# REPAIR18 — executable Stage R, blocked on remaining conditions This is **not accepted or completed**. Executable R artifacts and a reference-only collection were produced and the file-only checks were run. The whole gate fails. Original completion credit remains **13/88**, with no additional credit. The repair counter and `max_repair_attempts: null` were not changed. ## Scope and preservation - Checkout: `accd07c91d4e34d9b7c7fc20e389df2424b167e1`; registered base: `deb1bcb2374eb378b840ca345db952bd8572cb6e`. - Changed `tools/check_p04_order_evidence.py` only to add R composition and its separate read-only CLI, call composition from the whole missing-check, and retain an unconditional Stage A failure. - Created `p04_native_series.py`, `collect_p04_native.py`, `checker_series_fixtures.py`, this status, and the four output files listed below. - All existing checker functions except `verify` and `main` were compared with HEAD and are byte-unchanged, including `verify_native` and all C helpers. All three existing fixture files are byte-unchanged. Their failures were not hidden by editing assertions or Stage A code. - `REPAIR17_STATUS.md` was never written. Its SHA256 is `6497c335739f266c9026aa6499cf5c49ae80d590d6aa2d0f90d32adc08018061`. - No git writes, new worktree/branch, agents, Runner operations, engine runs, full regression, permission requests, production edits, input edits, or final `B/p04-evidence/index.json` writes occurred. This did not revalidate accd. ## Inputs and actual collection Here `B=/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build`, `R=B/audit-support/p04-r17-full-inputs-r01`, and `E=docs/plans/original-completion-2026-10-02/execution/p04-01`. The first input identity check verified `R/MANIFEST.json`: **1,244,135 bytes**, SHA256 `a15f29fa12537f6d8aaf7cabea390922a9f16e3eb9c10981e5742aafc8c4c8a8`. All **1,721** relocated members were used and rehashed across the series, covering 71,488,772 logical bytes. All four complete native `source_before` sets equal the supplied 1,338-file product set at content anchor `5f6bc11d6bb6e92d22d787989b219fef3a435bc1`. The one native QA override is checked separately against its supplied probe bytes; it is not represented as product content. Full-function-body pins include trailing comments and declarations. External original paths remain provenance strings. The resolver uses exact `original_to_relocated` keys, and checks each used file against both native descriptors and relocation descriptors. There is no prefix substitution or external-path fallback. Formal slot membership, directory membership, separate Writer/Reader paths and inodes, symlinks, traversal and duplicates are checked. All **344** formal members in **86** original/Reader slots were rehashed. The collector created only `B/audit-support/p04-raw-collect-r17/`. It did not exist before creation. It contains four series reference manifests and one collection manifest; no large evidence snapshots were copied. Actual collector output (exit 0): ```json {"estimated_payload_bytes":2970454,"files":5,"available_disk_bytes":4596576256,"large_payloads_copied":0} {"actual_payload_bytes":2970454,"manifest_sha256":"953a798831043abdf7d54909e8e041cb3fbe6d901ca8affa661ea28e62ca5975","formal_acceptance":false} ``` The estimate was printed before directory creation or output writes. The collection is deterministic and refuses an existing destination on rerun. Per-series manifests bind native raw references, relocation references, and verifier bytes by SHA. Composition reruns C and all series verifiers and compares the recomputed results and references with those manifests; editing a `verified_conditions` list cannot add credit. ## Conditions derived from literal raw | Verifier | Native raw | Relocated formal members | Conditions proved | | --- | --- | --- | --- | | S1 | `B/p04-s1-native-r02/raw/` | `R/formal/p04-s1-native-r02/{writer,reader}/` | `EV` | | S2a | `B/p04-s2a-native-r03/raw/` | `R/formal/p04-s2a-native-r03/{writer,reader}/C3/` | `midnight_settlement`, `midnight_replay` | | S2b | `B/p04-s2b-native-r02/raw/` | `R/formal/p04-s2b-native-r02/{writer,reader}/` | `night_staff_absent`, `overtime_task` | | S3 | `B/p04-s3-native-r01/raw/` | `R/formal/p04-s3-native-r01/{writer,reader}/` | `closure_release`, `exit_release`, `patience_release`, `destruction_stop` (B4b) | | Paid/resend supplement, collected with S2a | `B/audit-support/p04-current-native-series-r01/p04-idempotency-paid-midnight-native-r01/order-evidence/` | Manifest pin resolved through `R/MANIFEST.json`, full raw already inside B | `same_minute_replay` (request resend) | | Unchanged C | `B/audit-support/native-first-current/` | Existing C bundle, unchanged | `dependency_stop`, `recovery_completion`, `paused_midnight` | All product reads resolve to `R/product/` through manifest keys. Fixed-input relocations and every original formal provenance string are retained in the four generated series manifests; they are not replaced with guessed paths. Owned import/parse/Writer/Reader PIDs checked against starts, ends, owners, commands, raw stream hashes, exit gates and cleanup/guard records: | Series | PIDs | Formal slots per role | Exact raw phase pairs | | --- | --- | ---: | ---: | | S1 | 64745, 64788, 64818, 64850 | 14 | 0 (14 exact typed snapshot restore points instead) | | S2a | 85229, 85263, 85303, 85425 | 1 | 0 (typed settlement/replay and formal Runtime restore comparisons) | | S2b | 98696, 98744, 98770, 98810 | 6 | 12 | | S3 | 10448, 10493, 10523, 10578 | 22 | 352 JSON/typed phase files | - S1 checks task/trip/resource identity, safe landing, no-safe-landing hold, preserved reservation identity and release. It makes no paid-service power claim. - S2a derives a 25G sale/one transaction, 255G payroll/one transaction (Akane 120, Bardo 135 joined to actual staff and shifts), and 5G upkeep in three rows/one transaction. `advance_to(1440)` has processed minutes 0 and daily closes 0, with entire typed Runtime bytes unchanged. Formal Reader Runtime restore and recall bytes match exactly. - The supplemental request-resend raw preserves typed economy, facilities, inventory, guests and staff at the same minute, and joins the one completed service `service_00000027` to sale transaction `ledger_00000085`. This is not settlement-replay proof; S2a supplies that distinct proof. - S2b derives `STAFF_UNAVAILABLE`/`WAITING_FOR_STAFF`, the absent night workers, overtime task/staff/shift joins and one duty minute. Its same-minute call is rejected as `MINUTE_ALREADY_APPLIED`, with entire typed Runtime unchanged. - S3 retains `RELATED_FACILITY_INACTIVE` in B1, never relabeling it `NO_POWER`. The directly closed facility retains its started service while the dependent facility interruption pauses it; the queued reservation is released. B2a completes/consumes once; B2b and B3 release without a sale. B4b's queued event completes, durability becomes 0/`BROKEN`, then the service fails with `BROKEN` at 961, releases its reservation and has zero sale rows. ## Unresolved raw/specification gaps 1. **`power_stop` missing.** EV evidence is not a paid-service power proof; B1 is a dependency interruption. No relabeling or invented D05 rule was used. 2. **`shift_completion` missing.** The actual supplied paid-shift originals at `B/audit-support/p04-current-native-series-r01/p04-paid-shift-midnight-native-r01/order-evidence/` have zero `SERVICE_SALE` rows in all three 17:59/completion-phase/18:00 snapshots. The `paid` filenames do not establish a charged completion at 1080. 3. **`save_restore` withheld under the fixed normalization restriction.** The entire formal Runtime does restore exactly. However, the getter comparison changes not only StringName/String and dictionary order but typed arrays to untyped arrays. Examples are `/anomalies`, `/anomalies/0/allocations`, `/anomalies/0/unallocated_by_staff`, `/anomalies/0/facility_ids`, `/settlement/input_payments` and `/settlement/rows`. Native array headers include `1c000100...` versus `1c000000...`. The raw getter byte inequality is preserved and parsed from `.var`; JSON is not substituted. Normalization was not broadened beyond the instruction, so this condition remains missing. 4. **B4a zero-charge assertion is unsupported.** `B/p04-s3-native-r01/raw/writer-B4a-next.{json,var}` contains one 25G sale at 960 and a completed service with consumed reservation. B4b has zero sales. The implementation records both facts, rather than declaring B4a charge 0. Destruction-stop credit above is specifically the B4b failed-service branch. D05 approval and supplement full bytes in `p04-whole-closure-r01` were read. They approve dependency closure and the 18:00 ordering choice, not an invented blanket policy for all D05 domains. The supplied raw discrepancies require owner-level resolution or appropriate evidence; this worker did not amend scope. Each of these native-Windows conditions remains individually **pending**: `EV`, `power_stop`, `destruction_stop`, `dependency_stop`, `shift_completion`, `recovery_completion`, `same_minute_replay`, `closure_release`, `exit_release`, `patience_release`, `paused_midnight`, `midnight_settlement`, `midnight_replay`, `save_restore`, `night_staff_absent`, `overtime_task`. The machine output also contains an explicit per-condition pending map. ## Actual validation outputs - Static Python compilation: **4 files passed** (in-memory compile; no engine). - Existing C fixture: **exit 0**, 5 positive controls passed and 25 negatives rejected. `verify_native` reports 10 owned processes and its original three conditions. No C condition names were edited. - Existing negative fixture: **exit 1**, at `synthetic_scalar_only_rejected`: `AssertionError: ('synthetic_scalar_only_rejected', {'task_id': 'P04-01', 'machine_verified': False, 'formal_acceptance': False, 'error': "'product_binding'"})`. - Existing applicability fixture: **exit 1**: `AssertionError: negative fixture accepted: wrong_tested_revision`. These two suites therefore could not be confirmed to pass/reject as requested. Their files and the functions involved were unchanged; they were not repaired by touching the deferred A holes, and no baseline rerun is claimed. - New series fixtures: **exit 0**, **5 small positive controls and 56 rejected negatives**, 14 negative classes per series. Controls cover immutable raw and descriptor overlays, source/body pins, PID endings, paths, relocation byte drift and typed-vs-JSON rejection. Immutable descriptor hashes are deliberately not refreshed; the tests do not claim to be new engine evidence. - Real series verifiers ran successfully during collection and were rerun by composition. Outputs are recorded in `REPAIR18_REAL_SERIES_OUTPUT.json`. - Separate composition CLI: **exit 1**, with 13 raw-derived conditions and: ```text candidate binding stage A pending; uncollected original boundaries: power_stop, save_restore, shift_completion ``` Full new outputs: `REPAIR18_COLLECTOR_OUTPUT.jsonl`, `REPAIR18_SERIES_FIXTURE_OUTPUT.json`, `REPAIR18_REAL_SERIES_OUTPUT.json`, `REPAIR18_COMBINED_OUTPUT.json`. The 13 verified boundary conditions are not 13 newly accepted units and do not change the original 13/88 credit. ## Exact Root commands Run from this existing checkout. These commands perform file-only work: ```sh B=/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build E=docs/plans/original-completion-2026-10-02/execution/p04-01 python3 -B "$E/collect_p04_native.py" --build "$B" python3 -B "$E/checker_series_fixtures.py" --build "$B" python3 -B "$E/p04_native_series.py" --build "$B" python3 -B "$E/checker_negative_fixtures.py" python3 -B "$E/checker_applicability_fixtures.py" --native-bundle "$B/audit-support/native-first-current" python3 -B "$E/checker_native_fixtures.py" "$B/audit-support/native-first-current" BUILD_OUTPUT_DIR="$B" python3 -B tools/check_p04_order_evidence.py --verify-series-only ``` The collector command above was already executed successfully; another execution must refuse the now-existing destination. Review the existing collection rather than overwriting it. The final command is intentionally failing; it does not need or generate a final index and never performs candidate composition. ## Stage A and subsequent dependencies Stage A remains pending: actual HEAD/filesystem candidate binding, `MAIN_ANCHOR` `9694...`, `candidate_tree` trust and the `3139` metadata holes are untouched. `--verify-only` still requires the actual final evidence index; its missing-check unions recomputed C/R results and still fails for any missing condition, and it cannot succeed while Stage A is pending. Required sequence remains **R → A → final index → mandatory whole validation → independent review → ordinary integration**. Outstanding raw/specification gaps and the two existing fixture failures prevent representing this dispatch as a completed or accepted implementation.