totalTime
             + " report=" + reportPath);
     }
 
+    // QA-construction roots that must NEVER ship inside a player build. build_room_kit.cs assembles
+    // kit rooms as "KitRoom_<roomId>" roots in whatever scene is open; a capture/lighting flow that
+    // saves the scene mid-session bakes them in, and the built player then renders grey kit masses
+    // (fallback boxes, brazier plinths, parapets) in front of every plate. Measured three times
+    // (kit-crypt cleankit trap ×2, kit-tavern 2026-07-23 — the withheld tavern install). The build
+    // opens the canonical scene EXPLICITLY (also killing the wrong-open-scene trap), strips matching
+    // roots, saves, and reports them in build-report.txt (strippedQARoots=...).
+    const string QARootPrefix = "KitRoom_";
+
+    static string[] StripQAConstructions()
+    {
+        var scene = UnityEditor.SceneManagement.EditorSceneManager.OpenScene(SceneToBuild);
+        var stripped = new List<string>();
+        foreach (var go in scene.GetRootGameObjects())
+        {
+            if (go != null && go.name.StartsWith(QARootPrefix, StringComparison.Ordinal))
+            {
+                stripped.Add(go.name);
+                UnityEngine.Object.DestroyImmediate(go);
+            }
+        }
+        if (stripped.Count > 0)
+        {
+            UnityEditor.SceneManagement.EditorSceneManager.SaveScene(scene);
+            Debug.LogWarning("[BuildMacOSPlayer] stripped QA construction roots from " + SceneToBuild
+                + ": " + string.Join(",", stripped));
+        }
+        return stripped.ToArray();
+    }
+
     // #1674: shaders CombatSurfaceClient resolves at runtime via Shader.Find and that NO asset references, so
     // the player build strips them unless they are listed in Graphics -> Always-Included Shaders. The player
     // build MUST carry both or the runtime feature (occluder proxies / walk-behind silhouette) silently no-ops

qa/qa_sandbox.py

@@ -79,6 +79,26 @@ def _meta_path(run: str) -> Path:
     return _rundir(run) / "sandbox.json"
 
 
+def _qa_roots_in_app(app: Path) -> set:
+    """Names of QA kit-scene roots (KitRoom_*) baked into the app's level files.
+
+    build_room_kit.cs assembles kit rooms in the open scene; a capture flow that saves the scene
+    bakes them into the next build, which then draws grey kit masses in front of every plate.
+    Unity level files store GameObject names as plain bytes, so a byte scan is a reliable,
+    dependency-free detector (the same check as `strings level0 | grep KitRoom_`).
+    """
+    import re
+    found: set = set()
+    data_dir = app / "Contents" / "Resources" / "Data"
+    for lvl in sorted(data_dir.glob("level*")):
+        try:
+            found.update(m.decode() for m in re.findall(rb"KitRoom_[A-Za-z0-9_]+", lvl.read_bytes()))
+        except OSError:
+            continue
+    # child helper objects (KitRoom_Fire etc.) ride along with a real root; the root name is the signal
+    return {n for n in found if not n.startswith(("KitRoom_Fire", "KitRoom_TombGlow", "KitRoom_CoolKey"))} or found
+
+
 def up(run: str, *, campaign: str, engine_port: int, qa_port: int,
        seed_cmd: str, app: Path) -> dict:
     rd = _rundir(run)
@@ -119,6 +139,14 @@ def up(run: str, *, campaign: str, engine_port: int, qa_port: int,
     if not pbin.exists():
         engine.terminate()
         raise SystemExit(f"[sandbox] player binary missing: {pbin}")
+    contaminated = _qa_roots_in_app(app)
+    if contaminated:
+        engine.terminate()
+        raise SystemExit(
+            f"[sandbox] app CONTAMINATED — QA kit roots baked into the build: {sorted(contaminated)} "
+            f"({app}). A KitRoom_* scene root was saved into the canonical scene at build time; it "
+            f"renders grey kit masses over every plate (kit-tavern 2026-07-23). Rebuild via "
+            f"BuildMacOSPlayer (auto-strips + reports strippedQARoots in build-report.txt).")
     penv = dict(os.environ,
                 WORLDOS_ENGINE_BASE_URL=f"http://127.0.0.1:{engine_port}",
                 WORLDOS_CAMPAIGN_ID=campaign,