From d74e86c065448b66a39e6bece9e87d4955218710 Mon Sep 17 00:00:00 2001
From: OpenFUT Agent <agent@openfut.local>
Date: Thu, 13 Aug 2026 22:44:12 +0000
Subject: [PATCH] docs(fifa17): record Rust economy authority proof (E1 cutover
 ready)

Final per-route authority table: every economy route owner=Rust, Python
proxy=NO (userMassInfo the one hybrid: Python envelope + Rust economy/squad
overlay). Barrier 93a46d4; from_config 43917a0. Proofs: differential 15 PARITY
+ 1 DIFFERENT-BY-DESIGN, concurrency 8x50, failure 10 (complete-sale SAFE, no
E3), importer 5-step, from_config E2E, NEVER-BOTH / no-fallback / stale-reader.
Python source byte-unchanged; oracle suite 32/32.
---
 openfut-utas-host/ROUTE_AUTHORITY.md | 39 ++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/openfut-utas-host/ROUTE_AUTHORITY.md b/openfut-utas-host/ROUTE_AUTHORITY.md
index 2792939..5207888 100644
--- a/openfut-utas-host/ROUTE_AUTHORITY.md
+++ b/openfut-utas-host/ROUTE_AUTHORITY.md
@@ -12,6 +12,45 @@ entitlements (`unopenedPackIds`). `points` has **no** writer (read-only). EASFC
 Legend: **R** = Rust/Core authoritative, **P** = Python proxied (oracle).
 Evidence lines refer to `fifa17-recon/tools/{utas_server.py,fut_store.py}`.
 
+## E1 — CUTOVER READY (barrier `93a46d4`, superproject source-ready; NOT deployed)
+
+The economy authority barrier is committed: `Server::handle_with_ip` dispatches
+every economy route to Rust/Core (`try_handle_economy`) BEFORE `classify()`, and
+`from_config` (`43917a0`) attaches the economy services in production. Final
+per-route authority (all economy routes owner = Rust, Python proxy = NO):
+
+| Route (method) | Owner | coins R/W | inv R/W | ent R/W | pile R/W | listing R/W | reveal | Py proxy | Rust handler / Core primitive |
+|---|---|---|---|---|---|---|---|---|---|
+| `/user/credits` (GET) | R | R/- | - | R/- | - | - | - | NO | `handle_credits` (`balance`+ent count) |
+| `/userMassInfo` (GET) | R (hybrid) | R/- | R/- | R/- | - | - | - | envelope only | `overlay_massinfo_economy`+squad (Py non-economy envelope only) |
+| `/store/purchasegroup` (GET) | R | R/- | - | R/- | - | - | - | NO | `handle_purchasegroup` full-gen + `StoreMode` |
+| `/store/transaction` (PUT) | R | -/R | -/R | - | -/R | - | R | NO | `handle_store_buy` → `purchase_items` |
+| `/purchased` (POST) | R | -/R | -/R | -/R | -/R | - | R | NO | `handle_pack_open` → `redeem_entitlement`/mint |
+| `/purchased` (GET) | R | - | R/- | - | R/- | - | R | NO | `shape_purchased_reveal` (pile+inventory) |
+| `/item/<id>` (DELETE) | R | -/R | -/R | - | - | - | - | NO | `handle_quick_sell_path` → `sell_item` |
+| `/ut/delete/…/item` (POST) | R | -/R | -/R | - | - | - | - | NO | `handle_quick_sell_body` → `sell_item` |
+| `/item` (PUT) | R | - | R/- | - | -/R | - | - | NO | `handle_move_items` (PileStore) |
+| `/ut/delete/…/match` (POST) | R | -/R | - | - | - | - | - | NO | `handle_match_end` → `grant_reward` |
+| `/auctionhouse`,`/transfermarket` | R | R/- | - | - | - | -/R | - | NO | `handle_market_list` (MarketStore) |
+| `/tradePile` (GET) | R | R/- | - | - | - | R/- | - | NO | `handle_market_query` |
+| `/trade/<id>` (POST/PUT/GET) | R | R/R | -/R | - | - | R/R | - | NO | `handle_market_buy` → `purchase_item` |
+| `/ut/delete/…/trade/<id>` (DELETE) | R | - | - | - | - | -/R | - | NO | `handle_market_cancel` |
+
+`/ut/auth`, `/openfut/fifa17/capability`, `/club`, `/squad/*` are NOT economy
+routes (classify_economy → None) and are unchanged. `userMassInfo` is the one
+intentional hybrid: Python supplies the non-economy envelope, Rust overlays the
+squad AND the economy fields — no Python economy value is authoritative/visible.
+
+**Proofs (all green, source-ready):** differential 15 PARITY + 1
+DIFFERENT-BY-DESIGN (market second-buy: Rust single-debit ledger vs oracle
+stateless re-debit; compat NONE); host concurrency 8 races × 50 iters; failure
+injection 10 cases incl. complete-sale-after-commit = SAFE (listing left
+`reserved`, not buyable; one debit + one mint; no E3); importer
+dry-run/apply/restart/idempotency/conflict; `from_config` E2E + restart;
+NEVER-BOTH (economy routes → Rust, Python proxy count 0); no-fallback (dead Core
+→ 503, proxy count 0); stale-reader (Core values only, Python 111 never visible).
+Python source byte-unchanged; oracle suite 32/32 green.
+
 ## Writer routes (mutate cluster state)
 
 | Route | Method | Python handler | Writes | Current | Target | Core primitive |