TheTree_mock/docs/plans/original-completion-2026-10-02/execution/p04-01/ORDER_AUDIT.md

P04-01 REPAIR51 canonical handoff

ACTUAL S50 historical evidence complete; S51 docs-only resubmission; S51 native admission pending at worker handoff (fresh native on Q51 required by S-binding, checker:368-371); post-submit admission determined only by Root version-pinned receipts; formal_acceptance false; P04=0.

ACTUAL S50: native6 / 24 phases PASS (historical; bound to S50/Q50). ACTUAL S50: collector 15+EV, missing 0 (historical; bound to S50/Q50). ACTUAL S50 receipts: build/audit-support/p04-root-acceptance-a9ef681f/. ACTUAL S47: full184 retains its original label; conditional reuse only under the existing checker and applicability map. r22 remains historical.

S51 native admission is pending AT HANDOFF. After submission, only Root version-pinned receipts under build/audit-support/p04-root-acceptance-/ and build/p04-evidence/index.json determine admission. Worker-time NOT RUN / UNDETERMINED / unexecuted text below is historical and never a reason to rebuild. Fresh native6 on Q51 is required by S/Q binding, not by that text. No future S51 SHA, Q51 or receipt is claimed.

All six D05 IDs remain approved; pending D05 is empty. PAUSE-REASON: S5B proves same-tick onset from ACTIVE gives RELATED. Power-first then dependency closure shows NO_POWER statically at M facility_service.gd:860-864; that sequential case is EXPLICITLY UNRESOLVED/UNPROVEN under the unchanged approval. It is not a defect, cured, proven, or silently narrowed. The :569 gate preserves P04 safety regardless of label. Any later product change needs a separate owner-authorised task; do not amend the contract or re-ask the owner.

Remaining Root gates:

• Root fixes Q51; compare actual hashes with REPAIR51_APPLICABILITY_MAP.json; stop reuse on executable differences
• clean exact-Q check-only; capacity and PID check; one heavy lease for fresh native6 on Q51
• reader/adapters then collector; full184 conditional reuse check; order CLI/complete_B conditional reuse or rerun once
• index regeneration; one p04-acceptance validate; separate Opus whole-unit independent review
• prepare / exactC / integration / final / RootDB join / ledger / main push
• nativeWindows individually pending

Scope: documentation-only repair within the original P04-01/W unit. Original total 30/88, formal 16, P04 credit 0; formal_acceptance false; unit incomplete. No partial credit. See REPAIR51_APPLICABILITY_MAP.json for hashes and reuse conditions.

Historical, superseded

All older text below, including its current/status headings and worker-time execution statements, is superseded historical material.

REPAIR49 normal-gate handoff

Required materials: exact B/native-first-current and fresh-run registry; each runner-input/ended/source/UID/formal/raw/lifecycle receipt; original recorded Q and engine context; B/p04-evidence/runner-materials and RELOCATION.json; matching collection/MANIFEST and separate dependency invocation; original full run and full_suite binding/raw receipts; final index and invocation receipt; immutable authorities in frozen checkout. No raw or historical receipt is rewritten. Two-placement identity requires the explicit closure in repair48_identity_controls.py, missing-file rejection, and original/A/B complete path/bytes/SHA tables and tree hash equality before and after positive execution. See REPAIR49_STATUS.md. Submission is followed by new Q freeze, affected pure controls (complete_B included), clean exact-Q check-only, capacity/PID checks, one fresh native lease for S1/S2a/S2b/S3/S4 and all ten S5 cases, readers/adapters, 15EV collector, full verification/binding under the conditions below (or one final full184 if any condition fails), index generation, p04-acceptance once, separate Opus whole-unit review, normal prepare/C/integration/final/Root DB join/ledger/main push. If order-typed fails, preserve its result and stop before heavy execution. Only whole-unit acceptance grants credit.

REPAIR49 full184 conditional reuse candidate — all conditions UNVERIFIED

Native reuse is forbidden: all six series require fresh M/S/Q_tree provenance (p04_native_series.py:1287; checker:370). Full uses the existing separate binding (checker:1175-1186); no adopter or checker change is authorized. The following are requirements, not results or approval:

1. New S5 source_before must equal old full selected_source_map: all 1369 keys and SHA values, not counts alone.
2. Old project_root must remain unchanged: source-start == current source_refs == post-verification source_refs (full_suite_verifier.py:115).
3. selected_source_map, roster184, parse329, settings, runner/marker module, marker contract, suite-policy and UID plan/stage must all match (116-152,225).
4. inputs.engine must match current engine_pin (124-125).
5. Revalidate every phase PID, cleanup, marker and diagnostics (154-228).
6. Current s5/run_s5_native.py and full_suite_verifier.py SHA must equal the Root rehearsal versions.
7. Never relabel old S/oldQ/project_root/PIDs/time. Describe reuse only as revalidating the exact-source-identical old full through the existing full_suite route; never claim full ran on new S.
8. A separate Opus whole-unit review must independently confirm applicability.

Conditions 1–6 require actual checks after final freeze. If any predicate is unproved or differs, reject reuse and execute full184 once on the final version. SourceRefs (tools/run_all_tests.py:40-45) excludes docs/private package, but that fact is no substitute for complete source equality. No reuse is approved here.

REPAIR49 current correction

Source-ready only; original 30/88, formal 16, P04=0, no partial credit. REPAIR48's specification-mismatch blocker below is historical and corrected: the immutable 7000-byte original has SHA256 d28aadb044633f7d804de5a92c8d4c4a7438dfbf44c3243dca978951f4def25f; removing its single EOF LF gives 9ec722e7dfb0bee178d291624a026420c08412574e238bba1fde012c7a6f7881. This is the existing Git/Runner strip/checker one-EOF-LF pin contract. No specification, approval or normalization change. Older contradictory wording below is superseded history, including blanket full-reuse prohibitions and all-controls-unexecuted wording. Q47 admission/index failures remain failures. See REPAIR49_STATUS.md for closure audit and verbatim complete_B FileNotFoundError. Root handoff reports payload(B), all53, series/join/power PASS; order-typed remains UNDETERMINED. Worker did not rerun them. Corrected complete_B remains unexecuted. Old native/full successes confer no new-S acceptance or credit.

REPAIR48 current source status: see REPAIR48_STATUS.md. Earlier run directions and successes below are historical; they grant no P04 credit.

RUN47 harness repair; original unit remains unaccepted

Q46 S4 failed before engine startup: AssertionError: complete 316-script parse roster. Secondary guard: AssertionError: exact source and planned UID set. Captured S4 PIDs: []; phases: []; passed: false. No game verification ran. This failure is historical reference only, never adopted as a pass. Current S4 admission derives exact roster/sets from real selection; check-only and native share it. Import-not- attempted cleanup requires the original inventory without generated UIDs. REPAIR47_PLAN.json and REPAIR47_STATUS.md supersede earlier current-run count and reuse instructions. Immutable spec, REQUIRED/REACH_REFS, product, caps, denominator, permissions and historical raw are unchanged. Option B: Root freezes new final Q, then fresh all-series runs once; no receipt rewriting or reuse adopter.

Historical P04-01 order audit — repair31

Formal status is 16/88, P04 credit 0. Policy approvals are recorded; implementation and exact-Q evidence remain incomplete. No original-unit completion is claimed.

D05 is six of six actually approved; adoption into raw enforcement and verification are pending. Normal-C qualification now rejects matching-parent/tree commits without the authoritative Root/Runner receipt contract. That contract's path, SHA256 and provenance verification remain a concrete context gap.

M is c0ea009b28a7649aca6a433a1a24dc0be5e7ab81. Source hashes, full product inventory, metadata membership and function line numbers were read from its actual Git tree in REPAIR30_SOURCE_FACTS.json. Product manifest excludes the checker; native/full selected SourceRefs must include it. Q and C do not yet exist for this worker revision.

The four actual human answers are preserved verbatim in D05_REMAINING_APPROVAL.json, bound to both supplied copies by path and SHA256. Existing dependency, 18:00 and A01 approvals remain unchanged. The candidate documents are superseded history.

Domain	Approved rule	Current M source	Evidence
閉店	D-034 preserves started services on direct closure and releases waiting requests. Dependency closure stops progress and charging, retains reservations/service identity, and completes once after recovery. RELATED_FACILITY_INACTIVE wins over NO_POWER when both apply.	autoload/simulation_runtime.gd:5765 _process_tick_commands; scripts/facility/facility_service.gd:853 _prepare_service_for_tick; autoload/simulation_runtime.gd:12672 _release_closed_business_queues	Fresh Q pending; nativeWindows pending
停電	BASELINE:183 covers real mana depletion. Legitimately stopped service has no progress or charge and preserves reservations. D05-P04-PAUSE-REASON makes dependency closure the displayed reason when dependency closure and power loss coincide.	autoload/simulation_runtime.gd:10716 _advance_mana; scripts/facility/facility_service.gd:853 _prepare_service_for_tick	Fresh Q pending; nativeWindows pending
破壊	Command destruction precedes completion. Accident/raid destruction follows completion and charging in minute N; that sale remains valid. Failure and reservation release for affected unfinished service occurs in N+1. D05-P04-DESTRUCTION is the authority, not BASELINE:183.	autoload/simulation_runtime.gd:5765 _process_tick_commands; autoload/simulation_runtime.gd:8599 _advance_defense; autoload/simulation_runtime.gd:9826 _apply_defense_outcome_boundary; scripts/facility/facility_service.gd:853 _prepare_service_for_tick	Fresh Q pending; nativeWindows pending
退出	D-034 release safety remains. Command exit precedes completion; AI planned exit follows completion and only applies to a deciding guest. Later despawn is distinct.	autoload/simulation_runtime.gd:7575 _execute_leave_facility_queue; autoload/simulation_runtime.gd:8760 _advance_guest_ai_decisions	Fresh Q pending; nativeWindows pending
課金	Charge only completed service, once per idempotency key; retain original price snapshot and reservation/ledger joins. At 00:00 prior-day settlement and upkeep precede completion; the sale belongs to the new day.	autoload/simulation_runtime.gd:1876 _advance_facility_upkeep; autoload/simulation_runtime.gd:11817 _complete_service_transaction; autoload/simulation_runtime.gd:11833 _apply_service_transaction; scripts/operations/operations_coordinator.gd:1125 _process_daily_close	Fresh Q pending; nativeWindows pending
シフト交代	Approved 18:00 order remains: completion and payment before handover. No renewal of prior approval.	autoload/simulation_runtime.gd:8504 _advance_facilities; autoload/simulation_runtime.gd:8680 _advance_staff_ai	Fresh Q pending; nativeWindows pending
00:00決算	A01 ownership-based upkeep is unchanged. Prior-day settlement/upkeep precede 00:00 service completion; its sale belongs to the new day. Replay/restore must not duplicate settlement.	scripts/core/simulation_kernel.gd:254 _handle_time_boundaries; autoload/simulation_runtime.gd:1919 _advance_operations_time; scripts/operations/operations_coordinator.gd:882 _process_minute_boundaries; scripts/operations/operations_coordinator.gd:1125 _process_daily_close	Fresh Q pending; nativeWindows pending

The preserved S1–S4, r22 index, old registered validation and f5 full178 run retain their historical identities. Current runtime deltas conservatively require fresh proof for all 15 conditions plus EV. A test count, approval record or byte-equal ordering function alone does not establish original acceptance. No thresholds or original unknown values are changed.

The eleven phases remain APPLY_COMMANDS, TIME_BOUNDARIES, MANA, CONSTRUCTION, LOGISTICS, FACILITY_COMPLETION, VITALS_AND_ENVIRONMENT, INCIDENTS_AND_EVENTS, FACILITY_QUEUES, AI_DECISIONS, PUBLISH_SNAPSHOT. See the structured audit for preserved phase analysis and the new source manifest for exact M references.

See CURRENT_STATUS.md and REPAIR31_STATUS.md before any Root execution.

REPAIR50 source preparation (2026-10-18; no acceptance claim)

The commander handoff reports an identity order mutation on an all-equal array (recent_events/17/payload/current_cell = [0,0,0]), raw SHA prefix bb0ccb1d…, and 761.085 seconds elapsed. These are supplied observations, not measurements repeated by this worker; the full raw SHA/log remains Root material. The old control reversed every multi-element array and classified the resulting identical bytes as a negative. The oracle correctly accepted that identity. Existing failure records remain unchanged.

REPAIR50 separates byte-identical identity positives from negatives, swaps the first unequal typed byte pair, and lists collections with no genuine order variant. All AFTER keys/values, journal/body fields and both copied modes remain traversed. Type-invalid mutations still require ValueError rejection and are also listed as parser rejections; copied records contain the changed bytes in both AFTER and EXPECTED even when an intermediate parse is invalid. The oracle, adapters, public checker, native-series implementation and R49 closure roster are unchanged. No Node patch optimization is used.

The temporary expected memo keys full BEFORE/command/guard bytes by SHA256 and length plus oracle/parser source SHA256. Its cache contains only genuine derivation output bytes. It reconstructs fresh Nodes on each return, restores the wrapper with finally, and retains verify for each parseable mutation. Self-controls compare hit/nonmemo bytes for first/last and each mutated kind, require a one-byte BEFORE miss and reject, and check normal/exception cleanup. The SHA fixture now streams 1 MiB implementation chunks without changing file selection, traversal, relative keys or digest semantics.

Worker validation: AST parsing only; pure, stream, native and formal checks are unexecuted. See REPAIR50_STATUS.md for Root commands, static estimation and reuse prerequisites. Original 30/88, formal 16 and P04 credit 0 remain unchanged; the whole unit is incomplete.