P04-01: 同時発生の更新規約

2026-10-18 12:00:07 +09:00 · 2026-10-18 11:25:54 +09:00 · 2026-10-18 11:16:06 +09:00 · 2026-10-18 10:58:54 +09:00 · 2026-10-16 10:02:30 +09:00 · 2026-10-16 09:33:00 +09:00
120 changed files with 34214 additions and 24 deletions
@@ -1,3 +1,9 @@
+## 現在の次対象（2026-10-13・P24-03）
+
+P24-03「選択と保存の受入」の候補4cefcffは、305script parse/import・局所4suite/254check・同版全173suite/14810checkが失敗0。通常OSによる施設/客/職員/レイヤー選択と保存、別PID17306→19943で実モデルと実表示値の一致を記録し、Runnerの正式機械検証は通過した。現在はreview_pending。正式独立Claudeレビューと統合を残すため成果単位は未完了。正式9/着手22/予定57、30パッケージ/88成果単位・部分点なし。全回帰件数をゲーム完成の代用にしない。
+
+証拠と全7条件の現在記録は [候補版検証](execution/multi-agent-dev-handoff/p24-03-current-validation-r03.json)。レビュー入力は従来500,000bytes上限を超えるため、不変JSON行のraw一致を証明して範囲を絞る [Runner側候補案](checkpoints/p24-review-packet-proposal-r01/PROPOSAL.md) を提示した。承認までRunner本体への適用0、上限変更0。P06マナ案は未承認・製品未反映、P23手動操作延期と同一Windows実機受入は未達を維持。以下の「現在のRunner実行」等は記録時点の履歴である。
+
 ## 現在のRunner実行（2026-10-12）

 ユーザーがmain更新を明示許可し、現成果と原契約入力をmainへ反映済み。元の1成果単位P06-01を範囲とするRunner登録、3CLIの制限下認証確認、Claudeのrun判断、Codex1担当の監査起動まで進んだ。現在の次対象はP06-01。P22-03は必要数量/見積未確定、P23-02の追加性能修正は保留。正式9/着手21/予定58、全体30/88・部分点なし。Runnerの0/1はこの1件だけの運用表示で、全ゲーム分母ではない。証拠検証器は未実装/未実行で未受入。以下の未登録/main接続未解決/P22優先の記述は変更前履歴として保持する。
@@ -0,0 +1,77 @@
+# 未承認・製品未反映：MP-01 マナ契約候補
+
+承認用の候補案です。P06-01の受入や原88成果の完了を意味せず、分母にも加えません。製品・人物・資源・仕様原本・台帳は変更していません。正式試験と別セッションレビューはRunnerが実施します。
+
+## 根拠と区別
+
+原本 `docs/traceability/original/BASELINE.txt` 9.1は枯渇時の全館停止、10.6はマナ炉6×3・裏地下・奴隷消費を規定します。6.1/6.5の代替不可能・解雇売却不可・原則ロストしない人物は投入から除外します。数値、容量、生成周期、炉の収率は原本にありません。
+
+現実装 `autoload/game_state.gd` の初期mana=100は残量です。`autoload/simulation_runtime.gd` のSTARTER_MANA_OUTPUT=100はネットワーク供給能力であり、100 Mana/10分という承認済み生成率ではありません。`maintenance_mana` は完成施設のconsumer需要に登録され、`mana_network_service.gd` の10ゲーム分周期で配電されます。これは現時点で残量から差し引く維持エネルギーではありません。ネットワークの優先配電・75%の縮退・10分の停止保持と、全館のreserve>0ゲートは別です。Runtimeの定期マナ更新はネットワーク評価と電力投影であり、有限残量helperの定期生成消費接続ではありません。
+
+`tests/s2/test_mana_reserve_balance.gd` の残量7・容量10・時刻360、時刻370の生成5・需要8→残量4は試験入力です。承認済み製品値ではなく、今回その試験を実行していません。現sourceのSHA256と区分はJSONのsource_pinsに記録しました。候補の来歴はcandidate、原本・実装・fixtureと区別しています。
+
+## 承認する候補範囲
+
+| 案 | 初期Mana | 容量Mana | 世界樹生成Mana/10ゲーム分 |
+|---|---:|---:|---:|
+| 推薦 | 100 | 300 | 20 |
+| 慎重 | 100 | 200 | 10 |
+| 余裕 | 200 | 600 | 40 |
+
+全て未承認です。推薦は現初期残量100を維持する候補であり、100を原本値と主張しません。容量300は初期の3倍の有限バッファ、生成20は下記の通常需要16を4だけ上回り、全定義一基ずつの需要63には足りない設計上の選択です。周期10は現配電評価境界への整合を理由に提案します。全ゲームのバランス保証ではありません。
+
+換算案は各完成・保有施設のmaintenance_manaを1周期のMana消費量とし、D=Σ(基数×定義値)とします。閉店・停止中も維持需要を計上し、枯渇による需要免除と無償復帰の振動を避けます。撤去・破壊済みは除外します。金維持費の承認A01と同一契約ではなく、別途承認するマナ案です。Manaは整数、時刻はゲーム内分、初回は初期時刻360から370までの一周期です。現実時間10秒=ゲーム内1時間との関係を生成量へ重複換算しません。
+
+B=直前残量、C=容量、G=その周期の世界樹生成、F=確定した炉生成、D=需要。
+
+- available=B+G+F
+- consumed=min(available,D)
+- shortage=D-consumed
+- overflow=max(0,available-consumed-C)
+- after=min(C,available-consumed)
+
+需要を賄ってから余剰を蓄積し、超過は明記して破棄します。after=0では需要ゼロ施設も含め全館停止。供給そのものは停止館外の世界樹から復帰可能とし、次の境界でafter>0かつ局所配電条件成立の場合だけ再開します。ネットワークstorageと残量を二重計上しません。ネットワーク供給100をGとして足すこともしません。供給能力・局所切断と残量の二つのゲートを保ちます。
+
+## 需要と計算比較
+
+JSONはdata/facilities配下の全37定義を列挙します。省略されたmaintenance_manaはFacilityDefinitionの現default=0と明示し、未定義施設のunknownとは区別します。各行のpath・definition_id・observed_maintenance_manaを入力に、全定義一基ずつの合計は63です。定義の存在を通常登録・稼働とみなしません。
+
+歴史監査CURRENT_FACILITY_AUDIT.mdにある対応定義なし13施設（VIPスイート、ドミトリー、レストラン、屋台、カジノ、闘技場、高級ソープ、SM拷問室、覗き部屋、地下牢、マナ炉、ワープ、魔法砲台）は需要unknownです。魔力制御室3×2は原本マナ炉6×3の代替ではありません。現在の定義一覧と歴史監査の登録数も混同しません。
+
+比較は候補式の計算のみです。F=0、初期時刻360、10分刻み。低負荷D=2（食堂一基）、通常D=16（食堂・厨房・大浴場・客EV・受付・警備員詰所各一基）、需要超過D=63（全37定義各一基）を120分計算します。zero・capacityは10分、供給喪失復帰は30分。全入力、各周期結果、shortage/overflowはJSONに保存しています。
+
+| 条件 | 推薦の結果 | 慎重の結果 | 余裕の結果 |
+|---|---:|---:|---:|
+| 低負荷120分 | 300 Mana | 196 Mana | 600 Mana |
+| 通常120分 | 148 Mana | 28 Mana | 488 Mana |
+| 需要超過120分 | 0 Mana | 0 Mana | 0 Mana |
+| 初期0・通常需要10分 | 4 Mana | 0 Mana | 24 Mana |
+| 初期満容量・低負荷10分 | 300 Mana | 200 Mana | 600 Mana |
+| 生成0→0→通常・需要16、30分 | 72 Mana | 62 Mana | 192 Mana |
+| 通常10分後、同分再送 | 104 Mana | 94 Mana | 224 Mana |
+
+推薦の需要超過は100→57→14→0、3周期目にshortage29、その後は毎周期shortage43。通常は100+12×(20−16)=148。供給喪失復帰は100→84→68→72。初期0は生成20−需要16=4で次境界復帰、慎重案は生成10でshortage6、停止を維持します。満容量では需要を支払った余剰のみoverflow。余裕案は復帰しやすい一方、需要63には12周期で枯渇します。
+
+同分再送は全案とも保存済み結果の返却だけで残量不変。同じ分で異なる入力は拒否します。局所供給線だけ喪失する場合もpower_available=falseを投影し、残量が正でも停止します。復帰は局所配電の停止保持条件を満たした評価境界で行い、残量が0なら再開しません。これらは設計比較で、実機受入結果ではありません。
+
+## 炉の候補
+
+原本寸法・裏地下を維持。所有する一般奴隷1名→100 Mana、一炉につき次の10分境界で一回の明示投入を提案します。ユニーク・代替不可能・売却不可・保護対象・ヒロイン・ライバル、客、一般従業員、分類不明な拘束者は除外。適格性が不明なら拒否します。自動投入は行わない案です。
+
+投入前に所有・適格性・炉稼働・空き容量100以上を再検証。人物除去、Mana加算、投入IDと境界・対象ID・適格性根拠・前後残量の履歴を一つの保存可能な原子操作として確定する案です。容量不足では投入せず、人物を消費してoverflowを捨てる案にしません。確定前中断は無変更で取消、確定後中断は保存receiptから復帰して再消費しません。枯渇中の炉は稼働しないため世界樹で先に復帰します。これは将来実装契約の候補で、今回は実際の人物消費も資源変更もありません。
+
+## 更新順序と保存
+
+D05はdecisions.jsonのpendingです。現順序はAPPLY_COMMANDS→TIME_BOUNDARIES→MANA→CONSTRUCTION→LOGISTICS→FACILITY_COMPLETION→VITALS_AND_ENVIRONMENT→INCIDENTS_AND_EVENTS→FACILITY_QUEUES→AI_DECISIONS→PUBLISH_SNAPSHOT。推薦はこのphase列を保持し、MANA内で入力snapshot→生成/炉取引のstage→残量計算→局所配電→全館ゲート→receipt確定とします。
+
+00:00の既承認Gold維持費は閉店・停電でも所有時間に応じて精算し、マナ停止を理由に取り消しません。06:00/18:00の勤務境界は保持。マナ評価後の物流・サービス完了・queueは確定電力を参照する案です。未完了サービスを完了として課金せず、EV/搬送は位置・荷物・ID・ルートを保持して停止、復帰で重複搬送しない案。日跨ぎ完了・費用時点・移動中の具体処理はD05承認前に製品へ接続しません。
+
+旧GameStateは非負値を復元でき0を許し、get_resourceで欠落も0として参照されます。0は現在の投影では停止であり、無制限・満量の証拠ではありません。ネットワークsnapshot版1、save format1/2は新しい残量容量・生成率契約の承認を意味しません。
+
+移行案は適用元版と新domain版を明示し、preview・検証済みbackup後に原子的適用。明示旧0は0・停止を維持。正値は承認容量内のみ保持。欠落、曖昧、負値、非整数、容量超過は拒否して元保存・live状態を保持し、黙って切り詰めません。新保存は残量・容量・最後の境界/flow・炉receipt・配電投影を保持。同境界同入力は再消費・イベント再発行なし、異入力/逆行は拒否。時間飛びは各10分境界を順に処理し、offline生成は別承認なしには行いません。
+
+## 不足・承認待ちと検証
+
+D04の値と換算、D05の境界処理、炉の対象判定・収率・履歴、新保存domain版と移行元適用条件を承認範囲として分けます。未定義13施設の需要、実際の配置基数、全ゲームの性能・経済バランスは未確定です。原P06-01は未達を維持します。
+
+静的に参照sourceと計算を確認した成果です。正式proposal-consistency試験・別Claudeレビュー・承認・統合・完了確定はRunnerに委ね、合格を自己宣言しません。
@@ -0,0 +1,48 @@
+{
+  "observed_at_jst": "2026-10-13T00:25:48.063475+09:00",
+  "status": "draft_unaccepted_not_approval_ready",
+  "original_counts": {
+    "packages": 30,
+    "delivery_units": 88,
+    "completed": 9
+  },
+  "applied_to_product": false,
+  "entries": [
+    {
+      "path": "docs/plans/original-completion-2026-10-02/checkpoints/mana-proposal-draft-r01/PROPOSAL.md",
+      "sha256": "95024959e7c301c6a68a24de36dd6629e45b189f9d038f4397757124ba0bb41f",
+      "bytes": 9918,
+      "source": "/Users/korizatou114/Projects/TheTree-managed-worktrees/mana-proposal/MP-01-implement/docs/plans/original-completion-2026-10-02/execution/mana-proposal/PROPOSAL.md",
+      "scope": "unaccepted draft snapshot only; not original unit acceptance"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/checkpoints/mana-proposal-draft-r01/proposal.json",
+      "sha256": "aca6d781d5ce730c9f905b5dc817f27548b372b043beea68cf6de73761f6f0d2",
+      "bytes": 71713,
+      "source": "/Users/korizatou114/Projects/TheTree-managed-worktrees/mana-proposal/MP-01-implement/docs/plans/original-completion-2026-10-02/execution/mana-proposal/proposal.json",
+      "scope": "unaccepted draft snapshot only; not original unit acceptance"
+    }
+  ],
+  "root_checks": {
+    "source_pins_verified": 53,
+    "arithmetic_flows_verified": 126,
+    "demand_resources": 37,
+    "one_each_observed_load": 63,
+    "scope": "proposal arithmetic/source traceability only; no game or formal Runner acceptance"
+  },
+  "known_formal_gaps": [
+    "source_pins list differs from fixed mapping schema",
+    "formal proposal-consistency not executed",
+    "formal Runner reviewer not executed",
+    "managed worker stopped after two correction attempts; no unlimited retries"
+  ],
+  "read_only_content_review_job": "9d8583a74456470ea73a2bd531feb8ca",
+  "diagnostic_review_completed": true,
+  "content_findings": [
+    "HIGH-1 furnace headroom moment ambiguous; same-boundary tree generation can create overflow after consuming actor; furnace F>0 boundary cases absent",
+    "HIGH-2 restore from zero only possible when generation exceeds retained demand; after==0 stop must preserve original depletion constraint; unconditional recovery claim needs qualification and owner decision",
+    "MED-1 generous excess demand reaches zero on ninth interval, not twelfth",
+    "MED-2 distinguish tree generation loss from local distribution loss; stock balance and local power result separate"
+  ],
+  "review_disposition": "review-disposition.json"
+}
@@ -0,0 +1,28 @@
+{
+  "observed_at_jst": "2026-10-13T00:29:23.970192+09:00",
+  "status": "not_approval_ready",
+  "product_modified": false,
+  "original_delivery_completed": false,
+  "diagnostic_review": "diagnostic-independent-review.json",
+  "accepted_findings": [
+    "HIGH-1 furnace headroom moment ambiguous; same-boundary tree generation can create overflow after consuming actor; furnace F>0 boundary cases absent",
+    "HIGH-2 restore from zero only possible when generation exceeds retained demand; after==0 stop must preserve original depletion constraint; unconditional recovery claim needs qualification and owner decision",
+    "MED-1 generous excess demand reaches zero on ninth interval, not twelfth",
+    "MED-2 distinguish tree generation loss from local distribution loss; stock balance and local power result separate"
+  ],
+  "review_suggestions_not_auto_adopted": [
+    "Replacing depletion stop with shortage-only would change original depletion constraint; do not apply automatically",
+    "MED-3 assertion that one furnace cannot offset demand63 is numerically incorrect: generation20+furnace100 exceeds63 each interval; actual actor cost and sustainable operation still unapproved",
+    "Furnace loyalty side effects and bankruptcy actor eligibility remain proposal decisions; do not fabricate original numeric effect"
+  ],
+  "other_findings_deferred": [
+    "infirmary.tres duplicate properties and unknown queue_staff_min recorded outside proposal scope; no unsolicited fix"
+  ],
+  "formal_workflow_gaps": [
+    "source_pins list differs from registered mapping schema",
+    "formal validator and Runner review absent",
+    "worker correction stopped due forbidden reuse-input reads, despite exact local copy; retry cap respected"
+  ],
+  "next_original_candidate": "P24-03",
+  "proposal_numeric_choices_unapproved": true
+}
@@ -0,0 +1,11 @@
+# P24-03正式レビュー入力の範囲追加候補
+
+これは提案と読取専用prototypeです。Runner本体への適用は0、P24-03の正式受入は未達です。
+
+現候補4cefcffのレビュー主要入力は583,309bytesで、既存上限500,000bytesを超えます。候補内の185,697bytesのmarker JSONは新departure行だけが追加され、既存172行のraw bytesはbaseと一致します。現Runnerは全JSONを全文文字列として重複引用します。上限を増やさず、JSONの不変行を認証付きcontextへ置き換える候補です。
+
+コード全文、全diff、変更/追加/削除JSON行の全文、選択受入の既存3行と新1行の全文を保持します。全ファイルのraw SHA256、base/candidateのGit blob OID、172行のraw一致判定と各行SHA、全metadata前後、省略ID集合を示します。未知形式・重複キー/ID・必要行欠損は省略せず失敗します。変更行はraw差分も対象にし、意味が同じでも改行等を勝手に不変扱いしません。
+
+prototypeの8局所検証は通過しました。実候補に対するcontext例とサイズ実測はcontext-example.json/preflight.jsonにあります。実Runnerのcontract/allocation/validation_sources/正式検証receiptを含む最終packetは、適用時に従来500,000上限で再測定します。全native回帰とraw証拠は全文保持し、正式な別Claudeレビュー・全条件・元の分母を維持します。
+
+提案する追加範囲はRunnerのrunner/core.pyのpacket生成とtests/test_runner.pyの対応検証です。ゲームタスクのallowed_pathsには含まれません。AGENTS.mdの「タスク契約の allowed_paths 外を変更しない。追加変更は提案として返す。」に従い、本体変更は承認まで行いません。状態DB/ポリシー/承認の直接編集、上限/予算/権限拡大、重複ゲーム実装はありません。
@@ -0,0 +1,527 @@
+{
+  "review_context_format": "authenticated-json-rows-proposal-v1",
+  "full_source_not_modified": true,
+  "base_raw_sha256": "5cebdfdffeca26c7778c8be916877b06ae6e42999272d73d01ea66e644a9d648",
+  "candidate_raw_sha256": "3c72cad4dded0619d0cf1c9691b590258ea657d79e482910bde8b0bbeed73e03",
+  "metadata_current": {
+    "schema_version": 1,
+    "scope": "exact per-suite completion label/schema; all check counts from actual raw only",
+    "unknown_roster_suite_policy": "refuse, explicitly review its source/schema before accepting",
+    "roster_count_is_not_hardcoded": true,
+    "original155_authority_sha256": "aa0c90bb4106f592e083bfdc5983d8cc90dcf857477d779d1851ce33edb0d3ad",
+    "current164_review_sha256": "13ae528efd59ec486d705a28e10fb63fed57a5a3f0bba4be1b99518d3fc9561b",
+    "audio3_manifest_sha256": "5e2cf82041c617008099742a4a5611af789922ab1c37740997344caa6470e060",
+    "production_changes": [],
+    "engine_runs": 0,
+    "mimi_purchase_v2_candidate_binding": {
+      "existing4_GD_source_changes": {
+        "autoload/simulation_runtime.gd": {
+          "base_sha256": "dafee4833aa68fb97c8a8c43efc4aa6b9d29d83e00129bd2b99fd99210946b89",
+          "candidate_sha256": "8efbe3aafe519d5b67ba96025a3324b9b724e169aa757b2d31262066ab7b83bb"
+        },
+        "scripts/core/save_service.gd": {
+          "base_sha256": "79a8c3654868c81d3e623a429d8fdfe51f15d098cef8d5b60be091d5200b285d",
+          "candidate_sha256": "3e3d2aeeff7b7610b48bba24ca83610225f93aa8e8deef50c93186ee360fd8b7"
+        },
+        "scripts/supply/supply_management_service.gd": {
+          "base_sha256": "bd99c1418537415b574ff936c74817c721071fdcf4b31b1891347a7b6ae84e30",
+          "candidate_sha256": "e4ad420191020485c027004f64bb00fad9da195fe956ef10dc0c787412018f7f"
+        },
+        "scripts/ui/supply_management_panel.gd": {
+          "base_sha256": "b3425f797f2e56990bffd64a9770fcfd0e4b487b7420e848b43bb7c44f41bc4d",
+          "candidate_sha256": "c23c84c5afb2960b51384d80703c3e454059b46eb04e237df52f62291de7db06"
+        }
+      },
+      "old169_suite_source_SHA_rewritten": false,
+      "source_schema_scope": "prospective Runtime15/formal2; original v1-only14/formal1/generic/legacy1-13 immutable branches remain required",
+      "actual_new_marker": null,
+      "actual_check_count": null,
+      "actual_new_UID3": null,
+      "adoption": false,
+      "source_r06_seal": {
+        "path": "/Users/korizatou114/Projects/とりにく工房ゲーム制作部/artifacts/original-completion-2026-10-02/p17-mimi-purchase-v2-source-candidate-r06/input-seal.json",
+        "sha256": "7c01c096524d9560fb691f7fb1e0b5a718592b964574f8fe0153beb1ec76a60d",
+        "bytes": 3818
+      }
+    }
+  },
+  "metadata_before": {
+    "schema_version": 1,
+    "scope": "exact per-suite completion label/schema; all check counts from actual raw only",
+    "unknown_roster_suite_policy": "refuse, explicitly review its source/schema before accepting",
+    "roster_count_is_not_hardcoded": true,
+    "original155_authority_sha256": "aa0c90bb4106f592e083bfdc5983d8cc90dcf857477d779d1851ce33edb0d3ad",
+    "current164_review_sha256": "13ae528efd59ec486d705a28e10fb63fed57a5a3f0bba4be1b99518d3fc9561b",
+    "audio3_manifest_sha256": "5e2cf82041c617008099742a4a5611af789922ab1c37740997344caa6470e060",
+    "production_changes": [],
+    "engine_runs": 0,
+    "mimi_purchase_v2_candidate_binding": {
+      "existing4_GD_source_changes": {
+        "autoload/simulation_runtime.gd": {
+          "base_sha256": "dafee4833aa68fb97c8a8c43efc4aa6b9d29d83e00129bd2b99fd99210946b89",
+          "candidate_sha256": "8efbe3aafe519d5b67ba96025a3324b9b724e169aa757b2d31262066ab7b83bb"
+        },
+        "scripts/core/save_service.gd": {
+          "base_sha256": "79a8c3654868c81d3e623a429d8fdfe51f15d098cef8d5b60be091d5200b285d",
+          "candidate_sha256": "3e3d2aeeff7b7610b48bba24ca83610225f93aa8e8deef50c93186ee360fd8b7"
+        },
+        "scripts/supply/supply_management_service.gd": {
+          "base_sha256": "bd99c1418537415b574ff936c74817c721071fdcf4b31b1891347a7b6ae84e30",
+          "candidate_sha256": "e4ad420191020485c027004f64bb00fad9da195fe956ef10dc0c787412018f7f"
+        },
+        "scripts/ui/supply_management_panel.gd": {
+          "base_sha256": "b3425f797f2e56990bffd64a9770fcfd0e4b487b7420e848b43bb7c44f41bc4d",
+          "candidate_sha256": "c23c84c5afb2960b51384d80703c3e454059b46eb04e237df52f62291de7db06"
+        }
+      },
+      "old169_suite_source_SHA_rewritten": false,
+      "source_schema_scope": "prospective Runtime15/formal2; original v1-only14/formal1/generic/legacy1-13 immutable branches remain required",
+      "actual_new_marker": null,
+      "actual_check_count": null,
+      "actual_new_UID3": null,
+      "adoption": false,
+      "source_r06_seal": {
+        "path": "/Users/korizatou114/Projects/とりにく工房ゲーム制作部/artifacts/original-completion-2026-10-02/p17-mimi-purchase-v2-source-candidate-r06/input-seal.json",
+        "sha256": "7c01c096524d9560fb691f7fb1e0b5a718592b964574f8fe0153beb1ec76a60d",
+        "bytes": 3818
+      }
+    }
+  },
+  "base_rows": 172,
+  "candidate_rows": 173,
+  "changed_rows": {
+    "tests/ui/test_selection_departure.gd": {
+      "kind": "added",
+      "before": null,
+      "after": {
+        "test": "tests/ui/test_selection_departure.gd",
+        "template": "Selection departure: <checks> checks, <failures> failures",
+        "required": true,
+        "fixed_check_count_used": false,
+        "source_sha256_at_schema_audit": "3137f36f547514f25ce6ac775fa7a5141d12f83ca4b95da0be45fecfafe9d9b4",
+        "authority": {
+          "path": "docs/spec/acceptance/P24-03-code-r02.json",
+          "scope": "new local suite source marker; actual execution pending"
+        }
+      },
+      "before_raw_sha256": null,
+      "after_raw_sha256": "4e664b062178da6f2c7540ac037ab86cc40b7097c0e8800f6b22e527c7a39bfe"
+    }
+  },
+  "focused_current_rows": {
+    "tests/ui/test_actor_selection.gd": {
+      "test": "tests/ui/test_actor_selection.gd",
+      "template": "Actor selection: <checks> checks, <failures> failures",
+      "required": true,
+      "historical_marker_for_schema_only": "Actor selection: 100 checks, 0 failures\n",
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "ecc08464c20990f0a4bd5d1e5d8d6fceb6f3636c959790842a08539fc54ad911",
+      "authority": {
+        "path": "/Users/korizatou114/Projects/とりにく工房ゲーム制作部/artifacts/facility-need-pricing-r02-full155-independent-review-2026-10-01-r01/actual155-source-marker-review.json",
+        "sha256": "aa0c90bb4106f592e083bfdc5983d8cc90dcf857477d779d1851ce33edb0d3ad",
+        "scope": "historical exact label/schema; check count is not an expected future value"
+      },
+      "source_marker_lines": [
+        {
+          "line": 183,
+          "text": "\tprint(\"Actor selection: %d checks, %d failures\" % [_checks, _failures])"
+        }
+      ]
+    },
+    "tests/ui/test_selection_autosave.gd": {
+      "test": "tests/ui/test_selection_autosave.gd",
+      "template": "First operating day: <checks> checks, <failures> failures",
+      "required": true,
+      "historical_marker_for_schema_only": "First operating day: 75 checks, 0 failures\n",
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "1d7d267ef171041f77241c4c2f1a1bb55a46253f803d5c496507e934bc8fa815",
+      "authority": {
+        "path": "/Users/korizatou114/Projects/とりにく工房ゲーム制作部/artifacts/facility-need-pricing-r02-full155-independent-review-2026-10-01-r01/actual155-source-marker-review.json",
+        "sha256": "aa0c90bb4106f592e083bfdc5983d8cc90dcf857477d779d1851ce33edb0d3ad",
+        "scope": "historical exact label/schema; check count is not an expected future value"
+      },
+      "source_marker_lines": []
+    },
+    "tests/ui/test_selection_departure.gd": {
+      "test": "tests/ui/test_selection_departure.gd",
+      "template": "Selection departure: <checks> checks, <failures> failures",
+      "required": true,
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "3137f36f547514f25ce6ac775fa7a5141d12f83ca4b95da0be45fecfafe9d9b4",
+      "authority": {
+        "path": "docs/spec/acceptance/P24-03-code-r02.json",
+        "scope": "new local suite source marker; actual execution pending"
+      }
+    },
+    "tests/ui/test_selection_lifecycle.gd": {
+      "test": "tests/ui/test_selection_lifecycle.gd",
+      "template": "Selection lifecycle: <checks> checks, <failures> failures",
+      "required": true,
+      "historical_marker_for_schema_only": "Selection lifecycle: 38 checks, 0 failures\n",
+      "fixed_check_count_used": false,
+      "source_sha256_at_schema_audit": "b1172419e53fbffccb8f6cda046539fee8be1fe0ad711c3aff7f840b73f77895",
+      "authority": {
+        "path": "/Users/korizatou114/Projects/とりにく工房ゲーム制作部/artifacts/facility-need-pricing-r02-full155-independent-review-2026-10-01-r01/actual155-source-marker-review.json",
+        "sha256": "aa0c90bb4106f592e083bfdc5983d8cc90dcf857477d779d1851ce33edb0d3ad",
+        "scope": "historical exact label/schema; check count is not an expected future value"
+      },
+      "source_marker_lines": [
+        {
+          "line": 149,
+          "text": "\tprint(\"Selection lifecycle: %d checks, %d failures\" % [_checks, _failures])"
+        }
+      ]
+    }
+  },
+  "unchanged_raw_row_count": 172,
+  "unchanged_raw_row_proof": {
+    "tests/business/test_business_closure.gd": "72cfd9533569c79d22895d6163e68c64bb03bf9f6890823d86f399dfec4df914",
+    "tests/business/test_business_operations.gd": "9225c40a46146cfc75b9b65d3f72740b2f4c81df42e47729549221e3904335e5",
+    "tests/business/test_required_kitchen.gd": "20315f991160ed6604c9e71768e4201ac6a5a86bb6ee8e0b86ed4d39413e7ec7",
+    "tests/environment/test_cleaning_access.gd": "ad034c6b408b46a10c516e8ded39e25b832fbbaa22d9696ecb2bbec67f592c3e",
+    "tests/environment/test_facility_cleanliness.gd": "eb81fbf0e8adeca1b91c3b1b83b9ea2a3e8ca3092e7912498848b9e83b569b29",
+    "tests/environment/test_runtime_cleanliness.gd": "510903bc4cc3ac78dea6ae9a10b5fefebf34eb17537af0c095ab9ded90b11ed0",
+    "tests/environment/test_runtime_weather.gd": "c966414af96e35287aab86535cfa3dc48b486c6c7f57b7e00f1678d64b83cf6a",
+    "tests/environment/test_weather_recovery.gd": "4d7f81a0af4f7bd53f0e3210f9bc69f91ed4a47fa46adf141e41eef1e249393e",
+    "tests/environment/test_weather_timeline.gd": "ca41498de14bfbb4f5b18ab44508808afed9226dddbcffe4211bc86e56ccf286",
+    "tests/mvp/test_amelia_donations.gd": "779382447c03c92b51633c4b29d2bcc561c048b0a016715fbd202359175d1c86",
+    "tests/mvp/test_anri_floor_pricing.gd": "417dd0db3e1fe8d49d51fc364cbdfe7bc24d829088addacd0429746bb908eca4",
+    "tests/mvp/test_approved_free_unique_arrears.gd": "28a53b73051cf23792e21bfa696d8efa6241e2f50fa0ee4a02359fc2ea6c8004",
+    "tests/mvp/test_chapel_boundaries.gd": "b3ae22c781059764067d658a75f1a7cbf46543e1ef565295b5cae3a323751c3c",
+    "tests/mvp/test_chapel_service.gd": "77905f0d2383af1c8ce1d822946b9b21d34a01e8c1707c720acd7314b6f7a3fe",
+    "tests/mvp/test_fine_cleaning_effect.gd": "164ebc4801af85be90967fb6db665c1c4f24da5b1fd5b6226b4191b1ba08278e",
+    "tests/mvp/test_mvp_content_catalog.gd": "a3213cbbc96b1850395a3cbeb0a5c7af4baa9498060647c634931b7dbf549ff3",
+    "tests/mvp/test_operations_coordinator.gd": "d599e080fd4643a4fbfefb2ae80b3bad8bbe3013c9598a5773f3ad58936f7c12",
+    "tests/mvp/test_original_midnight_settlement.gd": "ae0c9c6a029eede1c25cbcb53db870ac15f646a91e81d45ed122af3372dfeb1f",
+    "tests/mvp/test_original_room_zones.gd": "dc0d658561a40d52bfb322d3868120bc288ebdb80f21a4c4e2537edc5e254678",
+    "tests/mvp/test_pending_service_pricing_report.gd": "2d864e1e78945ead82152383d66c7dd0596730ad496db31b4b7a958c2116ad60",
+    "tests/mvp/test_premium_room.gd": "1f3d316277f1383fc8d55fed38f9897ff5a4caba20a13f03606cee193bb9a41d",
+    "tests/mvp/test_premium_room_guest_flow.gd": "b6bf3e3baedb621844eded72b45420655903390c77dddb42f33830e02a44f9ae",
+    "tests/mvp/test_progression_service.gd": "dcc9474f6597bc7aad57a76177c17b907613984a38a69da9b5282b5a0e215179",
+    "tests/mvp/test_runtime_content_progression.gd": "3cf572219416bc1f9635eb7b6ac27e6277e74363a675443c487ae1feafce43e7",
+    "tests/mvp/test_runtime_mana_depletion.gd": "f395aca11b29d71edaca3a24152639a1d479cb68c20d418a9be4d8cc9c47db87",
+    "tests/mvp/test_runtime_operations_acceptance.gd": "bdf58844256d6f7be617cf9df18834abcb3f2b4016c6538dbbea1c34b61552c9",
+    "tests/mvp/test_runtime_operations_integration.gd": "a17015a661808f6ecb4f3830e1c3de546621c1edb47525a096b685df22c684f0",
+    "tests/mvp/test_runtime_upkeep.gd": "5a2551bc3c20841874fb723ce81c3d61a10838a070be0fb414c1613823865069",
+    "tests/mvp/test_staff_unique_contract_report.gd": "46e95500abce5310524d510fb2f4a687a0d6d7fdf3229b309f6edadb8a39643d",
+    "tests/mvp/test_tomari_floor_trouble.gd": "a869a46bd27158f59074cd2f47936c236450287ef8141c90757661ef007e25eb",
+    "tests/mvp/test_unique_character_validation_policy.gd": "7251db3eb4676125ecb0f1e586071a18b60d17862d9f8f670e4879f46569dc7e",
+    "tests/mvp/test_upkeep_construction_boundaries.gd": "88afc505b68615ff365936e40ca39288ec83fb58ede96511ac297ef2d834876c",
+    "tests/mvp/test_upkeep_legacy_midnight.gd": "ade1514874f851d738f3198d31b5cb94969f9623bca26f5eeda11bd3677e7501",
+    "tests/mvp/test_upkeep_loss_streak.gd": "421c8598d3fd2de5b4e9c561a638e0cc247226d83e729f8c65157ffbea920524",
+    "tests/performance/test_digest_performance.gd": "8f5f0def8e31088cd29ff3c85d431a09f2cfdca35c0a9d102b1e7871ab118ba2",
+    "tests/performance/test_facility_reachability.gd": "82763c8e1e8a569d057cc1dc717c94472cc1ad39f64ddfa99af1be34a6ad457a",
+    "tests/performance/test_lazy_digest.gd": "4d63e6093dfb4cbf7f22a021bf72f0b03cb50b2da09de4b59585d9c0ee5400a6",
+    "tests/performance/test_mvp_manifest_cache.gd": "1b7bc650ea2879dd582a7dc46bd601b6c1747ec1ebde7bbcffba946a97061281",
+    "tests/performance/test_path_membership.gd": "d251ef2492cc4480685ee227fd7ee424bdf348eca95bac8f340b7fedfcf27d06",
+    "tests/performance/test_perf_mvp_001.gd": "7a0ac13aa9ed0286a9ad5ed2b8088424ad14236a8446d4d6d5d1c0e9233a17f0",
+    "tests/performance/test_snapshot_ownership.gd": "0c9344b64a99ca35d85dacd0db65671dea1c7755384aaf63e334dd9c76bf5383",
+    "tests/performance/test_system_optimization.gd": "878a30fc0027cfbf28da056a1ec5c0c283f21e611671e83f7a721fbe660e1e16",
+    "tests/performance/test_world_snapshot_cache.gd": "f5882af31951e9deca2b8f60766ace3bc7cb43e066673c2681aadfdbbf8a49b1",
+    "tests/run_tests.gd": "3d0e5bee68d4ea183c6a4f5b0bdf899b3290bf079a1987a80ebb376141443590",
+    "tests/s0/test_command_snapshot_key_order.gd": "fbf97927b76c63b4637374e6e690701a5889ad8143dd221b030d3dab663c27a7",
+    "tests/s0/test_command_transaction.gd": "2ecd93cbb418d1db1209e8846c71bcff4f1f17331651d73e3263842e0d30e6c4",
+    "tests/s0/test_definition_registry.gd": "9876d70362d0e9b6402cc5b90acc227e23983a82ff88dbc792026e5c7b7c5304",
+    "tests/s0/test_determinism.gd": "4dd6ece78e2a806b5c791f2d13c7d701558faec5e65d3d410afc30e7718e6d89",
+    "tests/s0/test_domain_events.gd": "5c7d9f7df7921f00892155f793ef707a3d57d7f3ad193bf8c9a5df7c96e950af",
+    "tests/s0/test_runtime_integration.gd": "b436d6fba39f12dfcd95acff0ba2980f2460b77404d937a8ec91d4c5a9ffe188",
+    "tests/s0/test_stable_id_generator.gd": "f4684fd2d6693ae08441abf120ee941c447e99b2dc6a0c2690f5ab0c98c8d1d5",
+    "tests/s1/test_construction_service.gd": "c3fbf58740da5045bc3fb7170a016f53dae2ca63e4a54a19c0273fa5b2b6540a",
+    "tests/s1/test_dimension_batch_save.gd": "9b32174f9ed2b432f988909e54e2ed057b7a34dbf757dc77605b1614e48c3404",
+    "tests/s1/test_excavation_service.gd": "172f76465bda5ed66aa300b60a9b9c5ef307dc8d172d541049610c8c059b6ea9",
+    "tests/s1/test_facility_infrastructure_projector.gd": "a39bf71b97e5e16ab798f1381bb51bf6199cff826bdd310fec6d53befcf6b16d",
+    "tests/s1/test_facility_resize_preview.gd": "7dd9888bfd9977d0d53e88b917d5bb29879f8f5b44b6111678a3da202a881df8",
+    "tests/s1/test_original_facility_dimensions.gd": "01a4de68f9679b557b6745abd50ce4b43bf41f73650c0995b88ed5edf5d32c27",
+    "tests/s1/test_path_congestion.gd": "3714841bc64f147c31adff0c9e744162647a369623cabc231f022a98cf0bb074",
+    "tests/s1/test_path_service.gd": "ecc0d132387f4b488ac8a1ecb841012cc8ed1513563c796bc5d162c49353e0b4",
+    "tests/s1/test_path_snapshot_transit_guard.gd": "f9f1486d51a2a20eb452a342d39dabba05b1614b97ede04788f915eabd025987",
+    "tests/s1/test_route_subslot_path_adapter.gd": "fbdc2073e7ae9d295d275a76ada8d44bddbdf5a9020654052012f4639b9ee920",
+    "tests/s1/test_runtime_infrastructure_integration.gd": "e82fb4117a557cee0cdd3c63f73db9a86d09f44bdce80062362c0ca904fa56c6",
+    "tests/s1/test_runtime_world_construction.gd": "d2da40c0d11dccac4ce94778ffb07230a63e1cd174f48b348791edffb9812d9e",
+    "tests/s1/test_spatial_subslot_service.gd": "72a9f8908f748445883feea6629c55f0162031cd5d641d45790a21f2f7c806bd",
+    "tests/s1/test_weighted_resize_runtime.gd": "cdc5b7a68e10c45c0cb2e83950c39a58e5e461909d40d2935897fb3a8121f437",
+    "tests/s1/test_world_service.gd": "21e86bf3d1e32403a0b73c927e1f604ccc91d78290c22e1742cd063f5fb9a8fe",
+    "tests/s2/test_economy_service.gd": "e1409e38e89714a4c761dcd9e0ae8a2babe3b48150cc09e3f66f8345a1ab4410",
+    "tests/s2/test_facility_pricing.gd": "530df02db6fa460ed665e7449ad4890026a2d87ebef6db4b9acaa9d18a722fe4",
+    "tests/s2/test_facility_service.gd": "df0023c908f01af85eac9726bb2909cb792d6d4ecd3e6a2a8bbc66c8e1e8be36",
+    "tests/s2/test_facility_upkeep_accrual.gd": "53d05baadad526053eded75d1f96dba449331f215ac6cb2a61a55be181ca8651",
+    "tests/s2/test_facility_upkeep_settlement.gd": "fd3241471a704325a469ffe0025f2b7171e267bc87a629c52ad1d40f33152681",
+    "tests/s2/test_inventory_logistics.gd": "2e5da1c09d0ce660ce564a0c7e2e86baa94f463857d94fb8ad24e5905badfad6",
+    "tests/s2/test_kitchen_production.gd": "696d1ad18a3dab00e376b69a181afd04cafe1b04e1e4ec85894e601cbf45628a",
+    "tests/s2/test_ledger_backed_resources.gd": "bf3a4f8cf1b45c25fadb9bbfebce2a618b37ae5a829ed6900b079b8396472443",
+    "tests/s2/test_mana_network_service.gd": "35c7a903df12562fec091d33d7ec9f338ca16cf7fd059ae608a7ac9f428d9d6d",
+    "tests/s2/test_mana_power_projection.gd": "c21a8ebe7580f568134d156554ec5fc6546fc7e095c052fb6736f57cc73f9984",
+    "tests/s2/test_mana_reserve_balance.gd": "bbc62b7a7480c2600eae6291c29344cac41a33ae005320edfd9c695ff8d2c58e",
+    "tests/s2/test_original_facility_parameters.gd": "5eb473d6a8bcbebf2279aacf28229e2fd80fc17a3a31df7cb8bca13cabf2aa94",
+    "tests/s2/test_runtime_operations_cycle.gd": "bb7f88e6364d4d844aae1d26156790359b096fbc1f8db421a1a6173639cba167",
+    "tests/s2/test_service_start_slots.gd": "be9f4027f2a4260b8216ddbadb8857dfde109d393bc27c8de3f1454d8bb447b2",
+    "tests/s3/test_guest_observation_restore_order.gd": "5d1511cc85f7842b61ea635a4ac2af96628b779eca53e988e38eba09a8af2f70",
+    "tests/s3/test_guest_service.gd": "2d311228e7098325a3ce2c52fae7330be9b7cb67efd642ce52aaa5300f3d82ec",
+    "tests/s3/test_runtime_actor_cycle.gd": "11dcb5937962eb0ff7b41e4d8a21c1fe988b659d0024d9bb2b3fec9bd6a6b6d4",
+    "tests/s3/test_runtime_actor_hardening.gd": "30f1965e79aebf2e2fe592850afacdf443ef07d783883876e77f2857b0e30599",
+    "tests/s3/test_runtime_path_traffic.gd": "98f0d342a38e51c463372a69025d05107d20ae87817b280d8c1a7527b5ec23a9",
+    "tests/s3/test_runtime_staff_assignment.gd": "001eca714e0298a953c9c75a5e937da4ecf86e3e2b2bf53ec87b12daaf788115",
+    "tests/s3/test_staff_payroll_operations.gd": "d2cc0087a0d5e39ea7c72e6ac87f4643dcc83bb41297a4d1bc9035b6a544ea6d",
+    "tests/s3/test_staff_service.gd": "6635048deca0dc89e704c9738dc654ce8bc8df1397427bd2cf11b3f2e3a06564",
+    "tests/s4/test_placement_risk_preview_service.gd": "6ca69a7c945a46b6bf7984f078eb7a6694967a1169de04d9208fd84b51541c04",
+    "tests/s4/test_relationship_event_service.gd": "4a4d5038501ffcdb8ffa4596d7bd4395db19003f869a44ba19c59d0a9886b6b0",
+    "tests/s4/test_runtime_relationship_events.gd": "b10d90937468deca44e3540f9d66b50ae8ac56038e48e7478e4803a5cefc125d",
+    "tests/s5/test_authority_service.gd": "854b08f6ea495472b69cadfc70cac545d2e9f948dbb2cad4f45f4161b6f51503",
+    "tests/s5/test_defense_service.gd": "080a5d291d3540d045d9e07023dee561bdce333467ede3b8b31e9d3d8939bff9",
+    "tests/s5/test_runtime_authority_cycle.gd": "502641a3d6ac8205f19f862b46f26d6c6c04020d7f069b1a0a73b71e87389734",
+    "tests/s5/test_runtime_defense_autonomy.gd": "991429baa69b12de16417152f817a224706254a3e71bc4855ea9c63fdf8092be",
+    "tests/s5/test_runtime_defense_cycle.gd": "33f4a8a7e3d09b50c3bc12bf44532ed49b27ecbdd8fdc7b49597b1970bddb681",
+    "tests/s5/test_runtime_event_defense.gd": "cd7e7b9ba355983cb9d182eb0ce03309340a3061f6952d2ad8ef6a5e9c3db7b6",
+    "tests/s6/test_performance_budget.gd": "63fd42ecd5af6b005a79fe676c7cc2390081cf029e945fb44be3c793eefd48c2",
+    "tests/s6/test_runtime_save_lifecycle.gd": "26d2af83a98e9abbce80c0ff1985de9516ce79611b24b94276468657717b07fa",
+    "tests/s6/test_runtime_snapshot_serialization.gd": "0494708b7f0fdc4bd3e6228195687474cfac9baef6164f64dce8e7a69675416f",
+    "tests/s6/test_save_operations.gd": "1614a5122ff9f466aec038f580d63e91c5d1feab8d8f74018fa6b540b75df0e2",
+    "tests/s6/test_save_preflight.gd": "95c951a981c154348b39c889188deb872ce7e9e2ea0740cd8bb2592c3c853b9b",
+    "tests/s6/test_save_recovery_preservation.gd": "5c055617493cbd0cd25049cf8315f880cfbdfc52b3c5f1d17281184870197cfc",
+    "tests/staff/test_dormitory_dimension_migration.gd": "ace438ca3aa97e44db111a5107d630b7fd86eda2fb39f9199ca45eab4a803a71",
+    "tests/staff/test_dormitory_shift_cycle.gd": "b7c868002e2f385abf4d370a31e1a46521115690f4f4acafba8784ee018b3bea",
+    "tests/staff/test_rescue_elevator.gd": "c7d0ac22a4816abbe112ae4413a81410c0c5d0d85eadc69b899b999fedde7dc1",
+    "tests/staff/test_shift_rush.gd": "cfb1c07428bf60f533860d74eeca25c51fd492143b5d598c88b8ff92f2747a57",
+    "tests/staff/test_staff_commute.gd": "6942c4dfc875596b9ff845a206f146d87d28697bf137ed90000547368738821d",
+    "tests/staff/test_staff_dormitory.gd": "eb1d121b79de9df77fee00f2635e7d56ba175cc4e9287ed1234f039093eea7b1",
+    "tests/staff/test_staff_rescue.gd": "7b82618030ea1401b33b7796343aef7894f402fb99d2f26dfb3e5f89fa0e6590",
+    "tests/staff/test_staff_rest.gd": "e3ce1fc69d4bc241066d22a4c6c276871fc72087c1d94bc73d80ed20b88ef00d",
+    "tests/staff/test_task_work_clock.gd": "32c833d2fda02cc42b21b458c874e1afbd55e9d509a72df4bb34cd2d9cd33367",
+    "tests/supply/test_mimi_purchase_quote.gd": "2385b2d9d7a48991e1be5a334195211634d65dcbe5a6aad8abdaa78dce6f575f",
+    "tests/supply/test_normal_auto_purchase_chain.gd": "a1ae167057d8ad73103902911893f4e55e2cde03cbf8d413930919635a52d418",
+    "tests/supply/test_normal_supply_chain.gd": "5e1d57c7b8872073f68ad6224c79c8cc1d3282360a7331d0397b6a75e0c908b5",
+    "tests/supply/test_supply_auto_purchase.gd": "c832d6c871a542050fc90988b4dfc551b8e75002da1dfa406a47ae0d582d147a",
+    "tests/supply/test_supply_auto_purchase_boundaries.gd": "e73f8c11d24bb6c98e4bf3467e08aba6a1a1c18c1b465ea6e3943ce8ba9ebe4a",
+    "tests/supply/test_supply_auto_purchase_destruction.gd": "8b91682beecc74db781f55e0d5c6bcf76f3548becf6e5cebb80bc22f1e645543",
+    "tests/supply/test_supply_logistics_bridge.gd": "6593a850c421f2740cfa50c85055d47c323bc52f1fbd86a1be5b6eec2e550441",
+    "tests/supply/test_supply_management_service.gd": "b2e6a957fd82e384ec426bc10a72af253b1af2532d7154865d00bb81b11da145",
+    "tests/supply/test_supply_save_migration.gd": "00840e0c7267f699153dc99253ce1eb2ecaa71b22a4fd096234409fce5a743d9",
+    "tests/transport/test_elevator_service.gd": "dbfee5c1d581d3ed5414fff0fc8ca2051d12b9f1c8ecfaa44f9bbebc39f10382",
+    "tests/transport/test_runtime_stairs.gd": "f09a9934bf43a3be7f0071743858be804d6deca652113b30d9cde49969669a77",
+    "tests/transport/test_runtime_transport.gd": "9b8674b5220f2e49b5ed88db23cda910910ed97d2eccce8c8bd82e27ae45efff",
+    "tests/transport/test_runtime_transport_comparison.gd": "bc701caacc83a3f110c75538c2d9a97666e90facb4eb84796b407f50f9080417",
+    "tests/transport/test_transport_boundaries.gd": "e76068fe155c15bccf0be14078740886715b624f7b4e30dcd61a0c885469e806",
+    "tests/transport/test_transport_comparison.gd": "1b85b9b85f3f3f292cbccf01372d76fb572bb214386ad7014464fa99d4a829d5",
+    "tests/transport/test_transport_density_migration.gd": "2fa94d1db9135dee7b5253544374d93c535b585d1893bee78d6d072f7a317063",
+    "tests/transport/test_transport_save.gd": "888da77a548b75025c688593119d14f8db5cabe7a6eda46bf9b44f163285be6f",
+    "tests/ui/test_actor_selection.gd": "dc368864b7eaf3180b28f0a245ba7602087d8b87403e30ba3427725cf67eb920",
+    "tests/ui/test_anri_recruitment.gd": "fceed6d7ef285e20972cd50cc17e15baf4ca58ea5ffebdef58884ea9287a7b9f",
+    "tests/ui/test_approved_free_unique_arrears_ui.gd": "7a0d44a3ea62a3f6005593076ec5d51cc77348ed49443f6b66385e95ceefbcf3",
+    "tests/ui/test_business_management.gd": "e21190290fc03e7ef8bd5558a00ad42235c5522fc06eac13176df12becbb6ce0",
+    "tests/ui/test_chapel_gameplay.gd": "8fe9588f68d48884ff0d88ea76018349b618846586fcf6ef0d17be653014709a",
+    "tests/ui/test_cleaning_gameplay.gd": "6a894199f0aca563533e1de6fda3fbea7b0efa8a7b96ede7f68edc95566978db",
+    "tests/ui/test_dashboard_coalescing.gd": "06dab550f94b3d86d703c950310cdae752811616786bf34717b867d153da472b",
+    "tests/ui/test_defense_management.gd": "b2d128234dfd22376bdddcd61bebcfbf9782a5b4a65739a19994bd2df8d2e0d0",
+    "tests/ui/test_dimension_migration_ui.gd": "5c9b1a484bc4f584aa1d0cbc54f8fa4ae6d176fdd1daaef949ccacc66934b0ec",
+    "tests/ui/test_elevator_management.gd": "e0f5ad1aa692e39a185e399798b8d2f88773630ce583d257a341e66bc44cb295",
+    "tests/ui/test_event_log_ui.gd": "46178dc4b1af403597fd60b6280fea723b6ac9277573a0bd7563cf054abdeb26",
+    "tests/ui/test_first_operating_day.gd": "858b2f24e6b5f446920cc8c4c00ececbbaed7ac4a3dfeaa97ac74495017ffd59",
+    "tests/ui/test_guest_decision_log.gd": "55f857d99e5c1370c17459110aae63f7826a6b499eda1d38a76b99484344bd3a",
+    "tests/ui/test_guest_observation.gd": "82d51795bb221c48365459e07e0d2f6569844b256df98b723e8cfa9d04f9187a",
+    "tests/ui/test_layer_presentation.gd": "a47031252032877c72b6ac9e515bf4d149472884331b1ab8cbd57f0379b263ae",
+    "tests/ui/test_layer_skin.gd": "264aceab2cf40dfd05121500d899bcfad68888ef3e3b9cb168e142050de8fd32",
+    "tests/ui/test_main_audio_feedback.gd": "223c187442dea89de78db5b3f55dcfd43e6dade9b8440ab3d1d44ebb2dcb6c7d",
+    "tests/ui/test_main_dashboard.gd": "a39c850b08e3facdad0ba16220179d5c2dd9b077d7402a5a38112828c743096b",
+    "tests/ui/test_opening_assignment.gd": "06f220e76d0b28ce85b33bcf9c15bafd992b377ec6ecf6d0326af5fb000d10e2",
+    "tests/ui/test_original_build_pointer.gd": "4717f53cb0e852287e5b63b1e2bebe0053e27f4e022738a217dc2980cae7858f",
+    "tests/ui/test_original_facility_controls.gd": "ee4dd88a58a83a32082d4869daf05b8e8138149abc31d4d81126a90bb54edbd3",
+    "tests/ui/test_paired_bgm.gd": "dec8008198c2f6b7e816b1291f256ee255f115eeedacb21e14dfcc4a22a82135",
+    "tests/ui/test_pixel_tower.gd": "86ad7cbe417af9ce89e01d4d527e021c2f3d9d862f8df7056f71e5bf018d2a90",
+    "tests/ui/test_rank_pointer.gd": "0624a369902da897a3f9b1d5b5f8355bdd242a7323dfed663cb6a0ea2746f7e4",
+    "tests/ui/test_room_presentation.gd": "0232954ebdaa049f32c9071d6b2dd19a41513c9548e76a9ebf9ba4150b8d2cec",
+    "tests/ui/test_selection_autosave.gd": "3d6bcee63e8e0e3e31b3826998979bfcbf830e21832efb4072cab3153fd76864",
+    "tests/ui/test_selection_lifecycle.gd": "29a849466fc988ea46313b11b7d49be7468da12f93de9800d25949f21167051e",
+    "tests/ui/test_staff_management.gd": "67753d75b6158cc54d281ceec9c7b05d384378d1a1fd187b10cc19ab1899ad05",
+    "tests/ui/test_staff_rescue.gd": "3d583b1e1c9b44a498099cac5186c286d2d3c64a1581dfcc319a29812727d5c2",
+    "tests/ui/test_staff_rest.gd": "61f8f4b225b212c74f624b6085c261708cd6fe48211fcfc96b3b9b7c9bf424b2",
+    "tests/ui/test_stair_transport_details.gd": "5b4586f06297756e04848775cb4758cd196cdf5a83367cdb6de084d19117519a",
+    "tests/ui/test_supply_auto_purchase_ui.gd": "a5c76f923e294ea80cf45c0a7eda616ec778cdf7acf571c501cffbfdb3db8132",
+    "tests/ui/test_supply_management.gd": "299334b472c3ec30a019063fa532f0a5e33ca47dcd21b38266741aa60e9d4d5f",
+    "tests/ui/test_ui_audio_feedback.gd": "10025d2af1fd9c6f82424a43689b1b5d7ab6db160f929b0e2acdf043a7aa14eb",
+    "tests/ui/test_ui_presentation_audio_contract.gd": "51d1b5f81601eabe28ff9ae754a5ac5367b3592b435ed01bcdef7a5a5ba4c504",
+    "tests/ui/test_upkeep_closed_ui.gd": "4105c6f0318119c768d736360d0b409ede0d6d79c805d6cf2e6051a17c35cd6c",
+    "tests/ui/test_upkeep_inspector.gd": "9e2b81c45112d90daa59b36f74d88e2d810a89e080d79b221811daa834d4f4ef",
+    "tests/ui/test_world_tree_rank.gd": "e52baea06e209622e48d129b93fa9ce7ed06533447576aeb17d6710c41c4b147",
+    "tests/world/test_elevator_topology.gd": "0ba5708900940dfb54cad3f51bb954c79a8bfa2853a7e71965aea88bcaecd66d",
+    "tests/world/test_legacy_stairs.gd": "ce24c1806847ff742e230cf79fd4eccac35c37b4d41d30fb388e03115f237b47",
+    "tests/world/test_path_transit_density.gd": "bbcbd525f5fbc555553a45577eb1658dcfad6de509d53970569bd9dae8810f12",
+    "tests/world/test_path_vertical_policy.gd": "0050cda28f5cd59177993c9bfe9347e5cbce5d08d2f5e993cb9f711653176814",
+    "tests/world/test_stair_infrastructure.gd": "8e62bfa97e695d49767bb9e8be2d3143e971a5d727557aaf636153f2a0e10dca"
+  },
+  "omitted_current_rows": [
+    "tests/business/test_business_closure.gd",
+    "tests/business/test_business_operations.gd",
+    "tests/business/test_required_kitchen.gd",
+    "tests/environment/test_cleaning_access.gd",
+    "tests/environment/test_facility_cleanliness.gd",
+    "tests/environment/test_runtime_cleanliness.gd",
+    "tests/environment/test_runtime_weather.gd",
+    "tests/environment/test_weather_recovery.gd",
+    "tests/environment/test_weather_timeline.gd",
+    "tests/mvp/test_amelia_donations.gd",
+    "tests/mvp/test_anri_floor_pricing.gd",
+    "tests/mvp/test_approved_free_unique_arrears.gd",
+    "tests/mvp/test_chapel_boundaries.gd",
+    "tests/mvp/test_chapel_service.gd",
+    "tests/mvp/test_fine_cleaning_effect.gd",
+    "tests/mvp/test_mvp_content_catalog.gd",
+    "tests/mvp/test_operations_coordinator.gd",
+    "tests/mvp/test_original_midnight_settlement.gd",
+    "tests/mvp/test_original_room_zones.gd",
+    "tests/mvp/test_pending_service_pricing_report.gd",
+    "tests/mvp/test_premium_room.gd",
+    "tests/mvp/test_premium_room_guest_flow.gd",
+    "tests/mvp/test_progression_service.gd",
+    "tests/mvp/test_runtime_content_progression.gd",
+    "tests/mvp/test_runtime_mana_depletion.gd",
+    "tests/mvp/test_runtime_operations_acceptance.gd",
+    "tests/mvp/test_runtime_operations_integration.gd",
+    "tests/mvp/test_runtime_upkeep.gd",
+    "tests/mvp/test_staff_unique_contract_report.gd",
+    "tests/mvp/test_tomari_floor_trouble.gd",
+    "tests/mvp/test_unique_character_validation_policy.gd",
+    "tests/mvp/test_upkeep_construction_boundaries.gd",
+    "tests/mvp/test_upkeep_legacy_midnight.gd",
+    "tests/mvp/test_upkeep_loss_streak.gd",
+    "tests/performance/test_digest_performance.gd",
+    "tests/performance/test_facility_reachability.gd",
+    "tests/performance/test_lazy_digest.gd",
+    "tests/performance/test_mvp_manifest_cache.gd",
+    "tests/performance/test_path_membership.gd",
+    "tests/performance/test_perf_mvp_001.gd",
+    "tests/performance/test_snapshot_ownership.gd",
+    "tests/performance/test_system_optimization.gd",
+    "tests/performance/test_world_snapshot_cache.gd",
+    "tests/run_tests.gd",
+    "tests/s0/test_command_snapshot_key_order.gd",
+    "tests/s0/test_command_transaction.gd",
+    "tests/s0/test_definition_registry.gd",
+    "tests/s0/test_determinism.gd",
+    "tests/s0/test_domain_events.gd",
+    "tests/s0/test_runtime_integration.gd",
+    "tests/s0/test_stable_id_generator.gd",
+    "tests/s1/test_construction_service.gd",
+    "tests/s1/test_dimension_batch_save.gd",
+    "tests/s1/test_excavation_service.gd",
+    "tests/s1/test_facility_infrastructure_projector.gd",
+    "tests/s1/test_facility_resize_preview.gd",
+    "tests/s1/test_original_facility_dimensions.gd",
+    "tests/s1/test_path_congestion.gd",
+    "tests/s1/test_path_service.gd",
+    "tests/s1/test_path_snapshot_transit_guard.gd",
+    "tests/s1/test_route_subslot_path_adapter.gd",
+    "tests/s1/test_runtime_infrastructure_integration.gd",
+    "tests/s1/test_runtime_world_construction.gd",
+    "tests/s1/test_spatial_subslot_service.gd",
+    "tests/s1/test_weighted_resize_runtime.gd",
+    "tests/s1/test_world_service.gd",
+    "tests/s2/test_economy_service.gd",
+    "tests/s2/test_facility_pricing.gd",
+    "tests/s2/test_facility_service.gd",
+    "tests/s2/test_facility_upkeep_accrual.gd",
+    "tests/s2/test_facility_upkeep_settlement.gd",
+    "tests/s2/test_inventory_logistics.gd",
+    "tests/s2/test_kitchen_production.gd",
+    "tests/s2/test_ledger_backed_resources.gd",
+    "tests/s2/test_mana_network_service.gd",
+    "tests/s2/test_mana_power_projection.gd",
+    "tests/s2/test_mana_reserve_balance.gd",
+    "tests/s2/test_original_facility_parameters.gd",
+    "tests/s2/test_runtime_operations_cycle.gd",
+    "tests/s2/test_service_start_slots.gd",
+    "tests/s3/test_guest_observation_restore_order.gd",
+    "tests/s3/test_guest_service.gd",
+    "tests/s3/test_runtime_actor_cycle.gd",
+    "tests/s3/test_runtime_actor_hardening.gd",
+    "tests/s3/test_runtime_path_traffic.gd",
+    "tests/s3/test_runtime_staff_assignment.gd",
+    "tests/s3/test_staff_payroll_operations.gd",
+    "tests/s3/test_staff_service.gd",
+    "tests/s4/test_placement_risk_preview_service.gd",
+    "tests/s4/test_relationship_event_service.gd",
+    "tests/s4/test_runtime_relationship_events.gd",
+    "tests/s5/test_authority_service.gd",
+    "tests/s5/test_defense_service.gd",
+    "tests/s5/test_runtime_authority_cycle.gd",
+    "tests/s5/test_runtime_defense_autonomy.gd",
+    "tests/s5/test_runtime_defense_cycle.gd",
+    "tests/s5/test_runtime_event_defense.gd",
+    "tests/s6/test_performance_budget.gd",
+    "tests/s6/test_runtime_save_lifecycle.gd",
+    "tests/s6/test_runtime_snapshot_serialization.gd",
+    "tests/s6/test_save_operations.gd",
+    "tests/s6/test_save_preflight.gd",
+    "tests/s6/test_save_recovery_preservation.gd",
+    "tests/staff/test_dormitory_dimension_migration.gd",
+    "tests/staff/test_dormitory_shift_cycle.gd",
+    "tests/staff/test_rescue_elevator.gd",
+    "tests/staff/test_shift_rush.gd",
+    "tests/staff/test_staff_commute.gd",
+    "tests/staff/test_staff_dormitory.gd",
+    "tests/staff/test_staff_rescue.gd",
+    "tests/staff/test_staff_rest.gd",
+    "tests/staff/test_task_work_clock.gd",
+    "tests/supply/test_mimi_purchase_quote.gd",
+    "tests/supply/test_normal_auto_purchase_chain.gd",
+    "tests/supply/test_normal_supply_chain.gd",
+    "tests/supply/test_supply_auto_purchase.gd",
+    "tests/supply/test_supply_auto_purchase_boundaries.gd",
+    "tests/supply/test_supply_auto_purchase_destruction.gd",
+    "tests/supply/test_supply_logistics_bridge.gd",
+    "tests/supply/test_supply_management_service.gd",
+    "tests/supply/test_supply_save_migration.gd",
+    "tests/transport/test_elevator_service.gd",
+    "tests/transport/test_runtime_stairs.gd",
+    "tests/transport/test_runtime_transport.gd",
+    "tests/transport/test_runtime_transport_comparison.gd",
+    "tests/transport/test_transport_boundaries.gd",
+    "tests/transport/test_transport_comparison.gd",
+    "tests/transport/test_transport_density_migration.gd",
+    "tests/transport/test_transport_save.gd",
+    "tests/ui/test_anri_recruitment.gd",
+    "tests/ui/test_approved_free_unique_arrears_ui.gd",
+    "tests/ui/test_business_management.gd",
+    "tests/ui/test_chapel_gameplay.gd",
+    "tests/ui/test_cleaning_gameplay.gd",
+    "tests/ui/test_dashboard_coalescing.gd",
+    "tests/ui/test_defense_management.gd",
+    "tests/ui/test_dimension_migration_ui.gd",
+    "tests/ui/test_elevator_management.gd",
+    "tests/ui/test_event_log_ui.gd",
+    "tests/ui/test_first_operating_day.gd",
+    "tests/ui/test_guest_decision_log.gd",
+    "tests/ui/test_guest_observation.gd",
+    "tests/ui/test_layer_presentation.gd",
+    "tests/ui/test_layer_skin.gd",
+    "tests/ui/test_main_audio_feedback.gd",
+    "tests/ui/test_main_dashboard.gd",
+    "tests/ui/test_opening_assignment.gd",
+    "tests/ui/test_original_build_pointer.gd",
+    "tests/ui/test_original_facility_controls.gd",
+    "tests/ui/test_paired_bgm.gd",
+    "tests/ui/test_pixel_tower.gd",
+    "tests/ui/test_rank_pointer.gd",
+    "tests/ui/test_room_presentation.gd",
+    "tests/ui/test_staff_management.gd",
+    "tests/ui/test_staff_rescue.gd",
+    "tests/ui/test_staff_rest.gd",
+    "tests/ui/test_stair_transport_details.gd",
+    "tests/ui/test_supply_auto_purchase_ui.gd",
+    "tests/ui/test_supply_management.gd",
+    "tests/ui/test_ui_audio_feedback.gd",
+    "tests/ui/test_ui_presentation_audio_contract.gd",
+    "tests/ui/test_upkeep_closed_ui.gd",
+    "tests/ui/test_upkeep_inspector.gd",
+    "tests/ui/test_world_tree_rank.gd",
+    "tests/world/test_elevator_topology.gd",
+    "tests/world/test_legacy_stairs.gd",
+    "tests/world/test_path_transit_density.gd",
+    "tests/world/test_path_vertical_policy.gd",
+    "tests/world/test_stair_infrastructure.gd"
+  ],
+  "omission_rule": "Only rows byte-identical to the frozen base may be omitted; full file SHA, base blob identity, full diff and machine raw validation stay mandatory.",
+  "base_commit": "286730f88ce430a1cbe1501d40361188f832d235",
+  "candidate_commit": "4cefcff849d4dc1211caa5066e24bfae666cc2f4",
+  "base_git_blob_oid": "54a8438b7e96eb6105e9180a46a4896ec689a30d",
+  "candidate_git_blob_oid": "9438e65c214f6d4732deee1a86853713f6a62f49"
+}
@@ -0,0 +1,35 @@
+{
+  "candidate": "4cefcff849d4dc1211caa5066e24bfae666cc2f4",
+  "runner_modified": false,
+  "proposal_only": true,
+  "fixed_cap": 500000,
+  "major_fields_original_bytes": 583309,
+  "major_fields_proposed_bytes": 417301,
+  "margin_before_contract_allocation_validation_sources_and_receipts": 82699,
+  "full_code_files_retained": true,
+  "all_changed_json_entries_retained": true,
+  "base_unchanged_rows_raw_equal": 172,
+  "changed_entries": [
+    "tests/ui/test_selection_departure.gd"
+  ],
+  "focused_full_entries": [
+    "tests/ui/test_actor_selection.gd",
+    "tests/ui/test_selection_lifecycle.gd",
+    "tests/ui/test_selection_autosave.gd",
+    "tests/ui/test_selection_departure.gd"
+  ],
+  "prototype_tests": "8 pass; proposal diagnostics, not original game acceptance",
+  "prototype_sha256": "f436dd4004641ba1bf1338c23f97fc95b5b0e9e5776373b0d9162352d43e6f13",
+  "scope_proposed": [
+    "Runner runner/core.py review packet assembly only",
+    "Runner tests/test_runner.py authenticated context coverage"
+  ],
+  "not_changed": [
+    "500000 byte cap",
+    "original 30 packages / 88 units / seven P24 conditions",
+    "repair cap2",
+    "gamecandidate sources/metadata/content",
+    "budgets/API routes/security permissions",
+    "Runner state DB and approvals"
+  ]
+}
@@ -0,0 +1,64 @@
+"""Read-only proposal; not installed in Runner. Keep all changed/focused JSON rows."""
+import hashlib,json
+
+def digest(data):return hashlib.sha256(data).hexdigest()
+def pairs(items):
+ result={}
+ for k,v in items:
+  if k in result:raise ValueError('duplicate JSON key')
+  result[k]=v
+ return result
+
+def parse_rows(data):
+ text=data.decode('utf8');decoder=json.JSONDecoder(object_pairs_hook=pairs);obj=decoder.decode(text)
+ if not isinstance(obj,dict) or not isinstance(obj.get('rows'),list):raise ValueError('unsupported JSON schema')
+ def space(i):
+  while i<len(text) and text[i].isspace():i+=1
+  return i
+ pos=space(1);span=None
+ while pos<len(text) and text[pos]!='}':
+  key,end=decoder.raw_decode(text,pos);pos=space(end)
+  if text[pos]!=':':raise ValueError('invalid key separator')
+  start=space(pos+1);_,end=decoder.raw_decode(text,start)
+  if key=='rows':span=(start,end)
+  pos=space(end)
+  if text[pos]==',':pos=space(pos+1)
+ if span is None:raise ValueError('missing rows')
+ pos=space(span[0]+1);rows={}
+ while pos<span[1] and text[pos]!=']':
+  start=pos;row,end=decoder.raw_decode(text,pos)
+  if not isinstance(row,dict) or not isinstance(row.get('test'),str) or not row['test'] or row['test'] in rows:raise ValueError('invalid/duplicate row ID')
+  rows[row['test']]={'value':row,'raw':text[start:end].encode('utf8')};pos=space(end)
+  if text[pos]==',':pos=space(pos+1)
+ if len(rows)!=len(obj['rows']):raise ValueError('row cardinality mismatch')
+ return obj,rows
+
+def context(base,current,focus=()):
+ b,br=parse_rows(base);c,cr=parse_rows(current)
+ if not set(focus)<=set(cr):raise ValueError('focused row absent')
+ unchanged={k for k in br.keys()&cr.keys() if br[k]['raw']==cr[k]['raw']};changed=(br.keys()|cr.keys())-unchanged
+ entries={k:{'kind':'modified' if k in br and k in cr else 'added' if k in cr else 'removed','before':br[k]['value'] if k in br else None,'after':cr[k]['value'] if k in cr else None,'before_raw_sha256':digest(br[k]['raw'])if k in br else None,'after_raw_sha256':digest(cr[k]['raw'])if k in cr else None}for k in sorted(changed)}
+ return {'review_context_format':'authenticated-json-rows-proposal-v1','full_source_not_modified':True,'base_raw_sha256':digest(base),'candidate_raw_sha256':digest(current),'metadata_current':{k:v for k,v in c.items()if k!='rows'},'metadata_before':{k:v for k,v in b.items()if k!='rows'},'base_rows':len(br),'candidate_rows':len(cr),'changed_rows':entries,'focused_current_rows':{k:cr[k]['value']for k in sorted(focus)},'unchanged_raw_row_count':len(unchanged),'unchanged_raw_row_proof':{k:digest(cr[k]['raw'])for k in sorted(unchanged)},'omitted_current_rows':sorted(set(cr)-changed-set(focus)),'omission_rule':'Only rows byte-identical to the frozen base may be omitted; full file SHA, base blob identity, full diff and machine raw validation stay mandatory.'}
+
+if __name__=='__main__':
+ import unittest
+ class Proof(unittest.TestCase):
+  def enc(self,rows,**other):return json.dumps({'rows':rows,**other},ensure_ascii=False,indent=2).encode()
+  def test_added_changed_removed(self):
+   x=context(self.enc([{'test':'a','v':1},{'test':'b','v':2}]),self.enc([{'test':'a','v':3},{'test':'c','v':4}]))
+   self.assertEqual({k:v['kind']for k,v in x['changed_rows'].items()},{'a':'modified','b':'removed','c':'added'})
+  def test_unchanged_raw_and_focus(self):
+   b=self.enc([{'test':'a','v':'日本語'},{'test':'b','v':2}]);x=context(b,b,['a']);self.assertEqual(x['unchanged_raw_row_count'],2);self.assertEqual(x['omitted_current_rows'],['b']);self.assertEqual(x['focused_current_rows']['a']['v'],'日本語')
+  def test_duplicate_id(self):
+   with self.assertRaises(ValueError):context(self.enc([]),self.enc([{'test':'a'},{'test':'a'}]))
+  def test_duplicate_key(self):
+   with self.assertRaises(ValueError):context(self.enc([]),b'{"rows": [], "rows": []}')
+  def test_missing_focus(self):
+   with self.assertRaises(ValueError):context(self.enc([]),self.enc([]),['absent'])
+  def test_malformed_row(self):
+   with self.assertRaises(ValueError):context(self.enc([]),self.enc([{'id':'wrong'}]))
+  def test_metadata_retained(self):
+   x=context(self.enc([],mode=1),self.enc([],mode=2));self.assertEqual(x['metadata_before']['mode'],1);self.assertEqual(x['metadata_current']['mode'],2)
+  def test_raw_format_change_is_included(self):
+   b=self.enc([{'test':'a','v':1}]);c=b.replace(b'"v": 1',b'"v":  1');self.assertEqual(context(b,c)['changed_rows']['a']['kind'],'modified')
+ unittest.main()
@@ -1,3 +1,5 @@
+現状更新（2026-10-13T00:29:23.970192+09:00）: 承認用マナ候補はcheckpoint mana-proposal-draft-r01へ原稿同一内容で保存。内容の独立診断レビューで未解決がありnot_approval_ready、製品未反映。正式完了9/88、P06-01未完。修正上限を守り再起動停止。次の独立候補P24-03はp24-03-next-scope-r01.jsonに原契約/既存実装/不足/試験計画を整理済み、実装担当未起動。
+
 現状更新（2026-10-13T00:11:39.759932+09:00）: P06-01監査は未採用・正式試験なしで終端。元成果はin_progress、正式9/88のまま。人間許可に基づきMP-01承認用マナ候補案を作成する。MP-01は原88成果に加算せず、値の本番反映も承認まで行わない。詳細はp06-audit-terminal-r01.json。以下は履歴。

 ## 現在のRunner実行（2026-10-12）
@@ -0,0 +1,26 @@
+{
+  "observed_at_jst": "2026-10-13T00:50:08.864306+09:00",
+  "host": "TakeshinoMac-mini.local",
+  "read_only": true,
+  "settings_changed": false,
+  "observed_settings": {
+    "system_sleep_minutes": 0,
+    "display_sleep_minutes": 180,
+    "screensaver_idleTime": 0,
+    "askForPassword_default_domain": "not present, not interpreted as disabled"
+  },
+  "relevant_events": [
+    "2026-10-12 21:24:44: startUnlock kLWUnlockFromUserActive; previous kLWLockFromDisplayDim",
+    "2026-10-12 21:47:18.329: _handleAppleEvent Received a kAELockScreenEvent",
+    "2026-10-12 21:47:18.332: startScreenLock entered kLWLockFromDirectLock (8)"
+  ],
+  "inference": "21:47 event was a direct screen-lock request, not an idle timeout; earlier display-dim path also observed. Sender and explanation of repeated historical locks unproven.",
+  "sender_query": "appleeventsd/SystemUIServer 21:47:15-20 lock/lcks query returned no matching events",
+  "ui_inventory_current": "CUA returned native inventory without connection error; actual candidate OS input not yet executed",
+  "raw_log_hashes": {
+    "the-tree-lock-diagnostic.log": "cca22e0f7e6e8e28097e5b7ee68a0f36afa599d87619a803581c08254b9e4b3d",
+    "the-tree-lock-caller.log": "2c6f0e422c91f5ef39433dce9498e8408645def69968e5a45733b301d3cdb588",
+    "the-tree-lock-sender.log": "9f56fca152030dba9e8ee76dee4fc8967ab667507b5878f0f9ab819d55b6b9a6"
+  },
+  "original_game_acceptance_inferred": false
+}
@@ -0,0 +1,133 @@
+{
+  "observed_at_jst": "2026-10-13T00:50:08.864306+09:00",
+  "original_delivery": "P24-03",
+  "same_original_conditions": true,
+  "old_ui_job": {
+    "job_id": "3eefb441761546d6ae2f59000d912e9a",
+    "state": "cancelled",
+    "project": "the-tree-p24-03",
+    "task_id": "P24-03",
+    "operation": "dispatch",
+    "created": 1791819430.489873,
+    "pid": 92328,
+    "started": 1791819430.5233622,
+    "error": "Stopped by workflow_cancel",
+    "finished": 1791819864.843694,
+    "stdout_tail": "",
+    "stderr_tail": ""
+  },
+  "old_task_after_recover": {
+    "id": "P24-03",
+    "contract": {
+      "id": "P24-03",
+      "title": "選択と保存の受入",
+      "requirement_ids": [
+        "P24-03"
+      ],
+      "acceptance_ids": [
+        "P24-03"
+      ],
+      "spec_ref": "docs/spec/acceptance/P24-03.json",
+      "base_commit": "9b2ee480a88054eb863eb5cdff855b379201a7c1",
+      "worker": "agy",
+      "allowed_paths": [
+        "scenes/main/main.gd",
+        "scripts/ui/guest_observation_panel.gd",
+        "scripts/ui/staff_management_panel.gd",
+        "tests/ui/test_selection_departure.gd",
+        "tests/ui/test_selection_departure.gd.uid",
+        "tests/ui/fixtures/selection_cross_process.gd",
+        "tests/ui/fixtures/selection_cross_process.gd.uid",
+        "tools/check_p24_selection_evidence.py",
+        "tools/run_all_tests.py",
+        "tools/regression/suite-policy.json",
+        "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json",
+        "docs/plans/original-completion-2026-10-02/execution/p24-03/**"
+      ],
+      "depends_on": [],
+      "resource_locks": [
+        "main-selection-lifecycle",
+        "selection-acceptance-profile",
+        "regression-roster-policy"
+      ],
+      "validation_ids": [
+        "p24-acceptance"
+      ],
+      "max_repair_attempts": 2,
+      "spec_sha256": "4d353ff816d8edbb39671159e4f9fd87c20224cf0c44ea7b8fadc03bf25ae244"
+    },
+    "state": "blocked",
+    "worktree": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p24-03/P24-03-implement",
+    "submitted": null,
+    "candidate": null,
+    "main_base": null,
+    "reason": "runner_interrupted: dead process",
+    "repairs": 0,
+    "evidence": [],
+    "owner_approval": null
+  },
+  "role_diagnosis": {
+    "action": "wait",
+    "task_id": "P24-03",
+    "reason": "【判断】wait。agyの現runは停止のまま再開せず、UI調査を終端として扱う。P24-03は未達(0/1)で、受入分母・条件・上限・権限は変更しない。同じ原unitのコード実装をCodexへ渡す案は妥当と判断する。ただしspecの実装指示は「UI寿命/保存選択の担当はagy」と書かれている。worker差替えはその文言と食い違うため、窓口/オーナーの了承を待ってから割り当てる。それまで待機。\n\n【原因】agyのCLI ui promptはshell git statusだけを許し、view_fileはAbsolutePathのみで、行範囲指定や末尾までの確実な読取り手段がない。そのため同一引数で読み直す反復になった(main.gd 17回、staff_service.gd 13回、guest_service 6回、6分超)。編集は0。これは仕様不足でも環境blockでもなく、役割とツール能力の不一致。作業内容は画面設計でも素材差替えでもなく、GDScriptの選択保存/復元/不存在処理というデータ整合と寿命制御が主体。既存変更が0なので、Codexへ渡しても重複実装にならない。\n\n【最小対策】(1) agyの該当runは停止のまま維持し、同一引数の反復読取りを再試行しない。(2) agyの成果は「UI調査の終端」として記録する。範囲は、開始前の全回帰構成(1299 source/172 suite/303 parse)確認がpassだったこと、実行は0であること、読取りが停止要因だったこと。これは新しい全体blockにしない。(3) 同じP24-03・同じtask契約(allowed_paths、resource_locks、max_repair_attempts=2、validation p24-acceptance)のまま、実装担当をCodexへ割り当てる。base_commit 9b2ee48は維持する。(4) 未実行の証拠はpendingのままにする。\n\n【担当分界】\n- Codex:\n  - main.gd、guest_observation_panel.gd、staff_management_panel.gd のうち、必要な不足だけを修正する。対象は、選択ID/表示値/レイヤー/地図強調の保存・復元、不存在・不正型・過大ID・旧metadataの安全処理、失敗読込時の現在選択とゲーム状態の保持。\n  - 実離脱/除去後に選択しない扱い。履歴の存在と現在の選択可能性は区別する。Unique人物の解雇/消去禁止は維持する。\n  - tests/ui/test_selection_departure.gd と tests/ui/fixtures/selection_cross_process.gd の追加。\n  - tools/check_p24_selection_evidence.py の作成。--verify-onlyはBUILD_OUTPUT_DIR/p24-evidence/index.jsonを読み、証拠なし/古いsource/未実行/条件不足なら非0にする。自己申告trueだけを受入にしない。\n  - tools/run_all_tests.py の--suite複数指定(任意)と、新suite分のpolicy追加。\n  - docs/plans/original-completion-2026-10-02/execution/p24-03/ の条件matrixと変更/不足/実行計画。\n- agy: 画面確認が必要になった場合に限り、通常OSの選択・保存・別process再開の観察を担当する。これはコード提出後の証拠収集であり、実装ではない。\n- Runner/root: 正式試験、全回帰、別Claude独立レビュー、承認、統合。commanderと作成者はgit書込みや他worker起動をしない。\n\n【原contractの保ち方】\n- 受入は7条件(facility/guest/staff lifecycle、layer_and_values、invalid_and_failed_load、normal_os_input、final_validation_review)すべて。部分完了や条件緩和はしない。\n- 直接state変更で通すことはしない。pressed.emitや関数呼び出しだけをOS入力証拠にしない。\n- テストの削除・無効化、assert削除、件数の水増しはしない。既存suite/cleanup/strict markersを弱めない。\n- 上限・予算・権限は拡大しない。allowed_paths外は変更せず、必要なら提案として返す。\n- 外部入力は必須化しない。旧別worktreeの外部パスを必要入力にせず、現repoのsourceと固定specだけで完結させる。\n- SHAは区別する。spec_sha256は git show の文字列をstrip()してUTF-8でハッシュした値。source_pinsはraw bytes SHA。末尾改行によるraw/normalizedの差だけでblockedにしない。\n- 現source pinsは再確認する。pinと違うfileは、既存成果を再利用するか判断してから修正する。正常な既存実装は再実装しない。\n- Package依存と数値未承認は統合前提であり、この縦スライスの全体blockにしない。Windows固有条件は別途未受入のまま。Macで足りない証拠は作業として扱い、環境blockにしない。\n- コード提出はsubmittedとして可。元成果の完了は、全必要証拠(native/cross-process/OS入力/最終候補の全回帰)と独立レビューの後だけ。\n- 仕様変更、受入分母変更、予算拡大、承認、main統合はオーナー判断。この提案には含めない。"
+  },
+  "old_edits": 0,
+  "old_native_tests": 0,
+  "code_task": {
+    "id": "P24-03",
+    "contract": {
+      "id": "P24-03",
+      "title": "選択と保存の受入",
+      "requirement_ids": [
+        "P24-03"
+      ],
+      "acceptance_ids": [
+        "P24-03"
+      ],
+      "spec_ref": "docs/spec/acceptance/P24-03-code-r02.json",
+      "base_commit": "286730f88ce430a1cbe1501d40361188f832d235",
+      "worker": "codex",
+      "allowed_paths": [
+        "scenes/main/main.gd",
+        "scripts/ui/guest_observation_panel.gd",
+        "scripts/ui/staff_management_panel.gd",
+        "tests/ui/test_selection_departure.gd",
+        "tests/ui/test_selection_departure.gd.uid",
+        "tests/ui/fixtures/selection_cross_process.gd",
+        "tests/ui/fixtures/selection_cross_process.gd.uid",
+        "tools/check_p24_selection_evidence.py",
+        "tools/run_all_tests.py",
+        "tools/regression/suite-policy.json",
+        "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json",
+        "docs/plans/original-completion-2026-10-02/execution/p24-03/**"
+      ],
+      "depends_on": [],
+      "resource_locks": [
+        "main-selection-lifecycle",
+        "selection-acceptance-profile",
+        "regression-roster-policy"
+      ],
+      "validation_ids": [
+        "p24-acceptance"
+      ],
+      "max_repair_attempts": 2,
+      "spec_sha256": "dbb885b47a3ee4af3d4180bb97fe746e26a0e08d75af2cd3b5b727ed337bd37c"
+    },
+    "state": "implementing",
+    "worktree": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p24-03-code/P24-03-implement",
+    "submitted": null,
+    "candidate": null,
+    "main_base": null,
+    "reason": null,
+    "repairs": 0,
+    "evidence": [],
+    "owner_approval": null
+  },
+  "code_prepare_job": "b4bfb86eaa794fe7b8212710b25eb12d",
+  "code_doctor_job": "c177086f83d34426ae06ba7929bd13a1",
+  "code_commander_job": "99b733e329404f188d7666503e3c83d7",
+  "code_dispatch_job": "cc88bb8c62c9474a81d25d230f9c3150",
+  "runner_acceptance_completed": 0,
+  "global_completed": 9,
+  "partial_credit": false
+}
@@ -0,0 +1,115 @@
+{
+  "schema_version": 1,
+  "original_plan_id": "P24-03",
+  "recorded_at_jst": "2026-10-13T02:29:07.026485+09:00",
+  "candidate_commit": "4cefcff849d4dc1211caa5066e24bfae666cc2f4",
+  "worktree": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p24-03-code/P24-03-implement",
+  "production_adopted": false,
+  "formal_acceptance": false,
+  "denominator": {
+    "packages": 30,
+    "deliveries": 88,
+    "completed_deliveries": 9,
+    "partial_credit": false
+  },
+  "condition_status": {
+    "facility_lifecycle": "executed",
+    "guest_lifecycle": "executed",
+    "staff_lifecycle": "executed",
+    "layer_and_values": "executed",
+    "invalid_and_failed_load": "executed",
+    "normal_os_input": "executed",
+    "final_validation_review": "pending_review"
+  },
+  "full_regression": {
+    "actual_suites": 173,
+    "strict_accepted_checks": 14810,
+    "failed_suites": 0,
+    "remaining_unexecuted_tests": [],
+    "source_default_player_stage_cleanup_guard_errors": 0,
+    "receipt": {
+      "path": "/Users/korizatou114/Projects/とりにく工房ゲーム制作部/artifacts/original-completion-2026-10-02/p24-03-full173-native-r01/runner-ended.json",
+      "bytes": 3660538,
+      "sha256": "01e3677abe2aa93d0e4f81f922f0c66757f17d6f213254cf8aa121abd849f6a3"
+    },
+    "input": {
+      "path": "/Users/korizatou114/Projects/とりにく工房ゲーム制作部/artifacts/original-completion-2026-10-02/p24-03-full173-native-r01/runner-input.json",
+      "bytes": 320141,
+      "sha256": "db71b3267266b5115c5207048fa7744bc3d47be6684a395cbbd58307e0b196dd"
+    }
+  },
+  "local_validation": {
+    "suites": 4,
+    "checks": 254,
+    "failures": 0,
+    "parse_scripts": 305,
+    "receipt": {
+      "path": "/Users/korizatou114/Projects/とりにく工房ゲーム制作部/artifacts/original-completion-2026-10-02/p24-03-local-native-r03/local-ended.json",
+      "bytes": 293895,
+      "sha256": "c24e46313ede5ba006944d2b239cfe1d1b54ca3e2a8a7fa6e22322963808eec3"
+    }
+  },
+  "normal_os_and_distinct_process": {
+    "producer_pid": 17306,
+    "consumer_pid": 19943,
+    "raw_comparison": {
+      "path": "/Users/korizatou114/Projects/とりにく工房ゲーム制作部/artifacts/original-completion-2026-10-02/p24-03-native-os-r01/cross-pid-os-raw-comparison.json",
+      "bytes": 634,
+      "sha256": "a3236c477686040d1d6dd0c6bcbf17ca9d42e7cdc07e8e98b0f63b759be69e71"
+    },
+    "input": {
+      "path": "/Users/korizatou114/Projects/とりにく工房ゲーム制作部/artifacts/original-completion-2026-10-02/p24-03-native-os-r01/os-input-v2.json",
+      "bytes": 158558,
+      "sha256": "4c720ce714ad08e5d9f913de85d5555e180b627a6d5c846bfc7bdfbac4d2a0bd"
+    },
+    "transcoding": {
+      "path": "/Users/korizatou114/Projects/とりにく工房ゲーム制作部/artifacts/original-completion-2026-10-02/p24-03-native-os-r01/native-frames/native-image-transcoding.json",
+      "bytes": 8362,
+      "sha256": "4ebd5fd611a460b550691101878f65b91b1ae0fc6eefbac7cde947449892fb09"
+    },
+    "limitations": [
+      "CUA native app API delivered OS input; separate raw RPC instrumentation was not present.",
+      "Original returned screenshots are JPEG. Converted PNG pixels were proven equal; original JPEG bytes retained.",
+      "Normalized derived lines are ROOT_NORMALIZATION, not engine-emitted observations. Original engine logs and raw model/UI reports retained.",
+      "Mac evidence does not establish Windows acceptance."
+    ]
+  },
+  "evidence_index": {
+    "path": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p24-03-code/.runtime/P24-03/build/p24-evidence/index.json",
+    "bytes": 1416644,
+    "sha256": "98f9e066d370083c31c491b8ee913ada134d1c70ee5978f8545a80ca3d2f5043"
+  },
+  "formal_runner_validation": {
+    "job_id": "246e3747f45e458f97a6e031e606faa4",
+    "operation": "validate",
+    "job_state": "succeeded",
+    "task_state": "review_pending",
+    "machine_validation": true,
+    "formal_acceptance": false
+  },
+  "remaining": [
+    "Formal independent Claude acceptance review for the exact candidate and evidence.",
+    "Reviewed source integration and verification of unchanged source pins."
+  ],
+  "review_packet_proposal": {
+    "path": "docs/plans/original-completion-2026-10-02/checkpoints/p24-review-packet-proposal-r01/PROPOSAL.md",
+    "owner_approval": "pending",
+    "runner_changes_applied": false,
+    "size_cap_changed": false
+  },
+  "reused_evidence": [
+    "Original P02 fixed operating save package used only as immutable input; current candidate loaded it through native OS.",
+    "Earlier failed candidate receipts retained as history, not reused as acceptance."
+  ],
+  "dependencies": {
+    "original_package_dependencies": [
+      "P09",
+      "P15",
+      "P16",
+      "P18",
+      "P23",
+      "P19"
+    ],
+    "slice_note": "No unapproved mana coefficient used. Package-wide and Windows conditions remain outside this slice and unaccepted."
+  }
+}
@@ -0,0 +1,57 @@
+{
+  "observed_at_jst": "2026-10-13T01:10:31.583740+09:00",
+  "original_plan_id": "P24-03",
+  "candidate_commit": "9c711860a82d597a48dab595a49d4f23c5f3c370",
+  "original_unit_accepted": false,
+  "full_regression_executed": false,
+  "import_passed": true,
+  "parse_passed": true,
+  "parsed_scripts": 304,
+  "local_suites_planned": 4,
+  "local_suites_executed": 1,
+  "local_suite_passed": false,
+  "reported_checks": 31,
+  "failures": [
+    "departed guest selection/dropdown assumption",
+    "departed guest details assumption",
+    "actual facility construction starts",
+    "actual facility construction completes"
+  ],
+  "source_default_player_cleanup_guard_errors": [],
+  "evidence": {
+    "artifacts/original-completion-2026-10-02/p24-03-local-native-r01/runner-input.json": {
+      "bytes": 320004,
+      "sha256": "a270f87eb6a062c24da903c023af932095c29b0966aee9391e3952aff8a4fee7"
+    },
+    "artifacts/original-completion-2026-10-02/p24-03-local-native-r01/local-ended.json": {
+      "bytes": 55320,
+      "sha256": "ca878fa4ef79736460bd02e6e735707522059e76d61ce898fd915a988fb80393"
+    },
+    "artifacts/original-completion-2026-10-02/p24-03-local-native-r01/000-receipt.json": {
+      "bytes": 13059,
+      "sha256": "cf5f38ed6eb296e33304265ef62f9b57329fb5d6c8b39ec4be1e46921b64d1ce"
+    },
+    "artifacts/original-completion-2026-10-02/p24-03-local-native-r01/000/engine-native.log": {
+      "bytes": 22233,
+      "sha256": "7ddf46d4e42e406499949ca69ccc830921de621919bf13d7d52be2c5fa413960"
+    }
+  },
+  "formal_validation_job": "f9d9a0c639f14a5c80ce35dce6dffbbe",
+  "formal_validation_state": "failed: evidence missing",
+  "repair_job": "d02f0b6b551046dcb56eb6f2ff3b2cab",
+  "repair_state": "repair_ready",
+  "repairs_used": 1,
+  "repair_limit": 2,
+  "remaining_conditions": [
+    "facility lifecycle actual demolition",
+    "guest and staff absence/current detail values",
+    "layer and valid selection roundtrip",
+    "invalid/failed loads",
+    "distinct-process formal save restart",
+    "normal OS delivered input and observed current model values",
+    "exact final candidate full regression, formal independent Claude review and integration"
+  ],
+  "global_completed": 9,
+  "global_total": 88,
+  "partial_credit": false
+}
@@ -0,0 +1,44 @@
+{
+  "id": "P24-03",
+  "status": "next_scope_proposal_not_started",
+  "work": "施設・客・職員・レイヤーの選択を撤去、離脱、保存再起動に跨がせる。",
+  "acceptance": "不在対象を参照せず、有効な選択と画面値が復元される。",
+  "selection_reason": "既存復元実装と局所試験を再利用でき、P06未承認数値や延期したCtrl保持入力に依存せず、撤去/離脱/別process再開という有限範囲を閉じられる見込み。",
+  "existing_implementation": [
+    "version1 presentation IDs and open flags",
+    "valid entity/staff/guest existence checks at load",
+    "GameState active_layer and inspector restore"
+  ],
+  "reusable_test_sources": [
+    "tests/ui/test_actor_selection.gd",
+    "tests/ui/test_selection_lifecycle.gd",
+    "tests/ui/test_selection_autosave.gd"
+  ],
+  "current_pass_evidence": [],
+  "reused_pass_claim": false,
+  "missing_conditions": [
+    "実撤去後の施設選択と表示更新",
+    "実離脱/解雇後の客・職員選択と表示更新",
+    "選択とレイヤー/画面値の同一候補版・正式保存・別process再開",
+    "通常OS入力から選択保存再開までの証拠",
+    "影響範囲試験と別Claude正式独立レビュー"
+  ],
+  "test_scope": [
+    "static and local selection checks before broad runs",
+    "existing actor/lifecycle/autosave tests subject to valid current source/environment",
+    "only necessary removal/departure/cross-process gaps",
+    "final exact-candidate required regression and review"
+  ],
+  "dependencies": [
+    "existing accepted save/current UI contract applicability to be verified",
+    "package integration dependencies remain; no whole-package completion prerequisite fabricated"
+  ],
+  "windows_block_policy": "Only expressly Windows-device-specific conditions blocked; Mac selection gaps remain work, not platform block",
+  "source_pins": {
+    "scenes/main/main.gd": "a3d7d7ddd08a8df1f987806e60accf51792d728cf71c06e6b822f5a31d8ed3e3",
+    "tests/ui/test_actor_selection.gd": "f37a0f4805adce4b538fccde1404c1a417f20639fddf36947f076d88409ba0a3",
+    "tests/ui/test_selection_lifecycle.gd": "ed68b120f422e1b37b8cf0654b6d6605458fe01c7e5d84decc3ba6f4e9366c47",
+    "tests/ui/test_selection_autosave.gd": "1d7d267ef171041f77241c4c2f1a1bb55a46253f803d5c496507e934bc8fa815"
+  },
+  "observed_at_jst": "2026-10-13T00:27:34.431543+09:00"
+}
@@ -0,0 +1,67 @@
+{
+  "observed_at_jst": "2026-10-13T00:38:51.342403+09:00",
+  "scope": "one original P24-03 among original30/88, no completion",
+  "task": {
+    "id": "P24-03",
+    "contract": {
+      "id": "P24-03",
+      "title": "選択と保存の受入",
+      "requirement_ids": [
+        "P24-03"
+      ],
+      "acceptance_ids": [
+        "P24-03"
+      ],
+      "spec_ref": "docs/spec/acceptance/P24-03.json",
+      "base_commit": "9b2ee480a88054eb863eb5cdff855b379201a7c1",
+      "worker": "agy",
+      "allowed_paths": [
+        "scenes/main/main.gd",
+        "scripts/ui/guest_observation_panel.gd",
+        "scripts/ui/staff_management_panel.gd",
+        "tests/ui/test_selection_departure.gd",
+        "tests/ui/test_selection_departure.gd.uid",
+        "tests/ui/fixtures/selection_cross_process.gd",
+        "tests/ui/fixtures/selection_cross_process.gd.uid",
+        "tools/check_p24_selection_evidence.py",
+        "tools/run_all_tests.py",
+        "tools/regression/suite-policy.json",
+        "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json",
+        "docs/plans/original-completion-2026-10-02/execution/p24-03/**"
+      ],
+      "depends_on": [],
+      "resource_locks": [
+        "main-selection-lifecycle",
+        "selection-acceptance-profile",
+        "regression-roster-policy"
+      ],
+      "validation_ids": [
+        "p24-acceptance"
+      ],
+      "max_repair_attempts": 2,
+      "spec_sha256": "4d353ff816d8edbb39671159e4f9fd87c20224cf0c44ea7b8fadc03bf25ae244"
+    },
+    "state": "implementing",
+    "worktree": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p24-03/P24-03-implement",
+    "submitted": null,
+    "candidate": null,
+    "main_base": null,
+    "reason": null,
+    "repairs": 0,
+    "evidence": [],
+    "owner_approval": null
+  },
+  "prepare_job": "19d0869176724618b1b1707a511a014b",
+  "doctor_job": "8385adb488a84701aff065e15738a896",
+  "commander_job": "17c84f847fce40599a1e274802437b6b",
+  "dispatch_job": "3eefb441761546d6ae2f59000d912e9a",
+  "old_proof_reuse_audit": {
+    "path": "artifacts/original-completion-2026-10-02/p05-normal-principal-ui-formal-reader-native-r01/execution.json",
+    "then_passed": false,
+    "changed_source_count": 14,
+    "current_pass_reused": false
+  },
+  "normal_os_input_connection": "native tool inventory returned now; actual candidate input not executed",
+  "formal_tests_run": false,
+  "formal_review_run": false
+}
@@ -0,0 +1,36 @@
+{
+  "scope": "JSON numeric metadata type diagnostic only; no game acceptance",
+  "actual_pid": 99508,
+  "exit_code": 0,
+  "command": [
+    "/Applications/Godot.app/Contents/MacOS/Godot",
+    "--headless",
+    "--path",
+    "/private/tmp/the-tree-p24-json-c200043b18364206b2ca6f61179c4d62",
+    "--script",
+    "/private/tmp/the-tree-p24-json-c200043b18364206b2ca6f61179c4d62/probe.gd",
+    "--log-file",
+    "/private/tmp/the-tree-p24-json-c200043b18364206b2ca6f61179c4d62/engine.log"
+  ],
+  "raw": "Godot Engine v4.7.2.stable.official.ed1daf0bf - https://godotengine.org\n\n{\"engine_version\":{\"build\":\"official\",\"hash\":\"ed1daf0bf001b61586d9930840f2f1394092c079\",\"hex\":263938,\"major\":4,\"minor\":7,\"patch\":2,\"status\":\"stable\",\"string\":\"4.7.2-stable (official)\",\"timestamp\":0},\"is_float\":true,\"is_int\":false,\"profile\":\"/Users/korizatou114/Library/Application Support/TheTree-P24-JSON-5a698892c27c477f828a12f1841d8637\",\"version_value\":1.0}\n",
+  "probe_sha256": "2b6cba8ceee004d1788f69ba27cba73ebcb049dcce418baa9048400969cd5d34",
+  "finding": {
+    "severity": "high",
+    "file": "scenes/main/main.gd",
+    "functions": [
+      "_restore_interface_selection",
+      "_restore_actor_interface_selection"
+    ],
+    "candidate_observed": "not selection.get(\"version\", 0) is int",
+    "impact": "SaveService._read_manifest JSON.parse_string produces 1.0 FLOAT, so normal version1 metadata will be silently rejected and valid selections lost.",
+    "required_original_behavior": "accept numeric exact1 from normal JSON while rejecting bool/string/non1 version; preserve old optional metadata fallback",
+    "acceptance_cases": [
+      "normal saved JSON version1 decoded asfloat must restore map/staff/guest selection",
+      "bool true version must not count asnumeric1",
+      "1.5/string1/wrongtype safely ignored",
+      "no changes to gameplay snapshot or SaveService format needed"
+    ]
+  },
+  "read_only_review_report": true,
+  "root_product_source_edits": 0
+}
@@ -0,0 +1,19 @@
+# P04-01 現採用版の更新順序・証拠対応草案
+
+原work: 閉店、停電、破壊、退出、課金、シフト交代、00:00決算の順序を明記する。
+
+原acceptance: 順序境界で停止中課金、二重決算、予約の孤立がない。
+
+現source1299地図SHA `df8328ea8b6a7bc400caad8a52f6ead710c01942a726e5a6b530b82411c55da5`。旧順序監査からの変更は人物復元validatorとその回帰試験の2refsだけで、Runtime/Clock/施設/帳簿/勤務の順序ソースは同一。これは現実装の観測と不足を示す草案であり、未確定D05を承認した規約ではない。88成果単位・部分点なしを維持し、この7行を成果単位の追加や完了点に換算しない。
+
+| 原7種 | 現実装の順序 | 有効な証拠の範囲 | 残条件 |
+|---|---|---|---|
+| 閉店 | 施設処理で営業ポリシーを適用し、後続FACILITY_QUEUESで閉店待機列を解放する。開始済serviceの方針は未確定。 | 一致版business/operations関連回帰は部分適用。open serviceの00:00課金を閉店条件へ転用しない。 | D05:閉店後開始済service継続/中断の確定と依存する境界証拠 |
+| 停電 | APPLY_COMMANDS→MANA→FACILITY_COMPLETION。960停電でACTIVE44をPAUSED44に保ち、961停止を保持する。 | 元formal停止961/復電962の各4membersを全保持コピー。fresh Reader A/Bで公開復電操作→962元recovered全literal一致、同予約一回消費/通知1、963経済全不変/在庫clock以外全不変を独立受入。 | 有限条件の証拠適用性を原7種規約の全条件レビューで確認 |
+| 破壊 | command破壊はAPPLY_COMMANDSで先行。automatic Event破壊はINCIDENTSで施設完了後。入口を区別する。 | 先行破壊は失敗44/課金0/同予約release一回。後段破壊は完了45後破壊、未完了は次分に無課金失敗/予約release。原formal状態の別PID/全通常tick一致。 | 具体的な有限ケースを原条件全体へ広げず、更新規約の全条件適合性レビュー |
+| 退出 | 公開leave commandは受付処理前。自動patience放棄/同予約解放はFACILITY_QUEUES。後続再計画/予定退出はAI_DECISIONS。LEAVINGから次分にdespawn。 | 同分service完了消費/一回課金後退出、実queue予約の公開leave解放、自動45分patience解放/孤立0。元formal状態別PID/全通常tick一致。 | 有限Guest/予約条件の適用性を規約全条件レビューで確認 |
+| 課金 | 施設完了取引が確定した後に通知scopeを公開する。停止/失敗時は進捗と予約を保持/解放する。 | P04-02正式完了の4領域と現一致版full、P04-01有償service境界の全帳簿/通知/予約状態。原価格時間を保持。 | 未確定閉店/勤務終端の課金境界を承認後必要分だけ補完 |
+| シフト交代 | 施設完了がAIのスタッフ勤務/通勤/出勤投影更新より先。18:00ちょうどの最終区間の解釈は未確定。 | 通常shift/payroll回帰と原1080診断の観測を保持。診断predicate失敗を原本違反へ格上げしない。 | D05:18:00最終勤務区間の確定/勤務終了先行の意味を確定 |
+| 00:00決算 | TIME_BOUNDARIESのOperations決算は施設完了より先。終了Day1 [0,1440)の帳簿と同分1440service売上の時間区分を区別。 | 本番決算/payroll/upkeep各一回→同分service25一回、1441全帳簿/履歴不変。原formal状態別PID/全通常tick一致。fixture給与0は非ゼロ同分給与証拠に数えない。 | 原本/承認済み決算時刻と更新規約全条件への適合性を最終レビュー |
+
+原本64/67行は18:00交代と勤務枠、71/72行は00:00決算を指定する。閉店後serviceと最終勤務区間の先後を独断で補わない。A01は維持費の保有時間按分と00:00精算を承認済み。正式保存の有限証拠と実OS/Windows/全原本受入を混同しない。
@@ -0,0 +1,875 @@
+{
+  "original_unit": {
+    "id": "P04-01",
+    "title": "同時発生の更新規約",
+    "work": "閉店、停電、破壊、退出、課金、シフト交代、00:00決算の順序を明記する。",
+    "acceptance": "順序境界で停止中課金、二重決算、予約の孤立がない。",
+    "state": "in_progress",
+    "evidence": [
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-current-order-audit-r01/audit.json",
+        "sha256_at_integration": "90d2dbd3c04aed7ab409afa4f05f884832a4661cc506d28b818c72aadc352950",
+        "scope": "Bounded original order-contract audit actually started; no conditions accepted",
+        "linked_at_jst": "2026-10-10T10:55:03.652723+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-order-independent-gap-review-r01.json",
+        "sha256_at_integration": "121cf18c180052999bc99f207524818ae6bc724476d26727d27910078f877b68",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:15:29.671098+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-shift-end-actual-independent-review-r01.json",
+        "sha256_at_integration": "343f717048088909e91cb5855540d00c9a6623d9008560cbc59f9249ee600efd",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:15:29.671098+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-completion-root-review-r01.json",
+        "sha256_at_integration": "b239308b4da2019bc219eb88b854f76d8b528e1fdb6643cd60633d21248e8a9f",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:15:29.671098+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-completion-actual-independent-review-r01.json",
+        "sha256_at_integration": "9bc5500ca30fede1abca19c61d0ca7cf8735a4021cfb5fcee4fd33811f11920f",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:15:29.671098+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-destruction-reachability-independent-review-r01.json",
+        "sha256_at_integration": "d18010f3b5df83be60b66f1fbeeb1fb6588bfe6fd36cc27c240f99eee888ec59",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:24:23.490534+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-destruction-completion-independent-static-review-r02.json",
+        "sha256_at_integration": "a51a8433054d22d8fc4d4de23f0b0a1af5a79753780b2ab692c1d9b9c319ee90",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:24:23.490534+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-destruction-completion-root-review-r02.json",
+        "sha256_at_integration": "974365ec551cb6da35d5fbf58d796df1d713bc0cdaa8762c55c1606bd9f168ee",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:24:23.490534+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-destruction-completion-actual-independent-review-r02.json",
+        "sha256_at_integration": "e10deb826ef1f356e4031a6e8631cd47680f117a43893d14ad1f5fb0bdbcffa0",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:24:23.490534+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-early-destruction-failed-diagnostic-root-r01.json",
+        "sha256_at_integration": "aaf88d286ae40e6c23e04a840b3a903f612f34071d87722704d96d6873f8d214",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:30:43.372288+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-early-destruction-failure-and-static-independent-review-r02.json",
+        "sha256_at_integration": "e24dca41d5e588915fd75028ec4a3b4467463c4198c5e78e77348d9558b84801",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:30:43.372288+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-early-destruction-root-review-r02.json",
+        "sha256_at_integration": "30b575d1f7e6b399be1592da539561610d80d5c8e4d185289d3758d1ff9a98f7",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:30:43.372288+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-early-destruction-actual-independent-review-r02.json",
+        "sha256_at_integration": "2f9fbfb283f6226622f4cd1d794ed88390852c990e4ae6be0d96e659f657538f",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:30:43.372288+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-exit-boundary-independent-static-review-r01.json",
+        "sha256_at_integration": "ef2749d7c7c846fa2f7961d3e72253fdb4e50c0fa058b3815f9ec8a8132443ad",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:37:40.975162+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-exit-boundary-root-review-r01.json",
+        "sha256_at_integration": "5b9d96bb1932eaf6bd7012d32f6bfbd89eb0eb6543f9397663567b173e646557",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:37:40.975162+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-exit-boundary-actual-independent-review-r01.json",
+        "sha256_at_integration": "a1e4fc1311a097a5893901e6ab88b7bb958a440fec0718c680666e22831c30e0",
+        "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:37:40.975162+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-midnight-boundary-independent-static-review-r01.json",
+        "sha256_at_integration": "c3f2b5d06af4ce3bb4b7d60dca41e3eb6efdc05367d8c390b13b3d7bd50f1410",
+        "scope": "P04-01 real production midnight/open-service bounded evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:48:41.046651+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-midnight-existing-proof-reuse-r01.json",
+        "sha256_at_integration": "71f996eb0293a629f3da5daca74fa34fd6e87f299d0b5ad33442b0251054d768",
+        "scope": "P04-01 real production midnight/open-service bounded evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:48:41.046651+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-midnight-boundary-root-review-r01.json",
+        "sha256_at_integration": "594fb5ec7c51995f3f423141522097969a141e62ec11fed0192e403f53f741da",
+        "scope": "P04-01 real production midnight/open-service bounded evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:48:41.046651+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-midnight-boundary-actual-independent-review-r01.json",
+        "sha256_at_integration": "61bfc23a4412d0c0af0ddd319ddf569c861921b1f20ac25007d38c55c5bc5d08",
+        "scope": "P04-01 real production midnight/open-service bounded evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:48:41.046651+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-automatic-patience-independent-static-review-r01.json",
+        "sha256_at_integration": "5f79fd03231abeb71b7e7cb38ebb518594a28836add3525ed9d0f3bbfebeccc7",
+        "scope": "P04-01 original automatic patience actual reservation release bounded evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:55:46.922924+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-automatic-patience-existing-proof-reuse-r01.json",
+        "sha256_at_integration": "3a7dab539dada77d03546654f3486b8df11beabf0f2d15349803c0fbe74fbef9",
+        "scope": "P04-01 original automatic patience actual reservation release bounded evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:55:46.922924+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-automatic-patience-root-review-r02.json",
+        "sha256_at_integration": "cb9ccdcd057a8ea52c78e4454871cff4d497ccd779a1c468ad507226ada11974",
+        "scope": "P04-01 original automatic patience actual reservation release bounded evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:55:46.922924+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-automatic-patience-actual-independent-review-r01.json",
+        "sha256_at_integration": "275ffebf790f08a061a88f4b4e2540f356ff09773088adb632676909e24dfdd8",
+        "scope": "P04-01 original automatic patience actual reservation release bounded evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T11:55:46.922924+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-formal-boundary-reload-independent-failure-review-r02.json",
+        "sha256_at_integration": "690eb0260f492d711eb2a25514d1a9b99de3ff2330ae9c85a6118a2aa8def7ac",
+        "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:38:07.429656+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-overdue-exit-validation-independent-static-review-r01.json",
+        "sha256_at_integration": "16484fdfc26cda498abe300ab7418df2ed4070807daeaf0547ae1ff64b96b38e",
+        "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:38:07.429656+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-formal-boundary-reload-root-review-r04/review.json",
+        "sha256_at_integration": "49432eeec5acd04e7f7b804160780bdb89739e45621069ac0e0a41b7ceb9de4e",
+        "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:38:07.429656+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-formal-boundary-reload-actual-independent-review-r03.json",
+        "sha256_at_integration": "8ecdde2c88f7f56cf0b212095ac2b109398426ff7b0ee1e3a97e01ac84a7e235",
+        "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:38:07.429656+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-overdue-exit-final-full-root-review-r01/review.json",
+        "sha256_at_integration": "cbabbb9f6604cd58b5253b2d3e18b21f6ef272958c2bd65d05904f7d86958dca",
+        "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:38:07.429656+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-overdue-exit-final-candidate-independent-review-r01.json",
+        "sha256_at_integration": "678ca9ad1ffddf828016e0cdd04e8817822859a25da00f1f7d4c2f6ee108d8fd",
+        "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:38:07.429656+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-overdue-exit-source-adoption-r01/adoption.json",
+        "sha256_at_integration": "df25c45b14b62db9fb28e9edcc51923ab5bfbeff26056bd6cbafbe6715e70940",
+        "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:38:07.429656+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-formal-recovery-local-seal-r04.json",
+        "sha256_at_integration": "0b9e7f3ca62c9dc8d830fc17407da94bf46a062b9749b275ba0ffcaaf639ee20",
+        "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:56:16.880626+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-formal-recovery-independent-static-review-r03.json",
+        "sha256_at_integration": "140362e6d769525e8aac821e7a3b571bffd3616d26b56f94cc6610d994f30ec7",
+        "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:56:16.880626+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-formal-recovery-failure-attribution-independent-review-r03.json",
+        "sha256_at_integration": "eeb221d2c8e49878a0f9818fa6c1f9db9a595f4d69c57fe3521d6d188723c4a6",
+        "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:56:16.880626+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-formal-recovery-root-review-r05/review.json",
+        "sha256_at_integration": "aff6056537dc6b2c923419c340f2707a7d53efeff6ea93e239e9e66839f1e289",
+        "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:56:16.880626+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-formal-recovery-full-reuse-r04.json",
+        "sha256_at_integration": "ecd8fdfb7650abe7eadc2c9588a281216005b919029f8278ebec997b9de614f5",
+        "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:56:16.880626+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-current-order-evidence-matrix-r03/matrix.json",
+        "sha256_at_integration": "9e4686031332ff3c023fea7e3c1591712dc3e8227046dc32fc56ca0042289f08",
+        "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:56:16.880626+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-current-order-evidence-matrix-r03/ORDER_CONTRACT_DRAFT.md",
+        "sha256_at_integration": "c4dd8b907321b8859ba0744b9ae3d1447615d98fbe548983f9bb9fcad2d9d989",
+        "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:56:16.880626+09:00"
+      },
+      {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-formal-recovery-actual-independent-review-r04.json",
+        "sha256_at_integration": "7ae5702cd20d267bbf54cfafd89e1f7b5542c91073b04b8b958b380b19147ef5",
+        "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+        "linked_at_jst": "2026-10-10T12:56:16.880626+09:00"
+      }
+    ],
+    "current_summary": "P04-01の既存8境界27状態の正式保存/別PID受入とFORMAL-LEAVING-01修正採用を維持し、残の停電→復電進行を現採用1299/Runtime2d7e2ceaで補完。元Writerの停止961/復電962正式package各4membersを保持し、fresh Reader A/Bの公開load/Runtime restoreから元beforeの有限Mana reserveを同公開change_resources・同idempotency keyで戻し通常tick。両PIDの962状態は元recovered.var全literal一致、元25G/45分serviceを同予約一回消費/通知1で完了、963通知追加0/全経済snapshot不変/在庫clockのみ963へ更新し全他field不変。20typed/原2保存8members/コピー4保存16members/両commandと通知ID962全帳簿をrootと同1名が独立受入。r03はQA経済時計0保持の誤期待によりReaderA70/2fail・ReaderB未起動であり負履歴を保存し製品不具合へ分類しない。r04は両Reader各70/0・303parse・4owned終了。製品編集0、実engine/全1299一致の最終full172/14721を再利用し重複全回帰なし。原7種更新順序/証拠対応草案を現版に更新したが、閉店後serviceと18:00最終勤務区間D05は未承認、規約凍結/全条件独立受入を残す。正式完了追加0、通常OS/Windows/全ゲーム受入へ拡張しない。",
+    "remaining_conditions": [
+      "原7種更新順序・証拠対応草案は現採用版で整理済み。原本/承認済み仕様への全条件適合性と規約凍結を最終独立受入する",
+      "D05: 閉店後の開始済サービス継続/中断方針の承認待ち。00:00open service証拠を閉店条件へ代用しない",
+      "D05: 18:00最終勤務区間の完了確定/勤務終了先行の意味の承認待ち",
+      "D05確定後に依存境界だけ検証し、正確な最終版への既存証拠適用性・同1名の全条件独立受入と台帳反映"
+    ]
+  },
+  "original_package": {
+    "work": "一分更新、00:00決算、時間帯・天候更新、施設稼働判定、客選択の適用順を仕様化。新機能は分離サービスで実装しRuntimeから接続。全体の一括書換えはしない。",
+    "acceptance": "同一Tickでの閉店/停電/退出/課金順が決定的。コマンド再送で二重課金・二重生成しない。",
+    "depends_on": [
+      "P03"
+    ],
+    "decisions": [
+      "D05"
+    ]
+  },
+  "D05": {
+    "id": "D05",
+    "title": "同時発生と安全処理",
+    "details": "EV／搬送停止、費用時点、日跨ぎ順序の未確定部分。承認済み維持費時点を再確認しない。",
+    "needed_at": "更新規約の凍結",
+    "independent_work": "原状保持と重複防止、具体的な境界事例を作る。",
+    "kind": "implementation_contract"
+  },
+  "historical_audit": {
+    "path": "artifacts/original-completion-2026-10-02/p04-01-current-order-audit-r01/audit.json",
+    "sha256": "90d2dbd3c04aed7ab409afa4f05f884832a4661cc506d28b818c72aadc352950",
+    "bytes": 79269
+  },
+  "historical_source_map_original": {
+    "path": "artifacts/original-completion-2026-10-02/p04-01-power-formal-recovery-full-reuse-r04.json",
+    "sha256": "ecd8fdfb7650abe7eadc2c9588a281216005b919029f8278ebec997b9de614f5",
+    "bytes": 156086
+  },
+  "historical_source_map_local_copy": {
+    "path": "docs/plans/original-completion-2026-10-02/execution/p04-01-input-r01/historical-source-map.json",
+    "sha256": "df8328ea8b6a7bc400caad8a52f6ead710c01942a726e5a6b530b82411c55da5",
+    "bytes": 152598
+  },
+  "historical_count": 1299,
+  "changed_existing_paths": [
+    {
+      "path": "autoload/simulation_runtime.gd",
+      "old_sha256": "2d7e2cea5424585e9aa4302ab66d1fc4dbaefe743ce4328fccc1efa2f19b82e4",
+      "current_sha256": "d52a995ae715542bbc550f68d35889540658275d12e04ae0b21ac276f5843f39"
+    },
+    {
+      "path": "scenes/main/main.gd",
+      "old_sha256": "a7ae44c680eb9b70a117ddc8c6cbf0ca290b8e8d485eac41b4122698fde2a620",
+      "current_sha256": "a3d7d7ddd08a8df1f987806e60accf51792d728cf71c06e6b822f5a31d8ed3e3"
+    },
+    {
+      "path": "scenes/main/world_preview.gd",
+      "old_sha256": "3df29be32d3a016d8fb9dc1ee2bd32e2360ac8fad9810293f6be9b58d26046e0",
+      "current_sha256": "75d5b0bd23204f5a485540512e44b89e1d2a4596b368f70177a238ba078ff42d"
+    },
+    {
+      "path": "scripts/core/performance_budget.gd",
+      "old_sha256": "79d18e8f0dcc3932801cd02ea8a8ba037af02ef57665387cba8dbe3b3e9af917",
+      "current_sha256": "0e2278f88d29919a0634fc1b527328a0d0c12d87e2cd612f3eee1526aabdb073"
+    },
+    {
+      "path": "scripts/world/path_service.gd",
+      "old_sha256": "2e68653e4898387cb5a76402813a10595bd5ca7d5fb841c7ed8c55af77d7a918",
+      "current_sha256": "447135729a1106639a6eee6754af3195c8a8b458ca26980ae91fa39d80dcfbd4"
+    },
+    {
+      "path": "tests/s1/test_path_service.gd",
+      "old_sha256": "0f48bb44c27e32f08477b9aed61a0db5c8808219490928f734c3570a07efb251",
+      "current_sha256": "17d9fd42b35004376bf96e435f53d6bce41e79258ec7f6daf3ab04ae5d8c3e1d"
+    },
+    {
+      "path": "tests/ui/test_pixel_tower.gd",
+      "old_sha256": "93bdbb195f2ceec07dbe052e0d0a3017d84b56f1e8ec46b87be8d98105ec0f88",
+      "current_sha256": "f149f4b5507247dadf623e777e90b9bdb81f54324b406a8f55adaf89b649866a"
+    }
+  ],
+  "evidence_refs": [
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-current-order-audit-r01/audit.json",
+        "sha256": "90d2dbd3c04aed7ab409afa4f05f884832a4661cc506d28b818c72aadc352950",
+        "bytes": 79269
+      },
+      "registered_sha256": "90d2dbd3c04aed7ab409afa4f05f884832a4661cc506d28b818c72aadc352950",
+      "matches_registered": true,
+      "scope": "Bounded original order-contract audit actually started; no conditions accepted",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "source_edits": 0,
+        "formal_completion": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-order-independent-gap-review-r01.json",
+        "sha256": "121cf18c180052999bc99f207524818ae6bc724476d26727d27910078f877b68",
+        "bytes": 5811
+      },
+      "registered_sha256": "121cf18c180052999bc99f207524818ae6bc724476d26727d27910078f877b68",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "Windows_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-shift-end-actual-independent-review-r01.json",
+        "sha256": "343f717048088909e91cb5855540d00c9a6623d9008560cbc59f9249ee600efd",
+        "bytes": 1693
+      },
+      "registered_sha256": "343f717048088909e91cb5855540d00c9a6623d9008560cbc59f9249ee600efd",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-completion-root-review-r01.json",
+        "sha256": "b239308b4da2019bc219eb88b854f76d8b528e1fdb6643cd60633d21248e8a9f",
+        "bytes": 17514
+      },
+      "registered_sha256": "b239308b4da2019bc219eb88b854f76d8b528e1fdb6643cd60633d21248e8a9f",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "passed": true,
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-completion-actual-independent-review-r01.json",
+        "sha256": "9bc5500ca30fede1abca19c61d0ca7cf8735a4021cfb5fcee4fd33811f11920f",
+        "bytes": 3295
+      },
+      "registered_sha256": "9bc5500ca30fede1abca19c61d0ca7cf8735a4021cfb5fcee4fd33811f11920f",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-destruction-reachability-independent-review-r01.json",
+        "sha256": "d18010f3b5df83be60b66f1fbeeb1fb6588bfe6fd36cc27c240f99eee888ec59",
+        "bytes": 25552
+      },
+      "registered_sha256": "d18010f3b5df83be60b66f1fbeeb1fb6588bfe6fd36cc27c240f99eee888ec59",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-destruction-completion-independent-static-review-r02.json",
+        "sha256": "a51a8433054d22d8fc4d4de23f0b0a1af5a79753780b2ab692c1d9b9c319ee90",
+        "bytes": 1936
+      },
+      "registered_sha256": "a51a8433054d22d8fc4d4de23f0b0a1af5a79753780b2ab692c1d9b9c319ee90",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-destruction-completion-root-review-r02.json",
+        "sha256": "974365ec551cb6da35d5fbf58d796df1d713bc0cdaa8762c55c1606bd9f168ee",
+        "bytes": 23741
+      },
+      "registered_sha256": "974365ec551cb6da35d5fbf58d796df1d713bc0cdaa8762c55c1606bd9f168ee",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "passed": true,
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-destruction-completion-actual-independent-review-r02.json",
+        "sha256": "e10deb826ef1f356e4031a6e8631cd47680f117a43893d14ad1f5fb0bdbcffa0",
+        "bytes": 3614
+      },
+      "registered_sha256": "e10deb826ef1f356e4031a6e8631cd47680f117a43893d14ad1f5fb0bdbcffa0",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-early-destruction-failed-diagnostic-root-r01.json",
+        "sha256": "aaf88d286ae40e6c23e04a840b3a903f612f34071d87722704d96d6873f8d214",
+        "bytes": 8943
+      },
+      "registered_sha256": "aaf88d286ae40e6c23e04a840b3a903f612f34071d87722704d96d6873f8d214",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "passed": false,
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-early-destruction-failure-and-static-independent-review-r02.json",
+        "sha256": "e24dca41d5e588915fd75028ec4a3b4467463c4198c5e78e77348d9558b84801",
+        "bytes": 2484
+      },
+      "registered_sha256": "e24dca41d5e588915fd75028ec4a3b4467463c4198c5e78e77348d9558b84801",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-early-destruction-root-review-r02.json",
+        "sha256": "30b575d1f7e6b399be1592da539561610d80d5c8e4d185289d3758d1ff9a98f7",
+        "bytes": 13436
+      },
+      "registered_sha256": "30b575d1f7e6b399be1592da539561610d80d5c8e4d185289d3758d1ff9a98f7",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "passed": true,
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-early-destruction-actual-independent-review-r02.json",
+        "sha256": "2f9fbfb283f6226622f4cd1d794ed88390852c990e4ae6be0d96e659f657538f",
+        "bytes": 3454
+      },
+      "registered_sha256": "2f9fbfb283f6226622f4cd1d794ed88390852c990e4ae6be0d96e659f657538f",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-exit-boundary-independent-static-review-r01.json",
+        "sha256": "ef2749d7c7c846fa2f7961d3e72253fdb4e50c0fa058b3815f9ec8a8132443ad",
+        "bytes": 1914
+      },
+      "registered_sha256": "ef2749d7c7c846fa2f7961d3e72253fdb4e50c0fa058b3815f9ec8a8132443ad",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-exit-boundary-root-review-r01.json",
+        "sha256": "5b9d96bb1932eaf6bd7012d32f6bfbd89eb0eb6543f9397663567b173e646557",
+        "bytes": 23324
+      },
+      "registered_sha256": "5b9d96bb1932eaf6bd7012d32f6bfbd89eb0eb6543f9397663567b173e646557",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "passed": true,
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-exit-boundary-actual-independent-review-r01.json",
+        "sha256": "a1e4fc1311a097a5893901e6ab88b7bb958a440fec0718c680666e22831c30e0",
+        "bytes": 3645
+      },
+      "registered_sha256": "a1e4fc1311a097a5893901e6ab88b7bb958a440fec0718c680666e22831c30e0",
+      "matches_registered": true,
+      "scope": "P04-01 bounded gap/diagnostic/power evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-midnight-boundary-independent-static-review-r01.json",
+        "sha256": "c3f2b5d06af4ce3bb4b7d60dca41e3eb6efdc05367d8c390b13b3d7bd50f1410",
+        "bytes": 2314
+      },
+      "registered_sha256": "c3f2b5d06af4ce3bb4b7d60dca41e3eb6efdc05367d8c390b13b3d7bd50f1410",
+      "matches_registered": true,
+      "scope": "P04-01 real production midnight/open-service bounded evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-midnight-existing-proof-reuse-r01.json",
+        "sha256": "71f996eb0293a629f3da5daca74fa34fd6e87f299d0b5ad33442b0251054d768",
+        "bytes": 5304
+      },
+      "registered_sha256": "71f996eb0293a629f3da5daca74fa34fd6e87f299d0b5ad33442b0251054d768",
+      "matches_registered": true,
+      "scope": "P04-01 real production midnight/open-service bounded evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-midnight-boundary-root-review-r01.json",
+        "sha256": "594fb5ec7c51995f3f423141522097969a141e62ec11fed0192e403f53f741da",
+        "bytes": 25390
+      },
+      "registered_sha256": "594fb5ec7c51995f3f423141522097969a141e62ec11fed0192e403f53f741da",
+      "matches_registered": true,
+      "scope": "P04-01 real production midnight/open-service bounded evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "passed": true,
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-midnight-boundary-actual-independent-review-r01.json",
+        "sha256": "61bfc23a4412d0c0af0ddd319ddf569c861921b1f20ac25007d38c55c5bc5d08",
+        "bytes": 3487
+      },
+      "registered_sha256": "61bfc23a4412d0c0af0ddd319ddf569c861921b1f20ac25007d38c55c5bc5d08",
+      "matches_registered": true,
+      "scope": "P04-01 real production midnight/open-service bounded evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-automatic-patience-independent-static-review-r01.json",
+        "sha256": "5f79fd03231abeb71b7e7cb38ebb518594a28836add3525ed9d0f3bbfebeccc7",
+        "bytes": 2383
+      },
+      "registered_sha256": "5f79fd03231abeb71b7e7cb38ebb518594a28836add3525ed9d0f3bbfebeccc7",
+      "matches_registered": true,
+      "scope": "P04-01 original automatic patience actual reservation release bounded evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-automatic-patience-existing-proof-reuse-r01.json",
+        "sha256": "3a7dab539dada77d03546654f3486b8df11beabf0f2d15349803c0fbe74fbef9",
+        "bytes": 2487
+      },
+      "registered_sha256": "3a7dab539dada77d03546654f3486b8df11beabf0f2d15349803c0fbe74fbef9",
+      "matches_registered": true,
+      "scope": "P04-01 original automatic patience actual reservation release bounded evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "passed": true
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-automatic-patience-root-review-r02.json",
+        "sha256": "cb9ccdcd057a8ea52c78e4454871cff4d497ccd779a1c468ad507226ada11974",
+        "bytes": 15550
+      },
+      "registered_sha256": "cb9ccdcd057a8ea52c78e4454871cff4d497ccd779a1c468ad507226ada11974",
+      "matches_registered": true,
+      "scope": "P04-01 original automatic patience actual reservation release bounded evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "passed": true,
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-automatic-patience-actual-independent-review-r01.json",
+        "sha256": "275ffebf790f08a061a88f4b4e2540f356ff09773088adb632676909e24dfdd8",
+        "bytes": 3028
+      },
+      "registered_sha256": "275ffebf790f08a061a88f4b4e2540f356ff09773088adb632676909e24dfdd8",
+      "matches_registered": true,
+      "scope": "P04-01 original automatic patience actual reservation release bounded evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-formal-boundary-reload-independent-failure-review-r02.json",
+        "sha256": "690eb0260f492d711eb2a25514d1a9b99de3ff2330ae9c85a6118a2aa8def7ac",
+        "bytes": 797
+      },
+      "registered_sha256": "690eb0260f492d711eb2a25514d1a9b99de3ff2330ae9c85a6118a2aa8def7ac",
+      "matches_registered": true,
+      "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-overdue-exit-validation-independent-static-review-r01.json",
+        "sha256": "16484fdfc26cda498abe300ab7418df2ed4070807daeaf0547ae1ff64b96b38e",
+        "bytes": 820
+      },
+      "registered_sha256": "16484fdfc26cda498abe300ab7418df2ed4070807daeaf0547ae1ff64b96b38e",
+      "matches_registered": true,
+      "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-formal-boundary-reload-root-review-r04/review.json",
+        "sha256": "49432eeec5acd04e7f7b804160780bdb89739e45621069ac0e0a41b7ceb9de4e",
+        "bytes": 114797
+      },
+      "registered_sha256": "49432eeec5acd04e7f7b804160780bdb89739e45621069ac0e0a41b7ceb9de4e",
+      "matches_registered": true,
+      "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "passed": true,
+        "normal_OS_accepted": false,
+        "Windows_accepted": false,
+        "D05_resolved": false,
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-formal-boundary-reload-actual-independent-review-r03.json",
+        "sha256": "8ecdde2c88f7f56cf0b212095ac2b109398426ff7b0ee1e3a97e01ac84a7e235",
+        "bytes": 2830
+      },
+      "registered_sha256": "8ecdde2c88f7f56cf0b212095ac2b109398426ff7b0ee1e3a97e01ac84a7e235",
+      "matches_registered": true,
+      "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "D05_resolved": false,
+        "normal_OS_accepted": false,
+        "Windows_accepted": false,
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-overdue-exit-final-full-root-review-r01/review.json",
+        "sha256": "cbabbb9f6604cd58b5253b2d3e18b21f6ef272958c2bd65d05904f7d86958dca",
+        "bytes": 264831
+      },
+      "registered_sha256": "cbabbb9f6604cd58b5253b2d3e18b21f6ef272958c2bd65d05904f7d86958dca",
+      "matches_registered": true,
+      "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "passed": true
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-overdue-exit-final-candidate-independent-review-r01.json",
+        "sha256": "678ca9ad1ffddf828016e0cdd04e8817822859a25da00f1f7d4c2f6ee108d8fd",
+        "bytes": 158669
+      },
+      "registered_sha256": "678ca9ad1ffddf828016e0cdd04e8817822859a25da00f1f7d4c2f6ee108d8fd",
+      "matches_registered": true,
+      "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "unit_accepted": false,
+        "D05_resolved": false,
+        "normal_OS_accepted": false,
+        "Windows_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-overdue-exit-source-adoption-r01/adoption.json",
+        "sha256": "df25c45b14b62db9fb28e9edcc51923ab5bfbeff26056bd6cbafbe6715e70940",
+        "bytes": 414
+      },
+      "registered_sha256": "df25c45b14b62db9fb28e9edcc51923ab5bfbeff26056bd6cbafbe6715e70940",
+      "matches_registered": true,
+      "scope": "P04-01 finite candidate correction/formal boundary restart/exact full/adoption evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "passed": true
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-formal-recovery-local-seal-r04.json",
+        "sha256": "0b9e7f3ca62c9dc8d830fc17407da94bf46a062b9749b275ba0ffcaaf639ee20",
+        "bytes": 353695
+      },
+      "registered_sha256": "0b9e7f3ca62c9dc8d830fc17407da94bf46a062b9749b275ba0ffcaaf639ee20",
+      "matches_registered": true,
+      "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-formal-recovery-independent-static-review-r03.json",
+        "sha256": "140362e6d769525e8aac821e7a3b571bffd3616d26b56f94cc6610d994f30ec7",
+        "bytes": 1035
+      },
+      "registered_sha256": "140362e6d769525e8aac821e7a3b571bffd3616d26b56f94cc6610d994f30ec7",
+      "matches_registered": true,
+      "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "unit_accepted": false,
+        "D05_resolved": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-formal-recovery-failure-attribution-independent-review-r03.json",
+        "sha256": "eeb221d2c8e49878a0f9818fa6c1f9db9a595f4d69c57fe3521d6d188723c4a6",
+        "bytes": 1337
+      },
+      "registered_sha256": "eeb221d2c8e49878a0f9818fa6c1f9db9a595f4d69c57fe3521d6d188723c4a6",
+      "matches_registered": true,
+      "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-formal-recovery-root-review-r05/review.json",
+        "sha256": "aff6056537dc6b2c923419c340f2707a7d53efeff6ea93e239e9e66839f1e289",
+        "bytes": 20350
+      },
+      "registered_sha256": "aff6056537dc6b2c923419c340f2707a7d53efeff6ea93e239e9e66839f1e289",
+      "matches_registered": true,
+      "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "passed": true,
+        "product_source_changes": 0,
+        "D05_resolved": false,
+        "unit_accepted": false,
+        "Windows_accepted": false,
+        "normal_OS_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-formal-recovery-full-reuse-r04.json",
+        "sha256": "ecd8fdfb7650abe7eadc2c9588a281216005b919029f8278ebec997b9de614f5",
+        "bytes": 156086
+      },
+      "registered_sha256": "ecd8fdfb7650abe7eadc2c9588a281216005b919029f8278ebec997b9de614f5",
+      "matches_registered": true,
+      "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "passed": true,
+        "product_source_changes": 0,
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-current-order-evidence-matrix-r03/matrix.json",
+        "sha256": "9e4686031332ff3c023fea7e3c1591712dc3e8227046dc32fc56ca0042289f08",
+        "bytes": 21004
+      },
+      "registered_sha256": "9e4686031332ff3c023fea7e3c1591712dc3e8227046dc32fc56ca0042289f08",
+      "matches_registered": true,
+      "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "D05_resolved": false,
+        "unit_accepted": false
+      }
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-current-order-evidence-matrix-r03/ORDER_CONTRACT_DRAFT.md",
+        "sha256": "c4dd8b907321b8859ba0744b9ae3d1447615d98fbe548983f9bb9fcad2d9d989",
+        "bytes": 3996
+      },
+      "registered_sha256": "c4dd8b907321b8859ba0744b9ae3d1447615d98fbe548983f9bb9fcad2d9d989",
+      "matches_registered": true,
+      "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {}
+    },
+    {
+      "reference": {
+        "path": "artifacts/original-completion-2026-10-02/p04-01-power-formal-recovery-actual-independent-review-r04.json",
+        "sha256": "7ae5702cd20d267bbf54cfafd89e1f7b5542c91073b04b8b958b380b19147ef5",
+        "bytes": 3161
+      },
+      "registered_sha256": "7ae5702cd20d267bbf54cfafd89e1f7b5542c91073b04b8b958b380b19147ef5",
+      "matches_registered": true,
+      "scope": "P04-01 freshPID public power recovery original service and current seven-domain draft evidence; no whole-unit acceptance",
+      "result_not_reaccepted": true,
+      "declared_status": {
+        "product_source_changes": 0,
+        "unit_accepted": false,
+        "D05_resolved": false,
+        "normal_OS_accepted": false,
+        "Windows_accepted": false
+      }
+    }
+  ],
+  "historical_status_only": true,
+  "native_runs_started": 0,
+  "original_unit_accepted": false
+}
@@ -0,0 +1,34 @@
+# Checker protocol — historical repair29 description
+
+Repair30 is a partial, blocked implementation. CURRENT_STATUS.md and
+REPAIR30_STATUS.md supersede the current-role, authority and execution claims
+below. M is c0ea009; product manifests exclude checker, selected native/full
+SourceRefs include it. Q is the actual recomputed merge-tree; C requires separate
+normal-integration qualification. All four remaining D05 policies are approved.
+Do not run the old collection/index recipe as fresh-Q evidence. No 500000-byte
+limit applies. The historical protocol text below is retained for provenance.
+
+Worker **SOURCE-READY / NOTRUN**. [CURRENT_STATUS.md](CURRENT_STATUS.md) is canonical for execution facts; creation-time NOT RUN in REPAIR22–28 and runbooks is historical. [ORDER_AUDIT.md](ORDER_AUDIT.md) and order-audit.json give the eleven-phase/seven-domain audit. [D05_REMAINING_ORDER_CANDIDATE.md](D05_REMAINING_ORDER_CANDIDATE.md) is approval material only.
+
+B = `/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build`.
+The checker remains a61 (`a61c5b496e656f60c66898e42500bc9a2d45f947690ce8f5f19a03984ebbc850`), with its registry unchanged. Fifteen conditions + EV, seven domains, three safety outcomes and30/88 denominator remain fixed. Original credit13/88 unchanged; P04 remains incomplete.
+
+| Evidence | Root-measured current fact |
+| --- | --- |
+| B/p04-s4-native-r28 | 4/4 PASS; PIDs49940,50044,50078,50105 all ended; guards0; cleanup0. |
+| B/audit-support/p04-root-fb8b-s4-r01 | S4 controls and native receipts PASS. |
+| B/audit-support/p04-root-fb8b-local-r01 | Local8 PASS and registered validation fb8b PASS28.095s. |
+| B/audit-support/p04-raw-collect-r22 | Current collection, preserving raw and exact relocation/series SHA256 bindings. |
+| B/p04-evidence/index.json | Schema2; missing_conditions=[]; all15 conditions + EV mechanically verified. |
+
+Root-measured native product5f6bc11d/main9b1a18c1. Current product is B/audit-support/p04-r17-full-inputs-r01/product, not deb11300. Static current hashes and handler/function lines, plus exact proof pins, are in REPAIR29_STATIC_SOURCE.json. The index preserves source/config/input/environment applicability and native ownership joins; mechanical PASS does not grant D05 approval or original completion.
+
+C NATIVE_RUNS/native_ownership/verify_native remains unchanged. C shift proof joins actual owned start/end PIDs, serviceID, original priceSnapshot, service.payment key and receipt entries; no fixed PID or ledger number. S1 typed raw joins pre-travel ACTIVE reservation/task/staff/cell to boarded trip; JSON summaries do not replace typed evidence.
+
+Only S4 supplies isolated power_stop. It preserves native ownership, full product1338 plus sole QA override, Writer/Reader packages, exact Runtime typed restoration and replay, actual NO_POWER, operating dependency, powered/ACTIVE kitchen, positive global mana and open operator. Raw graph/revision, source-derived hold, intervening held minutes, zero stopped charge, original identity and one recovery sale are joined without canonicalization or dropped fields. S4 causes NO_POWER by directly calling disconnect_nodes; it is not global-depletion proof. Global depletion appears only in B1 combined diagnostic; B1 has RELATED_FACILITY_INACTIVE and supplies neither isolated power_stop nor priority approval.
+
+The low authority finding remains explicit: destruction_stop is bound to BASELINE:183, a mana-depletion line, not destruction authority. An explicit D05 destruction rule is required; pin/registry correction only after approval through normal repair. Observation and mechanical verification do not resolve this gap. A01 midnight ownership upkeep, dependency hold and18:00 are approved and are not re-asked. Other mandatory priorities remain pending under D05(a–d).
+
+Full178 used checker f5 (`f5b44827958f2ae352fe5c4bc3a1ffd4211ec7a41fc4c0759c8b954891662324`),21615 checks; exact receipt preserved at B/audit-support/p18-regression-support-final-r01/native-full178/runner-ended.json (runner-input.json selected_source_map preserves all1339 selected inputs; source-start.json records initial product sources). **No full1339 run against a61 exists.** Suites/parse not executing Python support checker-independent product applicability only. Static full178 selected-map comparison found one test-source difference (tests/business/test_required_kitchen.gd: full3a9c92f8…, current5dcc86d6…); no game-source difference. Runner must preserve that test applicability binding; no blanket1338 identity is claimed. Do not relabel the old full proof as a61 validation.
+
+Remaining Runner work: owner D05 decisions after review, any subsequent normal repair, support53cb normal registered rebind, final full run and final applicability binding, formal independent review, integration P04 first then support on main9b1a18c1, and individually applicable nativeWindows obligations. Missing original authority or unknown mandatory rules remain gaps regardless of mechanical PASS. No probe or test is requested or run by this docs-only repair.
@@ -0,0 +1,29 @@
+# P04-01 current status — repair31
+
+**BLOCKED: partial implementation; do not start the once-only native/full run.**
+Formal completed status is **16/88**, with **zero P04 credit**.
+
+D05 is six of six actually approved; adoption and exact-Q verification are pending.
+All four later D05 policies were approved by the actual human on 2026-10-18.
+D05_REMAINING_APPROVAL.json preserves exact answers and binds both supplied
+records by path/SHA256. Dependency hold, 18:00 and A01 upkeep remain approved.
+The old candidates are superseded, not deleted.
+
+Frozen M is c0ea009b28a7649aca6a433a1a24dc0be5e7ab81. Actual tree enumeration
+found 1368 product files excluding the checker and 3644 metadata paths.
+Native/full selected SourceRefs must additionally include the checker.
+Final S, genuine non-production Q and later normal C are not supplied by this
+worker. No Git writes, engine execution, Runner operations or delegation.
+
+The checker has partial authority/role corrections; the seven-domain audit uses
+M source. S5 executable probes, fresh-Q collector/wrapper/index plumbing,
+full-proof joins and independent normal-C qualification remain incomplete.
+Normal C now fails closed without the authoritative Root/Runner receipt contract.
+The isolated Git fixtures remain Root-run because `/tmp` creation was denied.
+See [REPAIR31_STATUS.md](REPAIR31_STATUS.md) for precise remaining work and the
+corrected Root execution order; [s5/PENDING.md](s5/PENDING.md) records S5 gaps.
+
+Historical S1–S4/r22, old registered validation and f5 full178 retain their
+original identities. They are not fresh Q evidence. All 15 conditions plus EV
+still require exact-version evidence; nativeWindows remains individually
+pending. Static fixture results confer no original acceptance credit.
@@ -0,0 +1,42 @@
+{
+  "plan_id": "P04-01",
+  "decision_scope": "D05 dependency closure and 18:00 transaction order only",
+  "recorded_at": "2026-10-15T13:51:09.167952+00:00",
+  "origin": "direct_user_reply",
+  "question_item_ids": [
+    "[\"request_user_input_async\",\"call_cea3c55446014be4bde664de0ab8c381\",0]",
+    "[\"request_user_input_async\",\"call_cea3c55446014be4bde664de0ab8c381\",1]"
+  ],
+  "approved_choices": [
+    {
+      "id": "D05-P04-DEPENDENCY",
+      "user_answer": "依存先の休業中は進捗・課金を停止し、予約を保持して復帰後に1回だけ完了する（Opus推奨・現状維持）",
+      "contract": "依存先の休業中は開始済みサービスの進捗と課金を停止し、予約とサービスIDを保持する。復帰後に残りを処理し、完了・課金は1回だけ。停止上限は新設しない。直接の休業操作はD-034を維持する。"
+    },
+    {
+      "id": "D05-P04-SHIFT-1800",
+      "user_answer": "17:59→18:00の昼番作業を先に確定し、完了・課金後に交代する（Opus推奨・現状維持）",
+      "contract": "[17:59,18:00)の昼番作業を先に確定し、必要時間に達したサービスを18:00に1回だけ完了・課金してから交代する。夜番は[18:00,18:01)から反映する。"
+    }
+  ],
+  "proposal_sha256": "082c6a9e7d8d0648be261ae30e52983e10ed677eaf90ab872b7c9e19793f773c",
+  "required_validation": [
+    "停止中課金0",
+    "完了課金1回",
+    "予約の孤立0",
+    "同分再送",
+    "日跨ぎ",
+    "正式保存・別PID復元",
+    "夜番不在",
+    "既存残業タスク",
+    "7領域の現版への証拠適用性",
+    "必要検証・独立レビュー・通常統合"
+  ],
+  "formal_acceptance": false,
+  "original_unit_complete": false,
+  "original_denominator": {
+    "packages": 30,
+    "units": 88
+  },
+  "remaining": "仕様選択は確定。条件ごとの既存証拠適用性確認と不足境界の検証、独立レビュー、通常統合は未完了。D05の他領域を一括解決したとは扱わない。"
+}
@@ -0,0 +1,53 @@
+{
+  "task_id": "P04-01",
+  "origin": "direct_user_reply",
+  "formal_acceptance": false,
+  "source_bindings": [
+    {
+      "path": "build/owner-handoff/p04-after-p26-closure-r01/D05_ACTUAL_HUMAN_APPROVAL.json",
+      "sha256": "cd365ded1b777a0327d090709f0a4161f5005562819183455d9f2e106fba3e96"
+    },
+    {
+      "commit": "c0ea009b28a7649aca6a433a1a24dc0be5e7ab81",
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01-owner-approval-20261018/D05_ACTUAL_HUMAN_APPROVAL.json",
+      "sha256": "cd365ded1b777a0327d090709f0a4161f5005562819183455d9f2e106fba3e96"
+    }
+  ],
+  "approved_choices": [
+    {
+      "id": "D05-P04-DESTRUCTION",
+      "source_id": "destruction_completion_order",
+      "answer_exact": "現行順序を承認する（Opus推奨）",
+      "approved_question_policy": "コマンド破壊をサービス完了前に処理。事故・襲撃による破壊は完了・課金後に処理してその分の売上を有効とし、次の分で失敗処理と予約解放。"
+    },
+    {
+      "id": "D05-P04-MIDNIGHT-DAY",
+      "source_id": "midnight_revenue_day",
+      "answer_exact": "新しい日に計上し、前日決算・維持費を完了より先に確定する（Opus推奨・現状維持）",
+      "approved_question_policy": "00:00完了のサービス売上は新しい日に計上。前日決算・維持費は完了より先に確定。既承認の維持費規則と18:00交代順序を維持。"
+    },
+    {
+      "id": "D05-P04-PAUSE-REASON",
+      "source_id": "pause_reason_priority",
+      "answer_exact": "2点とも現行動作を確定する（Opus推奨）",
+      "approved_question_policy": "停電と依存先休業が同時なら休業を理由表示の優先とする。どちらも進捗・課金停止、予約保持。"
+    },
+    {
+      "id": "D05-P04-EXIT",
+      "source_id": "exit_command_ai_order",
+      "answer_exact": "2点とも現行動作を確定する（Opus推奨）",
+      "approved_question_policy": "退出コマンドは完了前、AIの予定退出は判断中の客だけを対象として完了後に処理。"
+    }
+  ],
+  "prior_approved_rules_preserved": [
+    "依存先休業中は進捗・課金停止、予約保持、復帰後1回だけ完了",
+    "17:59→18:00昼番作業を先に確定し完了・課金後に交代",
+    "既承認維持費規則"
+  ],
+  "supersedes": [
+    "D05_REMAINING_ORDER_CANDIDATE.md",
+    "D05_REMAINING_ORDER_CANDIDATE.json"
+  ],
+  "original_unit_complete": false
+}
+
@@ -0,0 +1,131 @@
+{
+  "task_id": "P04-01",
+  "revision": "repair29",
+  "status": "superseded by D05_REMAINING_APPROVAL.json; candidate text below is historical",
+  "approval": "D05_REMAINING_APPROVAL.json",
+  "apply_to_product_or_checker": false,
+  "review_flow": "Root asks owner after review. This document neither requests approval from worker nor records it.",
+  "proof_legend": {
+    "R": "B/audit-support/p04-raw-collect-r22",
+    "I": "B/p04-evidence/index.json schema2",
+    "pins": "REPAIR29_STATIC_SOURCE.json; R/MANIFEST.json and I raw_references/versions"
+  },
+  "choices": [
+    {
+      "id": "a",
+      "topic": "Power vs closure/dependency",
+      "status": "pending D05",
+      "observation": {
+        "status": "observed-current",
+        "behavior": "RELATED_FACILITY_INACTIVE selected before NO_POWER; both pause service with no charge.",
+        "source": "FacilityService _prepare_service_for_tick:853–874, phase FACILITY_COMPLETION after MANA projection",
+        "proof": "Root-measured R/s4.json isolated NO_POWER; R/s3.json B1 combined RELATED diagnostic; REPAIR29_STATIC_SOURCE.json source pins"
+      },
+      "inputs": "Same service and minute, related facility inactive and power unavailable; include direct closure separately under D-034.",
+      "A": {
+        "recommended": true,
+        "rule": "Keep current RELATED-first reason selection.",
+        "outcome": "Service held, progress/payment paused, reservation and serviceID retained.",
+        "side_effects": "Reason reports dependency while both causes apply; no new hold limit.",
+        "dependencies": "Approved dependency hold, D-034 direct closure, existing MANA-before-completion order."
+      },
+      "B": {
+        "rule": "NO_POWER wins reason selection when both conditions fail.",
+        "outcome": "Same no-charge hold safety; reason reports power.",
+        "side_effects": "Reason/event and recovery-precedence semantics would change; concrete implementation and exact-version proof require normal repair.",
+        "dependencies": "Must retain no-charge while either legitimate hold persists; preserve approved dependency reservation/identity behavior."
+      }
+    },
+    {
+      "id": "b",
+      "topic": "Destruction",
+      "status": "pending D05",
+      "observation": {
+        "status": "observed-current",
+        "behavior": "Command destruction in APPLY precedes completion. Incident destruction in INCIDENTS follows it; B4a shows25G charge then destruction in same tick.",
+        "source": "Runtime _process_tick_commands:5743, _advance_facilities:8482, _advance_defense:8577 / _apply_defense_outcome_boundary:9804",
+        "proof": "Root-measured R/s3.json B4a/B4b; REPAIR29_STATIC_SOURCE.json"
+      },
+      "inputs": "A service due for completion in a minute with command or incident destruction of its facility.",
+      "A": {
+        "recommended": true,
+        "rule": "Keep command-before-completion and incident-after-completion behavior.",
+        "outcome": "Command destruction prevents completion; incident may follow a valid completion/charge that minute; next-tick broken failure/release remains.",
+        "side_effects": "Completion and destruction can coexist in one tick as B4a; not a universal no-sale-on-destruction rule.",
+        "dependencies": "P04 stopped-charge and orphan-reservation safety; explicit D05 destruction authority required."
+      },
+      "B": {
+        "rule": "An incident in the same minute suppresses that minute completion (or voids it if already posted).",
+        "outcome": "No retained completion/sale for the incident-destruction minute.",
+        "side_effects": "Would require preemption or atomic reversal of completion, inventory, payment and rewards; no unapproved numbers or refund amounts supplied.",
+        "dependencies": "Owner must specify the suppress/void transaction semantics; preserve idempotency, no orphan reservations and approved shift/hold rules; normal implementation and new proof required."
+      }
+    },
+    {
+      "id": "c",
+      "topic": "Exit",
+      "status": "pending D05",
+      "observation": {
+        "status": "observed-current",
+        "behavior": "Command exit APPLY before completion/charging; AI PLANNED_EXIT after them; LEAVING despawns later.",
+        "source": "Runtime _execute_leave_facility_queue:7553; _advance_guest_ai_decisions:8738–8762",
+        "proof": "Root-measured R/s3.json B2a/B2b/B3 and B1 departure history; source pins REPAIR29_STATIC_SOURCE.json"
+      },
+      "inputs": "Exit command or AI exit due at a minute with a completion-ready service. Current AI PLANNED_EXIT applies to DECIDING guests; do not assume it preempts an active service.",
+      "A": {
+        "recommended": true,
+        "rule": "Keep current command/AI distinction and state predicates.",
+        "outcome": "Command leave/release happens first; eligible AI planned exit follows completion/charging and queue processing.",
+        "side_effects": "AI due time alone does not universally cancel current-minute completion; later despawn remains separate.",
+        "dependencies": "D-034, reservation ownership/release, phase6 completion before phase10 AI."
+      },
+      "B": {
+        "rule": "An exit due this minute preempts completion.",
+        "outcome": "Applicable due exits release/cancel before completion and no completion sale occurs for that preempted service.",
+        "side_effects": "Changes eligibility for exit and service cancellation; would change simultaneous completion/payment observations.",
+        "dependencies": "Owner must define applicable due-exit states; preserve no orphan reservation, no duplicate charge and approved dependency/shift behavior; normal repair and exact proof required."
+      }
+    },
+    {
+      "id": "d",
+      "topic": "Cost time/day attribution beyond A01 and18:00",
+      "status": "pending D05",
+      "observation": {
+        "status": "observed-current",
+        "behavior": "Sale dated at post-increment minute. At00:00 TIME_BOUNDARIES settlement/upkeep precede completions;00:00 sales go to new day because daily-close period_end is exclusive.",
+        "source": "Kernel advance_one_minute:122; Runtime _apply_service_transaction:11785 /11826–11838; coordinator _process_daily_close:1125 /1136",
+        "proof": "Root-measured R/s2a.json paid midnight/replay; I C; REPAIR29_STATIC_SOURCE.json"
+      },
+      "inputs": "Service completes on calendar boundary; account period ends at boundary minute. A01 ownership upkeep and18:00 shift interval remain fixed.",
+      "A": {
+        "recommended": true,
+        "rule": "Keep post-increment sale time and new-day attribution for00:00 sales.",
+        "outcome": "Closing day excludes boundary-minute completion; new day receives sale.",
+        "side_effects": "Closing summary is finalized before those sales; upkeep ownership rule unchanged.",
+        "dependencies": "Exclusive daily-close interval, sale timestamp, idempotent close/replay; P04 mandatory timing/attribution separate from D04/P05 numeric cost math."
+      },
+      "B": {
+        "rule": "Boundary-minute sales belong to closing day.",
+        "outcome": "Closing day includes those sales.",
+        "side_effects": "Would require a distinct accounting attribution or revised boundary transaction sequencing; affects daily summaries/reconciliation/replay. No numeric cost policy is invented.",
+        "dependencies": "Owner must settle attribution mechanics and same-boundary replay; preserve A01 and18:00, all P04 safety criteria; normal repair and exact-version proof required."
+      }
+    }
+  ],
+  "bundle": {
+    "label": "accept current-behavior A for a-d",
+    "status": "pending D05",
+    "recommended": true,
+    "coupling_notes": [
+      "a preserves the approved hold and no-charge safety independent of reason priority.",
+      "b and c use the same completion boundary: commands before, incidents and AI after. Changing either requires separate applicability and replay checks.",
+      "d relies on TIME_BOUNDARIES before completion; changing attribution can affect the transaction history used by b/c and settlement idempotency.",
+      "A01 ownership upkeep, dependency hold and18:00 interval are already approved and are excluded from renewed approval.",
+      "Owner may explicitly rule some remaining items non-mandatory; no such ruling exists here. Unknowns stay pending; mandatory acceptance is never relaxed."
+    ]
+  },
+  "authority_gap": "destruction_stop currently binds BASELINE:183, which is mana depletion, not destruction authority. Explicit D05 destruction rule required. Pin/registry repair only after approval through normal repair.",
+  "power_scope": "S4 NO_POWER uses direct disconnect_nodes; not proof of global depletion, which exists only in B1 combined diagnostic.",
+  "original_unit_complete": false,
+  "superseded_by": "D05_REMAINING_APPROVAL.json"
+}
@@ -0,0 +1,95 @@
+> Superseded: D05_REMAINING_APPROVAL.json records the actual human approval of all four policies. The candidate text below is retained as history.
+
+# D05 remaining order candidate — repair29
+
+**Approval candidate only. SOURCE-READY / NOTRUN.** Root asks the owner after review. Nothing is applied to product, checker or registry; observation is not approval. A01 midnight ownership upkeep, dependency hold and18:00 are already approved and are not re-asked.
+
+Structured choices: [D05_REMAINING_ORDER_CANDIDATE.json](D05_REMAINING_ORDER_CANDIDATE.json). Source path/line/SHA256 pins: [REPAIR29_STATIC_SOURCE.json](REPAIR29_STATIC_SOURCE.json); phase map: [ORDER_AUDIT.md](ORDER_AUDIT.md). R = B/audit-support/p04-raw-collect-r22; I = B/p04-evidence/index.json. These are Root-measured exact-version proof references, with raw/provenance pins in R/MANIFEST.json, I and the static manifest.
+
+## (a) Power vs closure/dependency — pending D05
+
+**Observed-current:** RELATED_FACILITY_INACTIVE selected before NO_POWER; both pause service with no charge. Source: FacilityService _prepare_service_for_tick:853–874, phase FACILITY_COMPLETION after MANA projection. Proof: Root-measured R/s4.json isolated NO_POWER; R/s3.json B1 combined RELATED diagnostic; REPAIR29_STATIC_SOURCE.json source pins.
+
+**Inputs:** Same service and minute, related facility inactive and power unavailable; include direct closure separately under D-034.
+
+**Option A (recommended; keep current behavior):** Keep current RELATED-first reason selection.
+
+- Outcomes: Service held, progress/payment paused, reservation and serviceID retained.
+- Side effects: Reason reports dependency while both causes apply; no new hold limit.
+- Dependencies: Approved dependency hold, D-034 direct closure, existing MANA-before-completion order.
+
+**Option B:** NO_POWER wins reason selection when both conditions fail.
+
+- Outcomes: Same no-charge hold safety; reason reports power.
+- Side effects: Reason/event and recovery-precedence semantics would change; concrete implementation and exact-version proof require normal repair.
+- Dependencies: Must retain no-charge while either legitimate hold persists; preserve approved dependency reservation/identity behavior.
+
+## (b) Destruction — pending D05
+
+**Observed-current:** Command destruction in APPLY precedes completion. Incident destruction in INCIDENTS follows it; B4a shows25G charge then destruction in same tick. Source: Runtime _process_tick_commands:5743, _advance_facilities:8482, _advance_defense:8577 / _apply_defense_outcome_boundary:9804. Proof: Root-measured R/s3.json B4a/B4b; REPAIR29_STATIC_SOURCE.json.
+
+**Inputs:** A service due for completion in a minute with command or incident destruction of its facility.
+
+**Option A (recommended; keep current behavior):** Keep command-before-completion and incident-after-completion behavior.
+
+- Outcomes: Command destruction prevents completion; incident may follow a valid completion/charge that minute; next-tick broken failure/release remains.
+- Side effects: Completion and destruction can coexist in one tick as B4a; not a universal no-sale-on-destruction rule.
+- Dependencies: P04 stopped-charge and orphan-reservation safety; explicit D05 destruction authority required.
+
+**Option B:** An incident in the same minute suppresses that minute completion (or voids it if already posted).
+
+- Outcomes: No retained completion/sale for the incident-destruction minute.
+- Side effects: Would require preemption or atomic reversal of completion, inventory, payment and rewards; no unapproved numbers or refund amounts supplied.
+- Dependencies: Owner must specify the suppress/void transaction semantics; preserve idempotency, no orphan reservations and approved shift/hold rules; normal implementation and new proof required.
+
+## (c) Exit — pending D05
+
+**Observed-current:** Command exit APPLY before completion/charging; AI PLANNED_EXIT after them; LEAVING despawns later. Source: Runtime _execute_leave_facility_queue:7553; _advance_guest_ai_decisions:8738–8762. Proof: Root-measured R/s3.json B2a/B2b/B3 and B1 departure history; source pins REPAIR29_STATIC_SOURCE.json.
+
+**Inputs:** Exit command or AI exit due at a minute with a completion-ready service. Current AI PLANNED_EXIT applies to DECIDING guests; do not assume it preempts an active service.
+
+**Option A (recommended; keep current behavior):** Keep current command/AI distinction and state predicates.
+
+- Outcomes: Command leave/release happens first; eligible AI planned exit follows completion/charging and queue processing.
+- Side effects: AI due time alone does not universally cancel current-minute completion; later despawn remains separate.
+- Dependencies: D-034, reservation ownership/release, phase6 completion before phase10 AI.
+
+**Option B:** An exit due this minute preempts completion.
+
+- Outcomes: Applicable due exits release/cancel before completion and no completion sale occurs for that preempted service.
+- Side effects: Changes eligibility for exit and service cancellation; would change simultaneous completion/payment observations.
+- Dependencies: Owner must define applicable due-exit states; preserve no orphan reservation, no duplicate charge and approved dependency/shift behavior; normal repair and exact proof required.
+
+## (d) Cost time/day attribution beyond A01 and18:00 — pending D05
+
+**Observed-current:** Sale dated at post-increment minute. At00:00 TIME_BOUNDARIES settlement/upkeep precede completions;00:00 sales go to new day because daily-close period_end is exclusive. Source: Kernel advance_one_minute:122; Runtime _apply_service_transaction:11785 /11826–11838; coordinator _process_daily_close:1125 /1136. Proof: Root-measured R/s2a.json paid midnight/replay; I C; REPAIR29_STATIC_SOURCE.json.
+
+**Inputs:** Service completes on calendar boundary; account period ends at boundary minute. A01 ownership upkeep and18:00 shift interval remain fixed.
+
+**Option A (recommended; keep current behavior):** Keep post-increment sale time and new-day attribution for00:00 sales.
+
+- Outcomes: Closing day excludes boundary-minute completion; new day receives sale.
+- Side effects: Closing summary is finalized before those sales; upkeep ownership rule unchanged.
+- Dependencies: Exclusive daily-close interval, sale timestamp, idempotent close/replay; P04 mandatory timing/attribution separate from D04/P05 numeric cost math.
+
+**Option B:** Boundary-minute sales belong to closing day.
+
+- Outcomes: Closing day includes those sales.
+- Side effects: Would require a distinct accounting attribution or revised boundary transaction sequencing; affects daily summaries/reconciliation/replay. No numeric cost policy is invented.
+- Dependencies: Owner must settle attribution mechanics and same-boundary replay; preserve A01 and18:00, all P04 safety criteria; normal repair and exact-version proof required.
+
+## Bundle: accept current-behavior A for a-d
+
+Recommended candidate, not approved.
+
+- a preserves the approved hold and no-charge safety independent of reason priority.
+- b and c use the same completion boundary: commands before, incidents and AI after. Changing either requires separate applicability and replay checks.
+- d relies on TIME_BOUNDARIES before completion; changing attribution can affect the transaction history used by b/c and settlement idempotency.
+- A01 ownership upkeep, dependency hold and18:00 interval are already approved and are excluded from renewed approval.
+- Owner may explicitly rule some remaining items non-mandatory; no such ruling exists here. Unknowns stay pending; mandatory acceptance is never relaxed.
+
+destruction_stop currently binds BASELINE:183, which is mana depletion, not destruction authority. Explicit D05 destruction rule required. Pin/registry repair only after approval through normal repair.
+
+S4 NO_POWER uses direct disconnect_nodes; not proof of global depletion, which exists only in B1 combined diagnostic.
+
+P04 timing/attribution remains mandatory; D04/P05 numeric cost math is separate. No acceptance criterion is relaxed. P04 remains incomplete; original13/88 unchanged.
@@ -0,0 +1,28 @@
+# Evidence collection — historical repair29 description
+
+Repair30 supersedes current-use claims below: existing S1–S4/r22/full178 records
+remain historical. New Q evidence is required, with checker explicitly selected.
+The fresh-Q collection path and S5 drivers are not ready in this partial repair.
+See REPAIR30_STATUS.md; do not start native/full or formal acceptance yet.
+
+Worker **SOURCE-READY / NOTRUN** (static Read/SHA256 only). No probes, tests, engine or Runner execution in this repair. [CURRENT_STATUS.md](CURRENT_STATUS.md) overrides historical creation-time NOT RUN entries in REPAIR22–28 and runbooks, which remain untouched. Do not repeat their completed execution steps merely because their original prose says pending.
+
+B = `/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build`.
+
+| Completed material | Current fact (Root-measured) |
+| --- | --- |
+| B/p04-s4-native-r28 | Four phases PASS; PIDs49940,50044,50078,50105 all ended, guards0, cleanup0. |
+| B/audit-support/p04-root-fb8b-s4-r01 | S4 control/native receipts preserved. |
+| B/audit-support/p04-root-fb8b-local-r01 | Local8 PASS; registered validation on fb8b PASS28.095s. |
+| B/audit-support/p04-raw-collect-r22 | Completed collection of preserved C/series applicability; no new C/S1/S2a/S2b/S3 native runs. |
+| B/p04-evidence | Current schema2 index/generation invocation, missing_conditions=[], all15 conditions + EV mechanically verified. |
+
+Native product5f6bc11d and main9b1a18c1 remain the Root-measured versions. REPAIR29_STATIC_SOURCE.json hashes current B/audit-support/p04-r17-full-inputs-r01/product (1338 files), not old deb11300, and pins current collection/index. Per-series raw/source/config/input/environment joins remain in the immutable collection and schema2 index; this worker neither regenerates nor normalizes raw.
+
+S4 is isolated NO_POWER from direct disconnect_nodes, not global mana depletion. Global depletion is observed only in B1 combined diagnostic. B1 supplies no isolated power_stop or priority approval. Destruction authority BASELINE:183 is a known wrong category (mana depletion); explicit owner D05 destruction rule is required before normal registry/pin repair. Product/checker/registry remain unchanged here.
+
+Full178 used checker **f5**,21615 checks; exact receipt preserved at B/audit-support/p18-regression-support-final-r01/native-full178/runner-ended.json and exact selected inputs at runner-input.json selected_source_map (source-start.json records initial product sources). f5 SHA256 is f5b44827958f2ae352fe5c4bc3a1ffd4211ec7a41fc4c0759c8b954891662324. Product suites/316-file GDScript parse do not execute Python; this does not establish an exact1339 proof against a61. Static comparison with the full178 selected_source_map found one test-source difference (tests/business/test_required_kitchen.gd: full3a9c92f8…, current5dcc86d6…) and no game-source difference. Runner must retain explicit applicability for that test; no blanket product1338 identity with that full178 receipt is claimed. **No full1339 run exists against a61** (a61c5b496e656f60c66898e42500bc9a2d45f947690ce8f5f19a03984ebbc850). Keep the old full and partial receipts distinct and intact.
+
+Remaining steps belong to Runner: review this repair; Root obtains owner D05(a–d) decisions or explicit non-mandatory rulings; unknown mandatory rules remain pending. Any approved checker/registry/product change uses a normal repair. Perform support53cb normal registered rebind, final full run against the final source/checker and final source/config/input/environment applicability binding, independent review and integration (P04 first, then support on main9b1a18c1). NativeWindows obligations stay individually pending if required. This document does not launch or authorize duplicate probes and does not replace Runner scheduling.
+
+A01 midnight ownership upkeep, dependency hold and18:00 are already approved. P04 timing/attribution remains mandatory, separate from D04/P05 numeric cost math. Original13/88 credit,15 conditions + EV, seven domains, three safety outcomes and30/88 denominator remain unchanged. Original unit is incomplete.
@@ -0,0 +1,33 @@
+# Concrete32 external Runner-record boundary
+
+The supplied normal-gate reference was read directly: verify, has_evidence,
+prepare_integration, approve and integrate (893–1092), and the SQL schema
+(474–483). P26 normal-candidate-example files are format samples only.
+
+`normal_c_join.py` uses read-only SQLite transactions over actual Root-selected
+Runner records. It joins submitted S, candidate C, frozen main_base M, approval,
+validation/review on S and integration/final on C. It checks the exact validation
+roster, raw review result and referenced validation logs, and hashes evidence
+inputs and the logical record snapshot. Root must establish that both databases
+are actual Runner records: arbitrary SQLite files cannot authenticate themselves.
+
+Runner integrate deletes approvals after final verification. Root retains an
+actual consistent Runner snapshot after approve, supplied as
+`--approved-runner-db`; `--runner-db` supplies later final evidence. These are
+read-only inputs, not a new Runner API. The worker creates neither snapshot.
+Missing records fail. No Git, Runner or engine is invoked. Outputs confer no
+acceptance or Git/Q/source/settings/markers/policy/engine/input qualification.
+
+All partial31 files, including the existing checker, remain unchanged as directed.
+Its NORMAL_C_RECEIPT_CONTRACT fail-closed path therefore still blocks formal C
+qualification. This new join is not wired into that gate and cannot bypass it.
+Integration of the boundary remains an implementation gap. No actual Q/C or
+ordinary-gate proof was produced. This is not a new human D05 policy question.
+
+Root runs `normal_c_join_fixtures.py --scratch DIR`: synthetic positive, wrong
+C/M, missing kind, failed check, extra/missing validation ID, task mismatch,
+medium review, missing artifact, wrong approval and missing final. Unexecuted.
+`scratch_fixture_adapter.py --scratch DIR --fixture NAME -- ...` routes preserved
+fixture TemporaryDirectory calls to explicit external scratch and clears inherited
+GIT_* routing. Existing assertions are unchanged; candidate/role fixtures still
+exercise partial31 semantics. No fixture output belongs in source.
@@ -0,0 +1,28 @@
+# P04-01 order audit — repair31
+
+Formal status is **16/88, P04 credit 0**. Policy approvals are recorded; implementation and exact-Q evidence remain incomplete. No original-unit completion is claimed.
+
+D05 is **six of six actually approved**; adoption into raw enforcement and
+verification are pending. Normal-C qualification now rejects matching-parent/tree
+commits without the authoritative Root/Runner receipt contract. That contract's
+path, SHA256 and provenance verification remain a concrete context gap.
+
+M is `c0ea009b28a7649aca6a433a1a24dc0be5e7ab81`. Source hashes, full product inventory, metadata membership and function line numbers were read from its actual Git tree in [REPAIR30_SOURCE_FACTS.json](REPAIR30_SOURCE_FACTS.json). Product manifest excludes the checker; native/full selected SourceRefs must include it. Q and C do not yet exist for this worker revision.
+
+The four actual human answers are preserved verbatim in [D05_REMAINING_APPROVAL.json](D05_REMAINING_APPROVAL.json), bound to both supplied copies by path and SHA256. Existing dependency, 18:00 and A01 approvals remain unchanged. The candidate documents are superseded history.
+
+| Domain | Approved rule | Current M source | Evidence |
+| --- | --- | --- | --- |
+| 閉店 | D-034 preserves started services on direct closure and releases waiting requests. Dependency closure stops progress and charging, retains reservations/service identity, and completes once after recovery. RELATED_FACILITY_INACTIVE wins over NO_POWER when both apply. | autoload/simulation_runtime.gd:5765 _process_tick_commands; scripts/facility/facility_service.gd:853 _prepare_service_for_tick; autoload/simulation_runtime.gd:12672 _release_closed_business_queues | Fresh Q pending; nativeWindows pending |
+| 停電 | BASELINE:183 covers real mana depletion. Legitimately stopped service has no progress or charge and preserves reservations. D05-P04-PAUSE-REASON makes dependency closure the displayed reason when dependency closure and power loss coincide. | autoload/simulation_runtime.gd:10716 _advance_mana; scripts/facility/facility_service.gd:853 _prepare_service_for_tick | Fresh Q pending; nativeWindows pending |
+| 破壊 | Command destruction precedes completion. Accident/raid destruction follows completion and charging in minute N; that sale remains valid. Failure and reservation release for affected unfinished service occurs in N+1. D05-P04-DESTRUCTION is the authority, not BASELINE:183. | autoload/simulation_runtime.gd:5765 _process_tick_commands; autoload/simulation_runtime.gd:8599 _advance_defense; autoload/simulation_runtime.gd:9826 _apply_defense_outcome_boundary; scripts/facility/facility_service.gd:853 _prepare_service_for_tick | Fresh Q pending; nativeWindows pending |
+| 退出 | D-034 release safety remains. Command exit precedes completion; AI planned exit follows completion and only applies to a deciding guest. Later despawn is distinct. | autoload/simulation_runtime.gd:7575 _execute_leave_facility_queue; autoload/simulation_runtime.gd:8760 _advance_guest_ai_decisions | Fresh Q pending; nativeWindows pending |
+| 課金 | Charge only completed service, once per idempotency key; retain original price snapshot and reservation/ledger joins. At 00:00 prior-day settlement and upkeep precede completion; the sale belongs to the new day. | autoload/simulation_runtime.gd:1876 _advance_facility_upkeep; autoload/simulation_runtime.gd:11817 _complete_service_transaction; autoload/simulation_runtime.gd:11833 _apply_service_transaction; scripts/operations/operations_coordinator.gd:1125 _process_daily_close | Fresh Q pending; nativeWindows pending |
+| シフト交代 | Approved 18:00 order remains: completion and payment before handover. No renewal of prior approval. | autoload/simulation_runtime.gd:8504 _advance_facilities; autoload/simulation_runtime.gd:8680 _advance_staff_ai | Fresh Q pending; nativeWindows pending |
+| 00:00決算 | A01 ownership-based upkeep is unchanged. Prior-day settlement/upkeep precede 00:00 service completion; its sale belongs to the new day. Replay/restore must not duplicate settlement. | scripts/core/simulation_kernel.gd:254 _handle_time_boundaries; autoload/simulation_runtime.gd:1919 _advance_operations_time; scripts/operations/operations_coordinator.gd:882 _process_minute_boundaries; scripts/operations/operations_coordinator.gd:1125 _process_daily_close | Fresh Q pending; nativeWindows pending |
+
+The preserved S1–S4, r22 index, old registered validation and f5 full178 run retain their historical identities. Current runtime deltas conservatively require fresh proof for all 15 conditions plus EV. A test count, approval record or byte-equal ordering function alone does not establish original acceptance. No thresholds or original unknown values are changed.
+
+The eleven phases remain APPLY_COMMANDS, TIME_BOUNDARIES, MANA, CONSTRUCTION, LOGISTICS, FACILITY_COMPLETION, VITALS_AND_ENVIRONMENT, INCIDENTS_AND_EVENTS, FACILITY_QUEUES, AI_DECISIONS, PUBLISH_SNAPSHOT. See the structured audit for preserved phase analysis and the new source manifest for exact M references.
+
+See [CURRENT_STATUS.md](CURRENT_STATUS.md) and [REPAIR31_STATUS.md](REPAIR31_STATUS.md) before any Root execution.
@@ -0,0 +1,137 @@
+{
+  "schema_version": 1,
+  "scope": "Internal evidence-format design within P04-01 checker work, not a new game rule or acceptance waiver. Missing or unsupported semantic proof must fail.",
+  "input_path": "BUILD_OUTPUT_DIR/p04-evidence/index.json",
+  "required_index_fields": {
+    "schema_version": 1,
+    "task_id": "P04-01",
+    "candidate_commit": "exact candidate Git SHA",
+    "source_map": "repository-relative file to raw SHA256; all observed runtime/kernel/affected service sources required",
+    "environment": "engine path/hash, OS, configuration and inputs raw pins",
+    "artifacts": "unique artifact id to build-relative path/bytes/sha256/type; resolve safely within evidence dir; reject missing, duplicate, symlink, traversal",
+    "domains": "exact7 required domain objects",
+    "authority": "original file raw pin + applicable approved decision refs; pending mandatory rules are errors",
+    "review_status": "pending_review or approved; pending review may pass mechanical stage only if every original evidence predicate passed",
+    "formal_acceptance": false
+  },
+  "required_domains": [
+    "閉店",
+    "停電",
+    "破壊",
+    "退出",
+    "課金",
+    "シフト交代",
+    "00:00決算"
+  ],
+  "domain_fields": {
+    "source_refs": "actual current functions/phase order source pins",
+    "authority_refs": "original/approved refs; implementation observations alone do not authorize a missing rule",
+    "cases": "finite scenario IDs and artifact IDs binding input, before state, delivered operation/clock boundary, after state, producer/consumer PID and unchanged raw save package where applicable",
+    "invariants": "supported predicate descriptors on actual raw JSON observation/state data; not boolean pass claims or test counts",
+    "applicability": "exact source/config/input/environment bindings; old mismatch cannot auto-pass"
+  },
+  "native_receipt_predicates": [
+    "actual owned PID>0; start/end PID identical; exit0 and engine_ended; receipt bound to pinned rawstdout/native logs",
+    "source pins in observation and phase receipt match index and checkout; config/input pins are verified",
+    "where cross-process evidence is claimed, PIDs differ and exact formal save members match producer and consumer pins"
+  ],
+  "invariant_predicate_format": {
+    "artifact_id": "existing pinned raw observation or state artifact",
+    "json_pointer": "RFC6901 JSON pointer into artifact JSON",
+    "operator": "one of eq, nonnegative, distinct, same_literal, count_eq; reject unknown",
+    "expected": "only applicable original/approved rule values or independently computed actual state relationships, never unapproved numeric policy",
+    "paired_artifact_id": "when comparing before/after or restart, required paired pinned raw artifact",
+    "paired_json_pointer": "comparison source if needed",
+    "authority_ref": "original/approved authority for this condition",
+    "raw_origin": "actual engine-produced source or explicit root derivation with each raw input hash and documented formula; unsupported derivation rejected"
+  },
+  "original_invariant_mapping": [
+    "停止が有効な区間のactual service/payment/accounting before-after差が許可されない売上を含まない。停止が未確定D05ならfail。",
+    "同じ00:00境界の精算receiptが1回、同境界再送と再開で資金/台帳が不変。A01時点は承認済み。",
+    "閉店/破壊/退出でlive reservationsとactive targetの対応が一致し、除去/復元後の孤立が0。",
+    "課金の再送/再開で同じservice/payment identityが重複反映されない。",
+    "閉店後serviceとシフト最終区間等の未承認解釈を実装観測だけでpassしない。"
+  ],
+  "fail_closed": [
+    "missing index or mandatory fields",
+    "duplicate keys/IDs, invalid field types or paths",
+    "unknown predicate or unsupported proof source",
+    "raw file hash/size, source/config/input/environment mismatch",
+    "mandatory D05 rule pending or authority missing",
+    "unexecuted proof, incomplete7domain or required boundary coverage",
+    "selfreported pass/test count as substitute for actual state invariants"
+  ],
+  "implementation_note": "Implement this finite mechanical protocol and document exact supported predicates. If evidence is absent, output actual missing IDs and exit nonzero. No requirement to create fake pass evidence. Do not change source/Clock/game numbers; no engine/test run by worker.",
+  "revision": "repair29",
+  "status": "Worker SOURCE-READY / NOTRUN; Root-measured S4r28/local8/r22/schema2 index/registered validation PASS on fb8b; no original acceptance",
+  "accepted_index_schema_versions": [
+    1,
+    2
+  ],
+  "schema2_note": "Current candidate-role/index binding uses the existing schema2 implementation. Legacy field descriptions below are not a replacement schema.",
+  "current_order_table": "order-audit.json",
+  "series_collection": "BUILD_OUTPUT_DIR/audit-support/p04-raw-collect-r22",
+  "power_stop_binding": {
+    "only_series": "S4",
+    "status": "Root-measured S4r28 4/4 PASS; all four owned PIDs ended; guards0 cleanup0",
+    "required_reason": "NO_POWER",
+    "related_facility_operating": true,
+    "kitchen_power_available": true,
+    "global_mana": ">0",
+    "operator_open": true,
+    "formal_points": [
+      "boundary",
+      "held",
+      "recovered"
+    ],
+    "canonicalization": false,
+    "dropped_fields": false,
+    "native_path": "B/p04-s4-native-r28",
+    "controls_path": "B/audit-support/p04-root-fb8b-s4-r01",
+    "PIDs": [
+      49940,
+      50044,
+      50078,
+      50105
+    ],
+    "cause": "probe calls disconnect_nodes directly; isolated NO_POWER, not proof of global depletion",
+    "global_depletion_scope": "Only B1 combined diagnostic observes global depletion; B1 supplies no isolated power_stop or priority approval"
+  },
+  "B1": {
+    "scope": "combined dependency/closure diagnostic only",
+    "power_stop_evidence": false,
+    "priority_approval": false
+  },
+  "D05_power_vs_closure": "pending D05(a); observation RELATED before NO_POWER is not approval; choices in D05_REMAINING_ORDER_CANDIDATE.json",
+  "history": "Creation-time NOT RUN in REPAIR22–28 and runbooks is historical; CURRENT_STATUS.md canonical table overrides execution status. Historical files untouched.",
+  "version_policy": "Full178 used checker f5,21615 checks, exact receipt preserved. No full1339 against a61 exists. Product-only reuse is distinct from current-checker validation. support53cb normal rebind, final full run, independent review and P04-then-support integration on main9b remain Runner steps.",
+  "root_measurements": {
+    "label": "Root-measured",
+    "local8": "B/audit-support/p04-root-fb8b-local-r01 PASS",
+    "collection": "B/audit-support/p04-raw-collect-r22",
+    "index": "B/p04-evidence/index.json schema2; missing_conditions=[];15 conditions + EV verified",
+    "registered_validation": "fb8b PASS28.095s; local-r01/registered-validation.result.json",
+    "native_product": "5f6bc11d",
+    "main": "9b1a18c1",
+    "canonical_status": "CURRENT_STATUS.md",
+    "exact_sha256_pins": "REPAIR29_STATIC_SOURCE.json"
+  },
+  "destruction_stop_binding": {
+    "status": "pending D05",
+    "current_registry_authority": "BASELINE:183",
+    "gap": "mana depletion, not destruction authority",
+    "action": "No checker or registry edits before owner approval; explicit destruction rule and subsequent normal repair required"
+  },
+  "remaining_order_choices": "D05_REMAINING_ORDER_CANDIDATE.json; pending, not applied",
+  "full178_applicability_context": {
+    "selected_map": "B/audit-support/p18-regression-support-final-r01/native-full178/runner-input.json",
+    "difference": [
+      {
+        "path": "tests/business/test_required_kitchen.gd",
+        "current_sha256": "5dcc86d66bdc47003472d6c30d6889eb514e016003265965bdd8496d123d5ca5",
+        "full178_sha256": "3a9c92f80c24064ef0858fba10bd7caab63203932942837f7e142349578f6b2f"
+      }
+    ],
+    "status": "SOURCE-READY / NOTRUN; test-source applicability retained as Runner responsibility; no blanket1338 identity claim"
+  }
+}
@@ -0,0 +1,23 @@
+# Runner実行担当からの第1修正入力
+
+これは原ゲーム仕様の変更ではありません。旧Runtimeと差分診断を追加試験入力として供給します。既存監査を再実装せず、技術的な証拠index形式とfailclosed checkerを作成してください。原7領域とD05 pendingを維持します。原条件の証拠欠損は検証失敗です。rootは検証器のsourceを変更していません。
+
+読取専用入力（Runner allocation.build_dir内）:
+- /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/audit-support/support.json
+- /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/audit-support/historical-runtime.txt
+
+旧Runtime SHA256: 2d7e2cea5424585e9aa4302ab66d1fc4dbaefe743ce4328fccc1efa2f19b82e4。入力を検証してからdiffしてください。
+
+内部indexの形式設計はspecの検証器作成指示に含まれる技術判断であり、原ゲーム規則の補完ではありません。欠損/古いソース/不正hash/未実行/未定義必須規則は必ず非0にしてください。全証拠が揃わないまま元成果を完了扱いにしないでください。エンジン・全回帰・製品source編集は0。
+
+実際のClaude commanderの記録済み判断:
+
+{
+  "action": "request-repair",
+  "task_id": "P04-01",
+  "reason": "初回Codex blockedの原因は、検証器tools/check_p04_order_evidence.pyが未作成だったこと(missing gate schemaで仕様補完を避けて停止)。これは内部証拠formatの実装判断で、原ゲーム仕様の不足ではない。既存specの検証器作成指示が、元要件を守るfailclosed形式の設計を許可している。repairs=0で、第1repairは残2/2以内。入力は再起動に十分: input.json等のlocal copy、current source pins、14差分(production7とmanaged14を区別、追加7はroot対managedでCRLF→LFのみbyte検証済み、rawSHA差は隠さない)、正確な旧Runtime(SHA 2d7e2cea完全一致)をbuild_dir/audit-support/historical-runtime.txtへraw保存済み。support.jsonとこのtxtを読取専用の追加試験入力として使う(Git変更scopeなし)。repair範囲: (1) 既存のorder-audit.jsonとORDER_AUDIT.mdは保持し、重複作成しない。必要なら最小の追記・訂正のみ。(2) --verify-onlyのcheckerを作成する。BUILD_OUTPUT_DIR/p04-evidence/index.jsonを必須とし、7領域、不変のsource pin、raw proof hash、適用性を検証する。欠損、D05 pending、stale source、未実行proof、自己申告pass、test count単独のpassは非0で終了する。raw証拠が全て不足していてもcheckerは作成する。生証拠を作ったことにはしない。D05は未承認のまま、その不足がある受入をpassにしない。(3) 全回帰・engine実行、ゲームsource変更、Clock・値の変更は0。原7領域/元30/88/部分点なしの受入分母は維持し、仕様変更・分母変更・予算拡大・main統合は含めない。allowed_pathsは検証器と実行ディレクトリ配下に限る。"
+}
+
+追加技術入力: 同じaudit-support内のruntime-diff.patchは旧SHA確認済みRuntimeと現Runtimeのdiff -u出力です。原ソース2件と突合して利用できます。
+
+前回shellのhere-documentは/tmp作成制限で失敗しています。sandbox/権限を変更せず、既存のpython -c等の一時ファイル不要の方式、または許可scopeへのapply_patchを使ってください。前回未読だったこの文書とP04_ORDER_EVIDENCE_PROTOCOL.jsonを最初に読んでください。index形式は技術設計であり、未知ゲーム規則の確定ではありません。D05や証拠不足は非0を維持し、検証器と設計書をsubmittedとして提出することは元成果acceptedではありません。
@@ -0,0 +1,92 @@
+# REPAIR17 — blocked on required raw access
+
+This is not accepted or completed. Stage R is not implemented. No new condition
+is claimed as proven. This document records an observed input-access blocker,
+not a replacement implementation or a proposal to trust Root summaries.
+
+## Checkout and scope
+
+- Observed HEAD: `accd07c91d4e34d9b7c7fc20e389df2424b167e1` (the requested reused checkout).
+- Registered contract base: `deb1bcb2374eb378b840ca345db952bd8572cb6e`.
+- Only this status file was created. The checker, `verify_native`, C checks,
+  existing fixtures, probes, originals, and logs were not modified.
+- No git writes, Runner operations, engine runs, or other agents were used.
+
+## Reproduced blocker
+
+Let `B=/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build`.
+The four `B/<series>/raw/{writer,reader}.json` files are readable. Their literal
+`slots` mappings locate the formal packages. Attempting `Path.read_bytes()` on
+every `journal.log`, `manifest.json`, `thumbnail.png`, and `world.bin` in those
+slots returned `PermissionError: [Errno 1] Operation not permitted`:
+
+| Series | Slots per role | Unreadable original + copy members |
+| --- | ---: | ---: |
+| `p04-s1-native-r02` | 14 | 112 |
+| `p04-s2a-native-r03` | 1 | 8 |
+| `p04-s2b-native-r02` | 6 | 48 |
+| `p04-s3-native-r01` | 22 | 176 |
+
+For example, this exact required S3 original cannot be read:
+
+```text
+/Users/korizatou114/Library/Application Support/TheTree-PCK-tests-078167a92c6e4888a6b4ee4a005fd858-standard-runtime-writer/saves/p04_s3/B1-after/world.bin
+```
+
+Its Reader counterpart is also inaccessible:
+
+```text
+/Users/korizatou114/Library/Application Support/TheTree-PCK-tests-b1fd1956bd28493cbac1e00f3a775232-standard-runtime-reader/saves/p04_s3/B1-after/world.bin
+```
+
+Searching each series directory for `world.bin` found only the unrelated
+`stage/tests/fixtures/required_kitchen_legacy14/formal-package/world.bin`.
+There is no `.review-material` directory in this checkout. Root result SHA
+fields cannot replace re-hashing the actual original and Reader member bytes.
+
+Current-game source access also fails: reading the first source_before entry,
+`/Users/korizatou114/Projects/とりにく工房ゲーム制作部/AGENTS.md`, returned the same error.
+Each run's fixed_input_pins contains three inaccessible entries. The remaining
+entries re-hashed successfully (S1: 13, S2a: 14, S2b: 10, S3: 15).
+Each staged source tree has 1337 hashes matching source_before and one differing
+test script (`tests/s3/test_runtime_staff_assignment.gd`); this is not a proof
+that the current game's full 1338-file source set still matches.
+
+Required unblock: make these declared original inputs readable to the worker,
+or supply an authorized, provenance-bound relocation of their full bytes,
+including both formal roles and the current-game source/fixed inputs. No new
+engine run is requested. Permission denial must not be interpreted as missing
+files, matching hashes, or failed product behavior.
+
+## Evidence and remaining conditions
+
+Readable raw locations were inspected under all four series, including
+runner-input/source_before, lifecycle receipts, raw inventory, and raw Writer
+and Reader records. D05 supplement bytes were read. ROOT result files were
+used to inspect locators, never as proof of passing conditions.
+
+- S1: EV remains unverified in this run; no paid-service power claim.
+- S2a: midnight_settlement, midnight_replay, save_restore remain unverified.
+- S2b: night_staff_absent, overtime_task and same-minute rejection remain unverified.
+- S3: closure_release, exit_release, patience_release and B4 release-once remain unverified.
+- power_stop, destruction_stop, shift_completion, same_minute_replay remain unverified.
+- Existing C verification was neither changed nor rerun; no fresh C result is claimed.
+- Required native-Windows conditions remain pending individually; this run supplies no Windows proof.
+
+Stage A remains pending: actual HEAD + filesystem candidate binding, the known
+`MAIN_ANCHOR` `9694...`, candidate_tree trust, and `3139` metadata holes are
+untouched. No final index or composition was generated.
+
+## Footprint and verification
+
+Read-only `df -h` reported about 3.1 GiB available. No evidence payload was
+copied. `B/audit-support/p04-raw-collect-r17/` did not exist at the access audit
+and was not created. A trustworthy collection footprint cannot be finalized
+without access to the required member bytes; no collector was run.
+
+Only Python read/hash/access diagnostics were executed. Fixture suites were
+not run and are not reported as passing. `p04_native_series.py`,
+`collect_p04_native.py`, and `checker_series_fixtures.py` were not created, so
+there are no valid Root collector/new-fixture commands to advertise yet.
+Implementation and its required positive/adversarial checks remain outstanding
+after the required inputs become readable.
@@ -0,0 +1,2 @@
+{"estimated_payload_bytes": 2970454, "files": 5, "available_disk_bytes": 4596576256, "large_payloads_copied": 0}
+{"collection": "/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/audit-support/p04-raw-collect-r17", "manifest_sha256": "953a798831043abdf7d54909e8e041cb3fbe6d901ca8affa661ea28e62ca5975", "actual_payload_bytes": 2970454, "formal_acceptance": false}
@@ -0,0 +1 @@
+{"C_provenance_sha256": "51d746879b4197445a09cd44a88dd918c365fa98025d9cd652a740cee09a9040", "C_source_manifest_sha256": "dbaab3c293c191eb5f3aff34854945e2d564f824df50a92802b3a7eda55321a8", "error": "candidate binding stage A pending; uncollected original boundaries: power_stop, save_restore, shift_completion", "formal_acceptance": false, "machine_verified": false, "missing_conditions": ["power_stop", "save_restore", "shift_completion"], "nativeWindows": {"EV": "pending", "closure_release": "pending", "dependency_stop": "pending", "destruction_stop": "pending", "exit_release": "pending", "midnight_replay": "pending", "midnight_settlement": "pending", "night_staff_absent": "pending", "overtime_task": "pending", "patience_release": "pending", "paused_midnight": "pending", "power_stop": "pending", "recovery_completion": "pending", "same_minute_replay": "pending", "save_restore": "pending", "shift_completion": "pending"}, "relocation_manifest_sha256": "a15f29fa12537f6d8aaf7cabea390922a9f16e3eb9c10981e5742aafc8c4c8a8", "series_bindings": {"s1": "9792569af9c8ecef177ffdeb880b814fb2878231f23e77c3749e18c228ff0ceb", "s2a": "746b58cf1aff95b082c35f6cc2c29556f146a7c56cce0475f4f2c091168605a7", "s2b": "e6d5412c14809825cf368af1d93972bc9c4e41f4c09afa414732b007c9cc7589", "s3": "a9b4b80d54c18ae2a1dc82514052e22d6174ff79999c76fa622282709759b433"}, "series_manifest_sha256": "953a798831043abdf7d54909e8e041cb3fbe6d901ca8affa661ea28e62ca5975", "stage_A": "candidate binding stage A pending", "task_id": "P04-01", "verified_conditions": ["EV", "closure_release", "dependency_stop", "destruction_stop", "exit_release", "midnight_replay", "midnight_settlement", "night_staff_absent", "overtime_task", "patience_release", "paused_midnight", "recovery_completion", "same_minute_replay"]}
@@ -0,0 +1,153 @@
+{
+  "s1": {
+    "facts": {
+      "paid_service_power_claim": false
+    },
+    "formal_acceptance": false,
+    "owned_pids": [
+      64745,
+      64788,
+      64818,
+      64850
+    ],
+    "phase_pairs": 0,
+    "product_content": "5f6bc11d6bb6e92d22d787989b219fef3a435bc1",
+    "raw_reference_count": 97,
+    "relocated_reference_count": 1464,
+    "relocation_manifest_sha256": "a15f29fa12537f6d8aaf7cabea390922a9f16e3eb9c10981e5742aafc8c4c8a8",
+    "series": "s1",
+    "source_files": 1338,
+    "verified_conditions": [
+      "EV"
+    ],
+    "verifier_sha256": "61f6647be4d2ec95db0599b94a3c6acb5f91ca43501256548f5ae161ab2f0e4f"
+  },
+  "s2a": {
+    "facts": {
+      "paid_originals": {
+        "completed_service_id": "service_00000027",
+        "same_minute_replay": "request resend, not advance_to settlement replay",
+        "shift_completion": "missing: zero SERVICE_SALE rows at 1080",
+        "transaction_id": "ledger_00000085"
+      },
+      "payroll_gold": 255,
+      "raw_getter_bytes_equal": false,
+      "sales_gold": 25,
+      "save_restore_gap": "Raw getter also changes typed arrays to untyped arrays; authorized normalization permits only StringName/String and ordering",
+      "settlement_replay_is_request_resend": false,
+      "upkeep_gold": 5
+    },
+    "formal_acceptance": false,
+    "owned_pids": [
+      85229,
+      85263,
+      85303,
+      85425
+    ],
+    "phase_pairs": 0,
+    "product_content": "5f6bc11d6bb6e92d22d787989b219fef3a435bc1",
+    "raw_reference_count": 486,
+    "relocated_reference_count": 1362,
+    "relocation_manifest_sha256": "a15f29fa12537f6d8aaf7cabea390922a9f16e3eb9c10981e5742aafc8c4c8a8",
+    "series": "s2a",
+    "source_files": 1338,
+    "verified_conditions": [
+      "midnight_replay",
+      "midnight_settlement",
+      "same_minute_replay"
+    ],
+    "verifier_sha256": "61f6647be4d2ec95db0599b94a3c6acb5f91ca43501256548f5ae161ab2f0e4f"
+  },
+  "s2b": {
+    "facts": {
+      "same_minute_rejection": "MINUTE_ALREADY_APPLIED"
+    },
+    "formal_acceptance": false,
+    "owned_pids": [
+      98696,
+      98744,
+      98770,
+      98810
+    ],
+    "phase_pairs": 12,
+    "product_content": "5f6bc11d6bb6e92d22d787989b219fef3a435bc1",
+    "raw_reference_count": 163,
+    "relocated_reference_count": 1397,
+    "relocation_manifest_sha256": "a15f29fa12537f6d8aaf7cabea390922a9f16e3eb9c10981e5742aafc8c4c8a8",
+    "series": "s2b",
+    "source_files": 1338,
+    "verified_conditions": [
+      "night_staff_absent",
+      "overtime_task"
+    ],
+    "verifier_sha256": "61f6647be4d2ec95db0599b94a3c6acb5f91ca43501256548f5ae161ab2f0e4f"
+  },
+  "s3": {
+    "facts": {
+      "B1": {
+        "amount": 0,
+        "reservation_states": [
+          "ACTIVE",
+          "RELEASED"
+        ],
+        "sales": 0
+      },
+      "B2a": {
+        "amount": 25,
+        "reservation_states": [
+          "CONSUMED"
+        ],
+        "sales": 1
+      },
+      "B2b": {
+        "amount": 0,
+        "reservation_states": [
+          "RELEASED"
+        ],
+        "sales": 0
+      },
+      "B3": {
+        "amount": 0,
+        "reservation_states": [
+          "RELEASED"
+        ],
+        "sales": 0
+      },
+      "B4a": {
+        "amount": 25,
+        "reservation_states": [
+          "CONSUMED"
+        ],
+        "sales": 1
+      },
+      "B4b": {
+        "amount": 0,
+        "reservation_states": [
+          "RELEASED"
+        ],
+        "sales": 0
+      }
+    },
+    "formal_acceptance": false,
+    "owned_pids": [
+      10448,
+      10493,
+      10523,
+      10578
+    ],
+    "phase_pairs": 352,
+    "product_content": "5f6bc11d6bb6e92d22d787989b219fef3a435bc1",
+    "raw_reference_count": 891,
+    "relocated_reference_count": 1530,
+    "relocation_manifest_sha256": "a15f29fa12537f6d8aaf7cabea390922a9f16e3eb9c10981e5742aafc8c4c8a8",
+    "series": "s3",
+    "source_files": 1338,
+    "verified_conditions": [
+      "closure_release",
+      "destruction_stop",
+      "exit_release",
+      "patience_release"
+    ],
+    "verifier_sha256": "61f6647be4d2ec95db0599b94a3c6acb5f91ca43501256548f5ae161ab2f0e4f"
+  }
+}
@@ -0,0 +1,367 @@
+{
+  "formal_acceptance": false,
+  "results": [
+    {
+      "class": "small_synthetic_positive",
+      "result": "pass",
+      "series": "shared"
+    },
+    {
+      "class": "full_body_positive",
+      "result": "pass",
+      "series": "s1"
+    },
+    {
+      "class": "wrong_source_pin",
+      "error": "SHA drift: native /native/body.gd",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "signature_only_pin",
+      "error": "full-function-body pin mismatch",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "symlink",
+      "error": "symlink: /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-implement/docs/plans/original-completion-2026-10-02/execution/p04-01/.series-fixtures-ici55vnl/symlink.gd",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "traversal",
+      "error": "raw traversal",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "unmapped_original_path",
+      "error": "unmapped original path: /native/unknown.gd",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "relocated_manifest_native_mismatch",
+      "error": "byte length drift: native /native/body.gd",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "relocated_byte_manifest_mismatch",
+      "error": "SHA drift: relocation /native/body.gd",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "JSON_only_getter_substitute",
+      "error": "unsupported Variant flags 8827:25959 at 0",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "forged_scalar",
+      "error": "SHA drift: p04-s1-native-r02/raw/writer.json",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "changed_raw_byte",
+      "error": "SHA drift: p04-s1-native-r02/raw/writer.json",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "formal_member_SHA_drift",
+      "error": "SHA drift: p04-s1-native-r02/execution.json",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "unowned_missing_PID_end",
+      "error": "missing PID end",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "altered_phase_pair",
+      "error": "SHA drift: p04-s1-native-r02/raw/reader-landing-held.var",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "relabeled_interruption_reason",
+      "error": "SHA drift: p04-s1-native-r02/raw/writer-landing-depleted.json",
+      "result": "rejected",
+      "series": "s1"
+    },
+    {
+      "class": "full_body_positive",
+      "result": "pass",
+      "series": "s2a"
+    },
+    {
+      "class": "wrong_source_pin",
+      "error": "SHA drift: native /native/body.gd",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "signature_only_pin",
+      "error": "full-function-body pin mismatch",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "symlink",
+      "error": "symlink: /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-implement/docs/plans/original-completion-2026-10-02/execution/p04-01/.series-fixtures-ici55vnl/symlink.gd",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "traversal",
+      "error": "raw traversal",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "unmapped_original_path",
+      "error": "unmapped original path: /native/unknown.gd",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "relocated_manifest_native_mismatch",
+      "error": "byte length drift: native /native/body.gd",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "relocated_byte_manifest_mismatch",
+      "error": "SHA drift: relocation /native/body.gd",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "JSON_only_getter_substitute",
+      "error": "unsupported Variant flags 8827:25959 at 0",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "forged_scalar",
+      "error": "SHA drift: p04-s2a-native-r03/raw/writer.json",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "changed_raw_byte",
+      "error": "SHA drift: p04-s2a-native-r03/raw/writer.json",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "formal_member_SHA_drift",
+      "error": "SHA drift: p04-s2a-native-r03/execution.json",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "unowned_missing_PID_end",
+      "error": "missing PID end",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "altered_phase_pair",
+      "error": "SHA drift: p04-s2a-native-r03/raw/reader-C3-recall.var",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "relabeled_interruption_reason",
+      "error": "SHA drift: p04-s2a-native-r03/raw/writer-C1-midnight.json",
+      "result": "rejected",
+      "series": "s2a"
+    },
+    {
+      "class": "full_body_positive",
+      "result": "pass",
+      "series": "s2b"
+    },
+    {
+      "class": "wrong_source_pin",
+      "error": "SHA drift: native /native/body.gd",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "signature_only_pin",
+      "error": "full-function-body pin mismatch",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "symlink",
+      "error": "symlink: /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-implement/docs/plans/original-completion-2026-10-02/execution/p04-01/.series-fixtures-ici55vnl/symlink.gd",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "traversal",
+      "error": "raw traversal",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "unmapped_original_path",
+      "error": "unmapped original path: /native/unknown.gd",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "relocated_manifest_native_mismatch",
+      "error": "byte length drift: native /native/body.gd",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "relocated_byte_manifest_mismatch",
+      "error": "SHA drift: relocation /native/body.gd",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "JSON_only_getter_substitute",
+      "error": "unsupported Variant flags 8827:25959 at 0",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "forged_scalar",
+      "error": "SHA drift: p04-s2b-native-r02/raw/writer.json",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "changed_raw_byte",
+      "error": "SHA drift: p04-s2b-native-r02/raw/writer.json",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "formal_member_SHA_drift",
+      "error": "SHA drift: p04-s2b-native-r02/execution.json",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "unowned_missing_PID_end",
+      "error": "missing PID end",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "altered_phase_pair",
+      "error": "SHA drift: p04-s2b-native-r02/raw/reader-night_absent-1080-before-facility.var",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "relabeled_interruption_reason",
+      "error": "SHA drift: p04-s2b-native-r02/raw/writer-night_absent-1081.json",
+      "result": "rejected",
+      "series": "s2b"
+    },
+    {
+      "class": "full_body_positive",
+      "result": "pass",
+      "series": "s3"
+    },
+    {
+      "class": "wrong_source_pin",
+      "error": "SHA drift: native /native/body.gd",
+      "result": "rejected",
+      "series": "s3"
+    },
+    {
+      "class": "signature_only_pin",
+      "error": "full-function-body pin mismatch",
+      "result": "rejected",
+      "series": "s3"
+    },
+    {
+      "class": "symlink",
+      "error": "symlink: /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-implement/docs/plans/original-completion-2026-10-02/execution/p04-01/.series-fixtures-ici55vnl/symlink.gd",
+      "result": "rejected",
+      "series": "s3"
+    },
+    {
+      "class": "traversal",
+      "error": "raw traversal",
+      "result": "rejected",
+      "series": "s3"
+    },
+    {
+      "class": "unmapped_original_path",
+      "error": "unmapped original path: /native/unknown.gd",
+      "result": "rejected",
+      "series": "s3"
+    },
+    {
+      "class": "relocated_manifest_native_mismatch",
+      "error": "byte length drift: native /native/body.gd",
+      "result": "rejected",
+      "series": "s3"
+    },
+    {
+      "class": "relocated_byte_manifest_mismatch",
+      "error": "SHA drift: relocation /native/body.gd",
+      "result": "rejected",
+      "series": "s3"
+    },
+    {
+      "class": "JSON_only_getter_substitute",
+      "error": "unsupported Variant flags 8827:25959 at 0",
+      "result": "rejected",
+      "series": "s3"
+    },
+    {
+      "class": "forged_scalar",
+      "error": "SHA drift: p04-s3-native-r01/raw/writer.json",
+      "result": "rejected",
+      "series": "s3"
+    },
+    {
+      "class": "changed_raw_byte",
+      "error": "SHA drift: p04-s3-native-r01/raw/writer.json",
+      "result": "rejected",
+      "series": "s3"
+    },
+    {
+      "class": "formal_member_SHA_drift",
+      "error": "SHA drift: p04-s3-native-r01/execution.json",
+      "result": "rejected",
+      "series": "s3"
+    },
+    {
+      "class": "unowned_missing_PID_end",
+      "error": "missing PID end",
+      "result": "rejected",
+      "series": "s3"
+    },
+    {
+      "class": "altered_phase_pair",
+      "error": "SHA drift: p04-s3-native-r01/raw/reader-B1-phase-960-TIME_BOUNDARIES.var",
+      "result": "rejected",
+      "series": "s3"
+    },
+    {
+      "class": "relabeled_interruption_reason",
+      "error": "SHA drift: p04-s3-native-r01/raw/writer-B1-after.json",
+      "result": "rejected",
+      "series": "s3"
+    }
+  ],
+  "scope": "file-only Stage R controls; immutable descriptor and primitive negatives"
+}
@@ -0,0 +1,211 @@
+# REPAIR18 — executable Stage R, blocked on remaining conditions
+
+This is **not accepted or completed**. Executable R artifacts and a reference-only
+collection were produced and the file-only checks were run. The whole gate
+fails. Original completion credit remains **13/88**, with no additional credit.
+The repair counter and `max_repair_attempts: null` were not changed.
+
+## Scope and preservation
+
+- Checkout: `accd07c91d4e34d9b7c7fc20e389df2424b167e1`; registered base:
+  `deb1bcb2374eb378b840ca345db952bd8572cb6e`.
+- Changed `tools/check_p04_order_evidence.py` only to add R composition and its
+  separate read-only CLI, call composition from the whole missing-check, and
+  retain an unconditional Stage A failure.
+- Created `p04_native_series.py`, `collect_p04_native.py`,
+  `checker_series_fixtures.py`, this status, and the four output files listed below.
+- All existing checker functions except `verify` and `main` were compared with
+  HEAD and are byte-unchanged, including `verify_native` and all C helpers.
+  All three existing fixture files are byte-unchanged. Their failures were not
+  hidden by editing assertions or Stage A code.
+- `REPAIR17_STATUS.md` was never written. Its SHA256 is
+  `6497c335739f266c9026aa6499cf5c49ae80d590d6aa2d0f90d32adc08018061`.
+- No git writes, new worktree/branch, agents, Runner operations, engine runs,
+  full regression, permission requests, production edits, input edits, or final
+  `B/p04-evidence/index.json` writes occurred. This did not revalidate accd.
+
+## Inputs and actual collection
+
+Here `B=/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build`,
+`R=B/audit-support/p04-r17-full-inputs-r01`, and
+`E=docs/plans/original-completion-2026-10-02/execution/p04-01`.
+
+The first input identity check verified `R/MANIFEST.json`: **1,244,135 bytes**,
+SHA256 `a15f29fa12537f6d8aaf7cabea390922a9f16e3eb9c10981e5742aafc8c4c8a8`.
+All **1,721** relocated members were used and rehashed across the series,
+covering 71,488,772 logical bytes. All four complete native `source_before`
+sets equal the supplied 1,338-file product set at content anchor
+`5f6bc11d6bb6e92d22d787989b219fef3a435bc1`. The one native QA override is checked
+separately against its supplied probe bytes; it is not represented as product
+content. Full-function-body pins include trailing comments and declarations.
+
+External original paths remain provenance strings. The resolver uses exact
+`original_to_relocated` keys, and checks each used file against both native
+descriptors and relocation descriptors. There is no prefix substitution or
+external-path fallback. Formal slot membership, directory membership, separate
+Writer/Reader paths and inodes, symlinks, traversal and duplicates are checked.
+All **344** formal members in **86** original/Reader slots were rehashed.
+
+The collector created only `B/audit-support/p04-raw-collect-r17/`. It did not
+exist before creation. It contains four series reference manifests and one
+collection manifest; no large evidence snapshots were copied.
+
+Actual collector output (exit 0):
+
+```json
+{"estimated_payload_bytes":2970454,"files":5,"available_disk_bytes":4596576256,"large_payloads_copied":0}
+{"actual_payload_bytes":2970454,"manifest_sha256":"953a798831043abdf7d54909e8e041cb3fbe6d901ca8affa661ea28e62ca5975","formal_acceptance":false}
+```
+
+The estimate was printed before directory creation or output writes. The
+collection is deterministic and refuses an existing destination on rerun.
+Per-series manifests bind native raw references, relocation references, and
+verifier bytes by SHA. Composition reruns C and all series verifiers and
+compares the recomputed results and references with those manifests; editing a
+`verified_conditions` list cannot add credit.
+
+## Conditions derived from literal raw
+
+| Verifier | Native raw | Relocated formal members | Conditions proved |
+| --- | --- | --- | --- |
+| S1 | `B/p04-s1-native-r02/raw/` | `R/formal/p04-s1-native-r02/{writer,reader}/` | `EV` |
+| S2a | `B/p04-s2a-native-r03/raw/` | `R/formal/p04-s2a-native-r03/{writer,reader}/C3/` | `midnight_settlement`, `midnight_replay` |
+| S2b | `B/p04-s2b-native-r02/raw/` | `R/formal/p04-s2b-native-r02/{writer,reader}/` | `night_staff_absent`, `overtime_task` |
+| S3 | `B/p04-s3-native-r01/raw/` | `R/formal/p04-s3-native-r01/{writer,reader}/` | `closure_release`, `exit_release`, `patience_release`, `destruction_stop` (B4b) |
+| Paid/resend supplement, collected with S2a | `B/audit-support/p04-current-native-series-r01/p04-idempotency-paid-midnight-native-r01/order-evidence/` | Manifest pin resolved through `R/MANIFEST.json`, full raw already inside B | `same_minute_replay` (request resend) |
+| Unchanged C | `B/audit-support/native-first-current/` | Existing C bundle, unchanged | `dependency_stop`, `recovery_completion`, `paused_midnight` |
+
+All product reads resolve to `R/product/` through manifest keys. Fixed-input
+relocations and every original formal provenance string are retained in the
+four generated series manifests; they are not replaced with guessed paths.
+
+Owned import/parse/Writer/Reader PIDs checked against starts, ends, owners,
+commands, raw stream hashes, exit gates and cleanup/guard records:
+
+| Series | PIDs | Formal slots per role | Exact raw phase pairs |
+| --- | --- | ---: | ---: |
+| S1 | 64745, 64788, 64818, 64850 | 14 | 0 (14 exact typed snapshot restore points instead) |
+| S2a | 85229, 85263, 85303, 85425 | 1 | 0 (typed settlement/replay and formal Runtime restore comparisons) |
+| S2b | 98696, 98744, 98770, 98810 | 6 | 12 |
+| S3 | 10448, 10493, 10523, 10578 | 22 | 352 JSON/typed phase files |
+
+- S1 checks task/trip/resource identity, safe landing, no-safe-landing hold,
+  preserved reservation identity and release. It makes no paid-service power claim.
+- S2a derives a 25G sale/one transaction, 255G payroll/one transaction
+  (Akane 120, Bardo 135 joined to actual staff and shifts), and 5G upkeep in
+  three rows/one transaction. `advance_to(1440)` has processed minutes 0 and
+  daily closes 0, with entire typed Runtime bytes unchanged. Formal Reader
+  Runtime restore and recall bytes match exactly.
+- The supplemental request-resend raw preserves typed economy, facilities,
+  inventory, guests and staff at the same minute, and joins the one completed
+  service `service_00000027` to sale transaction `ledger_00000085`. This is not
+  settlement-replay proof; S2a supplies that distinct proof.
+- S2b derives `STAFF_UNAVAILABLE`/`WAITING_FOR_STAFF`, the absent night workers,
+  overtime task/staff/shift joins and one duty minute. Its same-minute call is
+  rejected as `MINUTE_ALREADY_APPLIED`, with entire typed Runtime unchanged.
+- S3 retains `RELATED_FACILITY_INACTIVE` in B1, never relabeling it `NO_POWER`.
+  The directly closed facility retains its started service while the dependent
+  facility interruption pauses it; the queued reservation is released.
+  B2a completes/consumes once; B2b and B3 release without a sale.
+  B4b's queued event completes, durability becomes 0/`BROKEN`, then the service
+  fails with `BROKEN` at 961, releases its reservation and has zero sale rows.
+
+## Unresolved raw/specification gaps
+
+1. **`power_stop` missing.** EV evidence is not a paid-service power proof;
+   B1 is a dependency interruption. No relabeling or invented D05 rule was used.
+2. **`shift_completion` missing.** The actual supplied paid-shift originals at
+   `B/audit-support/p04-current-native-series-r01/p04-paid-shift-midnight-native-r01/order-evidence/`
+   have zero `SERVICE_SALE` rows in all three 17:59/completion-phase/18:00
+   snapshots. The `paid` filenames do not establish a charged completion at 1080.
+3. **`save_restore` withheld under the fixed normalization restriction.** The
+   entire formal Runtime does restore exactly. However, the getter comparison
+   changes not only StringName/String and dictionary order but typed arrays to
+   untyped arrays. Examples are `/anomalies`, `/anomalies/0/allocations`,
+   `/anomalies/0/unallocated_by_staff`, `/anomalies/0/facility_ids`,
+   `/settlement/input_payments` and `/settlement/rows`. Native array headers
+   include `1c000100...` versus `1c000000...`. The raw getter byte inequality is
+   preserved and parsed from `.var`; JSON is not substituted. Normalization was
+   not broadened beyond the instruction, so this condition remains missing.
+4. **B4a zero-charge assertion is unsupported.**
+   `B/p04-s3-native-r01/raw/writer-B4a-next.{json,var}` contains one 25G sale at
+   960 and a completed service with consumed reservation. B4b has zero sales.
+   The implementation records both facts, rather than declaring B4a charge 0.
+   Destruction-stop credit above is specifically the B4b failed-service branch.
+
+D05 approval and supplement full bytes in `p04-whole-closure-r01` were read.
+They approve dependency closure and the 18:00 ordering choice, not an invented
+blanket policy for all D05 domains. The supplied raw discrepancies require
+owner-level resolution or appropriate evidence; this worker did not amend scope.
+
+Each of these native-Windows conditions remains individually **pending**:
+`EV`, `power_stop`, `destruction_stop`, `dependency_stop`, `shift_completion`,
+`recovery_completion`, `same_minute_replay`, `closure_release`, `exit_release`,
+`patience_release`, `paused_midnight`, `midnight_settlement`, `midnight_replay`,
+`save_restore`, `night_staff_absent`, `overtime_task`. The machine output also
+contains an explicit per-condition pending map.
+
+## Actual validation outputs
+
+- Static Python compilation: **4 files passed** (in-memory compile; no engine).
+- Existing C fixture: **exit 0**, 5 positive controls passed and 25 negatives
+  rejected. `verify_native` reports 10 owned processes and its original three
+  conditions. No C condition names were edited.
+- Existing negative fixture: **exit 1**, at `synthetic_scalar_only_rejected`:
+  `AssertionError: ('synthetic_scalar_only_rejected', {'task_id': 'P04-01', 'machine_verified': False, 'formal_acceptance': False, 'error': "'product_binding'"})`.
+- Existing applicability fixture: **exit 1**:
+  `AssertionError: negative fixture accepted: wrong_tested_revision`.
+  These two suites therefore could not be confirmed to pass/reject as requested.
+  Their files and the functions involved were unchanged; they were not repaired
+  by touching the deferred A holes, and no baseline rerun is claimed.
+- New series fixtures: **exit 0**, **5 small positive controls and 56 rejected
+  negatives**, 14 negative classes per series. Controls cover immutable raw and
+  descriptor overlays, source/body pins, PID endings, paths, relocation byte
+  drift and typed-vs-JSON rejection. Immutable descriptor hashes are deliberately
+  not refreshed; the tests do not claim to be new engine evidence.
+- Real series verifiers ran successfully during collection and were rerun by
+  composition. Outputs are recorded in `REPAIR18_REAL_SERIES_OUTPUT.json`.
+- Separate composition CLI: **exit 1**, with 13 raw-derived conditions and:
+
+```text
+candidate binding stage A pending; uncollected original boundaries: power_stop, save_restore, shift_completion
+```
+
+Full new outputs: `REPAIR18_COLLECTOR_OUTPUT.jsonl`,
+`REPAIR18_SERIES_FIXTURE_OUTPUT.json`, `REPAIR18_REAL_SERIES_OUTPUT.json`,
+`REPAIR18_COMBINED_OUTPUT.json`. The 13 verified boundary conditions are not
+13 newly accepted units and do not change the original 13/88 credit.
+
+## Exact Root commands
+
+Run from this existing checkout. These commands perform file-only work:
+
+```sh
+B=/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build
+E=docs/plans/original-completion-2026-10-02/execution/p04-01
+python3 -B "$E/collect_p04_native.py" --build "$B"
+python3 -B "$E/checker_series_fixtures.py" --build "$B"
+python3 -B "$E/p04_native_series.py" --build "$B"
+python3 -B "$E/checker_negative_fixtures.py"
+python3 -B "$E/checker_applicability_fixtures.py" --native-bundle "$B/audit-support/native-first-current"
+python3 -B "$E/checker_native_fixtures.py" "$B/audit-support/native-first-current"
+BUILD_OUTPUT_DIR="$B" python3 -B tools/check_p04_order_evidence.py --verify-series-only
+```
+
+The collector command above was already executed successfully; another execution
+must refuse the now-existing destination. Review the existing collection rather
+than overwriting it. The final command is intentionally failing; it does not
+need or generate a final index and never performs candidate composition.
+
+## Stage A and subsequent dependencies
+
+Stage A remains pending: actual HEAD/filesystem candidate binding,
+`MAIN_ANCHOR` `9694...`, `candidate_tree` trust and the `3139` metadata holes
+are untouched. `--verify-only` still requires the actual final evidence index;
+its missing-check unions recomputed C/R results and still fails for any missing
+condition, and it cannot succeed while Stage A is pending.
+
+Required sequence remains **R → A → final index → mandatory whole validation →
+independent review → ordinary integration**. Outstanding raw/specification gaps
+and the two existing fixture failures prevent representing this dispatch as a
+completed or accepted implementation.
@@ -0,0 +1,58 @@
+# Repair19 persistence explanation corrigendum
+
+This corrects the old Root explanation that the live day-summary comparison
+differed only in StringName/String and dictionary order. That explanation missed
+generic Array headers. It also corrects the superseded proposal to explain this
+path using `_to_snapshot_variant`.
+
+The exact relocated source is
+`B/audit-support/p04-r17-full-inputs-r01/product/scripts/operations/operations_coordinator.gd`.
+Its 130891 bytes have SHA256
+`871a248ee101b6df543fd5cf0440b5d4b0f02c21fa145a99f0687888c1bc6f90`.
+Full bodies, including bytes through the next named function, were read directly
+and compared with `T/ROOT_ACTUAL_PERSISTENCE_CALL_CHAIN.json`, where
+`T=B/audit-support/p04-repair19-close-r01`. All five bodies, lengths and hashes
+match that supplied file:
+
+| Function | Line | Bytes | SHA256 |
+| --- | ---: | ---: | --- |
+| `get_day_summary` | 577 | 153 | `449eef926054cf76c39d6b4c016da3d775d41f2b343b4f8ad57b62c594cb32bb` |
+| `create_snapshot` | 620 | 3988 | `8c6e4f000e6df6f0f996445a57c4c17223cae4e1df57a9c2e3a605cf4d9f5309` |
+| `_snapshot_root_report` | 2943 | 2062 | `96084d76beeac11d165753a82160f789cd47b4dec4b6bb8cd6599a4f5ed08efe` |
+| `_visit_snapshot_tree` | 2992 | 3045 | `70792369c05882b813632a3c96f934928e9a089d420700cfc0d4c8fa971972a0` |
+| `_to_snapshot_variant` | 3083 | 550 | `f7db3cf2d495bb117fc7f6795633daa272c03d8eb7f99977e462e0a9df20cd8a` |
+
+`get_day_summary` returns `_day_summaries[day].duplicate(true)` directly. It
+exposes an internal API representation; the product getter need not change.
+`create_snapshot` first validates with capture=true. In that pass,
+`day_summaries` is not among the reusable encoded fields. It then assembles
+`saved_days` and calls `_snapshot_root_report(raw_snapshot, field_cache, false)`.
+That report invokes `_visit_snapshot_tree` with encoding enabled. The visitor
+creates untyped arrays, converts StringName to String, stringifies permitted
+dictionary keys and sorts the resulting String keys with native sorting.
+
+The separate `_to_snapshot_variant` helper is not on this call chain. Its
+`sort_custom(_variant_string_less)`, lack of finite-float/budget checks and
+pass-through of unsupported types prevent using it as a general equivalent.
+
+The supplied `T/ROOT_S2A_TYPED_ARRAY_HEADER_AUDIT.json` lists the following six
+changes. These are explicitly attributed to that diagnostic; they have not been
+independently rerun by a repair19 fixture in this dispatch.
+
+| Path below `day_summary` | Writer header | Writer element kind | Reader header | Length |
+| --- | --- | --- | --- | ---: |
+| `/anomalies` | `1c000100` | Dictionary (27) | `1c000000` | 1 |
+| `/anomalies/0/allocations` | `1c000100` | Dictionary (27) | `1c000000` | 1 |
+| `/anomalies/0/facility_ids` | `1c000100` | String (4) | `1c000000` | 3 |
+| `/anomalies/0/unallocated_by_staff` | `1c000100` | Dictionary (27) | `1c000000` | 0 |
+| `/settlement/input_payments` | `1c000100` | Dictionary (27) | `1c000000` | 5 |
+| `/settlement/rows` | `1c000100` | Dictionary (27) | `1c000000` | 5 |
+
+Every listed Reader array is untyped. Raw getter byte equality remains **false**.
+This diagnostic is separate from the source-defined persisted snapshot.
+Neither this explanation nor an optional projection may weaken exact native
+expected/restored typed-byte comparison, entire Runtime equality, formal 4+4
+member equality, settlement counts, duplicate-payment checks or replay checks.
+No projection implementation or new save_restore verification is claimed here.
+The executable R18 normalization gate is still unchanged, so save_restore is
+still open pending the exact encoder port and its required validation.
@@ -0,0 +1,78 @@
+# Repair19 — incomplete; execution constraint clarification pending
+
+This is not a ready submission and not formal acceptance. Original credit stays
+13/88. All 15 conditions plus EV retain their existing scope; nativeWindows
+remains pending for each. No product, acceptance, domain or outcome was changed.
+
+## Blocking instruction conflict
+
+The recorded repair19 direction requires local fixture reruns, isolated temp-Git
+negative and positive controls, and removing the Stage-A refusal only after
+those tests pass. The final worker instructions prohibit Git writes and say
+tests are formally executed by Runner. This dispatch has requested clarification
+on whether that prohibition exempts the specifically requested file-only and
+isolated temp-Git fixtures. There is no answer at the time of this report.
+No exemption has been assumed. This is an execution-constraint blocker, not a
+claim that pending formal acceptance itself blocks implementation.
+
+## Changes actually made in this dispatch
+
+- `p04_native_series.py`: retain both JSON and Variant Writer/Reader phase-byte
+  comparisons, but increment the S3 pair metric only for `.var`. The requested
+  interpretation is 352 checked file pairs representing 176 observations. A
+  new execution output confirming that count has not been generated.
+- `p04_native_series.py`: add the B1 `power_stop` join for the five observations
+  at 959–963, positive finite original reserve, actual public mana and power
+  flags, direct closure, same service identity/progress/reservations, queued B
+  release/stock/patience, recovery payment and unchanged next ledger. Bind the
+  saved 961 recovery command and the APPLY_COMMANDS phase. Preserve the actual
+  `RELATED_FACILITY_INACTIVE` reason. This code is untested; its addition to the
+  verifier's returned conditions is conditional on every assertion succeeding
+  when Runner executes it. No successful power_stop result is claimed here.
+- `REPAIR19_CORRIGENDUM.md`: correct the StringName/order-only explanation,
+  distinguish raw getter from public persistence, list all six supplied typed
+  Array header changes, and record the actual source call-chain full-body pins.
+
+## Static observations and preservation
+
+- In-memory Python `compile` of the edited series module succeeded. No fixture,
+  native, Godot, full-regression or Runner run occurred.
+- The exact relocated operations source was read. All five complete function
+  bodies, lengths and hashes equal
+  `B/audit-support/p04-repair19-close-r01/ROOT_ACTUAL_PERSISTENCE_CALL_CHAIN.json`.
+  The hash table and exact call-chain explanation are in the corrigendum.
+- The checker region from `NATIVE_RUNS` through `verify_native`, inclusive of
+  the C constants and helpers, equals its HEAD bytes. Region SHA256:
+  `5d778b3cfab7c139ca03812489508ce9aae90c1d17f8c2249c340f30d1496b3b`.
+- No R17/R18 output or status file was edited. The existing uncommitted R18
+  checker changes remain. No Git write, agent, integration or Runner operation
+  occurred. No native evidence was created or modified.
+- No collector was run. Both the existing r17 collection and the required fresh
+  r19 destination remain untouched by this dispatch. Since the series verifier
+  bytes changed, the old r17 collection cannot validate these new verifier bytes;
+  it must never be overwritten or represented as a repair19 collection.
+
+## Remaining implementation and validation
+
+Repair19 is incomplete. R2's C-backed paid shift join, R3's exact encoder port
+and fixtures, Stage A's actual Git-role verifier, new index generator, fixture
+protocol repairs and all requested fixture executions remain to be completed.
+The old Stage-A unconditional refusal remains in place. The old
+`verify_product_target` has not been edited or replaced in this dispatch.
+The 9b1a18c anchor resolves to
+`9b1a18c1eb25ca1300dcd59da78423c0dda2f498`; the old checker constant has not yet
+been changed as part of a complete Stage-A repair.
+
+No new output JSON is reported, and no old fixture success is reused as success
+for the edited module. B4a/B4b semantics, frozen save_restore measurements and
+its current open result remain unchanged. The 25 C negatives and 56 series
+negatives have not been rerun.
+
+There are no valid repair19 index-generation or submitted/merged-candidate Root
+commands yet: the required generator and role verifier are not implemented.
+Providing plausible commands for nonexistent functionality would be misleading.
+The completed follow-up must supply those exact commands after implementing and
+validating the protocol, retain all existing outputs, and collect exclusively
+into the fresh `B/audit-support/p04-raw-collect-r19` destination.
+
+Here `B=/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build`.
@@ -0,0 +1,40 @@
+# Repair20 persistence corrigendum
+
+The old Root explanation, “StringName/order only”, omitted six generic Array
+header changes. `get_day_summary` returns the internal day's `duplicate(true)`;
+it does not return the canonical persisted representation. Its raw Writer and
+Reader bytes remain unequal. All original raw files and values are retained.
+No product getter change is proposed.
+
+| Path under day_summary | Writer header | Element kind | Reader header | Length |
+| --- | --- | --- | --- | ---: |
+| anomalies | 1c000100 | Dictionary (27) | 1c000000 | 1 |
+| anomalies/0/allocations | 1c000100 | Dictionary (27) | 1c000000 | 1 |
+| anomalies/0/facility_ids | 1c000100 | String (4) | 1c000000 | 3 |
+| anomalies/0/unallocated_by_staff | 1c000100 | Dictionary (27) | 1c000000 | 0 |
+| settlement/input_payments | 1c000100 | Dictionary (27) | 1c000000 | 5 |
+| settlement/rows | 1c000100 | Dictionary (27) | 1c000000 | 5 |
+
+These are the six entries in `T/ROOT_S2A_TYPED_ARRAY_HEADER_AUDIT.json`.
+The new code derives them again from typed nodes and compares the list to that
+diagnostic. This execution is **NOT RUN** in repair20.
+
+The persistence chain is `create_snapshot` (620) →
+`_snapshot_root_report(raw_snapshot, field_cache, false)` (2943) →
+`_visit_snapshot_tree(..., encode=true)` (2992). The earlier capture=true pass
+does not cache encoded day_summaries. `_to_snapshot_variant` is not on this path.
+
+The projection is confined to raw getter → persisted day1. It retains all
+scalar Variant bytes, including numeric type, rejects nonfinite floats and
+unsupported values, stringifies permitted keys, rejects canonical collisions,
+sorts String keys, rebuilds untyped Arrays, and enforces collection, depth, node,
+single-string and aggregate-string limits. Unsupported dictionary-key types
+are rejected, never silently normalized. The optional admitted subset does not
+include composite-key Godot stringification. No projection is allowed on the
+native persisted expected/restored comparison.
+
+Full Runtime Writer/Reader/restored equality, formal 4+4 member equality,
+settlement/duplicate-payment checks and the actual advance_to replay checks
+remain independent strict requirements. If getter projection still differs
+from the native canonical_day1 bytes, `save_restore` remains open and reports
+that exact mismatch. No new successful equality is claimed without Root's run.
@@ -0,0 +1,183 @@
+# Repair20 — source submission; tests NOT RUN
+
+Source-only repair. No Git command, fixture, collector, series, Godot/native,
+Runner, agent, commit, branch or integration operation was executed. The only
+code validation performed was Python `compile(..., 'exec')` in memory, without
+imports/execution of the edited modules. No acceptance is claimed. Original
+credit remains 13/88; all 15 conditions + EV, seven domains and three safety
+outcomes retain their scope. nativeWindows remains pending for every condition.
+The next submission SHA is assigned by Runner and is not predeclared here.
+
+Changed files:
+
+- `tools/check_p04_order_evidence.py`: real checkout/role binding, isolated
+  object stores under B, first-1080 R2 join, schema2 recomputation and r20 collection.
+- `p04_native_series.py`: B1 departure/despawn/full-state joins, explicit 352/176
+  S3 checks, confined getter projection, persistence pins and six-header diagnostic.
+- `collect_p04_native.py`: exclusive new collection at
+  `B/audit-support/p04-raw-collect-r20`.
+- `checker_negative_fixtures.py`: retain existing content-case IDs and meanings;
+  isolate their content layer explicitly in the test harness, while the separate
+  real-Git fixture exercises production role binding without a bypass.
+- New `build_p04_index.py`, `checker_role_fixtures.py`,
+  `checker_encoder_fixtures.py`, `checker_join_fixtures.py`.
+- New `REPAIR20_STATUS.md` and `REPAIR20_CORRIGENDUM.md`.
+
+In-memory compilation: all eleven Python files (checker plus ten modules in E)
+compile. This is syntax validation only; every test below is **NOT RUN**.
+The retained C region, `NATIVE_RUNS` through `verify_native`, is byte-for-byte
+equal to T's retained source, SHA256
+`5d778b3cfab7c139ca03812489508ce9aae90c1d17f8c2249c340f30d1496b3b`.
+`verify_product_target` itself is also byte-for-byte retained and no longer called.
+Existing repair17/18/19 status, corrigendum, raw outputs and T's retained archives
+were not modified. Existing C 25 negatives and series 56 negatives remain required.
+
+## R3 source pins
+
+Product source: `scripts/operations/operations_coordinator.gd`, 130891 bytes,
+SHA256 `871a248ee101b6df543fd5cf0440b5d4b0f02c21fa145a99f0687888c1bc6f90`.
+Runtime verification checks the complete bodies and cross-checks the actual
+body bytes, lengths and hashes against `T/ROOT_ACTUAL_PERSISTENCE_CALL_CHAIN.json`.
+
+| Function | SHA256 |
+| --- | --- |
+| get_day_summary | 449eef926054cf76c39d6b4c016da3d775d41f2b343b4f8ad57b62c594cb32bb |
+| create_snapshot | 8c6e4f000e6df6f0f996445a57c4c17223cae4e1df57a9c2e3a605cf4d9f5309 |
+| _snapshot_root_report | 96084d76beeac11d165753a82160f789cd47b4dec4b6bb8cd6599a4f5ed08efe |
+| _visit_snapshot_tree | 70792369c05882b813632a3c96f934928e9a089d420700cfc0d4c8fa971972a0 |
+
+The corrigendum lists all six Array header changes. Native persisted comparisons
+are direct typed-byte comparisons. Raw getter inequality remains diagnostic.
+The optional projection admits only the supported persistence subset; unsupported
+composite dictionary keys fail closed. Its negative controls include field loss,
+extra fields, both numeric-type directions, value changes, nonfinite floats,
+invalid keys, collisions, unsaveable values, wrong call chain and use on native
+persisted comparisons. The positive changes only Array headers and StringName.
+
+## Condition disposition on this untested source
+
+No condition is newly proven by this dispatch. All tests are **NOT RUN**.
+
+| Condition | State and reason pending Root execution |
+| --- | --- |
+| power_stop | Open: new B1 959–963 join; real B at 959/960, normal recorded departure then absence, unchanged one-time release, stock 1, wallet 50, no B charge; recovery 25 at 962 and no extra 963 charge. |
+| destruction_stop | Pending: retained S3 B4b BROKEN failure and zero-sale/release predicates. |
+| dependency_stop | Pending: unchanged C paused service identity/progress/reservation proof. |
+| shift_completion | Open: new C first-1080 join; PIDs 77462/77504/77536 ended, 1338-file content 5f, 44→45, ledger_00000006/25G, DAY2 present before handover and zero after, no extra at 1081. |
+| recovery_completion | Pending: unchanged C recovery transaction/idempotency join. |
+| same_minute_replay | Pending: retained real paid request-resend join; never substituted for settlement replay. |
+| closure_release | Pending: retained S3 closure/release plus despawn-aware B1 checks. |
+| exit_release | Pending: retained S3 B2 release/completion ordering. |
+| patience_release | Pending: retained S3 B3 patience expiration and release. |
+| paused_midnight | Pending: unchanged C paused-midnight series. |
+| midnight_settlement | Pending: retained S2a nonzero sales/payroll/upkeep/duty joins. |
+| midnight_replay | Pending: actual advance_to replay, zero processed minutes and zero daily closes, exact Runtime bytes. |
+| save_restore | Open: direct full typed Runtime and formal 4+4 equality remain mandatory; optional getter projection must equal actual persisted day1. A remaining mismatch is explicitly reported, never projected out of native restore. |
+| night_staff_absent | Pending: retained S2b WAITING_FOR_STAFF at 1081. |
+| overtime_task | Pending: retained S2b interrupt-level-zero task/staff/shift and once-only duty joins. |
+| EV | Pending: retained S1 reachable reserved staff power-stop proof and pinned static chain. |
+
+Stage A is implemented but **NOT RUN**. Submission is inferred from actual Git
+ancestry and scoped diff; the composed product is labelled prospective, not a
+tested worker game. Integration/final requires an actual two-parent merge and
+exact recomputed merge tree, native product map/modes and submitted checker/doc
+patch. Every tracked file and executing module must match HEAD bytes/mode;
+untracked/ignored files and symlinks fail. Unknown/deleted sources and candidate,
+code-only or phase declarations cannot authorize a role. Metadata membership
+comes from the real 9b1a18c tree, without the old count assumptions.
+
+Schema2 retains native source/config/input/environment, real lifecycle PIDs,
+formal proofs, complete raw references, authority and original-audit uncertainty,
+domain and reachability mappings. Its entire payload is recomputed from raw by
+the same checker. It contains no candidate==HEAD pin or Root-passed flag.
+`generation-invocation.json` separately records the actual invocation/HEAD.
+
+## Root execution order (all commands below NOT RUN)
+
+Run from the clean, actual auto-submitted checkout. Root supplies actual clean
+merged/final checkout paths later; do not substitute invented SHAs. Preserve all
+prior output directories and use exclusive fresh output destinations.
+
+```sh
+export B=/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build
+export E=docs/plans/original-completion-2026-10-02/execution/p04-01
+export BUILD_OUTPUT_DIR="$B"
+export PYTHONDONTWRITEBYTECODE=1
+```
+
+1. Local file-only and fixture controls on the actual new SHA:
+
+```sh
+python3 "$E/checker_negative_fixtures.py"
+python3 "$E/checker_applicability_fixtures.py" --native-bundle "$B/audit-support/native-first-current"
+python3 "$E/checker_native_fixtures.py" "$B/audit-support/native-first-current"
+python3 "$E/checker_series_fixtures.py" --build "$B"
+python3 "$E/checker_encoder_fixtures.py"
+python3 "$E/checker_join_fixtures.py" --build "$B"
+```
+
+2. Real series against B, then the exclusive r20 collection:
+
+```sh
+python3 "$E/p04_native_series.py" --build "$B"
+python3 "$E/collect_p04_native.py" --build "$B"
+```
+
+3. After auto-submit, generate the fresh normal Runner index. B/p04-evidence was
+absent at static inspection. If it is now occupied, retain it and choose an
+explicit fresh directory with P04_EVIDENCE_DIR for manual checks; do not overwrite.
+The normal Runner uses B/p04-evidence and must receive that actual generated index.
+
+```sh
+python3 "$E/build_p04_index.py" --build "$B" --output "$B/p04-evidence" \
+  --invocation validate \
+  --registered-ref deb1bcb2374eb378b840ca345db952bd8572cb6e \
+  --tested-ref 5f6bc11d6bb6e92d22d787989b219fef3a435bc1
+```
+
+4. Checker on submitted, merged and final actual checkouts. Real temp-Git fixtures
+need the generated index, so their execution follows step 3, not a fabricated
+pre-submission index. They create throwaway repositories/objects only under B.
+
+```sh
+python3 "$E/checker_role_fixtures.py" --build "$B" --evidence "$B/p04-evidence"
+python3 tools/check_p04_order_evidence.py --verify-only
+python3 "$P04_MERGED_CHECKOUT/tools/check_p04_order_evidence.py" --verify-only
+python3 "$P04_FINAL_CHECKOUT/tools/check_p04_order_evidence.py" --verify-only
+```
+
+The same index works in all three roles. For separate invocation records, the
+generator also accepts `--invocation prepare-integration` and `--invocation final`
+with explicit fresh output paths while executing from those actual checkouts.
+These labels are receipt metadata and grant no role. Root must respect the normal
+Runner state machine: its prepare_integration requires prior formal review.
+An isolated local prospective-merge control does not replace that review or move
+Runner state. `runner.validate("P04-01")`, `runner.prepare_integration("P04-01")`
+and `runner.integrate("P04-01")` remain Root operations only.
+
+5. Mandatory whole validation and full 178-game regression once on exact final
+sources. The supplied Runner core exposes
+`runner.verify("P04-01", final_checkout, actual_final_sha, "final")`; retain every
+configured mandatory validation, then run the existing guarded full-game runner:
+
+```sh
+python3 "$P04_FINAL_CHECKOUT/tools/run_all_tests.py" \
+  --project-root "$P04_FINAL_CHECKOUT" --output "$B/p04-final-product-full-r01"
+```
+
+Do not change timeout, marker contracts or suite policy, splice phases, or reuse
+historical 177-suite proof. Confirm the final selected source map and 178-suite
+roster, and preserve source/default-profile invariance. This command is the one
+full run, not permission for an additional `make test` native run.
+
+6. Independent Opus review using Root's existing reviewer route, with exact
+source/validation materials mirrored into the frozen checkout's .review-material.
+The supplied core's formal method is `runner.review("P04-01")`; that method reviews
+the actual submitted revision and requires its validation evidence. Any additional
+final-composition Opus review must explicitly receive the actual final revision.
+The external commander/Opus CLI entry point and installed Runner configuration
+were not supplied in this checkout, so no guessed shell command is asserted for
+them. Root retains its existing formal validation/review/integration workflow.
+
+The absent external entry-point/configuration details are handoff context gaps,
+not evidence of a pass, and not a blocker solely because Root testing is pending.
@@ -0,0 +1,95 @@
+# Repair21 — source submission; tests NOTRUN
+
+P04-01 source-only performance repair. Changes are restricted to the checker,
+the new `bulk_reader_equivalence.py` fixture, and this status file. No Git
+command, test, fixture, collector, Runner, native/Godot run, agent, commit,
+branch or integration operation was executed by the worker.
+
+`read_blobs` validates full lowercase 40-hex OIDs before starting a process,
+deduplicates/sorts them, and uses one `git cat-file --batch` process per nonempty
+request. Empty requests start no process. `check_output` inherits stderr and
+raises for nonzero exit status just like `git_bytes`. The separately injectable
+byte parser verifies ordered OIDs, blob type, decimal size, exact framing and
+complete output consumption. There is deliberately no blob cache, so no object
+can be reused across `_GIT_ENV` namespaces. The two bulk call sites preserve
+selected-path sorted manifests and every actual-file byte/mode comparison.
+
+No existing require message or assertion was removed. The `NATIVE_RUNS` through
+`verify_native` region, commit-type checks, ancestry, merge-tree isolation,
+status/untracked/symlink/module checks, schema/encoder, six existing suites and
+role case IDs were not edited. Checker self-blob reads remain unchanged.
+
+The fixture source covers binary NUL/CR/LF/trailing LF, empty and large blobs,
+unicode `ls-tree -z` path resolution, duplicates, empty input, malformed/short
+OIDs, missing objects, tree/commit objects, invalid/truncated/oversized/garbage
+responses, process failure, one-process sorted input, and private object
+visibility inside versus outside and across isolated namespaces. It has not run.
+
+Static validation: `ast.parse` and in-memory `compile(..., 'exec')` completed for
+the checker and new fixture. Neither module was imported or executed. This is
+syntax validation only. Tests: **NOTRUN**. Runtime equivalence and completion
+within the registered 180 seconds remain for Root to measure.
+
+The existing schema2 index at B/p04-evidence/index.json was read as data, along
+with the existing builder and role fixture. Its registered/execution/tested
+roles remain deb1bcb/9767b0a/5f6bc11 and original_credit remains 13/88.
+The existing index and r20 collection are untouched. No new generation is
+needed if Root confirms the recomputed payload is identical. If generation is
+needed, use a new explicit destination, never overwrite existing evidence.
+Original P04-01 remains incomplete; criteria and nativeWindows pending status
+are unchanged. No original credit or acceptance is claimed.
+
+## Root execution order — all NOTRUN
+
+Use the clean new auto-submitted checkout, whose SHA is assigned after this
+source submission. Do not use the registered base SHA as the new submission.
+
+```sh
+export B=/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build
+export E=docs/plans/original-completion-2026-10-02/execution/p04-01
+export BUILD_OUTPUT_DIR="$B"
+export PYTHONDONTWRITEBYTECODE=1
+python3 "$E/bulk_reader_equivalence.py"
+python3 "$E/checker_negative_fixtures.py"
+python3 "$E/checker_applicability_fixtures.py" --native-bundle "$B/audit-support/native-first-current"
+python3 "$E/checker_native_fixtures.py" "$B/audit-support/native-first-current"
+python3 "$E/checker_series_fixtures.py" --build "$B"
+python3 "$E/checker_encoder_fixtures.py"
+python3 "$E/checker_join_fixtures.py" --build "$B"
+python3 "$E/checker_role_fixtures.py" --build "$B" --evidence "$B/p04-evidence"
+```
+
+Next run the registered validation on the **new auto-submitted SHA**, retaining
+its existing 180-second timeout and actual timed receipt. The supplied formal
+API call is exactly:
+
+```python
+runner.validate("P04-01")
+```
+
+The external Runner launcher/configuration is not present in the supplied task
+context; use Root's already registered invocation, without substituting an
+invented CLI, changing timeout, or treating direct checker timing as registered
+validation. Record actual SHA, elapsed time and exit status from that invocation.
+
+Then run direct real-candidate controls from actual clean submitted, merged and
+final checkouts, preserving the formal review/integration state machine:
+
+```sh
+python3 tools/check_p04_order_evidence.py --verify-only
+python3 "$P04_MERGED_CHECKOUT/tools/check_p04_order_evidence.py" --verify-only
+python3 "$P04_FINAL_CHECKOUT/tools/check_p04_order_evidence.py" --verify-only
+```
+
+After required formal validation/review and exact final-source binding, run the
+full178 product regression once, using a fresh output destination:
+
+```sh
+python3 "$P04_FINAL_CHECKOUT/tools/run_all_tests.py" \
+  --project-root "$P04_FINAL_CHECKOUT" --output "$B/p04-final-product-full-r21"
+```
+
+Do not regenerate raw collections, overwrite index/r20 evidence, alter existing
+case semantics, or run an additional native/full suite to compensate for a
+timeout. Any unrelated improvement is deferred. Pending Root execution is not
+a worker specification gap and does not change this submission's scope.
@@ -0,0 +1,73 @@
+{
+  "scope": "AST/static source checks and in-memory compile ONLY; no module imports or execution of task code",
+  "python": [
+    {
+      "path": "tools/check_p04_order_evidence.py",
+      "bytes": 78399,
+      "sha256": "a61c5b496e656f60c66898e42500bc9a2d45f947690ce8f5f19a03984ebbc850",
+      "AST": "parsed",
+      "in_memory_compile": "compiled; not executed"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/p04_native_series.py",
+      "bytes": 72591,
+      "sha256": "667c95e10c451239292b08589706bfef978de730b321151ae7845dd10a06c411",
+      "AST": "parsed",
+      "in_memory_compile": "compiled; not executed"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_join_fixtures.py",
+      "bytes": 7888,
+      "sha256": "f89ee6b835a8b0dc47f804686f7e338e7178c24a5a30a8a25bcd8bf59dfbea0c",
+      "AST": "parsed",
+      "in_memory_compile": "compiled; not executed"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_series_fixtures.py",
+      "bytes": 6779,
+      "sha256": "f91b2d7003fd5c8cd196f849ad392d37479317e7d109eb584ccde5e5073e5bee",
+      "AST": "parsed",
+      "in_memory_compile": "compiled; not executed"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/collect_p04_native.py",
+      "bytes": 2996,
+      "sha256": "d727230de0af94dfc7e68bec40e84ecaa86a5b98d5e5bc16c2a35fe9c67fa12d",
+      "AST": "parsed",
+      "in_memory_compile": "compiled; not executed"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/build_p04_index.py",
+      "bytes": 9246,
+      "sha256": "47ae05b7bec617063e5d4fca2d8687f25e2eee0f809b5676ec91cf21c3223773",
+      "AST": "parsed",
+      "in_memory_compile": "compiled; not executed"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/s4/run_s4_native.py",
+      "bytes": 18623,
+      "sha256": "03a0aaab7e824d1b516ee4c6b456913439515c03daa687b5822cdfefb4d54c46",
+      "AST": "parsed",
+      "in_memory_compile": "compiled; not executed"
+    }
+  ],
+  "gd_validation": "static text/declaration review only; engine parse NOT RUN",
+  "gd_sha256": "ceb592d853fd50063f20496c7b6df05257528dbe1c0d0d80bc6a8ccb1f9dd6d7",
+  "C_frozen": {
+    "exact_equal_to_immutable_full_stage": true,
+    "bytes": 20918,
+    "sha256": "5d778b3cfab7c139ca03812489508ce9aae90c1d17f8c2249c340f30d1496b3b",
+    "body_with_one_final_LF_sha256": "33ae2af6afb98b48919ed679ab8519b7da7ddfda68c00f71c557d5cc9aad4a6c"
+  },
+  "required_registry_unchanged": true,
+  "required_conditions": 15,
+  "EV": "additional existing obligation, unchanged",
+  "domains": 7,
+  "product_input_files": 1338,
+  "parse_gd_files": 316,
+  "native_runs": 0,
+  "fixture_runs": 0,
+  "tests": "NOT RUN",
+  "S4_raw": "pending Root execution",
+  "formal_acceptance": false
+}
@@ -0,0 +1,82 @@
+# Repair22 — source-ready submission; NOT RUN
+
+This batch changes only `tools/check_p04_order_evidence.py` and this P04-01
+documentation subtree. No Git command, test/fixture, engine, Runner operation,
+agent, manual commit or integration was performed. The normal autosubmit owns
+the submitted revision; the contract base SHA is not a new evidence version.
+
+S3 B1 no longer supplies `power_stop`. Its full diagnostic checks remain under
+`dependency_closure_diagnostic`, including the actual dependency reason,
+closure/release, departure history and recovery sale. It approves no priority.
+Strict power-vs-closure order remains D05 pending/unknown. The existing approvals
+cover dependency hold and the18:00 shift interval only; A01 is not reopened.
+
+S4 is a new minimal single-case QA probe using the existing ActorHardening,
+physical-kitchen and guarded Writer/Reader pattern. It cuts the actual sole
+cafeteria edge at959, waits for normal evaluation/projection at960, retains the
+held state at961, reconnects that same edge, and waits normally through the
+source-derived hold until970. Source constants were re-read as10/10. No forced
+evaluation, hold bypass, direct power/progress/patience/capacity writes or
+product edits are introduced. Kitchen Facility.OPEN / network ACTIVE, positive
+mana, operating dependency and open operator distinguish it from B1.
+
+Three formal Writer points and separate-process Reader restores retain every
+typed Runtime field and all four SaveService members. Reconnect resend at970
+must leave the full Runtime unchanged; normal971 and Reader replay add no
+extra sale/completion. Full intermediate phase raw is preserved. All graph
+nodes, cut/restored edge sets, revisions, allocation and derived dependency
+restoration are checked. Normal post-completion guest redecision/despawn is
+retained, not forced or concealed; no exit accompanies the outage/hold.
+
+R now derives shift PID and sale IDs from the existing full raw joins. S1 joins
+the existing pre-travel reservation/task/staff cell to the boarded task/trip,
+and checks actual mana0 and elevator loss of power. The existing join fixtures
+are retained and extended with the requested semantic negatives and consistent
+dynamic-ID positive controls. Existing C25 and all other fixture sources remain
+in place. No fixture result is claimed: S4 positives await actual Root raw.
+
+ORDER_AUDIT.md and order-audit.json are one current seven-domain table with
+normative rules, source, C/S1/S2a/S2b/S3 evidence, pending S4, approved authority
+and pending D05. REPAIR17–21 remain untouched historical documents and outputs;
+their current-status claims are superseded by repair22. The current protocol,
+collection plan and this status agree: no final acceptance.
+
+Static validation is recorded in REPAIR22_STATIC_VALIDATION.json:
+
+- Seven Python files parsed with AST and compiled in memory; none imported or
+  executed. GDScript received static text/source review only; engine parse NOT RUN.
+- The entire frozen C region is byte-identical to the preserved full-stage
+  checker. Its one-final-LF body hash is
+  `33ae2af6afb98b48919ed679ab8519b7da7ddfda68c00f71c557d5cc9aad4a6c`, matching
+  the supplied repair21 C_FULL_BLOCK_EXACT receipt. Existing C checks are intact.
+- The complete15-condition registry matches that immutable source; EV, seven
+  domains and three safety outcomes are unchanged. Product1338 inputs and the
+ 316-file `.gd` parse roster were counted from the actual relocation manifest.
+- The five supplied public power bodies were compared to their actual relocated
+  source. Full bodies, hashes, timing and restore analysis are retained in
+  REPAIR22_SOURCE_FACTS.json.
+
+The exact finite Root plan is `s4/S4_ROOT_RUN.md`: one fresh own-B four-phase
+collection, with explicit arguments and full input/QA/source footprints. All
+old C/S1/S2a/S2b/S3 raw and all R17 sources remain accessible and are not rerun.
+S4 remains **missing/pending Root execution**. Future native/index/cross-gate
+work does not block this source submission. The updated collector/index
+references use a fresh r22 destination; no r17/r20 evidence is overwritten.
+
+Preserve the21615-check proof. Static full-map comparison found exactly the
+unchanged product1338 plus the old checker in its1339 map. The new checker hash
+differs; never claim1339 byte identity. The178 product suites do not invoke the
+checker and `.py` is excluded from the316 parse roster, so reuse requires the
+explicit QA-only source/config/input/environment applicability argument in
+EVIDENCE_COLLECTION.md. New-checker validation and S4 are separate, pending.
+
+Root must rebind support53cb through its normal registered task once the new
+source is known, without metadata bypass. Only if an exact final1339 full proof
+is required, perform one run after all fixes, S4 raw, local checks, eight suites
+and rebind are bundled; do not splice versions or perform a blanket full now.
+
+No required source context is missing for this preparation. Remaining D05
+choices are explicitly pending and not silently implemented. Formal validation,
+independent review, exact final-source applicability and normal integration
+remain pending. CurrentAlphaScope,30 packages/88 deliveries, original13/88 and
+P04 main9b are unchanged. P04 receives no credit; nothing is integrated.
@@ -0,0 +1,34 @@
+# Repair 23 — submitted, NOT RUN
+
+S4 source preparation only. The wrapper now defaults to fresh import without
+accessing cache receipts or cache directories. It checks that private `.godot`
+is absent immediately before import and requires the complete 316-script parse
+roster. The complete 1338-file source check and sole QA override remain intact.
+Optional cache mode retains the original registered-path, passed-run, source
+identity, engine identity and original-cache preservation guards.
+
+Engine identity is independently pinned to
+`c7cccbf8fb143e34e02fd6521e09be2c2b974f0d5db080b19071c9c570718ccf`.
+Read-only SHA256 inspection found identical bytes in the installed executable
+and the preserved r22 staged executable; neither was launched.
+
+Current wrapper SHA256:
+`6d5f4e05e87607413bfb5498dc9c9e17c2bfd96bf751c9e645050ca6f8e69d5c`.
+The current runbook binds this SHA. The series verifier already binds the wrapper
+to current checkout bytes dynamically, so no series metadata change is needed.
+Historical REPAIR22_STATIC_VALIDATION.json is preserved as historical evidence,
+not rewritten to claim validation of the new wrapper.
+
+Root must use fresh staging `audit-support/p04-s4-source-r23` and fresh plan
+`p04-s4-plan-r23.json`. Output remains `p04-s4-native-r22`. Old staging and plan
+are preserved. All R22 fixes and other suite wrappers/checks are retained.
+
+Checker SHA256 remains
+`a61c5b496e656f60c66898e42500bc9a2d45f947690ce8f5f19a03984ebbc850`;
+S4 probe SHA256 remains
+`ceb592d853fd50063f20496c7b6df05257528dbe1c0d0d80bc6a8ccb1f9dd6d7`.
+No game input file was edited. Review was limited to source reading and hashes.
+No Git, tests, fixtures, check-only execution, engine, Runner, agents or manual
+commit were run. Native S4 evidence, root native/data/index work, independent
+review and formal acceptance remain pending. The expected validate MANIFEST
+failure is unchanged. Original P04-01 completion is not claimed.
@@ -0,0 +1,77 @@
+# Repair24 — source-ready submission
+
+Bounded continuation of P04-01 request-repair24; tests NOT RUN.
+Existing wrapper edits and the untracked identity fixture were read first and
+preserved/corrected. Only this execution subtree was written. No Git, engine,
+Runner, agent, commit or integration operation was performed.
+
+Changed source/runbook SHA256 (exact bytes):
+
+| File | SHA256 |
+| --- | --- |
+| s4/run_s4_native.py | dda495d33566eae14c8a707e77f8ec9dc6c7bd043076a091e90dd53f6a7490db |
+| p04_native_series.py | 348197759c169c2094db3b1114ca3abe5525b8d4bc9aca611d4579871a130b40 |
+| s4/engine_identity_negative_fixtures.py | f9148ef79cb62ec6631e7e3f23e1d3b062434f7152977aab3b9d18d82672255e |
+| s4/S4_ROOT_RUN.md | c1a00e3dad8d91d28df1a7f868f6e4e905f1df721baac964865e341c84356135 |
+
+This new status document records the hashes above; its own hash must be taken
+from the submitted checkout, outside its own contents.
+
+Wrapper pins changed: the own-B bare Godot copy is replaced with exactly
+`/Applications/Godot.app/Contents/MacOS/Godot`, rejecting symlinks and any
+different resolved path. Its constant SHA remains
+`c7cccbf8fb143e34e02fd6521e09be2c2b974f0d5db080b19071c9c570718ccf`.
+Engine identity no longer depends on an old cache runner-input. Fresh NO-CACHE
+is the default at plan and native collection. Optional explicit cache mode
+rejects failed receipts before reading their inputs or cache contents.
+No default cache or cache PASS is required. No engine is copied, re-signed or
+modified, and no codesign/xattr/security operation is added.
+
+Before-launch, during-collection and explicit after-cleanup re-pins retain the
+full runtime descriptor (path/resolved path, bytes, SHA, device, inode, mode,
+mtime and ctime). Runner-input and execution retain equal before/during/after
+identity records and execution retains labeled observations. fixed_guard still
+re-pins the engine. The verifier permits only this exact installed engine
+outside B, reads/hashes it exactly and checks the recorded identities.
+Fixed inputs and QA remain own-B only; actual command[0] must equal the pin.
+
+Defaults and Root staging are now:
+`p04-s4-native-r24`, `p04-s4-plan-r24.json`,
+`audit-support/p04-s4-source-r24`. Only RUNS S4 changes to r24.
+C/S1-S3 bindings, other series and the frozen C block (20916) are unchanged.
+Source1338, parse316, sole QA override, default-player protection, owned
+four-distinct-PID capture, live-engine refusal, disk admission, fresh output,
+cleanup-before-fixed-guard, formal Writer/Reader, NO_POWER, typed declarations,
+forbidden mutations/bypasses and mana constants guards remain.
+
+Untouched checker: SHA256
+`a61c5b496e656f60c66898e42500bc9a2d45f947690ce8f5f19a03984ebbc850`,
+78399 B. Untouched probe: SHA256
+`ceb592d853fd50063f20496c7b6df05257528dbe1c0d0d80bc6a8ccb1f9dd6d7`.
+All 1338 game files are unchanged; no game source was written. No new claim of
+executed 1338-file verification is made.
+
+The formal reviewer's five findings are carried forward unchanged, with no
+closure claimed. Their individual review text was not supplied in this dispatch
+or found in the local execution records searched; it is not reconstructed here.
+Main 9b remains frozen at original 13/88. Support 53cb remains review pending.
+D05 remains pending. No acceptance denominator, specification, main integration
+or original completion state changes.
+
+r22 is an immutable failed proof and remains ineligible. Diagnostics:
+`audit-support/p04-root-d393-s4-r01/ENGINE_STAGING_DIAGNOSTICS.json`.
+Its pre-banner staged-copy failure is an environment/staging fault; no product
+logic or probe/checker repair is claimed. Root uses the installed executable
+directly and preserves r22. Do not rerun S1-S3, C or full178.
+
+Validation: static AST parsing and in-memory compile completed for the wrapper,
+series verifier and identity fixture; no module was imported or executed.
+Read-only SHA/byte inspection completed for the four listed files, checker and
+probe. These are source checks only. Tests NOT RUN: identity fixtures, all other
+fixtures/suites, check-only plan generation, native S4, full178, registered
+validation and independent review. No unexecuted result is reported as passed.
+
+Registered validation stays exit 2 until Root generates the current
+MANIFEST.json collection; the gate is not changed. This is the carried-forward
+expected gate state, not a newly executed validation result. Root execution,
+current exact-version evidence and formal independent review remain pending.
@@ -0,0 +1,71 @@
+{
+  "task_id": "P04-01",
+  "scope": "Worker static controls only; no engine/registered validation/acceptance",
+  "formal_acceptance": false,
+  "original_credit": 0,
+  "results": [
+    {
+      "check": "checker_approval_fixtures",
+      "status": "pass",
+      "positive": 6,
+      "negative": 24,
+      "scope": "path/hash/status + literal human answers"
+    },
+    {
+      "check": "checker_negative_fixtures",
+      "status": "pass"
+    },
+    {
+      "check": "checker_applicability_fixtures",
+      "status": "pass",
+      "M": "c0ea009b28a7649aca6a433a1a24dc0be5e7ab81",
+      "changed_function_units": 58
+    },
+    {
+      "check": "checker_native_fixtures",
+      "status": "pass",
+      "scope": "mutations of historical supplied raw; not a native engine run"
+    },
+    {
+      "check": "checker_series_fixtures",
+      "status": "pass",
+      "scope": "historical/synthetic controls"
+    },
+    {
+      "check": "checker_encoder_fixtures",
+      "status": "pass"
+    },
+    {
+      "check": "checker_join_fixtures",
+      "status": "pass",
+      "scope": "historical/synthetic controls"
+    },
+    {
+      "check": "bulk_reader_equivalence",
+      "status": "not_run",
+      "reason": "Contains git init/hash-object -w and isolated-object writes; worker Git writes prohibited"
+    },
+    {
+      "check": "checker_role_fixtures",
+      "status": "not_run",
+      "reason": "Contains clone/checkout/add/commit/merge/reset; worker Git writes prohibited; fresh Q index is also not available"
+    },
+    {
+      "check": "Python AST / top-level execution JSON",
+      "status": "pass"
+    },
+    {
+      "check": "git diff --check",
+      "status": "pass"
+    }
+  ],
+  "exclusions": [
+    "No fresh-Q positive fixture claimed",
+    "No fake-normal-C qualification claimed",
+    "No S5 native execution",
+    "No full184/329",
+    "No p04-acceptance on current S"
+  ],
+  "note": "Recorded fixture outcomes are not exact-version native proofs. Final comment/document edits do not alter executed fixture semantics. Final source is unqualified for native admission; see REPAIR30_STATUS.md."
+}
+
@@ -0,0 +1,67 @@
+# Repair 30 — BLOCKED / partial implementation
+
+This revision is **not ready for Root native admission**. Formal status remains
+**16/88, P04=0**. Outstanding items include unfinished implementation, not merely
+the fresh evidence Root is expected to produce after submission.
+
+Implemented within allowed_paths:
+
+- Four actual human approvals, exact answer/policy text, both source paths and
+  SHA256 bindings; candidate documents marked superseded.
+- Per-ID path/hash authority binding for six D05 IDs; required authority refs
+  corrected without changing the 15-condition + EV roster or thresholds.
+- Frozen M is c0ea009b28a7649aca6a433a1a24dc0be5e7ab81. Counts/membership derive
+  from Git objects: 1368 product files excluding checker, 3644 metadata paths.
+  Ordering functions retain registered byte equality; applicability has 58
+  changed function units. Full details are in REPAIR30_SOURCE_FACTS.json.
+- Q must equal the recomputed merge-tree object. A commit cannot impersonate Q.
+  C must have frozen M as first parent, legal S as second parent and the same
+  entire tree as Q. Selected native sources explicitly include the checker;
+  product equality continues to exclude it.
+- Seven-domain audit refreshed with actual M hashes/function lines. All
+  condition-specific nativeWindows obligations remain pending.
+
+Implementation/context gaps blocking readiness:
+
+1. S5's four executable drivers and raw semantic adapters are **not written**.
+   s5/PENDING.md records concrete source constraints. Additional approved
+   destruction/day/pause-reason/exit measurements are not enforced from S5 raw
+   bytes yet. REQUIRED retains the existing safety metrics.
+2. p04_native_series.py, collect_p04_native.py, S1–S4 wrappers and parts of the
+   schema2 builder still bind historical run names/manifests/raw pins. Connect
+   fresh Q material without replacing historical records or inventing future
+   hashes. The builder now reads tested revision from native provenance and
+   includes the checker, so the old bundle cannot satisfy the new role check.
+3. Full184/329 runner-input has no source_before or QA_overrides, unlike native
+   QA inputs. It needs its own exact source/settings/markers/policy/engine/input
+   and ended-receipt join. The native input loop is not a full-proof verifier.
+4. Parent/tree equality alone cannot establish normal prepare-integration
+   provenance: a synthetic commit can have identical parents/tree. The supplied
+   plan does not define the concrete normal-candidate qualification receipt,
+   path and hash contract. Independent qualification remains pending; no
+   invented Runner API or authority has been added.
+5. Bulk and role fixtures perform Git writes, including temporary objects,
+   commits and merges. They were not run under the worker Git-write prohibition.
+   Updated role negatives are unexecuted; genuine fresh-Q positive and
+   fake-normal-C rejection remain unqualified.
+
+Static results are in REPAIR30_STATIC_CHECKS.json. Historical/synthetic fixture
+success is not new game evidence. No engine, formal registered gate, Runner
+operation, Git write or other agent was invoked. Product/test-tree/Clock/values
+remain unchanged.
+
+Required Root order after remaining implementation is repaired:
+
+1. All eight static controls plus role/applicability/approval negatives.
+2. Genuine Q from final S and frozen M; fresh real native S1–S5 once.
+3. Inspect free disk and verified CoW, then full184/329 once on the same final Q
+   including final checker; bind test_required_kitchen separately.
+4. Truthful index from exact raw material.
+5. Registered p04-acceptance on S with --verify-only.
+6. Independent whole-unit review.
+7. Normal prepare-integration/final on independently qualified C, equal to Q for
+   source/settings/markers/policy/engine/inputs.
+
+Keep live Root records under .runtime while M is frozen. Old S1–S4/r22 and f5
+full178 remain historical. No known-fail formal gate is a progress check.
+No sources/evidence are removed for the obsolete 500000-byte cap.
@@ -0,0 +1,94 @@
+{
+  "task_id": "P04-01",
+  "scope": "Worker static controls only; no native run or formal gate",
+  "formal_acceptance": false,
+  "original_credit": 0,
+  "results": [
+    {
+      "check": "checker_approval_fixtures",
+      "status": "pass",
+      "exit_code": 0,
+      "scope": "six positive and 24 negative authority controls"
+    },
+    {
+      "check": "checker_negative_fixtures",
+      "status": "pass",
+      "exit_code": 0,
+      "scope": "historical/synthetic control only; no fresh Q proof"
+    },
+    {
+      "check": "checker_applicability_fixtures",
+      "status": "pass",
+      "exit_code": 0,
+      "scope": "historical/synthetic control only; no fresh Q proof"
+    },
+    {
+      "check": "checker_native_fixtures",
+      "status": "pass",
+      "exit_code": 0,
+      "scope": "historical/synthetic control only; no fresh Q proof"
+    },
+    {
+      "check": "checker_series_fixtures",
+      "status": "pass",
+      "exit_code": 0,
+      "scope": "historical/synthetic control only; no fresh Q proof"
+    },
+    {
+      "check": "checker_encoder_fixtures",
+      "status": "pass",
+      "exit_code": 0,
+      "scope": "historical/synthetic control only; no fresh Q proof"
+    },
+    {
+      "check": "checker_join_fixtures",
+      "status": "pass",
+      "exit_code": 0,
+      "scope": "historical/synthetic control only; no fresh Q proof"
+    },
+    {
+      "check": "Python AST / execution JSON",
+      "status": "pass",
+      "python_files": 22,
+      "json_files": 17
+    },
+    {
+      "check": "git diff --check",
+      "status": "pass"
+    },
+    {
+      "check": "normal C fail-closed in-memory controls",
+      "status": "pass",
+      "cases": [
+        "missing authority contract rejected",
+        "caller-forged authority contract rejected"
+      ],
+      "scope": "not a Git role fixture"
+    },
+    {
+      "check": "bulk_reader_equivalence",
+      "status": "blocked",
+      "exit_code": 1,
+      "reason": "/tmp directory creation raised PermissionError (Operation not permitted), before any Git invocation",
+      "execution": "fixture body unexecuted; Root-run"
+    },
+    {
+      "check": "checker_role_fixtures",
+      "status": "unexecuted",
+      "reason": "isolated temporary directory unavailable; fresh-Q evidence also unavailable; Root-run"
+    },
+    {
+      "check": "checker_candidate_fixtures",
+      "status": "unexecuted",
+      "reason": "isolated temporary directory unavailable; Root-run"
+    }
+  ],
+  "exclusions": [
+    "S5 drivers and adapters not implemented",
+    "fresh-Q pipeline not implemented",
+    "full184/329 verifier not implemented",
+    "normal-C authoritative receipt path/hash/provenance contract not supplied",
+    "no genuine-Q or qualified-C positive claimed"
+  ],
+  "note": "Existing REPAIR30_SOURCE_FACTS and REPAIR30_STATIC_CHECKS were reused without modification. Counts here describe static file parsing, not acceptance or runtime source membership."
+}
@@ -0,0 +1,59 @@
+# Repair 31 — BLOCKED / incomplete implementation
+
+Formal status remains **16/88, P04 credit 0**. **Do not admit the once-only
+native/full batch.** This revision does not finish BF35.
+
+D05 is **six of six actually approved**. There is no policy question for the
+human. Adoption into enforced raw evidence and exact-Q verification are pending.
+A01 remains approved. The per-ID path/SHA256 bindings in the checker and the
+superseded candidate documents are preserved. The authority fixtures exercise
+positive, missing, wrong-hash, pending-status and wrong-path cases for every ID.
+
+Repair30's SOURCE_FACTS and STATIC_CHECKS remain historical, unchanged inputs.
+This repair adds a fail-closed normal-C qualification boundary and records the
+receipt content requirements in `NORMAL_C_RECEIPT_FIELDS`. Even a commit with
+the correct two parents and Q tree is insufficient. The authoritative Root/Runner
+receipt path, digest and provenance verification contract have not been supplied;
+`NORMAL_C_RECEIPT_CONTRACT` remains unset. No Runner API or authority is inferred.
+An index-provided receipt cannot resolve this gap. This blocks every C, including
+a legitimate C, until that concrete contract and its verifier are supplied.
+
+The schema2 builder's undefined `tested` reference is fixed by checking the CLI
+reference against the constructed payload's tested version. This does not make
+its historical pipeline usable for fresh Q.
+
+Bulk and role fixtures now allocate under `/tmp`, outside the source repository,
+with inherited Git routing removed. Role fixtures reject unqualified no-ff merges
+and synthetic commits with identical parents/tree. The additional candidate
+fixture constructs such a commit only in a temporary bare clone. These Git
+fixtures are **Root-run / unexecuted**: the worker's bulk attempt failed on
+temporary directory creation with `PermissionError: Operation not permitted`,
+before any Git invocation. They were not redirected into the worktree.
+
+Remaining implementation, separate from the genuine authority context gap:
+
+1. Four executable S5 drivers and their raw semantic adapters are still missing.
+   `s5/PENDING.md` remains accurate. All approved destruction/day/reason/exit
+   policies must be enforced alongside the existing safety conditions.
+2. Fresh-Q run identity/provenance plumbing in native series, collector, S1–S4
+   wrappers and schema2 builder is unfinished. Historical names, pins and source
+   manifests have not been relabeled.
+3. The separate full184/329 verifier and its exact source/settings/markers/policy/
+   engine/input/ended-receipt joins, including separate test_required_kitchen
+   binding, are unfinished. The native input loop is not a substitute.
+4. Normal-C positive qualification needs the actual authoritative receipt contract
+   described above; matching Git structure alone is deliberately rejected.
+5. Genuine-Q positive and fake-Q/full-role fixtures remain unexecuted. The new
+   synthetic-C Git fixture also remains unexecuted; static parsing is not proof
+   that it ran.
+
+See REPAIR31_STATIC_CHECKS.json for actual worker results. No engine, formal gate,
+Runner operation, repository Git write, integration or other agent was invoked.
+Product code, Clock, values, tests, spec, denominator, thresholds and permissions
+are unchanged. No material was removed for the obsolete byte cap.
+
+After the missing implementation and context are resolved, Root retains the
+recorded order: static controls; genuine Q and fresh S1–S5 once; disk/verified CoW
+then full184/329 once on final Q with final checker; truthful index; verify-only
+on S; independent whole-unit review; prepare-integration/final on qualified C.
+Live records stay under `.runtime`. No known-failing gate is a progress check.
@@ -0,0 +1,63 @@
+{
+  "task_id": "P04-01",
+  "scope": "new concrete32 static preparation only",
+  "results": [
+    {
+      "path": "normal_c_join.py",
+      "check": "AST and in-memory compile",
+      "exit_code": 0,
+      "status": "pass",
+      "sha256": "3156e1df928ae15ab311b61eb27e21ef27cf123cb7097646a81a3f836c30ba33"
+    },
+    {
+      "path": "normal_c_join_fixtures.py",
+      "check": "AST and in-memory compile",
+      "exit_code": 0,
+      "status": "pass",
+      "sha256": "fba1634aafbb5c6030bec073b75b609a20d10d5ca6a6f0eddc270a12023830a3"
+    },
+    {
+      "path": "scratch_fixture_adapter.py",
+      "check": "AST and in-memory compile",
+      "exit_code": 0,
+      "status": "pass",
+      "sha256": "4994101754c38568007f2d7e1e0c8a2221d26216f464c496a7258ff89c601994"
+    },
+    {
+      "path": "s5/run_s5_native.py",
+      "check": "AST and in-memory compile",
+      "exit_code": 0,
+      "status": "pass",
+      "sha256": "928409e17984330498b2637e33957740bcdd91d427df5ee60d21a86671646fa2"
+    },
+    {
+      "path": "s5/s5_power_adapter.py",
+      "check": "AST and in-memory compile",
+      "exit_code": 0,
+      "status": "pass",
+      "sha256": "6b77e1ac7f1bdfd031321f106d8a6fcf465a3c1dd30e697d2b1e7c7285139f15"
+    },
+    {
+      "path": "s5/p04_s5_power_probe.gd",
+      "check": "text-only forbidden operation and declaration controls",
+      "exit_code": 0,
+      "status": "pass",
+      "godot_parse": "unexecuted",
+      "sha256": "248da3f1dbca644e2fd62fcf283a4e499e0631ff23f8dc44dc77b872ef1be5ba"
+    },
+    {
+      "check": "normal-gate reference supplied index SHA256",
+      "status": "pass",
+      "exit_code": 0,
+      "sha256": "4c6067bbd57034764873a468ff161a6882d232503043d5640fc83dea0b455856"
+    }
+  ],
+  "fixtures": "unexecuted",
+  "formal_validation": "unexecuted",
+  "engines_launched": 0,
+  "git_commands": 0,
+  "runner_operations": 0,
+  "whole_goal_accepted": false,
+  "original_credit": 0,
+  "existing_partial31_files_edited": 0
+}
@@ -0,0 +1,44 @@
+# Repair 32 — partial implementation submitted; no acceptance claim
+
+Only new concrete32 files were added. Existing partial31 files, including the
+checker and s5/PENDING.md, were not edited. No condition credit is claimed:
+formal 16/88, original 30/88, P04 credit 0, all 15 conditions plus EV, frozen
+Mc0 and all six approved D05 items remain unchanged.
+
+Implemented, unexecuted:
+- S5 power driver pair and S4-derived wrapper: public bath pure depletion and
+  cafeteria/kitchen reason-priority depletion; public spend/recovery commands;
+  observed completion; same-key replay; full typed/JSON phase points; formal
+  save/independent Reader load/replay. No disconnect or direct resource mutation.
+- Hashed raw semantic adapter for existing power_stop, dependency_stop and
+  recovery_completion measurement keys. It does not qualify native provenance.
+- Read-only normal_c_join over actual Runner task/candidate/main_base, approval,
+  validation/review and integration/final records. No future C hash is frozen.
+  Root must retain an actual approved Runner snapshot before integrate deletes
+  approval; later final records come from the current Runner database.
+- Root-run synthetic normal join controls and explicit-scratch adapter for
+  preserved Git fixtures. No fixtures were executed.
+- S5_ROOT_RUN.md and NORMAL_C_BOUNDARY32.md explain boundaries and limitations.
+
+Actual verification: Python AST/compile for five new Python files and textual
+probe controls passed. No pycache, engine, Godot parse, Git command, Runner
+operation, fixture, formal validation, independent review or integration ran.
+The shell rejected a here-document temporary-file allocation; subsequent commands
+used python -c. An attempted documentation addition at the repository root was
+rejected and no file was created there; the document was added within allowed_paths.
+
+Remaining implementation limitations:
+1. The old checker still deliberately rejects normal C: preserving partial31
+   means this standalone Runner-record join is not connected to its role output.
+   It does not assert Git structure/Q equivalence and cannot bypass that gate.
+2. The S5 wrapper retains historical S4 template identity/count bindings. Fresh-Q
+   plumbing is outside this step and remains pending; this is not batch admission.
+3. S5 destruction/midnight/exit, fresh-Q/full184/329, truthful collection/index,
+   exact-version applicability, independent review and ordinary gates remain
+   pending. None was attempted together or counted as a new unit.
+4. Scratch adapters preserve the old fixtures' assertions; positive normal-C
+   structure fixtures under the eventual integrated boundary are still pending.
+
+Runner/Root must run the permitted static fixtures in external scratch, review
+the added source, and resolve boundary integration before the established
+once-only genuine-Q/native/full sequence. No evidence or completion is invented.
@@ -0,0 +1,112 @@
+{
+  "task_id": "P04-01",
+  "status": "blocked",
+  "checks": [
+    {
+      "kind": "py_compile",
+      "path": "tools/check_p04_order_evidence.py",
+      "output": "compiled without syntax errors",
+      "exit_code": 0
+    },
+    {
+      "kind": "py_compile",
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_candidate_fixtures.py",
+      "output": "compiled without syntax errors",
+      "exit_code": 0
+    },
+    {
+      "kind": "py_compile",
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_role_fixtures.py",
+      "output": "compiled without syntax errors",
+      "exit_code": 0
+    },
+    {
+      "kind": "py_compile",
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/normal_c_join.py",
+      "output": "compiled without syntax errors",
+      "exit_code": 0
+    },
+    {
+      "kind": "py_compile",
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/normal_c_join_fixtures.py",
+      "output": "compiled without syntax errors",
+      "exit_code": 0
+    },
+    {
+      "kind": "py_compile",
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/s5/run_s5_native.py",
+      "output": "compiled without syntax errors",
+      "exit_code": 0
+    },
+    {
+      "kind": "pure_static_ast",
+      "observation": "normal_c_join.verify parameters",
+      "output": [
+        "database",
+        "approved_database",
+        "candidate",
+        "submission",
+        "hashes"
+      ]
+    },
+    {
+      "kind": "pure_static_source",
+      "observation": "checker contains runner_inputs",
+      "output": true
+    }
+  ],
+  "fixtures": [
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_applicability_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_approval_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_candidate_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_encoder_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_join_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_native_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_negative_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_role_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_series_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/normal_c_join_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/s4/engine_identity_negative_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/s4/receipt_lifecycle_fixtures.py",
+      "execution": "unexecuted; Root only"
+    }
+  ],
+  "engine_runs": 0,
+  "fixture_runs": 0,
+  "condition_credit": 0,
+  "original_completion": false
+}
@@ -0,0 +1,51 @@
+# REPAIR33 — blocked, no implementation or acceptance claim
+
+P04-01 remains incomplete. Only this status and REPAIR33_STATIC_CHECKS.json
+were added. Checker, fixtures, wrapper and S5 run documents remain unchanged.
+No Git writes, Runner operations, fixture execution or engine runs occurred.
+
+The instruction to return blocked for missing specifications applies to these
+unresolved input contracts:
+
+- The Root-supplied Q descriptor has no supplied schema or existing definition
+  in the inspected checker, S5 wrapper or local execution documentation.
+  `verify_roles` requires `product_binding` to contain exactly `tested_product`
+  and `runner_inputs`. Each runner input references an existing native receipt,
+  wrapper and materials; it does not define M/S fields or the wrapper's fresh-Q
+  configuration input. Specify the descriptor fields/types and how M, S, Q,
+  staged product, settings, markers, policy and material bindings are obtained
+  without inventing another input contract. Future hashes are not requested.
+- The requested combined control includes matching Runner/Root records, but
+  `normal_c_join.verify(database, approved_database, candidate, submission,
+  hashes)` accepts only Runner databases and caller-supplied commit strings.
+  Its CLI has no Root exact-candidate record input or verification. Specify
+  that record's schema and binding, or explicitly confirm that Root performs
+  this join outside this verifier and define the combined control boundary.
+  The verifier was neither weakened nor called from the checker.
+
+These are contract questions, not requests for permission expansion. Runner
+core, Owner CLI and the reference core were not read. No dependency on them
+was introduced. No speculative partial implementation was made.
+
+Actual verification: six existing Python files compiled with py_compile;
+generated bytecode was placed under the allowed execution directory and
+removed. Pure AST inspection confirmed the normal_c_join parameter list;
+a source assertion confirmed runner_inputs is present. Actual outputs are
+recorded in REPAIR33_STATIC_CHECKS.json. All twelve discovered fixture files
+are individually listed there as unexecuted; Root runs them later with its
+own scratch directory. No test or acceptance result is inferred from syntax.
+
+An initial shell here-document command failed before Python started with
+`can't create temp file for here document: operation not permitted`.
+It produced no verification result. The checks were then run using python3
+`-c`, without shell temporary-file redirection.
+
+Explicitly pending: this REPAIR33 implementation; S5 destruction, midnight
+and exit drivers; fresh-Q plumbing for S1–S4 and the collector; all 184
+executable suites and the 329 parse verifier; the truthful index; Root's
+fixed run order, independent review and normal integration/final joins.
+
+Formal 16/88, original 30/88, seven domains plus EV, all six D05 approvals
+and P04 credit 0 remain fixed. M remains
+`c0ea009b28a7649aca6a433a1a24dc0be5e7ab81`. No condition credit, original
+completion, self-reported acceptance or cap change is claimed.
@@ -0,0 +1,95 @@
+{
+  "task_id": "P04-01",
+  "status": "submitted",
+  "checks": [
+    {
+      "kind": "py_compile",
+      "path": "tools/check_p04_order_evidence.py",
+      "output": "tools/check_p04_order_evidence.py: py_compile completed without syntax errors",
+      "exit_code": 0
+    },
+    {
+      "kind": "py_compile",
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_candidate_fixtures.py",
+      "output": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_candidate_fixtures.py: py_compile completed without syntax errors",
+      "exit_code": 0
+    },
+    {
+      "kind": "py_compile",
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_role_fixtures.py",
+      "output": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_role_fixtures.py: py_compile completed without syntax errors",
+      "exit_code": 0
+    },
+    {
+      "kind": "ast",
+      "output": "AST: documentation roster is definition-only; qualifier retains identity require and structural return with provenance false; role candidate initialized, assigned and returned; pure control function has no subprocess/Git calls.",
+      "exit_code": 0
+    },
+    {
+      "kind": "py_compile",
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_candidate_fixtures.py",
+      "output": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_candidate_fixtures.py: py_compile completed without syntax errors (final literal inputs)",
+      "exit_code": 0
+    },
+    {
+      "kind": "ast",
+      "output": "AST: pure candidate controls contain four literal 40-hex inputs.",
+      "exit_code": 0
+    }
+  ],
+  "fixtures": [
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_applicability_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_approval_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_candidate_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_encoder_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_join_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_native_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_negative_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_role_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_series_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/normal_c_join_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/s4/engine_identity_negative_fixtures.py",
+      "execution": "unexecuted; Root only"
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/s4/receipt_lifecycle_fixtures.py",
+      "execution": "unexecuted; Root only"
+    }
+  ],
+  "pure_candidate_controls": "unexecuted; Root may use checker_candidate_fixtures.py --pure-only",
+  "engine_runs": 0,
+  "fixture_runs": 0,
+  "condition_credit": 0,
+  "original_completion": false
+}
@@ -0,0 +1,49 @@
+# REPAIR34 — structural step submitted
+
+P04-01 remains incomplete. This step changes only the checker structural C
+qualification and the two local fixture boundaries, plus this status and the
+static-check record. The checker returns structure_qualified true and
+provenance_verified_by_checker false with C/S/M/C_tree/Q joins. Prospective
+roles return candidate_structure null. The provenance roster is documentation
+only, never consumed. Other parent, tree, checker-blob and binding guards
+were left unchanged.
+
+Candidate fixtures now expect honest structural qualification for a manufactured
+same-tree C. A separate --pure-only path contains three identity negatives and
+one exact positive with literal 40-hex inputs; it requires no Git or engine.
+The two role cases expect structural verification and separately record actual
+downstream --verify-only returncode/stdout/stderr without asserting acceptance.
+Both boundaries assert stderr has no 'qualification context gap'. Other
+negative expectations remain unchanged. These fixtures have not been executed;
+their downstream outcomes are pending Root execution, not inferred here.
+
+Actual verification is limited to py_compile for the three changed Python
+files and AST checks recorded with their real output in
+REPAIR34_STATIC_CHECKS.json. Temporary compilation bytecode was created only
+inside the allowed execution directory and removed. Every discovered fixture,
+including the pure candidate controls, is unexecuted. An initial editing
+command failed with a Python SyntaxError before any file writes; edits were
+then applied in place. That command was not a validation check.
+
+Explicitly pending in this same unit:
+
+- normal_c_join and its fixtures: unchanged and unexecuted here; post-final
+  Root SQL candidate/M/S/approval/validation/review/integration/final joins
+  remain mandatory before original credit.
+- Wrapper/descriptor: separate pre-run configuration with Root-derived M/S/Q
+  and pinned source/material references, not after-run binding.runner_inputs
+  receipts. Root JSON and exact-candidate qualification remain pending.
+- S5 destruction, midnight and exit drivers; S1–S4 and collector fresh Q.
+- All 184 executable suites / 329 parse verification; truthful index.
+- Root run order, independent review, integration/final and provenance joins.
+
+scratch_fixture_adapter.py routing is unchanged. No Git commands or writes,
+engine runs, fixture runs, Runner operations, permissions or cap changes were
+performed. Runner core and Owner CLI were not read; this step does not depend
+on them. External provenance remains a required pending context, not a reason
+to block the authorized structural step.
+
+All seven domains plus EV, all six D05 approvals, formal 16/88, original 30/88
+and P04 credit 0 remain fixed. Frozen M is
+c0ea009b28a7649aca6a433a1a24dc0be5e7ab81. No condition credit, self-reported
+acceptance, original completion or new counted unit is claimed.
@@ -0,0 +1,72 @@
+{
+  "validation": "py_compile and ast only",
+  "results": [
+    {
+      "file": "docs/plans/original-completion-2026-10-02/execution/p04-01/s5/run_s5_native.py",
+      "py_compile": "passed",
+      "ast.parse": "passed",
+      "ast.required_functions": "passed",
+      "ast.no_fixed_counts": "passed"
+    },
+    {
+      "file": "docs/plans/original-completion-2026-10-02/execution/p04-01/s5/s5_wrapper_fixtures.py",
+      "py_compile": "passed",
+      "ast.parse": "passed"
+    }
+  ],
+  "fixtures": [
+    {
+      "name": "partial-triple",
+      "status": "unexecuted"
+    },
+    {
+      "name": "non-hex",
+      "status": "unexecuted"
+    },
+    {
+      "name": "short",
+      "status": "unexecuted"
+    },
+    {
+      "name": "mixed-modes",
+      "status": "unexecuted"
+    },
+    {
+      "name": "historical-native",
+      "status": "unexecuted"
+    },
+    {
+      "name": "no-flags",
+      "status": "unexecuted"
+    },
+    {
+      "name": "fresh-q",
+      "status": "unexecuted"
+    },
+    {
+      "name": "historical-check-only",
+      "status": "unexecuted"
+    },
+    {
+      "name": "git-dirty-file",
+      "status": "unexecuted"
+    },
+    {
+      "name": "git-untracked-file",
+      "status": "unexecuted"
+    },
+    {
+      "name": "git-wrong-head-tree",
+      "status": "unexecuted"
+    },
+    {
+      "name": "git-wrong-submission",
+      "status": "unexecuted"
+    },
+    {
+      "name": "git-wrong-main",
+      "status": "unexecuted"
+    }
+  ],
+  "accepted": false
+}
@@ -0,0 +1,37 @@
+# REPAIR35 — submitted preparation, no acceptance credit
+
+Scope is the S5 wrapper fresh-Q mode, pure mode-selection fixtures and status
+documents only. The wrapper now binds M/S/Q_tree, the clean checkout carrier,
+selection authority, selected source bytes and Q marker contracts. Fixed-input
+rechecks require identical provenance. Cache comparisons remove only checker
+and TEST from both maps and otherwise compare keys and hashes. R17 is explicitly
+check-only/read-only. Fresh-Q counts are derived; historical material is listed
+as historical_not_inputs rather than pinned as fresh-Q input.
+
+R34 structural C, Root normal_c_join, probe, adapter, ownership/PID/cleanup,
+Writer/Reader, formal mirror and inventory remain unchanged. Product, Clock,
+values, tests/, Runner, core and Owner CLI were read-only. No Git commands,
+engines, Runner operations or fixture execution were performed. No /tmp or
+permission additions were used. A shell heredoc could not be created by the
+environment; that edit attempt exited before running Python or changing files.
+Edits were then applied directly in place.
+
+Only py_compile and AST static validation are recorded in
+REPAIR35_STATIC_CHECKS.json. Pure fixtures (partial triple, non-hex, short,
+mixed modes, historical native, no flags, full triple, historical check-only)
+and all five Root Git negatives are **unexecuted**. No functional pass is claimed.
+
+Pending: S5 destruction/midnight/exit drivers; fresh Q for S1–S4 and collector;
+184 suites / 329 parse; truthful index; Root run order; Root exact-candidate
+qualification. Root next builds Qt and parentless X, stages under its own B,
+then runs check-only, pure fixtures and Git negatives as described in
+s5/S5_ROOT_RUN.md. No native/batch admission until the pending prerequisites
+are ready.
+
+All 7 domains + EV, formal 16/88, original 30/88, P04 credit 0, all six D05
+approvals, frozen M c0ea009b28a7649aca6a433a1a24dc0be5e7ab81 and allowed_paths
+remain fixed. This is an internal step of P04-01, no new counted unit and no
+completion claim. Unchanged support gates including owned_outer.py were not
+read or executed; their qualification remains with Root, as recorded in the
+direction. Source commit identity was not independently checked because Git
+commands are prohibited for this worker.
@@ -0,0 +1,41 @@
+{
+  "py_compile_ast": [
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/s5/run_s5_native.py",
+      "sha256": "e96b2793d7352ac52e16505c9c4cde3d151497763be3cb47926338df070b05e5",
+      "py_compile": "passed",
+      "ast": "passed",
+      "top_level_functions": [
+        "r17_relocation_guard",
+        "probe_guard",
+        "module",
+        "pin",
+        "load_uid_helper",
+        "make_uid_policy",
+        "engine_pin",
+        "select_mode",
+        "fresh_q_guard",
+        "main"
+      ]
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/s5/s5_uid_controls.py",
+      "sha256": "17069b87b98c385e1298152c9c5c2f23c8710b79eb19aef073c64ce215f6c902",
+      "py_compile": "passed",
+      "ast": "passed",
+      "top_level_functions": [
+        "module",
+        "main"
+      ]
+    },
+    {
+      "path": "docs/plans/original-completion-2026-10-02/execution/p04-01/s5/s5_wrapper_fixtures.py",
+      "sha256": "1a4daebf46051e975a9cc740660c4672371ea6a9e6cb04cbc1d458ece5f0151d",
+      "py_compile": "passed",
+      "ast": "passed",
+      "top_level_functions": [
+        "main"
+      ]
+    }
+  ]
+}
@@ -0,0 +1,28 @@
+# REPAIR36 — bounded preparation submitted, no acceptance credit
+
+Changes are limited to the S5 wrapper, new pure UID controls and these documents.
+Actual-Q AST helper loading, finite derived UID planning, import sealing,
+private-globals phase instrumentation, phase receipts and cleanup rechecks
+supplement the existing expected inventory. Historical selection, existing
+require gates, ownership/PID, engine, cache and formal mirror rules remain.
+The helper is loaded from real Q before controls construct synthetic refs.
+
+Only py_compile and AST checks are executed and recorded in
+REPAIR36_STATIC_CHECKS.json. Wrapper fixtures, UID controls, check-only plans,
+Git negatives and every native diagnostic are unexecuted. No functional pass,
+full regression, 15+EV batch, original credit or completion is claimed.
+No Git, engine, Runner or other agent operations were performed. A shell
+heredoc edit failed before Python execution; edits then used apply_patch.
+
+Context gap: Q runner API was read from
+build/owner-handoff/p04-after-p26-closure-r01/q35-uid-diagnostic/run_all_tests.py.reference;
+Root must confirm the actual Q runner matches that mirror (320ca668…)
+at runtime. Helper implementation was read from the adjacent P13 reference;
+runtime loading uses only the actual pinned Q, never either mirror.
+
+Pending: S5 destruction/midnight/exit drivers; S1–S4/collector fresh Q;
+derived 184 suites / 329 parse; truthful index; Root exact-candidate qualification.
+Root order is py_compile → wrapper fixtures → UID controls with explicit scratch
+→ fresh check-only plan → exactly one new-name diagnostic. The failed r35
+diagnostic is preserved. All 7 domains + EV, formal 16/88, original 30/88,
+P04 credit 0, all six D05 approvals pending, M c0ea009 and allowed_paths stay fixed.
@@ -0,0 +1,173 @@
+# repair7 作業状態
+
+状態: blocked（実装未完了）。whole合格、登録validate成功、実測成功を意味しない。
+提出547のGit objectと既存C実装は保持。今回の変更は未コミット。
+engine・全回帰・checker試験・登録validate・Runner操作は未実行。
+原15条件+EV、7領域、3安全性結果、30/88、部分点0を維持する。
+
+## 実装した部分と未検証部分
+
+checkerに名前付きtargetの照合を追加した。main_anchorは
+9694f50ee63750192376ca69bc7dda3f884784c5、submittedは提出後に確定する実commit。
+composed_treeはRoot例の904bbbを固定せず、毎回merge-treeから再計算する。
+実行時の一時object directoryとcanonical objectsのread-only alternateを使い、
+canonical refs/HEAD/indexへの書込み命令を使わない。この実装はまだ実行していない。
+
+全tree entryと選択sourceを区別し、1338件のpath/bytes/SHA256をGit blobと
+runner-input.source_beforeで両方向比較する。source選択規則はmain_anchorの
+tools/run_all_tests.pyのSHAに固定。追加選択pathはcheckerのみ。
+3139件の変更されていない既存metadataを明示分類し、追加・変更・削除pathは
+登録scope内のみ許す。submitted差分もregisteredから独立にscope検査する。
+
+ORDER_FUNCTIONS、REACH_REFS、applicability_deltaはcomposed_treeのbytesを読む。
+candidate_treeは実候補のtree OIDとし、composed_treeの全entryとの一致を要求する。
+checker metadataだけのcommit SHA差はengine再実行の理由にしない。
+checker source bytesはsubmitted/composed/checker commitと別々に比較する。
+自己blob一致は提出前なので**未実施**。Rootが提出後に検証する。
+
+## 新しい入力形式（未試験）
+
+既存indexの条件・authority・domain・rawを省略する形式ではない。
+
+- `candidate_commit`: 実際にcheckerを実行するcheckoutのHEAD。
+- `candidate_tree`: 実際に検証する候補tree。登録時にも指定し、比較を省略しない。
+- `product_binding.product_target`: main_anchor/submitted/composed_treeの完全OID。
+- `product_binding.tested_product`: 実測製品commit。製品manifestをGitから再計算する。
+- `product_binding.runner_inputs`: 実runner-inputファイルのdescriptor配列。
+  descriptorはpath/bytes/sha256に加えてmaterialsとwrapperを持つ。
+  materialsはnative固定input/QAの原pathから供給済み実ファイルdescriptorへのmap。
+  原pathは由来のみで、そこからファイルを開かない。wrapperも実ファイルdescriptor。
+  Cの3 runのrunner-inputを全て含める。各selected_source_mapの差分は宣言済みQA
+  override 1件だけに限定する。
+- `versions`: registered、execution_origin、checker、testedの4役割。
+  checkerはcommit/sha256。testedはproduct_target/manifest_sha256。
+  manifest digestはpath→{bytes,sha256}をsort_keys=True、separators=(',', ':')の
+  JSON UTF-8で符号化したSHA256。checkerのSHAは製品digestに代用しない。
+- `native_bundle`: 従来のmanifestキーからpath/bytes/sha256 descriptorへ変更。
+  OWNERSHIP_RAW_PROVENANCE.jsonの実ファイルを指定する。
+
+descriptorの相対pathはp04-evidence配下。絶対pathはbuild_dir/audit-support配下の
+p04-whole-closure-r01、native-first-current、p04-current-native-series-r01の3系統のみ。
+ファイルを追加コピーせずその場で読む。symlink・欠落・SHA/bytes不一致は失敗する。
+
+## 残作業（Rootのnative実行へ進める状態ではない）
+
+1. S1/S2/S3のprobeと、import/parse各1回→実測→正式Writer→別PID Readerを
+   結合するwrapperは未実装。既存templateを読んだだけで完成とは扱わない。
+2. 全条件のactor/service/予約/帳簿/同minute/正式保存rawを結合するcollectorは
+   未実装。既存verify_nativeの有限3条件を全条件collectorに代用できない。
+   verified_conditionsの全条件への動的導出も未実装。
+3. 新しいtarget側のconfig/input/environment実体照合は未完了。
+   現在は固定input/QA/wrapperと既存environment pin検査があり、これだけで
+   engine環境を全runnerの実起動に結合したとは主張しない。
+4. 新入力形式へのfixture更新・Runner正式試験・提出後自己blob検査は未実施。
+   既存repair6の試験結果を今回の変更の合格として転記しない。
+
+実装残作業を仕様不足として偽装しない。原本の未確定D05部分は従来どおりpending。
+新しい金額、費用帰属、EV停止規則を追加して残作業を埋めない。
+
+## B/Cの確定事項と実体確認
+
+main969のautoload/simulation_runtime.gdのrepay_loan_principal本体と
+tests/mvp/test_original_midnight_settlement.gdの返済テストをGit objectから読んだ。
+公開返済APIとledger分類は存在する。自動返済・全UI完成は主張しない。
+
+duty_paymentsはstaff_id/dayで勤務recordに結合できるpayroll settlement取引数で、
+期待値1のまま。実コードではWAGE行のsource_entity_idがpayroll settlement_id、
+settlement.rowsがstaff_id/payment、ShiftInstance snapshotがstaff_id/start_dayと
+worked_minutes/overtime_minutesを保持する。給与行の数や勤務分数をそのまま
+duty_paymentsに代入してはならない。day基準と勤務の実測差分も照合対象。
+
+具体的に読んだ追加rawは
+`p04-current-native-series-r01/p04-paid-shift-midnight-native-r01/order-evidence/midnight-midnight.json`
+のstaff/payroll/economy部分と
+`p04-current-native-series-r01/p04-paid-shift-midnight-formal-native-r01/runner-input.json`
+のsource_beforeサンプル・fixed_input_pins。これを39raw読了・採用とはしない。
+加えてnative-first-currentのactual-native、dependency-midnight-native、
+dependency-formal-native各runner-input.jsonのキーとQA/QA_overridesを読んだ。
+前2件にはfixed_input_pinsがなく、formalのみ保存入力のpinを持つ。
+
+midnight_replayは実際の同minute決算API再呼出しまでpending。
+paid資料の1442完了は1440売上境界を証明せず、request再送は決算API再呼出しを
+証明しない。shift_completionはROOT_APPROVED_SHIFT_CURRENT_RESULTと
+approved-shift-current-r01.gdの1080系列を結合する必要がある。
+
+順序はworker実装完了→Root資源確認→S1→S2→S3→collector→登録validate→
+独立whole review→prepare-integration/final。全case収集前のwhole合格はない。
+
+S1準備に移行、A未検証。repair8はs1/の3ファイルによるコード準備のみ。未実測・原P04 whole未達。
+
+## repair9 — S1 code-ready / submitted
+
+今回の限定修正は完了。上記repair7の未完一覧は履歴であり、今回のS1実装をblockedとはしない。
+原P04 whole未達・修正版native未実測。git書込み・Runner操作・engine起動なし。
+
+原因はfixtureのint(String)=0の読み違い。InventoryReservation.create_snapshot()は
+stateをACTIVE/RELEASED等の文字列名で保存するが、旧probe:150はint()で比較し、
+RELEASEDもACTIVE=0として双方向照合していた。productは不変。
+s1/p04_s1_ev_power_probe.gdのsafety():144にstates_knownを追加し、旧150
+（修正後151–155）をString化・enum名存在確認・ACTIVE名比較へ変更した。
+修正後165の既存孤立outcomeにstates_knownをANDし、不明状態なら明示的に失敗する。
+既知状態のcheck数は各case 3のまま。不明状態も6 checksの既存枠内で失敗する。
+staff状態の119、purpose==staff_task、8境界、双方向照合、孤立0、ledger・到着・
+remaining_minutesは維持。非ACTIVE履歴もsnapshot/rawから削除・除外しない。
+wrapperに予約state判定の説明はなくコード変更不要。S1_ROOT_RUN.mdに型の説明と
+Root用fresh r02 plan/outputを反映した。
+
+### 直接読んだ根拠（絶対path）
+
+- /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/audit-support/p04-whole-closure-r01/ROOT_S1_NATIVE_R01_RESULT.json
+- /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-native-r01/raw/writer-landing-observations.json
+- /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-native-r01/raw/writer-landing-observations.var
+- /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-native-r01/raw/writer-no-safe-landing-observations.json
+- /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-native-r01/raw/writer-no-safe-landing-observations.var
+- /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-native-r01/raw/writer.json
+- /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-native-r01/writer/stderr.log
+- /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-native-r01/execution.json
+
+指定の /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-native-r01/raw/writer/stderr.log と
+/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-native-r01/raw/writer/execution.json はFileNotFoundError。
+/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-native-r01/writer/execution.json も存在しない。
+上記実在stderrとrun全体executionを代わりに直接確認した。欠落pathを読了とはしない。
+.varは全bytes読取りのみで、engineによるtyped復号・JSONとの型付き一致検証は未実施。
+
+### rawからの手照合（オーナー提示値と区別）
+
+以下は提示値の転記ではなく、閲覧用JSONの予約・task行を直接読み、両方向を照合した値。
+全行のreservation_idはreservation_00000001、requester/task_idはs1_rescue_with_tool。
+ACTIVE行ではtask.reservation_idsに同IDがあり、RELEASED行ではidsが空なので、
+有効予約→taskとtask.ids→有効予約の欠落数はいずれも0。
+
+|case|境界 minute|予約state / task state|孤立（両方向合計）|
+|---|---|---|---|
+|landing|boarded 779|ACTIVE / MOVING|0|
+|landing|stopped 781|RELEASED / CANCELLED|0|
+|landing|held_after 801|RELEASED / CANCELLED|0|
+|landing|final 802|RELEASED / CANCELLED|0|
+|no-safe-landing|boarded 779|ACTIVE / MOVING|0|
+|no-safe-landing|stopped 781|ACTIVE / MOVING|0|
+|no-safe-landing|held_after 801|ACTIVE / MOVING|0|
+|no-safe-landing|final 847|RELEASED / CANCELLED|0|
+
+両caseで予約時761はACTIVE、搭乗779もACTIVE。landingのterminal_atは780、
+no-safe-landingは815。landingという観測キー自体はminute801であり、780は解放時点。
+ledger配列長のheld_after−reserve_exhausted_before_tickは各0。
+到着はboardedのrequest_id末尾000002（medic）/000003（patient）とshaft stopsで絞ると各1回。
+medicには先行request末尾000001の到着もあるが対象requestではない。
+remaining_minutesはlanding 0→0、no-safe-landing 4→4。
+Writer receiptからPID59355、6 checks / 2 failures、旧orphansはlanding 3、no-safe-landing 1。
+これら直接確認値はオーナー提示値に一致する。未知の予約stateは観測JSONにない。
+修正後の8境界孤立0は既存rawの再解釈であり、修正版native成功を意味しない。
+
+### 静的検証
+
+run_s1_native.pyのpy_compileはexit0（pycacheはtask build/s1-repair9-python-cache）。
+既定製品rootのcheck-onlyはtools/run_all_tests.pyのPermissionErrorでexit2。
+checkoutを--project-root指定したcheck-onlyはexit0、engine0、source1300、fixed pins16。
+cache receiptはPermissionErrorをcache_accessへ記録。製品1338件やnative開始条件の証明ではない。
+最終説明更新後のplanはtask build/p04-s1-repair9-worker-final-plan.json、
+output指定はtask build/p04-s1-repair9-worker-unused（native未使用）。
+Rootは既定製品rootで独自fresh r02 plan/outputを用いnativeを1回実行し、
+Writer6 checks全PASSとdistinct Readerの14正式slot復元を確認する。worker planは転用しない。
+同版missing-index whole validateは再実行しない。S2/S3/collector/Aは今回扱わない。
+D05の採用済み2承認は維持し、それ以外の未確定事項と混同しない。
@@ -0,0 +1,19 @@
+# Runner実行担当からの第1修正入力
+
+これは原ゲーム仕様の変更ではありません。旧Runtimeと差分診断を追加試験入力として供給します。既存監査を再実装せず、技術的な証拠index形式とfailclosed checkerを作成してください。原7領域とD05 pendingを維持します。原条件の証拠欠損は検証失敗です。rootは検証器のsourceを変更していません。
+
+読取専用入力（Runner allocation.build_dir内）:
+- /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/audit-support/support.json
+- /Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/audit-support/historical-runtime.txt
+
+旧Runtime SHA256: 2d7e2cea5424585e9aa4302ab66d1fc4dbaefe743ce4328fccc1efa2f19b82e4。入力を検証してからdiffしてください。
+
+内部indexの形式設計はspecの検証器作成指示に含まれる技術判断であり、原ゲーム規則の補完ではありません。欠損/古いソース/不正hash/未実行/未定義必須規則は必ず非0にしてください。全証拠が揃わないまま元成果を完了扱いにしないでください。エンジン・全回帰・製品source編集は0。
+
+実際のClaude commanderの記録済み判断:
+
+{
+  "action": "request-repair",
+  "task_id": "P04-01",
+  "reason": "初回Codex blockedの原因は、検証器tools/check_p04_order_evidence.pyが未作成だったこと(missing gate schemaで仕様補完を避けて停止)。これは内部証拠formatの実装判断で、原ゲーム仕様の不足ではない。既存specの検証器作成指示が、元要件を守るfailclosed形式の設計を許可している。repairs=0で、第1repairは残2/2以内。入力は再起動に十分: input.json等のlocal copy、current source pins、14差分(production7とmanaged14を区別、追加7はroot対managedでCRLF→LFのみbyte検証済み、rawSHA差は隠さない)、正確な旧Runtime(SHA 2d7e2cea完全一致)をbuild_dir/audit-support/historical-runtime.txtへraw保存済み。support.jsonとこのtxtを読取専用の追加試験入力として使う(Git変更scopeなし)。repair範囲: (1) 既存のorder-audit.jsonとORDER_AUDIT.mdは保持し、重複作成しない。必要なら最小の追記・訂正のみ。(2) --verify-onlyのcheckerを作成する。BUILD_OUTPUT_DIR/p04-evidence/index.jsonを必須とし、7領域、不変のsource pin、raw proof hash、適用性を検証する。欠損、D05 pending、stale source、未実行proof、自己申告pass、test count単独のpassは非0で終了する。raw証拠が全て不足していてもcheckerは作成する。生証拠を作ったことにはしない。D05は未承認のまま、その不足がある受入をpassにしない。(3) 全回帰・engine実行、ゲームsource変更、Clock・値の変更は0。原7領域/元30/88/部分点なしの受入分母は維持し、仕様変更・分母変更・予算拡大・main統合は含めない。allowed_pathsは検証器と実行ディレクトリ配下に限る。"
+}
@@ -0,0 +1,165 @@
+#!/usr/bin/env python3
+"""Build a fresh evidence index from supplied native bytes after auto-submit.
+
+The index has no candidate identity or Root-passed flag. Invocations share the
+same payload; checkout roles are established afresh by the checker.
+"""
+import argparse
+import hashlib
+import importlib.util
+import json
+import os
+from pathlib import Path
+import sys
+
+sys.dont_write_bytecode = True
+ROOT = Path(__file__).resolve().parents[5]
+
+
+def checker():
+    spec = importlib.util.spec_from_file_location('p04_index_checker', ROOT / 'tools/check_p04_order_evidence.py')
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+def descriptor(path):
+    data = path.read_bytes()
+    return {'path': str(path.absolute()), 'bytes': len(data), 'sha256': hashlib.sha256(data).hexdigest()}
+
+
+def payload(build, gate=None):
+    gate = gate or checker()
+    build = Path(build).resolve(strict=True)
+    native = build / 'audit-support/native-first-current'
+    c = gate.verify_native(native)
+    raw = gate.combine_native_series(build, c)
+    tested = c['production_commit']
+    source = gate.selected_manifest(gate.tree_entries(tested))
+    source_map = {p: v['sha256'] for p, v in source.items()}
+    # Resolve content from supplied roots only; never open original provenance
+    # paths, never omit required source/config/input/environment material.
+    supplied = {}
+    roots = [build / 'audit-support' / name for name in
+             ('native-first-current', 'p04-whole-closure-r01', 'p04-current-native-series-r01',
+              'p04-r17-full-inputs-r01')]
+    for root in roots:
+        if not root.exists():
+            continue
+        for path in sorted(root.rglob('*')):
+            if path.is_file():
+                gate.safe(root, path.relative_to(root).as_posix())
+                pin = descriptor(path)
+                supplied.setdefault(pin['sha256'], pin)
+    runners = []
+    for run in gate.NATIVE_RUNS:
+        path = native / run / 'runner-input.json'
+        inputs = gate.load(path)
+        row = descriptor(path)
+        row['materials'] = {}
+        for pin in inputs.get('fixed_input_pins', []) + [inputs['QA']]:
+            gate.require(pin['sha256'] in supplied, 'missing supplied runner material: ' + pin['path'])
+            actual = supplied[pin['sha256']]
+            gate.require(actual['bytes'] == pin['bytes'], 'runner material length')
+            row['materials'][pin['path']] = actual
+        gate.require(inputs['wrapper_sha256'] in supplied, 'missing supplied native wrapper')
+        row['wrapper'] = supplied[inputs['wrapper_sha256']]
+        runners.append(row)
+    # C references retain every lifecycle, raw phase, source, environment and
+    # formal member mapping; Stage R retains its complete original->relocated map.
+    references = {}
+    for row in gate.load(native / 'SOURCE_MANIFEST.json')['files']:
+        references['C/' + row['copy']] = descriptor(gate.safe(native, row['copy']))
+    for row in gate.load(native / 'OWNERSHIP_RAW_PROVENANCE.json')['copied']:
+        references['C/' + row['target']] = descriptor(gate.safe(native, row['target']))
+    series = {}
+    collection = build / 'audit-support/p04-raw-collect-r22'
+    for name in ('s1', 's2a', 's2b', 's3', 's4'):
+        series[name] = gate.load(collection / (name + '.json'))
+    relocation = gate.load(build / 'audit-support/p04-r17-full-inputs-r01/MANIFEST.json')
+    authorities = {}
+    for ref in sorted({r for _, refs, _ in gate.REQUIRED.values() for r in refs}):
+        relative = (gate.OWNER_BINDINGS[ref][0] if ref.startswith('D05-P04-') else
+                    'docs/traceability/original/BASELINE.txt' if ref.startswith('BASELINE:') else
+                    'docs/DESIGN_DECISIONS.md' if ref == 'D-034' else
+                    'docs/plans/original-completion-2026-10-02/execution/p04-01-input-r01/ORDER_CONTRACT_DRAFT.md')
+        path = gate.safe(gate.ROOT, relative)
+        if ref.startswith('D05-P04-'):
+            gate.owner_authority(ref, {'source': relative, 'status': 'approved'}, path)
+        authorities[ref] = {'source': relative, 'sha256': gate.sha(path),
+                            'status': 'approved' if not ref.startswith('BASELINE:') else 'original'}
+    conditions = {cid: {'case_id': cid, 'authority_refs': list(refs), 'nativeWindows': 'pending',
+                        'raw_verified': cid in raw['verified_conditions'],
+                        'required_measurements': metrics}
+                  for cid, (_, refs, metrics) in gate.REQUIRED.items()}
+    domains = {domain: {'conditions': [cid for cid, (d, _, _) in gate.REQUIRED.items() if d == domain],
+                        'source_refs': [{'path': p, 'sha256': source_map[p], 'functions': list(fs)}
+                                        for p, fs in gate.ORDER_FUNCTIONS.items()],
+                        'authority_refs': sorted({r for _, (d, refs, _) in gate.REQUIRED.items()
+                                                  if d == domain for r in refs})}
+               for domain in sorted(gate.DOMAINS)}
+    reachability = {}
+    for name, rows in gate.REACH_REFS.items():
+        refs = []
+        for path, function, digest, lines in rows:
+            gate.resolve_anchor(gate.git_bytes('show', tested + ':' + path), function, digest, lines)
+            refs.append({'path': path, 'sha256': source_map[path], 'function': function,
+                         'anchor_sha256': digest, 'line_count': lines})
+        reachability[name] = {'reach': name == 'EV', 'case_id': 'EV' if name == 'EV' else None, 'source_refs': refs,
+                              'raw_verified': 'EV' in raw['verified_conditions'] if name == 'EV' else None}
+    delta = gate.source_delta(gate.REGISTERED_COMMIT, tested)
+    index = {'schema_version': 2, 'task_id': 'P04-01', 'formal_acceptance': False,
+            'versions': {'registered': gate.REGISTERED_COMMIT, 'execution_origin': gate.EXECUTION_ORIGIN,
+                         'tested': tested},
+            'product_binding': {'tested_product': tested, 'runner_inputs': runners},
+            'source_map': source_map, 'registered_pins': gate.load(gate.SPEC)['current_source_pins'],
+            'applicability_delta': delta,
+            'delta_cases': {r['path'] + ':' + r['function']: {cid: cid for cid in
+                            gate.boundary_conditions(r['path'], r['function'])} for r in delta},
+            'domains': domains, 'authority': authorities, 'conditions': conditions,
+            'reachability': reachability, 'raw_conditions': raw, 'raw_references': references,
+            'series': series, 'source_config_input_environment_and_formal': relocation,
+            'native_bundle': descriptor(native / 'OWNERSHIP_RAW_PROVENANCE.json'),
+            'original_audit': {'sha256': gate.sha(gate.ROOT / gate.DOC_SCOPE / 'order-audit.json'),
+                               'content': gate.load(gate.ROOT / gate.DOC_SCOPE / 'order-audit.json')},
+            'review_status': 'pending_review', 'original_credit': '16/88; P04=0',
+            'safety_outcomes': ['no charging while legitimately stopped',
+                                'no double midnight settlement', 'no orphan reservations']}
+    gate.applicability(index, gate.load(gate.SPEC), source_map, tested)
+    return index
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--build', required=True, type=Path)
+    parser.add_argument('--output', required=True, type=Path, help='fresh directory; exclusive creation')
+    parser.add_argument('--invocation', required=True, choices=('validate', 'prepare-integration', 'final'))
+    parser.add_argument('--registered-ref', required=True)
+    parser.add_argument('--tested-ref', required=True)
+    args = parser.parse_args()
+    gate = checker()
+    os.environ['BUILD_OUTPUT_DIR'] = str(args.build.resolve(strict=True))
+    output = args.output.absolute()
+    gate.require(not output.exists() and not output.is_symlink(), 'output must be fresh')
+    for path in output.parents:
+        gate.require(not path.is_symlink(), 'output parent symlink')
+    index = payload(args.build, gate)
+    gate.require(args.registered_ref == gate.REGISTERED_COMMIT and
+                 args.tested_ref == index['versions']['tested'],
+                 'source refs differ from immutable evidence roles')
+    with gate.isolated_objects():
+        _, role = gate.verify_roles(index, args.build.resolve())
+    # The historical invocation is separate from the reusable evidence index.
+    receipt = {'invocation': args.invocation, 'actual_head': role['actual_head'],
+               'actual_tree': role['actual_tree'], 'role': role['role'], 'formal_acceptance': False}
+    output.mkdir(parents=False)
+    for name, value in (('index.json', index), ('generation-invocation.json', receipt)):
+        with (output / name).open('x', encoding='utf-8') as stream:
+            json.dump(value, stream, ensure_ascii=False, sort_keys=True, indent=2)
+            stream.write('\n')
+    print(json.dumps({'evidence_directory': str(output), **receipt}))
+
+
+if __name__ == '__main__':
+    main()
@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""Isolated disposable repository controls; never original acceptance evidence."""
+import importlib.util
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+from unittest.mock import patch
+
+sys.dont_write_bytecode = True
+ROOT = Path(__file__).resolve().parents[5]
+
+
+def rejected(operation):
+    try:
+        operation()
+    except (ValueError, subprocess.CalledProcessError):
+        return
+    raise AssertionError('invalid input/response accepted')
+
+
+def run():
+    spec = importlib.util.spec_from_file_location('bulk_gate', ROOT / 'tools/check_p04_order_evidence.py')
+    gate = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(gate)
+    with tempfile.TemporaryDirectory(prefix='p04-bulk-fixture-', dir='/tmp') as temporary:
+        base = Path(temporary)
+        assert not base.resolve().is_relative_to(ROOT.resolve())
+        repo = base / 'repo'
+        repo.mkdir()
+        gate.ROOT = repo
+        env = gate.git_environment()
+        env.update(GIT_AUTHOR_NAME='fixture', GIT_AUTHOR_EMAIL='fixture@invalid',
+                   GIT_COMMITTER_NAME='fixture', GIT_COMMITTER_EMAIL='fixture@invalid')
+
+        def git(*args, data=None):
+            return subprocess.check_output(['git', '-c', 'core.hooksPath=/dev/null', *args],
+                                           input=data, cwd=repo, env=env)
+
+        git('init', '--quiet')
+        payloads = [b'\x00binary\r\nline\n', b'', bytes(range(256)) * 32768]
+        oids = [git('hash-object', '-w', '--stdin', data=data).decode().strip() for data in payloads]
+        name = '日本語の木.dat'
+        (repo / name).write_bytes(payloads[0])
+        git('add', '--', name)
+        git('commit', '--quiet', '-m', 'fixture')
+        entries = gate.tree_entries('HEAD')  # ls-tree -z resolves the unicode path.
+        assert entries[name][1] == oids[0]
+        expected = {oid: git('cat-file', 'blob', oid) for oid in oids}
+        original_output = subprocess.check_output
+        with patch.object(gate.subprocess, 'check_output', wraps=original_output) as process:
+            assert gate.read_blobs(reversed(oids + [oids[0]])) == expected
+            assert process.call_count == 1
+            assert process.call_args.kwargs['input'] == ('\n'.join(sorted(set(oids))) + '\n').encode()
+        with patch.object(gate.subprocess, 'check_output', side_effect=AssertionError('process started')):
+            assert gate.read_blobs([]) == {}
+            for invalid in ('abc', 'g' * 40, 'a' * 39, 'a' * 41, 'HEAD', oids[0] + '\n', None):
+                rejected(lambda: gate.read_blobs([invalid]))
+        for oid in ('0' * 40, git('rev-parse', 'HEAD').decode().strip(),
+                    git('rev-parse', 'HEAD^{tree}').decode().strip()):
+            rejected(lambda: gate.read_blobs([oid]))
+
+        oid = oids[0]
+        header = oid.encode() + b' blob '
+        valid = header + b'3\na\x00\n\n'
+        assert gate.parse_blob_batch(valid, [oid]) == {oid: b'a\x00\n'}
+        bad = [b'', header + b'3', header + b'3\na', valid[:-1],
+               header + b'999\na\n', header + b'1\nabc\n', valid + b'garbage',
+               oid.encode() + b' missing\n', oid.encode() + b' ambiguous\n',
+               header + b'-1\n', header + b'x\n', header + b'1.0\n',
+               b'f' * 40 + b' blob 0\n\n', oid.encode() + b' tree 0\n\n']
+        for response in bad:
+            rejected(lambda: gate.parse_blob_batch(response, [oid]))
+            with patch.object(gate.subprocess, 'check_output', return_value=response):
+                rejected(lambda: gate.read_blobs([oid]))
+        rejected(lambda: gate.parse_blob_batch(valid + valid, [oid]))
+        rejected(lambda: gate.parse_blob_batch(valid, [oid, oids[1]]))
+        with patch.object(gate.subprocess, 'check_output',
+                          side_effect=subprocess.CalledProcessError(7, ['git'])):
+            rejected(lambda: gate.read_blobs([oid]))
+
+        with patch.dict(os.environ, BUILD_OUTPUT_DIR=str(base)):
+            with gate.isolated_objects():
+                private_data = b'isolated-only unique payload\x00\n'
+                private = subprocess.check_output(
+                    ['git', 'hash-object', '-w', '--stdin'], input=private_data,
+                    cwd=repo, env=gate._GIT_ENV).decode().strip()
+                assert gate.read_blobs([private]) == {private: private_data}
+            rejected(lambda: gate.read_blobs([private]))
+            with gate.isolated_objects():
+                rejected(lambda: gate.read_blobs([private]))
+                assert gate.read_blobs(oids) == expected
+        assert gate._GIT_ENV is None
+    print('bulk reader equivalence controls completed')
+
+
+if __name__ == '__main__':
+    run()
@@ -0,0 +1,576 @@
+{
+  "scope": "C Python controls on supplied raw; no formal acceptance",
+  "formal_original_credit": 0,
+  "engine_runs": 0,
+  "results": [
+    {
+      "control": "native_ownership_supplied_raw",
+      "result": "pass"
+    },
+    {
+      "control": "native_saves_supplied_raw",
+      "result": "pass"
+    },
+    {
+      "control": "native_ledger_supplied_raw",
+      "result": "pass"
+    },
+    {
+      "control": "supplied_applicability",
+      "result": "pass"
+    },
+    {
+      "control": "verify_native_supplied_raw",
+      "result": "pass",
+      "details": {
+        "service_id": "service_00000001",
+        "transaction_id": "ledger_00000081",
+        "receipt_rows": 8,
+        "formal_original_credit": 0,
+        "production_commit": "5f6bc11d6bb6e92d22d787989b219fef3a435bc1",
+        "owned_processes": 10,
+        "verified_conditions": [
+          "dependency_stop",
+          "recovery_completion",
+          "paused_midnight"
+        ]
+      }
+    },
+    {
+      "control": "signature_line_sha",
+      "result": "rejected",
+      "error": "native ordering bytes",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "trailing_comment_excluded_sha",
+      "result": "rejected",
+      "error": "native ordering bytes",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "one_byte_raw",
+      "result": "rejected",
+      "error": "native SHA: actual-native/repro/stdout.log",
+      "manifest_hashes_refreshed": false
+    },
+    {
+      "control": "missing_member",
+      "result": "rejected",
+      "error": "missing/outside file: dependency-formal-native/formal-packages/reader/paused/world.bin",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "writer_reader_same_pid",
+      "result": "rejected",
+      "error": "native writer reader PID binding",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "writer_reader_same_profile",
+      "result": "rejected",
+      "error": "native writer reader profile reused",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "abnormal_ended",
+      "result": "rejected",
+      "error": "native process bindings",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "process_pid_changed",
+      "result": "rejected",
+      "error": "native PID chain",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "cleanup_missing",
+      "result": "rejected",
+      "error": "native owned cleanup binding",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "execution_owned_pid_deleted",
+      "result": "rejected",
+      "error": "native execution cleanup membership",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "reader_receipt_row_duplicated",
+      "result": "rejected",
+      "error": "native duplicate receipt row",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "reader_receipt_row_deleted",
+      "result": "rejected",
+      "error": "native reader receipt delta",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "observation_receipt_deleted",
+      "result": "rejected",
+      "error": "native ledger receipt delta",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "paused_sale_injected",
+      "result": "rejected",
+      "error": "native ledger receipt delta",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "paused_sale_joined_ledger_wallet",
+      "result": "rejected",
+      "error": "native PAUSED sale/progress/reason",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "reservation_orphaned",
+      "result": "rejected",
+      "error": "native reservation snapshot binding",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "reservation_orphaned_both_snapshots",
+      "result": "rejected",
+      "error": "native orphan reservation relation",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "wallet_wrong",
+      "result": "rejected",
+      "error": "native wallet delta",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "idempotency_wrong_transaction",
+      "result": "rejected",
+      "error": "native sale service join",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "production_commit_mismatch",
+      "result": "rejected",
+      "error": "native production commit mismatch",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "current_source_pin_mismatch",
+      "result": "rejected",
+      "error": "native current_source_pins mismatch",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "input_source_pin_mismatch",
+      "result": "rejected",
+      "error": "native input source pin mismatch",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "original_member_changed",
+      "result": "rejected",
+      "error": "native original members changed",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "typed_var_changed",
+      "result": "rejected",
+      "error": "native typed SHA mismatch",
+      "manifest_hashes_refreshed": true
+    },
+    {
+      "control": "self_reported_scalar_true",
+      "result": "rejected",
+      "error": "native reader receipt delta",
+      "manifest_hashes_refreshed": true
+    }
+  ],
+  "previous_validation": {
+    "scope": "C Python controls only; synthetic corrected applicability is not native proof",
+    "formal_original_credit": 0,
+    "engine_runs": 0,
+    "results": [
+      {
+        "control": "native_ownership_supplied_raw",
+        "result": "pass"
+      },
+      {
+        "control": "native_saves_supplied_raw",
+        "result": "pass"
+      },
+      {
+        "control": "native_ledger_supplied_raw",
+        "result": "pass"
+      },
+      {
+        "control": "supplied_applicability",
+        "result": "rejected",
+        "error": "native ordering bytes"
+      },
+      {
+        "control": "synthetic_corrected_applicability_composition",
+        "result": "pass",
+        "native_acceptance": false
+      },
+      {
+        "control": "one_byte_raw",
+        "result": "rejected",
+        "error": "native SHA: actual-native/repro/stdout.log",
+        "manifest_hashes_refreshed": false
+      },
+      {
+        "control": "missing_member",
+        "result": "rejected",
+        "error": "missing/outside file: dependency-formal-native/formal-packages/reader/paused/world.bin",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "writer_reader_same_pid",
+        "result": "rejected",
+        "error": "native writer reader PID binding",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "writer_reader_same_profile",
+        "result": "rejected",
+        "error": "native writer reader profile reused",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "abnormal_ended",
+        "result": "rejected",
+        "error": "native process bindings",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "process_pid_changed",
+        "result": "rejected",
+        "error": "native PID chain",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "cleanup_missing",
+        "result": "rejected",
+        "error": "native owned cleanup binding",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "execution_owned_pid_deleted",
+        "result": "rejected",
+        "error": "native execution cleanup membership",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "reader_receipt_row_duplicated",
+        "result": "rejected",
+        "error": "native duplicate receipt row",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "reader_receipt_row_deleted",
+        "result": "rejected",
+        "error": "native reader receipt delta",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "observation_receipt_deleted",
+        "result": "rejected",
+        "error": "native ledger receipt delta",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "paused_sale_injected",
+        "result": "rejected",
+        "error": "native ledger receipt delta",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "paused_sale_joined_ledger_wallet",
+        "result": "rejected",
+        "error": "native PAUSED sale/progress/reason",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "reservation_orphaned",
+        "result": "rejected",
+        "error": "native reservation snapshot binding",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "reservation_orphaned_both_snapshots",
+        "result": "rejected",
+        "error": "native orphan reservation relation",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "wallet_wrong",
+        "result": "rejected",
+        "error": "native wallet delta",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "idempotency_wrong_transaction",
+        "result": "rejected",
+        "error": "native sale service join",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "production_commit_mismatch",
+        "result": "rejected",
+        "error": "native production commit mismatch",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "current_source_pin_mismatch",
+        "result": "rejected",
+        "error": "native current_source_pins mismatch",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "input_source_pin_mismatch",
+        "result": "rejected",
+        "error": "native input source pin mismatch",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "original_member_changed",
+        "result": "rejected",
+        "error": "native original members changed",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "typed_var_changed",
+        "result": "rejected",
+        "error": "native typed SHA mismatch",
+        "manifest_hashes_refreshed": true
+      },
+      {
+        "control": "self_reported_scalar_true",
+        "result": "rejected",
+        "error": "native reader receipt delta",
+        "manifest_hashes_refreshed": true
+      }
+    ],
+    "validated_source_sha256": {
+      "tools/check_p04_order_evidence.py": "98b2692c604055d7b970e6ef9e3ad1795f35823c3c19d1acad5b80ad2ec7a378",
+      "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_native_fixtures.py": "26bbdcee483816b8bc60c250bbc63bf0a72a194dce2ba9b690abace9b6b17bbc"
+    },
+    "supplied_bundle_pins": {
+      "SOURCE_MANIFEST.json": "381b439fb1d4ee5f30e21243b03ad755c3ab654a9e414af5648004054d67b5f4",
+      "OWNERSHIP_RAW_PROVENANCE.json": "51d746879b4197445a09cd44a88dd918c365fa98025d9cd652a740cee09a9040",
+      "POST_P18_CURRENT_SOURCE_APPLICABILITY.json": "ecb92215b7bfb4368ddeb6d44dcd467d13e97d677ca2f29df3ab9684f6c757c7"
+    },
+    "whole_native_status": "blocked: supplied applicability body hashes exclude four function bodies",
+    "whole_gate_executed": false
+  },
+  "whole_native_status": "pass: corrected supplied bundle; strict full raw SHA",
+  "whole_gate_executed": false,
+  "validation_invocations": {
+    "native": 1,
+    "existing_fixtures": 1,
+    "applicability_ab": 1
+  },
+  "existing_fixtures": {
+    "scope": "A/B and optional C applicability controls; no native acceptance",
+    "results": [
+      {
+        "control": "registered_equals_tested",
+        "revision": "deb1bcb2374eb378b840ca345db952bd8572cb6e",
+        "changed_units": 0,
+        "result": "pass"
+      },
+      {
+        "control": "line_shift_resolves",
+        "revision": "deb1bcb2374eb378b840ca345db952bd8572cb6e",
+        "result": "pass"
+      },
+      {
+        "control": "legal_delta",
+        "revision": "5f6bc11d6bb6e92d22d787989b219fef3a435bc1",
+        "changed_units": 25,
+        "result": "pass"
+      },
+      {
+        "control": "line_shift_resolves",
+        "revision": "5f6bc11d6bb6e92d22d787989b219fef3a435bc1",
+        "result": "pass"
+      },
+      {
+        "control": "undeclared_delta",
+        "result": "rejected",
+        "error": "git diff/applicability_delta mismatch"
+      },
+      {
+        "control": "missing_boundary_case",
+        "result": "rejected",
+        "error": "boundary delta coverage: autoload/simulation_runtime.gd:_build_facility_precheck"
+      },
+      {
+        "control": "wrong_tested_revision",
+        "result": "rejected",
+        "error": "version roles"
+      },
+      {
+        "control": "native_applicability",
+        "result": "pass"
+      }
+    ]
+  },
+  "applicability_ab": {
+    "scope": "Synthetic checker checks only; no engine evidence or formal acceptance",
+    "py_compile": true,
+    "results": [
+      {
+        "fixture": "synthetic_scalar_only_rejected",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "native bundle required; self-reported scalar evidence is insufficient"
+        }
+      },
+      {
+        "fixture": "forged_registered_pin",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "registered pin declaration"
+        }
+      },
+      {
+        "fixture": "false_delta",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "git diff/applicability_delta mismatch"
+        }
+      },
+      {
+        "fixture": "wrong_reach_anchor",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "unknown reachability anchor"
+        }
+      },
+      {
+        "fixture": "missing_index",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "missing/outside file: index.json"
+        }
+      },
+      {
+        "fixture": "duplicate_key",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "duplicate JSON key: schema_version"
+        }
+      },
+      {
+        "fixture": "symlink",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "symlink: stdout.json"
+        }
+      },
+      {
+        "fixture": "hash_mismatch",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "artifact hash: stdout"
+        }
+      },
+      {
+        "fixture": "stale_pin",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "stale pin: autoload/simulation_runtime.gd"
+        }
+      },
+      {
+        "fixture": "unexecuted_receipt",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "unexecuted/incomplete receipt"
+        }
+      },
+      {
+        "fixture": "pending_authority",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "pending/missing authority"
+        }
+      },
+      {
+        "fixture": "missing_condition",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "mandatory conditions missing/unknown"
+        }
+      },
+      {
+        "fixture": "unsupported_reach_false",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "unsupported reach=false: transport"
+        }
+      },
+      {
+        "fixture": "owner_hash_mismatch",
+        "exit_code": 1,
+        "result": {
+          "task_id": "P04-01",
+          "machine_verified": false,
+          "formal_acceptance": false,
+          "error": "owner approval hash mismatch"
+        }
+      }
+    ]
+  },
+  "validated_source_sha256": {
+    "tools/check_p04_order_evidence.py": "afe8c7cc3d3b511bacdaa1965fb06a0eefd1b204b7e9b930eb29767c4d320824",
+    "docs/plans/original-completion-2026-10-02/execution/p04-01/checker_native_fixtures.py": "634b5e3a3491cdcdab549ed5d812935f73c2958d8cca008ce35c80b6ebb298e4"
+  },
+  "supplied_bundle_pins": {
+    "SOURCE_MANIFEST.json": "dbaab3c293c191eb5f3aff34854945e2d564f824df50a92802b3a7eda55321a8",
+    "OWNERSHIP_RAW_PROVENANCE.json": "51d746879b4197445a09cd44a88dd918c365fa98025d9cd652a740cee09a9040",
+    "POST_P18_CURRENT_SOURCE_APPLICABILITY.json": "46e0cc35cb95496d5f26d3cab7d3a31cb29faacaa16714daab3aefdf65b420a3"
+  }
+}
@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+"""Python-only A/B controls. Real Git blobs, synthetic case IDs; no engine proof."""
+import copy
+import argparse
+import importlib.util
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+
+sys.dont_write_bytecode = True
+ROOT = Path(__file__).resolve().parents[5]
+spec = importlib.util.spec_from_file_location('p04_gate', ROOT / 'tools/check_p04_order_evidence.py')
+gate = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(gate)
+PRODUCTION = gate.MAIN_ANCHOR
+
+
+def run(native_bundle=None):
+    results = []
+    registered_spec = gate.load(gate.SPEC)
+    # Bind Git reads to the actual repository while testing exported raw blobs.
+    # No branch/index/checkout operation and no synthetic Git command output.
+    gate.git_bytes = lambda *args: subprocess.check_output(['git', *args], cwd=ROOT)
+    with tempfile.TemporaryDirectory(prefix='.applicability-fixtures-', dir=Path(__file__).parent) as tmp:
+        for revision in (gate.REGISTERED_COMMIT, PRODUCTION):
+            base = Path(tmp) / revision
+            source = {}
+            for name in gate.git_bytes('ls-tree', '-r', '--name-only', '-z', revision,
+                                       '--', 'autoload/', 'scripts/').split(b'\0'):
+                if not name.endswith(b'.gd'):
+                    continue
+                path = name.decode()
+                target = base / path
+                target.parent.mkdir(parents=True, exist_ok=True)
+                target.write_bytes(gate.git_bytes('show', revision + ':' + path))
+                source[path] = gate.sha(target)
+            gate.ROOT = base
+            delta = gate.source_delta(gate.REGISTERED_COMMIT, revision)
+            index = dict(registered_pins=registered_spec['current_source_pins'],
+                versions=dict(execution_origin=gate.EXECUTION_ORIGIN, registered=gate.REGISTERED_COMMIT,
+                              tested=revision, integration=None), applicability_delta=delta,
+                conditions={cid: {'case_id': cid} for cid in gate.REQUIRED},
+                reachability={'EV': {'case_id': 'EV'}}, delta_cases={})
+            index['delta_cases'] = {r['path'] + ':' + r['function']: {
+                cid: cid for cid in gate.boundary_conditions(r['path'], r['function'])} for r in delta}
+            gate.applicability(index, registered_spec, source, revision)
+            results.append(dict(control='registered_equals_tested' if not delta else 'legal_delta',
+                                revision=revision, changed_units=len(delta), result='pass'))
+            for name, refs in gate.REACH_REFS.items():
+                for path, function, digest, lines in refs:
+                    data = (base / path).read_bytes()
+                    gate.resolve_anchor(data, function, digest, lines)
+                    # Seven lines added before the function must not break reachability.
+                    gate.resolve_anchor(b'\n' * 7 + data, function, digest, lines)
+            results.append(dict(control='line_shift_resolves', revision=revision, result='pass'))
+            if delta:
+                for label, mutate in (
+                    ('undeclared_delta', lambda i: i['applicability_delta'].pop()),
+                    ('missing_boundary_case', lambda i: i['delta_cases'][next(iter(i['delta_cases']))].clear()),
+                    ('wrong_tested_revision', lambda i: i['versions'].update(tested=gate.REGISTERED_COMMIT)),
+                ):
+                    altered = copy.deepcopy(index)
+                    mutate(altered)
+                    try:
+                        gate.applicability(altered, registered_spec, source, revision)
+                    except ValueError as exc:
+                        results.append(dict(control=label, result='rejected', error=str(exc)))
+                    else:
+                        raise AssertionError('negative fixture accepted: ' + label)
+        gate.ROOT = ROOT
+    if native_bundle is not None:
+        try:
+            gate.native_applicability(native_bundle)
+        except ValueError as exc:
+            # A/B Git equality must not turn an inconsistent native report into
+            # applicable evidence. The C mutation suite tests a corrected copy.
+            assert str(exc) == 'native ordering bytes', str(exc)
+            results.append(dict(control='native_report_body_hash_gap', result='rejected', error=str(exc)))
+        else:
+            results.append(dict(control='native_applicability', result='pass'))
+    return {'scope': 'A/B and optional C applicability controls; no native acceptance', 'results': results}
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--native-bundle', type=Path)
+    print(json.dumps(run(parser.parse_args().native_bundle), ensure_ascii=False, indent=2))
@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+"""Read-only authority controls; no Git writes, engine or acceptance execution."""
+import copy
+import importlib.util
+import json
+from pathlib import Path
+import sys
+from unittest.mock import patch
+
+sys.dont_write_bytecode = True
+ROOT = Path(__file__).resolve().parents[5]
+spec = importlib.util.spec_from_file_location('p04_authority', ROOT / 'tools/check_p04_order_evidence.py')
+gate = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(gate)
+
+
+def run():
+    results = []
+    original = gate.load(ROOT / gate.DOC_SCOPE / 'D05_REMAINING_APPROVAL.json')
+    source = gate.git_bytes('show', 'c0ea009b28a7649aca6a433a1a24dc0be5e7ab81:' +
+        'docs/plans/original-completion-2026-10-02/execution/' +
+        'p04-01-owner-approval-20261018/D05_ACTUAL_HUMAN_APPROVAL.json')
+    import hashlib
+    assert all(row['sha256'] == hashlib.sha256(source).hexdigest()
+               for row in original['source_bindings'])
+    human = {row['id']: row for row in json.loads(source)['approved']}
+    for choice in original['approved_choices']:
+        assert all(choice[k] == human[choice['source_id']][k]
+                   for k in ('answer_exact', 'approved_question_policy'))
+    for ref, (relative, digest) in gate.OWNER_BINDINGS.items():
+        entry = {'source': relative, 'status': 'approved'}
+        path = ROOT / relative
+        gate.owner_authority(ref, entry, path)
+        results.append({'id': ref, 'case': 'positive', 'result': 'accepted'})
+        for label in ('missing', 'wrong_hash', 'pending', 'wrong_path'):
+            changed = copy.deepcopy(entry)
+            if label == 'missing':
+                changed = {}
+            elif label == 'pending':
+                changed['status'] = 'pending'
+            elif label == 'wrong_path':
+                changed['source'] = gate.DOC_SCOPE + 'D05_REMAINING_ORDER_CANDIDATE.json'
+            try:
+                if label == 'wrong_hash':
+                    with patch.object(gate, 'sha', return_value='0' * 64):
+                        gate.owner_authority(ref, changed, path)
+                else:
+                    gate.owner_authority(ref, changed, path)
+            except ValueError as exc:
+                results.append({'id': ref, 'case': label, 'result': 'rejected', 'error': str(exc)})
+            else:
+                raise AssertionError('negative accepted: ' + ref + ':' + label)
+    return {'scope': 'authority fixtures only; no native or acceptance proof', 'results': results}
+
+
+if __name__ == '__main__':
+    print(json.dumps(run(), ensure_ascii=False, indent=2))
@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+"""Candidate structure controls; no provenance or whole-role/native credit."""
+import argparse
+import importlib.util
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+
+sys.dont_write_bytecode = True
+ROOT = Path(__file__).resolve().parents[5]
+
+
+def load_gate():
+    spec = importlib.util.spec_from_file_location('candidate_gate', ROOT / 'tools/check_p04_order_evidence.py')
+    gate = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(gate)
+    return gate
+
+
+def expected_candidate(commit, tree, main, submitted, composed):
+    return {'structure_qualified': True, 'provenance_verified_by_checker': False,
+            'provenance_owner': 'actual Runner.prepare_integration/integrate and Root normal_c_join AFTER final before original credit',
+            'join': {'C': commit, 'S': submitted, 'M': main, 'C_tree': tree, 'Q': composed}}
+
+
+def run_pure():
+    """Three identity negatives and one exact positive; no Git or engine."""
+    gate = load_gate()
+    commit = '1111111111111111111111111111111111111111'
+    tree = '2222222222222222222222222222222222222222'
+    submitted = '3333333333333333333333333333333333333333'
+    other = '4444444444444444444444444444444444444444'
+    for args in ((commit, other, gate.MAIN_ANCHOR, submitted, tree),
+                 (commit, tree, other, submitted, tree),
+                 (submitted, tree, gate.MAIN_ANCHOR, submitted, tree)):
+        try:
+            gate.qualify_normal_candidate(*args)
+        except ValueError as exc:
+            assert str(exc) == 'normal candidate identity mismatch', str(exc)
+        else:
+            raise AssertionError('invalid candidate structure qualified')
+    args = (commit, tree, gate.MAIN_ANCHOR, submitted, tree)
+    assert gate.qualify_normal_candidate(*args) == expected_candidate(*args)
+    return {'scope': 'pure structure only', 'negative_controls': 3,
+            'exact_positive_controls': 1, 'formal_acceptance': False}
+
+
+def run():
+    gate = load_gate()
+    env = gate.git_environment()
+    env.update(GIT_AUTHOR_NAME='P04 isolated fixture', GIT_AUTHOR_EMAIL='fixture@invalid',
+               GIT_COMMITTER_NAME='P04 isolated fixture', GIT_COMMITTER_EMAIL='fixture@invalid')
+    with tempfile.TemporaryDirectory(prefix='p04-candidate-fixture-', dir='/tmp') as temp:
+        repo = Path(temp) / 'objects.git'
+        assert not repo.resolve().is_relative_to(ROOT.resolve())
+        subprocess.run(['git', '-c', 'core.hooksPath=/dev/null', 'clone', '--bare', '--shared',
+                        str(ROOT), str(repo)], env=env, check=True, capture_output=True)
+
+        def git(*args):
+            return subprocess.check_output(['git', '-c', 'core.hooksPath=/dev/null', *args],
+                                           cwd=repo, env=env, text=True).strip()
+
+        submission = git('rev-parse', 'HEAD')
+        main = gate.MAIN_ANCHOR
+        tree = git('merge-tree', '--write-tree', main, submission)
+        synthetic = git('commit-tree', tree, '-p', main, '-p', submission,
+                        '-m', 'synthetic C; no Root qualification')
+        assert git('show', '-s', '--format=%P', synthetic).split() == [main, submission]
+        assert git('rev-parse', synthetic + '^{tree}') == tree
+        result = gate.qualify_normal_candidate(synthetic, tree, main, submission, tree)
+        assert result == expected_candidate(synthetic, tree, main, submission, tree)
+    return {'scope': 'isolated candidate structure only; provenance remains external',
+            'synthetic_equal_parents_and_tree': result, 'formal_acceptance': False}
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--pure-only', action='store_true', help='no Git, engine or scratch directory')
+    args = parser.parse_args()
+    print(json.dumps(run_pure() if args.pure_only else run(), indent=2))
@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+"""Optional getter projection controls; these are never native proof."""
+import json
+import struct
+import sys
+
+sys.dont_write_bytecode = True
+import p04_native_series as s
+
+
+def string(value, kind=4):
+    data = value.encode()
+    return struct.pack('<II', kind, len(data)) + data + b'\0' * ((-len(data)) % 4)
+
+
+def integer(value):
+    return struct.pack('<Ii', 2, value)
+
+
+def dictionary(rows):
+    return struct.pack('<II', 27, len(rows)) + b''.join(k + v for k, v in rows)
+
+
+def array(values, typed=None):
+    return (struct.pack('<I', 28 if typed is None else 28 | (1 << 16)) +
+            (b'' if typed is None else struct.pack('<I', typed)) +
+            struct.pack('<I', len(values)) + b''.join(values))
+
+
+def run():
+    results = []
+    canonical = dictionary([(string('a'), array([string('item')])), (string('n'), integer(7))])
+    getter = dictionary([(string('n', 21), integer(7)),
+                         (string('a', 21), array([string('item', 21)], typed=21))])
+    assert s.persisted_day_projection(s.variant(getter)) == canonical
+    results.append({'case': 'typed_array_headers_and_StringName_only', 'result': 'accepted'})
+
+    def reject(name, action, error=None):
+        try:
+            action()
+        except ValueError as exc:
+            assert error is None or error in str(exc), (name, str(exc))
+            results.append({'case': name, 'result': 'rejected', 'error': str(exc)})
+        else:
+            raise AssertionError('negative accepted: ' + name)
+
+    def compare(data):
+        s.require(s.persisted_day_projection(s.variant(data)) == canonical, 'persisted value mismatch')
+
+    reject('dropped_field', lambda: compare(dictionary([(string('n'), integer(7))])))
+    reject('extra_field', lambda: compare(dictionary([(string('a'), array([string('item')])),
+                                                      (string('n'), integer(7)), (string('x'), integer(0))])))
+    reject('int_to_float', lambda: compare(dictionary([(string('a'), array([string('item')])),
+                                                       (string('n'), struct.pack('<If', 3, 7.0))])))
+    floating = dictionary([(string('n'), struct.pack('<If', 3, 7.0))])
+    reject('float_to_int', lambda: s.require(s.persisted_day_projection(s.variant(floating)) ==
+                                            dictionary([(string('n'), integer(7))]), 'numeric type changed'))
+    reject('value_change', lambda: compare(dictionary([(string('a'), array([string('item')])),
+                                                       (string('n'), integer(8))])))
+    reject('nonfinite_float', lambda: s.persisted_day_projection(s.variant(dictionary([
+        (string('n'), struct.pack('<If', 3, float('inf')))]))), 'NON_FINITE_NUMBER')
+    reject('invalid_key_type', lambda: s.persisted_day_projection(s.variant(dictionary([
+        (struct.pack('<II', 1, 1), integer(1))]))), 'INVALID_DICTIONARY_KEY')
+    reject('key_collision', lambda: s.persisted_day_projection(s.variant(dictionary([
+        (integer(1), integer(1)), (string('1'), integer(2))]))), 'DUPLICATE_CANONICAL_KEY')
+    reject('unsaveable_variant', lambda: s.persisted_day_projection(s.variant(dictionary([
+        (string('x'), struct.pack('<Iff', 5, 1.0, 2.0))]))), 'UNSAVEABLE_VARIANT')
+    reject('wrong_to_snapshot_variant_chain', lambda: s.persisted_day_projection(s.variant(getter),
+        chain='_to_snapshot_variant'), 'projection call chain')
+    reject('projection_on_native_persisted_comparison', lambda: s.persisted_day_projection(s.variant(getter),
+        comparison='native_expected_restored'), 'projection forbidden')
+    reject('single_string_budget', lambda: s.persisted_day_projection(s.variant(dictionary([
+        (string('x'), string('x' * 4097))]))), 'STRING_TOO_LONG')
+    reject('collection_budget', lambda: s.persisted_day_projection(s.variant(dictionary([
+        (string('x'), array([integer(0)] * 20001))]))), 'COLLECTION_TOO_LARGE')
+    nested = integer(1)
+    for _ in range(33):
+        nested = array([nested])
+    reject('depth_budget', lambda: s.persisted_day_projection(s.variant(dictionary([
+        (string('x'), nested)]))), 'MAX_VARIANT_DEPTH')
+    # The collision prepass must win over invalid-key and child errors.
+    reject('collision_error_precedence', lambda: s.persisted_day_projection(s.variant(dictionary([
+        (struct.pack('<II', 1, 1), struct.pack('<If', 3, float('inf'))),
+        (string('true'), integer(0))]))), 'DUPLICATE_CANONICAL_KEY')
+    return {'scope': 'synthetic projection controls only', 'results': results}
+
+
+if __name__ == '__main__':
+    print(json.dumps(run(), indent=2))
@@ -0,0 +1,155 @@
+#!/usr/bin/env python3
+"""Real B1/R2 positive controls and semantic mutation negatives for Root."""
+import argparse
+import copy
+import json
+from pathlib import Path
+import sys
+from unittest.mock import patch
+
+sys.dont_write_bytecode = True
+import p04_native_series as series
+from build_p04_index import checker
+
+
+def run(build):
+    gate = checker()
+    base = build / 'audit-support/native-first-current'
+    results = []
+
+    def reject(name, action):
+        try:
+            action()
+        except (ValueError, KeyError, TypeError) as exc:
+            results.append({'case': name, 'result': 'rejected', 'error': str(exc)})
+        else:
+            raise AssertionError('negative accepted: ' + name)
+
+    context = series.Series(build, 's3')
+    series.dependency_closure_diagnostic(context)
+    reject('B1_cannot_supply_power_stop', lambda: series.power_stop(context))
+    results.append({'case': 'B1_real_despawn_positive', 'result': 'accepted'})
+    original_value = context.value
+    for name, label, mutate in (
+        ('dependency_reason_relabelled_as_NO_POWER', 'after', lambda r: r['service'].update(interruption_reason='NO_POWER')),
+        ('B1_missing_at_closure', 'after', lambda r: r['guests'].update({'p04.s3.guest.b': {}})),
+        ('B1_synthetic_later_guest', 'next', lambda r: r['guests'].update({'p04.s3.guest.b': {'patience_remaining': 45}})),
+        ('B1_wrong_release_minute', 'next', lambda r: r['reservations'][1].update(terminal_at=961)),
+        ('B1_changed_wallet', 'recovered', lambda r: r['wallets'].update({'p04.s3.guest.b': 25})),
+        ('B1_missing_departure_history', 'next', lambda r: r['snapshot']['systems']['runtime']['guests'].update(persistent_records=[])),
+    ):
+        def altered(key, label=label, mutate=mutate):
+            value = copy.deepcopy(original_value(key))
+            if key == 'writer-B1-' + label:
+                mutate(value)
+            return value
+        with patch.object(context, 'value', altered):
+            reject(name, lambda: series.dependency_closure_diagnostic(context))
+    gate.verify_shift_completion(base)
+    results.append({'case': 'R2_real_first_1080_positive', 'result': 'accepted'})
+    original_load = gate.load
+    observation_path = base / 'actual-native/order-evidence/observations.json'
+    for name, mutate in (
+        ('R2_paid_midnight_substitution', lambda o: o['observations'][2]['service'].update(completed_at=1442)),
+        ('R2_wrong_transaction', lambda o: o['observations'][2]['receipts'][0].update(id='ledger_00000099')),
+        ('R2_missing_DAY2', lambda o: o['observations'][2].update(active_staff=[])),
+        ('R2_after_staff_still_present', lambda o: o['observations'][3].update(active_staff=['p04.order.server.a'])),
+        ('R2_next_extra_receipt', lambda o: o['observations'][5]['receipts'].append(copy.deepcopy(o['first_receipts'][0]))),
+    ):
+        def altered(path, mutate=mutate):
+            value = original_load(path)
+            if path == observation_path:
+                mutate(value)
+            return value
+        with patch.object(gate, 'load', altered):
+            reject(name, lambda: gate.verify_shift_completion(base))
+    # Dynamic IDs are legitimate when every raw join agrees. These are semantic
+    # overlays of already verified raw, not replacement native evidence.
+    shift = gate.verify_shift_completion(base)
+    old_pids = gate.native_ownership(base)
+    replacements = {pid: pid + 1000000 for pid in old_pids.values()}
+    replacements[shift['transaction_id']] = 'dynamic-sale-repair22'
+
+    def remap(value):
+        if isinstance(value, dict): return {k: remap(v) for k, v in value.items()}
+        if isinstance(value, list): return [remap(v) for v in value]
+        if isinstance(value, (str, int)) and not isinstance(value, bool):
+            return replacements.get(value, value)
+        return value
+
+    with patch.object(gate, 'load', lambda path: remap(original_load(path))):
+        dynamic = gate.verify_shift_completion(base)
+        assert dynamic['transaction_id'] == 'dynamic-sale-repair22'
+    results.append({'case': 'R2_dynamic_PID_and_transaction_positive', 'result': 'accepted'})
+    wrong_end = base / 'actual-native' / gate.NATIVE_RUNS['actual-native'][0] / 'ended.json'
+
+    def wrong_pid(path):
+        value = original_load(path)
+        if path == wrong_end: value['actual_pid'] += 1
+        return value
+
+    with patch.object(gate, 'load', wrong_pid):
+        reject('R2_wrong_PID_join', lambda: gate.verify_shift_completion(base))
+
+    s1 = series.Series(build, 's1')
+    series.s1_semantics(s1)
+    s1_value = s1.value
+    for name, mutate in (
+        ('S1_pre_travel_mismatch', lambda r: r['reserved_before_travel'].update(staff_cell=(6, 0, 1))),
+        ('S1_no_actual_outage', lambda r: r['reserve_exhausted_before_tick']['snapshot']['game_state']['resources'].update(mana=1)),
+    ):
+        def altered(key, mutate=mutate):
+            value = copy.deepcopy(s1_value(key))
+            if key == 'writer-landing-observations': mutate(value)
+            return value
+        with patch.object(s1, 'value', altered):
+            reject(name, lambda: series.s1_semantics(s1))
+
+    # S4 is deliberately unavailable until the single Root collection exists.
+    # Never substitute B1 or manufacture a positive raw fixture for it.
+    s4 = series.S4Series(build)
+    series.power_stop(s4)
+    results.append({'case': 'S4_real_NO_POWER_positive', 'result': 'accepted'})
+    s4_value = s4.value
+
+    def facility_change(row, field, value, kitchen=False):
+        target = row['kitchen' if kitchen else 'facility']
+        target[field] = value
+        for f in series.runtime(row)['facilities']['instances']:
+            if f['instance_id'] == target['instance_id']: f[field] = value
+
+    for name, mutate in (
+        ('S4_related_facility_operating_false', lambda r: r.update(related_facility_operating=False)),
+        ('S4_kitchen_unpowered', lambda r: facility_change(r, 'power_available', False, kitchen=True)),
+        ('S4_closure_confound', lambda r: facility_change(r, 'operator_open', False)),
+        ('S4_no_actual_outage', lambda r: facility_change(r, 'power_available', True)),
+        ('S4_wrong_transaction_join', lambda r: series.runtime(r)['economy']['idempotency'].clear()),
+    ):
+        def altered(key, mutate=mutate, name=name):
+            value = copy.deepcopy(s4_value(key))
+            label = 'recovered' if name == 'S4_wrong_transaction_join' else 'boundary'
+            if key == 'writer-S4-' + label: mutate(value)
+            return value
+        with patch.object(s4, 'value', altered):
+            reject(name, lambda: series.power_stop(s4))
+    # Rename every occurrence, including service.payment.<serviceID> keys.
+    original = s4_value('writer-S4-before')['service']
+    paid = series.sales(s4_value('writer-S4-recovered'))[0]
+    id_map = {original['service_id']: 'dynamic-service-22', paid['transaction_id']: 'dynamic-sale-22',
+              'service.payment.' + original['service_id']: 'service.payment.dynamic-service-22'}
+
+    def dynamic_ids(value):
+        if isinstance(value, dict): return {id_map.get(k, k): dynamic_ids(v) for k, v in value.items()}
+        if isinstance(value, list): return [dynamic_ids(v) for v in value]
+        return id_map.get(value, value) if isinstance(value, str) else value
+
+    with patch.object(s4, 'value', lambda key: dynamic_ids(s4_value(key))):
+        assert series.power_stop(s4)['transaction_id'] == 'dynamic-sale-22'
+    results.append({'case': 'S4_dynamic_service_and_sale_positive', 'result': 'accepted'})
+    return {'scope': 'semantic controls only; no new native execution', 'results': results}
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--build', type=Path, required=True)
+    print(json.dumps(run(parser.parse_args().build), indent=2))
@@ -0,0 +1,191 @@
+#!/usr/bin/env python3
+"""C component controls and raw mutations. No engine, Runner or acceptance."""
+import argparse
+import copy
+import hashlib
+import importlib.util
+import json
+import re
+from pathlib import Path
+import shutil
+import sys
+import tempfile
+
+sys.dont_write_bytecode = True
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parents[4]
+spec = importlib.util.spec_from_file_location('p04_native_gate', ROOT / 'tools/check_p04_order_evidence.py')
+gate = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(gate)
+
+
+def run(source):
+    results = []
+    for function in (gate.native_ownership, gate.native_saves, gate.native_ledger):
+        function(source)
+        results.append({'control': function.__name__ + '_supplied_raw', 'result': 'pass'})
+    gate.native_applicability(source)
+    results.append({'control': 'supplied_applicability', 'result': 'pass'})
+    native = gate.verify_native(source)
+    results.append({'control': 'verify_native_supplied_raw', 'result': 'pass', 'details': native})
+    with tempfile.TemporaryDirectory(prefix='.native-fixtures-', dir=HERE) as tmp:
+        base = Path(tmp) / 'raw'
+        shutil.copytree(source, base)
+        app_path = 'POST_P18_CURRENT_SOURCE_APPLICABILITY.json'
+        originals = {p.relative_to(base).as_posix(): p.read_bytes() for p in base.rglob('*') if p.is_file()}
+        changed = set()
+
+        def edit(name, mutation):
+            path = base / name
+            value = gate.load(path)
+            mutation(value)
+            path.write_text(json.dumps(value))
+            changed.add(name)
+
+        def refresh():
+            for manifest, key, field in (('OWNERSHIP_RAW_PROVENANCE.json', 'copied', 'target'),
+                                         ('SOURCE_MANIFEST.json', 'files', 'copy')):
+                def update(value):
+                    for row in value[key]:
+                        path = base / row[field]
+                        if path.is_file():
+                            row.update(bytes=path.stat().st_size, sha256=gate.sha(path))
+                edit(manifest, update)
+
+        def check(name, function, mutation, error, rehash=True):
+            for path in changed:
+                (base / path).write_bytes(originals[path])
+            changed.clear()
+            mutation()
+            if rehash:
+                refresh()
+            try:
+                function(base)
+            except (ValueError, KeyError, TypeError) as exc:
+                assert error in str(exc), (name, str(exc))
+                results.append({'control': name, 'result': 'rejected', 'error': str(exc),
+                                'manifest_hashes_refreshed': rehash})
+            else:
+                raise AssertionError('negative fixture accepted: ' + name)
+
+        def truncated_hash(kind):
+            def mutate(app):
+                for row in app['ordering_functions']:
+                    body = gate.function_bytes(gate.git_bytes(
+                        'show', app['production_commit'] + ':' + row['path']))[row['function']]
+                    if kind == 'signature':
+                        if row['function'] != '_complete_service_transaction':
+                            continue
+                        truncated = body.splitlines(keepends=True)[0]
+                    else:
+                        offsets = [m.start() for m in re.finditer(rb'(?m)^#', body)]
+                        offsets = [i for i in offsets if all(
+                            not line.strip() or line.startswith(b'#') for line in body[i:].splitlines())]
+                        if not offsets:
+                            continue
+                        truncated = body[:offsets[0]]
+                    assert truncated != body
+                    digest = hashlib.sha256(truncated).hexdigest()
+                    row.update(registered_body_sha256=digest, production_body_sha256=digest)
+                    return
+                raise AssertionError('no truncation target: ' + kind)
+            edit(app_path, mutate)
+        check('signature_line_sha', gate.native_applicability,
+              lambda: truncated_hash('signature'), 'native ordering bytes')
+        check('trailing_comment_excluded_sha', gate.native_applicability,
+              lambda: truncated_hash('comment'), 'native ordering bytes')
+
+        formal = 'dependency-formal-native/'
+        obs = 'dependency-midnight-native/order-evidence/observations.json'
+        reader = formal + 'restart-evidence/reader.json'
+        def corrupt():
+            name = 'actual-native/repro/stdout.log'
+            data = bytearray((base / name).read_bytes())
+            data[0] ^= 1
+            (base / name).write_bytes(data)
+            changed.add(name)
+        check('one_byte_raw', gate.native_ownership, corrupt, 'native SHA', False)
+        def remove_member():
+            name = formal + 'formal-packages/reader/paused/world.bin'
+            (base / name).unlink()
+            changed.add(name)
+        check('missing_member', gate.native_saves, remove_member, 'missing/outside')
+        check('writer_reader_same_pid', gate.native_ownership,
+              lambda: edit(reader, lambda d: d.update(pid=gate.load(base / (formal + 'restart-evidence/writer.json'))['pid'])),
+              'PID binding')
+        check('writer_reader_same_profile', gate.native_ownership,
+              lambda: edit(reader, lambda d: d.update(profile=gate.load(base / (formal + 'restart-evidence/writer.json'))['profile'])),
+              'profile reused')
+        check('abnormal_ended', gate.native_ownership,
+              lambda: edit(formal + 'reader/ended.json', lambda d: d.update(exit_code=1)), 'process bindings')
+        check('process_pid_changed', gate.native_ownership,
+              lambda: edit(formal + 'reader/process.json', lambda d: d.update(pid=d['pid'] + 1)), 'PID chain')
+        check('cleanup_missing', gate.native_ownership,
+              lambda: edit(formal + 'reader/outer-owned-finally.json', lambda d: d.update(cleanup=[])), 'cleanup binding')
+        check('execution_owned_pid_deleted', gate.native_ownership,
+              lambda: edit(formal + 'execution.json', lambda d: d['actual_captured_PIDs'].pop()), 'cleanup membership')
+        check('reader_receipt_row_duplicated', gate.native_ledger,
+              lambda: edit(reader, lambda d: d['results'][0]['receipts'][-1]['rows'].append(copy.deepcopy(d['results'][0]['receipts'][-1]['rows'][0]))),
+              'duplicate receipt row')
+        check('reader_receipt_row_deleted', gate.native_ledger,
+              lambda: edit(reader, lambda d: d['results'][0]['receipts'][-1]['rows'].pop()), 'reader receipt delta')
+        check('observation_receipt_deleted', gate.native_ledger,
+              lambda: edit(obs, lambda d: d['observations'][3]['receipts'].pop()), 'ledger receipt delta')
+        check('paused_sale_injected', gate.native_ledger,
+              lambda: edit(obs, lambda d: d['observations'][1]['receipts'].append(copy.deepcopy(d['observations'][3]['receipts'][-1]))),
+              'ledger receipt delta')
+        def joined_paused_sale():
+            observation = gate.load(base / obs)
+            receipt = copy.deepcopy(observation['observations'][3]['receipts'][-1])
+            sale = next(r for r in receipt['rows'] if r['category'] == 'SERVICE_SALE')
+            def inject(d):
+                paused = d['observations'][1]
+                paused['receipts'].append(receipt)
+                paused['wallet'] -= sale['amount']
+                paused['guest']['wallet_gold'] = paused['wallet']
+            edit(obs, inject)
+            edit('dependency-midnight-native/order-evidence/midnight-midnight.json',
+                 lambda d: d['systems']['runtime']['economy']['entries'].extend(receipt['rows']))
+        check('paused_sale_joined_ledger_wallet', gate.native_ledger, joined_paused_sale, 'PAUSED sale/progress/reason')
+        check('reservation_orphaned', gate.native_ledger,
+              lambda: edit(obs, lambda d: d['observations'][1]['reservations']['reservations'][0].update(requester_id='orphan')),
+              'reservation snapshot binding')
+        def joined_orphan():
+            edit(obs, lambda d: d['observations'][1]['reservations']['reservations'][0].update(requester_id='orphan'))
+            edit('dependency-midnight-native/order-evidence/midnight-midnight.json',
+                 lambda d: d['systems']['runtime']['inventory']['reservations'][0].update(requester_id='orphan'))
+        check('reservation_orphaned_both_snapshots', gate.native_ledger, joined_orphan, 'orphan reservation relation')
+        check('wallet_wrong', gate.native_ledger,
+              lambda: edit(obs, lambda d: d['observations'][3].update(wallet=d['observations'][3]['wallet'] + 1)), 'wallet delta')
+        state = 'dependency-midnight-native/order-evidence/midnight-after.json'
+        check('idempotency_wrong_transaction', gate.native_ledger,
+              lambda: edit(state, lambda d: next(r for r in d['systems']['runtime']['economy']['idempotency'] if r['key'].startswith('service.payment.')).update(transaction_id='wrong')),
+              'sale service join')
+        check('production_commit_mismatch', gate.native_applicability,
+              lambda: edit('ROOT_APPROVED_DEPENDENCY_FORMAL_RESULT.json', lambda d: d.update(production_commit=gate.REGISTERED_COMMIT)),
+              'production commit mismatch')
+        check('current_source_pin_mismatch', gate.native_applicability,
+              lambda: edit(app_path, lambda d: d['registered_source_pins'][0].update(production_sha256='0' * 64)),
+              'current_source_pins mismatch')
+        check('input_source_pin_mismatch', gate.native_applicability,
+              lambda: edit(formal + 'runner-input.json', lambda d: d['selected_source_map'].update({'autoload/simulation_runtime.gd': '0' * 64})),
+              'input source pin mismatch')
+        check('original_member_changed', gate.native_saves,
+              lambda: edit(formal + 'execution.json', lambda d: d['formal_after']['before']['world.bin'].update(sha256='0' * 64)),
+              'original members changed')
+        def typed_corrupt():
+            name = formal + 'restart-evidence/reader-before-loaded.var'
+            (base / name).write_bytes(b'forged typed bytes')
+            changed.add(name)
+        check('typed_var_changed', gate.native_saves, typed_corrupt, 'typed SHA mismatch')
+        check('self_reported_scalar_true', gate.native_ledger,
+              lambda: edit(reader, lambda d: d.update(results=[{'receipts': [], 'sale_count': 1}],
+                                                      passed=True, formal_save_restored=True)), 'reader receipt delta')
+    return {'scope': 'C Python controls on supplied raw; no formal acceptance',
+            'formal_original_credit': 0, 'engine_runs': 0, 'results': results}
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('native_bundle', type=Path)
+    print(json.dumps(run(parser.parse_args().native_bundle), ensure_ascii=False, indent=2))
@@ -0,0 +1,178 @@
+#!/usr/bin/env python3
+"""Synthetic checker fixtures only; never engine/acceptance evidence."""
+import copy
+import hashlib
+import importlib.util
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[5]
+CHECKER = ROOT / 'tools/check_p04_order_evidence.py'
+spec = importlib.util.spec_from_file_location('p04_checker', CHECKER)
+gate = importlib.util.module_from_spec(spec)
+sys.dont_write_bytecode = True
+spec.loader.exec_module(gate)
+
+
+def run():
+    results = []
+    with tempfile.TemporaryDirectory(prefix='.checker-fixtures-', dir=Path(__file__).parent) as temp:
+        base = Path(temp)
+        # Keep py_compile output inside allowed_paths; delete with the fixture.
+        env = dict(os.environ, PYTHONPYCACHEPREFIX=str(base / 'pycache'))
+        subprocess.run(['python3', '-m', 'py_compile', str(CHECKER)], env=env, check=True)
+        evidence = base / 'p04-evidence'
+        evidence.mkdir()
+        artifacts = {}
+        def add(aid, value, kind='observation'):
+            data = value if isinstance(value, bytes) else json.dumps(value).encode()
+            path = evidence / (aid + '.json')
+            path.write_bytes(data)
+            artifacts[aid] = dict(path=path.name, bytes=len(data),
+                                  sha256=hashlib.sha256(data).hexdigest(), type=kind)
+            return aid
+        oldmap = gate.load(ROOT / 'docs/plans/original-completion-2026-10-02/execution/p04-01-input-r01/historical-source-map.json')
+        source = {p: gate.sha(ROOT / p) for p in oldmap if p.endswith('.gd') and p.startswith(('autoload/', 'scripts/'))}
+        for folder in ('autoload', 'scripts'):
+            source.update({p.relative_to(ROOT).as_posix(): gate.sha(p) for p in (ROOT / folder).rglob('*.gd')})
+        add('fixture_environment', b'SYNTHETIC CHECKER FIXTURE - NOT AN ENGINE')
+        environment = dict(os='synthetic-checker-fixture', **{
+            k: {'fixture_environment.json': artifacts['fixture_environment']['sha256']}
+            for k in ('engine', 'configuration', 'inputs')})
+        add('baseline', (ROOT / 'docs/traceability/original/BASELINE.txt').read_bytes(), 'authority')
+        add('decisions', (ROOT / 'docs/DESIGN_DECISIONS.md').read_bytes(), 'authority')
+        add('a01', (ROOT / 'docs/plans/original-completion-2026-10-02/execution/p04-01-input-r01/ORDER_CONTRACT_DRAFT.md').read_bytes(), 'authority')
+        add('owner', (ROOT / 'docs/plans/original-completion-2026-10-02/execution/p04-01/D05_OWNER_APPROVAL.json').read_bytes(), 'authority')
+        add('remaining_owner', (ROOT / gate.DOC_SCOPE / 'D05_REMAINING_APPROVAL.json').read_bytes(), 'authority')
+        authority = {ref: dict(status='approved', artifact_id=(
+            ('owner' if gate.OWNER_BINDINGS[ref][0].endswith('/D05_OWNER_APPROVAL.json') else 'remaining_owner') if ref.startswith('D05-P04-') else 'baseline' if ref.startswith('BASELINE:')
+            else 'decisions' if ref == 'D-034' else 'a01'))
+            for _, refs, _ in gate.REQUIRED.values() for ref in refs}
+        for ref, (relative, digest) in gate.OWNER_BINDINGS.items():
+            authority[ref]['source'] = relative
+        add('stdout', b'SYNTHETIC fixture log', 'stdout')
+        add('native_log', b'SYNTHETIC fixture log', 'native_log')
+        domains = {d: dict(source_refs=[dict(path='autoload/simulation_runtime.gd', function='_advance_facilities',
+                      sha256=source['autoload/simulation_runtime.gd'])], authority_refs=[],
+                      cases=[], invariants=[], applicability=dict(source_map=source, environment=environment))
+                   for d in gate.DOMAINS}
+        conditions = {}
+        for cid, (d, refs, metrics) in gate.REQUIRED.items():
+            domain = domains[d]
+            domain['authority_refs'] = sorted(set(domain['authority_refs']) | set(refs))
+            case = dict(id=cid, raw_origin='engine')
+            for field in ('input', 'before', 'operation', 'after'):
+                case[field] = add(cid + '_' + field, {'conditions': {cid: metrics}} if field == 'after' else {'fixture': True})
+            receipt = dict(start_pid=101, end_pid=101, exit_code=0, engine_ended=True,
+                           case_id=cid, source_map=source, environment=environment,
+                           stdout='stdout', native_log='native_log',
+                           artifact_hashes={f: artifacts[case[f]]['sha256'] for f in ('input', 'before', 'operation', 'after')})
+            condition = dict(case_id=cid, authority_refs=list(refs), nativeWindows='pending')
+            if cid == 'save_restore':
+                condition['save_artifact'] = add('save', b'SYNTHETIC save', 'save')
+                receipt['saved_sha256'] = artifacts['save']['sha256']
+                reader = dict(receipt, start_pid=102, end_pid=102, restored_sha256=artifacts['save']['sha256'])
+                condition['restore_receipt'] = add('reader', reader, 'receipt')
+            case['receipt'] = add(cid + '_receipt', receipt, 'receipt')
+            domain['cases'].append(case)
+            for metric, value in metrics.items():
+                domain['invariants'].append(dict(case_id=cid, artifact_id=case['after'],
+                    json_pointer='/conditions/' + cid + '/' + metric, operator='eq', expected=value,
+                    authority_ref=refs[0], raw_origin='engine'))
+            conditions[cid] = condition
+        # EV case has a separate, reachable reserved-staff scenario.
+        ev_case = copy.deepcopy(domains['停電']['cases'][0])
+        ev_case['id'] = 'ev_stop'
+        ev_case['after'] = add('ev_after', {'ev': dict(orphan_reservations=0, reserved_before_travel=True, power_stopped=True)})
+        receipt = gate.load(evidence / artifacts[ev_case['receipt']]['path'])
+        receipt['case_id'] = ev_case['id']
+        receipt['artifact_hashes']['after'] = artifacts['ev_after']['sha256']
+        ev_case['receipt'] = add('ev_receipt', receipt, 'receipt')
+        domains['停電']['cases'].append(ev_case)
+        domains['停電']['invariants'].append(dict(case_id='ev_stop', artifact_id='ev_after',
+            json_pointer='/ev/orphan_reservations', operator='eq', expected=0,
+            authority_ref='BASELINE:183', raw_origin='engine'))
+        reachability = {}
+        for name, refs in gate.REACH_REFS.items():
+            reachability[name] = dict(reach=name == 'EV', reason='Synthetic static-chain fixture',
+                source_refs=[dict(path=p, sha256=source[p], function=f, anchor_sha256=h,
+                                  line_count=n) for p,f,h,n in refs])
+        reachability['EV']['case_id'] = 'ev_stop'
+        index = dict(schema_version=1, task_id='P04-01', formal_acceptance=False,
+            candidate_commit=subprocess.check_output(['git','rev-parse','HEAD'], cwd=ROOT, text=True).strip(),
+            source_map=source, environment=environment, artifacts=artifacts, authority=authority,
+            domains=domains, conditions=conditions, reachability=reachability, review_status='pending_review')
+        index['registered_pins'] = gate.load(gate.SPEC)['current_source_pins']
+        index['versions'] = dict(execution_origin=gate.EXECUTION_ORIGIN,
+            registered=gate.REGISTERED_COMMIT, tested=index['candidate_commit'], integration=None)
+        index['applicability_delta'] = gate.source_delta(gate.REGISTERED_COMMIT, index['candidate_commit'])
+        index['delta_cases'] = {row['path'] + ':' + row['function']: {
+            cid: ('ev_stop' if cid == 'EV' else cid)
+            for cid in gate.boundary_conditions(row['path'], row['function'])}
+            for row in index['applicability_delta']}
+        original_files = {p.name:p.read_bytes() for p in evidence.iterdir()}
+        index = copy.deepcopy(index)
+        def check(name, mutate, error):
+            for p in evidence.iterdir():
+                p.unlink()
+            for name_, data in original_files.items():
+                (evidence / name_).write_bytes(data)
+            candidate = copy.deepcopy(index)
+            mutate(candidate)
+            if name != 'missing_index':
+                (evidence / 'index.json').write_text(json.dumps(candidate))
+            if name == 'duplicate_key':
+                (evidence / 'index.json').write_text('{"schema_version":1,"schema_version":1}')
+            # These are content-layer unit cases. Stage-A real Git/FS controls
+            # live in checker_role_fixtures.py; no production bypass is added.
+            head = index['candidate_commit']
+            with patch.object(gate, 'verify_roles', return_value=(head, {})), patch.dict(
+                    os.environ, {'BUILD_OUTPUT_DIR': str(base), 'P04_EVIDENCE_DIR': str(evidence)}):
+                try:
+                    gate.verify(base)
+                    code, output = 0, {}
+                except (ValueError, OSError, KeyError, TypeError) as exc:
+                    code, output = 1, {'error': str(exc)}
+            assert code == (0 if error is None else 1), (name, output)
+            assert error is None or error in output.get('error',''), (name, output)
+            results.append(dict(fixture=name, exit_code=code, result=output))
+        check('synthetic_scalar_only_rejected', lambda i: None, 'native bundle required')
+        check('forged_registered_pin', lambda i: i['registered_pins'].update({'autoload/simulation_runtime.gd':'0'*64}), 'registered pin declaration')
+        check('false_delta', lambda i: i['applicability_delta'].append({'path':'autoload/simulation_runtime.gd','function':'initialize'}), 'git diff/applicability_delta mismatch')
+        check('wrong_reach_anchor', lambda i: i['reachability']['EV']['source_refs'][0].update(anchor_sha256='0'*64), 'unknown reachability anchor')
+        check('missing_index', lambda i: None, 'missing/outside')
+        check('duplicate_key', lambda i: None, 'duplicate JSON key')
+        def symlink(i):
+            (evidence / 'stdout.json').unlink()
+            (evidence / 'stdout.json').symlink_to(evidence / 'native_log.json')
+        check('symlink', symlink, 'symlink')
+        check('hash_mismatch', lambda i: i['artifacts']['stdout'].update(sha256='0'*64), 'artifact hash')
+        check('stale_pin', lambda i: i['source_map'].update({'autoload/simulation_runtime.gd':'0'*64}), 'tested game differs from Git')
+        def receipt_mutation(i):
+            aid = 'power_stop_receipt'
+            value = gate.load(evidence / artifacts[aid]['path'])
+            value['engine_ended'] = False
+            add(aid, value, 'receipt')
+            i['artifacts'][aid] = copy.deepcopy(artifacts[aid])
+        check('unexecuted_receipt', receipt_mutation, 'unexecuted/incomplete receipt')
+        check('pending_authority', lambda i: i['authority']['D05-P04-DEPENDENCY'].update(status='pending'), 'pending/missing authority')
+        check('missing_condition', lambda i: i['conditions'].pop('paused_midnight'), 'mandatory conditions')
+        check('unsupported_reach_false', lambda i: i['reachability']['transport'].update(reach=False, source_refs=[]), 'unsupported reach=false')
+        def owner_mutation(i):
+            aid = 'owner'
+            data = (evidence / 'owner.json').read_bytes() + b' '
+            add(aid, data, 'authority')
+            i['artifacts'][aid] = copy.deepcopy(artifacts[aid])
+        check('owner_hash_mismatch', owner_mutation, 'owner approval hash mismatch')
+    return dict(scope='Synthetic checker checks only; no engine evidence or formal acceptance',
+                py_compile=True, results=results)
+
+
+if __name__ == '__main__':
+    print(json.dumps(run(), ensure_ascii=False, indent=2))
+
@@ -0,0 +1,147 @@
+#!/usr/bin/env python3
+"""Real temp-Git role controls. Root executes after auto-submit; never evidence."""
+import argparse
+import copy
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+
+sys.dont_write_bytecode = True
+ROOT = Path(__file__).resolve().parents[5]
+
+
+def run(build, evidence):
+    build, evidence = build.resolve(strict=True), evidence.resolve(strict=True)
+    original = json.loads((evidence / 'index.json').read_text())
+    results = []
+    env = dict(os.environ, BUILD_OUTPUT_DIR=str(build), PYTHONDONTWRITEBYTECODE='1',
+               GIT_CONFIG_NOSYSTEM='1', GIT_AUTHOR_NAME='P04 fixture', GIT_AUTHOR_EMAIL='fixture@invalid',
+               GIT_COMMITTER_NAME='P04 fixture', GIT_COMMITTER_EMAIL='fixture@invalid')
+    for name in ('GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY',
+                 'GIT_ALTERNATE_OBJECT_DIRECTORIES'):
+        env.pop(name, None)
+    # Never let a task build path put Git objects inside the source repository.
+    # /tmp is explicit so an inherited TMPDIR cannot redirect writes into it.
+    with tempfile.TemporaryDirectory(prefix='p04-role-fixtures-', dir='/tmp') as temp:
+        base = Path(temp)
+        assert not base.resolve().is_relative_to(ROOT.resolve())
+        checkout = base / 'checkout'
+        subprocess.run(['git', 'clone', '--shared', '--no-checkout', str(ROOT), str(checkout)],
+                       env=env, check=True, capture_output=True)
+
+        def git(*args):
+            return subprocess.check_output(['git', '-c', 'core.hooksPath=/dev/null', *args], cwd=checkout, env=env).decode().strip()
+
+        actual = git('rev-parse', 'HEAD')
+        anchor = 'c0ea009b28a7649aca6a433a1a24dc0be5e7ab81'
+        ancestry = subprocess.run(['git', 'merge-base', '--is-ancestor', anchor, actual], cwd=checkout, env=env)
+        submission = git('show', '-s', '--format=%P', actual).split()[1] if ancestry.returncode == 0 else actual
+        git('checkout', '--detach', submission)
+        # Objects created by clone commits/merge-tree remain under build. The
+        # shared canonical objects are consulted as read-only alternates only.
+        probe = base / 'probe.py'
+        probe.write_text(
+            'import importlib.util,json,sys\nfrom pathlib import Path\n'
+            'sys.dont_write_bytecode=True\n'
+            's=importlib.util.spec_from_file_location("gate",Path.cwd()/"tools/check_p04_order_evidence.py")\n'
+            'g=importlib.util.module_from_spec(s);sys.modules[s.name]=g;s.loader.exec_module(g)\n'
+            'with g.isolated_objects():\n'
+            ' g.verify_roles(json.loads(Path(sys.argv[1]).read_text()),Path(sys.argv[2]))\n')
+        index_path = base / 'index.json'
+
+        def check(name, index=None, positive=False, full=False, no_context_gap=False):
+            index_path.write_text(json.dumps(original if index is None else index))
+            if full:
+                directory = base / name
+                directory.mkdir()
+                (directory / 'index.json').write_text(index_path.read_text())
+                command = [sys.executable, 'tools/check_p04_order_evidence.py', '--verify-only']
+                process_env = dict(env, P04_EVIDENCE_DIR=str(directory))
+            else:
+                command = [sys.executable, str(probe), str(index_path), str(build)]
+                process_env = env
+            process = subprocess.run(command, cwd=checkout, env=process_env, capture_output=True, text=True)
+            if no_context_gap:
+                assert 'qualification context gap' not in process.stderr, (name, process.stderr)
+            if positive is not None:
+                assert (process.returncode == 0) == positive, (name, process.stdout, process.stderr)
+            results.append({'case': name, 'result': 'command_completed' if process.returncode == 0 else 'command_rejected',
+                            'returncode': process.returncode, 'formal_acceptance': False,
+                            'stdout': process.stdout, 'stderr': process.stderr})
+
+        check('real_submission_positive', positive=True)
+        game = checkout / 'project.godot'
+        original_game = game.read_bytes()
+        game.write_bytes(original_game + b'\n')
+        check('HEAD_tree_FS_mismatch')
+        game.write_bytes(original_game)
+        game.unlink()
+        game.symlink_to(base / 'outside')
+        (base / 'outside').write_bytes(original_game)
+        check('symlink_substitution')
+        game.unlink()
+        game.write_bytes(original_game)
+        unknown = checkout / 'scripts/p04_unknown.gd'
+        unknown.write_text('extends RefCounted\n')
+        check('untracked_substitution')
+        git('add', 'scripts/p04_unknown.gd')
+        git('commit', '-m', 'fixture unknown source')
+        check('unknown_source_commit')
+        git('reset', '--hard', submission)
+        game.unlink()
+        git('add', '-u')
+        git('commit', '-m', 'fixture deleted source')
+        check('deleted_source_commit')
+        git('reset', '--hard', submission)
+        changed = copy.deepcopy(original)
+        changed['product_binding']['tested_product'] = submission
+        check('wrong_tested_revision', changed)
+        for name, key, value in [('forged_candidate', 'candidate_tree', '0' * 40),
+                                 ('code_only_real_candidate', 'code_only', True),
+                                 ('phase_bypass', 'phase', 'candidate')]:
+            changed = copy.deepcopy(original)
+            changed[key] = value
+            check(name, changed)
+        git('checkout', '--detach', anchor)
+        git('merge', '--no-ff', '--no-edit', submission)
+        merged = git('rev-parse', 'HEAD')
+        # A normal commit C cannot be relabelled as tested non-production Q.
+        changed = copy.deepcopy(original)
+        changed['product_binding']['tested_product'] = merged
+        check('normal_C_cannot_impersonate_Q', changed)
+        changed = copy.deepcopy(original)
+        changed['product_binding']['tested_product'] = git('rev-parse', anchor + '^{tree}')
+        check('main_tree_cannot_impersonate_Q', changed)
+        # A merge made by this fixture has no independent normal-C provenance.
+        # Structure qualifies; provenance and credit remain external.
+        check('unqualified_merge_structure', positive=True, no_context_gap=True)
+        check('unqualified_merge_downstream', positive=None, full=True, no_context_gap=True)
+        synthetic = git('commit-tree', git('rev-parse', merged + '^{tree}'),
+                        '-p', anchor, '-p', submission, '-m', 'synthetic normal C')
+        git('checkout', '--detach', synthetic)
+        check('synthetic_identical_parents_tree_structure', positive=True, no_context_gap=True)
+        check('synthetic_identical_parents_tree_downstream', positive=None, full=True, no_context_gap=True)
+        git('checkout', '--detach', merged)
+        game.unlink()
+        git('add', '-u')
+        git('commit', '--amend', '--no-edit')
+        changed = copy.deepcopy(original)
+        changed['product_binding']['metadata'] = ['project.godot']
+        check('metadata_hiding_deleted_source', changed)
+        git('reset', '--hard', merged)
+        changed = copy.deepcopy(original)
+        changed['conditions']['power_stop']['required_measurements']['charges'] = 9
+        check('forged_index', changed, full=True)
+    return {'scope': 'fixture controls only', 'formal_acceptance': False,
+            'condition_credit': 0, 'results': results}
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--build', required=True, type=Path)
+    parser.add_argument('--evidence', required=True, type=Path)
+    args = parser.parse_args()
+    print(json.dumps(run(args.build, args.evidence), indent=2))
@@ -0,0 +1,123 @@
+#!/usr/bin/env python3
+"""Stage R file-only controls. Synthetic primitive controls plus real raw controls.
+
+Tests never alter supplied originals or the relocation. In-memory overlays are
+used for native descriptor/raw adversaries; filesystem adversaries are disposable.
+"""
+import argparse
+import copy
+import json
+from pathlib import Path
+import struct
+import sys
+import tempfile
+from unittest.mock import patch
+
+sys.dont_write_bytecode = True
+import p04_native_series as s
+
+
+def run(build):
+    results = []
+
+    def reject(series, name, action):
+        try:
+            action()
+        except (ValueError, KeyError, OSError, TypeError, UnicodeError) as exc:
+            results.append({'series': series, 'class': name, 'result': 'rejected', 'error': str(exc)})
+        else:
+            raise AssertionError('negative accepted: ' + series + '/' + name)
+
+    with tempfile.TemporaryDirectory(prefix='.series-fixtures-', dir=s.HERE) as tmp:
+        base = Path(tmp)
+        data = b'func boundary():\n\treturn 42\n# included trailing comment\n'
+        path = base / 'body.gd'
+        path.write_bytes(data)
+        pin = {'sha256': s.digest(data), 'bytes': len(data)}
+        # A deliberately small resolver fixture bypasses the production-only
+        # fixed 1721-file constructor, but exercises its exact read path.
+        resolver = s.Resolver.__new__(s.Resolver)
+        resolver.base, resolver.used = base, {}
+        resolver.mapping = {'/native/body.gd': dict(pin, relocated=str(path))}
+        resolver.manifest = {'product_source': {'body.gd': dict(pin, path='/native/body.gd')}}
+        assert resolver.read('/native/body.gd', pin) == data
+        assert s.variant(struct.pack('<Ii', 2, 42)).plain() == 42
+        assert s.checked(data, pin, 'positive') == data
+        results.append({'series': 'shared', 'class': 'small_synthetic_positive', 'result': 'pass'})
+        link = base / 'symlink.gd'
+        link.symlink_to(path)
+        for name in s.NATIVE_PINS:
+            context = s.Series.__new__(s.Series)
+            context.build, context.run, context.references = base, s.RUNS[name], {}
+            body_row = {'path': 'body.gd', 'function': 'boundary',
+                        'production_body_sha256': s.digest(data), 'registered_body_sha256': s.digest(data)}
+            s.source_body_pins(resolver, [body_row])
+            results.append({'series': name, 'class': 'full_body_positive', 'result': 'pass'})
+            reject(name, 'wrong_source_pin', lambda: resolver.read('/native/body.gd', dict(pin, sha256='0' * 64)))
+            signature = s.digest(data.splitlines(keepends=True)[0])
+            reject(name, 'signature_only_pin', lambda: s.source_body_pins(resolver, [dict(
+                body_row, production_body_sha256=signature, registered_body_sha256=signature)]))
+            reject(name, 'symlink', lambda: s.ordinary(link))
+            reject(name, 'traversal', lambda: context.read_build('../body.gd'))
+            reject(name, 'unmapped_original_path', lambda: resolver.read('/native/unknown.gd', pin))
+            reject(name, 'relocated_manifest_native_mismatch', lambda: resolver.read('/native/body.gd', dict(pin, bytes=len(data)+1)))
+            path.write_bytes(data + b'!')
+            try:
+                reject(name, 'relocated_byte_manifest_mismatch', lambda: resolver.read('/native/body.gd', pin))
+            finally:
+                path.write_bytes(data)
+            reject(name, 'JSON_only_getter_substitute', lambda: s.variant(b'{"getter": {}, "passed": true}'))
+
+            # Each series' real verifier is called for descriptor/raw overlays.
+            # The native descriptor pins are intentionally not refreshed: these
+            # runs and their original native descriptors are immutable inputs.
+            original_read = s.Series.read_build
+            run_name = s.RUNS[name]
+            targets = {
+                'forged_scalar': run_name + '/raw/writer.json',
+                'changed_raw_byte': run_name + '/raw/writer.json',
+                'formal_member_SHA_drift': run_name + '/execution.json',
+                'unowned_missing_PID_end': run_name + '/writer/ended.json',
+                'altered_phase_pair': run_name + '/raw/' + {
+                    's1': 'reader-landing-held.var', 's2a': 'reader-C3-recall.var',
+                    's2b': 'reader-night_absent-1080-before-facility.var',
+                    's3': 'reader-B1-phase-960-TIME_BOUNDARIES.var'}[name],
+                'relabeled_interruption_reason': run_name + '/raw/' + {
+                    's1': 'writer-landing-depleted.json', 's2a': 'writer-C1-midnight.json',
+                    's2b': 'writer-night_absent-1081.json', 's3': 'writer-B1-after.json'}[name],
+            }
+            for label, target in targets.items():
+                def overlay(self, relative, descriptor=None, target=target, label=label):
+                    if relative != target:
+                        return original_read(self, relative, descriptor)
+                    raw = s.ordinary(self.build / relative).read_bytes()
+                    if label in ('changed_raw_byte', 'altered_phase_pair'):
+                        raw += b' '
+                    else:
+                        obj = s.loads(raw)
+                        if label == 'unowned_missing_PID_end':
+                            obj['event'] = 'ENGINE_STARTED'
+                        elif label == 'forged_scalar':
+                            obj.update(passed=True, verified_conditions=list(s.RUNS), slots={})
+                        elif label == 'formal_member_SHA_drift':
+                            slot = next(iter(obj['formal_before']))
+                            obj['formal_before'][slot]['world.bin']['sha256'] = '0' * 64
+                        elif label == 'relabeled_interruption_reason':
+                            if 'service' in obj:
+                                obj['service']['interruption_reason'] = 'NO_POWER'
+                            else:
+                                obj['task']['state_reason'] = 'NO_POWER'
+                        raw = json.dumps(obj).encode()
+                    if descriptor is not None:
+                        s.checked(raw, descriptor, relative)
+                    return raw
+                with patch.object(s.Series, 'read_build', overlay):
+                    reject(name, label, lambda name=name: getattr(s, 'verify_' + name)(build))
+    return {'scope': 'file-only Stage R controls; immutable descriptor and primitive negatives',
+            'formal_acceptance': False, 'results': results}
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--build', type=Path, required=True)
+    print(json.dumps(run(parser.parse_args().build), indent=2, sort_keys=True))
@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+"""Deterministic reference-only Stage R collector; never writes the final index."""
+import argparse
+import json
+from pathlib import Path
+import shutil
+import sys
+
+sys.dont_write_bytecode = True
+import p04_native_series as series
+
+
+def encoded(value):
+    return (json.dumps(value, sort_keys=True, indent=2, ensure_ascii=False) + '\n').encode()
+
+
+def collect(build):
+    build = Path(build).absolute()
+    destination = build / 'audit-support/p04-raw-collect-r22'
+    series.require(not destination.exists() and not destination.is_symlink(), 'collection destination already exists')
+    for p in (destination.parent, *destination.parents):
+        series.require(not p.is_symlink(), 'collection parent symlink')
+    payloads = {}
+    bindings = {}
+    for name in series.RUNS:
+        result = getattr(series, 'verify_' + name)(build)
+        result['verifier_sha256'] = series.digest(Path(series.__file__).read_bytes())
+        data = encoded(result)
+        filename = name + '.json'
+        payloads[filename] = data
+        bindings[name] = {'path': filename, 'bytes': len(data), 'sha256': series.digest(data),
+                          'relocation_manifest_sha256': series.MANIFEST_SHA256}
+    manifest = {'protocol': 'p04-native-series-collection-v1', 'formal_acceptance': False,
+                'stage_A': 'candidate binding stage A pending', 'series': bindings,
+                'relocation_manifest_sha256': series.MANIFEST_SHA256,
+                'relocation_manifest': 'audit-support/p04-r17-full-inputs-r01/MANIFEST.json',
+                'collector_sha256': series.digest(Path(__file__).read_bytes()),
+                'large_payloads_copied': 0}
+    payloads['MANIFEST.json'] = encoded(manifest)
+    estimate = sum(len(v) for v in payloads.values())
+    # The estimate precedes all writes. Reserve extra directory/allocation space.
+    print(json.dumps({'estimated_payload_bytes': estimate, 'files': len(payloads),
+                      'available_disk_bytes': shutil.disk_usage(destination.parent).free,
+                      'large_payloads_copied': 0}), flush=True)
+    series.require(shutil.disk_usage(destination.parent).free > estimate + 1048576, 'insufficient disk for pointers')
+    destination.mkdir()  # exclusive creation: a previous collection is never overwritten
+    for name, data in sorted(payloads.items()):
+        with (destination / name).open('xb') as output:
+            output.write(data)
+    print(json.dumps({'collection': str(destination), 'manifest_sha256': series.digest(payloads['MANIFEST.json']),
+                      'actual_payload_bytes': estimate, 'formal_acceptance': False}))
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--build', type=Path, required=True)
+    try:
+        collect(parser.parse_args().build)
+    except (ValueError, OSError, KeyError, TypeError) as exc:
+        print(json.dumps({'collected': False, 'error': str(exc)}))
+        sys.exit(1)
@@ -0,0 +1,21 @@
+{
+  "task_id": "P04-01",
+  "base_commit": "deb1bcb2374eb378b840ca345db952bd8572cb6e",
+  "status": "blocked",
+  "preexisting_files": ["order-audit.json", "ORDER_AUDIT.md"],
+  "verifier_created": false,
+  "blockers": [
+    "Local inputs specify no evidence index schema, mandatory proof identifiers, raw-proof predicates or authority binding. Implementing an accepting verifier would supplement unspecified requirements.",
+    "D05 remains pending; approved A01 is retained without reconfirmation.",
+    "Verified local historical raw proofs and exact old Runtime source are required for reuse and exact diff. Artifact paths are provenance only."
+  ],
+  "read_only_observations": [
+    "Current kernel lines 123-153 and Runtime registrations 364-427 confirm the phase sequence recorded in the preexisting audit.",
+    "Git read-only path history lists ten Runtime revisions; this turn has not scanned their content hashes."
+  ],
+  "hash_reconfirmation": "Not completed: shell rejected temporary-file creation for the Python here-document before execution. Preexisting hash claims are not new verification results.",
+  "tests_executed": false,
+  "original_unit_complete": false,
+  "counted_units_added": 0,
+  "next_step": "Supply evidence protocol and verified local historical source/raw proofs; Runner performs formal validation and independent review."
+}
@@ -0,0 +1,132 @@
+#!/usr/bin/env python3
+"""Root-only, read-only join of actual Runner records; never grants acceptance.
+
+Root must select the real Runner state.sqlite, not a hand-written export. This
+checks consistency, not authenticity of an arbitrary caller-supplied database.
+No Git, engine, Runner API, SQL mutation or temporary file is used.
+Root retains a read-only Runner snapshot taken after approve; integrate deletes
+the live approval. Final evidence is read separately from the current database.
+"""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import re
+import sqlite3
+
+MAIN = "c0ea009b28a7649aca6a433a1a24dc0be5e7ab81"
+SPEC = "9ec722e7dfb0bee178d291624a026420c08412574e238bba1fde012c7a6f7881"
+
+
+def require(value, message):
+    if not value:
+        raise ValueError(message)
+
+
+def unique(pairs):
+    out = {}
+    for key, value in pairs:
+        require(key not in out, "duplicate JSON key")
+        out[key] = value
+    return out
+
+
+def read(path, hashes):
+    path = Path(path)
+    require(path.is_file() and not path.is_symlink(), "ordinary record required: " + str(path))
+    require("normal-candidate-example" not in path.parts, "format samples are not authority")
+    data = path.read_bytes()
+    hashes[str(path)] = hashlib.sha256(data).hexdigest()
+    result = json.loads(data, object_pairs_hook=unique)
+    require(isinstance(result, dict) and not result.get("example_only_not_P04_authority"), "actual record required")
+    return result
+
+
+def verify(database, approved_database, candidate, submission, hashes):
+    for sha in (candidate, submission):
+        require(re.fullmatch(r"[0-9a-f]{40}", sha), "full commit SHA required")
+    database = database.resolve(strict=True)
+    require(database.is_file(), "Runner database required")
+    # mode=ro deliberately reads live WAL consistently; immutable=1 would hide it.
+    with sqlite3.connect(database.as_uri() + "?mode=ro", uri=True) as db:
+        db.row_factory = sqlite3.Row
+        db.execute("PRAGMA query_only=ON")
+        db.execute("BEGIN")
+        task = db.execute("SELECT * FROM tasks WHERE id=?", ("P04-01",)).fetchone()
+        require(task is not None, "Runner task missing")
+        require(task["submitted"] == submission and task["candidate"] == candidate
+                and task["main_base"] == MAIN and candidate != submission,
+                "Runner candidate/submission/main_base mismatch")
+        require(task["state"] in ("approved", "completed"), "Runner approval state required")
+        contract = json.loads(task["contract"], object_pairs_hook=unique)
+        require(contract["id"] == "P04-01" and contract["spec_sha256"] == SPEC
+                and contract["validation_ids"] == ["p04-acceptance"]
+                and contract["acceptance_ids"] == ["P04-01"], "immutable contract mismatch")
+        approved_database = approved_database.resolve(strict=True)
+        with sqlite3.connect(approved_database.as_uri() + "?mode=ro", uri=True) as approved:
+            approved.row_factory = sqlite3.Row
+            approved.execute("PRAGMA query_only=ON")
+            approved.execute("BEGIN")
+            approved_task = approved.execute("SELECT * FROM tasks WHERE id=?", ("P04-01",)).fetchone()
+            require(approved_task is not None and approved_task["state"] == "approved"
+                    and all(approved_task[k] == task[k] for k in ("submitted", "candidate", "main_base", "contract")),
+                    "Root-retained actual approved Runner snapshot mismatch")
+            approval = approved.execute("SELECT * FROM approvals WHERE task_id=?", ("P04-01",)).fetchone()
+        require(approval is not None and approval["candidate"] == candidate
+                and approval["main_base"] == MAIN and approval["owner"].strip(), "exact Runner approval required")
+        rows = []
+        for kind, sha in (("validation", submission), ("review", submission),
+                          ("integration", candidate), ("final", candidate)):
+            records = db.execute("SELECT * FROM evidence WHERE task_id=? AND kind=? AND commit_sha=? AND passed=1",
+                                 ("P04-01", kind, sha)).fetchall()
+            require(records, "Runner evidence missing: " + kind)
+            for record in records:
+                value = read(record["artifact"], hashes)
+                require(value.get("task_id") == "P04-01" and value.get("commit") == sha, "evidence identity mismatch")
+                if kind == "review":
+                    require(value.get("status") == "pass" and value.get("acceptance_ids") == ["P04-01"], "independent review failed")
+                    require(isinstance(value.get("findings"), list) and all(
+                        f.get("severity") == "low" for f in value["findings"]), "review finding blocks join")
+                else:
+                    require(value.get("kind") == kind and value.get("passed") is True, "verification kind/result mismatch")
+                    checks = value.get("checks")
+                    require(isinstance(checks, list) and len(checks) == 1, "exact validation roster required")
+                    check = checks[0]
+                    require(check.get("id") == "p04-acceptance" and type(check.get("exit_code")) is int
+                            and check["exit_code"] == 0 and check.get("passed") is True, "failed validation check")
+                    artifact = Path(check["artifact"])
+                    require(artifact.is_dir(), "registered validation artifact directory missing")
+                    for name in ("command.json", "stdout.log", "stderr.log"):
+                        path = artifact / name
+                        require(path.is_file() and not path.is_symlink(), "registered validation log missing")
+                        hashes[str(path)] = hashlib.sha256(path.read_bytes()).hexdigest()
+                rows.append(dict(record))
+        # Hash the logical transaction snapshot, not mutable SQLite/WAL bytes.
+        snapshot = dict(task=dict(task), approval=dict(approval), evidence=rows)
+        digest = hashlib.sha256(json.dumps(snapshot, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+    return dict(protocol="p04-normal-c-runner-join-v1", runner_database=str(database),
+                approved_runner_database=str(approved_database),
+                runner_records_sha256=digest, join={"C": candidate, "S": submission, "M": MAIN},
+                runner_records_consistent=True, structure_verified=False,
+                source_Q_applicability_verified=False, input_sha256=hashes,
+                whole_goal_accepted=False, unit_accepted=False)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--runner-db", type=Path, required=True)
+    parser.add_argument("--approved-runner-db", type=Path, required=True,
+                        help="Root-retained actual Runner snapshot after approve, before integrate deletes approval")
+    parser.add_argument("--candidate", required=True)
+    parser.add_argument("--submission", required=True)
+    args = parser.parse_args()
+    try:
+        print(json.dumps(verify(args.runner_db, args.approved_runner_db, args.candidate, args.submission, {}), sort_keys=True))
+    except (OSError, ValueError, KeyError, TypeError, sqlite3.Error) as error:
+        print(json.dumps({"runner_records_consistent": False, "error": str(error), "whole_goal_accepted": False}))
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+"""Root-run synthetic boundary fixtures. Never P04 authority; no default scratch."""
+import argparse
+import importlib.util
+import json
+from pathlib import Path
+import sqlite3
+import sys
+sys.dont_write_bytecode = True
+
+HERE = Path(__file__).resolve().parent
+spec = importlib.util.spec_from_file_location("normal_c_join", HERE / "normal_c_join.py")
+join = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(join)
+
+
+def fixture(root, change):
+    root.mkdir()
+    submission, candidate = "1" * 40, "2" * 40
+    contract = dict(id="P04-01", spec_sha256=join.SPEC,
+                    validation_ids=["p04-acceptance"], acceptance_ids=["P04-01"])
+    db_path = root / "runner.sqlite"
+    with sqlite3.connect(db_path) as db:
+        db.executescript("CREATE TABLE tasks(id,contract,state,submitted,candidate,main_base);"
+                         "CREATE TABLE approvals(task_id,candidate,main_base,owner,created);"
+                         "CREATE TABLE evidence(id,task_id,kind,commit_sha,artifact,passed);")
+        db.execute("INSERT INTO tasks VALUES(?,?,?,?,?,?)",
+                   ("P04-01", json.dumps(contract), "approved", submission, candidate, join.MAIN))
+        db.execute("INSERT INTO approvals VALUES(?,?,?,?,?)", ("P04-01", candidate, join.MAIN, "fixture-only", 1.0))
+        for number, kind in enumerate(("validation", "review", "integration", "final")):
+            sha = submission if kind in ("validation", "review") else candidate
+            value = dict(task_id="P04-01", commit=sha)
+            if kind == "review":
+                value.update(status="pass", acceptance_ids=["P04-01"], findings=[])
+                if change == "medium":
+                    value["findings"] = [{"severity": "medium", "message": "synthetic"}]
+            else:
+                logs = root / (kind + "-logs")
+                logs.mkdir()
+                for name in ("command.json", "stdout.log", "stderr.log"):
+                    (logs / name).write_text("{}" if name.endswith("json") else "synthetic fixture only\n")
+                check = dict(id="p04-acceptance", exit_code=0, artifact=str(logs), passed=True)
+                value.update(kind=kind, passed=True, checks=[check])
+                if kind == "final":
+                    if change == "wrong_C": value["commit"] = "3" * 40
+                    if change == "kind_missing": del value["kind"]
+                    if change == "failed_check": check["exit_code"] = 1
+                    if change == "extra_id": value["checks"].append(dict(check, id="extra"))
+                    if change == "missing_id": value["checks"] = []
+                    if change == "task_mismatch": value["task_id"] = "P26-01"
+                    if change == "missing_artifact": check["artifact"] = str(root / "missing")
+            artifact = root / (kind + ".json")
+            artifact.write_text(json.dumps(value))
+            db.execute("INSERT INTO evidence VALUES(?,?,?,?,?,?)", (number, "P04-01", kind, sha, str(artifact), 1))
+        if change == "wrong_M": db.execute("UPDATE tasks SET main_base=?", ("3" * 40,))
+        if change == "wrong_approval": db.execute("UPDATE approvals SET candidate=?", ("3" * 40,))
+        if change == "no_final": db.execute("DELETE FROM evidence WHERE kind='final'")
+    return db_path, submission, candidate
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--scratch", type=Path, required=True)
+    args = parser.parse_args()
+    root = args.scratch.resolve()
+    if root.exists() or root.is_relative_to(HERE.parents[4]) or root == Path("/tmp").resolve() or Path("/tmp").resolve() in root.parents:
+        raise ValueError("fresh external scratch required; /tmp and repository are prohibited")
+    root.mkdir(parents=True)
+    results = []
+    for name in ("positive", "wrong_C", "wrong_M", "kind_missing", "failed_check", "extra_id",
+                 "missing_id", "task_mismatch", "medium", "missing_artifact", "wrong_approval", "no_final"):
+        path, submission, candidate = fixture(root / name, name)
+        try:
+            result = join.verify(path, path, candidate, submission, {})
+            if name != "positive" or result["whole_goal_accepted"] is not False:
+                raise AssertionError("unexpected qualification: " + name)
+        except ValueError:
+            if name == "positive": raise
+        results.append(name)
+    print(json.dumps(dict(synthetic_controls=results, whole_goal_accepted=False)))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,587 @@
+{
+  "revision": "repair30",
+  "status": "BLOCKED: partial implementation; no native admission",
+  "task_id": "P04-01",
+  "current_table": true,
+  "scope": {
+    "conditions": 15,
+    "additional_EV_obligation": true,
+    "domains": 7,
+    "safety_outcomes": [
+      "no stopped charging",
+      "no double midnight settlement",
+      "no orphan reservations"
+    ],
+    "packages": 30,
+    "deliveries": 88,
+    "original_credit": "16/88 formal; P04 receives zero credit",
+    "CurrentAlphaScope": "unchanged",
+    "frozen_main": "c0ea009b28a7649aca6a433a1a24dc0be5e7ab81"
+  },
+  "domains": [
+    {
+      "domain": "閉店",
+      "normative_rule": "D-034 preserves started services on direct closure and releases waiting requests. Dependency closure stops progress and charging, retains reservations/service identity, and completes once after recovery. RELATED_FACILITY_INACTIVE wins over NO_POWER when both apply.",
+      "current_source": [
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_process_tick_commands",
+          "line": 5765,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "9de66a4bb84b12304300d49085f44546412319bd4aee91e67b61becf97e50294"
+        },
+        {
+          "path": "scripts/facility/facility_service.gd",
+          "function": "_prepare_service_for_tick",
+          "line": 853,
+          "sha256": "ceb4a3e9224587423f273cdb2b56e6843ab176ac1fc4fe79dd498b5ed5c33b77",
+          "function_sha256": "b35c2c0fb23a04258b71995dd7c3b6dfacbbcdf36106e2e3348acef0e18d21cc"
+        },
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_release_closed_business_queues",
+          "line": 12672,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "3a05fbe94877eeb750fb0d692501954555ab6a8005448ab3b6023dab9bad816b"
+        }
+      ],
+      "approved_authority": [
+        "D-034",
+        "D05-P04-DEPENDENCY",
+        "D05-P04-PAUSE-REASON"
+      ],
+      "pending_D05": [],
+      "phase": "APPLY_COMMANDS / FACILITY_COMPLETION / FACILITY_QUEUES",
+      "relative_priority": "Command closure before completion; dependency hold during preparation; closed queue release after completion.",
+      "status": "approved policy; fresh Q evidence pending",
+      "observation_status": "historical observations; current M source inspected",
+      "historical_evidence": "I native_bundle C; R/s2a.json; R/s3.json B1",
+      "evidence": "Fresh exact-Q native proof pending; no old raw reused as Q",
+      "nativeWindows": "pending"
+    },
+    {
+      "domain": "停電",
+      "normative_rule": "BASELINE:183 covers real mana depletion. Legitimately stopped service has no progress or charge and preserves reservations. D05-P04-PAUSE-REASON makes dependency closure the displayed reason when dependency closure and power loss coincide.",
+      "current_source": [
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_advance_mana",
+          "line": 10716,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "05c54626ce6e355acd92994ab80aaf2177c5cf194885e66934552139e087599e"
+        },
+        {
+          "path": "scripts/facility/facility_service.gd",
+          "function": "_prepare_service_for_tick",
+          "line": 853,
+          "sha256": "ceb4a3e9224587423f273cdb2b56e6843ab176ac1fc4fe79dd498b5ed5c33b77",
+          "function_sha256": "b35c2c0fb23a04258b71995dd7c3b6dfacbbcdf36106e2e3348acef0e18d21cc"
+        }
+      ],
+      "approved_authority": [
+        "BASELINE:183",
+        "P04-01 safety acceptance",
+        "D05-P04-PAUSE-REASON"
+      ],
+      "pending_D05": [],
+      "phase": "MANA → FACILITY_COMPLETION",
+      "relative_priority": "Projection before completion; RELATED chosen before NO_POWER.",
+      "status": "approved policy; fresh Q evidence pending",
+      "observation_status": "historical observations; current M source inspected",
+      "evidence_scope": "S4 probe calls disconnect_nodes directly: isolated NO_POWER, not global depletion. Global depletion appears only in S3 B1 combined diagnostic. S1 covers separate staff/EV safety.",
+      "historical_evidence": "R/s4.json; B/p04-s4-native-r28; R/s3.json B1 combined diagnostic",
+      "evidence": "Fresh exact-Q native proof pending; no old raw reused as Q",
+      "nativeWindows": "pending"
+    },
+    {
+      "domain": "破壊",
+      "normative_rule": "Command destruction precedes completion. Accident/raid destruction follows completion and charging in minute N; that sale remains valid. Failure and reservation release for affected unfinished service occurs in N+1. D05-P04-DESTRUCTION is the authority, not BASELINE:183.",
+      "current_source": [
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_process_tick_commands",
+          "line": 5765,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "9de66a4bb84b12304300d49085f44546412319bd4aee91e67b61becf97e50294"
+        },
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_advance_defense",
+          "line": 8599,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "db38b51531276d2620999d57eed7a6219b73f8b8d9ff3706cf569f4797918527"
+        },
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_apply_defense_outcome_boundary",
+          "line": 9826,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "182c48282d96c6ccd1e5f636751db9de8cef2770ad433b291db89111c5fb5043"
+        },
+        {
+          "path": "scripts/facility/facility_service.gd",
+          "function": "_prepare_service_for_tick",
+          "line": 853,
+          "sha256": "ceb4a3e9224587423f273cdb2b56e6843ab176ac1fc4fe79dd498b5ed5c33b77",
+          "function_sha256": "b35c2c0fb23a04258b71995dd7c3b6dfacbbcdf36106e2e3348acef0e18d21cc"
+        }
+      ],
+      "approved_authority": [
+        "D05-P04-DESTRUCTION"
+      ],
+      "pending_D05": [],
+      "phase": "APPLY_COMMANDS vs INCIDENTS_AND_EVENTS",
+      "relative_priority": "Command destruction before completion; incident destruction after completion: B4a charges25G then destroys in same tick; B4b next-tick failure/release.",
+      "status": "approved policy; fresh Q evidence pending",
+      "observation_status": "historical observations; current M source inspected",
+      "historical_evidence": "R/s3.json B4a/B4b",
+      "evidence": "Fresh exact-Q native proof pending; no old raw reused as Q",
+      "nativeWindows": "pending"
+    },
+    {
+      "domain": "退出",
+      "normative_rule": "D-034 release safety remains. Command exit precedes completion; AI planned exit follows completion and only applies to a deciding guest. Later despawn is distinct.",
+      "current_source": [
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_execute_leave_facility_queue",
+          "line": 7575,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "04733da2c6f9627e6d831f8bb6b620018d63305fe43bb927abf21a969288d90d"
+        },
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_advance_guest_ai_decisions",
+          "line": 8760,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "e33b41294e88dba840affd5cc0a5c58fe5d46f5d98a80a8d5f4e907a3b9a7b93"
+        }
+      ],
+      "approved_authority": [
+        "D-034",
+        "P04-01 safety acceptance",
+        "D05-P04-EXIT"
+      ],
+      "pending_D05": [],
+      "phase": "APPLY_COMMANDS vs AI_DECISIONS",
+      "relative_priority": "Command exit before completion/charging; AI PLANNED_EXIT after them; despawn later.",
+      "status": "approved policy; fresh Q evidence pending",
+      "observation_status": "historical observations; current M source inspected",
+      "historical_evidence": "R/s3.json B2a/B2b/B3 and B1 departure history",
+      "evidence": "Fresh exact-Q native proof pending; no old raw reused as Q",
+      "nativeWindows": "pending"
+    },
+    {
+      "domain": "課金",
+      "normative_rule": "Charge only completed service, once per idempotency key; retain original price snapshot and reservation/ledger joins. At 00:00 prior-day settlement and upkeep precede completion; the sale belongs to the new day.",
+      "current_source": [
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_advance_facility_upkeep",
+          "line": 1876,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "33a969a14d1a15296059cecadc4bf7e5a35c9eb61d82cb9e2d6d9bbcf5c32c68"
+        },
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_complete_service_transaction",
+          "line": 11817,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "f2b6e96a8eeef3dd3f8419b4d9d5ef4e1d13241600ce970bdd78a924428cac6c"
+        },
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_apply_service_transaction",
+          "line": 11833,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "950474ff3ca8a867ee025c2b7635586d79f2385f79586fc66107191ceb329a9a"
+        },
+        {
+          "path": "scripts/operations/operations_coordinator.gd",
+          "function": "_process_daily_close",
+          "line": 1125,
+          "sha256": "871a248ee101b6df543fd5cf0440b5d4b0f02c21fa145a99f0687888c1bc6f90",
+          "function_sha256": "665ac0ac4d4c220e68e98810da063fd2ad7ae7dc9e1997944a1e7bea7a3c30e6"
+        }
+      ],
+      "approved_authority": [
+        "P04-01 safety acceptance",
+        "D05-P04-DEPENDENCY",
+        "D05-P04-SHIFT-1800",
+        "D05-P04-MIDNIGHT-DAY"
+      ],
+      "pending_D05": [],
+      "phase": "TIME_BOUNDARIES → FACILITY_COMPLETION",
+      "relative_priority": "Upkeep/daily close before sale; post-increment sale timestamp, exclusive close period_end;00:00 sale belongs to new day.",
+      "status": "approved policy; fresh Q evidence pending",
+      "observation_status": "historical observations; current M source inspected",
+      "historical_evidence": "I native_bundle C; R/s2a.json; R/s4.json",
+      "evidence": "Fresh exact-Q native proof pending; no old raw reused as Q",
+      "nativeWindows": "pending"
+    },
+    {
+      "domain": "シフト交代",
+      "normative_rule": "Approved 18:00 order remains: completion and payment before handover. No renewal of prior approval.",
+      "current_source": [
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_advance_facilities",
+          "line": 8504,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "f1efd0c23bdd60d1ef19a21879640b53b8b4d88844c0c881fe7cd724387ec274"
+        },
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_advance_staff_ai",
+          "line": 8680,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "0e222987f7c5e25583dbaba8fe63784aa563715067396e8d31d10bd191e7179b"
+        }
+      ],
+      "approved_authority": [
+        "BASELINE:64",
+        "BASELINE:67",
+        "D05-P04-SHIFT-1800"
+      ],
+      "pending_D05": [],
+      "phase": "FACILITY_COMPLETION → AI_DECISIONS",
+      "relative_priority": "18:00 completion/payment before shift handover; day staff [17:59,18:00), night [18:00,18:01).",
+      "status": "approved policy; fresh Q evidence pending",
+      "observation_status": "historical observations; current M source inspected",
+      "historical_evidence": "I C first1080 sale joins; R/s2b.json no-night1081/overtime",
+      "evidence": "Fresh exact-Q native proof pending; no old raw reused as Q",
+      "nativeWindows": "pending"
+    },
+    {
+      "domain": "00:00決算",
+      "normative_rule": "A01 ownership-based upkeep is unchanged. Prior-day settlement/upkeep precede 00:00 service completion; its sale belongs to the new day. Replay/restore must not duplicate settlement.",
+      "current_source": [
+        {
+          "path": "scripts/core/simulation_kernel.gd",
+          "function": "_handle_time_boundaries",
+          "line": 254,
+          "sha256": "341c0c878c4894adbac628d0db6362ff69fc3347bdd9e61e50936e15dc2d1edb",
+          "function_sha256": "2ced47a2911b36def9d89de82a43afc69148ead44d19db6a2a6c7bce5a910ae9"
+        },
+        {
+          "path": "autoload/simulation_runtime.gd",
+          "function": "_advance_operations_time",
+          "line": 1919,
+          "sha256": "45514aea9367ff678f4dc05166bb9b58121f240d4b5565edeb7ab258e3ded8e0",
+          "function_sha256": "511580d1fac3d2785072e94c2981065fa47ba18b1c97122922645dac5c0d94ab"
+        },
+        {
+          "path": "scripts/operations/operations_coordinator.gd",
+          "function": "_process_minute_boundaries",
+          "line": 882,
+          "sha256": "871a248ee101b6df543fd5cf0440b5d4b0f02c21fa145a99f0687888c1bc6f90",
+          "function_sha256": "1312166dc17aee0ef470069a73ff3fe6b86d11d04ca7de76f3d04f1d2d14674e"
+        },
+        {
+          "path": "scripts/operations/operations_coordinator.gd",
+          "function": "_process_daily_close",
+          "line": 1125,
+          "sha256": "871a248ee101b6df543fd5cf0440b5d4b0f02c21fa145a99f0687888c1bc6f90",
+          "function_sha256": "665ac0ac4d4c220e68e98810da063fd2ad7ae7dc9e1997944a1e7bea7a3c30e6"
+        }
+      ],
+      "approved_authority": [
+        "BASELINE:71",
+        "BASELINE:72",
+        "A01",
+        "D05-P04-DEPENDENCY",
+        "D05-P04-MIDNIGHT-DAY"
+      ],
+      "pending_D05": [],
+      "phase": "pre-TIME_BOUNDARIES signals → TIME_BOUNDARIES → FACILITY_COMPLETION",
+      "relative_priority": "Midnight signals, then upkeep/close, then completion.",
+      "status": "approved policy; fresh Q evidence pending",
+      "observation_status": "historical observations; current M source inspected",
+      "historical_evidence": "I C paused/formal; R/s2a.json nonzero payroll/upkeep, replay and typed restore",
+      "evidence": "Fresh exact-Q native proof pending; no old raw reused as Q",
+      "nativeWindows": "pending"
+    }
+  ],
+  "source_facts": "REPAIR30_SOURCE_FACTS.json",
+  "authority": "D05_OWNER_APPROVAL.json preserves dependency/18:00; D05_REMAINING_APPROVAL.json binds all four actual 2026-10-18 answers; BASELINE/D-034/A01 unchanged.",
+  "historical_superseded": [
+    "REPAIR17_STATUS.md",
+    "REPAIR18_STATUS.md",
+    "REPAIR19_CORRIGENDUM.md",
+    "REPAIR19_STATUS.md",
+    "REPAIR20_CORRIGENDUM.md",
+    "REPAIR20_STATUS.md",
+    "REPAIR21_STATUS.md",
+    "REPAIR22–28 creation-time status and runbooks"
+  ],
+  "history_policy": "Historical source/proof pins retain their original revisions; CURRENT_STATUS.md is canonical. New approvals are not new native evidence.",
+  "evidence_policy": "All old S1-S4/r22/native/full178 records are historical. None is relabelled as Q. Fresh native S1-S5 and full184/329 on final Q remain NOT RUN.",
+  "pending": [
+    "Complete current-Q collector/wrapper/index binding and S5 drivers; see REPAIR30_STATUS.md",
+    "Fresh native S1-S5 on final Q, then full184/329 on the same Q including checker",
+    "Truthful index, formal registered validation on S --verify-only, whole-unit independent review, normal C integration",
+    "nativeWindows individually pending for every condition"
+  ],
+  "priority_candidates_if_required": "D05_REMAINING_ORDER_CANDIDATE.json (superseded history)",
+  "collection_plan": "REPAIR30_STATUS.md",
+  "formal_acceptance": false,
+  "original_unit_complete": false,
+  "phase_order": [
+    {
+      "priority": 1,
+      "phase": "APPLY_COMMANDS",
+      "status": "observed-current",
+      "handlers": [
+        {
+          "phase": "APPLY_COMMANDS",
+          "handler_id": "simulation_runtime.commands",
+          "function": "_process_tick_commands",
+          "registration_line": 369
+        }
+      ],
+      "behavior": "Previous minute: commands → _process_tick_commands:5743. Operations gate requests current tick abort and returns before Clock changes; otherwise commands apply for minute+1."
+    },
+    {
+      "priority": 2,
+      "phase": "TIME_BOUNDARIES",
+      "status": "observed-current",
+      "handlers": [
+        {
+          "phase": "TIME_BOUNDARIES",
+          "handler_id": "simulation_runtime.0_weather",
+          "function": "_advance_weather",
+          "registration_line": 366
+        },
+        {
+          "phase": "TIME_BOUNDARIES",
+          "handler_id": "simulation_runtime.a_upkeep",
+          "function": "_advance_facility_upkeep",
+          "registration_line": 368
+        },
+        {
+          "phase": "TIME_BOUNDARIES",
+          "handler_id": "simulation_runtime.operations",
+          "function": "_advance_operations_time",
+          "registration_line": 1766
+        }
+      ],
+      "behavior": "After APPLY: absolute_minute += 1, _sync_calendar_fields, _handle_time_boundaries:254 emits settlement_requested(completed_day) then day_started at00:00, before TIME_BOUNDARIES handlers. Handler order: weather, upkeep, operations. Runtime upkeep:1855; operations:1898 → coordinator _process_minute_boundaries:882: 00:00 upkeep, daily close, 06:00 morning, demand, arrivals (conditional boundaries and early returns)."
+    },
+    {
+      "priority": 3,
+      "phase": "MANA",
+      "status": "observed-current",
+      "handlers": [
+        {
+          "phase": "MANA",
+          "handler_id": "simulation_runtime.mana",
+          "function": "_advance_mana",
+          "registration_line": 379
+        }
+      ],
+      "behavior": "Runtime _advance_mana:10694: proxy preflight → mana_network advance → mana_power_projection.apply → MANA_STATE_CHANGED events."
+    },
+    {
+      "priority": 4,
+      "phase": "CONSTRUCTION",
+      "status": "observed-current",
+      "handlers": [
+        {
+          "phase": "CONSTRUCTION",
+          "handler_id": "simulation_runtime.construction",
+          "function": "_advance_construction",
+          "registration_line": 384
+        }
+      ],
+      "behavior": "Construction:8064 follows power and precedes logistics."
+    },
+    {
+      "priority": 5,
+      "phase": "LOGISTICS",
+      "status": "observed-current",
+      "handlers": [
+        {
+          "phase": "LOGISTICS",
+          "handler_id": "simulation_runtime.logistics",
+          "function": "_advance_inventory_and_logistics",
+          "registration_line": 389
+        }
+      ],
+      "behavior": "Logistics:8472 precedes completion."
+    },
+    {
+      "priority": 6,
+      "phase": "FACILITY_COMPLETION",
+      "status": "observed-current",
+      "handlers": [
+        {
+          "phase": "FACILITY_COMPLETION",
+          "handler_id": "simulation_runtime.facilities",
+          "function": "_advance_facilities",
+          "registration_line": 394
+        }
+      ],
+      "behavior": "Runtime _advance_facilities:8482: facility_service.advance_one_minute then kitchen. FacilityService _prepare_service_for_tick:853 checks BROKEN, related_facility_operating (RELATED_FACILITY_INACTIVE), power_available (NO_POWER), staff grace. Only ACTIVE services advance (:569). _complete_service:895 → Runtime _complete_service_transaction:11769 → _apply_service_transaction:11785 posts SERVICE_SALE / SERVICE_CASH_SWEEP at the post-increment minute (:11826–11838)."
+    },
+    {
+      "priority": 7,
+      "phase": "VITALS_AND_ENVIRONMENT",
+      "status": "observed-current",
+      "handlers": [
+        {
+          "phase": "VITALS_AND_ENVIRONMENT",
+          "handler_id": "simulation_runtime.guest_vitals",
+          "function": "_advance_guest_vitals",
+          "registration_line": 399
+        }
+      ],
+      "behavior": "Guest vitals:8488 follows completion."
+    },
+    {
+      "priority": 8,
+      "phase": "INCIDENTS_AND_EVENTS",
+      "status": "observed-current",
+      "handlers": [
+        {
+          "phase": "INCIDENTS_AND_EVENTS",
+          "handler_id": "simulation_runtime.authority_incidents",
+          "function": "_advance_authority_incidents",
+          "registration_line": 409
+        },
+        {
+          "phase": "INCIDENTS_AND_EVENTS",
+          "handler_id": "simulation_runtime.defense",
+          "function": "_advance_defense",
+          "registration_line": 414
+        },
+        {
+          "phase": "INCIDENTS_AND_EVENTS",
+          "handler_id": "simulation_runtime.relationship_events",
+          "function": "_advance_relationship_events",
+          "registration_line": 419
+        }
+      ],
+      "behavior": "String-sorted authority_incidents:8551 → defense:8577 → relationship_events:8615; after completion/charging."
+    },
+    {
+      "priority": 9,
+      "phase": "FACILITY_QUEUES",
+      "status": "observed-current",
+      "handlers": [
+        {
+          "phase": "FACILITY_QUEUES",
+          "handler_id": "simulation_runtime.guest_queues",
+          "function": "_advance_guest_queues",
+          "registration_line": 404
+        }
+      ],
+      "behavior": "_advance_guest_queues:8502 releases closed queues first (_release_closed_business_queues:12624); closed queues spend no patience (:8516–8517)."
+    },
+    {
+      "priority": 10,
+      "phase": "AI_DECISIONS",
+      "status": "observed-current",
+      "handlers": [
+        {
+          "phase": "AI_DECISIONS",
+          "handler_id": "simulation_runtime.staff_ai",
+          "function": "_advance_staff_ai",
+          "registration_line": 424
+        }
+      ],
+      "behavior": "_advance_staff_ai:8658: prune elevator waits, elevators, rescue, staff_service, prune waits, staff_commute (shift handover), staffing sync, cleaning, fatigue, rescue and staffing sync again, then _advance_guest_ai_decisions:8738. DECIDING PLANNED_EXIT → LEAVING; despawn occurs only on later minute (:8760–8762)."
+    },
+    {
+      "priority": 11,
+      "phase": "PUBLISH_SNAPSHOT",
+      "status": "observed-current",
+      "handlers": [
+        {
+          "phase": "PUBLISH_SNAPSHOT",
+          "handler_id": "simulation_runtime.snapshot",
+          "function": "_publish_snapshot",
+          "registration_line": 374
+        },
+        {
+          "phase": "PUBLISH_SNAPSHOT",
+          "handler_id": "simulation_runtime.zz_save_checkpoints",
+          "function": "_process_save_checkpoints",
+          "registration_line": 431
+        }
+      ],
+      "behavior": "snapshot:12476 then zz_save_checkpoints:4514; persistence follows publication."
+    }
+  ],
+  "safety_cases": [
+    {
+      "item": "No charge while paused NO_POWER or RELATED",
+      "status": "original",
+      "phase": "FACILITY_COMPLETION",
+      "source": "FacilityService _prepare_service_for_tick:853, ACTIVE-only gate:569, _complete_service:895",
+      "priority": "Preparation before advance/completion/payment",
+      "proof": "R/s4.json isolated power; I C and R/s2a.json dependency hold",
+      "approval": "Dependency hold approved; both D05(a) options preserve safety"
+    },
+    {
+      "item": "Double-settlement idempotency",
+      "status": "original",
+      "phase": "TIME_BOUNDARIES",
+      "source": "coordinator _process_daily_close:1125; _day_summaries replay:1127–1130; daily-close:N:1137",
+      "priority": "Before facility completion",
+      "proof": "I C; R/s2a.json same-boundary replay and separate-PID restore, unchanged accounting"
+    },
+    {
+      "item": "Orphan reservation release",
+      "status": "original",
+      "phase": "APPLY_COMMANDS / FACILITY_QUEUES",
+      "source": "Runtime _execute_leave_facility_queue:7553 (release keys:7565–7569); _leave_guest_queue_boundary:9178; _release_closed_business_queues:12624; _release_closed_business_request:12642",
+      "priority": "Command release before completion; closed-queue release afterward; closed patience not spent",
+      "proof": "R/s3.json B2a/B2b/B3/B4b; I C; R/s2a.json reservation/service identity and restore"
+    }
+  ],
+  "proof_legend": {
+    "label": "Root-measured",
+    "R": "B/audit-support/p04-raw-collect-r22",
+    "I": "B/p04-evidence/index.json schema2; native_bundle/raw_references/versions/source_map/environment bind exact proofs",
+    "pins": "REPAIR29_STATIC_SOURCE.json proof_pins; R/MANIFEST.json pins series and relocation, series retain raw paths/hashes"
+  },
+  "authority_statuses": {
+    "original": [
+      "P04-01 safety acceptance",
+      "BASELINE:64,67,71,72,183"
+    ],
+    "approved": [
+      "A01 midnight ownership upkeep",
+      "D05-P04-DEPENDENCY",
+      "D05-P04-SHIFT-1800",
+      "D-034 direct business closure"
+    ],
+    "pending D05": [
+      "a power vs closure/dependency",
+      "b destruction",
+      "c exit",
+      "d cost time/day beyond A01 and18:00"
+    ],
+    "observed-current": "All phase and source behavior observations; not approval"
+  },
+  "full178_applicability_context": "REPAIR29_STATIC_SOURCE.json full_source_static_comparison: full178 selected1339 includes f5; one test-source mismatch (test_required_kitchen.gd), no game-source mismatch; preserve Runner applicability binding, no blanket1338 identity or a61 full proof.",
+  "current_source_commit": "c0ea009b28a7649aca6a433a1a24dc0be5e7ab81",
+  "nativeWindows": {
+    "EV": "pending",
+    "closure_release": "pending",
+    "dependency_stop": "pending",
+    "destruction_stop": "pending",
+    "exit_release": "pending",
+    "midnight_replay": "pending",
+    "midnight_settlement": "pending",
+    "night_staff_absent": "pending",
+    "overtime_task": "pending",
+    "patience_release": "pending",
+    "paused_midnight": "pending",
+    "power_stop": "pending",
+    "recovery_completion": "pending",
+    "same_minute_replay": "pending",
+    "save_restore": "pending",
+    "shift_completion": "pending"
+  }
+}
@@ -0,0 +1,69 @@
+{
+  "supplied_sources": [
+    {
+      "name": "p04-01-shift-end-repro-r03.gd",
+      "sha256": "97e20c3f68b85bbb85fd37e85e97dec277cca5ebc791107120b0606d1138cc0a",
+      "bytes": 9518,
+      "historical_only": true
+    },
+    {
+      "name": "p04-01-shift-end-repro-native-r03.py",
+      "sha256": "995a9b159533f40f79a4ef639c1338b689e8e98720eed638f8eae169d8a03e11",
+      "bytes": 6268,
+      "historical_only": true
+    },
+    {
+      "name": "p04-01-midnight-boundary-r01.gd",
+      "sha256": "4f587cc90a3bbd310b53c6216e54cda1deacfa87fa4312411b41288e534de527",
+      "bytes": 11677,
+      "historical_only": true
+    },
+    {
+      "name": "p04-01-midnight-boundary-native-r01.py",
+      "sha256": "3da084530941658ee396b05b9343f0342bf2a981962ef3361ed0f82475dd73dd",
+      "bytes": 6317,
+      "historical_only": true
+    },
+    {
+      "name": "p04-01-power-formal-recovery-r04.gd",
+      "sha256": "887d3097fa4178675caf253c428d56cc842b506b8c32d6f7925505f17c32e2ff",
+      "bytes": 10062,
+      "historical_only": true
+    },
+    {
+      "name": "p04-01-power-formal-recovery-native-r04.py",
+      "sha256": "d115a1ec5f985cfa4d7bd751eace0f2f5e93e1f4809434a0e2685c0fe0b8b23e",
+      "bytes": 8425,
+      "historical_only": true
+    },
+    {
+      "name": "p04-01-formal-boundary-reload-r01.gd",
+      "sha256": "56e193a2c1d44c62c83374442b61c63935a69fdc1665ffa09bb549b0dfd8d14b",
+      "bytes": 7624,
+      "historical_only": true
+    },
+    {
+      "name": "p04-01-formal-boundary-reload-native-r03.py",
+      "sha256": "fcd22729c9d045eb9656fae5db6c2116a27ab54fdb24f91c8125925b02a9d47a",
+      "bytes": 8677,
+      "historical_only": true
+    },
+    {
+      "name": "p04-01-destruction-completion-boundary-r02.gd",
+      "sha256": "a9d58e7d5fcdf4793075552ae5be1ba6f5c2d45423b245b3d4617530260df37b",
+      "bytes": 12257,
+      "historical_only": true
+    },
+    {
+      "name": "p04-01-exit-boundary-r01.gd",
+      "sha256": "6d7f32d801e4d8fb241a5e5695d6e31a8e7c47ad8021228ded460efcb1967254",
+      "bytes": 12726,
+      "historical_only": true
+    }
+  ],
+  "evidence_references": 39,
+  "raw_reuse_confirmed": 0,
+  "engine_runs": 0,
+  "runner_operations": 0,
+  "formal_acceptance": false
+}
@@ -0,0 +1,92 @@
+# S1 Root run（コード準備のみ）
+
+S1コード準備完了・未実測・原P04 whole未達。D05 pending、A未検証。
+engine起動・全回帰・コミットはworkerでは実施しない。
+assertは各caseの停止中の課金行0、予約の孤立0、到着1回だけ。
+予約snapshotのstateは文字列名として検査し、未知の名前は孤立checkを失敗にする。
+ACTIVEのstaff_task予約とtask.reservation_idsを双方向照合する。非ACTIVEの履歴もrawには保持する。
+費用帰属、金額、EV停止規則を決めない。remaining_minutes保持は生観測として保存する。
+
+## Rootが実行するコマンド
+
+以下はSource checkout外のtask buildにplan/cache/rawを保存する。
+Rootは先に空き容量・他のengine・終了済cacheへのアクセスを確認する。
+既存出力は削除しない。再試行する場合はplan/outputの両方に新しいr番号を指定する。
+
+```sh
+export PYTHONPYCACHEPREFIX='/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/s1-python-cache'
+python3 '/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-implement/docs/plans/original-completion-2026-10-02/execution/p04-01/s1/run_s1_native.py' --check-only --plan '/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-root-plan-r02.json' --output '/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-native-r02'
+python3 '/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/P04-01-implement/docs/plans/original-completion-2026-10-02/execution/p04-01/s1/run_s1_native.py' --plan '/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-root-plan-r02.json' --output '/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-native-r02'
+```
+
+既定の製品sourceは
+`/Users/korizatou114/Projects/とりにく工房ゲーム制作部`。
+workerのprobeだけを `tests/s3/test_runtime_staff_assignment.gd` にQA overrideする。
+製品sourceの全選択ファイルをpinし、終了済cacheのselected mapとの完全一致を実runで要求する。
+sourceの役割変更や不一致を自動承認しない。
+
+既定cache:
+`/Users/korizatou114/Projects/TheTree-managed-worktrees/p18-01-model/.runtime/P18-01-CODE/build/p18-relationship-evidence`。
+workerからreceiptの読取りはOSに拒否された。check-onlyはその具体的path/errorを
+cache_accessに記録し、engineやdefault playerには触らない。
+Rootのcheck-onlyでは読める必要がある。実runではreceiptがpassedであること、
+cacheの存在・全hash・cp -cの別inodeを必須とする。アクセス権やRoot境界は変更しない。
+
+## 実行順序とexit
+
+source_refs → QA override 1件 → private stage → bootstrap → cache cp -c/別inode →
+import 1回 → parse 1回 → writer → 別PID reader →
+finally owned_outer.finish_captured → fixed_guard。
+normal watchdogは既存1200秒、importは既存180秒で変更しない。
+実runのdefault-player保護は既存runnerを使う。
+
+check-onlyの期待exitは0。engine起動0で入力SHAとplanを出力する。
+cache_accessが非nullならRoot確認が未完でありnative開始条件を満たさない。
+実runの期待exitは0（4phase成功、Writer/Reader別PID/profile、6安全性checksずつ、
+14保存pointの正式復元、Writer保存物不変、owned cleanupとsource/default-player guard成功）。
+strict phase失敗またはguard失敗は1、native開始前の入力・資源不備は2。
+最初の失敗で停止し、自動再試行しない。exit0でも原P04 whole合格ではない。
+
+## 出力とraw一覧
+
+出力root:
+`/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s1-native-r02/`
+
+- source_before.json、source_after.json、selected-source-map.json、runner-input.json
+- runner-started.json、runner-ended.json、execution.json、PID-set.json、outer-owned-finally.json、raw-inventory.json
+- stage/（別inodeの製品source＋QA、.godot clone）、starters/、bootstrap/
+- cache-reuse.json（全cache hashと終了済receipt pin）、parse-paths.json、contracts.json
+- import/、parse/、writer/、reader/のstdout.log、stderr.log、engine-native.log、
+  strict runner生成のprocess/profile/start/end/capture証拠。全フォルダを保存する
+- 各phaseの*-receipt.json、*-actual-phase.json、writer-combined-raw.log、reader-combined-raw.log
+- raw/writer.json、raw/reader.json（PID/profile、正式slot path、checks/errors）
+- raw/{writer,reader}-observations.{json,var}
+- raw/{writer,reader}-{landing,no-safe-landing}-observations.{json,var}
+- raw/{writer,reader}-{landing,no-safe-landing}-{before,boarded,depleted,stopped,held,landing,recovered}.{json,var}
+- phase receiptが指すuser://saves/p04_s1/の全正式package。
+  WriterとReader各14slot、各slotのjournal.log、manifest.json、thumbnail.png、world.binを保持する。
+  private startup/runtime profileのlog/lock等も既存runner方式で保持し削除しない
+
+JSONは閲覧用でVariant型を落とすため、必ずtyped .varと対で読む。
+case観測はseed、実task.required_items、予約配列、ledger全行、trip/elevator report、
+domain event、facility/service ID、全Runtime snapshot、コマンド結果を含む。
+割当時のreserved_before_travelはイベント内の生観測で、正式保存pointとは区別する。
+Readerは正式4-member packageを自身のprivate profileへ全コピーしてpublic load/restore後、
+tickせず観測しWriter typed snapshotとの完全一致を確認する。
+到着イベント履歴はWriter採取rawであることをReader側にも明示する。
+no-safe-landingの残り時間保持とclosureによるrelease時点はrawで確認する。
+給電復帰後も対象clinicは直接休業のままにして追加の搬送を防ぐ。
+
+S2/S3、collector、A仕上げ、登録validate、独立whole review、統合は後続であり本提出の範囲外。
+
+## worker静的確認の適用範囲
+
+製品rootのtools/run_all_tests.pyもworkerから読取り拒否されたため、workerのcheck-onlyは
+--project-rootにSource checkoutを明示した。選択sourceは1300件であり、Rootのcurrent製品1338件の検証を代行しない。
+Rootは上記既定product_rootで独自のfresh planを作る。worker planを実runに転用しない。
+
+停電と着床を別規則に分離しない。reserveをpublic commandで0にし、同じ更新境界の前に
+対象clinicへ直接休業commandを送り、通常tickによる停電・予約解放・安全到着の実順序を記録する。
+着床不能caseの予約は乗車中保持され得るため、releaseの時点を予測しない。
+strict runnerの同一test名logはphaseごとにcombined-rawとして退避し、actual-phase/executionの
+logを退避pathへ結合する。元strict receiptは変更せずstrict_runner_log_pathも残す。
@@ -0,0 +1,262 @@
+extends SceneTree
+# S1 only; setup follows test_rescue_elevator and transport:94-149.
+const SEED := 712
+const TASK := &"s1_rescue_with_tool"
+var runtime: Variant
+var clock: Variant
+var state: Variant
+var folder := ""
+var mode := ""
+var clinic_id: StringName
+var checks := 0
+var failures := 0
+var errors: Array = []
+var slots: Dictionary = {}
+var observations: Dictionary = {}
+var commands: Array = []
+var arrivals: Array = []
+var pretravel: Dictionary = {}
+
+func _initialize() -> void: call_deferred("run")
+
+# Exactly three safety assertions per case; operational failures are separate.
+func outcome(ok: bool, label: String) -> void:
+	checks += 1
+	if not ok:
+		failures += 1
+		push_error(label)
+
+func io(ok: bool, label: String) -> bool:
+	if not ok:
+		errors.append(label)
+		push_error(label)
+	return ok
+
+func raw(label: String, value: Variant) -> void:
+	var file := FileAccess.open(folder.path_join(mode + "-" + label + ".var"), FileAccess.WRITE)
+	if io(file != null, "typed output " + label):
+		file.store_buffer(var_to_bytes(value)); file.flush(); file.close()
+	file = FileAccess.open(folder.path_join(mode + "-" + label + ".json"), FileAccess.WRITE)
+	if io(file != null, "JSON output " + label):
+		file.store_string(JSON.stringify(value, "\t")); file.flush(); file.close()
+
+func read_json(path: String) -> Dictionary:
+	var file := FileAccess.open(path, FileAccess.READ)
+	if not io(file != null, "read " + path): return {}
+	var value: Variant = JSON.parse_string(file.get_as_text()); file.close()
+	if not io(value is Dictionary, "dictionary " + path): return {}
+	return value
+
+func typed(path: String) -> Dictionary:
+	var file := FileAccess.open(path, FileAccess.READ)
+	if not io(file != null, "read typed " + path): return {}
+	var value: Variant = bytes_to_var(file.get_buffer(file.get_length())); file.close()
+	if not io(value is Dictionary, "typed dictionary " + path): return {}
+	return value
+
+func cleanup() -> void:
+	if runtime != null: runtime.free()
+	if clock != null: clock.free()
+	if state != null: state.free()
+	runtime = null; clock = null; state = null
+
+func reset() -> bool:
+	cleanup(); commands = []; arrivals = []; pretravel = {}; clinic_id = &""
+	clock = load("res://autoload/game_clock.gd").new()
+	state = load("res://autoload/game_state.gd").new()
+	runtime = load("res://autoload/simulation_runtime.gd").new()
+	clock.reset(1, 6, 0); state.reset()
+	var initialized: Dictionary = runtime.initialize(clock, state, SEED)
+	clock.set_paused(true)
+	runtime.configure_save_policy({&"enabled": false, &"daily_checkpoint_enabled": false})
+	runtime.domain_events.subscribe(&"ELEVATOR_ARRIVED", &"s1.raw", on_arrival)
+	runtime.domain_events.subscribe(&"STAFF_TASK_ASSIGNED", &"s1.reservation", on_assignment)
+	return io(bool(initialized.get(&"valid", false)), "runtime initialization")
+
+func on_assignment(event: SimulationDomainEvent) -> void:
+	if TASK in event.entity_ids and pretravel.is_empty():
+		pretravel = capture()
+		pretravel[&"staff_cell"] = runtime.staff_service.get_staff(&"medic").current_cell
+
+func on_arrival(event: SimulationDomainEvent) -> void:
+	arrivals.append(event.to_dictionary())
+
+func cmd(kind: StringName, payload: Dictionary) -> bool:
+	var result: CommandResult = runtime.submit_command(kind, payload, &"player")
+	commands.append(result.to_dictionary())
+	return io(result.is_success(), "public command " + String(kind))
+
+func capture() -> Dictionary:
+	var reservations: Array = []
+	for reservation: InventoryReservation in runtime.inventory_service.get_reservations():
+		reservations.append(reservation.create_snapshot())
+	var ledger: Array = []
+	for entry: LedgerEntry in runtime.economy_service.get_entries(): ledger.append(entry.to_dictionary())
+	var events: Array = []
+	for event: SimulationDomainEvent in runtime.domain_events.recent_events(): events.append(event.to_dictionary())
+	var services: Array = []
+	for facility: FacilityInstance in runtime.facility_service.get_instances():
+		services.append({&"facility_id": facility.instance_id, &"active_service_ids": facility.active_services.keys()})
+	var task: StaffTask = runtime.staff_service.get_task(TASK)
+	return {&"seed": SEED, &"minute": clock.absolute_minute, &"snapshot": runtime.create_snapshot(),
+		&"ledger": ledger, &"reservations": reservations, &"task": task.create_snapshot() if task != null else {},
+		&"trip": runtime.elevators.get_actor_trip(&"staff:medic"),
+		&"elevator_report": runtime.elevators.get_report(), &"domain_events": events,
+		&"arrivals": arrivals.duplicate(true), &"commands": commands.duplicate(true),
+		&"service_ids": services, &"staff_invariants": runtime.staff_service.validate_invariants()}
+
+func construct() -> bool:
+	if not reset(): return false
+	for spec: Array in [[&"infirmary", Vector3i(-6,0,1)], [&"service_elevator", Vector3i(0,0,1)]]:
+		if not cmd(&"build_facility", {&"definition_id": spec[0], &"origin": spec[1]}): return false
+	clock.advance_minutes(400)
+	for facility: FacilityInstance in runtime.facility_service.get_instances():
+		if facility.definition_id == &"infirmary": clinic_id = facility.instance_id
+	if not io(not clinic_id.is_empty(), "constructed clinic"): return false
+	for id: StringName in [&"patient", &"medic"]:
+		if not cmd(&"register_staff", {&"staff_id": id, &"role_id": &"medic", &"options": {
+			&"current_cell": Vector3i(0,1,1) if id == &"patient" else Vector3i(5,0,1),
+			&"health": 0 if id == &"patient" else 100, &"state": StaffRuntime.State.AVAILABLE,
+			&"role_tags": [&"medic"], &"permitted_task_tags": [&"rescue"]}}): return false
+	# Actual task.required_items uses the ordinary Runtime reservation callback.
+	if not cmd(&"add_inventory_stack", {&"owner_inventory_id": &"staff.supplies", &"item_id": &"tool/cleaning_kit", &"quantity": 1}): return false
+	return cmd(&"create_staff_task", {&"task_id": TASK, &"task_type": &"rescue_pickup", &"priority": 95, &"options": {
+		&"target_entity_id": &"patient", &"target_cell": Vector3i(0,1,1),
+		&"required_role_tags": [&"medic"], &"task_tags": [&"rescue"],
+		&"required_items": {&"tool/cleaning_kit": 1}, &"estimated_minutes": 30,
+		&"interrupt_level": 0, &"emergency": true}})
+
+func save_point(label: String) -> void:
+	# The raw snapshot is observed immediately before the official save.
+	var point := capture()
+	raw(label, point)
+	var path := "user://saves/p04_s1/" + label
+	var saved := SaveService.save_snapshot(path, point[&"snapshot"])
+	if not io(bool(saved.get(&"ok", false)), "formal save " + label): return
+	var inspected := SaveService.inspect_snapshot(path)
+	io(bool(inspected.get(&"ok", false)) and bool(inspected.get(&"read_only", false)) and var_to_bytes(inspected.get(&"snapshot", {})) == var_to_bytes(point[&"snapshot"]), "formal inspect " + label)
+	slots[label] = ProjectSettings.globalize_path(path)
+
+func safety(row: Dictionary) -> void:
+	var charge_rows: int = row[&"held_after"][&"ledger"].size() - row[&"reserve_exhausted_before_tick"][&"ledger"].size()
+	outcome(charge_rows == 0, "停止中の課金行0")
+	var orphans := 0
+	var states_known := true
+	# Check each observed boundary, both directions, using actual task ownership.
+	for point_name: StringName in [&"boarded", &"stopped", &"held_after", &"final"]:
+		var point: Dictionary = row[point_name]
+		var tasks: Array = point[&"snapshot"][&"systems"][&"runtime"][&"staff"][&"tasks"]
+		var active: Dictionary = {}
+		for reservation: Dictionary in point[&"reservations"]:
+			var state_name := String(reservation[&"state"])
+			if InventoryReservation.State.keys().find(state_name) < 0:
+				states_known = false
+				continue
+			if state_name != InventoryReservation.State.keys()[InventoryReservation.State.ACTIVE]: continue
+			if String(reservation[&"purpose"]) != "staff_task": continue
+			active[String(reservation[&"reservation_id"])] = reservation
+			var linked := false
+			for task: Dictionary in tasks:
+				if String(task[&"task_id"]) == String(reservation[&"requester_id"]) and String(reservation[&"reservation_id"]) in task[&"reservation_ids"]: linked = true
+			if not linked: orphans += 1
+		for task: Dictionary in tasks:
+			for id: Variant in task[&"reservation_ids"]:
+				if not active.has(String(id)): orphans += 1
+	outcome(orphans == 0 and states_known, "予約の孤立0" if states_known else "予約の不明状態")
+	var counts := {&"staff:medic": 0, &"staff:patient": 0}
+	var stops: Array = row[&"boarded"][&"elevator_report"][&"shafts"][0][&"stops"]
+	var requests: Dictionary = {}
+	for trip: Dictionary in row[&"boarded"][&"elevator_report"][&"trips"]: requests[trip[&"actor_id"]] = trip[&"request_id"]
+	for event: Dictionary in row[&"final"][&"arrivals"]:
+		var payload: Dictionary = event["payload"]
+		var actor := StringName(payload.get(&"actor_id", &""))
+		if counts.has(actor) and payload.get(&"request_id") == requests.get(actor) and payload.get(&"cell") in stops: counts[actor] += 1
+	outcome(counts[&"staff:medic"] == 1 and counts[&"staff:patient"] == 1, "到着1回")
+	row[&"safety_raw"] = {&"stopped_ledger_delta": charge_rows, &"orphans": orphans, &"arrivals_by_actor": counts}
+
+func writer_case(label: String, blocked: bool) -> void:
+	if not construct(): return
+	var row := {&"seed": SEED, &"case": label, &"before": capture()}
+	save_point(label + "-before")
+	var reserved := false
+	for tick: int in 130:
+		clock.advance_one_minute()
+		var task: StaffTask = runtime.staff_service.get_task(TASK)
+		if not reserved and not task.reservation_ids.is_empty():
+			row[&"reserved_before_travel"] = pretravel.duplicate(true); reserved = true
+		if task.task_type == &"rescue_transport" and runtime.elevators.get_actor_trip(&"staff:patient").get(&"state") == PathService.ELEVATOR_REQUEST_BOARDED: break
+	if not io(reserved and not pretravel.is_empty() and pretravel.get(&"staff_cell") == Vector3i(5,0,1) and not pretravel[&"task"][&"reservation_ids"].is_empty() and runtime.elevators.get_actor_trip(&"staff:patient").get(&"state") == PathService.ELEVATOR_REQUEST_BOARDED, "real reserved task reaches boarded pair"): return
+	row[&"boarded"] = capture(); save_point(label + "-boarded")
+	var stops: Array = runtime.elevators.get_report()[&"shafts"][0][&"stops"]
+	# Public fixture API reused literally from transport test, not a private mutation.
+	if blocked:
+		for cell: Vector3i in stops: runtime.path_service.configure_cell_traffic(cell, 4, 0, true)
+	var reserve: int = state.get_resource(&"mana")
+	if not cmd(&"change_resources", {&"deltas": {&"mana": -reserve}}): return
+	row[&"reserve_exhausted_before_tick"] = capture()
+	if not cmd(&"set_facility_conditions", {&"facility_id": clinic_id, &"conditions": {&"operator_open": false}}): return
+	clock.advance_one_minute(); row[&"depleted"] = capture(); save_point(label + "-depleted")
+	clock.advance_one_minute(); row[&"stopped"] = capture(); save_point(label + "-stopped")
+	clock.advance_minutes(20); row[&"held_after"] = capture(); save_point(label + "-held")
+	row[&"remaining_minutes_before"] = row[&"stopped"][&"elevator_report"][&"shafts"][0][&"remaining_minutes"]
+	row[&"remaining_minutes_after"] = row[&"held_after"][&"elevator_report"][&"shafts"][0][&"remaining_minutes"]
+	row[&"held_remaining_unchanged"] = row[&"remaining_minutes_before"] == row[&"remaining_minutes_after"]
+	if blocked:
+		for cell: Vector3i in stops: runtime.path_service.configure_cell_traffic(cell)
+		clock.advance_one_minute()
+	row[&"landing"] = capture(); save_point(label + "-landing")
+	if not cmd(&"change_resources", {&"deltas": {&"mana": reserve}}): return
+	clock.advance_minutes(45 if blocked else 1)
+	row[&"final"] = capture(); save_point(label + "-recovered")
+	row[&"reservation_release_raw"] = runtime.staff_service.get_task(TASK).create_snapshot()
+	safety(row); observations[label] = row; raw(label + "-observations", row)
+
+func reader() -> void:
+	var receipt := read_json(folder.path_join("writer.json"))
+	if not io(int(receipt.get("pid", 0)) != OS.get_process_id() and String(receipt.get("profile", "")) != OS.get_user_data_dir(), "distinct Reader PID/profile"): return
+	for label: String in receipt["slots"]:
+		if not reset(): return
+		var original := String(receipt["slots"][label])
+		var target := ProjectSettings.globalize_path("user://saves/p04_s1/" + label)
+		if not io(DirAccess.make_dir_recursive_absolute(target) == OK, "reader package directory"): return
+		var directory := DirAccess.open(original)
+		if not io(directory != null, "writer package exists"): return
+		var members := directory.get_files(); members.sort()
+		if not io(directory.get_directories().is_empty() and members == PackedStringArray(["journal.log", "manifest.json", "thumbnail.png", "world.bin"]), "complete formal package"): return
+		for member: String in members:
+			if not io(DirAccess.copy_absolute(original.path_join(member), target.path_join(member)) == OK and FileAccess.get_sha256(original.path_join(member)) == FileAccess.get_sha256(target.path_join(member)), "exact formal member"): return
+		var loaded := SaveService.load_snapshot(target)
+		if not io(bool(loaded.get(&"ok", false)), "formal Reader load"): return
+		if not io(runtime.restore_snapshot(loaded[&"snapshot"]), "public Reader restore"): return
+		var expected := typed(folder.path_join("writer-" + label + ".var"))
+		if not io(expected.has(&"snapshot"), "writer point exists"): return
+		io(var_to_bytes(runtime.create_snapshot()) == var_to_bytes(expected[&"snapshot"]), "Reader exact typed snapshot")
+		var point := capture() # No tick after formal restore.
+		point[&"writer_observation"] = expected
+		observations[label] = point; slots[label] = target; raw(label, point)
+	for label: String in ["landing", "no-safe-landing"]:
+		var row := typed(folder.path_join("writer-" + label + "-observations.var"))
+		if not io(not row.is_empty(), "writer case exists"): return
+		for pair: Array in [[&"boarded", "boarded"], [&"stopped", "stopped"], [&"held_after", "held"], [&"final", "recovered"]]:
+			var point: Dictionary = observations[label + "-" + pair[1]]
+			for key: StringName in [&"snapshot", &"ledger", &"reservations"]: row[pair[0]][key] = point[key]
+		# Arrival history is Writer raw; Reader proves restored state separately.
+		safety(row); raw(label + "-observations", row)
+
+func run() -> void:
+	folder = OS.get_environment("THE_TREE_S1_EVIDENCE"); mode = OS.get_environment("THE_TREE_S1_MODE")
+	if folder.is_empty() or mode not in ["writer", "reader"]: quit(2); return
+	if not io(DirAccess.make_dir_recursive_absolute(folder) == OK, "evidence directory"): quit(2); return
+	if mode == "writer":
+		writer_case("landing", false); writer_case("no-safe-landing", true)
+	else: reader()
+	raw("observations", observations)
+	var receipt := {&"pid": OS.get_process_id(), &"profile": OS.get_user_data_dir(), &"slots": slots,
+		&"checks": checks, &"failures": failures, &"operational_errors": errors,
+		&"whole_goal_accepted": false, &"unit_accepted": false}
+	var file := FileAccess.open(folder.path_join(mode + ".json"), FileAccess.WRITE)
+	if io(file != null, "phase receipt"):
+		file.store_string(JSON.stringify(receipt, "\t")); file.flush(); file.close()
+	cleanup()
+	print("S1 EV power: %d checks, %d failures" % [checks, failures])
+	quit(1 if failures or not errors.is_empty() or checks != 6 else 0)
@@ -0,0 +1,253 @@
+#!/usr/bin/env python3
+"""S1-only native entry. --check-only never loads ownership helpers or starts Godot."""
+from pathlib import Path
+import argparse
+import hashlib
+import importlib.util
+import json
+import os
+import shutil
+import subprocess
+import sys
+sys.dont_write_bytecode = True
+
+HERE = Path(__file__).resolve().parent
+BUILD = Path("/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build")
+PRODUCT = Path("/Users/korizatou114/Projects/とりにく工房ゲーム制作部")
+CACHE_RUN = Path("/Users/korizatou114/Projects/TheTree-managed-worktrees/p18-01-model/.runtime/P18-01-CODE/build/p18-relationship-evidence")
+TEST = "tests/s3/test_runtime_staff_assignment.gd"
+QA = HERE / "p04_s1_ev_power_probe.gd"
+ENGINE = Path("/Applications/Godot.app/Contents/MacOS/Godot")
+MATERIALS = [
+    BUILD / "audit-support/p04-whole-closure-r01/current-patterns/p04-idempotency-paid-formal-native-r01.py",
+    BUILD / "audit-support/p04-whole-closure-r01/current-patterns/idempotency-paid-formal-r01.gd",
+    BUILD / "audit-support/p04-whole-closure-r01/SOURCE_MANIFEST.json",
+    BUILD / "audit-support/p04-native-existing-sources/p04-01-power-formal-recovery-r04.gd",
+    BUILD / "audit-support/p04-native-existing-sources/p04-01-power-formal-recovery-native-r04.py",
+    BUILD / "audit-support/p04-native-existing-sources/SOURCE_MANIFEST.json",
+    BUILD / "audit-support/native-first-current/SOURCE_MANIFEST.json",
+    BUILD / "audit-support/native-first-current/actual-native/runner-input.json",
+    BUILD / "audit-support/p04-current-native-series-r01/SOURCE_MANIFEST.json",
+    BUILD / "audit-support/p04-current-native-series-r01/p04-idempotency-paid-formal-native-r01/runner-input.json",
+]
+
+def module(name, path):
+    spec = importlib.util.spec_from_file_location(name, path)
+    value = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(value)
+    return value
+
+def pin(path):
+    path = Path(path)
+    if path.is_symlink() or not path.is_file():
+        raise ValueError("missing exact input: " + str(path))
+    data = path.read_bytes()
+    return dict(path=str(path), bytes=len(data), sha256=hashlib.sha256(data).hexdigest())
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--project-root", type=Path, default=PRODUCT)
+    parser.add_argument("--output", type=Path, default=BUILD / "p04-s1-native-r01")
+    parser.add_argument("--plan", type=Path, default=BUILD / "p04-s1-plan-r01.json")
+    parser.add_argument("--cache-run", type=Path, default=CACHE_RUN)
+    parser.add_argument("--godot", type=Path, default=ENGINE)
+    parser.add_argument("--check-only", action="store_true")
+    args = parser.parse_args()
+    root = args.project_root.resolve()
+    out = args.output.resolve()
+    r = module("s1_standard_runner", root / "tools/run_all_tests.py")
+    # Preserve the reviewed source_refs -> exactly one QA override order.
+    source_before = r.source_refs(root)
+    refs = dict(source_before)
+    refs[TEST] = pin(QA)
+    expected = {n: dict(bytes=p["bytes"], sha256=p["sha256"]) for n, p in refs.items()}
+    fixed = [pin(p) for p in MATERIALS + [
+        QA, Path(__file__), HERE / "S1_ROOT_RUN.md",
+        root / "tests/transport/test_runtime_transport.gd",
+        root / "tests/staff/test_rescue_elevator.gd",
+        root / "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json",
+    ]]
+    selected = dict(root_before=source_before, map={n: p["sha256"] for n, p in refs.items()}, timeout=1200)
+    cache_note = None
+    cache_receipts = []
+    for leaf in ["runner-ended.json", "runner-input.json"]:
+        path = args.cache_run / leaf
+        try:
+            cache_receipts.append(pin(path))
+        except OSError as caught:
+            cache_note = dict(path=str(path), error=type(caught).__name__ + ": " + str(caught),
+                              required_before_native=True)
+            break
+    plan = dict(protocol="p04-s1-preparation-v1", project_root=str(root), output=str(out),
+                source_before=source_before, selected_source_map=selected["map"],
+                QA_overrides=[TEST], fixed_input_pins=fixed, cache_run=str(args.cache_run),
+                cache_receipts=cache_receipts, cache_access=cache_note,
+                phases=["import", "parse", "writer", "reader"],
+                native_engine_launches=0, whole_goal_accepted=False, unit_accepted=False)
+    # Check-only only reads source/materials and writes the plan in task build.
+    # It deliberately does not read default-player data, inspect processes or stat Godot.
+    if args.check_only:
+        args.plan.parent.mkdir(parents=True, exist_ok=True)
+        if args.plan.exists():
+            r.require(r.read(args.plan) == plan, "existing plan differs; use a fresh plan path")
+        else:
+            r.write(args.plan, plan)
+        print(json.dumps(dict(check_only=True, engines=0, source_files=len(source_before),
+                              QA_overrides=[TEST], fixed_pins=len(fixed), plan=str(args.plan),
+                              plan_sha256=r.sha(args.plan), cache_access=cache_note), ensure_ascii=False))
+        return 0
+    r.require(args.plan.is_file() and r.read(args.plan) == plan, "run exact check-only plan first")
+    def fixed_guard():
+        for value in fixed + cache_receipts:
+            r.require(pin(value["path"]) == value, "fixed input changed: " + value["path"])
+    fixed_guard()
+    # Native admission is Root-only and fails closed on unreadable cache.
+    r.require(cache_note is None, "Root must read exact cache receipts: " + str(cache_note))
+    old = args.cache_run
+    r.require(r.read(old / "runner-ended.json")["passed"], "ended cache run must have passed")
+    old_map = r.read(old / "runner-input.json")["selected_source_map"]
+    current_map = {n: p["sha256"] for n, p in source_before.items()}
+    r.require(old_map == current_map, "ended cache selected source must equal current product")
+    protected = r.default_player(root)
+    outer = module("s1_owned_outer", r.SUPPORT / "owned_outer.py")
+    r.require(not outer.native.helper["live_engines"](), "another Godot owns CPU")
+    engine = args.godot.resolve()
+    r.require(engine.is_file(), "Root native Godot path")
+    r.require(shutil.disk_usage(out.parent).free >= 1024**3 + engine.stat().st_size + 136*1024**2,
+              "reviewed native disk admission")
+    r.require(not out.exists(), "fresh output required; preserve previous attempts")
+    out.mkdir()
+    stage = out / "stage"
+    stage.mkdir()
+    (out / "starters").mkdir()
+    (out / "bootstrap").mkdir()
+    phases = []
+    previous = {}
+    error = None
+    guards = []
+    cleanup = []
+    cleanup_errors = []
+    cache_before = None
+    formal_before = None
+    formal_after = None
+    original_phase = outer.run_phase
+    def run_phase(argv, folder, timeout, env, **kwargs):
+        env = dict(env)
+        if folder.name in ["writer", "reader"]:
+            env.update(THE_TREE_S1_EVIDENCE=str(out / "raw"), THE_TREE_S1_MODE=folder.name)
+        return original_phase(argv, folder, timeout, env, **kwargs)
+    outer.run_phase = run_phase
+    r.write(out / "runner-started.json", dict(started=r.now(), owner_runner_pid=os.getpid(),
+            plan=pin(args.plan), engines_launched=0))
+    try:
+        r.write(out / "source_before.json", source_before)
+        r.write(out / "selected-source-map.json", refs)
+        # Private source stage first, then literal reviewed bootstrap.
+        for name, value in refs.items():
+            target = stage / name
+            target.parent.mkdir(parents=True, exist_ok=True)
+            r.copy_source(Path(value["path"]), target)
+        r.require(r.inventory(stage, stage=True) == expected, "whole private source")
+        for name, value in r.read(r.SUPPORT / "bootstrap-scripts.json").items():
+            data = value["text"].encode()
+            r.require(hashlib.sha256(data).hexdigest() == value["sha256"], "bootstrap pin")
+            (out / "bootstrap" / name).write_bytes(data)
+        cache = old / "stage/.godot"
+        cache_before = r.inventory(cache)
+        r.require(bool(cache_before), "nonempty ended cache")
+        for name in cache_before:
+            src = cache / name
+            dst = stage / ".godot" / name
+            dst.parent.mkdir(parents=True, exist_ok=True)
+            subprocess.run(["/bin/cp", "-c", str(src), str(dst)], check=True)
+            r.require((src.stat().st_dev, src.stat().st_ino) != (dst.stat().st_dev, dst.stat().st_ino),
+                      "cache clone is a separate inode")
+        r.require(r.inventory(stage / ".godot") == cache_before, "whole cache clone hashes")
+        r.write(out / "cache-reuse.json", dict(ended_run=str(old), receipts=cache_receipts,
+                whole_cache=cache_before, independent_inode=True,
+                ordinary_import_required=True, ordinary_parse_required=True))
+        paths = ["res://" + n for n in sorted(refs) if n.endswith(".gd")]
+        r.write(out / "parse-paths.json", paths)
+        markers = module("s1_markers", root / "tools/strict_test_markers.py")
+        contracts = markers.load_contracts(root / "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json")
+        contracts[TEST] = dict(test=TEST, template="S1 EV power: <checks> checks, <failures> failures", required=True)
+        policy = r.read(r.SUPPORT / "suite-policy.json")
+        r.require(TEST not in policy["suite_policies"], "no normal suite watchdog/policy override")
+        r.write(out / "contracts.json", contracts)
+        r.write(out / "runner-input.json", dict(plan, owner_runner_pid=os.getpid(),
+                wrapper_sha256=r.sha(__file__), QA=pin(QA), runner_sha256=r.sha(root / "tools/run_all_tests.py"),
+                default_player_before=protected, fixed_input_pins=fixed,
+                functional_watchdog_seconds=1200, source_adoption=False))
+        diagnostics = module("s1_diagnostics", r.SUPPORT / "diagnostic_gate.py")
+        owners = module("s1_owners", r.SUPPORT / "ordinary_proof_gate.py")
+        audio = module("s1_audio", r.SUPPORT / "audio_evidence_gate.py")
+        public = (stage / "project.godot").read_bytes()
+        for phase, test in [("import", None), ("parse", None), ("writer", TEST), ("reader", TEST)]:
+            if phase == "reader":
+                writer = r.read(out / "raw/writer.json")
+                formal_before = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
+                r.require(len(formal_before) == 14, "all fourteen formal writer points")
+            row = r.execute_phase(str(engine), stage, out, phase, test, selected, expected,
+                                  previous, policy, contracts, paths, public, protected, root,
+                                  outer, markers, diagnostics, owners, audio)
+            phases.append(row)
+            # execute_phase uses the same test log name; retain each phase's exact log too.
+            if test and row.get("log"):
+                (out / (phase + "-combined-raw.log")).write_bytes((out / row["log"]).read_bytes())
+                row["strict_runner_log_path"] = row["log"]
+                row["log"] = phase + "-combined-raw.log"
+            r.write(out / (phase + "-actual-phase.json"), row)
+            print(json.dumps(dict(phase=phase, passed=row["passed"], error=row.get("validation_error"))), flush=True)
+            r.require(row["passed"], "first strict phase failure: " + phase)
+            if phase in ["writer", "reader"]:
+                receipt = r.read(out / ("raw/" + phase + ".json"))
+                r.require(receipt["checks"] == 6 and receipt["failures"] == 0 and not receipt["operational_errors"],
+                          "exact S1 outcome/operational receipt")
+                r.require(receipt["pid"] == row["actual_pid"], "actual native PID/receipt")
+        writer = r.read(out / "raw/writer.json")
+        reader = r.read(out / "raw/reader.json")
+        r.require(writer["pid"] != reader["pid"] and writer["profile"] != reader["profile"], "distinct formal processes")
+        formal_after = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
+        r.require(formal_before == formal_after, "Reader leaves Writer packages unchanged")
+    except BaseException as caught:
+        error = type(caught).__name__ + ": " + str(caught)
+    finally:
+        cleanup, cleanup_errors = outer.finish_captured(outer.OWNED)
+        try:
+            r.write(out / "outer-owned-finally.json", dict(cleanup=cleanup, errors=cleanup_errors))
+        except BaseException as caught:
+            guards.append("finally receipt: " + type(caught).__name__ + ": " + str(caught))
+    # Fixed guard always follows ownership cleanup, even if setup or an engine failed.
+    try:
+        fixed_guard()
+        after = r.source_refs(root)
+        r.write(out / "source_after.json", after)
+        r.require(after == source_before, "whole product source unchanged")
+        r.require(r.default_player(root) == protected, "default player unchanged")
+        if (stage / "project.godot").exists():
+            r.require(r.inventory(stage, stage=True) == dict(expected, **previous), "whole private source unchanged")
+        if cache_before is not None:
+            r.require(r.inventory(old / "stage/.godot") == cache_before, "original cache unchanged")
+    except BaseException as caught:
+        guards.append(type(caught).__name__ + ": " + str(caught))
+    pids = [p.pid for p in outer.OWNED]
+    passed = (error is None and not guards and not cleanup_errors and len(phases) == 4
+              and all(p["passed"] for p in phases) and len(pids) == len(set(pids)) == 4
+              and all(p["engine_ended"] for p in cleanup))
+    execution = dict(passed=passed, error=error, guard_errors=guards, phases=phases,
+                     actual_captured_PIDs=pids, cleanup=cleanup, cleanup_errors=cleanup_errors,
+                     formal_before=formal_before, formal_after=formal_after,
+                     whole_goal_accepted=False, unit_accepted=False)
+    r.write(out / "raw-inventory.json", r.inventory(out / "raw"))
+    r.write(out / "PID-set.json", dict(owner_runner_pid=os.getpid(), engine_PIDs=pids))
+    r.write(out / "execution.json", execution)
+    r.write(out / "runner-ended.json", dict(execution, ended=r.now()))
+    print(json.dumps(dict(passed=passed, error=error, guard_errors=guards, output=str(out))))
+    return 0 if passed else 1
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except Exception as caught:
+        print(type(caught).__name__ + ": " + str(caught), file=sys.stderr)
+        raise SystemExit(2)
@@ -0,0 +1,122 @@
+# P04-01 S2a Root run（code-ready提出用・実測未実施）
+
+repair12確認: worktreeのoperations_coordinator.gd SHA256は
+`871a248ee101b6df543fd5cf0440b5d4b0f02c21fa145a99f0687888c1bc6f90`。
+製品パスの直接読取はOSが拒否したが、Root r01のsource_before.jsonに記録された
+同ファイルの製品pin（130891 bytes）と一致した。
+
+## repair12の判断と検証境界
+
+ROOT_S2A_NATIVE_R01_RESULT.json、r01 source_before.json、execution.json、Reader stderr、
+raw Writer C1 join/C2 recall/C3 midnightとReader C3 branchのJSONを直接確認した。
+対応する型保持.varも全バイトを読みSHAを確認した。原本を保持し、workerはengineで復号・再実行しない。
+Readerの失敗はformal equality day_summaryの1件。実勤務はAkaneの1+236分、
+Bardoの361分（0勤務取消shiftも存在）、維持費は3行がledger_00000082を共有する。
+
+受入JSON、既存S2条件、ORDER_AUDITは決算内容・決定的順序・重複防止・保存復元を要求し、
+getterのDictionary挿入順やStringNameキー型の保存前後不変を要求していない。
+OperationsCoordinator:577-580は内部duplicate、668-710と2943-3065は保存用のString化・sort、
+restore:734と_parse_historiesは保存形を内部へ採用する。したがって製品変更は不要と判断した。
+JSON正規化で一致を作らず、create_snapshot.day_summariesのday==1をそのまま取り出して
+Writer/Readerのvar_to_bytes完全一致を必須とする。raw getterは保持し、再帰typeof・キー型・
+キー順fingerprint、rawバイト比較結果も保存する。rawとcanonicalは全キーをString(key)で
+一対一照合し、全値を再帰的に型込みで検査する。StringName/Stringだけは明示した差分種別で
+照合し、その他の型差・値差・欠落は失敗する。配列の順序も維持する。
+
+paid.payment>0の各staffを同日の実worked/overtime>0のshiftへ結合し、各shiftの実deltaを
+照合してからpayroll取引IDを集計する。Bardoは1439→1440でworked+1、Akaneは+0、
+同分recallは双方+0、overtime差分は0が必須。0勤務取消shiftは実勤務根拠にしない。
+維持費distinct取引数は1を維持し、売上時点・日帰属は変えない。
+Runtime全体、ledger/payroll、4member SHA、原本不変、recall typed不変は従来どおり必須。
+
+Rootはfresh r02 plan/outputでimport/parse/Writer/別PID Readerを各1回だけ正式実行する。
+r01のFAILをr02の成功として扱わない。worker検証はpy_compileとwrapper --check-onlyのみ。
+engine0、default/private profile読取0、手動commit0、全回帰0。原30/88、部分点0を維持する。
+
+repair12 worker検証: py_compile成功、--check-only成功（source1300、QA1、固定pin17、engine0）。
+終了済cache receiptはPermissionErrorをplanへ記録した。Rootは自身の権限で確認する必要がある。
+GDScript parseとnativeの成否は未検証で、正式なr02実行に委ねる。
+
+原P04の完成加点は0。独立したwhole受入の前段の準備資料であり、D05、whole受入、独立レビュー、統合を確定しない。
+Rootは新しいcode-readyの提出が出るまでengineを起動しない。
+workerはGodot起動（parse、--check-only、--versionを含む）、S1再実行、全回帰、commitを行わない。
+
+## 入力の確認
+
+`BUILD_OUTPUT_DIR/audit-support/p04-whole-closure-r01/current-patterns/` の供給ファイルを直接読んだ結果は以下のとおり。指定値に全一致した。
+
+| ファイル | bytes | SHA256 |
+| --- | ---: | --- |
+| paid-shift-midnight-formal-r01.gd | 7667 | 4c56ff05b1bcf8775bb526a30ed021a4a2630ea4f360a5075f880806b052e6d1 |
+| p04-paid-shift-midnight-native-r01.py | 6580 | 23bf2e241c7828b6533aa8107b3d33e962d5c53300a71b198e6fe371e0d4f4f0 |
+| p04-paid-shift-midnight-formal-native-r01.py | 7765 | e3b6eab32dd4fe3dfbff7ae9b67b34dd674236018bdb6bc7c64da25898ff5ed6 |
+
+`SUPPLEMENT_SOURCE_MANIFEST_R02.json`を読み、上記3ファイルと合わせてwrapperが直接pinする。旧SOURCE_MANIFESTに名前がないことを欠落とは解釈しない。
+paid-shift-midnight / formal / idempotency-paid-formalの各GDと対応native Python、ROOT_S1_NATIVE_R02_RESULT.json、既存S1の3ファイルもpinする。
+Root S1結果のSource1338、owned engine4終了は履歴資料でありS2aの実行結果へ転用しない。
+
+セットアップは原paid-shift-midnight-r01.gdの開始から23:59までと_setup_paid_receptionを機械的に抽出して保持した。
+wrapperは毎回templateを直接読み、両ブロックのliteral一致を確認する。公的hire、DAY/NIGHT、原catalog賃金、原施設価格・サービス時間、材料1つを変更しない。
+厨房を1439で閉じる処理を省くことだけがシナリオ差分。公開helperを継承し、snapshot内部への書込みはない。
+
+## Root手順
+
+既定製品rootは `/Users/korizatou114/Projects/とりにく工房ゲーム制作部`。
+以下のBUILD_OUTPUT_DIRは `/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build`。
+製品rootのfresh source planを作成し、nativeを1回だけ実行する。既存のplan/outputは上書き・削除しない。
+失敗時は最初の失敗で停止し、自動再試行しない。再実行はRootの判断と新しいplan/outputを必要とする。
+
+```sh
+export BUILD_OUTPUT_DIR='/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build'
+export PYTHONDONTWRITEBYTECODE=1
+python3 docs/plans/original-completion-2026-10-02/execution/p04-01/s2/run_s2a_native.py --check-only --plan "$BUILD_OUTPUT_DIR/p04-s2a-root-plan-r02.json" --output "$BUILD_OUTPUT_DIR/p04-s2a-native-r02"
+python3 docs/plans/original-completion-2026-10-02/execution/p04-01/s2/run_s2a_native.py --plan "$BUILD_OUTPUT_DIR/p04-s2a-root-plan-r02.json" --output "$BUILD_OUTPUT_DIR/p04-s2a-native-r02"
+```
+
+wrapperのパスはこの提出checkoutのものを使う。実行cwdに依存して製品sourceを選ばず、既定product rootを使用する。
+workerのcheckout向けcheck-only planはRootの製品planへ転用しない。
+check-onlyはwrapperのmodeであり、Godot起動0、default/private profile読取0。sourceと固定資料、cache receiptだけを読む。
+cache receiptが読めない場合は実際のpath/errorをplanに記録し、native admissionは拒否する。
+
+## ケースと証拠
+
+Writerはseed424242の独立fresh Runtimeを3回作り、各branchを1回ずつ実施する。
+
+- C1 midnight_sale_payroll_upkeep：原のclock advanceで1440にserviceを完了し、同じadvanceでDay1決算。実sale transaction IDをservice.paymentのIdempotency記録でservice IDへjoinし、request ID・予約IDと照合する。WAGEのsource_entity_idを実payroll settlement IDへjoinし、各paid rowのstaff_idとsettlement.day（1始まり）をShiftInstance.staff_id/start_day（0始まり）へjoinする。取引IDをdistinctで数え、行数・勤務分数を取引数の代わりにしない。
+- C2 same_minute_recall：別fresh stateから1440へ到達した直後、current_minute==1440で公開advance_to(1440)を1回呼ぶ。ok/code/payloadとCommandResult全体を記録し、全typed snapshot、ledger、payroll、day_summary、shifts不変を検査。request再送や1443からの過去呼出しで代用しない。
+- C3 formal_restore：別fresh stateからC1と同じ境界に到達し、公的SaveServiceで1slotを保存。別PID/profileのReaderが4member全コピーとSHA一致、公的load/restore、typed snapshot完全一致、ledger/payroll/canonical day1完全一致とraw getter結合を確認。復元直後の1440でadvance_to(1440)を再度呼び、実結果と再決算0を採取する。
+
+勤務分は全shiftのbefore/after、worked_minutesとovertime_minutes差分を保持する。
+孤立予約0は対象serviceの予約と実予約行のrequester_id/purpose/CONSUMEDを照合し、ACTIVE facility_service予約は原requestのreserved_inventory_idsへ照合する。未知stateは失敗する。
+sale/payroll/upkeep/dutyは全ledgerと正式snapshotに加えjoin行に保持する。停止条件はないため、1440の売上・給与・維持費ledgerを「停止中課金ledger0」と判定しない。「停止中課金0」は実停止条件を満たす別probeの受入条件として残る。
+
+出力は `BUILD_OUTPUT_DIR/p04-s2a-native-r02/`。rawの各観測はJSON（閲覧用）と.var（型保持）の対で保存する。FAILも原値のまま残す。
+seed、入力、日、minute、実取引/service/request/予約ID、勤務差分、ledger全行、commands、全Runtime snapshot、operations/Idempotency、upkeep accrual/settlementを保持する。
+Writer各branchのbefore/midnight/join/branch、C2 recall、Reader C3 branch/recall、phase receiptを保存する。
+private profile内のWriter/Reader formal package（journal.log、manifest.json、thumbnail.png、world.bin）を保持する。
+source_before/after、selected-source-map、runner-input、cache-reuse、parse-paths、contracts、各phase raw logs/receipts、退避combined-raw.log、PID-set、outer-owned-finally、execution、runner-ended、raw-inventoryも全保存する。
+
+## strict guard
+
+S1 wrapperの手順を同順序で複製：source_refs → 明示QA1 → 別inodeのprivate source/cache → import1 → parse1 → Writer → 別PID Reader → owned finally → 全guard。
+
+- fresh output、exact check-only plan、全source pin、固定資料pin、供給3pinと補足manifest、literal setup一致
+- passed終了済cache receiptと製品selected source map完全一致、cache全hash、cp -c別inode
+- 他engine不在、既存disk admission、既存watchdog/policy/diagnostic/ownership/audio/marker gate
+- 製品source/default player不変、private source全体不変、原cache不変
+- Writer/Readerの実PIDとreceipt一致、別PID/profile、4phase/4owned PID、全engine owned終了
+- formal全member hash一致、Writer原slot不変（Reader失敗時もguard）、typed完全一致
+- finallyでcaptured owned process cleanup。cleanup/fixed guard失敗も失敗receiptに保持
+
+exit0でも原P04の完成ではない。native未実行のため、実測checks数・case結果を予測で埋めない。
+worker検証はpy_compileとwrapper --check-onlyだけ。Godot parseはRootの正式nativeのparse phaseで行う。
+
+worker静的確認：py_compile成功。wrapper --check-only成功、engine0・private profile読取0、source checkout1300件・QA1・固定pin17件。
+終了済cacheの `runner-ended.json` はOSからPermissionError（Operation not permitted）で読取拒否された。
+planはその実path/errorをcache_accessへ記録した。Root製品1338件の確認は代行していない。
+Rootは製品rootでfresh planを作り、cache receiptを自身の権限で確認する。worker planは実runへ転用しない。
+
+## 残件
+
+S2bの夜番不在と残業は勤務生成と時刻条件が別系統なので分ける。
+本提出の実測、元の停止条件の別probe、独立whole受入・レビュー・必要OS証拠・統合はRoot側の後続。
@@ -0,0 +1,397 @@
+extends "res://tests/s3/test_runtime_actor_hardening.gd"
+var _mode := ""
+var _slots: Dictionary = {}
+var _branches: Dictionary = {}
+var _commands: Array = []
+
+func _run() -> void:
+	_evidence_dir = OS.get_environment("THE_TREE_S2A_EVIDENCE")
+	_mode = OS.get_environment("THE_TREE_S2A_MODE")
+	if _evidence_dir.is_empty() or _mode not in ["writer", "reader"]: quit(2); return
+	_expect(DirAccess.make_dir_recursive_absolute(_evidence_dir) == OK, "evidence directory")
+	if _mode == "writer":
+		for branch: String in ["C1", "C2", "C3"]: _writer_branch(branch)
+	else: _reader_branch()
+	_write_var("branches", _branches)
+	var receipt := {&"pid": OS.get_process_id(), &"profile": OS.get_user_data_dir(), &"slots": _slots,
+		&"checks": _checks, &"failures": _failures, &"branches": _branches.keys(),
+		&"whole_goal_accepted": false, &"unit_accepted": false}
+	var file := FileAccess.open(_evidence_dir.path_join(_mode + ".json"), FileAccess.WRITE)
+	_expect(file != null, "phase receipt")
+	if file != null: file.store_string(JSON.stringify(receipt, "\t")); file.flush(); file.close()
+	_cleanup()
+	print("S2a midnight: %d checks, %d failures" % [_checks, _failures])
+	quit(1 if _failures else 0)
+
+func _writer_branch(branch: String) -> void:
+	_case = _mode + "-" + branch
+	_serial = 0; _expected_daily_wages = 0; _commands.clear(); _observations.clear()
+	_prepare_midnight()
+	var before := _capture()
+	_write_var("before", before)
+	_expect(before[&"active_reservation_orphans"] == 0, "pre-midnight active reservation ownership")
+	_expect(_clock.absolute_minute == 1439 and _runtime.operations_coordinator.current_minute == 1439, "fresh branch before midnight")
+	# Only scenario change: omit dependency closure. The ordinary clock performs
+	# completion and daily close in the same advance. No snapshot mutation.
+	_clock.advance_one_minute()
+	var after := _capture()
+	var joined := _join(before, after)
+	_write_var("midnight", after); _write_var("join", joined)
+	_expect(_clock.absolute_minute == 1440 and _runtime.operations_coordinator.current_minute == 1440, "midnight reached")
+	_expect(after[&"service"][&"completed_at"] == 1440 and joined[&"sales"].size() == 1, "actual one midnight service sale")
+	_expect(joined[&"sale_join_complete"], "sale transaction idempotency joins actual service and reservations")
+	_expect(int(after[&"day_summary"].get(&"closed_at", -1)) == 1440, "same advance closes Day 1")
+	_expect(joined[&"payroll_transaction_ids"].size() == 1 and joined[&"payroll_join_complete"], "actual payroll transaction joins paid Staff and day shifts")
+	_expect(joined[&"upkeep_transaction_ids"].size() == 1, "one distinct actual upkeep transaction")
+	_expect(joined[&"orphans"] == 0, "reservation orphans zero")
+	var row := {&"before": before, &"midnight": after, &"join": joined}
+	if branch == "C2": row[&"recall"] = _recall()
+	if branch == "C3":
+		var path := "user://saves/p04_s2a/C3"
+		var saved := SaveService.save_snapshot(path, after[&"snapshot"])
+		var inspected := SaveService.inspect_snapshot(path)
+		row[&"save_result"] = saved
+		_expect(bool(saved.get(&"ok", false)) and bool(inspected.get(&"ok", false)) and bool(inspected.get(&"read_only", false)), "formal SaveService save/inspect")
+		_expect(var_to_bytes(inspected.get(&"snapshot", {})) == var_to_bytes(after[&"snapshot"]) and var_to_bytes(_runtime.create_snapshot()) == var_to_bytes(after[&"snapshot"]), "save preserves entire typed state")
+		_slots["C3"] = ProjectSettings.globalize_path(path)
+	_branches[branch] = row; _write_var("branch", row)
+
+func _capture() -> Dictionary:
+	var raw_day: Dictionary = _runtime.operations_coordinator.get_day_summary(1)
+	var canonical_day: Dictionary = {}
+	var day_count := 0
+	for day: Dictionary in _runtime.operations_coordinator.create_snapshot()["day_summaries"]:
+		if int(day["day"]) == 1:
+			canonical_day = day
+			day_count += 1
+	var day_differences: Array = []
+	var day_join := _day_join(raw_day, canonical_day, "$", day_differences)
+	_expect(day_join and day_count == (0 if raw_day.is_empty() else 1), "raw getter joins every canonical day1 key and typed value")
+	var ledger: Array = []
+	for entry: LedgerEntry in _runtime.economy_service.get_entries(): ledger.append(entry.to_dictionary())
+	var reservations: Array = []
+	for reservation: InventoryReservation in _runtime.inventory_service.get_reservations(): reservations.append(reservation.create_snapshot())
+	var service: ServiceInstance = _runtime.facility_service.get_service(_service_id)
+	var staff: Dictionary = _runtime.staff_service.create_snapshot()
+	var active_orphans := 0
+	for reservation: Dictionary in reservations:
+		if InventoryReservation.State.keys().find(String(reservation[&"state"])) < 0: active_orphans += 1
+		if reservation[&"state"] != "ACTIVE" or reservation[&"purpose"] != "facility_service": continue
+		var request: ServiceRequest = _runtime.facility_service.get_request(StringName(reservation[&"requester_id"]))
+		if request == null or not request.reserved_inventory_ids.has(StringName(reservation[&"reservation_id"])): active_orphans += 1
+	if service != null and not service.is_terminal():
+		for id: StringName in service.inventory_reservations:
+			var reservation: InventoryReservation = _runtime.inventory_service.get_reservation(id)
+			if reservation == null or not reservation.is_active() or reservation.requester_id != service.request_id: active_orphans += 1
+	return {&"seed": 424242, &"day": _clock.absolute_minute / 1440 + 1, &"minute": _clock.absolute_minute,
+		&"inputs": {&"facility_id": _facility_id, &"service_id": _service_id, &"request_id": _request_id, &"guest_id": _guest_id, &"original_price": _original_price},
+		&"snapshot": _runtime.create_snapshot(), &"ledger": ledger, &"reservations": reservations, &"active_reservation_orphans": active_orphans,
+		&"service": service.create_snapshot() if service != null else {}, &"staff": staff,
+		&"payroll": staff[&"payroll_settlements"], &"shifts": staff[&"shifts"],
+		&"day_summary": raw_day, &"canonical_day1": canonical_day,
+		&"day_summary_diagnostic": {&"raw": _fingerprint(raw_day), &"canonical": _fingerprint(canonical_day), &"differences": day_differences, &"join_complete": day_join},
+		&"idempotency": {&"commands": _runtime.command_queue.create_snapshot(), &"economy": _runtime.economy_service.create_snapshot()[&"idempotency"]},
+		&"upkeep": {&"accrual": _runtime.facility_upkeep.create_snapshot(), &"settlement": _runtime.upkeep_settlement.create_snapshot()},
+		&"operations": _runtime.operations_coordinator.create_snapshot(),
+		&"commands": _commands.duplicate(true), &"setup_observations": _observations.duplicate(true)}
+
+func _fingerprint(value: Variant) -> Dictionary:
+	var result := {"typeof": typeof(value), "type": type_string(typeof(value))}
+	if value is Dictionary:
+		var entries: Array = []
+		for key: Variant in value:
+			entries.append({"key": str(key), "key_typeof": typeof(key), "value": _fingerprint(value[key])})
+		result["entries_in_order"] = entries
+	elif value is Array:
+		var children: Array = []
+		for child: Variant in value: children.append(_fingerprint(child))
+		result["elements"] = children
+	return result
+
+func _day_join(raw: Variant, saved: Variant, path: String, differences: Array) -> bool:
+	if typeof(raw) != typeof(saved):
+		var text_pair := typeof(raw) in [TYPE_STRING, TYPE_STRING_NAME] and typeof(saved) in [TYPE_STRING, TYPE_STRING_NAME]
+		differences.append({"path": path, "kind": "StringName_String" if text_pair else "type_mismatch", "raw_type": typeof(raw), "saved_type": typeof(saved)})
+		return text_pair and String(raw) == String(saved)
+	if raw is Dictionary:
+		var matched: Dictionary = {}
+		var ok: bool = raw.size() == saved.size()
+		var raw_order: Array = []
+		var saved_order: Array = []
+		for key: Variant in saved: saved_order.append(String(key))
+		for key: Variant in raw:
+			var name := String(key)
+			raw_order.append(name)
+			if matched.has(name) or not saved.has(name):
+				ok = false
+				continue
+			matched[name] = true
+			if typeof(key) != TYPE_STRING:
+				differences.append({"path": path + "/" + name, "kind": "key_StringName_String" if typeof(key) == TYPE_STRING_NAME else "invalid_key_type", "raw_type": typeof(key), "saved_type": TYPE_STRING})
+				ok = typeof(key) == TYPE_STRING_NAME and ok
+			ok = _day_join(raw[key], saved[name], path + "/" + name, differences) and ok
+		if raw_order != saved_order: differences.append({"path": path, "kind": "key_order", "raw": raw_order, "saved": saved_order})
+		return ok
+	if raw is Array:
+		if raw.size() != saved.size(): return false
+		var ok := true
+		for index: int in range(raw.size()): ok = _day_join(raw[index], saved[index], path + "/" + str(index), differences) and ok
+		return ok
+	return var_to_bytes(raw) == var_to_bytes(saved)
+
+func _recall() -> Dictionary:
+	var before := _capture()
+	_expect(_runtime.operations_coordinator.current_minute == 1440, "recall starts at current minute 1440")
+	var result: CommandResult = _runtime.operations_coordinator.advance_to(1440)
+	var command := {&"ok": result.is_success(), &"code": CommandResult.Code.keys()[result.code], &"payload": result.details.duplicate(true), &"result": result.to_dictionary()}
+	var after := _capture()
+	var row := {&"before": before, &"command": command, &"after": after, &"join": _join(before, after)}
+	_write_var("recall", row)
+	_expect(result.is_success() and result.is_replay and int(result.details.get(&"boundary_counts", {}).get(&"daily_closes", -1)) == 0, "actual replay result has zero daily closes")
+	_expect(var_to_bytes(before[&"snapshot"]) == var_to_bytes(after[&"snapshot"]), "same-minute public recall entire typed state unchanged")
+	for key: StringName in [&"ledger", &"payroll", &"day_summary", &"shifts"]:
+		_expect(var_to_bytes(before[key]) == var_to_bytes(after[key]), "no duplicate settlement " + String(key))
+	_expect(row[&"join"][&"orphans"] == 0, "recall reservation orphans zero")
+	return row
+
+func _join(before: Dictionary, after: Dictionary) -> Dictionary:
+	var sales: Array = []
+	var upkeep: Array = []
+	var transactions: Dictionary = {}
+	var upkeep_transactions: Dictionary = {}
+	var payroll_join: Array = []
+	var complete := true
+	var sale_complete := true
+	var shift_delta: Array = []
+	for shift: Dictionary in after[&"shifts"]:
+		var prior: Dictionary = {}
+		for old: Dictionary in before[&"shifts"]:
+			if old[&"shift_instance_id"] == shift[&"shift_instance_id"]: prior = old
+		shift_delta.append({&"before": prior, &"after": shift, &"worked_minutes_delta": int(shift[&"worked_minutes"]) - int(prior.get(&"worked_minutes", 0)), &"overtime_minutes_delta": int(shift[&"overtime_minutes"]) - int(prior.get(&"overtime_minutes", 0))})
+	for entry: Dictionary in after[&"ledger"]:
+		if entry[&"category"] == "SERVICE_SALE" and entry[&"source_entity_id"] == String(_facility_id) and entry[&"credit_account"] == "GUEST_WALLET:" + String(_guest_id):
+			var payment_id: StringName = _runtime.economy_service.get_transaction_id_for_idempotency_key(StringName("service.payment.%s" % _service_id))
+			sale_complete = sale_complete and String(payment_id) == entry[&"transaction_id"] and int(entry[&"absolute_minute"]) == 1440 and int(entry[&"amount"]) == _original_price
+			sales.append({&"ledger": entry, &"service_id": _service_id, &"reservation_ids": after[&"service"].get(&"inventory_reservations", [])})
+		if entry[&"category"] == "MAINTENANCE_PAYMENT":
+			upkeep.append(entry)
+			upkeep_transactions[entry[&"transaction_id"]] = true
+		if entry[&"category"] != "WAGE": continue
+		var found := false
+		for settlement: Dictionary in after[&"payroll"]:
+			if settlement[&"settlement_id"] != entry[&"source_entity_id"]: continue
+			found = true
+			var settlement_duty_complete := true
+			var paid_count := 0
+			for paid: Dictionary in settlement[&"rows"]:
+				if int(paid[&"payment"]) <= 0: continue
+				paid_count += 1
+				var shifts: Array = []
+				var duty: Array = []
+				var worked_delta := 0
+				var overtime_delta := 0
+				# Settlement day is 1-based; ShiftInstance.start_day is 0-based.
+				for shift: Dictionary in after[&"shifts"]:
+					if shift[&"staff_id"] != paid[&"staff_id"] or int(shift[&"start_day"]) + 1 != int(settlement[&"day"]): continue
+					if int(shift[&"worked_minutes"]) + int(shift[&"overtime_minutes"]) <= 0: continue
+					shifts.append(shift)
+					for delta: Dictionary in shift_delta:
+						if delta[&"after"][&"shift_instance_id"] != shift[&"shift_instance_id"]: continue
+						duty.append(delta)
+						worked_delta += int(delta[&"worked_minutes_delta"])
+						overtime_delta += int(delta[&"overtime_minutes_delta"])
+				var expected_delta := 1 if paid[&"staff_id"] == "staff_bardo" else 0
+				if int(before[&"minute"]) == int(after[&"minute"]): expected_delta = 0
+				var duty_ok := not shifts.is_empty() and duty.size() == shifts.size() and worked_delta == expected_delta and overtime_delta == 0
+				settlement_duty_complete = settlement_duty_complete and duty_ok
+				payroll_join.append({&"transaction": entry, &"settlement": settlement, &"paid_staff": paid, &"day": settlement[&"day"], &"shifts": shifts, &"service_id": _service_id, &"sale_rows": sales, &"upkeep_rows": upkeep, &"duty_delta": duty, &"worked_delta": worked_delta, &"overtime_delta": overtime_delta, &"duty_join_complete": duty_ok})
+			complete = complete and settlement_duty_complete and paid_count > 0
+			if settlement_duty_complete and paid_count > 0: transactions[entry[&"transaction_id"]] = true
+		complete = complete and found
+	var orphans := 0
+	var service: Dictionary = after[&"service"]
+	if service.get(&"inventory_reservations", []).is_empty(): orphans += 1
+	for id: Variant in service.get(&"inventory_reservations", []):
+		var found := false
+		for reservation: Dictionary in after[&"reservations"]:
+			if reservation[&"reservation_id"] == String(id):
+				found = true
+				if reservation[&"requester_id"] != service[&"request_id"] or reservation[&"purpose"] != "facility_service" or reservation[&"state"] != "CONSUMED": orphans += 1
+		if not found: orphans += 1
+	for reservation: Dictionary in after[&"reservations"]:
+		if InventoryReservation.State.keys().find(String(reservation[&"state"])) < 0: orphans += 1
+		if reservation[&"state"] == "ACTIVE" and reservation[&"purpose"] == "facility_service":
+			var request: ServiceRequest = _runtime.facility_service.get_request(StringName(reservation[&"requester_id"]))
+			if request == null or not request.reserved_inventory_ids.has(StringName(reservation[&"reservation_id"])): orphans += 1
+	return {&"sales": sales, &"sale_join_complete": sale_complete and not sales.is_empty(), &"payroll_transaction_ids": transactions.keys(), &"payroll_join": payroll_join,
+		&"payroll_join_complete": complete and not payroll_join.is_empty(), &"upkeep_rows": upkeep, &"upkeep_transaction_ids": upkeep_transactions.keys(), &"duty_delta": shift_delta, &"orphans": orphans}
+
+func _reader_branch() -> void:
+	_case = "reader-C3"
+	var file := FileAccess.open(_evidence_dir.path_join("writer.json"), FileAccess.READ)
+	_expect(file != null, "Writer receipt available")
+	if file == null: return
+	var writer: Dictionary = JSON.parse_string(file.get_as_text()); file.close()
+	_expect(int(writer["pid"]) != OS.get_process_id() and String(writer["profile"]) != OS.get_user_data_dir(), "distinct Reader PID/profile")
+	var original := String(writer["slots"]["C3"])
+	var target := ProjectSettings.globalize_path("user://saves/p04_s2a/C3")
+	_expect(DirAccess.make_dir_recursive_absolute(target) == OK, "Reader fresh slot")
+	var directory := DirAccess.open(original)
+	_expect(directory != null, "Writer slot available")
+	if directory == null: return
+	var members := directory.get_files(); members.sort()
+	_expect(directory.get_directories().is_empty() and members == PackedStringArray(["journal.log", "manifest.json", "thumbnail.png", "world.bin"]), "all formal package members")
+	var hashes: Dictionary = {}
+	for member: String in members:
+		var sha := FileAccess.get_sha256(original.path_join(member))
+		_expect(DirAccess.copy_absolute(original.path_join(member), target.path_join(member)) == OK, "copy formal member")
+		hashes[member] = {&"original_before": sha, &"copy": FileAccess.get_sha256(target.path_join(member))}
+		_expect(sha == hashes[member][&"copy"], "member SHA matches")
+	file = FileAccess.open(_evidence_dir.path_join("writer-C3-midnight.var"), FileAccess.READ)
+	_expect(file != null, "Writer typed point")
+	if file == null: return
+	var expected: Dictionary = bytes_to_var(file.get_buffer(file.get_length())); file.close()
+	_reset_runtime(424242)
+	var loaded := SaveService.load_snapshot(target)
+	_expect(bool(loaded.get(&"ok", false)), "formal public load")
+	if not bool(loaded.get(&"ok", false)): return
+	_expect(_runtime.restore_snapshot(loaded[&"snapshot"]), "public Runtime restore")
+	_facility_id = StringName(expected[&"inputs"][&"facility_id"]); _service_id = StringName(expected[&"inputs"][&"service_id"])
+	_original_price = int(expected[&"inputs"][&"original_price"])
+	var actual := _capture()
+	_expect(var_to_bytes(actual[&"snapshot"]) == var_to_bytes(expected[&"snapshot"]), "formal entire typed snapshot equality")
+	for key: StringName in [&"ledger", &"payroll", &"canonical_day1"]: _expect(var_to_bytes(actual[key]) == var_to_bytes(expected[key]), "formal equality " + String(key))
+	var raw_equal := var_to_bytes(actual[&"day_summary"]) == var_to_bytes(expected[&"day_summary"])
+	var raw_differences: Array = []
+	var raw_join := _day_join(expected[&"day_summary"], actual[&"canonical_day1"], "$", raw_differences)
+	_expect(raw_join, "Writer raw getter joins Reader canonical day1")
+	_write_var("day-summary-comparison", {&"raw_bytes_equal": raw_equal, &"writer": expected[&"day_summary_diagnostic"], &"reader": actual[&"day_summary_diagnostic"], &"differences": raw_differences})
+	var recall := _recall()
+	for member: String in members:
+		hashes[member][&"original_after"] = FileAccess.get_sha256(original.path_join(member))
+		_expect(hashes[member][&"original_before"] == hashes[member][&"original_after"], "original member unchanged")
+	_slots["C3"] = target
+	_branches["C3"] = {&"expected": expected, &"restored": actual, &"recall": recall, &"member_hashes": hashes}
+	_write_var("branch", _branches["C3"])
+var _observations: Array[Dictionary] = []
+var _receipts: Array[Dictionary] = []
+var _first_receipts: Array[Dictionary] = []
+var _receipt_hook: Callable
+var _evidence_dir := ""
+var _facility_id: StringName = &""
+var _service_id: StringName = &""
+var _request_id: StringName = &"p04.order.midnight.request"
+var _guest_id: StringName = &"p04.order.midnight.guest"
+var _staff_ids: Array[StringName] = [&"p04.midnight.server.a", &"p04.midnight.server.b"]
+var _serial := 0
+var _case := "midnight"
+var _original_price := 0
+var _observation_pass := "first"
+var _first_summary: Dictionary = {}
+var _paid_reception_id: StringName = &""
+var _expected_daily_wages := 0
+
+# Setup below is literal paid-shift-midnight-r01.gd through 23:59, pinned by wrapper.
+func _prepare_midnight() -> void:
+	_reset_runtime(424242)
+	var enabled: Dictionary = _runtime.enable_production_operations()
+	_expect(bool(enabled.get(&"ok", false)), "public production operations enabled at original Day 1 06:00")
+	if not bool(enabled.get(&"ok", false)): return
+	var facility := _build_cafeteria(true)
+	if facility == null: return
+	_facility_id = facility.instance_id
+	var definition: FacilityDefinition = _runtime.definition_registry.get_facility(facility.definition_id)
+	_original_price = definition.base_price
+	_setup_paid_reception()
+	var cook_id := StringName("fixture.kitchen.worker.%s" % _facility_id)
+	_expect(_cmd(&"set_staff_work_assignment", {&"staff_id": cook_id, &"template_id": &"NIGHT", &"facility_id": facility.related_facility_id}).is_success(), "public original NIGHT assignment replaces inherited 23:59 cook fixture")
+	for id: StringName in _staff_ids:
+		_expect(_cmd(&"register_staff", {&"staff_id": id, &"role_id": &"server", &"options": {&"state": StaffRuntime.State.OFF_DUTY, &"current_cell": Vector3i.ZERO}}).is_success(), "register real workplace Staff " + String(id))
+		_expect(_cmd(&"set_staff_work_assignment", {&"staff_id": id, &"template_id": &"NIGHT", &"facility_id": _facility_id}).is_success(), "original NIGHT 18:00-next06:00 assignment " + String(id))
+	var queue_at := 1440 - definition.base_service_minutes - 1
+	_expect(queue_at > _clock.absolute_minute, "setup finishes before original service start")
+	if queue_at <= _clock.absolute_minute: return
+	_clock.advance_minutes(1079 - _clock.absolute_minute)
+	_observe("paid-before-handover-17-59")
+	_expect(_runtime.facility_service.get_instance(_paid_reception_id).active_staff_ids.has(&"staff_akane"), "normally hired daytime receptionist physically attends before original DAY boundary")
+	_clock.register_tick_handler(_clock.TickPhase.FACILITY_COMPLETION, &"zz.p04.paid.before-handover", func(minute: int):
+		if minute == 1080:
+			_observe("paid-at-completion-before-handover-18-00")
+			_expect(_runtime.facility_service.get_instance(_paid_reception_id).active_staff_ids.has(&"staff_akane"), "last DAY interval retains actual hired worker before handover")
+	)
+	_clock.advance_one_minute(); _observe("paid-after-handover-18-00")
+	_expect(not _runtime.facility_service.get_instance(_paid_reception_id).active_staff_ids.has(&"staff_akane"), "daytime hired receptionist is removed after completion phase")
+	_clock.advance_minutes(queue_at - _clock.absolute_minute)
+	_expect(_runtime.facility_service.get_instance(_paid_reception_id).active_staff_ids.has(&"staff_bardo"), "normally hired NIGHT replacement physically arrives")
+	_expect(_clock.absolute_minute == queue_at and _runtime.operations_coordinator.current_minute == queue_at, "real production operations advance without blocked suffix")
+	if _clock.absolute_minute != queue_at: return
+	for id: StringName in _staff_ids:
+		var worker: StaffRuntime = _runtime.staff_service.get_staff(id)
+		_expect(_runtime.staff_service.requires_attendance(id) and StaffCommuteService.is_at_facility(worker, facility) and worker.current_cell != Vector3i.ZERO, "physical ordinary NIGHT workplace arrival " + String(id))
+	var kitchen: FacilityInstance = _runtime.facility_service.get_instance(facility.related_facility_id)
+	var cook: StaffRuntime = _runtime.staff_service.get_staff(cook_id)
+	_expect(_runtime.staff_service.requires_attendance(cook_id) and StaffCommuteService.is_at_facility(cook, kitchen), "real kitchen NIGHT attendance, not legacy attendance bypass")
+	_expect(_stock(facility.local_inventory_id, &"ingredient/basic_meal", 1, &"p04.midnight.stock"), "one real meal to reserve")
+	_expect(_cmd(&"spawn_guest", {&"guest_id": _guest_id, &"guest_type_id": &"traveler", &"gold": _original_price * 2, &"options": {&"state": GuestRuntime.State.DECIDING, &"current_cell": Vector3i.ZERO}}).is_success(), "public actual Guest wallet")
+	_expect(_cmd(&"create_service_request", {&"facility_id": _facility_id, &"request_id": _request_id, &"guest_ids": [_guest_id]}).is_success(), "actual request original price/duration")
+	_clock.advance_one_minute()
+	var active: Array = _runtime.facility_service.get_active_services(_facility_id)
+	_expect(active.size() == 1, "one actual reserved service starts")
+	if active.size() != 1: return
+	var service: ServiceInstance = active[0]; _service_id = service.service_id
+	_expect(service.started_at + service.duration_minutes == 1440 and service.duration_minutes == definition.base_service_minutes and service.price_snapshot == _original_price, "original service completion coincides with 00:00")
+	_clock.advance_minutes(1439 - _clock.absolute_minute)
+	_expect(service.elapsed_minutes == service.duration_minutes - 1, "one original service minute remains at 23:59")
+	_expect(_runtime.operations_coordinator.get_day_summary(1).is_empty(), "real Day 1 not closed early")
+
+func _setup_paid_reception() -> void:
+	var definition: FacilityDefinition = _runtime.definition_registry.get_facility(&"reception")
+	_expect(_cmd(&"build_facility", {&"definition_id": &"reception", &"origin": Vector3i(2, 0, WorldService.LAYER_FRONT)}).is_success(), "paid public reception construction")
+	_clock.advance_minutes(definition.build_minutes)
+	for instance: FacilityInstance in _runtime.facility_service.get_instances():
+		if instance.definition_id == &"reception": _paid_reception_id = instance.instance_id
+	_expect(not _paid_reception_id.is_empty(), "reception completes using unchanged construction duration")
+	var catalog: Dictionary = JSON.parse_string(FileAccess.get_file_as_string("res://data/characters/mvp_staff_candidates.json"))
+	for candidate_id: StringName in [&"staff_akane", &"staff_bardo"]:
+		var original_wage := -1
+		for row: Dictionary in catalog["entries"]:
+			if StringName(row["id"]) == candidate_id: original_wage = int(row["daily_wage"])
+		_expect(original_wage > 0 and _cmd(&"hire_staff_candidate", {&"candidate_id": candidate_id}).is_success(), "public hire of existing paid candidate " + String(candidate_id))
+		var worker: StaffRuntime = _runtime.staff_service.get_staff(candidate_id)
+		_expect(worker != null and worker.get_effective_daily_wage() == original_wage, "existing catalog wage unchanged for " + String(candidate_id))
+		_expected_daily_wages += original_wage
+		_expect(_cmd(&"set_staff_work_assignment", {&"staff_id": candidate_id, &"template_id": &"DAY" if candidate_id == &"staff_akane" else &"NIGHT", &"facility_id": _paid_reception_id}).is_success(), "ordinary recurring paid DAY or NIGHT assignment")
+
+func _cmd(kind: StringName, payload: Dictionary) -> CommandResult:
+	_serial += 1
+	var result: CommandResult = _runtime.submit_command(kind, payload, &"player", &"", 10, -1, StringName("p04.order.shift.command.%d" % _serial))
+	_commands.append({&"kind": kind, &"input": payload.duplicate(true), &"minute": _clock.absolute_minute, &"ok": result.is_success(), &"result": result.to_dictionary()})
+	return result
+
+func _observe(label: String) -> void:
+	label = _case + "-" + _observation_pass + "-" + label
+	var facility: FacilityInstance = _runtime.facility_service.get_instance(_facility_id)
+	var service: ServiceInstance = _runtime.facility_service.get_service(_service_id)
+	var guest: GuestRuntime = _runtime.guest_service.get_guest(_guest_id)
+	var paid: Array = []
+	for paid_id: StringName in [&"staff_akane", &"staff_bardo"]:
+		var hired: StaffRuntime = _runtime.staff_service.get_staff(paid_id)
+		if hired != null: paid.append(hired.create_snapshot())
+	var reception: FacilityInstance = _runtime.facility_service.get_instance(_paid_reception_id)
+	_observations.append({&"label": label + "-paid-actors", &"minute": _clock.absolute_minute, &"paid_staff": paid, &"paid_reception": reception.create_snapshot() if reception != null else {}, &"expected_catalog_wages": _expected_daily_wages})
+	var workers: Array = []
+	for id: StringName in _staff_ids:
+		var worker: StaffRuntime = _runtime.staff_service.get_staff(id)
+		var shift: ShiftInstance = _runtime.staff_service.get_shift(worker.shift_id)
+		workers.append({&"staff": worker.create_snapshot(), &"shift": shift.create_snapshot() if shift != null else {}, &"is_present": _runtime.staff_commute.is_present(worker, facility), &"requires_attendance": _runtime.staff_service.requires_attendance(id), &"at_facility": StaffCommuteService.is_at_facility(worker, facility), &"within_shift": shift.contains_minute(_clock.absolute_minute) if shift != null else false})
+	_observations.append({&"label": label, &"minute": _clock.absolute_minute, &"workers": workers, &"facility_state": facility.state, &"power_available": facility.power_available, &"active_staff": facility.active_staff_ids.duplicate(), &"service": service.create_snapshot() if service != null else {}, &"request_present": _runtime.facility_service.get_request(_request_id) != null, &"wallet": _runtime.economy_service.get_balance(StringName("GUEST_WALLET:" + String(_guest_id))), &"available_meals": _runtime.inventory_service.available_quantity(facility.local_inventory_id, &"ingredient/basic_meal"), &"reservations": _runtime.inventory_service.create_snapshot(), &"guest": guest.create_snapshot() if guest != null else {}, &"receipts": _receipts.duplicate(true), &"day_summary": _runtime.operations_coordinator.get_day_summary(1), &"operations": _runtime.operations_coordinator.create_snapshot()})
+	_write_var(_observation_pass + "-" + label.trim_prefix(_case + "-" + _observation_pass + "-"), _runtime.create_snapshot())
+
+func _write_var(label: String, value: Variant) -> void:
+	var file := FileAccess.open(_evidence_dir.path_join(_case + "-" + label + ".var"), FileAccess.WRITE)
+	_expect(file != null, "write whole typed evidence " + label)
+	if file != null: file.store_buffer(var_to_bytes(value)); file.flush(); file.close()
+	var json_file := FileAccess.open(_evidence_dir.path_join(_case + "-" + label + ".json"), FileAccess.WRITE)
+	_expect(json_file != null, "write JSON mirror alongside authoritative typed snapshot")
+	if json_file != null: json_file.store_string(JSON.stringify(value, "\t")); json_file.flush(); json_file.close()
+
@@ -0,0 +1,282 @@
+#!/usr/bin/env python3
+"""S2a-only native entry. --check-only never loads ownership helpers or starts Godot."""
+from pathlib import Path
+import argparse
+import hashlib
+import importlib.util
+import json
+import os
+import shutil
+import subprocess
+import sys
+sys.dont_write_bytecode = True
+
+HERE = Path(__file__).resolve().parent
+BUILD = Path("/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build")
+PRODUCT = Path("/Users/korizatou114/Projects/とりにく工房ゲーム制作部")
+CACHE_RUN = Path("/Users/korizatou114/Projects/TheTree-managed-worktrees/p18-01-model/.runtime/P18-01-CODE/build/p18-relationship-evidence")
+TEST = "tests/s3/test_runtime_staff_assignment.gd"
+QA = HERE / "p04_s2a_midnight_probe.gd"
+ENGINE = Path("/Applications/Godot.app/Contents/MacOS/Godot")
+PATTERNS = BUILD / "audit-support/p04-whole-closure-r01/current-patterns"
+SUPPLIED = {
+    "paid-shift-midnight-formal-r01.gd": (7667, "4c56ff05b1bcf8775bb526a30ed021a4a2630ea4f360a5075f880806b052e6d1"),
+    "p04-paid-shift-midnight-native-r01.py": (6580, "23bf2e241c7828b6533aa8107b3d33e962d5c53300a71b198e6fe371e0d4f4f0"),
+    "p04-paid-shift-midnight-formal-native-r01.py": (7765, "e3b6eab32dd4fe3dfbff7ae9b67b34dd674236018bdb6bc7c64da25898ff5ed6"),
+}
+MATERIALS = [PATTERNS / n for n in [
+    "paid-shift-midnight-r01.gd", "paid-shift-midnight-formal-r01.gd",
+    "idempotency-paid-formal-r01.gd", "p04-paid-shift-midnight-native-r01.py",
+    "p04-paid-shift-midnight-formal-native-r01.py", "p04-idempotency-paid-formal-native-r01.py",
+    "SUPPLEMENT_SOURCE_MANIFEST_R02.json", "ROOT_S1_NATIVE_R02_RESULT.json",
+]] + [HERE.parent / "s1" / n for n in ["run_s1_native.py", "p04_s1_ev_power_probe.gd", "S1_ROOT_RUN.md"]]
+
+def template_guard():
+    """Read literal setup from supplied template, including original public helpers."""
+    for name, (size, digest) in SUPPLIED.items():
+        actual = pin(PATTERNS / name)
+        if (actual["bytes"], actual["sha256"]) != (size, digest):
+            raise ValueError("supplied input mismatch: " + json.dumps(actual))
+    supplement = json.loads((PATTERNS / "SUPPLEMENT_SOURCE_MANIFEST_R02.json").read_text())
+    for name in SUPPLIED:
+        actual = pin(PATTERNS / name)
+        if not any(Path(row["supplied"]) == PATTERNS / name and
+                   (row["bytes"], row["sha256"]) == (actual["bytes"], actual["sha256"])
+                   for row in supplement["files"]):
+            raise ValueError("supplement pin mismatch: " + name)
+    original = (PATTERNS / "paid-shift-midnight-r01.gd").read_text()
+    probe = QA.read_text()
+    setup = original[original.index("func _run_midnight()"):original.index('\t_expect(_cmd(&"set_facility_policy", {&"facility_id": kitchen.instance_id')]
+    setup = setup.replace("func _run_midnight() -> void:", "func _prepare_midnight() -> void:")
+    hire = original[original.index("func _setup_paid_reception()"):original.index("func _reopen_dependency")]
+    if setup not in probe or hire not in probe:
+        raise ValueError("probe must retain literal original setup and public paid hire")
+
+def module(name, path):
+    spec = importlib.util.spec_from_file_location(name, path)
+    value = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(value)
+    return value
+
+def pin(path):
+    path = Path(path)
+    if path.is_symlink() or not path.is_file():
+        raise ValueError("missing exact input: " + str(path))
+    data = path.read_bytes()
+    return dict(path=str(path), bytes=len(data), sha256=hashlib.sha256(data).hexdigest())
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--project-root", type=Path, default=PRODUCT)
+    parser.add_argument("--output", type=Path, default=BUILD / "p04-s2a-native-r02")
+    parser.add_argument("--plan", type=Path, default=BUILD / "p04-s2a-plan-r02.json")
+    parser.add_argument("--cache-run", type=Path, default=CACHE_RUN)
+    parser.add_argument("--godot", type=Path, default=ENGINE)
+    parser.add_argument("--check-only", action="store_true")
+    args = parser.parse_args()
+    root = args.project_root.resolve()
+    out = args.output.resolve()
+    r = module("s2a_standard_runner", root / "tools/run_all_tests.py")
+    # Preserve the reviewed source_refs -> exactly one QA override order.
+    source_before = r.source_refs(root)
+    refs = dict(source_before)
+    refs[TEST] = pin(QA)
+    template_guard()
+    expected = {n: dict(bytes=p["bytes"], sha256=p["sha256"]) for n, p in refs.items()}
+    fixed = [pin(p) for p in MATERIALS + [
+        QA, Path(__file__), HERE / "S2_ROOT_RUN.md",
+        root / "tests/transport/test_runtime_transport.gd",
+        root / "tests/staff/test_rescue_elevator.gd",
+        root / "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json",
+    ]]
+    selected = dict(root_before=source_before, map={n: p["sha256"] for n, p in refs.items()}, timeout=1200)
+    cache_note = None
+    cache_receipts = []
+    for leaf in ["runner-ended.json", "runner-input.json"]:
+        path = args.cache_run / leaf
+        try:
+            cache_receipts.append(pin(path))
+        except OSError as caught:
+            cache_note = dict(path=str(path), error=type(caught).__name__ + ": " + str(caught),
+                              required_before_native=True)
+            break
+    plan = dict(protocol="p04-s2a-preparation-v1", project_root=str(root), output=str(out),
+                source_before=source_before, selected_source_map=selected["map"],
+                QA_overrides=[TEST], fixed_input_pins=fixed, cache_run=str(args.cache_run),
+                cache_receipts=cache_receipts, cache_access=cache_note,
+                phases=["import", "parse", "writer", "reader"],
+                native_engine_launches=0, whole_goal_accepted=False, unit_accepted=False)
+    # Check-only only reads source/materials and writes the plan in task build.
+    # It deliberately does not read default-player data, inspect processes or stat Godot.
+    if args.check_only:
+        args.plan.parent.mkdir(parents=True, exist_ok=True)
+        if args.plan.exists():
+            r.require(r.read(args.plan) == plan, "existing plan differs; use a fresh plan path")
+        else:
+            r.write(args.plan, plan)
+        print(json.dumps(dict(check_only=True, engines=0, source_files=len(source_before),
+                              QA_overrides=[TEST], fixed_pins=len(fixed), plan=str(args.plan),
+                              plan_sha256=r.sha(args.plan), cache_access=cache_note), ensure_ascii=False))
+        return 0
+    r.require(args.plan.is_file() and r.read(args.plan) == plan, "run exact check-only plan first")
+    def fixed_guard():
+        template_guard()
+        for value in fixed + cache_receipts:
+            r.require(pin(value["path"]) == value, "fixed input changed: " + value["path"])
+    fixed_guard()
+    # Native admission is Root-only and fails closed on unreadable cache.
+    r.require(cache_note is None, "Root must read exact cache receipts: " + str(cache_note))
+    old = args.cache_run
+    r.require(r.read(old / "runner-ended.json")["passed"], "ended cache run must have passed")
+    old_map = r.read(old / "runner-input.json")["selected_source_map"]
+    current_map = {n: p["sha256"] for n, p in source_before.items()}
+    r.require(old_map == current_map, "ended cache selected source must equal current product")
+    protected = r.default_player(root)
+    outer = module("s2a_owned_outer", r.SUPPORT / "owned_outer.py")
+    r.require(not outer.native.helper["live_engines"](), "another Godot owns CPU")
+    engine = args.godot.resolve()
+    r.require(engine.is_file(), "Root native Godot path")
+    r.require(shutil.disk_usage(out.parent).free >= 1024**3 + engine.stat().st_size + 136*1024**2,
+              "reviewed native disk admission")
+    r.require(not out.exists(), "fresh output required; preserve previous attempts")
+    out.mkdir()
+    stage = out / "stage"
+    stage.mkdir()
+    (out / "starters").mkdir()
+    (out / "bootstrap").mkdir()
+    phases = []
+    previous = {}
+    error = None
+    guards = []
+    cleanup = []
+    cleanup_errors = []
+    cache_before = None
+    formal_before = None
+    formal_after = None
+    original_phase = outer.run_phase
+    def run_phase(argv, folder, timeout, env, **kwargs):
+        env = dict(env)
+        if folder.name in ["writer", "reader"]:
+            env.update(THE_TREE_S2A_EVIDENCE=str(out / "raw"), THE_TREE_S2A_MODE=folder.name)
+        return original_phase(argv, folder, timeout, env, **kwargs)
+    outer.run_phase = run_phase
+    r.write(out / "runner-started.json", dict(started=r.now(), owner_runner_pid=os.getpid(),
+            plan=pin(args.plan), engines_launched=0))
+    try:
+        r.write(out / "source_before.json", source_before)
+        r.write(out / "selected-source-map.json", refs)
+        # Private source stage first, then literal reviewed bootstrap.
+        for name, value in refs.items():
+            target = stage / name
+            target.parent.mkdir(parents=True, exist_ok=True)
+            r.copy_source(Path(value["path"]), target)
+        r.require(r.inventory(stage, stage=True) == expected, "whole private source")
+        for name, value in r.read(r.SUPPORT / "bootstrap-scripts.json").items():
+            data = value["text"].encode()
+            r.require(hashlib.sha256(data).hexdigest() == value["sha256"], "bootstrap pin")
+            (out / "bootstrap" / name).write_bytes(data)
+        cache = old / "stage/.godot"
+        cache_before = r.inventory(cache)
+        r.require(bool(cache_before), "nonempty ended cache")
+        for name in cache_before:
+            src = cache / name
+            dst = stage / ".godot" / name
+            dst.parent.mkdir(parents=True, exist_ok=True)
+            subprocess.run(["/bin/cp", "-c", str(src), str(dst)], check=True)
+            r.require((src.stat().st_dev, src.stat().st_ino) != (dst.stat().st_dev, dst.stat().st_ino),
+                      "cache clone is a separate inode")
+        r.require(r.inventory(stage / ".godot") == cache_before, "whole cache clone hashes")
+        r.write(out / "cache-reuse.json", dict(ended_run=str(old), receipts=cache_receipts,
+                whole_cache=cache_before, independent_inode=True,
+                ordinary_import_required=True, ordinary_parse_required=True))
+        paths = ["res://" + n for n in sorted(refs) if n.endswith(".gd")]
+        r.write(out / "parse-paths.json", paths)
+        markers = module("s2a_markers", root / "tools/strict_test_markers.py")
+        contracts = markers.load_contracts(root / "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json")
+        contracts[TEST] = dict(test=TEST, template="S2a midnight: <checks> checks, <failures> failures", required=True)
+        policy = r.read(r.SUPPORT / "suite-policy.json")
+        r.require(TEST not in policy["suite_policies"], "no normal suite watchdog/policy override")
+        r.write(out / "contracts.json", contracts)
+        r.write(out / "runner-input.json", dict(plan, owner_runner_pid=os.getpid(),
+                wrapper_sha256=r.sha(__file__), QA=pin(QA), runner_sha256=r.sha(root / "tools/run_all_tests.py"),
+                default_player_before=protected, fixed_input_pins=fixed,
+                functional_watchdog_seconds=1200, source_adoption=False))
+        diagnostics = module("s2a_diagnostics", r.SUPPORT / "diagnostic_gate.py")
+        owners = module("s2a_owners", r.SUPPORT / "ordinary_proof_gate.py")
+        audio = module("s2a_audio", r.SUPPORT / "audio_evidence_gate.py")
+        public = (stage / "project.godot").read_bytes()
+        for phase, test in [("import", None), ("parse", None), ("writer", TEST), ("reader", TEST)]:
+            if phase == "reader":
+                writer = r.read(out / "raw/writer.json")
+                formal_before = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
+                r.require(len(formal_before) == 1, "one C3 formal writer point")
+            row = r.execute_phase(str(engine), stage, out, phase, test, selected, expected,
+                                  previous, policy, contracts, paths, public, protected, root,
+                                  outer, markers, diagnostics, owners, audio)
+            phases.append(row)
+            # execute_phase uses the same test log name; retain each phase's exact log too.
+            if test and row.get("log"):
+                (out / (phase + "-combined-raw.log")).write_bytes((out / row["log"]).read_bytes())
+                row["strict_runner_log_path"] = row["log"]
+                row["log"] = phase + "-combined-raw.log"
+            r.write(out / (phase + "-actual-phase.json"), row)
+            print(json.dumps(dict(phase=phase, passed=row["passed"], error=row.get("validation_error"))), flush=True)
+            r.require(row["passed"], "first strict phase failure: " + phase)
+            if phase in ["writer", "reader"]:
+                receipt = r.read(out / ("raw/" + phase + ".json"))
+                r.require(receipt["checks"] > 0 and receipt["failures"] == 0,
+                          "S2a actual outcome receipt")
+                r.require(sorted(receipt["branches"]) == (["C1", "C2", "C3"] if phase == "writer" else ["C3"]),
+                          "exact independent Writer cases and formal Reader case")
+                r.require(receipt["pid"] == row["actual_pid"], "actual native PID/receipt")
+        writer = r.read(out / "raw/writer.json")
+        reader = r.read(out / "raw/reader.json")
+        r.require(writer["pid"] != reader["pid"] and writer["profile"] != reader["profile"], "distinct formal processes")
+        formal_after = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
+        r.require(formal_before == formal_after, "Reader leaves Writer packages unchanged")
+    except BaseException as caught:
+        error = type(caught).__name__ + ": " + str(caught)
+    finally:
+        cleanup, cleanup_errors = outer.finish_captured(outer.OWNED)
+        try:
+            r.write(out / "outer-owned-finally.json", dict(cleanup=cleanup, errors=cleanup_errors))
+        except BaseException as caught:
+            guards.append("finally receipt: " + type(caught).__name__ + ": " + str(caught))
+    # Fixed guard always follows ownership cleanup, even if setup or an engine failed.
+    try:
+        fixed_guard()
+        after = r.source_refs(root)
+        r.write(out / "source_after.json", after)
+        r.require(after == source_before, "whole product source unchanged")
+        r.require(r.default_player(root) == protected, "default player unchanged")
+        if (stage / "project.godot").exists():
+            r.require(r.inventory(stage, stage=True) == dict(expected, **previous), "whole private source unchanged")
+        if cache_before is not None:
+            r.require(r.inventory(old / "stage/.godot") == cache_before, "original cache unchanged")
+        if formal_before is not None:
+            writer = r.read(out / "raw/writer.json")
+            formal_after = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
+            r.require(formal_before == formal_after, "Writer formal packages unchanged after Reader, including failure")
+    except BaseException as caught:
+        guards.append(type(caught).__name__ + ": " + str(caught))
+    pids = [p.pid for p in outer.OWNED]
+    passed = (error is None and not guards and not cleanup_errors and len(phases) == 4
+              and all(p["passed"] for p in phases) and len(pids) == len(set(pids)) == 4
+              and all(p["engine_ended"] for p in cleanup))
+    execution = dict(passed=passed, error=error, guard_errors=guards, phases=phases,
+                     actual_captured_PIDs=pids, cleanup=cleanup, cleanup_errors=cleanup_errors,
+                     formal_before=formal_before, formal_after=formal_after,
+                     whole_goal_accepted=False, unit_accepted=False)
+    r.write(out / "raw-inventory.json", r.inventory(out / "raw"))
+    r.write(out / "PID-set.json", dict(owner_runner_pid=os.getpid(), engine_PIDs=pids))
+    r.write(out / "execution.json", execution)
+    r.write(out / "runner-ended.json", dict(execution, ended=r.now()))
+    print(json.dumps(dict(passed=passed, error=error, guard_errors=guards, output=str(out))))
+    return 0 if passed else 1
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except Exception as caught:
+        print(type(caught).__name__ + ": " + str(caught), file=sys.stderr)
+        raise SystemExit(2)
@@ -0,0 +1,110 @@
+# P04-01 S2b code preparation
+
+変更は本ディレクトリの `p04_s2b_shift_probe.gd`、`run_s2b_native.py`、本書の3ファイルのみ。
+S1 r02、S2a native r03（ROOT_S2A_NATIVE_R03_RESULT.json と build/p04-s2a-native-r03/）は保持し、再実行しない。
+原15条件＋EV、7領域、3安全結果、原30/88、部分点なしを維持する。本提出による完成加点は0。
+原P04全体の達成、D05、独立レビュー、統合は確定しない。
+
+## 構成と固定入力
+
+QA overrideは `tests/s3/test_runtime_staff_assignment.gd` の1件だけ。
+単一GDがWriter内で2回fresh Runtime/Clock/GameStateを生成する。Readerも保存点ごと、replay開始時にfresh生成する。
+型推論によるVariant受取を避け、GDの変数宣言は明示型。state snapshotはString定義と比較する。
+
+- night_absent: supplied `approved-shift-current-r01.gd` のseed420410、2 DAY servers、実通勤、元のcafeteria/kitchen fixtureを使用。
+  queue_atだけ `boundary + 2 - base_service_minutes - 1` にし、予定完了を1082へ移す。
+  service duration/priceは定義値、Guest planned_exitは元の `boundary + base_service_minutes` のまま。
+  kitchenの物理配置済FLEX cookは既存診断fixtureの前提であり、自然雇用の証拠と混同しない。
+- overtime: `tests/supply/test_supply_logistics_bridge.gd:40-79` のseed653322、warehouse/kitchen/staff_door施工、
+  catalogue Gina公開hire/DAY assignment、実通勤、購入8、公開request、実pickupから_loadedを得る。
+  synthetic dispatch rejection、expiry snapshot変更、fault injectionは採用しない。
+  実taskのinterrupt_level==0を確認し、元のtarget cellだけ一時blockして通常clockを進める。
+
+ROOT_S2B_EXISTING_SOURCE_AUDIT.jsonの8ファイルは毎回bytes/SHAを選択rootと照合する。
+供給18:00 GD、監査JSON、S1/S2a wrapperと関連文書/GD、本3ファイルをplanでpinする。
+inherit先hardening/kitchen fixtureを含む選択root全sourceもpinする。
+旧source checkout1300のcheck-onlyは製品1338の代替証拠にしない。
+
+## 境界判定
+
+night_absentでは1079を基準に1080/1081で未完了、wallet/player cash/ledger無変更、同じ非空予約IDとACTIVE予約内容、
+元requestの所有を検査する。DAYの退出とNIGHT登録0を確認し、1081でWAITING_FOR_STAFFを必須にする。
+退出予定式と元5分graceも検査する。完了を早めたり、元のduration、price、shift値を変更しない。
+
+overtimeでは1078→1079にworked+1/overtime+0、1079→1080と1080→1081はworked+0/overtime+1を検査する。
+各tickの総勤務差分は1。正常勤務分と残業分を両方+1と誤読しない。
+同じstaff/task/shift/request/cargo所有、8個のcargo、crosslinks、is_overtimeを実オブジェクト／snapshotで検査する。
+各1079/1080/1081のtick後に公開 `StaffService.advance_one_minute(current_minute)` を1回呼び、
+実戻り値MINUTE_ALREADY_APPLIEDと全Runtime bytes不変で二重勤務記録なしを確認する。
+private `_update_shift_states` と `record_duty_minute` は呼ばない。
+解除後は各tickを保存し、safe unloading→元task/request COMPLETED→OFF_DUTY、8個移送と所有解放を確認する。
+
+## Formal save / Reader
+
+両ケースの1079/1080/1081を公開SaveServiceで保存・inspectする（合計6slot）。
+Writer全Runtime snapshotとinspect snapshotのvar_to_bytes完全一致、保存時のlive Runtime不変を必須とする。
+Readerは別PID/profileで各slotのjournal.log/manifest.json/thumbnail.png/world.binを全コピーし、
+原本／コピーの全SHAと、load前後／replay後の不変を検査する。余分なmember/directoryは失敗。
+公開load/restore後はWriterの全Runtimeをvar_to_bytesで比較する。項目の削除、JSON正規化による一致化はしない。
+
+Readerはさらに各1079 slotをfresh loadして通常clockの2tickを再現し、1080/1081全Runtimeと勤務差分、
+同分guardを検査する。FACILITY_COMPLETION前後とAI_DECISIONS後のphase順と全snapshotもWriterに一致させる。
+overtimeはunblock後のCOMPLETED/OFF_DUTYまで全Runtime一致を追加確認する。
+実coordinatorの有効性／実nullと、Runtime保存Operationsのenabled／coordinator値を別々に記録する。
+実coordinator不在時はgetter適用外・raw getter未呼出しを明示し、架空のday summaryや診断結果を記録しない。
+実coordinatorが存在する場合だけraw Dictionary getterと保存用canonical Operationsを別々に保存する。getter joinだけStringName/Stringとkey順差を明示し、
+型・値・欠落・配列順を検査する。全Runtime typed条件は緩和しない。
+
+## Rootの正式実行
+
+Rootだけが製品1338でfresh plan/nativeを実行する。workerはGodot起動（parse/version含む）、Runner操作、全回帰、git書込みをしない。
+以下は本提出checkoutからRootが実行する手順。既存output/planを上書きせず、失敗時は最初のphaseで停止し自動再試行しない。
+
+```sh
+export BUILD_OUTPUT_DIR='/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build'
+export PYTHONDONTWRITEBYTECODE=1
+python3 docs/plans/original-completion-2026-10-02/execution/p04-01/s2b/run_s2b_native.py --check-only --plan "$BUILD_OUTPUT_DIR/p04-s2b-root-plan-r01.json" --output "$BUILD_OUTPUT_DIR/p04-s2b-native-r01"
+python3 docs/plans/original-completion-2026-10-02/execution/p04-01/s2b/run_s2b_native.py --plan "$BUILD_OUTPUT_DIR/p04-s2b-root-plan-r01.json" --output "$BUILD_OUTPUT_DIR/p04-s2b-native-r01"
+```
+
+製品root既定値は `/Users/korizatou114/Projects/とりにく工房ゲーム制作部`。
+native admissionはこのrootかつsource1338を必須にする。worker checkout planをnativeへ転用しない。
+check-onlyはsource/material/cache receiptのみ読取り、engine0、default/private profile読取り0。
+cache receiptの読取拒否はplanに実エラーを残し、nativeは拒否する。Rootは自身の環境で確認する。
+
+S1/S2aと同じsource_refs→QA1→private source stage→終了済cacheの別inode clone→import→parse→Writer→Reader→
+owned finally cleanup→全guardを維持する。source/default player/private source/original cache不変、
+固定pin、実PIDとreceipt、4phase/4owned PIDの終了、正式slot不変は失敗時にも検査する。
+通常policy、watchdog、strict marker/diagnostic/ownership/audio gateを変更しない。
+
+## 必須出力と残件
+
+rawにはseed/input、実command結果（継承fixture分もcommand_completedで採取）、minute、実staff/task/shift/request/service ID、
+reservation/cargo、全ledger、全Runtime、phase観測、duty差分、同分guard結果、save/load結果をJSONと型保持.varの対で残す。
+Writerのloaded、1078-1079-duty、各1079/1080/1081とsave、phase、branch、unload、Readerの全restored/replayとSHA表を保持する。
+正式6slotはWriter/Reader private profileに保持する。
+source_before/after、selected-source-map、runner-input、cache-reuse、parse-paths、contracts、各phaseログ／receipt、
+combined-raw.log、PID-set、outer-owned-finally、execution、runner-ended、raw-inventoryも保持する。
+obsolete 500000-byte capに合わせた省略・圧縮はしない。
+
+worker検証範囲はpy_compile、wrapper --check-only、GDのVariant推論宣言grepのみ。
+GDScript parse、製品1338 nativeの条件成立、formal replay一致は未実行であり合格を主張しない。
+Root native実測と正式独立レビューが残る。これらは予定された後続作業であり、未実装を外部blockedとは報告しない。
+
+worker実施記録: Python py_compile成功。GD grepは `:=` と禁止された2直接呼出しが0件（rg exit1）。
+既定製品rootでのcheck-onlyは `tools/run_all_tests.py` 読取りがPermissionErrorとなりexit2。
+明示worktree rootでのcheck-onlyはexit0、source1300、QA1、固定pin13、engine0。
+終了済cacheのrunner-ended.jsonもPermissionErrorであり、planのcache_accessへ実path/errorを記録した。
+private/default profileの読取りは0。製品1338のcheck-only成功・native成功を主張しない。
+最初のworker planは `build/p04-s2b-worker-check-r01.json`。その後の本書／GD調整を含む最終pin確認には
+fresh `build/p04-s2b-worker-check-r02.json` を使用し、r01を上書きしない。
+
+## repair15 nullable診断修正
+
+`_capture`でOperationsCoordinatorをis_instance_validで分岐し、実nullと正式保存値`coordinator: {}`を区別する。
+全Runtime snapshotは無加工で保持する。fixtureでOperationsをenableせず、既存の境界・保存・replay判定を維持する。
+同GD全体を静的確認し、OperationsCoordinatorの直接呼出しはこの分岐内の2件のみ。
+reservation/request/task/shift、FileAccess、DirAccessには既存のnullガードがある。
+facility/definition/service/guest/worker、_inventory/_request/_worker/_taskの直接参照は既存fixtureの生成・取得成立が前提である。
+これらの前提が崩れた場合のnullリスクは残るが、任意機能Operationsの無効化による同種の無条件アクセスは他にない。
+本修正版のRoot fresh r02 nativeは未実測。workerはcode-ready提出のみで受入・readinessを確定しない。
@@ -0,0 +1,538 @@
+extends "res://tests/s3/test_runtime_actor_hardening.gd"
+
+const REQUEST: StringName = &"supply.bridge_test"
+const PORTER: StringName = &"staff_gina"
+var _evidence_dir: String = ""
+var _mode: String = ""
+var _case: String = ""
+var _seed: int = 0
+var _serial: int = 0
+var _slots: Dictionary = {}
+var _branches: Dictionary = {}
+var _commands: Array = []
+var _command_results: Array = []
+var _phases: Array = []
+var _facility_id: StringName = &""
+var _service_id: StringName = &""
+var _request_id: StringName = &"p04.order.shift.request"
+var _guest_id: StringName = &"p04.order.shift.guest"
+var _staff_ids: Array[StringName] = [&"p04.order.server.a", &"p04.order.server.b"]
+var _source: StringName = &""
+var _destination: StringName = &""
+var _loaded: Dictionary = {}
+var _task_id: StringName = &""
+var _shift_id: StringName = &""
+var _target: Vector3i = Vector3i.ZERO
+
+func _run() -> void:
+	_evidence_dir = OS.get_environment("THE_TREE_S2B_EVIDENCE")
+	_mode = OS.get_environment("THE_TREE_S2B_MODE")
+	if _evidence_dir.is_empty() or _mode not in ["writer", "reader"]:
+		quit(2)
+		return
+	_expect(DirAccess.make_dir_recursive_absolute(_evidence_dir) == OK, "evidence directory")
+	if _mode == "writer":
+		for branch: String in ["night_absent", "overtime"]: _writer_branch(branch)
+	else:
+		_reader()
+	_write("branches", _branches)
+	var receipt: Dictionary = {&"pid": OS.get_process_id(), &"profile": OS.get_user_data_dir(),
+		&"slots": _slots, &"checks": _checks, &"failures": _failures, &"branches": _branches.keys(),
+		&"whole_goal_accepted": false, &"unit_accepted": false}
+	_write(_mode, receipt, true)
+	_cleanup()
+	print("S2b shift: %d checks, %d failures" % [_checks, _failures])
+	quit(1 if _failures else 0)
+
+func _fresh(seed: int) -> void:
+	_seed = seed
+	_serial = 0
+	_commands.clear()
+	_command_results.clear()
+	_phases.clear()
+	_facility_id = &""
+	_service_id = &""
+	_source = &""
+	_destination = &""
+	_task_id = &""
+	_shift_id = &""
+	_target = Vector3i.ZERO
+	_loaded = {}
+	_reset_runtime(seed)
+	_runtime.configure_save_policy({&"enabled": false, &"daily_checkpoint_enabled": false})
+	_runtime.command_completed.connect(func(result: CommandResult) -> void:
+		_command_results.append({&"minute": _clock.absolute_minute, &"result": result.to_dictionary()})
+	)
+
+func _cmd(kind: StringName, payload: Dictionary) -> CommandResult:
+	_serial += 1
+	var result: CommandResult = _runtime.submit_command(kind, payload, &"player", &"", 10, -1, StringName("p04.order.shift.command.%d" % _serial))
+	_commands.append({&"kind": kind, &"input": payload.duplicate(true), &"minute": _clock.absolute_minute, &"result": result.to_dictionary()})
+	return result
+
+func _command(kind: StringName, payload: Dictionary) -> bool:
+	# Supply fixture retains its original public submit defaults.
+	var result: CommandResult = _runtime.submit_command(kind, payload)
+	_commands.append({&"kind": kind, &"input": payload.duplicate(true), &"minute": _clock.absolute_minute, &"result": result.to_dictionary()})
+	return result.is_success()
+
+func _prepare_night() -> void:
+	_fresh(420410)
+	var facility: FacilityInstance = _build_cafeteria(true)
+	if facility == null: return
+	_facility_id = facility.instance_id
+	var definition: FacilityDefinition = _runtime.definition_registry.get_facility(facility.definition_id)
+	for id: StringName in _staff_ids:
+		_expect(_cmd(&"register_staff", {&"staff_id": id, &"role_id": &"server", &"options": {&"state": StaffRuntime.State.OFF_DUTY, &"current_cell": Vector3i.ZERO}}).is_success(), "register real Staff actor " + String(id))
+		_expect(_cmd(&"set_staff_work_assignment", {&"staff_id": id, &"template_id": &"DAY", &"facility_id": _facility_id}).is_success(), "original DAY 06:00-18:00 shift " + String(id))
+	# Publicly registered Staff actors walk normally. The inherited fixture's
+	# kitchen cook is explicitly placed at the kitchen and uses its existing FLEX
+	# shift; this is not natural hiring/unlock or a proof of the whole labor flow.
+	var boundary: int = ShiftInstance.DAY_END
+	var queue_at: int = boundary + 2 - definition.base_service_minutes - 1
+	_expect(queue_at > _clock.absolute_minute, "real ticks can reach exact admission minute")
+	_clock.advance_minutes(queue_at - _clock.absolute_minute)
+	_expect(facility.active_staff_ids == _staff_ids, "both daytime actors are physically projected before service")
+	for id: StringName in _staff_ids:
+		var worker: StaffRuntime = _runtime.staff_service.get_staff(id)
+		_expect(_runtime.staff_service.requires_attendance(id) and StaffCommuteService.is_at_facility(worker, facility) and worker.current_cell != Vector3i.ZERO, "actual workplace arrival and attendance plan " + String(id))
+	_expect(_stock(facility.local_inventory_id, &"ingredient/basic_meal", 1, &"p04.order.shift.stock"), "one actual meal to reserve")
+	_expect(_cmd(&"spawn_guest", {&"guest_id": _guest_id, &"guest_type_id": &"traveler", &"gold": definition.base_price * 2, &"options": {&"state": GuestRuntime.State.DECIDING, &"current_cell": Vector3i.ZERO, &"planned_exit_at": boundary + definition.base_service_minutes}}).is_success(), "real public Guest actor and wallet")
+	_expect(_cmd(&"create_service_request", {&"facility_id": _facility_id, &"request_id": _request_id, &"guest_ids": [_guest_id]}).is_success(), "original price and duration service request")
+	_clock.advance_one_minute()
+	var active: Array = _runtime.facility_service.get_active_services(_facility_id)
+	_expect(active.size() == 1, "exactly one actual service starts")
+	if active.size() != 1: return
+	var service: ServiceInstance = active[0]; _service_id = service.service_id
+	_expect(service.duration_minutes == definition.base_service_minutes and service.price_snapshot == definition.base_price, "no price or duration override")
+	_expect(service.started_at + service.duration_minutes == boundary + 2, "unchanged duration with admission shifted two minutes")
+	_clock.advance_minutes(boundary - 1 - _clock.absolute_minute)
+	_expect(service.elapsed_minutes == service.duration_minutes - 3, "three real service minutes remain at 17:59")
+
+func _prepare_overtime() -> void:
+	_fresh(653322)
+	for row: Array in [[&"warehouse", Vector3i(-8, 0, 1)], [&"kitchen", Vector3i(2, 0, 1)], [&"staff_door", Vector3i(0, 0, 1)]]:
+		_expect(_command(&"build_facility", {&"definition_id": row[0], &"origin": row[1]}), "build %s" % row[0])
+	_clock.advance_minutes(180)
+	for facility: FacilityInstance in _runtime.facility_service.get_instances():
+		if facility.definition_id == &"warehouse": _source = facility.instance_id
+		if facility.definition_id == &"kitchen": _destination = facility.instance_id
+	if _source.is_empty() or _destination.is_empty():
+		_expect(false, "normal construction completes")
+		return
+	_expect(_command(&"hire_staff_candidate", {&"candidate_id": PORTER}), "hire the catalogue porter")
+	_expect(_command(&"set_staff_work_assignment", {&"staff_id": PORTER, &"facility_id": _source, &"template_id": &"DAY"}), "assign porter to a repeating real shift")
+	_expect(_worker().state == StaffRuntime.State.COMMUTING, "porter assignment begins a real warehouse commute")
+	for minute in range(40):
+		if _worker().state == StaffRuntime.State.AVAILABLE: break
+		_clock.advance_minutes(1)
+	_expect(_worker().state == StaffRuntime.State.AVAILABLE and StaffCommuteService.is_at_facility(_worker(), _runtime.facility_service.get_instance(_source)), "porter checks in physically before taking a supply job")
+	_expect(_command(&"purchase_supplies", {&"warehouse_id": _source, &"item_id": SupplyCatalog.RAW_FOOD, &"quantity": 8}), "purchase the source stock through the ledger")
+	_expect(_command(&"create_logistics_request", {&"request_id": REQUEST, &"source_inventory_id": _inventory(_source), &"destination_inventory_id": _inventory(_destination), &"item_requirements": {SupplyCatalog.RAW_FOOD: 8}}), "create the reserved supply request")
+	_expect(_quantity(_inventory(_destination)) == 0, "request creation does not deliver anything")
+	var check_in_cell: Vector3i = _worker().current_cell
+	_clock.advance_minutes(1)
+	_expect(_request().assigned_carrier_id == PORTER and _worker().current_cell.distance_to(check_in_cell) <= 1.0, "dispatcher selects the checked-in employee without teleporting")
+	_wait_for(LogisticsRequest.State.DELIVERING, 40)
+	_expect(_request().state == LogisticsRequest.State.DELIVERING and _worker().current_cell.distance_to(check_in_cell) <= 1.0, "physical pickup starts delivery from the checked-in warehouse access without teleporting")
+	if _request().state != LogisticsRequest.State.DELIVERING:
+		return
+	_expect(_quantity(_inventory(_source)) == 0 and _quantity(_cargo()) == 8 and _quantity(_inventory(_destination)) == 0, "pickup moves all eight units into owned cargo only")
+	_expect(_crosslinks(), "loaded Request, Task, reservations and cargo agree")
+	_loaded = _runtime.create_snapshot()
+
+	_write("loaded", {&"seed": _seed, &"snapshot": _loaded, &"commands": _commands, &"command_results": _command_results})
+	_expect(_task().interrupt_level == 0, "actual loaded task is non-interruptible")
+	_task_id = _task().task_id
+	_shift_id = _worker().shift_id
+	_target = _task().target_cell
+	_runtime.path_service.set_cell_temporary_block(_target, true)
+	_clock.advance_minutes(1078 - _clock.absolute_minute)
+	var before: Dictionary = _capture()
+	_clock.advance_one_minute()
+	var after: Dictionary = _capture()
+	_write("1078-1079-duty", _duty_delta(before, after))
+	_expect(_clock.absolute_minute == 1079, "real loaded branch reaches pre-boundary")
+
+func _wait_for(state: int, minutes: int) -> void:
+	for index: int in minutes:
+		if _request().state == state: return
+		_clock.advance_minutes(1)
+
+
+func _inventory(id: StringName) -> StringName:
+	return _runtime.facility_service.get_instance(id).local_inventory_id
+
+
+func _request() -> LogisticsRequest:
+	return _runtime.logistics_requests[REQUEST]
+
+
+func _worker() -> StaffRuntime:
+	return _runtime.staff_service.get_staff(PORTER)
+
+
+func _task() -> StaffTask:
+	return _runtime.staff_service.get_task(_worker().current_task_id)
+
+
+func _cargo() -> StringName:
+	return StringName("cargo:%s" % PORTER)
+
+
+func _quantity(inventory_id: StringName) -> int:
+	return _runtime.inventory_service.total_quantity(inventory_id, SupplyCatalog.RAW_FOOD)
+
+
+func _crosslinks() -> bool:
+	return SupplyLogisticsBridge.validate_crosslinks(_runtime.logistics_requests, _runtime.staff_service, _runtime.inventory_service, _runtime.facility_service)
+
+func _writer_branch(branch: String) -> void:
+	_case = branch
+	if branch == "night_absent": _prepare_night()
+	else: _prepare_overtime()
+	if _clock.absolute_minute != 1079:
+		_expect(false, "setup must reach exact pre-boundary minute")
+		return
+	_connect_phases()
+	var before: Dictionary = _capture()
+	if branch == "overtime": _guard_same_minute()
+	_save_point("1079", before)
+	var previous: Dictionary = before
+	var points: Dictionary = {"1079": before}
+	for minute: int in [1080, 1081]:
+		_clock.advance_one_minute()
+		var actual: Dictionary = _capture()
+		_expect(actual[&"minute"] == minute, "normal clock advances one boundary tick")
+		if branch == "overtime":
+			_write(str(minute) + "-duty", _duty_delta(previous, actual))
+			_guard_same_minute()
+		else:
+			_assert_night(before, actual)
+		_save_point(str(minute), actual)
+		points[str(minute)] = actual
+		previous = actual
+	if branch == "overtime": points["unload"] = _unload()
+	points["phase_observations"] = _phases.duplicate(true)
+	points["commands"] = _commands.duplicate(true)
+	points["command_results_including_inherited_fixture"] = _command_results.duplicate(true)
+	_branches[branch] = points
+	_write("branch", points)
+
+func _capture() -> Dictionary:
+	var snapshot: Dictionary = _runtime.create_snapshot()
+	var saved_operations: Dictionary = snapshot[&"systems"][&"runtime"][&"operations"]
+	var coordinator: OperationsCoordinator = _runtime.operations_coordinator
+	var coordinator_present: bool = is_instance_valid(coordinator)
+	var getter_diagnostics: Dictionary = {
+		&"operations_enabled": saved_operations[&"enabled"],
+		&"saved_coordinator": saved_operations[&"coordinator"],
+		&"actual_coordinator_present": coordinator_present,
+		&"actual_coordinator_is_null": coordinator == null,
+		&"getter_applicable": coordinator_present,
+		&"raw_getter_called": false,
+		&"getter_status": "not_applicable: actual coordinator absent; raw getter not called",
+	}
+	if coordinator_present:
+		var raw_day: Dictionary = coordinator.get_day_summary(1)
+		var canonical_operations: Dictionary = coordinator.create_snapshot()
+		var canonical_day: Dictionary = {}
+		var day_count: int = 0
+		for day: Dictionary in canonical_operations["day_summaries"]:
+			if int(day["day"]) == 1:
+				canonical_day = day
+				day_count += 1
+		var getter_differences: Array = []
+		_expect(_getter_join(raw_day, canonical_day, "$", getter_differences) and day_count == (0 if raw_day.is_empty() else 1), "raw getter joins canonical save contract without relaxing Runtime equality")
+		getter_diagnostics.merge({&"raw_getter_called": true, &"getter_status": "executed",
+			&"raw_day_getter": raw_day, &"canonical_operations": canonical_operations,
+			&"canonical_day1": canonical_day, &"getter_differences": getter_differences,
+			&"getter_bytes_equal": var_to_bytes(raw_day) == var_to_bytes(canonical_day)}, true)
+	var ledger: Array = []
+	for entry: LedgerEntry in _runtime.economy_service.get_entries(): ledger.append(entry.to_dictionary())
+	var row: Dictionary = {&"seed": _seed, &"minute": _clock.absolute_minute, &"snapshot": snapshot,
+		&"inputs": {&"case": _case, &"seed": _seed, &"facility_id": _facility_id, &"service_id": _service_id,
+			&"source": _source, &"destination": _destination, &"task_id": _task_id, &"shift_id": _shift_id,
+			&"target": _target, &"request_id": _request_id, &"guest_id": _guest_id,
+			&"boundary": ShiftInstance.DAY_END},
+		&"ledger": ledger,
+		&"commands": _commands.duplicate(true), &"command_results": _command_results.duplicate(true)}
+	row.merge(getter_diagnostics)
+	# Raw getters retain their actual StringName keys and insertion order. They
+	# are diagnostics, never substituted for the entire canonical Runtime save.
+	if _case == "night_absent":
+		row[&"inputs"].merge({&"planned_completion": 1082, &"admission_offset": 2,
+			&"kitchen_premise": "original physically placed FLEX cook; not natural hire"})
+		var facility: FacilityInstance = _runtime.facility_service.get_instance(_facility_id)
+		var service: ServiceInstance = _runtime.facility_service.get_service(_service_id)
+		var guest: GuestRuntime = _runtime.guest_service.get_guest(_guest_id)
+		var workers: Array = []
+		var night_count: int = 0
+		var staff_snapshot: Dictionary = _runtime.staff_service.create_snapshot()
+		for shift: Dictionary in staff_snapshot[&"shifts"]:
+			if shift[&"template_id"] == "NIGHT" and not shift[&"cancelled"]: night_count += 1
+		for id: StringName in _staff_ids:
+			var worker: StaffRuntime = _runtime.staff_service.get_staff(id)
+			workers.append(worker.create_snapshot())
+		var reservations: Array = []
+		for id: StringName in service.inventory_reservations:
+			var reservation: InventoryReservation = _runtime.inventory_service.get_reservation(id)
+			_expect(reservation != null, "original service reservation exists")
+			if reservation != null: reservations.append(reservation.create_snapshot())
+		var request: ServiceRequest = _runtime.facility_service.get_request(_request_id)
+		row.merge({&"facility": facility.create_snapshot(), &"service": service.create_snapshot(),
+			&"guest": guest.create_snapshot(), &"workers": workers, &"night_staff_count": night_count,
+			&"reservation_ids": service.inventory_reservations.duplicate(), &"reservations": reservations,
+			&"request": request.create_snapshot() if request != null else {},
+			&"wallet": _runtime.economy_service.get_balance(StringName("GUEST_WALLET:" + String(_guest_id))),
+			&"player_cash": _runtime.economy_service.get_balance(_runtime.PLAYER_CASH_ACCOUNT)})
+	else:
+		row[&"inputs"].merge({&"supply_request_id": REQUEST, &"porter_id": PORTER, &"quantity": 8,
+			&"staff_premise": "public catalogue Gina hire and real DAY commute"})
+		var worker: StaffRuntime = _worker()
+		var task: StaffTask = _runtime.staff_service.get_task(_task_id)
+		var shift: ShiftInstance = _runtime.staff_service.get_shift(_shift_id)
+		row.merge({&"worker": worker.create_snapshot(), &"task": task.create_snapshot() if task != null else {},
+			&"shift": shift.create_snapshot() if shift != null else {}, &"request": _request().create_snapshot(),
+			&"cargo_id": _cargo(), &"cargo_quantity": _quantity(_cargo()),
+			&"source_quantity": _quantity(_inventory(_source)), &"destination_quantity": _quantity(_inventory(_destination)),
+			&"inventory": _runtime.inventory_service.create_snapshot(), &"crosslinks": _crosslinks(),
+			&"reserved_load": _runtime.logistics_dispatcher.get_reserved_load(PORTER)})
+	return row
+
+func _assert_night(before: Dictionary, actual: Dictionary) -> void:
+	var service: Dictionary = actual[&"service"]
+	_expect(service[&"state"] != "COMPLETED" and int(service[&"elapsed_minutes"]) < int(service[&"duration_minutes"]), "original service remains unfinished")
+	_expect(actual[&"night_staff_count"] == 0, "no NIGHT shift registered")
+	_expect(actual[&"wallet"] == before[&"wallet"] and actual[&"player_cash"] == before[&"player_cash"], "unfinished service charges neither wallet nor player")
+	_expect(var_to_bytes(actual[&"ledger"]) == var_to_bytes(before[&"ledger"]), "no ledger posting while unfinished at boundary")
+	_expect(var_to_bytes(actual[&"reservation_ids"]) == var_to_bytes(before[&"reservation_ids"]) and not actual[&"reservation_ids"].is_empty(), "same nonempty original reservation IDs")
+	_expect(var_to_bytes(actual[&"reservations"]) == var_to_bytes(before[&"reservations"]), "original active reservations unchanged")
+	_expect(not actual[&"request"].is_empty(), "original request retained")
+	for reservation: Dictionary in actual[&"reservations"]:
+		_expect(reservation[&"state"] == "ACTIVE" and reservation[&"requester_id"] == String(_request_id) and reservation[&"purpose"] == "facility_service", "reservation state and original request ownership")
+		_expect(actual[&"request"][&"reserved_inventory_ids"].has(reservation[&"reservation_id"]), "request still owns service reservation")
+	_expect(actual[&"facility"][&"active_staff_ids"].is_empty(), "DAY staff have left cafeteria")
+	for worker: Dictionary in actual[&"workers"]:
+		_expect(worker[&"state"] == "OFF_DUTY", "DAY worker is off duty")
+	_expect(int(actual[&"guest"][&"planned_exit_at"]) == 1080 + int(service[&"duration_minutes"]) and int(actual[&"guest"][&"planned_exit_at"]) > 1081, "original planned exit formula; not early exit")
+	if actual[&"minute"] == 1081:
+		_expect(service[&"state"] == "WAITING_FOR_STAFF", "night_staff_absent at 1081")
+		_expect(int(service[&"staff_grace_deadline"]) == int(service[&"interrupted_at"]) + FacilityService.STAFF_REPLACEMENT_GRACE_MINUTES, "original five-minute replacement grace")
+
+func _duty_delta(before: Dictionary, after: Dictionary) -> Dictionary:
+	var worked: int = int(after[&"shift"][&"worked_minutes"]) - int(before[&"shift"][&"worked_minutes"])
+	var overtime: int = int(after[&"shift"][&"overtime_minutes"]) - int(before[&"shift"][&"overtime_minutes"])
+	var minute: int = after[&"minute"]
+	var expected_overtime: int = 1 if minute >= ShiftInstance.DAY_END else 0
+	_expect(worked == 1 - expected_overtime and overtime == expected_overtime, "exactly one duty minute in original normal/overtime bucket")
+	_expect(after[&"worker"][&"is_overtime"] == (minute >= ShiftInstance.DAY_END), "actual overtime flag at each minute")
+	for point: Dictionary in [before, after]:
+		_expect(point[&"task"][&"interrupt_level"] == 0, "actual task interrupt_level zero")
+		_expect(point[&"worker"][&"current_task_id"] == String(_task_id) and point[&"task"][&"assigned_staff_id"] == String(PORTER), "same Staff/Task pair")
+		_expect(point[&"worker"][&"shift_id"] == String(_shift_id) and point[&"shift"][&"staff_id"] == String(PORTER), "same real ShiftInstance")
+		_expect(point[&"worker"][&"carried_inventory_id"] == String(_cargo()) and point[&"cargo_quantity"] == 8 and point[&"destination_quantity"] == 0 and point[&"source_quantity"] == 0, "same eight-unit cargo owner while held")
+		_expect(point[&"request"][&"assigned_carrier_id"] == String(PORTER) and point[&"request"][&"state"] == "DELIVERING" and point[&"crosslinks"], "loaded request crosslinks remain valid")
+	return {&"before": before, &"after": after, &"worked_delta": worked, &"overtime_delta": overtime,
+		&"duty_recorded_once": worked == 1 - expected_overtime and overtime == expected_overtime}
+
+func _guard_same_minute() -> void:
+	var before: Dictionary = _runtime.create_snapshot()
+	var minute: int = _clock.absolute_minute
+	var result: Dictionary = _runtime.staff_service.advance_one_minute(minute)
+	var after: Dictionary = _runtime.create_snapshot()
+	_expect(not bool(result.get(&"ok", true)) and result.get(&"reason") == &"MINUTE_ALREADY_APPLIED", "public same-minute duplicate guard")
+	_expect(var_to_bytes(before) == var_to_bytes(after), "same-minute guard records no second duty minute; all Runtime fields unchanged")
+	_write(str(minute) + "-guard", {&"minute": minute, &"result": result, &"before": before, &"after": after})
+
+func _unload() -> Dictionary:
+	_runtime.path_service.set_cell_temporary_block(_target, false)
+	var observations: Array = []
+	for index: int in range(40):
+		if _request().state == LogisticsRequest.State.COMPLETED: break
+		_clock.advance_one_minute()
+		observations.append(_capture())
+	var completed: Dictionary = _capture()
+	_expect(_request().state == LogisticsRequest.State.COMPLETED and completed[&"task"][&"state"] == "COMPLETED", "safe unloading completes original request and task")
+	_expect(_quantity(_inventory(_destination)) == 8 and _quantity(_cargo()) == 0 and _crosslinks(), "safe unloading conserves all eight units")
+	_expect(_worker().current_task_id.is_empty() and _worker().carried_inventory_id.is_empty() and _runtime.logistics_dispatcher.get_reserved_load(PORTER) == 0, "completion releases cargo/task/dispatcher ownership")
+	_clock.advance_one_minute()
+	var off: Dictionary = _capture()
+	_expect(_worker().state == StaffRuntime.State.OFF_DUTY and not _worker().is_overtime, "OFF_DUTY after safe completion")
+	var row: Dictionary = {&"observations": observations, &"completed": completed, &"off_duty": off}
+	_write("unload", row)
+	return row
+
+func _connect_phases() -> void:
+	_clock.register_tick_handler(_clock.TickPhase.FACILITY_COMPLETION, &"aa.p04.s2b.observe", func(minute: int) -> void:
+		if minute in [1080, 1081]: _phase("before-facility")
+	)
+	_clock.register_tick_handler(_clock.TickPhase.FACILITY_COMPLETION, &"zz.p04.s2b.observe", func(minute: int) -> void:
+		if minute in [1080, 1081]: _phase("after-facility")
+	)
+	_clock.register_tick_handler(_clock.TickPhase.AI_DECISIONS, &"zz.p04.s2b.observe", func(minute: int) -> void:
+		if minute in [1080, 1081]: _phase("after-staff")
+	)
+
+func _phase(label: String) -> void:
+	var row: Dictionary = {&"label": label, &"minute": _clock.absolute_minute, &"snapshot": _runtime.create_snapshot()}
+	_phases.append(row)
+	_write(str(_clock.absolute_minute) + "-" + label, row)
+
+func _save_point(label: String, point: Dictionary) -> void:
+	_write(label, point)
+	var path: String = "user://saves/p04_s2b/" + _case + "-" + label
+	var result: Dictionary = SaveService.save_snapshot(path, point[&"snapshot"])
+	var inspected: Dictionary = SaveService.inspect_snapshot(path)
+	_expect(bool(result.get(&"ok", false)) and bool(inspected.get(&"ok", false)) and bool(inspected.get(&"read_only", false)), "public formal save and inspect")
+	_expect(var_to_bytes(inspected.get(&"snapshot", {})) == var_to_bytes(point[&"snapshot"]), "formal save retains every typed Runtime field")
+	_expect(var_to_bytes(_runtime.create_snapshot()) == var_to_bytes(point[&"snapshot"]), "saving does not mutate live Runtime")
+	_slots[_case + "-" + label] = ProjectSettings.globalize_path(path)
+	_write(label + "-save", {&"save_result": result, &"inspect_result": inspected})
+
+func _write(label: String, value: Variant, global_name: bool = false) -> void:
+	var name: String = label if global_name else _mode + "-" + _case + "-" + label
+	var file: FileAccess = FileAccess.open(_evidence_dir.path_join(name + ".var"), FileAccess.WRITE)
+	_expect(file != null, "typed artifact " + name)
+	if file != null:
+		file.store_buffer(var_to_bytes(value)); file.flush(); file.close()
+	file = FileAccess.open(_evidence_dir.path_join(name + ".json"), FileAccess.WRITE)
+	_expect(file != null, "JSON artifact " + name)
+	if file != null:
+		file.store_string(JSON.stringify(value, "\t")); file.flush(); file.close()
+
+func _read_point(label: String) -> Dictionary:
+	var file: FileAccess = FileAccess.open(_evidence_dir.path_join("writer-" + _case + "-" + label + ".var"), FileAccess.READ)
+	_expect(file != null, "Writer typed artifact " + label)
+	if file == null: return {}
+	var value: Variant = bytes_to_var(file.get_buffer(file.get_length()))
+	file.close()
+	_expect(value is Dictionary, "typed dictionary artifact")
+	return value if value is Dictionary else {}
+
+func _restore_inputs(point: Dictionary) -> void:
+	var inputs: Dictionary = point[&"inputs"]
+	_seed = int(inputs[&"seed"])
+	_facility_id = StringName(inputs[&"facility_id"])
+	_service_id = StringName(inputs[&"service_id"])
+	_source = StringName(inputs[&"source"])
+	_destination = StringName(inputs[&"destination"])
+	_task_id = StringName(inputs[&"task_id"])
+	_shift_id = StringName(inputs[&"shift_id"])
+	_target = inputs[&"target"]
+
+func _reader() -> void:
+	var file: FileAccess = FileAccess.open(_evidence_dir.path_join("writer.json"), FileAccess.READ)
+	_expect(file != null, "Writer receipt")
+	if file == null: return
+	var writer: Dictionary = JSON.parse_string(file.get_as_text())
+	file.close()
+	_expect(int(writer["pid"]) != OS.get_process_id() and String(writer["profile"]) != OS.get_user_data_dir(), "independent Reader PID/profile")
+	for branch: String in ["night_absent", "overtime"]:
+		_case = branch
+		var points: Dictionary = {}
+		var hashes: Dictionary = {}
+		for label: String in ["1079", "1080", "1081"]:
+			var key: String = branch + "-" + label
+			var original: String = writer["slots"][key]
+			var target: String = ProjectSettings.globalize_path("user://saves/p04_s2b/" + key)
+			_expect(DirAccess.make_dir_recursive_absolute(target) == OK, "fresh Reader slot")
+			var directory: DirAccess = DirAccess.open(original)
+			_expect(directory != null, "Writer slot accessible")
+			if directory == null: return
+			var members: PackedStringArray = directory.get_files()
+			members.sort()
+			_expect(directory.get_directories().is_empty() and members == PackedStringArray(["journal.log", "manifest.json", "thumbnail.png", "world.bin"]), "exact four-member formal package")
+			var member_hashes: Dictionary = {}
+			for member: String in members:
+				var sha: String = FileAccess.get_sha256(original.path_join(member))
+				_expect(DirAccess.copy_absolute(original.path_join(member), target.path_join(member)) == OK, "copy formal member")
+				var copied_sha: String = FileAccess.get_sha256(target.path_join(member))
+				_expect(sha == copied_sha and not sha.is_empty(), "original/copy SHA equality")
+				member_hashes[member] = {&"original_before": sha, &"copy_before": copied_sha}
+			hashes[key] = {&"original": original, &"copy": target, &"members": member_hashes}
+			_slots[key] = target
+			var expected: Dictionary = _read_point(label)
+			if expected.is_empty(): return
+			points[label] = expected
+			_fresh(int(expected[&"seed"]))
+			_restore_inputs(expected)
+			var loaded: Dictionary = SaveService.load_snapshot(target)
+			_expect(bool(loaded.get(&"ok", false)), "public formal load")
+			if not bool(loaded.get(&"ok", false)): return
+			_expect(var_to_bytes(loaded[&"snapshot"]) == var_to_bytes(expected[&"snapshot"]), "all typed saved fields match Writer")
+			_expect(_runtime.restore_snapshot(loaded[&"snapshot"]), "public Runtime restore")
+			var actual: Dictionary = _capture()
+			_expect(var_to_bytes(actual[&"snapshot"]) == var_to_bytes(expected[&"snapshot"]), "all typed Runtime fields match Writer after restore")
+			_write(label + "-restored", {&"expected": expected, &"actual": actual, &"load_result": loaded})
+			if branch == "night_absent" and label != "1079": _assert_night(points["1079"], actual)
+		# A separate fresh load of the pre-boundary package drives both real ticks.
+		_fresh(int(points["1079"][&"seed"]))
+		_restore_inputs(points["1079"])
+		var pre: Dictionary = SaveService.load_snapshot(_slots[branch + "-1079"])
+		_expect(bool(pre.get(&"ok", false)), "replay public pre-boundary load")
+		if not bool(pre.get(&"ok", false)): return
+		_expect(_runtime.restore_snapshot(pre[&"snapshot"]), "replay public restore")
+		_expect(var_to_bytes(_runtime.create_snapshot()) == var_to_bytes(points["1079"][&"snapshot"]), "replay starts at exact all-field pre-boundary state")
+		_connect_phases()
+		var previous: Dictionary = _capture()
+		if branch == "overtime": _guard_same_minute()
+		for label: String in ["1080", "1081"]:
+			_clock.advance_one_minute()
+			var actual: Dictionary = _capture()
+			_expect(var_to_bytes(actual[&"snapshot"]) == var_to_bytes(points[label][&"snapshot"]), "two-tick replay entire typed equality " + label)
+			if branch == "overtime":
+				_write(label + "-duty", _duty_delta(previous, actual))
+				_guard_same_minute()
+			else: _assert_night(points["1079"], actual)
+			_write(label + "-replay", actual)
+			previous = actual
+		var writer_branch: Dictionary = _read_point("branch")
+		_expect(var_to_bytes(_phases) == var_to_bytes(writer_branch["phase_observations"]), "same boundary phase order and full typed states")
+		if branch == "overtime":
+			var unload: Dictionary = _unload()
+			for label: String in ["completed", "off_duty"]:
+				_expect(var_to_bytes(unload[label][&"snapshot"]) == var_to_bytes(writer_branch["unload"][label][&"snapshot"]), "safe unloading replay all typed fields " + label)
+		for key: String in hashes:
+			var row: Dictionary = hashes[key]
+			for member: String in row[&"members"]:
+				var member_row: Dictionary = row[&"members"][member]
+				member_row[&"original_after"] = FileAccess.get_sha256(String(row[&"original"]).path_join(member))
+				member_row[&"copy_after"] = FileAccess.get_sha256(String(row[&"copy"]).path_join(member))
+				_expect(member_row[&"original_before"] == member_row[&"original_after"] and member_row[&"copy_before"] == member_row[&"copy_after"], "original and copied members unchanged after loads/replay")
+		_branches[branch] = {&"member_hashes": hashes, &"phase_observations": _phases.duplicate(true)}
+		_write("branch", _branches[branch])
+
+func _getter_join(raw: Variant, saved: Variant, path: String, differences: Array) -> bool:
+	# Only diagnostic getter-to-save joining permits StringName/String and key
+	# ordering differences. All formal/replay Runtime checks above remain bytes.
+	if typeof(raw) != typeof(saved):
+		var text_pair: bool = typeof(raw) in [TYPE_STRING, TYPE_STRING_NAME] and typeof(saved) in [TYPE_STRING, TYPE_STRING_NAME]
+		differences.append({"path": path, "kind": "StringName_String" if text_pair else "type_mismatch", "raw_type": typeof(raw), "saved_type": typeof(saved)})
+		return text_pair and String(raw) == String(saved)
+	if raw is Dictionary:
+		var matched: Dictionary = {}
+		var ok: bool = raw.size() == saved.size()
+		var raw_order: Array = []
+		var saved_order: Array = []
+		for key: Variant in saved: saved_order.append(String(key))
+		for key: Variant in raw:
+			var name: String = String(key)
+			raw_order.append(name)
+			if matched.has(name) or not saved.has(name):
+				ok = false
+				continue
+			matched[name] = true
+			if typeof(key) != TYPE_STRING:
+				differences.append({"path": path + "/" + name, "kind": "key_StringName_String" if typeof(key) == TYPE_STRING_NAME else "invalid_key_type", "raw_type": typeof(key), "saved_type": TYPE_STRING})
+				ok = typeof(key) == TYPE_STRING_NAME and ok
+			ok = _getter_join(raw[key], saved[name], path + "/" + name, differences) and ok
+		if raw_order != saved_order: differences.append({"path": path, "kind": "key_order", "raw": raw_order, "saved": saved_order})
+		return ok
+	if raw is Array:
+		if raw.size() != saved.size(): return false
+		var ok: bool = true
+		for index: int in range(raw.size()): ok = _getter_join(raw[index], saved[index], path + "/" + str(index), differences) and ok
+		return ok
+	return var_to_bytes(raw) == var_to_bytes(saved)
+
@@ -0,0 +1,274 @@
+#!/usr/bin/env python3
+"""S2b-only native entry. --check-only never loads ownership helpers or starts Godot."""
+from pathlib import Path
+import argparse
+import hashlib
+import importlib.util
+import json
+import os
+import shutil
+import subprocess
+import sys
+sys.dont_write_bytecode = True
+
+HERE = Path(__file__).resolve().parent
+BUILD = Path("/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build")
+PRODUCT = Path("/Users/korizatou114/Projects/とりにく工房ゲーム制作部")
+CACHE_RUN = Path("/Users/korizatou114/Projects/TheTree-managed-worktrees/p18-01-model/.runtime/P18-01-CODE/build/p18-relationship-evidence")
+TEST = "tests/s3/test_runtime_staff_assignment.gd"
+QA = HERE / "p04_s2b_shift_probe.gd"
+ENGINE = Path("/Applications/Godot.app/Contents/MacOS/Godot")
+PATTERNS = BUILD / "audit-support/p04-whole-closure-r01/current-patterns"
+AUDIT = BUILD / "audit-support/p04-whole-closure-r01/ROOT_S2B_EXISTING_SOURCE_AUDIT.json"
+MATERIALS = [PATTERNS / "approved-shift-current-r01.gd", AUDIT] + [
+    HERE.parent / folder / name for folder, name in [
+        ("s1", "run_s1_native.py"), ("s1", "S1_ROOT_RUN.md"),
+        ("s2", "run_s2a_native.py"), ("s2", "p04_s2a_midnight_probe.gd"),
+        ("s2", "S2_ROOT_RUN.md"),
+    ]
+]
+
+def template_guard(root):
+    audit = json.loads(AUDIT.read_text())
+    for row in audit["source_pins"]:
+        actual = pin(root / row["path"])
+        if (actual["bytes"], actual["sha256"]) != (row["production_bytes"], row["production_sha256"]):
+            raise ValueError("Root source audit mismatch: " + row["path"])
+    probe = QA.read_text()
+    if ":=" in probe:
+        raise ValueError("probe must use explicit types; inferred declaration found")
+    for forbidden in ["._update_shift_states(", ".record_duty_minute("]:
+        if forbidden in probe:
+            raise ValueError("unsupported duty mutation: " + forbidden)
+
+def module(name, path):
+    spec = importlib.util.spec_from_file_location(name, path)
+    value = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(value)
+    return value
+
+def pin(path):
+    path = Path(path)
+    if path.is_symlink() or not path.is_file():
+        raise ValueError("missing exact input: " + str(path))
+    data = path.read_bytes()
+    return dict(path=str(path), bytes=len(data), sha256=hashlib.sha256(data).hexdigest())
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--project-root", type=Path, default=PRODUCT)
+    parser.add_argument("--output", type=Path, default=BUILD / "p04-s2b-native-r01")
+    parser.add_argument("--plan", type=Path, default=BUILD / "p04-s2b-plan-r01.json")
+    parser.add_argument("--cache-run", type=Path, default=CACHE_RUN)
+    parser.add_argument("--godot", type=Path, default=ENGINE)
+    parser.add_argument("--check-only", action="store_true")
+    args = parser.parse_args()
+    root = args.project_root.resolve()
+    out = args.output.resolve()
+    if not out.is_relative_to(BUILD.resolve()) or not args.plan.resolve().is_relative_to(BUILD.resolve()):
+        raise ValueError("plan/output must stay in task build")
+    r = module("s2b_standard_runner", root / "tools/run_all_tests.py")
+    # Preserve the reviewed source_refs -> exactly one QA override order.
+    source_before = r.source_refs(root)
+    refs = dict(source_before)
+    refs[TEST] = pin(QA)
+    template_guard(root)
+    expected = {n: dict(bytes=p["bytes"], sha256=p["sha256"]) for n, p in refs.items()}
+    fixed = [pin(p) for p in MATERIALS + [
+        QA, Path(__file__), HERE / "S2B_ROOT_RUN.md",
+        root / "tests/transport/test_runtime_transport.gd",
+        root / "tests/staff/test_rescue_elevator.gd",
+        root / "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json",
+    ]]
+    selected = dict(root_before=source_before, map={n: p["sha256"] for n, p in refs.items()}, timeout=1200)
+    cache_note = None
+    cache_receipts = []
+    for leaf in ["runner-ended.json", "runner-input.json"]:
+        path = args.cache_run / leaf
+        try:
+            cache_receipts.append(pin(path))
+        except OSError as caught:
+            cache_note = dict(path=str(path), error=type(caught).__name__ + ": " + str(caught),
+                              required_before_native=True)
+            break
+    plan = dict(protocol="p04-s2b-preparation-v1", project_root=str(root), output=str(out),
+                source_before=source_before, selected_source_map=selected["map"],
+                QA_overrides=[TEST], fixed_input_pins=fixed, cache_run=str(args.cache_run),
+                cache_receipts=cache_receipts, cache_access=cache_note,
+                phases=["import", "parse", "writer", "reader"],
+                native_engine_launches=0, whole_goal_accepted=False, unit_accepted=False)
+    # Check-only only reads source/materials and writes the plan in task build.
+    # It deliberately does not read default-player data, inspect processes or stat Godot.
+    if args.check_only:
+        args.plan.parent.mkdir(parents=True, exist_ok=True)
+        if args.plan.exists():
+            r.require(r.read(args.plan) == plan, "existing plan differs; use a fresh plan path")
+        else:
+            r.write(args.plan, plan)
+        print(json.dumps(dict(check_only=True, engines=0, source_files=len(source_before),
+                              QA_overrides=[TEST], fixed_pins=len(fixed), plan=str(args.plan),
+                              plan_sha256=r.sha(args.plan), cache_access=cache_note), ensure_ascii=False))
+        return 0
+    r.require(root == PRODUCT.resolve() and len(source_before) == 1338, "Root native requires product 1338; worker plan is not native evidence")
+    r.require(args.plan.is_file() and r.read(args.plan) == plan, "run exact check-only plan first")
+    def fixed_guard():
+        template_guard(root)
+        for value in fixed + cache_receipts:
+            r.require(pin(value["path"]) == value, "fixed input changed: " + value["path"])
+    fixed_guard()
+    # Native admission is Root-only and fails closed on unreadable cache.
+    r.require(cache_note is None, "Root must read exact cache receipts: " + str(cache_note))
+    old = args.cache_run
+    r.require(r.read(old / "runner-ended.json")["passed"], "ended cache run must have passed")
+    old_map = r.read(old / "runner-input.json")["selected_source_map"]
+    current_map = {n: p["sha256"] for n, p in source_before.items()}
+    r.require(old_map == current_map, "ended cache selected source must equal current product")
+    protected = r.default_player(root)
+    outer = module("s2b_owned_outer", r.SUPPORT / "owned_outer.py")
+    r.require(not outer.native.helper["live_engines"](), "another Godot owns CPU")
+    engine = args.godot.resolve()
+    r.require(engine.is_file(), "Root native Godot path")
+    r.require(shutil.disk_usage(out.parent).free >= 1024**3 + engine.stat().st_size + 136*1024**2,
+              "reviewed native disk admission")
+    r.require(not out.exists(), "fresh output required; preserve previous attempts")
+    out.mkdir()
+    stage = out / "stage"
+    stage.mkdir()
+    (out / "starters").mkdir()
+    (out / "bootstrap").mkdir()
+    phases = []
+    previous = {}
+    error = None
+    guards = []
+    cleanup = []
+    cleanup_errors = []
+    cache_before = None
+    formal_before = None
+    formal_after = None
+    original_phase = outer.run_phase
+    def run_phase(argv, folder, timeout, env, **kwargs):
+        env = dict(env)
+        if folder.name in ["writer", "reader"]:
+            env.update(THE_TREE_S2B_EVIDENCE=str(out / "raw"), THE_TREE_S2B_MODE=folder.name)
+        return original_phase(argv, folder, timeout, env, **kwargs)
+    outer.run_phase = run_phase
+    r.write(out / "runner-started.json", dict(started=r.now(), owner_runner_pid=os.getpid(),
+            plan=pin(args.plan), engines_launched=0))
+    try:
+        r.write(out / "source_before.json", source_before)
+        r.write(out / "selected-source-map.json", refs)
+        # Private source stage first, then literal reviewed bootstrap.
+        for name, value in refs.items():
+            target = stage / name
+            target.parent.mkdir(parents=True, exist_ok=True)
+            r.copy_source(Path(value["path"]), target)
+        r.require(r.inventory(stage, stage=True) == expected, "whole private source")
+        for name, value in r.read(r.SUPPORT / "bootstrap-scripts.json").items():
+            data = value["text"].encode()
+            r.require(hashlib.sha256(data).hexdigest() == value["sha256"], "bootstrap pin")
+            (out / "bootstrap" / name).write_bytes(data)
+        cache = old / "stage/.godot"
+        cache_before = r.inventory(cache)
+        r.require(bool(cache_before), "nonempty ended cache")
+        for name in cache_before:
+            src = cache / name
+            dst = stage / ".godot" / name
+            dst.parent.mkdir(parents=True, exist_ok=True)
+            subprocess.run(["/bin/cp", "-c", str(src), str(dst)], check=True)
+            r.require((src.stat().st_dev, src.stat().st_ino) != (dst.stat().st_dev, dst.stat().st_ino),
+                      "cache clone is a separate inode")
+        r.require(r.inventory(stage / ".godot") == cache_before, "whole cache clone hashes")
+        r.write(out / "cache-reuse.json", dict(ended_run=str(old), receipts=cache_receipts,
+                whole_cache=cache_before, independent_inode=True,
+                ordinary_import_required=True, ordinary_parse_required=True))
+        paths = ["res://" + n for n in sorted(refs) if n.endswith(".gd")]
+        r.write(out / "parse-paths.json", paths)
+        markers = module("s2b_markers", root / "tools/strict_test_markers.py")
+        contracts = markers.load_contracts(root / "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json")
+        contracts[TEST] = dict(test=TEST, template="S2b shift: <checks> checks, <failures> failures", required=True)
+        policy = r.read(r.SUPPORT / "suite-policy.json")
+        r.require(TEST not in policy["suite_policies"], "no normal suite watchdog/policy override")
+        r.write(out / "contracts.json", contracts)
+        r.write(out / "runner-input.json", dict(plan, owner_runner_pid=os.getpid(),
+                wrapper_sha256=r.sha(__file__), QA=pin(QA), runner_sha256=r.sha(root / "tools/run_all_tests.py"),
+                default_player_before=protected, fixed_input_pins=fixed,
+                functional_watchdog_seconds=1200, source_adoption=False))
+        diagnostics = module("s2b_diagnostics", r.SUPPORT / "diagnostic_gate.py")
+        owners = module("s2b_owners", r.SUPPORT / "ordinary_proof_gate.py")
+        audio = module("s2b_audio", r.SUPPORT / "audio_evidence_gate.py")
+        public = (stage / "project.godot").read_bytes()
+        for phase, test in [("import", None), ("parse", None), ("writer", TEST), ("reader", TEST)]:
+            if phase == "reader":
+                writer = r.read(out / "raw/writer.json")
+                formal_before = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
+                r.require(len(formal_before) == 6, "three formal points for each of two fresh branches")
+            row = r.execute_phase(str(engine), stage, out, phase, test, selected, expected,
+                                  previous, policy, contracts, paths, public, protected, root,
+                                  outer, markers, diagnostics, owners, audio)
+            phases.append(row)
+            # execute_phase uses the same test log name; retain each phase's exact log too.
+            if test and row.get("log"):
+                (out / (phase + "-combined-raw.log")).write_bytes((out / row["log"]).read_bytes())
+                row["strict_runner_log_path"] = row["log"]
+                row["log"] = phase + "-combined-raw.log"
+            r.write(out / (phase + "-actual-phase.json"), row)
+            print(json.dumps(dict(phase=phase, passed=row["passed"], error=row.get("validation_error"))), flush=True)
+            r.require(row["passed"], "first strict phase failure: " + phase)
+            if phase in ["writer", "reader"]:
+                receipt = r.read(out / ("raw/" + phase + ".json"))
+                r.require(receipt["checks"] > 0 and receipt["failures"] == 0,
+                          "S2b actual outcome receipt")
+                r.require(sorted(receipt["branches"]) == ["night_absent", "overtime"],
+                          "exact independent Writer cases and formal Reader case")
+                r.require(receipt["pid"] == row["actual_pid"], "actual native PID/receipt")
+        writer = r.read(out / "raw/writer.json")
+        reader = r.read(out / "raw/reader.json")
+        r.require(writer["pid"] != reader["pid"] and writer["profile"] != reader["profile"], "distinct formal processes")
+        formal_after = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
+        r.require(formal_before == formal_after, "Reader leaves Writer packages unchanged")
+    except BaseException as caught:
+        error = type(caught).__name__ + ": " + str(caught)
+    finally:
+        cleanup, cleanup_errors = outer.finish_captured(outer.OWNED)
+        try:
+            r.write(out / "outer-owned-finally.json", dict(cleanup=cleanup, errors=cleanup_errors))
+        except BaseException as caught:
+            guards.append("finally receipt: " + type(caught).__name__ + ": " + str(caught))
+    # Fixed guard always follows ownership cleanup, even if setup or an engine failed.
+    try:
+        fixed_guard()
+        after = r.source_refs(root)
+        r.write(out / "source_after.json", after)
+        r.require(after == source_before, "whole product source unchanged")
+        r.require(r.default_player(root) == protected, "default player unchanged")
+        if (stage / "project.godot").exists():
+            r.require(r.inventory(stage, stage=True) == dict(expected, **previous), "whole private source unchanged")
+        if cache_before is not None:
+            r.require(r.inventory(old / "stage/.godot") == cache_before, "original cache unchanged")
+        if formal_before is not None:
+            writer = r.read(out / "raw/writer.json")
+            formal_after = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
+            r.require(formal_before == formal_after, "Writer formal packages unchanged after Reader, including failure")
+    except BaseException as caught:
+        guards.append(type(caught).__name__ + ": " + str(caught))
+    pids = [p.pid for p in outer.OWNED]
+    passed = (error is None and not guards and not cleanup_errors and len(phases) == 4
+              and all(p["passed"] for p in phases) and len(pids) == len(set(pids)) == 4
+              and all(p["engine_ended"] for p in cleanup))
+    execution = dict(passed=passed, error=error, guard_errors=guards, phases=phases,
+                     actual_captured_PIDs=pids, cleanup=cleanup, cleanup_errors=cleanup_errors,
+                     formal_before=formal_before, formal_after=formal_after,
+                     whole_goal_accepted=False, unit_accepted=False)
+    r.write(out / "raw-inventory.json", r.inventory(out / "raw"))
+    r.write(out / "PID-set.json", dict(owner_runner_pid=os.getpid(), engine_PIDs=pids))
+    r.write(out / "execution.json", execution)
+    r.write(out / "runner-ended.json", dict(execution, ended=r.now()))
+    print(json.dumps(dict(passed=passed, error=error, guard_errors=guards, output=str(out))))
+    return 0 if passed else 1
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except Exception as caught:
+        print(type(caught).__name__ + ": " + str(caught), file=sys.stderr)
+        raise SystemExit(2)
@@ -0,0 +1,95 @@
+# P04-01 S3 code-ready preparation
+
+変更は本ディレクトリのGD、Python wrapper、本書の3本のみ。製品修正0。
+本提出は原P04-01の残る5条件の検証コード準備であり、原成果の加点は0。
+原7領域、3安全結果、15条件＋EV、30/88、部分点0を維持する。
+S1r02、S2ar03、S2b native r02は保持し再実行しない。
+
+## 固定入力と6実ケース
+
+最初に供給SOURCE_MANIFEST.jsonの7ファイルについて全byte SHA256とbyte数の一致を確認した。
+manifest自体のSHAは `d4993398f7619ca37bcd64c32b79bdee892d44e31f332cc0dd5f31fb7bc28314`。
+wrapperは同manifest、7供給ファイル、Rootの現行source audit、S2bの3ファイル、本3ファイルをpinする。
+選択rootの全sourceもsource_refsでpinし、その後にQAを1件だけ明示overrideする。
+override先はS2bと同じ `tests/s3/test_runtime_staff_assignment.gd`。
+これはprivate stageだけのoverrideで、継承先ActorHardeningを置き換えない。
+
+| case | seed | 境界と検証対象 |
+| --- | --- | --- |
+| B1 | 420410 | 959に開始済Aと実queue B。960に有限mana枯渇と対象への直接休業。960/961はAの進捗・同じ予約を保持し課金0、Bはrelease・在庫返却・忍耐不消費。元reserveへ公開復旧し、休業のまま962にAだけ1回課金。963で重複なし。 |
+| B2a | 420430 | 原定義のduration/priceで960完了・課金後に通常退出、961 Despawnで二重課金なし。 |
+| B2b | 420431 | 959の実queueを960の公開leaveでadmission前にrelease。961通常退出、962 Despawn。課金0。 |
+| B3 | 420435 | 元traveler.base_patience、実サーバー不足queue。template同様にfixture時刻＋base_patienceを境界とし、通常tickで枯渇。ABANDONING→DECIDING→LEAVING→Despawn、返却1回・課金0。planned_exitは元templateの境界値。 |
+| B4a | 420420 | 元diagnostic automatic DEFENSE Event、foreground=false、durability=0。960の完了・1回課金が後段Event破壊に先行。961で重複なし。 |
+| B4b | 420421 | 元durationの入場offset1。960は進捗後にEvent破壊、961でFAILED・release・返却1回、課金0。 |
+
+7件目は作らない。各caseはfresh Runtime/Clock/GameState、厨房は現行ActorHardeningと
+required_kitchen_setupの物理配置FLEX fixture。自然hire/unlockの証拠ではない。
+サービス価格・時間は定義取得、capacity/staff_min変更なし、忍耐・elapsedの直接変更なし。
+旧1299 wrapper、未承認18:00 predicate、本番Operations enableは使用しない。
+
+D-034（供給DESIGN_DECISIONS.md 252–262行、特に258行）の直接休業では開始済を継続する。
+関連厨房不稼働によるpauseとは区別する。interruption_reasonは実snapshotのまま残し、
+RELATED_FACILITY_INACTIVEをNO_POWERへ置換しない。
+enum snapshotは各create_snapshotのString定義に従い、stateをintへ変換しない。
+
+## Rawと正式保存
+
+Writerの各before/after/next、B1 recovered/duplicate_guard、B2b/B3 despawnを正式保存する（計22slot）。
+各点の全Runtime typed snapshot、入力・seed・serial・実ID・Guest/wallet/planned_exit、
+service/request/reservation、在庫、ledger、Event instanceを無加工の.varとJSONで一度だけ保存する。
+各tickの全11phase開始点も同様に保存し、phase順と境界内部の状態を残す。
+case/indexはrawのpath/SHAを参照し、巨大snapshotのaggregate多重コピーを作らない。
+全体rawをobsolete 500000-byte capに合わせて省略・圧縮しない。
+public command入力と結果、継承fixture分を含むcommand_completed結果をcase別rawに保存する。
+fixture自身の公開command入力・IDは全Runtime command queue履歴にも残る。
+Operationsは正式snapshotのdisabled/coordinator={}と実coordinator不在を別々に記録し、無関係なgetterを呼ばない。
+
+公開SaveService.save_snapshot/inspect_snapshotの成功・全typed一致・live Runtime不変を確認する。
+Readerは別PID/profileで22slotの全member（journal.log/manifest.json/thumbnail.png/world.bin）をコピーし、
+原/copyの全SHA、load/replay後の両者不変を確認する。余分なmember/directoryは失敗する。
+全点を公開load/restoreしてWriterの全Runtime typed bytesと一致させる。
+さらに各beforeをfresh loadし、通常clockで同じ全境界を再生する。
+B1のfuture recoveryについてserial、idempotency key、command ID、issue minute、元reserveをbeforeに保存する。
+Readerはserial0から始め、保存済probe入力を復元して未来コマンドだけを実行する。setup keyを再利用しない。
+全pointとphaseのtyped比較からフィールドを削除せず、JSON正規化や要約への置換も行わない。
+再生中のphaseはWriterと同じ順・全typed状態、pointは入力・receiptまで含む全typed一致を必須とする。
+
+## Root手順
+
+Rootだけが現行製品1338でfresh plan→nativeを1回実行する。
+worker checkout planを製品nativeへ転用しない。既存plan/outputは上書きしない。
+
+```sh
+export BUILD_OUTPUT_DIR='/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build'
+export PYTHONDONTWRITEBYTECODE=1
+python3 docs/plans/original-completion-2026-10-02/execution/p04-01/s3/run_s3_native.py --check-only --plan "$BUILD_OUTPUT_DIR/p04-s3-root-plan-r01.json" --output "$BUILD_OUTPUT_DIR/p04-s3-native-r01"
+python3 docs/plans/original-completion-2026-10-02/execution/p04-01/s3/run_s3_native.py --plan "$BUILD_OUTPUT_DIR/p04-s3-root-plan-r01.json" --output "$BUILD_OUTPUT_DIR/p04-s3-native-r01"
+```
+
+製品root既定値: `/Users/korizatou114/Projects/とりにく工房ゲーム制作部`。
+出力先: `/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build/p04-s3-native-r01/`。
+一つのprivate stage/cacheでimport1回、parse1回、Writer1回、別PID Reader1回。
+S2bのstrict guard、policy/watchdog、marker/diagnostic/ownership/audio gateを踏襲する。
+source/cacheは別inode、owned finally後に全source/default profile/private source/pin/original cacheを検査する。
+Writer formal slot不変も失敗時を含めて検査し、4phase・4実PIDの終了とreceipt PIDを必須とする。
+check-onlyはengine0、private/default profileアクセス0、所有helper未読込。cache receiptの実読取エラーはplanに残しnativeを拒否する。
+
+## 残gapとworker検証
+
+workerはpy_compile、check-only、型/参照の静的確認だけを行う。
+Godot parse・native・全回帰・Runner操作・git書込み・他agent起動は0。
+GDの正式parseと6ケースの実成立、全正式Save/Load/replay一致はRoot nativeまで未実証。
+S3 raw取得後のcollector/A仕上げ、原15＋EV全証拠の適用性照合、D05の原未確定規約、
+必要なOS別条件、正式独立レビュー・統合は本提出で確定しない。
+未知の原規約を新たに作らずpendingとし、P04全体完成を主張しない。
+
+worker実施記録: py_compile成功（出力はtask buildのp04-s3-worker-pycompile.pyc）。
+GDの明示型変数・loop・関数戻り値、禁止されたpatience/elapsed直接代入なし、継承先literal参照、
+15のservice method参照、Runtime method/signal参照、括弧整合を静的確認した。Godot parseの代替ではない。
+製品rootでのcheck-onlyはtools/run_all_tests.py読取りがPermissionErrorでexit2。
+明示worktree rootではcheck-only成功（source1300、QA1、fixed pins18、engine0）。
+終了済cacheのrunner-ended.jsonはPermissionErrorであり、planのcache_accessに実path/errorを記録した。
+製品1338のcheck-only成功やcache再利用の成立は主張しない。Rootが自身の環境で確認する。
+初回worktree planはbuild/p04-s3-worker-check-r01.json。最終3ファイルのpin確認にはfreshな
+build/p04-s3-worker-check-r02.jsonを使用し、r01は保持する。
@@ -0,0 +1,480 @@
+extends "res://tests/s3/test_runtime_actor_hardening.gd"
+
+const CASES: Array[String] = ["B1", "B2a", "B2b", "B3", "B4a", "B4b"]
+const SEEDS: Dictionary = {"B1": 420410, "B2a": 420430, "B2b": 420431, "B3": 420435, "B4a": 420420, "B4b": 420421}
+const GUEST: StringName = &"p04.s3.guest.a"
+const REQUEST: StringName = &"p04.s3.request.a"
+const QUEUED_GUEST: StringName = &"p04.s3.guest.b"
+const QUEUED_REQUEST: StringName = &"p04.s3.request.b"
+const SERVERS: Array[StringName] = [&"p04.order.server.a", &"p04.order.server.b"]
+var _evidence_dir: String = ""
+var _mode: String = ""
+var _case: String = ""
+var _serial: int = 0
+var _facility_id: StringName = &""
+var _service_id: StringName = &""
+var _boundary: int = 960
+var _price: int = 0
+var _duration: int = 0
+var _patience: int = 0
+var _reserve: int = 0
+var _recovery: Dictionary = {}
+var _commands: Array = []
+var _results: Array = []
+var _receipts: Array = []
+var _phases: Array = []
+var _points: Dictionary = {}
+var _branches: Dictionary = {}
+var _slots: Dictionary = {}
+
+func _run() -> void:
+	_evidence_dir = OS.get_environment("THE_TREE_S3_EVIDENCE")
+	_mode = OS.get_environment("THE_TREE_S3_MODE")
+	if _evidence_dir.is_empty() or _mode not in ["writer", "reader"]:
+		quit(2)
+		return
+	_expect(DirAccess.make_dir_recursive_absolute(_evidence_dir) == OK, "external evidence directory")
+	if _mode == "writer":
+		for branch: String in CASES:
+			_case = branch
+			_writer_case()
+	else:
+		_reader()
+	_write(_mode, {&"pid": OS.get_process_id(), &"profile": OS.get_user_data_dir(), &"slots": _slots,
+		&"branches": _branches, &"checks": _checks, &"failures": _failures,
+		&"whole_goal_accepted": false, &"unit_accepted": false}, true)
+	_cleanup()
+	print("S3 closure: %d checks, %d failures" % [_checks, _failures])
+	quit(1 if _failures else 0)
+
+func _fresh() -> void:
+	_serial = 0
+	_facility_id = &""
+	_service_id = &""
+	_boundary = 960
+	_price = 0
+	_duration = 0
+	_patience = 0
+	_reserve = 0
+	_recovery = {}
+	_commands = []
+	_results = []
+	_receipts = []
+	_phases = []
+	_points = {}
+	_reset_runtime(SEEDS[_case])
+	_runtime.configure_save_policy({&"enabled": false, &"daily_checkpoint_enabled": false})
+	_runtime.command_completed.connect(func(result: CommandResult) -> void:
+		_results.append({&"minute": _clock.absolute_minute, &"result": result.to_dictionary()})
+		_expect(result.is_success(), "actual public command completion " + str(result.command_id))
+	)
+
+func _cmd(kind: StringName, payload: Dictionary, at: int = -1) -> CommandResult:
+	_serial += 1
+	var key: StringName = StringName("p04.s3.%s.command.%d" % [_case, _serial])
+	var result: CommandResult = _runtime.submit_command(kind, payload, &"player", &"", 10, at, key)
+	_commands.append({&"serial": _serial, &"kind": kind, &"payload": payload.duplicate(true),
+		&"at": at, &"issued_at": _clock.absolute_minute, &"idempotency_key": key, &"result": result.to_dictionary()})
+	_expect(result.is_success(), "public command " + String(kind))
+	return result
+
+func _queue(guest_id: StringName, request_id: StringName, exit_at: int) -> void:
+	_cmd(&"spawn_guest", {&"guest_id": guest_id, &"guest_type_id": &"traveler", &"gold": _price * 2,
+		&"options": {&"state": GuestRuntime.State.DECIDING, &"current_cell": Vector3i.ZERO, &"planned_exit_at": exit_at}})
+	_cmd(&"create_service_request", {&"facility_id": _facility_id, &"request_id": request_id, &"guest_ids": [guest_id]})
+	var guest: GuestRuntime = _runtime.guest_service.get_guest(guest_id)
+	var request: ServiceRequest = _runtime.facility_service.get_request(request_id)
+	_expect(guest != null and request != null, "actual Guest and request exist")
+	if guest == null or request == null: return
+	_expect(guest.state == GuestRuntime.State.QUEUING and guest.queue_request_id == request_id, "actual queued ownership before advancing clock")
+	_expect(request.quoted_price == _price and request.service_minutes == _duration and request.reserved_inventory_ids.size() == 1, "definition price/duration and one meal reservation")
+	for id: StringName in request.reserved_inventory_ids:
+		var reservation: InventoryReservation = _runtime.inventory_service.get_reservation(id)
+		_expect(reservation != null and reservation.is_active() and reservation.requester_id == request_id, "public queue actually reserves meal")
+
+func _prepare() -> bool:
+	_fresh()
+	var facility: FacilityInstance = _build_cafeteria(true)
+	if facility == null: return false
+	_facility_id = facility.instance_id
+	var definition: FacilityDefinition = _runtime.definition_registry.get_facility(facility.definition_id)
+	var traveler: GuestDefinition = _runtime.guest_service.get_definition(&"traveler")
+	_price = definition.base_price
+	_duration = definition.base_service_minutes
+	_patience = traveler.base_patience
+	if _case == "B3":
+		_expect(_patience > 1 and _patience < 240, "original patience precedes reservation expiry")
+		if _patience <= 1 or _patience >= 240: return false
+		_boundary = _clock.absolute_minute + _patience
+		_expect(facility.operator_open and facility.is_within_opening_hours(_clock.absolute_minute) and facility.related_facility_operating and facility.active_staff_ids.size() < facility.staff_min, "real no-server queue with operating kitchen")
+	else:
+		for id: StringName in SERVERS:
+			_cmd(&"register_staff", {&"staff_id": id, &"role_id": &"server", &"options": {&"state": StaffRuntime.State.OFF_DUTY, &"current_cell": Vector3i.ZERO}})
+			_cmd(&"set_staff_work_assignment", {&"staff_id": id, &"template_id": &"DAY", &"facility_id": _facility_id})
+		var queue_at: int = 959 if _case == "B2b" else 960 - _duration - 1 + (1 if _case == "B4b" else 0)
+		_expect(queue_at > _clock.absolute_minute, "normal ticks reach queue time")
+		_clock.advance_minutes(queue_at - _clock.absolute_minute)
+		_expect(facility.active_staff_ids == SERVERS, "unchanged real server attendance")
+		for id: StringName in SERVERS:
+			var worker: StaffRuntime = _runtime.staff_service.get_staff(id)
+			_expect(_runtime.staff_service.requires_attendance(id) and StaffCommuteService.is_at_facility(worker, facility) and worker.current_cell != Vector3i.ZERO, "ordinary public server commute")
+	if _case in ["B4a", "B4b"]:
+		var action: EventAction = EventAction.new().configure(&"p04.destroy.action", EventAction.Type.SET_FACILITY_STATE, {&"facility_id": _facility_id, &"conditions": {&"durability": 0, &"suspension_reason": &"DESTROYED"}})
+		_cmd(&"register_event_definition", {&"definition": {&"event_id": &"p04.destroy.event", &"category": &"DEFENSE", &"foreground": false, &"transaction_policy": &"ROLLBACK_ALL", &"automatic_actions": [action.create_snapshot()]}})
+	_expect(_stock(facility.local_inventory_id, &"ingredient/basic_meal", 1, &"p04.order.shift.stock"), "original public stock helper")
+	var exit_at: int = _boundary if _case in ["B2a", "B2b", "B3"] else _boundary + _duration
+	_queue(GUEST, REQUEST, exit_at)
+	if _case == "B3":
+		_clock.advance_minutes(_patience - 1)
+		var guest: GuestRuntime = _runtime.guest_service.get_guest(GUEST)
+		_expect(guest.state == GuestRuntime.State.QUEUING and guest.patience_remaining == 1 and _runtime.facility_service.get_active_services(_facility_id).is_empty(), "normal ticks exhaust original patience, no manual mutation")
+	elif _case == "B2b":
+		_cmd(&"leave_facility_queue", {&"facility_id": _facility_id, &"request_id": REQUEST}, 960)
+	else:
+		_clock.advance_one_minute()
+		var active: Array = _runtime.facility_service.get_active_services(_facility_id)
+		_expect(active.size() == 1, "one public service starts")
+		if active.size() != 1: return false
+		var service: ServiceInstance = active[0]
+		_service_id = service.service_id
+		var offset: int = 1 if _case == "B4b" else 0
+		_expect(service.duration_minutes == _duration and service.price_snapshot == _price and service.started_at + _duration == 960 + offset, "original service completion alignment")
+		_clock.advance_minutes(959 - _clock.absolute_minute)
+		_expect(service.elapsed_minutes == _duration - 1 - offset, "measured boundary-before progress")
+	if _case == "B1":
+		_expect(_stock(facility.local_inventory_id, &"ingredient/basic_meal", 1, &"p04.s3.stock.b"), "second actual meal at 959")
+		_queue(QUEUED_GUEST, QUEUED_REQUEST, 960 + _duration)
+		_reserve = _state.get_resource(&"mana")
+		_expect(_reserve > 0, "original positive finite mana reserve")
+		_cmd(&"change_resources", {&"deltas": {&"mana": -_reserve}}, 960)
+		_cmd(&"set_facility_policy", {&"facility_id": _facility_id, &"patch": {&"business_open": false}}, 960)
+		var snapshot: Dictionary = _runtime.create_snapshot()
+		_recovery = {&"serial": _serial + 1, &"kind": &"change_resources", &"payload": {&"deltas": {&"mana": _reserve}},
+			&"idempotency_key": StringName("p04.s3.%s.command.%d" % [_case, _serial + 1]),
+			&"command_id": snapshot[&"systems"][&"runtime"][&"next_command_id"], &"at": -1, &"issue_minute": 961}
+	if _case in ["B4a", "B4b"]:
+		_cmd(&"enqueue_event", {&"event_id": &"p04.destroy.event", &"actor_ids": [], &"options": {&"event_instance_id": &"p04.destroy.instance"}})
+	_expect(_clock.absolute_minute == _boundary - 1, "exact boundary-before time")
+	return _clock.absolute_minute == _boundary - 1
+
+func _connect_observations() -> void:
+	_runtime.economy_service.transaction_posted.connect(func(id: StringName, entries: Array) -> void:
+		var rows: Array = []
+		for entry: LedgerEntry in entries: rows.append(entry.to_dictionary())
+		_receipts.append({&"id": id, &"minute": _clock.absolute_minute, &"entries": rows})
+	)
+	_clock.tick_phase_started.connect(func(phase: int, minute: int) -> void:
+		var label: String = "phase-%d-%s" % [minute, SimulationKernel.TickPhase.keys()[phase]]
+		var row: Dictionary = _capture()
+		row[&"phase"] = SimulationKernel.TickPhase.keys()[phase]
+		_assert_phase(row)
+		_phases.append(_write(label, row))
+	)
+
+func _assert_phase(point: Dictionary) -> void:
+	if point[&"minute"] != _boundary: return
+	var phase: String = point[&"phase"]
+	if _case in ["B4a", "B4b"]:
+		if phase == "INCIDENTS_AND_EVENTS":
+			_expect(point[&"facility"][&"durability"] > 0 and point[&"event"][&"state"] == "QUEUED", "facility phase precedes diagnostic destruction")
+			_expect(point[&"service"][&"state"] == ("COMPLETED" if _case == "B4a" else "ACTIVE"), "actual service state before Event phase")
+			_expect(point[&"receipts"].size() == (1 if _case == "B4a" else 0), "completion payment occurs before destruction, not while stopped")
+		if phase == "FACILITY_QUEUES":
+			_expect(point[&"facility"][&"durability"] == 0 and point[&"event"][&"state"] == "COMPLETED", "Event committed before queue phase")
+	if _case == "B3" and phase == "AI_DECISIONS":
+		var guest: Dictionary = point[&"guests"][String(GUEST)]
+		_expect(guest[&"state"] == "ABANDONING" and guest[&"patience_remaining"] == 0 and guest[&"queue_request_id"].is_empty(), "actual auto-abandon before AI redecision")
+	if _case == "B2b" and phase == "FACILITY_COMPLETION":
+		_expect(point[&"requests"][String(REQUEST)].is_empty() and point[&"active_services"] == 0 and point[&"available_meals"] == 1, "scheduled leave released before admission")
+	if _case == "B1" and phase == "AI_DECISIONS":
+		var queued: Dictionary = point[&"guests"][String(QUEUED_GUEST)]
+		_expect(not queued.is_empty() and queued[&"queue_request_id"].is_empty() and queued[&"patience_remaining"] == _patience, "direct closure releases B before AI with no patience penalty")
+
+func _capture() -> Dictionary:
+	var snapshot: Dictionary = _runtime.create_snapshot()
+	var operations: Dictionary = snapshot[&"systems"][&"runtime"][&"operations"]
+	var facility: FacilityInstance = _runtime.facility_service.get_instance(_facility_id)
+	var service: ServiceInstance = _runtime.facility_service.get_service(_service_id)
+	var event: EventInstance = _runtime.event_service.get_instance(&"p04.destroy.instance")
+	var actors: Dictionary = {}
+	var requests: Dictionary = {}
+	var wallets: Dictionary = {}
+	for id: StringName in [GUEST, QUEUED_GUEST]:
+		var guest: GuestRuntime = _runtime.guest_service.get_guest(id)
+		actors[String(id)] = guest.create_snapshot() if guest != null else {}
+		wallets[String(id)] = _runtime.economy_service.get_balance(StringName("GUEST_WALLET:" + String(id)))
+	for id: StringName in [REQUEST, QUEUED_REQUEST]:
+		var request: ServiceRequest = _runtime.facility_service.get_request(id)
+		requests[String(id)] = request.create_snapshot() if request != null else {}
+	var reservations: Array = []
+	for reservation: InventoryReservation in _runtime.inventory_service.get_reservations(false): reservations.append(reservation.create_snapshot())
+	var ledger: Array = []
+	for entry: LedgerEntry in _runtime.economy_service.get_entries(): ledger.append(entry.to_dictionary())
+	return {&"snapshot": snapshot, &"minute": _clock.absolute_minute,
+		&"inputs": {&"case": _case, &"seed": SEEDS[_case], &"serial": _serial, &"facility_id": _facility_id, &"service_id": _service_id,
+			&"boundary": _boundary, &"price": _price, &"duration": _duration, &"patience": _patience, &"reserve": _reserve, &"recovery": _recovery.duplicate(true),
+			&"kitchen_premise": "ActorHardening physical FLEX fixture; not natural hire/unlock"},
+		&"facility": facility.create_snapshot(), &"service": service.create_snapshot() if service != null else {},
+		&"event": event.create_snapshot() if event != null else {}, &"guests": actors, &"requests": requests, &"wallets": wallets,
+		&"reservations": reservations, &"ledger": ledger, &"receipts": _receipts.duplicate(true),
+		&"player_cash": _runtime.economy_service.get_balance(_runtime.PLAYER_CASH_ACCOUNT),
+		&"available_meals": _runtime.inventory_service.available_quantity(facility.local_inventory_id, &"ingredient/basic_meal"),
+		&"active_services": _runtime.facility_service.get_active_services(_facility_id).size(),
+		&"operations_enabled": operations[&"enabled"], &"saved_coordinator": operations[&"coordinator"],
+		&"actual_coordinator_absent": _runtime.operations_coordinator == null, &"unrelated_getters_called": false}
+
+func _labels() -> Array[String]:
+	if _case == "B1": return ["before", "after", "next", "recovered", "duplicate_guard"]
+	if _case in ["B2b", "B3"]: return ["before", "after", "next", "despawn"]
+	return ["before", "after", "next"]
+
+func _advance(label: String) -> void:
+	if label == "recovered":
+		_expect(_serial + 1 == _recovery[&"serial"] and _clock.absolute_minute == _recovery[&"issue_minute"], "saved future recovery serial and issue minute")
+		var result: CommandResult = _cmd(_recovery[&"kind"], _recovery[&"payload"], _recovery[&"at"])
+		var command: Dictionary = _commands.back()
+		_expect(result.command_id == _recovery[&"command_id"] and command[&"idempotency_key"] == _recovery[&"idempotency_key"], "same future public recovery command ID/key")
+	_clock.advance_one_minute()
+
+func _writer_case() -> void:
+	if not _prepare(): return
+	_connect_observations()
+	var before: Dictionary = _capture()
+	_assert_before(before)
+	_save_point("before", before)
+	for label: String in _labels():
+		if label == "before": continue
+		_advance(label)
+		var actual: Dictionary = _capture()
+		_assert_outcome(before, actual)
+		_save_point(label, actual)
+	var branch: Dictionary = {&"points": _points.duplicate(true), &"phases": _phases.duplicate(true),
+		&"commands": _write("commands", {&"submitted": _commands, &"completed_including_fixture": _results})}
+	_branches[_case] = _write("case", branch)
+
+func _assert_before(point: Dictionary) -> void:
+	_expect(not point[&"operations_enabled"] and point[&"actual_coordinator_absent"] and point[&"saved_coordinator"] == {}, "Operations disabled and actual absence measured")
+	var guest: Dictionary = point[&"guests"][String(GUEST)]
+	_expect(guest[&"planned_exit_at"] >= _boundary, "planned exit does not short-circuit queue/service")
+	var expected_count: int = 2 if _case == "B1" else 1
+	_expect(point[&"reservations"].size() == expected_count, "only actual requested meals reserved")
+	for reservation: Dictionary in point[&"reservations"]:
+		_expect(reservation[&"state"] == "ACTIVE" and reservation[&"purpose"] == "facility_service", "actual ACTIVE reservation before boundary")
+	_expect(point[&"available_meals"] == 0, "all stocked meals are reserved")
+	if _case == "B1":
+		var queued: Dictionary = point[&"guests"][String(QUEUED_GUEST)]
+		_expect(queued[&"state"] == "QUEUING" and queued[&"patience_remaining"] == _patience, "B exists at 959 with unchanged original patience")
+
+func _assert_reservation(before: Dictionary, point: Dictionary, request_id: StringName, state: String, terminal: int) -> void:
+	var prior: Array = []
+	var current: Array = []
+	for row: Dictionary in before[&"reservations"]:
+		if row[&"requester_id"] == String(request_id): prior.append(row)
+	for row: Dictionary in point[&"reservations"]:
+		if row[&"requester_id"] == String(request_id): current.append(row)
+	_expect(prior.size() == 1 and current.size() == 1, "one original reservation per request")
+	if prior.size() != 1 or current.size() != 1: return
+	_expect(prior[0][&"reservation_id"] == current[0][&"reservation_id"] and current[0][&"state"] == state and current[0][&"terminal_at"] == terminal, "same reservation ID/state/terminal time; no second release")
+	if state == "ACTIVE":
+		_expect(var_to_bytes(prior[0]) == var_to_bytes(current[0]), "entire held reservation unchanged")
+		var request: Dictionary = point[&"requests"][String(request_id)]
+		_expect(not request.is_empty() and request[&"reserved_inventory_ids"].has(current[0][&"reservation_id"]), "active reservation has live request owner")
+	else:
+		_expect(point[&"requests"][String(request_id)].is_empty(), "terminal reservation has no orphan request")
+	if state == "RELEASED":
+		var release_count: int = 0
+		var inventory: Dictionary = point[&"snapshot"][&"systems"][&"runtime"][&"inventory"]
+		for operation: Dictionary in inventory[&"idempotency_results"]:
+			var result: Dictionary = operation[&"result"]
+			if operation[&"action"] == "release" and String(result.get(&"reservation_id", "")) == current[0][&"reservation_id"]:
+				release_count += 1
+				_expect(bool(result.get(&"ok", false)) and result.get(&"quantity", 0) == current[0][&"quantity"], "release returned actual reserved quantity, not an orphan repair/retry")
+		_expect(release_count == 1, "one raw inventory release operation for original reservation")
+
+func _assert_outcome(before: Dictionary, point: Dictionary) -> void:
+	var minute: int = point[&"minute"]
+	var service: Dictionary = point[&"service"]
+	var guest: Dictionary = point[&"guests"][String(GUEST)]
+	var paid: bool = _case in ["B2a", "B4a"] or (_case == "B1" and minute >= 962)
+	_expect(point[&"wallets"][String(GUEST)] == _price * (1 if paid else 2), "actual wallet delta follows boundary")
+	_expect(point[&"receipts"].size() == (1 if paid else 0), "actual payment notification exactly once or zero")
+	_expect(point[&"player_cash"] == before[&"player_cash"] + (_price if paid else 0), "actual player cash delta exactly matches single price")
+	if not paid:
+		_expect(var_to_bytes(point[&"ledger"]) == var_to_bytes(before[&"ledger"]), "zero ledger charge while stopped or abandoned")
+	if paid:
+		var expected_ledger: Array = before[&"ledger"].duplicate(true)
+		for receipt: Dictionary in point[&"receipts"]: expected_ledger.append_array(receipt[&"entries"])
+		_expect(var_to_bytes(point[&"ledger"]) == var_to_bytes(expected_ledger), "whole ledger delta is exactly actual payment receipt, no extra posting")
+		var completed_at: int = 962 if _case == "B1" else 960
+		_expect(service[&"state"] == "COMPLETED" and service[&"completed_at"] == completed_at, "one actual completion")
+		_assert_reservation(before, point, REQUEST, "CONSUMED", completed_at)
+		_expect(point[&"active_services"] == 0, "completed service releases active slot")
+	if _case == "B1":
+		_expect(not point[&"facility"][&"operator_open"], "direct closure remains in force including recovery")
+		_assert_reservation(before, point, QUEUED_REQUEST, "RELEASED", 960)
+		var queued: Dictionary = point[&"guests"][String(QUEUED_GUEST)]
+		if minute == 960: _expect(not queued.is_empty(), "released B measured on closure tick")
+		if not queued.is_empty():
+			_expect(queued[&"queue_request_id"].is_empty() and queued[&"patience_remaining"] == before[&"guests"][String(QUEUED_GUEST)][&"patience_remaining"], "closure releases B without patience consumption; later natural Despawn is allowed")
+		_expect(point[&"wallets"][String(QUEUED_GUEST)] == _price * 2 and point[&"available_meals"] == 1, "B stock returned once and wallet unchanged")
+		if not paid:
+			_expect(not point[&"facility"][&"power_available"] and service[&"state"] == "PAUSED" and service[&"elapsed_minutes"] == before[&"service"][&"elapsed_minutes"], "outage holds original progress; actual interruption_reason retained in raw")
+			_assert_reservation(before, point, REQUEST, "ACTIVE", -1)
+	elif _case in ["B2b", "B3"]:
+		_assert_reservation(before, point, REQUEST, "RELEASED", _boundary)
+		_expect(point[&"active_services"] == 0 and point[&"available_meals"] == 1, "no service/orphan and exact stock return")
+		if minute == _boundary:
+			_expect(not guest.is_empty() and guest[&"state"] == "DECIDING" and guest[&"queue_request_id"].is_empty(), "automatic redecision after release")
+			if _case == "B3": _expect(guest[&"patience_remaining"] == 0, "normal queue tick exhausted original patience")
+		elif minute == _boundary + 1:
+			_expect(not guest.is_empty() and guest[&"state"] == "LEAVING", "normal next-minute exit")
+		else: _expect(guest.is_empty(), "normal Despawn boundary")
+	elif _case == "B2a":
+		_expect(point[&"available_meals"] == 0, "completed meal consumed")
+		if minute == 960: _expect(not guest.is_empty() and guest[&"state"] == "LEAVING" and guest[&"state_entered_at"] == 960, "completion precedes normal planned exit")
+		else: _expect(guest.is_empty(), "next-tick despawn without second payment")
+	else:
+		_expect(point[&"facility"][&"durability"] == 0 and point[&"facility"][&"state"] == "BROKEN" and point[&"event"][&"state"] == "COMPLETED", "actual automatic destruction Event committed")
+		if _case == "B4a": _expect(point[&"available_meals"] == 0, "completion before destruction consumes meal")
+		elif minute == 960:
+			_expect(service[&"state"] == "ACTIVE" and service[&"elapsed_minutes"] == _duration - 1, "late Event follows facility completion phase")
+			_assert_reservation(before, point, REQUEST, "ACTIVE", -1)
+		else:
+			_expect(service[&"state"] == "FAILED" and service[&"elapsed_minutes"] == _duration - 1 and point[&"available_meals"] == 1 and point[&"active_services"] == 0, "next facility tick fails without progress or payment")
+			_assert_reservation(before, point, REQUEST, "RELEASED", 961)
+	# Any remaining active reservation must still belong to the same live request
+	# and started service. Terminal history is retained, never filtered away.
+	for reservation: Dictionary in point[&"reservations"]:
+		if reservation[&"state"] != "ACTIVE": continue
+		var request: Dictionary = point[&"requests"].get(reservation[&"requester_id"], {})
+		_expect(not request.is_empty() and request[&"reserved_inventory_ids"].has(reservation[&"reservation_id"]) and not service.is_empty() and service[&"inventory_reservations"].has(reservation[&"reservation_id"]), "no active reservation orphan")
+
+func _save_point(label: String, point: Dictionary) -> void:
+	_points[label] = _write(label, point)
+	var path: String = "user://saves/p04_s3/" + _case + "-" + label
+	var saved: Dictionary = SaveService.save_snapshot(path, point[&"snapshot"])
+	var inspected: Dictionary = SaveService.inspect_snapshot(path)
+	_expect(bool(saved.get(&"ok", false)) and bool(inspected.get(&"ok", false)) and bool(inspected.get(&"read_only", false)), "public formal save/inspect")
+	_expect(var_to_bytes(inspected.get(&"snapshot", {})) == var_to_bytes(point[&"snapshot"]), "all typed fields preserved by formal package")
+	_expect(var_to_bytes(_runtime.create_snapshot()) == var_to_bytes(point[&"snapshot"]), "formal saving leaves Runtime unchanged")
+	_slots[_case + "-" + label] = ProjectSettings.globalize_path(path)
+	# Snapshot bytes exist once in point raw and once in the required formal
+	# package; indexes do not embed inspection/load copies of those bytes.
+
+func _write(label: String, value: Variant, global_name: bool = false) -> Dictionary:
+	var name: String = label if global_name else _mode + "-" + _case + "-" + label
+	var reference: Dictionary = {}
+	for extension: String in ["var", "json"]:
+		var path: String = _evidence_dir.path_join(name + "." + extension)
+		_expect(not FileAccess.file_exists(path), "raw point written exactly once " + name)
+		var file: FileAccess = FileAccess.open(path, FileAccess.WRITE)
+		_expect(file != null, "raw file " + name)
+		if file == null: continue
+		if extension == "var": file.store_buffer(var_to_bytes(value))
+		else: file.store_string(JSON.stringify(value, "\t"))
+		file.flush()
+		file.close()
+		reference[extension] = {&"path": path, &"sha256": FileAccess.get_sha256(path)}
+	return reference
+
+func _read(reference: Dictionary) -> Dictionary:
+	var item: Dictionary = reference["var"]
+	var path: String = item["path"]
+	_expect(FileAccess.get_sha256(path) == item["sha256"], "raw typed SHA")
+	var json_ref: Dictionary = reference["json"]
+	_expect(FileAccess.get_sha256(json_ref["path"]) == json_ref["sha256"], "raw JSON SHA")
+	var file: FileAccess = FileAccess.open(path, FileAccess.READ)
+	_expect(file != null, "typed input readable")
+	if file == null: return {}
+	var value: Variant = bytes_to_var(file.get_buffer(file.get_length()))
+	file.close()
+	_expect(value is Dictionary, "typed input dictionary")
+	return value if value is Dictionary else {}
+
+func _restore_inputs(point: Dictionary) -> void:
+	var inputs: Dictionary = point[&"inputs"]
+	_expect(_serial == 0, "Reader starts with serial zero before importing external inputs")
+	_serial = inputs[&"serial"]
+	_facility_id = inputs[&"facility_id"]
+	_service_id = inputs[&"service_id"]
+	_boundary = inputs[&"boundary"]
+	_price = inputs[&"price"]
+	_duration = inputs[&"duration"]
+	_patience = inputs[&"patience"]
+	_reserve = inputs[&"reserve"]
+	_recovery = inputs[&"recovery"].duplicate(true)
+
+func _load_point(path: String, expected: Dictionary) -> bool:
+	_fresh()
+	_restore_inputs(expected)
+	var loaded: Dictionary = SaveService.load_snapshot(path)
+	_expect(bool(loaded.get(&"ok", false)), "public formal load")
+	if not bool(loaded.get(&"ok", false)): return false
+	_expect(var_to_bytes(loaded[&"snapshot"]) == var_to_bytes(expected[&"snapshot"]), "all saved typed fields equal Writer")
+	var restored: bool = _runtime.restore_snapshot(loaded[&"snapshot"])
+	_expect(restored, "public Runtime restore")
+	_expect(var_to_bytes(_runtime.create_snapshot()) == var_to_bytes(expected[&"snapshot"]), "all restored typed fields equal Writer")
+	return restored
+
+func _reader() -> void:
+	var file: FileAccess = FileAccess.open(_evidence_dir.path_join("writer.json"), FileAccess.READ)
+	_expect(file != null, "Writer receipt")
+	if file == null: return
+	var writer: Dictionary = JSON.parse_string(file.get_as_text())
+	file.close()
+	_expect(int(writer["pid"]) != OS.get_process_id() and writer["profile"] != OS.get_user_data_dir(), "independent Reader PID/profile")
+	for branch: String in CASES:
+		_case = branch
+		var writer_case: Dictionary = _read(writer["branches"][branch])
+		var hashes: Dictionary = {}
+		var restored_refs: Dictionary = {}
+		for label: String in _labels():
+			var key: String = branch + "-" + label
+			var original: String = writer["slots"][key]
+			var target: String = ProjectSettings.globalize_path("user://saves/p04_s3/" + key)
+			_expect(DirAccess.make_dir_recursive_absolute(target) == OK, "private Reader formal slot")
+			var directory: DirAccess = DirAccess.open(original)
+			_expect(directory != null, "Writer formal slot readable")
+			if directory == null: return
+			var members: PackedStringArray = directory.get_files()
+			members.sort()
+			_expect(directory.get_directories().is_empty() and members == PackedStringArray(["journal.log", "manifest.json", "thumbnail.png", "world.bin"]), "all formal members enumerated")
+			var member_hashes: Dictionary = {}
+			for member: String in members:
+				var sha: String = FileAccess.get_sha256(original.path_join(member))
+				_expect(DirAccess.copy_absolute(original.path_join(member), target.path_join(member)) == OK, "copy every formal member")
+				var copied_sha: String = FileAccess.get_sha256(target.path_join(member))
+				_expect(not sha.is_empty() and sha == copied_sha, "original/copy member SHA equality")
+				member_hashes[member] = {&"original_before": sha, &"copy_before": copied_sha}
+			hashes[key] = {&"original": original, &"copy": target, &"members": member_hashes}
+			_slots[key] = target
+			var expected: Dictionary = _read(writer_case[&"points"][label])
+			if not _load_point(target, expected): return
+			restored_refs[label] = _write(label + "-restored", _capture())
+		var before: Dictionary = _read(writer_case[&"points"]["before"])
+		if not _load_point(_slots[branch + "-before"], before): return
+		_assert_before(_capture())
+		_connect_observations()
+		var replay_refs: Dictionary = {}
+		for label: String in _labels():
+			if label == "before": continue
+			_advance(label)
+			var actual: Dictionary = _capture()
+			var expected: Dictionary = _read(writer_case[&"points"][label])
+			_expect(var_to_bytes(actual) == var_to_bytes(expected), "replay complete typed point including Runtime, inputs, receipts " + label)
+			_assert_outcome(before, actual)
+			replay_refs[label] = _write(label + "-replay", actual)
+		var expected_phases: Array = writer_case[&"phases"]
+		_expect(_phases.size() == expected_phases.size(), "complete phase count")
+		if _phases.size() == expected_phases.size():
+			for index: int in range(_phases.size()):
+				_expect(var_to_bytes(_read(_phases[index])) == var_to_bytes(_read(expected_phases[index])), "same phase order and all typed phase state")
+		for key: String in hashes:
+			var row: Dictionary = hashes[key]
+			for member: String in row[&"members"]:
+				var item: Dictionary = row[&"members"][member]
+				item[&"original_after"] = FileAccess.get_sha256(String(row[&"original"]).path_join(member))
+				item[&"copy_after"] = FileAccess.get_sha256(String(row[&"copy"]).path_join(member))
+				_expect(item[&"original_before"] == item[&"original_after"] and item[&"copy_before"] == item[&"copy_after"], "original/copy unchanged after all loads and replay")
+		_branches[branch] = _write("case", {&"restored": restored_refs, &"replay": replay_refs, &"phases": _phases,
+			&"member_hashes": hashes, &"recovery_commands": _commands, &"replay_completed_commands": _results})
@@ -0,0 +1,293 @@
+#!/usr/bin/env python3
+"""S3-only native entry. --check-only never loads ownership helpers or starts Godot."""
+from pathlib import Path
+import argparse
+import hashlib
+import importlib.util
+import json
+import os
+import shutil
+import subprocess
+import sys
+sys.dont_write_bytecode = True
+
+HERE = Path(__file__).resolve().parent
+BUILD = Path("/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build")
+PRODUCT = Path("/Users/korizatou114/Projects/とりにく工房ゲーム制作部")
+CACHE_RUN = Path("/Users/korizatou114/Projects/TheTree-managed-worktrees/p18-01-model/.runtime/P18-01-CODE/build/p18-relationship-evidence")
+TEST = "tests/s3/test_runtime_staff_assignment.gd"
+QA = HERE / "p04_s3_closure_probe.gd"
+ENGINE = Path("/Applications/Godot.app/Contents/MacOS/Godot")
+MANIFEST = BUILD / "audit-support/p04-s3-existing-source-r01/SOURCE_MANIFEST.json"
+MANIFEST_SHA = "d4993398f7619ca37bcd64c32b79bdee892d44e31f332cc0dd5f31fb7bc28314"
+AUDIT = BUILD / "audit-support/p04-whole-closure-r01/ROOT_S2B_EXISTING_SOURCE_AUDIT.json"
+CASES = ["B1", "B2a", "B2b", "B3", "B4a", "B4b"]
+LABELS = {"B1": ["before", "after", "next", "recovered", "duplicate_guard"],
+          "B2a": ["before", "after", "next"], "B2b": ["before", "after", "next", "despawn"],
+          "B3": ["before", "after", "next", "despawn"],
+          "B4a": ["before", "after", "next"], "B4b": ["before", "after", "next"]}
+SLOTS = sorted(case + "-" + label for case in CASES for label in LABELS[case])
+MATERIALS = [MANIFEST, AUDIT, HERE.parent / "s2b/run_s2b_native.py",
+             HERE.parent / "s2b/p04_s2b_shift_probe.gd", HERE.parent / "s2b/S2B_ROOT_RUN.md"]
+
+def template_guard(root):
+    if pin(MANIFEST)["sha256"] != MANIFEST_SHA:
+        raise ValueError("supplied seven-source manifest changed")
+    manifest = json.loads(MANIFEST.read_text())
+    if len(manifest["files"]) != 7:
+        raise ValueError("exact seven source files required")
+    for row in manifest["files"]:
+        actual = pin(row["supplied"])
+        if (actual["bytes"], actual["sha256"]) != (row["bytes"], row["sha256"]):
+            raise ValueError("supplied template SHA mismatch: " + row["supplied"])
+    audit = json.loads(AUDIT.read_text())
+    for row in audit["source_pins"]:
+        actual = pin(root / row["path"])
+        if (actual["bytes"], actual["sha256"]) != (row["production_bytes"], row["production_sha256"]):
+            raise ValueError("Root source audit mismatch: " + row["path"])
+    probe = QA.read_text()
+    if ":=" in probe:
+        raise ValueError("probe requires explicit typed declarations")
+    import re
+    if re.search(r"\bvar\s+\w+\s*=", probe) or re.search(r"\bfor\s+\w+\s+in\b", probe):
+        raise ValueError("untyped declaration/loop")
+    if re.search(r"\.(?:patience_remaining|elapsed_minutes)\s*=(?!=)", probe):
+        raise ValueError("manual patience/progress mutation")
+    for forbidden in ["._update_shift_states(", ".record_duty_minute(", "get_day_summary(",
+                      "configure_operations("]:
+        if forbidden in probe:
+            raise ValueError("out-of-scope mutation/getter: " + forbidden)
+
+
+def module(name, path):
+    spec = importlib.util.spec_from_file_location(name, path)
+    value = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(value)
+    return value
+
+def pin(path):
+    path = Path(path)
+    if path.is_symlink() or not path.is_file():
+        raise ValueError("missing exact input: " + str(path))
+    data = path.read_bytes()
+    return dict(path=str(path), bytes=len(data), sha256=hashlib.sha256(data).hexdigest())
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--project-root", type=Path, default=PRODUCT)
+    parser.add_argument("--output", type=Path, default=BUILD / "p04-s3-native-r01")
+    parser.add_argument("--plan", type=Path, default=BUILD / "p04-s3-plan-r01.json")
+    parser.add_argument("--cache-run", type=Path, default=CACHE_RUN)
+    parser.add_argument("--godot", type=Path, default=ENGINE)
+    parser.add_argument("--check-only", action="store_true")
+    args = parser.parse_args()
+    root = args.project_root.resolve()
+    out = args.output.resolve()
+    if not out.is_relative_to(BUILD.resolve()) or not args.plan.resolve().is_relative_to(BUILD.resolve()):
+        raise ValueError("plan/output must stay in task build")
+    r = module("s3_standard_runner", root / "tools/run_all_tests.py")
+    # Preserve the reviewed source_refs -> exactly one QA override order.
+    source_before = r.source_refs(root)
+    refs = dict(source_before)
+    refs[TEST] = pin(QA)
+    template_guard(root)
+    expected = {n: dict(bytes=p["bytes"], sha256=p["sha256"]) for n, p in refs.items()}
+    fixed = [pin(p) for p in MATERIALS + [Path(row["supplied"]) for row in json.loads(MANIFEST.read_text())["files"]] + [
+        QA, Path(__file__), HERE / "S3_ROOT_RUN.md",
+        root / "tests/transport/test_runtime_transport.gd",
+        root / "tests/staff/test_rescue_elevator.gd",
+        root / "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json",
+    ]]
+    selected = dict(root_before=source_before, map={n: p["sha256"] for n, p in refs.items()}, timeout=1200)
+    cache_note = None
+    cache_receipts = []
+    for leaf in ["runner-ended.json", "runner-input.json"]:
+        path = args.cache_run / leaf
+        try:
+            cache_receipts.append(pin(path))
+        except OSError as caught:
+            cache_note = dict(path=str(path), error=type(caught).__name__ + ": " + str(caught),
+                              required_before_native=True)
+            break
+    plan = dict(protocol="p04-s3-preparation-v1", project_root=str(root), output=str(out),
+                source_before=source_before, selected_source_map=selected["map"],
+                QA_overrides=[TEST], fixed_input_pins=fixed, cache_run=str(args.cache_run),
+                cache_receipts=cache_receipts, cache_access=cache_note,
+                phases=["import", "parse", "writer", "reader"],
+                native_engine_launches=0, whole_goal_accepted=False, unit_accepted=False)
+    # Check-only only reads source/materials and writes the plan in task build.
+    # It deliberately does not read default-player data, inspect processes or stat Godot.
+    if args.check_only:
+        args.plan.parent.mkdir(parents=True, exist_ok=True)
+        if args.plan.exists():
+            r.require(r.read(args.plan) == plan, "existing plan differs; use a fresh plan path")
+        else:
+            r.write(args.plan, plan)
+        print(json.dumps(dict(check_only=True, engines=0, source_files=len(source_before),
+                              QA_overrides=[TEST], fixed_pins=len(fixed), plan=str(args.plan),
+                              plan_sha256=r.sha(args.plan), cache_access=cache_note), ensure_ascii=False))
+        return 0
+    r.require(root == PRODUCT.resolve() and len(source_before) == 1338, "Root native requires product 1338; worker plan is not native evidence")
+    r.require(args.plan.is_file() and r.read(args.plan) == plan, "run exact check-only plan first")
+    def fixed_guard():
+        template_guard(root)
+        for value in fixed + cache_receipts:
+            r.require(pin(value["path"]) == value, "fixed input changed: " + value["path"])
+    fixed_guard()
+    # Native admission is Root-only and fails closed on unreadable cache.
+    r.require(cache_note is None, "Root must read exact cache receipts: " + str(cache_note))
+    old = args.cache_run
+    r.require(r.read(old / "runner-ended.json")["passed"], "ended cache run must have passed")
+    old_map = r.read(old / "runner-input.json")["selected_source_map"]
+    current_map = {n: p["sha256"] for n, p in source_before.items()}
+    r.require(old_map == current_map, "ended cache selected source must equal current product")
+    protected = r.default_player(root)
+    outer = module("s3_owned_outer", r.SUPPORT / "owned_outer.py")
+    r.require(not outer.native.helper["live_engines"](), "another Godot owns CPU")
+    engine = args.godot.resolve()
+    r.require(engine.is_file(), "Root native Godot path")
+    r.require(shutil.disk_usage(out.parent).free >= 1024**3 + engine.stat().st_size + 136*1024**2,
+              "reviewed native disk admission")
+    r.require(not out.exists(), "fresh output required; preserve previous attempts")
+    out.mkdir()
+    stage = out / "stage"
+    stage.mkdir()
+    (out / "starters").mkdir()
+    (out / "bootstrap").mkdir()
+    phases = []
+    previous = {}
+    error = None
+    guards = []
+    cleanup = []
+    cleanup_errors = []
+    cache_before = None
+    formal_before = None
+    formal_after = None
+    original_phase = outer.run_phase
+    def run_phase(argv, folder, timeout, env, **kwargs):
+        env = dict(env)
+        if folder.name in ["writer", "reader"]:
+            env.update(THE_TREE_S3_EVIDENCE=str(out / "raw"), THE_TREE_S3_MODE=folder.name)
+        return original_phase(argv, folder, timeout, env, **kwargs)
+    outer.run_phase = run_phase
+    r.write(out / "runner-started.json", dict(started=r.now(), owner_runner_pid=os.getpid(),
+            plan=pin(args.plan), engines_launched=0))
+    try:
+        r.write(out / "source_before.json", source_before)
+        r.write(out / "selected-source-map.json", refs)
+        # Private source stage first, then literal reviewed bootstrap.
+        for name, value in refs.items():
+            target = stage / name
+            target.parent.mkdir(parents=True, exist_ok=True)
+            r.copy_source(Path(value["path"]), target)
+        r.require(r.inventory(stage, stage=True) == expected, "whole private source")
+        for name, value in r.read(r.SUPPORT / "bootstrap-scripts.json").items():
+            data = value["text"].encode()
+            r.require(hashlib.sha256(data).hexdigest() == value["sha256"], "bootstrap pin")
+            (out / "bootstrap" / name).write_bytes(data)
+        cache = old / "stage/.godot"
+        cache_before = r.inventory(cache)
+        r.require(bool(cache_before), "nonempty ended cache")
+        for name in cache_before:
+            src = cache / name
+            dst = stage / ".godot" / name
+            dst.parent.mkdir(parents=True, exist_ok=True)
+            subprocess.run(["/bin/cp", "-c", str(src), str(dst)], check=True)
+            r.require((src.stat().st_dev, src.stat().st_ino) != (dst.stat().st_dev, dst.stat().st_ino),
+                      "cache clone is a separate inode")
+        r.require(r.inventory(stage / ".godot") == cache_before, "whole cache clone hashes")
+        r.write(out / "cache-reuse.json", dict(ended_run=str(old), receipts=cache_receipts,
+                whole_cache=cache_before, independent_inode=True,
+                ordinary_import_required=True, ordinary_parse_required=True))
+        paths = ["res://" + n for n in sorted(refs) if n.endswith(".gd")]
+        r.write(out / "parse-paths.json", paths)
+        markers = module("s3_markers", root / "tools/strict_test_markers.py")
+        contracts = markers.load_contracts(root / "docs/plans/original-completion-2026-10-02/execution/completion_marker_contracts.json")
+        contracts[TEST] = dict(test=TEST, template="S3 closure: <checks> checks, <failures> failures", required=True)
+        policy = r.read(r.SUPPORT / "suite-policy.json")
+        r.require(TEST not in policy["suite_policies"], "no normal suite watchdog/policy override")
+        r.write(out / "contracts.json", contracts)
+        r.write(out / "runner-input.json", dict(plan, owner_runner_pid=os.getpid(),
+                wrapper_sha256=r.sha(__file__), QA=pin(QA), runner_sha256=r.sha(root / "tools/run_all_tests.py"),
+                default_player_before=protected, fixed_input_pins=fixed,
+                functional_watchdog_seconds=1200, source_adoption=False))
+        diagnostics = module("s3_diagnostics", r.SUPPORT / "diagnostic_gate.py")
+        owners = module("s3_owners", r.SUPPORT / "ordinary_proof_gate.py")
+        audio = module("s3_audio", r.SUPPORT / "audio_evidence_gate.py")
+        public = (stage / "project.godot").read_bytes()
+        for phase, test in [("import", None), ("parse", None), ("writer", TEST), ("reader", TEST)]:
+            if phase == "reader":
+                writer = r.read(out / "raw/writer.json")
+                formal_before = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
+                r.require(sorted(formal_before) == SLOTS, "all 22 formal points for six fresh cases")
+            row = r.execute_phase(str(engine), stage, out, phase, test, selected, expected,
+                                  previous, policy, contracts, paths, public, protected, root,
+                                  outer, markers, diagnostics, owners, audio)
+            phases.append(row)
+            # execute_phase uses the same test log name; retain each phase's exact log too.
+            if test and row.get("log"):
+                (out / (phase + "-combined-raw.log")).write_bytes((out / row["log"]).read_bytes())
+                row["strict_runner_log_path"] = row["log"]
+                row["log"] = phase + "-combined-raw.log"
+            r.write(out / (phase + "-actual-phase.json"), row)
+            print(json.dumps(dict(phase=phase, passed=row["passed"], error=row.get("validation_error"))), flush=True)
+            r.require(row["passed"], "first strict phase failure: " + phase)
+            if phase in ["writer", "reader"]:
+                receipt = r.read(out / ("raw/" + phase + ".json"))
+                r.require(receipt["checks"] > 0 and receipt["failures"] == 0,
+                          "S3 actual outcome receipt")
+                r.require(sorted(receipt["branches"]) == CASES,
+                          "exact six independent Writer/Reader cases")
+                r.require(sorted(receipt["slots"]) == SLOTS, "all formal point slots")
+                r.require(receipt["pid"] == row["actual_pid"], "actual native PID/receipt")
+        writer = r.read(out / "raw/writer.json")
+        reader = r.read(out / "raw/reader.json")
+        r.require(writer["pid"] != reader["pid"] and writer["profile"] != reader["profile"], "distinct formal processes")
+        formal_after = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
+        r.require(formal_before == formal_after, "Reader leaves Writer packages unchanged")
+    except BaseException as caught:
+        error = type(caught).__name__ + ": " + str(caught)
+    finally:
+        cleanup, cleanup_errors = outer.finish_captured(outer.OWNED)
+        try:
+            r.write(out / "outer-owned-finally.json", dict(cleanup=cleanup, errors=cleanup_errors))
+        except BaseException as caught:
+            guards.append("finally receipt: " + type(caught).__name__ + ": " + str(caught))
+    # Fixed guard always follows ownership cleanup, even if setup or an engine failed.
+    try:
+        fixed_guard()
+        after = r.source_refs(root)
+        r.write(out / "source_after.json", after)
+        r.require(after == source_before, "whole product source unchanged")
+        r.require(r.default_player(root) == protected, "default player unchanged")
+        if (stage / "project.godot").exists():
+            r.require(r.inventory(stage, stage=True) == dict(expected, **previous), "whole private source unchanged")
+        if cache_before is not None:
+            r.require(r.inventory(old / "stage/.godot") == cache_before, "original cache unchanged")
+        if formal_before is not None:
+            writer = r.read(out / "raw/writer.json")
+            formal_after = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
+            r.require(formal_before == formal_after, "Writer formal packages unchanged after Reader, including failure")
+    except BaseException as caught:
+        guards.append(type(caught).__name__ + ": " + str(caught))
+    pids = [p.pid for p in outer.OWNED]
+    passed = (error is None and not guards and not cleanup_errors and len(phases) == 4
+              and all(p["passed"] for p in phases) and len(pids) == len(set(pids)) == 4
+              and all(p["engine_ended"] for p in cleanup))
+    execution = dict(passed=passed, error=error, guard_errors=guards, phases=phases,
+                     actual_captured_PIDs=pids, cleanup=cleanup, cleanup_errors=cleanup_errors,
+                     formal_before=formal_before, formal_after=formal_after,
+                     whole_goal_accepted=False, unit_accepted=False)
+    r.write(out / "raw-inventory.json", r.inventory(out / "raw"))
+    r.write(out / "PID-set.json", dict(owner_runner_pid=os.getpid(), engine_PIDs=pids))
+    r.write(out / "execution.json", execution)
+    r.write(out / "runner-ended.json", dict(execution, ended=r.now()))
+    print(json.dumps(dict(passed=passed, error=error, guard_errors=guards, output=str(out))))
+    return 0 if passed else 1
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except Exception as caught:
+        print(type(caught).__name__ + ": " + str(caught), file=sys.stderr)
+        raise SystemExit(2)
@@ -0,0 +1,38 @@
+{
+  "status": "NOTRUN",
+  "task_id": "P04-01",
+  "starting_submission": "55f1fb49aaefa5c1b86de1c3eda72392ef6b58f2",
+  "source": "audit-support/p04-s4-source-r28",
+  "plan": "p04-s4-plan-r28.json",
+  "native": "p04-s4-native-r28",
+  "regression_status": "NOTRUN",
+  "native_status": "NOTRUN",
+  "unit_complete": false,
+  "D05": "pending",
+  "files": {
+    "s4/p04_s4_power_probe.gd": {
+      "bytes": 26912,
+      "sha256": "56f8e2786e3aff82097baa06afb4cd13e6e7c06c3d1afa43b9ee35c78a25a999"
+    },
+    "s4/run_s4_native.py": {
+      "bytes": 23233,
+      "sha256": "2d3be39d2b310abac058e27336ac816c234043a0a1dd7b2c52d84994907dd31b"
+    },
+    "s4/S4_ROOT_RUN.md": {
+      "bytes": 21862,
+      "sha256": "ff463e1e6ce8847f658eddc91f1cec3eab3bb8bcadd9a75272138e06083116a2"
+    },
+    "s4/phase_cut_regression.py": {
+      "bytes": 3919,
+      "sha256": "1362078fdd819d057f1f1bab369b9629a11e089a3453da8af4ce21cec251dbad"
+    },
+    "s4/receipt_lifecycle_fixtures.py": {
+      "bytes": 12340,
+      "sha256": "629571495787fdcda82a6a74d98649d4ea424d6fc9c27c5cafa55d4b2881c71f"
+    },
+    "p04_native_series.py": {
+      "bytes": 75900,
+      "sha256": "c1cc5d49dbf4c8422a2208297c665fde8abd569e2c9f8239603d8218ae1ed8fb"
+    }
+  }
+}
@@ -0,0 +1,305 @@
+# S4 finite Root collection r28 — NOT RUN
+
+This adds only the existing `power_stop` evidence obligation. It adds no counted
+condition, product change, acceptance or priority approval. Run once after this
+source batch is auto-submitted. Do not rerun C/S1/S2a/S2b/S3. Do not run the full
+product suite now. Preserve all existing raw and REPAIR17–21 history.
+
+From the clean auto-submitted checkout, stage these three exact reviewed files
+in the fresh own-B source directory. Run the installed executable directly; do not stage or copy it. This staging is a Root action, not a worker
+execution. The wrapper refuses QA outside own B. QA and fixed inputs stay within registered B; only the exact installed engine is external; external manifest paths are lookup keys and
+provenance only. Never open their original production locations.
+
+```sh
+export B=/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build
+export E=docs/plans/original-completion-2026-10-02/execution/p04-01
+export PYTHONDONTWRITEBYTECODE=1
+python3 "$E/s4/engine_identity_negative_fixtures.py"
+python3 "$E/s4/receipt_lifecycle_fixtures.py"
+mkdir "$B/audit-support/p04-s4-source-r28"
+cp "$E/s4/run_s4_native.py" "$E/s4/p04_s4_power_probe.gd" "$E/s4/S4_ROOT_RUN.md" "$B/audit-support/p04-s4-source-r28/"
+python3 "$B/audit-support/p04-s4-source-r28/run_s4_native.py" \
+  --project-root "$B/audit-support/p04-r17-full-inputs-r01/product" \
+  --output "$B/p04-s4-native-r28" --plan "$B/p04-s4-plan-r28.json" \
+  --godot /Applications/Godot.app/Contents/MacOS/Godot --check-only
+python3 "$B/audit-support/p04-s4-source-r28/run_s4_native.py" \
+  --project-root "$B/audit-support/p04-r17-full-inputs-r01/product" \
+  --output "$B/p04-s4-native-r28" --plan "$B/p04-s4-plan-r28.json" \
+  --godot /Applications/Godot.app/Contents/MacOS/Godot
+```
+
+Root must stop if either fixture or check-only fails; the commands are not an
+unconditional batch. Both fixtures start zero engines. The check-only invocation
+only prepares the pinned plan: zero engine launches. The final invocation
+is one collection, exactly four sequential owned processes: import,
+parse, Writer, Reader. Each retains the framework's native diagnostics,
+ownership, exit/end checks, full stream SHA, default-player protection, private
+profiles, source-before/after guards and cleanup. Failure stops the collection;
+do not overwrite or silently repeat it. The ordinary framework creates its
+normal private user profiles; these are process outputs, not external source
+inputs. Reader uses only the existing IO1 formal package mapping.
+
+Exact input footprints:
+
+- Historical wrapper hashes do not pin this repair. The fresh plan pins
+  its exact bytes and Stage R checks them against the current source checkout.
+- `B/audit-support/p04-r17-full-inputs-r01/MANIFEST.json`, SHA256
+  `a15f29fa12537f6d8aaf7cabea390922a9f16e3eb9c10981e5742aafc8c4c8a8`.
+- All 1338 files below that relocation's `product/`, each matched to the
+  manifest by bytes/SHA. No source is omitted and no old path is followed.
+- Its `fixed/6ce6b28c5985e8a4f13b78bfeb1f1e09f6216d874fb01e0656ec1633bfa01cd7/completion_marker_contracts.json`.
+- `B/audit-support/p04-review-repair22-r01/ACTUAL_CURRENT_PUBLIC_POWER_FUNCTIONS.json`.
+- The three staged S4 files above, pinned by the plan, and the installed executable
+  `/Applications/Godot.app/Contents/MacOS/Godot`, pinned directly against the
+  constant SHA before launch, during collection, and explicitly after cleanup.
+  Runner-input retains an immutable initial descriptor and observation prefix;
+  execution and engine-identity retain the final before/during/after identity. The only stage override
+  is `tests/s3/test_runtime_staff_assignment.gd` with the S4 probe. Harness and
+  kitchen fixture are the unchanged product files; inherited sources are
+  included in the full1338 map. The parse roster is all316 `.gd` inputs.
+- Fresh mode is the default: no cache receipt or cache directory is accessed,
+  read or cloned. The private `stage/.godot` must be absent immediately before
+  the actual full import. All316 scripts are parsed before Writer and Reader.
+- The engine SHA256 is
+  `c7cccbf8fb143e34e02fd6521e09be2c2b974f0d5db080b19071c9c570718ccf`,
+  required directly of the installed executable. Fresh mode does not obtain engine identity from a cache.
+- Optional `--cache-run` retains the registered path, passed-run, complete-source
+  and engine identity guards. The known red run remains ineligible. The commands
+  above use no cache. Preserve the old r22 staging and plan unchanged. r22 is an immutable failed
+  proof and remains ineligible. Its diagnostics are at
+  `audit-support/p04-root-d393-s4-r01/ENGINE_STAGING_DIAGNOSTICS.json`.
+
+Exact output footprints are `B/p04-s4-plan-r28.json` and the fresh
+`B/p04-s4-native-r28/**`: private selected source stage, complete phase receipts
+and logs, raw JSON/Variant points and all phase observations, full source maps,
+PID and cleanup receipts. `formal/{writer,reader}/S4-{boundary,held,recovered}/`
+mirrors all four formal members (`journal.log`, `manifest.json`, `thumbnail.png`,
+`world.bin`) with a provenance-only `formal-relocation.json`. R reads these
+own-B mirrors, never profile paths from old manifests.
+
+Scenario and source-derived timing:
+
+1. Use the existing public cafeteria + physical FLEX kitchen fixture and normal
+   DAY server commute. Queue using the definition's original price and duration;
+   advance naturally to duration−1 at959. Derive the cafeteria's sole neighbour
+   from the actual graph and call public `disconnect_nodes` on exactly that edge.
+2. Advance normally to960. The source's modulo10 evaluation finds an isolated
+   consumer with zero generation/storage. Normal `mana_power_projection.apply`
+   makes only the cafeteria unpowered; preparation reaches `NO_POWER` with its
+   dependency operating. Save **boundary** at960, then **held** at961. Mana stays
+   positive; operator stays open; linked kitchen is Facility `OPEN` and network
+   consumer `ACTIVE`. No closure, damage, shift or exit triggers accompany outage.
+3. At961 reconnect the same edge. Verify the complete original edge set and
+   graph invariants. Advance each minute, retaining full phase raw. The saved
+   hold deadline is960+10=970; the next permitted normal evaluation is970.
+   Progress, reservation and sale stay held through969. Save **recovered** at970
+   after one completion/payment. Resend connect_nodes on the same edge at970,
+   comparing the complete Runtime before/after;971 is the duplicate guard. Ordinary guest
+   redecision/despawn after completed service is retained in raw, never forced
+   or suppressed; the outage and held service have no exit confound.
+4. A distinct Reader copies all four members at each point. Normal SaveService
+   load and Runtime restore must reproduce the full typed snapshot, including
+   graph and all unrelated fields. No canonicalization, dropped fields, forced
+   evaluation or hold bypass. Replay from the960 formal boundary through961,
+   reconnect,970 and971; compare complete typed points and phase states. No
+   additional condition is credited for this formal preservation check.
+
+`REPAIR22_SOURCE_FACTS.json` contains full actual source bodies and graph restore
+invariants. The source normalizes saved node IDs/reasons, checks valid endpoints,
+rebuilds symmetric edges, preserves revision/evaluation time and checks storage
+capacity and consumer allocation. Transient `_last_report` is cleared on normal
+restore and is not part of Runtime snapshot equality. The derived
+`related_facility_operating` flag is measured separately and checked after restore.
+
+This source-only dispatch authorizes no worker execution. Root stages the three
+files, creates the r28 plan with --check-only, then collects once to the fresh
+r28 output. Do not read or write r24 outputs, cleanup, stages or plans.
+Do not rerun S1-S3, C or full178. No engine copy, signing, xattr,
+codesign call or security-setting change is part of this procedure.
+Native evidence, registered validation, independent review, support53cb rebind
+and formal acceptance remain pending. D05 remains pending.
+
+## REPAIR26 receipt lifecycle audit (static; NOT RUN)
+
+All names below are relative to the fresh output unless marked otherwise.
+`r.write` is the unchanged exclusive `open('x')` writer in
+`tools/run_all_tests.py`. No retry, overwrite, replace or atomic rename is used
+for a JSON proof. A write attempt may fail or leave a partial file; it is never
+retried. “At most once” describes wrapper control flow, not a durability claim.
+The initial input is serialized once with `engine=engine_descriptor`,
+`engine_identity_before=engine_descriptor` and a deep-copied initial identity.
+`repin()` itself is unchanged (it returns None); each per-phase receipt uses
+the descriptor it just appended and the index of that exact observation.
+
+| Writer / destination | Maximum attempts per run / uniqueness | Success and failure reachability |
+| --- | --- | --- |
+| `r.write(args.plan)` outside output | 1, check-only branch returns immediately | Native branch only reads the exact plan; existing plan rejected in check-only |
+| `runner-started.json` | 1 | First write inside protected setup; exception enters cleanup |
+| `source_before.json` | 1 | Setup before source copy; no fallback write |
+| `selected-source-map.json` | 1 | Setup before source copy; no fallback write |
+| `r.copy_source` to `stage/<source name>` | 1 per unique source-map key | Fresh stage; loop stops on setup failure; source files are not proof receipts |
+| `write_bytes` to `bootstrap/<name>` | 1 per pinned bootstrap key | The reviewed map names `profile_guard.gd` and `parse_full_dependencies.gd`; setup only |
+| `/bin/cp -c` to `stage/.godot/<name>` | 1 per cache inventory key | Optional eligible-cache branch only; fresh mode never accesses cache |
+| `cache-reuse.json` | 0 or 1 | Only after all optional cache clones and guards |
+| `parse-paths.json` | 1 | Setup after 316-script guard |
+| `contracts.json` | 1 | Setup after unchanged suite-policy guard |
+| `runner-input.json` | 1 | Setup; no final read/rewrite; absent if earlier setup fails |
+| `engine-identity-before-<phase>.json` | 1 each for import, parse, writer, reader | Immediately after that phase's repin; failure stops loop, never resumes it |
+| `write_bytes` to `writer-combined-raw.log`, `reader-combined-raw.log` | 1 each | Binary copy immediately after returned phase row, even a failed row if it has a log; later phases never reuse names |
+| `<phase>-actual-phase.json` | 1 each for four unique phases | Before `require(row['passed'])`; mid-loop failure retains its row and stops later phases |
+| `outer-owned-finally.json` | 1 | Single finally after setup/loop success or failure; cleanup called once; cleanup exception recorded; receipt write exception becomes guard error |
+| `source_after.json` | 0 or 1 | Single post-cleanup guarded block, after fixed_guard/source_refs succeed; later guard failure does not re-enter or retry the write |
+| `shutil.copyfile` to `formal/<role>/<slot>/<member>` | 1 per tuple | Only preliminary pass; two unique roles, unique slot map keys, four unique member keys, fresh target directory; exception stops collection |
+| `formal-relocation.json` | 0 or 1 | Only after successful complete formal mirror |
+| `raw-inventory.json` | 0 or 1 | Once after mirror branch, including setup/phase/cleanup failure; earlier output-collection exception can skip it |
+| `PID-set.json` | 0 or 1 | Once after raw inventory; earlier output-collection exception can skip it |
+| `engine-identity.json` | 1 | One final attempt after cleanup and both after-cleanup/after-output-collection repin attempts, including caught setup/phase/cleanup/collection failures; own write failure records guard error and makes both passed fields false |
+| `execution.json` | 1 | After identity attempt, with final observations, identity and guard errors |
+| `runner-ended.json` | 1 | After execution; no retry if final receipt storage itself fails |
+
+The wrapper has no `write_text` call. The unchanged `execute_phase` dependency
+also writes the following. Its shared text log is an explicit exception to
+write-once naming, and is not presented as two independent phase proofs.
+
+| Dependency destination | Writer and lifecycle |
+| --- | --- |
+| `<phase>-startup-profile-before.json` | Exclusive `write`, once per distinct phase before engine start |
+| `<phase>-profile.json` | Guard report path for parse/writer/reader, one per phase; actual Guard checks file absence before writing |
+| `starters/<phase>.gd` | `write_text`, once each for writer/reader |
+| `<phase>/combined-raw.log` | `write_text`, once each for import/parse |
+| `tests__s3__test_runtime_staff_assignment.gd.log` (general `out/<test>.log`) | Both writer and reader call `write_text` on this same per-test name; reader replaces the shared text. Wrapper preserves separate binary copies as `writer-combined-raw.log` and `reader-combined-raw.log`, retaining `strict_runner_log_path` and the original log hash |
+| `<phase>-receipt.json` | Exclusive `write`, once per phase after its finally and guards |
+| `stage/project.godot` | `write_bytes` for private startup settings and restoration in each phase finally; mutable private source, not immutable proof |
+| `<phase>/**`, private profiles, raw QA outputs | Delegated owned-native capture/engine/QA outputs; not wrapper `r.write`/`write_bytes`/`write_text` calls; their existing ownership/diagnostic/formal guards remain unchanged |
+
+Path coverage: success traverses each distinct phase once. A failed parse row is
+recorded, then `require(row['passed'])` jumps to the single finally; no writer or
+reader names are used. A protected setup failure also enters that finally, then
+attempts post-cleanup guards and final identity/execution/end receipts. Cleanup
+exceptions are caught separately, set `cleanup_errors`, and do not prevent final
+receipts. A post-cleanup fixed/source guard failure is caught without retrying
+`source_after`; formal/output-collection exceptions now become guard errors and
+still reach the final repin and identity receipt. A final identity write failure
+is caught without touching existing bytes and forces failure in execution/end.
+
+Admission failures before the protected setup (invalid plan/product/engine,
+live engine, insufficient disk, existing output, directory creation failure)
+remain fail-closed and do not promise final receipts. They have no repeated
+wrapper proof write. Persistent storage failure writing execution/end can still
+prevent a complete terminal receipt pair; no code can guarantee receipt storage
+when that storage fails. Such runs cannot provide accepted evidence.
+
+## Fixture scope and remaining gaps
+
+`receipt_lifecycle_fixtures.py` imports the real wrapper and standard writer.
+It builds 1338 synthetic source entries including 316 scripts in resolved fresh
+temporary paths; engine identity, template_guard, disk/default-player, helpers
+and phase execution are mocked. Four distinct fake PIDs and complete synthetic
+formal slot members exercise wrapper guards and copying without starting an
+engine. The actual identity section of `S4Series.__init__` is compiled from its
+AST, and actual `verify_s4_engine` checks a non-executable temporary data file
+under fixture-only patched constants. Other verifier sections are not claimed
+as covered by this synthetic fixture.
+
+Cases cover success after check-only, parse failure, cleanup exception, setup
+copy failure, post-cleanup collection failure and final identity write failure.
+Every exclusive write attempt is counted. Input bytes are compared with their
+creation bytes before negative mutation. Fresh-output refusal, each missing or
+tampered phase receipt and mismatched initial-before are negative checks. The
+fixture's deliberate proof mutations are confined to its disposable temporary
+files. No registered plan/output/stage is read or changed.
+
+Reasoning only about the 7af6 wrapper: import writes `engine-identity.json` via
+exclusive create. Before parse, the same name raises FileExistsError, so the
+four-phase success assertion cannot pass. After cleanup the old final write
+tries that same name again and escapes main, preventing final execution/end.
+Even if that collision alone were removed, the old runner-input final rewrite
+would hit the exclusive writer, and the required initial/per-phase receipts
+are absent. No 7af6 execution was performed to establish this reasoning.
+
+Worker performed source inspection and file edits only: no fixtures, check-only,
+tests, Git, engines, Runner, agents or commits. Root still must run both fixtures
+and check-only before any native r27 collection, then exact-version verification
+and independent review. The registered validation gate remains unchanged at
+7af6, exit 2, fresh MANIFEST missing; this is the supplied gate record, not a new
+worker run. Native/product proof, full formal checks, D05 and original P04-01
+acceptance remain pending. This repair is submitted preparation, not completion.
+
+
+## REPAIR27 snapshot staff expectation (source-only; NOT RUN)
+
+Root supplied the r26 result: 15 failures of 934 S4 checks, all at
+no shift confound; engine-identity/lifecycle fixtures and cleanup passed.
+This is supplied history, not a worker execution. Preserve r26 raw output,
+formal records, logs, source stage and plan unchanged.
+
+The r27 probe SHA256 is `b5e5c81a0762427880416759e30e0a0144ce26749f1db1f26837c3287eeecf35`.
+FacilityInstance.create_snapshot serializes active_staff_ids through
+_names_to_strings as Array[String]. The snapshot expectation is now explicit
+SNAPSHOT_SERVERS: Array[String], containing exactly server a then server b.
+Runtime registration and attendance still use unchanged SERVERS:
+Array[StringName]. No values are normalized, fields dropped or invariants
+relaxed. Inspection of all S4 StringName constant uses found no other snapshot
+comparison with this mismatch; reservation IDs already compare with
+String(request_id). S3 lines 111–118 compare live runtime values and remain
+unchanged.
+
+The wrapper dynamically pins QA bytes through pin(QA) into the plan and
+selected source map. S4Series dynamically hashes the current probe and checks
+the exact receipt/map binding; only its RUNS['s4'] binding advances to r27.
+The documented hash does not replace dynamic verification.
+Engine identity and receipt lifecycle logic, the a61 checker, frozen C and all
+1338 product inputs remain unchanged. The lifecycle mock's disposable output
+and plan names advance to r27; its behavior is unchanged.
+
+Worker performed source inspection, edits and SHA256 calculation only. No
+fixtures, tests, check-only, Git, engine, Runner, agents or commits were run.
+Root re-runs only the fresh S4 collection and any needed fixture validation,
+using the r27 commands above. Exact-version evidence, registered validation,
+independent review, D05 and original acceptance remain pending; this is
+submitted preparation, not completion.
+
+## REPAIR28 phase cut (source-only; NOTRUN)
+
+Root's supplied r27 own-B diagnosis is preserved as history: import, parse and
+Writer passed (934 checks, zero failures); Reader ran 1445 checks with exactly
+one failure, complete phase count. ACTUAL_TYPED_PHASE_DIAGNOSIS.json reports
+all 121 actual Reader phase .var files byte-identical to matching Writer files.
+This worker did not open or rerun those raw materials. Keep all r27 failed raw,
+formals, logs, source stages, plans and diagnosis unchanged.
+
+The kernel applies commands at the old minute, advances absolute_minute, then
+emits TIME_BOUNDARIES and the remaining phases. The new helper includes minute
+960 APPLY_COMMANDS using the enum key expression used by the Writer. It also
+includes all later rows. Before byte comparison the probe asserts the exact
+121-entry kernel roster, uniqueness, and Writer order. Both existing complete
+phase count and complete typed var_to_bytes equality checks remain unchanged.
+Writer row data, typed staff fix, runtime SERVERS, Clock and raw format stay
+unchanged.
+
+The current RUNS s4 binding, wrapper defaults and disposable lifecycle fixture
+path names use r28. Only these path strings change in the wrapper and lifecycle
+fixture; their engine/lifecycle behavior is unchanged. Stage the three current
+files using the commands at the top to create fresh source-r28, plan-r28 and
+native-r28 paths. Do not reuse r27 as passing evidence.
+
+Regression control status: NOTRUN. Root supplies full paths to ALL 132 actual
+r27 Writer phase .var files and ALL 121 actual Reader phase .var files:
+python3 "$E/s4/phase_cut_regression.py" --writer <full Writer phase paths...> --reader <full Reader phase paths...>
+Use actual own-B raw paths supplied by Root, not fabricated fixtures or old
+external provenance paths. Paths may be in any argument order; the control
+reconstructs kernel order from typed minute/phase, checks the complete Writer
+and Reader rosters, then compares unchanged full bytes. It requires old cut
+120/rejected, new cut 121/equal, deleted boundary APPLY_COMMANDS/rejected and
+duplicate/rejected. Mutations are in-memory lists only. Its result is a raw
+regression control, never an engine/native/acceptance PASS. Missing raw paths
+remain a Root execution input, not a worker-generated substitute.
+
+Worker made source edits and calculated bindings only; no tests, fixtures,
+Git, engine, Runner, agents or commits. The normal validation on submitted
+55f1fb49aaefa5c1b86de1c3eda72392ef6b58f2 ran once and exited 2 because the current
+MANIFEST is missing (Root-supplied history). The gate, checker a61, 1338 inputs,
+C/S1-3/full178 artifacts, five carried formal review findings, and frozen
+original 13/88 main 9b remain unchanged. D05, independent review, exact-version
+native proof and original unit acceptance remain pending. This repair does
+not complete the unit.
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Agent Control Runner	8e25213e91	P04-01: 同時発生の更新規約	2026-10-18 12:00:07 +09:00
Agent Control Runner	27b18b75c9	P04-01: 同時発生の更新規約	2026-10-18 11:25:54 +09:00
Agent Control Runner	1b08d6b0fc	P04-01: 同時発生の更新規約	2026-10-18 11:16:06 +09:00
Agent Control Runner	20d0ae5990	P04-01: 同時発生の更新規約	2026-10-18 10:58:54 +09:00
Agent Control Runner	2dde7596a8	P04-01: 同時発生の更新規約	2026-10-16 10:02:30 +09:00
Agent Control Runner	fb8b7919db	P04-01: 同時発生の更新規約	2026-10-16 09:33:00 +09:00
Agent Control Runner	55f1fb49aa	P04-01: 同時発生の更新規約	2026-10-16 09:25:26 +09:00
Agent Control Runner	4ab7ab8712	P04-01: 同時発生の更新規約	2026-10-16 09:19:25 +09:00
Agent Control Runner	7af6fafaf0	P04-01: 同時発生の更新規約	2026-10-16 09:07:58 +09:00
Agent Control Runner	d393e4d90f	P04-01: 同時発生の更新規約	2026-10-16 08:51:30 +09:00
Agent Control Runner	8418560aaf	P04-01: 同時発生の更新規約	2026-10-16 08:35:40 +09:00
Agent Control Runner	16207d353a	P04-01: 同時発生の更新規約	2026-10-16 06:46:41 +09:00
Agent Control Runner	b543c26c95	P04-01: 同時発生の更新規約	2026-10-16 06:12:33 +09:00
Agent Control Runner	accd07c91d	P04-01: 同時発生の更新規約	2026-10-16 04:48:31 +09:00
Agent Control Runner	29a641c540	P04-01: 同時発生の更新規約	2026-10-16 04:21:59 +09:00
Agent Control Runner	cc3a377841	P04-01: 同時発生の更新規約	2026-10-16 04:14:48 +09:00
Agent Control Runner	877dee40bc	P04-01: 同時発生の更新規約	2026-10-16 03:55:04 +09:00
Agent Control Runner	c0bc92a469	P04-01: 同時発生の更新規約	2026-10-16 03:46:10 +09:00
Agent Control Runner	3bba4f34f0	P04-01: 同時発生の更新規約	2026-10-16 03:35:55 +09:00
Agent Control Runner	dd20d5b96c	P04-01: 同時発生の更新規約	2026-10-16 03:20:25 +09:00
Agent Control Runner	64617018ed	P04-01: 同時発生の更新規約	2026-10-16 03:11:58 +09:00
Agent Control Runner	5475391647	P04-01: 同時発生の更新規約	2026-10-16 01:54:03 +09:00
Agent Control Runner	9767b0a28c	P04-01: 同時発生の更新規約	2026-10-15 23:15:15 +09:00
Agent Control Runner	a19737b160	P04-01: 同時発生の更新規約	2026-10-13 02:56:23 +09:00
Takeshi	deb1bcb237	docs: freeze P04 order audit inputs and original acceptance scope	2026-10-13 02:35:44 +09:00
Takeshi	339a118895	docs: retain updated planning validation pins	2026-10-13 02:30:08 +09:00
Takeshi	25467ac502	docs: record P24 exact-candidate validation and review proposal	2026-10-13 02:29:39 +09:00
Takeshi	243a3593bb	docs: preserve P24 native failure and diagnostic evidence	2026-10-13 01:11:19 +09:00
Takeshi	286730f88c	docs: record P24 start and correct implementation role after read-only loop	2026-10-13 00:46:32 +09:00
Takeshi	9b2ee480a8	docs: freeze original P24-03 selection acceptance contract	2026-10-13 00:34:53 +09:00
Takeshi	4fb8312a33	docs: preserve unapproved mana proposal and independent review findings	2026-10-13 00:29:38 +09:00
				`@@ -0,0 +1 @@`
				{"C_provenance_sha256": "51d746879b4197445a09cd44a88dd918c365fa98025d9cd652a740cee09a9040", "C_source_manifest_sha256": "dbaab3c293c191eb5f3aff34854945e2d564f824df50a92802b3a7eda55321a8", "error": "candidate binding stage A pending; uncollected original boundaries: power_stop, save_restore, shift_completion", "formal_acceptance": false, "machine_verified": false, "missing_conditions": ["power_stop", "save_restore", "shift_completion"], "nativeWindows": {"EV": "pending", "closure_release": "pending", "dependency_stop": "pending", "destruction_stop": "pending", "exit_release": "pending", "midnight_replay": "pending", "midnight_settlement": "pending", "night_staff_absent": "pending", "overtime_task": "pending", "patience_release": "pending", "paused_midnight": "pending", "power_stop": "pending", "recovery_completion": "pending", "same_minute_replay": "pending", "save_restore": "pending", "shift_completion": "pending"}, "relocation_manifest_sha256": "a15f29fa12537f6d8aaf7cabea390922a9f16e3eb9c10981e5742aafc8c4c8a8", "series_bindings": {"s1": "9792569af9c8ecef177ffdeb880b814fb2878231f23e77c3749e18c228ff0ceb", "s2a": "746b58cf1aff95b082c35f6cc2c29556f146a7c56cce0475f4f2c091168605a7", "s2b": "e6d5412c14809825cf368af1d93972bc9c4e41f4c09afa414732b007c9cc7589", "s3": "a9b4b80d54c18ae2a1dc82514052e22d6174ff79999c76fa622282709759b433"}, "series_manifest_sha256": "953a798831043abdf7d54909e8e041cb3fbe6d901ca8affa661ea28e62ca5975", "stage_A": "candidate binding stage A pending", "task_id": "P04-01", "verified_conditions": ["EV", "closure_release", "dependency_stop", "destruction_stop", "exit_release", "midnight_replay", "midnight_settlement", "night_staff_absent", "overtime_task", "patience_release", "paused_midnight", "recovery_completion", "same_minute_replay"]}