exec(unified): drive loop §7 — PINK _handle_expired_working ported + audit build items

drive_loop.py transcribes pink_direct.py:1089 (the 10-step expiry sequence) warts-and-all
against injected ports (ExecPort seam: clock+kernel+venue), so no ambient state (C1). Carries
the scar tissue: pump-before-cancel, re-classify-after-cancel (fill races cancel), EXIT never
strands→MARKET, slot-busy double-entry guard, fail-safe venue-truth requote gate. SEAM
learnings preserved as referenced comments (zero-silent-suppression rule). Decimal sizes (H1).

- working.py: WorkingRegistry + WorkingOrder, injected clock, rejected→expire_now (one shared
  path). contract.py: client_order_id_core(attempt) — unique per attempt (audit H4/FIX).
- _constants.py: REQUOTE_HOT_WINDOW_S=5.0 (prov: 2026-06-10 double-entry).
- inventory §6: audit build items BI-1..5 folded in.
- test_drive_loop.py: 15 scar-tissue tests. Mutation-verified RED under exit-no-escalate
  (kills 3) and no-hot-window (kills double-entry guard). Full exec_unified suite: 77 green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

prod/docs/PINK_DRIVE_LOOP_PORT_INVENTORY.md

@@ -157,3 +157,23 @@ Two rulings the port encodes:
 **Golden rule for the port (operator's ruling, restated):** transcribe the mess, don't
 tidy it. Each branch above is a headstone. The only edits allowed are the AMEND rows —
 and every one of those cites a newer *certified* learning, not a preference.
+
+## 6. Build items from the best-practice audit (`EXEC_BEST_PRACTICE_AUDIT_20260714.md`)
+
+These are ADDITIONS the audit surfaced — not PINK scar tissue, so they carry their own
+tests. Fold into the port:
+
+- **BI-1 (H4) — clientOrderId unique per ATTEMPT.** Dialect mints `u-<request_id>-<n>`;
+  a retry after INDETERMINATE gets a *fresh* venue id (exchanges reject duplicates) with
+  parent linkage (FIX `OrigClOrdID` discipline). Add an `attempt` counter to the working
+  order. Enforce BingX charset/length cap. `contract.py` gains `client_order_id(attempt)`.
+- **BI-2 (H5) — order-stream seqnum gap detection.** WS is a delta; on a gap → forced REST
+  resync; keep the 5 s own-fill hot-window as belt-and-braces, not the primary guard.
+  (Lands in the venue-dialect §11, not the pure loop; referenced-comment the seam.)
+- **BI-3 (M1) — log-don't-swallow.** Every fail-safe guard keeps the guard, loses the
+  silence: catch specific, log ≥debug with context. No bare `except: pass` in the port.
+- **BI-4 (M2) — dead-man's-stop is a HARD gate.** Attached STOP_MARKET must be mutation-
+  tested for (a) auto-cancel on position close, (b) `reduceOnly` so a fire cannot open a
+  reverse. Pre-live gate, not a TODO. `ProtectiveSpec.reduce_only=True` enforced (done).
+- **BI-5 (H2) — durable atomic working-order state.** Never `/tmp`; durable path, `0600`,
+  tmp+rename. (Venue/persistence seam; referenced-comment where state would persist.)