diff --git a/docs/research/2026-09-01-overhaul/c1a-building-bridge-repair-contract.md b/docs/research/2026-09-01-overhaul/c1a-building-bridge-repair-contract.md
index 8ffb61004..11d6f0093 100644
--- a/docs/research/2026-09-01-overhaul/c1a-building-bridge-repair-contract.md
+++ b/docs/research/2026-09-01-overhaul/c1a-building-bridge-repair-contract.md
@@ -79,6 +79,19 @@ hitsInteriorCell reporting are correct for their own callers.
 Do not silently invent policy for malformed positive reciprocal indices;
 identify existing validation/error handling if this requires a new choice.
 
+**Resolved before implementation:** existing BuildingPhysics stores a signed
+short with no cross-cell upper-bound validation; the sphere helper never
+indexes it. For an otherwise available destination, explicitly reject a
+nonnegative reciprocal index >= destination.Portals.Count with
+InvalidDataException, consistent with TryGetPortalPlane's prepared topology/
+polygon corruption boundary. Include destination/index/count in its message.
+Do not clamp, substitute portal0, silently skip, load a cell, or let an
+unchecked indexer dictate the error. Negative and unavailable/rootless cases
+keep their preceding skip semantics. Add exact-count and larger-index tests.
+This managed malformed-input guard is not claimed as native behavior (retail
+indexes trusted authored metadata unchecked); lead records this adaptation
+with the narrowed AP159 row in the implementation commit.
+
 ## Required discriminating tests
 
 Drive real `BuildShadowCellSetFromParts` where possible; tests may use a