diff --git a/openspec/changes/replace-scum-projections-with-real-data-management/evidence/scum-login-log-fixtures-2026-08-13.md b/openspec/changes/replace-scum-projections-with-real-data-management/evidence/scum-login-log-fixtures-2026-08-13.md
new file mode 100644
index 0000000..b4f2d73
--- /dev/null
+++ b/openspec/changes/replace-scum-projections-with-real-data-management/evidence/scum-login-log-fixtures-2026-08-13.md
@@ -0,0 +1,83 @@
+# SCUM Login Log Fixture Evidence - 2026-08-13
+
+## Scope
+
+- Change: `replace-scum-projections-with-real-data-management`
+- Task: 3.3, sanitized authentic login-log fixtures from the active service
+- Device: `枣庄服务器` (`FyBDIohqPhRx7Cia`)
+- Server instance: `server-scum-1785923898033`
+- Run binding: `server-run-server-scum-1785923898033`
+- Plugin: `game.scum` `0.1.6`
+- Probe path: personal server-management MCP `list_devices`, `test_connection`, then bounded `ssh_exec`
+- Observed time: `2026-08-12T23:44:07.9106530Z`
+
+The diagnostic ran only on the configured active server through the server-management MCP. It returned no host paths, raw IP addresses, raw player names, raw Steam IDs, raw coordinates, credentials, sockets, SQL, RCON, or database content. Source and file identities are SHA-256 fingerprints of server-local paths and file metadata.
+
+## Source Discovery
+
+- `test_connection` succeeded for `枣庄服务器`.
+- `SCUMServer.exe` was observed running during the diagnostic window.
+- Recursive log discovery found SCUM `login_{date}{digits}.log` files under the active service log root.
+- The newest login log is currently empty, so the next Run log-source tail must handle a zero-byte active file and later append/rotation cleanly.
+
+```json
+{
+  "latestLoginLog": {
+    "sourceIdentity": "sha256:752c3ee3789fe73b80245dfcb97776db27f977c4350c3b50516278afbecb9dad",
+    "streamGeneration": "sha256:57b5be4818757e4d64070e5e0f026dbd471bdba189d0426a38b618423f7e1439",
+    "nameTemplate": "login_{date}{digits}.log",
+    "bytes": 0,
+    "lastWriteUtc": "2026-08-12T01:18:15.6090680Z"
+  },
+  "loginFilesSeen": 30,
+  "filesRead": 10,
+  "linesRead": 30,
+  "encoding": "utf-16le"
+}
+```
+
+## Parser Binding
+
+The production parser asset is not implemented yet. These fixtures bind the pending parser profile that task 3.4 must implement and digest-reference before the parser can create durable players.
+
+```json
+{
+  "parserKey": "scum-login-log-parser.pending-real-fixture-v1",
+  "parserVersion": "pending-scum-login-log-v1",
+  "parserDigest": "sha256:5bb528cb9f6e04d8d8b819db3a71f855569c78a5135f22a982301301ae1da50a",
+  "lineEncoding": "utf-16le",
+  "acceptedTemplate": "{timestamp}: '{network_redacted} {external_player_id}:{display_name}({profile_local_id})' logged {in|out} at: X={coordinate} Y={coordinate} Z={coordinate}",
+  "privacyRules": {
+    "networkMaterial": "strip before durable storage and logical fingerprinting",
+    "externalPlayerId": "hash in evidence; store only through the later typed ingestion contract",
+    "displayName": "hash in evidence; parser may emit display name only through the safe event schema",
+    "coordinates": "redact in parser fixture evidence; map capability remains separately gated"
+  }
+}
+```
+
+The logical event identity is derived from server ID, event type, and the normalized non-network event line. It intentionally excludes `sourceIdentity`, `streamGeneration`, and `sequence`, so replaying the same logical line under a later copy-truncate or rotation generation remains idempotent.
+
+## Fixtures
+
+All fixture rows are from active-service `login_{date}{digits}.log` files. Values below are already sanitized; the original line content was not written to the repository.
+
+| # | Event | Source Identity | Generation | Seq | Line Digest | External Player Hash | Logical Event Identity | Occurrence Local Time |
+|---|---|---|---|---:|---|---|---|---|
+| 1 | `scum.login` | `sha256:485b0e95ad608bb5f1dd2a6dfe74856526ec3a0c2f7eaa80b64ce31aadd06331` | `sha256:99e8e26fb62ea9b143024dc78e87b6727c87c32d79c11a4e482ec7157b57fd30` | 3 | `sha256:4450a172273ba476f9e472ff3afcdf6a8b6e069c37e274ed95fa23a8a94b0d2e` | `sha256:2a740d7265b07f2b886e7a0f1f249321d040557f42b19c83759ffbb620bfb6e7` | `sha256:8a93cfb9deb8f82528bae3bc2273d0e0f89ffe2d4761277f994cedda84533225` | `2026.07.05-05.39.10` |
+| 2 | `scum.logout` | `sha256:485b0e95ad608bb5f1dd2a6dfe74856526ec3a0c2f7eaa80b64ce31aadd06331` | `sha256:99e8e26fb62ea9b143024dc78e87b6727c87c32d79c11a4e482ec7157b57fd30` | 4 | `sha256:2e7d6690260854d3f38c7c2fd97bc8b297d718a55ca192e3e14ed79268425dde` | `sha256:2a740d7265b07f2b886e7a0f1f249321d040557f42b19c83759ffbb620bfb6e7` | `sha256:ee80c7b4b5e1176c11d4c0a3b3393182ab971bc8bb50f92ac9384b26255a6e2d` | `2026.07.05-07.21.15` |
+| 3 | `scum.login` | `sha256:5b1630d3747f317fb0d2000f3c7072cd202e358e59ec43f4efff9d192164210c` | `sha256:6aed8ccee83260b16e771ed8a8d49fd26d581a9307b5c01b8294ddcc5906624f` | 3 | `sha256:450b0e4cd4e24c3f9e21b6812103214936b3b58c61e8a887d3458c9a03b2ea6d` | `sha256:f2d4c03c66c9ef6cf9339fa983ddb86ec64a2d41f4756e0831a522c604f87845` | `sha256:b35fc0e99ed878f47514bf368c472bc137a109b4ca1f7dfc84529717e1cb1f02` | `2026.06.19-12.30.45` |
+| 4 | `scum.logout` | `sha256:5b1630d3747f317fb0d2000f3c7072cd202e358e59ec43f4efff9d192164210c` | `sha256:6aed8ccee83260b16e771ed8a8d49fd26d581a9307b5c01b8294ddcc5906624f` | 4 | `sha256:442994383d47561339be31149d0c6836430f528aedf0cf72ba51788658f24832` | `sha256:f2d4c03c66c9ef6cf9339fa983ddb86ec64a2d41f4756e0831a522c604f87845` | `sha256:362e7f05ac8015ea7fdf58c5c5f9709154b331c1d15ca56fff0121058e4d3f59` | `2026.06.19-16.36.22` |
+| 5 | `scum.login` | `sha256:5b1630d3747f317fb0d2000f3c7072cd202e358e59ec43f4efff9d192164210c` | `sha256:6aed8ccee83260b16e771ed8a8d49fd26d581a9307b5c01b8294ddcc5906624f` | 5 | `sha256:853ded422a039c697cb88760b3bf5292810dbac887e4464d84959f92afcc3a82` | `sha256:a6a353c4223497d1a43631104b31c20884a4cf0ce8cbb972398e885682c7b538` | `sha256:dd93eb0f7e4455708b2defdab69a39814bfb84efb84c99a17306715f6597258a` | `2026.06.20-06.36.46` |
+| 6 | `scum.logout` | `sha256:5b1630d3747f317fb0d2000f3c7072cd202e358e59ec43f4efff9d192164210c` | `sha256:6aed8ccee83260b16e771ed8a8d49fd26d581a9307b5c01b8294ddcc5906624f` | 6 | `sha256:18a014c7e3dccdd1a3b5179fa49bd1fb88d47bab1f1c9ce1ff3114c908999d61` | `sha256:a6a353c4223497d1a43631104b31c20884a4cf0ce8cbb972398e885682c7b538` | `sha256:a1a8a46507b6cabf03a94220ddbe1437c181b7f6ba306117594acf095ba3d7cf` | `2026.06.20-06.44.55` |
+| 7 | `scum.login` | `sha256:5b1630d3747f317fb0d2000f3c7072cd202e358e59ec43f4efff9d192164210c` | `sha256:6aed8ccee83260b16e771ed8a8d49fd26d581a9307b5c01b8294ddcc5906624f` | 7 | `sha256:1d03f4ea4ef8acbb3aeab390215e15be03fb7c4563956827ab933dbf4ba66139` | `sha256:2f260f8e697d93c26fda3ec9858c8b9e03a7a95f36378c58d579030f9c2914df` | `sha256:6cd52f703336f4ba63011a1711e6fcd0cd5839a577f178337f9170475bf25219` | `2026.06.20-12.30.26` |
+| 8 | `scum.logout` | `sha256:5b1630d3747f317fb0d2000f3c7072cd202e358e59ec43f4efff9d192164210c` | `sha256:6aed8ccee83260b16e771ed8a8d49fd26d581a9307b5c01b8294ddcc5906624f` | 8 | `sha256:9ba905e6a1b352aa8489ee3be2476e525f3888fbad05240e772d163bb22a517a` | `sha256:2f260f8e697d93c26fda3ec9858c8b9e03a7a95f36378c58d579030f9c2914df` | `sha256:943962513b85365cd5cd276e70b01c6882f203037e3a3eb6195d56cfbb0a936d` | `2026.06.20-12.32.40` |
+
+## Fixture Conclusions
+
+- Authentic login files are UTF-16LE and use the `logged in/out at` template shown above.
+- A single fixture row contains raw network material, external player ID, display name, local profile ID, and coordinates; fixture evidence stores only hashes/placeholders for those values.
+- Transport cursor identity is `(sourceIdentity, streamGeneration, sequence)`.
+- Logical event identity is separate and stable across rotation overlap because it excludes source identity, stream generation, sequence, and network material.
+- The newest active login file is empty; Run tailing must begin from a complete-line boundary and handle later appends without creating events from the header-only or zero-byte files.
+- Existing `companion/events.go` still parses only the invented stdout/stderr `SCUM LOGIN/LOGOUT` format; task 3.4 must replace/add a versioned parser for these authentic UTF-16LE file-tail fixtures before enabling login-driven player creation.
diff --git a/openspec/changes/replace-scum-projections-with-real-data-management/tasks.md b/openspec/changes/replace-scum-projections-with-real-data-management/tasks.md
index 379983b..110d751 100644
--- a/openspec/changes/replace-scum-projections-with-real-data-management/tasks.md
+++ b/openspec/changes/replace-scum-projections-with-real-data-management/tasks.md
@@ -42,9 +42,15 @@
 
 ## 3. Plugin SDK, Manifest, and Immutable SCUM Assets
 
+### Login-log fixture evidence (2026-08-13)
+
+- Server-management MCP `list_devices`/`test_connection` confirmed `枣庄服务器` (`FyBDIohqPhRx7Cia`) was reachable, and bounded `ssh_exec` diagnostics observed the active `SCUMServer.exe` process without returning host paths or raw protected values.
+- Recursive active-service log discovery found `30` `login_{date}{digits}.log` files under the current service log root. The newest active login log fingerprint is `sha256:752c3ee3789fe73b80245dfcb97776db27f977c4350c3b50516278afbecb9dad`, generation `sha256:57b5be4818757e4d64070e5e0f026dbd471bdba189d0426a38b618423f7e1439`, `0` bytes, last written `2026-08-12T01:18:15.6090680Z`; Run tailing must handle zero-byte active files and later append/rotation boundaries.
+- Authentic non-empty login fixtures are UTF-16LE and match `{timestamp}: '{network_redacted} {external_player_id}:{display_name}({profile_local_id})' logged {in|out} at: X={coordinate} Y={coordinate} Z={coordinate}`. Sanitized fixture rows bind expected `scum.login`/`scum.logout` events to server `server-scum-1785923898033`, Run binding `server-run-server-scum-1785923898033`, plugin `game.scum` `0.1.6`, pending parser key `scum-login-log-parser.pending-real-fixture-v1`, parser version `pending-scum-login-log-v1`, parser digest `sha256:5bb528cb9f6e04d8d8b819db3a71f855569c78a5135f22a982301301ae1da50a`, transport cursor `(sourceIdentity, streamGeneration, sequence)`, and separate privacy-safe logical event identities. Evidence is stored in `evidence/scum-login-log-fixtures-2026-08-13.md`.
+
 - [x] 3.1 Add SDK and manifest types for versioned log parsers, SQLite query assets, parameter/result schemas, capability-specific schema fingerprints, sync cadence/limits, map metadata, typed RCON templates, gift item catalogs, and guarded mutation declarations.
 - [x] 3.2 Extend plugin validation to require asset digests, contained package paths, unique template keys, bounded parameters/results, compatible adapter versions, and explicit permission bindings, and to reject raw caller-supplied SQL, RCON, XML, paths, or undeclared parameters.
-- [ ] 3.3 Capture sanitized authentic login-log fixtures from the active service and bind their expected events to server, Run binding, plugin version, parser version/digest, a transport cursor `(source identity, stream generation, sequence)`, and a separate privacy-safe logical event identity stable across rotation overlap.
+- [x] 3.3 Capture sanitized authentic login-log fixtures from the active service and bind their expected events to server, Run binding, plugin version, parser version/digest, a transport cursor `(source identity, stream generation, sequence)`, and a separate privacy-safe logical event identity stable across rotation overlap.
 - [ ] 3.4 Implement the versioned SCUM login/logout parser and tests for successful login/logout, failed login, partial/undecodable/oversized/malformed lines, copy-truncate/rotation overlap under a new generation, Run restart/resume, duplicate delivery, and out-of-order delivery while discarding IP/network material before storage or logical fingerprinting.
 - [ ] 3.5 Add parameterized, read-only player identity/detail/economy/session-enrichment query assets and exact result schemas only for joins and fields proven by the probe.
 - [ ] 3.6 Add parameterized squad/member, vehicle, flag/territory, and position query assets and exact result schemas, keeping ambiguous ranks, ownership, coordinates, and missing numeric values null.