Continue P04-01 same intended R collector/verifier work. Worker17 e914a4e39679424f90408e06510e4ca9 ended status blocked only on actual external input read PermissionError; created one untracked status doc, zero implementation, tests not run, same submitted accd07c91d4e34d9b7c7fc20e389df2424b167e1. Root has now supplied all full input bytes inside existing B scope, no security/Runner change. Ordinary repair18 preserves usedcounter/maxnull; no repeated registeredvalidation of unchangedaccd. Return recorded run with SELF-CONTAINED instructions including your full previous stage R direction and exact newinput relocation below; model Soldefault/Astra your judgment. No more docs-only stop and no engine re-execution.

B=/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build. NEW EXACT SOURCE: B/audit-support/p04-r17-full-inputs-r01/MANIFEST.json bytes1244135 SHA256 a15f29fa12537f6d8aaf7cabea390922a9f16e3eb9c10981e5742aafc8c4c8a8. This is Root full-byte relocation1721 files/71488772logicalB including all1338 currentproductfiles plus full344 formal memberfiles in86original+Reader slots and allneeded fixedinputs. All original and relocated bytes were actually rehashed equal and separateinodes; originalbytes preserved. Current product inventory was re-derived from actual R tools/run_all_tests.source_refs and all1338 bytes/SHA compared to allfour native source_before sets, exact equality. Current main HEAD at copy8af0d5af8c4a15f6b7130617dbaa78ed736e604a, productcontentstill5f6bc11d6bb6e92d22d787989b219fef3a435bc1 (docs only since). Manifest has product_source full1338 mapping, original_to_relocated(originalpath -> relocated,bytes,SHA), formal_slot_original_to_relocated, fixed_original_paths, per-run source_before_sha. Rehash every required relocated fullbyte against BOTH originalnative descriptors and this exactmanifest, not rootpassedflags. Don't open external originals or request permissions again; mapped bytes are the approved suppliedoriginal inputs. Preserve raw absolute paths as provenance but resolve only through explicit mapping, never arbitrary pathrewrites or signature-onlypins. Product source .gd fullfunction bodies can be inspected directly in relocated product/; keep exactbodypin checks. Formal member parentmembership mapping exact, no symlinks/traversal/duplicates. Existing raw/lifecycle under B accessible unchanged, don'tcopy them again. New relocation estimated71.5MB logical, APFSindependentclones where possible. Missingunknownoriginal stillfails, no silentfallback. Fix workeraccess concern without broadening sandbox.

Same worker checkout inherited, preserve REPAIR17_STATUS.md historicalfailure, new repair18status honest. Existing C exactunchanged. Current native allpass but no originalcredit remains13/88. RthenAthenfinalindex/mandatorywhole/independentreview/ordinaryintegration remain. Wholeoriginalgoalnotblocked. Complete actual executable R artifacts and file-only tests. Your previous exact stageR directions to incorporate and refine in new run.reason follow:
REPAIR17 STAGE = native raw series collector + per-series verifiers only (stage R). Candidate/final binding (stage A) is explicitly NOT in this run. Validation 0689f007... failed only because BUILD_OUTPUT_DIR/p04-evidence/index.json is missing. That index can't be produced honestly until the 13 conditions outside C plus EV are proven from raw. So R comes first, then A (actual HEAD+FS candidate binding), and only then the final index/composition. Root will run whole validation and independent review after A.

WORKTREE/BASE: reuse the current submitted checkout accd07c91d4e34d9b7c7fc20e389df2424b167e1 and its existing inherited S1/S2a/S2b/S3 code. No new branch/worktree, no git writes, no Runner, no engine/Godot, no full regression. Python static/local file-only tests are allowed.

ALLOWED EDITS: tools/check_p04_order_evidence.py and docs/plans/original-completion-2026-10-02/execution/p04-01/** only. Do not touch production source, input originals, Runner contract, config, DB or security files. Existing s1/s2/s2b/s3 sources and logs are immutable.

RAW INPUTS (read-only), with B=/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build:
- B/audit-support/p04-whole-closure-r01/ROOT_S1_NATIVE_R02_RESULT.json -> B/p04-s1-native-r02
- ROOT_S2A_NATIVE_R03_RESULT.json -> B/p04-s2a-native-r03
- ROOT_S2B_NATIVE_R02_RESULT.json -> B/p04-s2b-native-r02
- ROOT_S3_NATIVE_R01_RESULT.json -> B/p04-s3-native-r01
- C series: B/audit-support/native-first-current (OWNERSHIP_RAW_PROVENANCE.json, SOURCE_MANIFEST, three runs)
- B/audit-support/p04-current-native-series-r01 (paid shift + same-minute request-resend originals)
- D05 approvals/supplement full bytes in p04-whole-closure-r01
Read the actual raw files. Treat ROOT_*_RESULT.json only as locators: never trust their passed/summary fields.

TASKS
1. New module docs/plans/original-completion-2026-10-02/execution/p04-01/p04_native_series.py. One verifier per series (verify_s1, verify_s2a, verify_s2b, verify_s3). Each one must independently:
   - re-hash every file listed in its source manifest;
   - check that run inputs/source_before equal current game 1338, tested product content 5f6bc11d6bb6e92d22d787989b219fef3a435bc1, config/input/env pins, and full-function-body source pins (never signature-only);
   - check owned processes from raw logs: S3 import 10448/parse 10493/Writer 10523/Reader 10578 all ended with gates 0 and guards 0, and the equivalent records for the other series;
   - check formal member SHAs (original and copy unchanged) and phase raw pairs byte-identical;
   - work out IDs and ledger/shift/reservation joins from literal raw.
   Each verifier returns the condition names it proves.
   Mapping:
   - S1 -> EV: valid landing and no-safe-landing, same request/resource reservation, 14 typed formal points. Do not claim paid-service power proof.
   - S2a -> midnight_settlement, midnight_replay, save_restore:
     - sales 25G/1 tx, payroll 255G/1 tx (Akane 120 + Bardo 135 from actual duty), upkeep 5G as 3 rows/1 tx;
     - advance_to(1440) replay processed 0/daily_closes 0 with entire Runtime bytes invariant;
     - formal Reader replay exact;
     - API getter normalization limited to StringName/String and ordering, with raw getter byte inequality kept as recorded fact (not JSON-only).
   - S2b -> night_staff_absent, overtime_task, plus same-minute rejection MINUTE_ALREADY_APPLIED with all Runtime typed state unchanged.
   - S3 -> closure_release (B1, direct closure false while started service continues; keep RELATED_FACILITY_INACTIVE, never relabel it NO_POWER), exit_release (B2a/B2b), patience_release (B3), plus B4a/B4b event/failed release-once with charge 0.
   - power_stop/destruction_stop/shift_completion/same_minute_replay: prove them only if the raw actually covers them. S2a supersedes request-resend as settlement-replay proof, but keep that distinction, and use the current-native-series-r01 paid shift/resend originals for shift_completion/same_minute_replay. Any condition with no raw stays listed as missing. Never invent D05 rules. Native-Windows-only conditions stay individually pending.
2. In check_p04_order_evidence.py: keep verify_native and the C checks byte-for-byte unchanged. Add a separate combine step that unions C with the new series results, each bound by SHA to its manifest. Do not just edit the verified_conditions list. The final missing-check must still fail for any condition not proven from raw, and must still fail overall because stage A is unfinished: keep that refusal and add a clear 'candidate binding stage A pending' error. Leave the known A holes (MAIN_ANCHOR 9694..., candidate_tree trust, 3139 metadata) untouched, but document them in the gap list.
3. Deterministic collector collect_p04_native.py (same docs dir). It reads the literal raw and writes only to a new path, B/audit-support/p04-raw-collect-r17/, which must not exist beforehand. Output: a manifest of SHA-bound references/relocation pointers (no repeated copying of big snapshots; materialize at most once if strictly needed). Estimate the footprint first and record it (disk is about 3GB). Reject symlinks, traversal, paths outside the declared membership, and duplicates. Do not write B/p04-evidence/index.json in this stage.
4. Adversarial fixtures checker_series_fixtures.py: at least one negative per series for each of forged scalar, changed raw byte, altered phase pair, formal member SHA drift, wrong source pin, signature-only pin, unowned/missing PID end, symlink, traversal, relabeled interruption reason, and a JSON-only getter substitute. Also include positive small synthetic fixtures. All existing fixtures (checker_negative/applicability/native) must still pass/reject exactly as before; run them with python3.
5. Write a REPAIR17_STATUS.md with: files created, conditions proven per series with raw paths, still-missing conditions, stage A dependencies, and exact Root commands to run the collector and fixtures. State honestly that this is not accepted or completed.
Stop after these steps. No docs-only planning substitute, no broad rewrite.
PREVIOUS_MODEL_REASON:
I picked Astra over the Sol default because this stage is hard adversarial verifier work, not routine editing. In one bounded run the worker has to: (1) parse four different native raw series (S1, S2a, S2b, S3) with different phase/formal layouts (22 formal slots with 176 original+copy members, 176 typed phase pairs, 16 replay pairs, settlement ledger, and duty/shift joins); (2) work out entity IDs and ledger/shift/reservation joins from literal raw bytes instead of Root flags; (3) keep the existing finite C verify_native, its full-function-body pins, and the 23 raw + 2 signature-only + 14 scalar negative rejections working unchanged; and (4) write adversarial negatives (symlink, traversal, forged scalar, altered phase byte, wrong source, unowned PID, formal member SHA drift). A subtle soundness mistake here, such as accepting a relabel or a scalar-only pass, would cost more repair cycles than the extra usage. The scope is still bounded: no engine runs, file-only Python. So one strong run is cheaper than several Sol repairs.