data: switch to recovered game DB and refresh cards and charts

AGENTS.md

@@ -22,15 +22,17 @@
 - Do not bump the package version, create version-specific release notes, create tags, or publish GitHub Releases for routine online commits and deployments unless the user explicitly requests them.
 - Use `UPDATES.md` as the single user-facing update history and include only changes that affect service users.
 
-## HolodoriDB source policy
+## Game DB source policy
 
-- Always fetch the official HolodoriDB remote main before collecting or checking game data and strings. Read files at the fetched commit, not local checkout files or stale remote-tracking refs.
-- Use scripts/holodoridb-source.mjs for collectors. A failed remote fetch must stop collection; do not fall back to cached data or --offline.
-- Resolve Korean song titles through Music.json titleLangId and LangMusic_Kor.json before asking the user for names.
+- The captured Android game DB is the authoritative master-data source. Use scripts/game-db-source.mjs and the hash-pinned snapshot in data/game-db/current.json. Do not fetch HolodoriDB or substitute third-party data when a table is missing.
+- Preserve provenance: SUS charts are separate game assets; live event schedules and bonus rules are absent from this DB. Do not label historical manual event records as DB-derived or invent missing server data.
+- Resolve Korean song titles through Music.json titleLangId and LangMusic_Kor.json in the snapshot.
+- Keep account credentials, keys, raw memory and recovery files in ignored local inspection directories; only verified master tables and non-secret provenance belong in the source snapshot.
 
 ## Collection review before calculator extraction
 
-- A collection request starts with `npm run data:sync`: compare all three official remotes against the last successful collection commits in data/holodoridb/manifest.json. Inspect every intervening commit and every changed file, including all strings, tables unrelated to the calculator, and changes later reverted.
-- Read data/holodoridb-review/latest.json (full JSON before/after details), latest.md, and changes.patch. Present a Korean semantic summary grouped by content (cards/skills, songs, events, translations, other systems), describing additions, removals, corrections, and relevant dates. Do not substitute a file list or calculator-only summary for this review; state unknown meanings explicitly.
-- Provide this report to the user before acquiring/extracting calculator data. Then continue with `npm run data:apply` and other required collectors within the authorized task; no additional approval is implied. A review-only request must not extract data.
-- Reviewing does not advance the collection baseline. Extraction must use the reviewed remote commits; if any remote changes, regenerate and present the report first.
+- A collection request starts with npm run data:sync. Compare every table and string in the selected snapshot with the last successful snapshot in data/game-db/applied.json, including non-calculator systems.
+- Read data/game-db/review/latest.json and latest.md. Report semantic changes in Korean, grouped by cards/skills, songs, events, translations and other systems. Include additions, removals, corrections and relevant dates; state unknown meanings explicitly. First import is a snapshot registration, not evidence that every row is newly added content.
+- Present the review before npm run data:apply. Then continue authorized collectors without an additional approval. Review-only requests must not extract data.
+- Reviewing does not advance the collection baseline. Extraction must use the reviewed snapshot hash; changes require a new review first. Never fall back to older or external sources after validation failure.
+- See docs/game-data-source.md for snapshot import and separate game-asset collection.