Complete original P28-01 acceptance and preserve performance shortfalls

2026-10-21 05:33:29 +09:00
parent ae9ae47646
commit 413c8e3e51
6 changed files with 1655 additions and 60 deletions
@@ -0,0 +1,37 @@
+# P28-01 正式受入記録
+
+P28-01原work/acceptance/横断6を全9条件（原7枠＋補助2）の独立fresh Desktop Opus5.5レビューPASS、高/中0・low4、通常validation/review/integration/final全PASSと実DB/traceability結合で正式完了。Sddde6f8→Qae9ae47。実測db9d613全9/r02各scope/S954528a別PID再開の版を区別し、製品1407等の実一致を確認。正式23/88・4/30、部分点なし。性能予算6件、200客OpsON、Windows/長期/全ゲーム受入は別未達を維持。
+
+提出 S: `ddde6f8ab50db6baa03f25453a02814b78bbf365`  
+統合・最終検証 Q: `ae9ae47646434dd57fc21f3e8566d0d35b242ab1`  
+基準 M: `0aee05e1d987e126ee9c00536aed5d9c75115d00`
+
+正式証拠: `P28_01_FORMAL_COMPLETION_AE9AE47.json` SHA256 `f778ac8df366110dd7c9ff0b6daa7bde824913e3d813ad090ebd8c20053915a5`
+
+独立レビューは別fresh Claude Desktop Opus5.5。原work/acceptanceと横断6を7枠、補助U1/U2を2枠として判定した。原88成果の分母は増やさない。25合成試験は構造確認であり完了数の代用ではない。全条件の証拠結合、独立レビュー、同一候補の通常integration/finalと台帳を確認して原成果1件を加算した。
+
+G3適用判断: Persisted Runtime state and paused reproduce; wall-clock backlog/sub-minute accumulator deliberately discarded by restore_clock, outside persisted-state contract. Actual writers nonzero accumulator/readers0 and all30 complete typed states/newPID match. Not inferred from non-occurrence.
+
+保存再開は実際の別4PID・各30分の全typed状態と390分の全16イベントに基づく。過負荷停止→保存→復帰の通し試験は未実施で、非0backlog保存の証拠とはしない。
+
+性能予算の失敗は次の6件を維持する。R0は10分参照、P1/P2は各本測定。
+
+| Phase | Metric | Aggregation | Actual (us) | Limit (us) |
+|---|---|---|---:|---:|
+| R0 | main_thread_stall | maximum | 468148 | 50000 |
+| R0 | simulation_x1 | average | 383229 | 4000 |
+| P1 | main_thread_stall | maximum | 4809099 | 50000 |
+| P1 | simulation_x1 | average | 479210 | 4000 |
+| P2 | main_thread_stall | maximum | 5891466 | 50000 |
+| P2 | simulation_x3 | p95 | 5062697 | 12000 |
+
+実測はdb9d613、r02はheadless/OpsOFF/x1、保存再開はS954528a。ゲートQで測定したと書き換えない。全1407製品ソース等の一致で適用範囲を検証した。登録150施設と稼働100施設、tiny OperationsON、GPU null理由、r02のseed欄なし/同一入力SHAによる根拠を保持する。
+
+独立レビューlow4（原結果の全文は `P28_01_INDEPENDENT_REVIEW_DDDE6F8.json`）:
+
+- U1 budget disclosure is incomplete. GATE_CONDITIONS.unmet and SPEC §5 list four budget falses (P1 x2, P2 x2). The full9 raw R0 report also has two false verdicts: simulation_x1 average 383.229 ms > 4 and main_thread_stall max 468.148 ms > 50. They are not counted as pass, since the verifier rejects false-as-pass in every phase, and the raw is SHA-bound. The disclosure should still list all six, or say that R0 is a 10-minute reference phase, when final/ledger records are written.
+- The verifier's output 'commit' is the hardcoded registered BASE 0aee05e, not the verified S ddde6f8, so the JSON alone mislabels the version that was checked. Version binding still holds: the Runner receipt records ddde6f8, and the MANIFEST/CONDITIONS seals exist only in S's gate files. This is a labeling defect, not missing evidence. A future revision should name the field base_commit and emit the verified HEAD and the verifier's own SHA.
+- G3 residual: the overload-triggered pause→save→load path was not run end to end (overloads 0, backlog_at_save 0). Only manual-pause saves were exercised. It is judged out of the persisted-state contract: paused is persisted, while backlog and the sub-minute accumulator are discarded by design in restore_clock. Keep RESTART low #1 in the ledger, and do not cite this run as proof that a non-zero backlog survives.
+- Verifier strength: verify_conditions(conditions, load_json(craw)) compares the file with itself, so only the CONDITIONS_SHA256 seal gives protection. r02 Operations OFF is not asserted against the raw (only --headless and the absent seed are checked); it rests on report.scope and the sealed scopes. Neither weakens this run.
+
+次成果P28-02は実測上位の改善。P28-03、同一Windows配布版実機、長期通常プレイ、全施設・人物・ルート・エンド・図鑑・完成素材・全ゲーム受入は未完。
@@ -0,0 +1,35 @@
+{
+  "task_id": "P28-01-GATE",
+  "commit": "ddde6f8ab50db6baa03f25453a02814b78bbf365",
+  "status": "pass",
+  "summary": "Fresh independent Desktop whole-unit review (claude-opus-5-5), read-only; nothing executed, edited or committed. Integrity: actual-review-packet SHA 791cf223… (normal packet 8eb2fc73… differs only by the material-pointer line), schema 4334b9c4…, manifest 35495218…, and all 3200 material files re-hash to their manifest SHA. Scope: S ddde6f8 vs base 0aee05e changes only the 4 files under gate/** (new; no test removed). Validation raw: p28-01-gate-unit ran 25 synthetic tests, OK. p28-01-gate-verify against the real bundle exited 0 with passed=true, verified_files 3175 and source_files 1407. Its stdout equals build/p28-01-gate-verify.json. The MANIFEST/CONDITIONS seals that exist only in S matched, so S's verifier was what ran. G0 met: Tick and render CPU (P1–P4: 150/50/2398/745) come from full9, actually measured at db9d613, not at Q. Path, snapshot (count 5), save/autosave and load come from r02 (headless, Operations OFF per report.scope, x1 count 300, path cold 245). Every report carries machine Mac16,10, build/engine c7cccbf8…, seed, speed, interval and mean/P95/max with counts. r02 has no seed field and none is invented: its input_sha256 eb4f7700… equals the R0 input, the fixture and readiness, and R0's seed is 28012026. Registered 20000/200/50/150 with 100 active; the P2 warm-up is 31. G1: collector C1/C9 UI speed path and RESTART RS1 UI save/load; Mac only, Windows not verified. G2: default autoload world; O is a real Operations ON run on a tiny input (guests 0–2, facilities 0, 50 cells). G3 met (independent judgment): the original wording 「途中保存・再起動で再現」 requires the persisted Runtime state to reproduce after a mid-run save in a new process. The product's save contract persists paused in clock_snapshot, so an overload stop survives as paused. restore_clock (simulation_kernel.gd:217-231) deliberately sets _accumulator=0 and _skip_next_process: backlog and the sub-minute phase are wall-clock catch-up debt, not game state, and create_snapshot (simulation_runtime.gd:521-583) does not carry them. Requiring them to survive would contradict the product contract and is not implied by the original text. This is not inferred from 'did not occur'. Raw shows the writers saved with a non-zero sub-minute accumulator (R 0.0539 s, O 0.1 s) while the readers restored 0. All 30 per-minute complete typed SHAs still matched across 4 distinct PIDs. Tamper was rejected with CHECKSUM_MISMATCH, and O IDs 9–24 / counter 24 at 390 are equal across the restart. G4: collector stop contract and phase failures, RESTART tamper, paused-idle and boundary. G5: formal 192/192, 22198 checks; source map equals the current 1407-file product map and the full9/r02/RESTART maps; marker and engine match. G6: every receipt is SHA-bound through the sealed manifest. U1/U2 are recorded as auxiliary, not original. U2: each evidence is applied only to its own commit, input and scope. C1 is confirmed independently: SPEC.md at 0aee05e and ddde6f8 has raw SHA e2bff09a… and text.strip() SHA 641ce9ea…, the same blob with no criteria change. The first b78c718 block was a correct contract question with 0 edits. This is the gate judgment only; RESTART completed is not original completion. P28-01 stays 22/88 until prepare, approval, integration, final and the ledger.",
+  "acceptance_ids": [
+    "P28-01-G0",
+    "P28-01-G1",
+    "P28-01-G2",
+    "P28-01-G3",
+    "P28-01-G4",
+    "P28-01-G5",
+    "P28-01-G6",
+    "P28-01-U1",
+    "P28-01-U2"
+  ],
+  "findings": [
+    {
+      "severity": "low",
+      "message": "U1 budget disclosure is incomplete. GATE_CONDITIONS.unmet and SPEC §5 list four budget falses (P1 x2, P2 x2). The full9 raw R0 report also has two false verdicts: simulation_x1 average 383.229 ms > 4 and main_thread_stall max 468.148 ms > 50. They are not counted as pass, since the verifier rejects false-as-pass in every phase, and the raw is SHA-bound. The disclosure should still list all six, or say that R0 is a 10-minute reference phase, when final/ledger records are written."
+    },
+    {
+      "severity": "low",
+      "message": "The verifier's output 'commit' is the hardcoded registered BASE 0aee05e, not the verified S ddde6f8, so the JSON alone mislabels the version that was checked. Version binding still holds: the Runner receipt records ddde6f8, and the MANIFEST/CONDITIONS seals exist only in S's gate files. This is a labeling defect, not missing evidence. A future revision should name the field base_commit and emit the verified HEAD and the verifier's own SHA."
+    },
+    {
+      "severity": "low",
+      "message": "G3 residual: the overload-triggered pause→save→load path was not run end to end (overloads 0, backlog_at_save 0). Only manual-pause saves were exercised. It is judged out of the persisted-state contract: paused is persisted, while backlog and the sub-minute accumulator are discarded by design in restore_clock. Keep RESTART low #1 in the ledger, and do not cite this run as proof that a non-zero backlog survives."
+    },
+    {
+      "severity": "low",
+      "message": "Verifier strength: verify_conditions(conditions, load_json(craw)) compares the file with itself, so only the CONDITIONS_SHA256 seal gives protection. r02 Operations OFF is not asserted against the raw (only --headless and the absent seed are checked); it rests on report.scope and the sealed scopes. Neither weakens this run."
+    }
+  ]
+}