A facility is not available because it was designed to be. It is available because each system was proven in isolation, then proven together, then proven again under fault — and because the people on shift have executed the failure procedures before the failure arrives. This document sets out both halves of that: the commissioning gate ladder that admits the Facility to service, and the drill programme that keeps the emergency procedures live once it is in service.

Scope is the KOM Oman AI Factory at Knowledge Oasis Muscat — the electrical chain from utility intake to rack, the cooling plant and secondary loops, fire detection and suppression, the security estate, the network fabric and the compute platform. Ready for service is December 2026, and gate L5 is the condition of it.

• The definition of each gate — what is tested, against what standard, and the criterion that constitutes a pass rather than an opinion.
• The witness and sign-off regime — who must be present, who signs, and what the customer is entitled to attend.
• The drill calendar — which of the 17 emergency procedures is exercised when, at what depth, and to what pass criterion.
• The evidence set each gate and each drill produces, and how long it is retained.

It is not the test scripts themselves, and it is not a record of tests performed. The scripts are produced by the appointed commissioning agent against the installed plant and the manufacturers' own acceptance procedures; the records accrue as the gates are cleared. Nothing in this document should be read as evidence that a system has been tested.

Commissioning runs in five levels. Each is a gate, not a phase: work on the level above does not begin until the level below is signed off, and a gate is cleared by a witnessed result against a written criterion — never by a contractor's statement that a system is complete.

A failure is a normal and expected output of commissioning — it is the mechanism working. What is not permitted is passing it forward.

The party that installs a system does not sign off that it works. Commissioning is directed by an independent commissioning agent appointed by Prima and reporting to the COO, not to the contractor or the EPC programme. The agent owns the scripts and the results; Prima owns the criteria and the gates.

The first three levels prove equipment in isolation: correct as built, correct as installed, correct as operating. No system interaction is tested here, and passing all three does not imply the Facility works.

The last two levels are where availability is actually established. L4 proves each subsystem behaves correctly when a component within it fails. L5 proves the whole Facility behaves correctly when a system fails — under load, with nothing simulated on paper.

Ready for service is not a date on a programme; it is the L5 certificate. No customer load is accepted, and no availability commitment takes effect, until L5 is signed. Two consequences follow, and both are deliberate.

• The service level does not run before L5. The 99.982% monthly cluster availability commitment under PRM-SLA-2026-001 takes effect from the date of the L5 certificate, not from first power or first login. Measuring a commitment against a facility that has not been proven would make the number meaningless.
• The emergency procedures are drilled before L5, not after. The 17 EOPs are approved and exercised during the commissioning window — the drill calendar at section 07 is built around the L4 and L5 windows precisely because those are the only occasions when plant can be failed deliberately without a customer on it.

A gate certificate is worth exactly as much as the people who signed it were present for. This section fixes who must attend, who signs, and what the customer is entitled to see.

The engineers who will hold the shift attend L4 and L5 as participants. This is the only period in the Facility's life when plant can be failed deliberately with no customer on it, and it is therefore the most valuable training that will ever be available. Attendance at L4 and L5 is recorded against each engineer's competence file under PRM-HR-2026-001 and counts toward the certification requirements named there.

Each gate closes with a defined set. An incomplete pack is an open gate, irrespective of whether the tests passed.

An emergency procedure that has never been executed is an assumption. The 17 EOPs in PRM-OPS-2026-001 are exercised at three depths, and each exercise is graded against the procedure's own stated timings — not against the impression of those present.

1. Authorised in advance by the COO, with the date, scope, the plant to be failed and the abort condition stated in writing.
2. Customer notified where the exercise falls inside a window in which the Demarcation Matrix requires notice. Once the Facility is in service, live exercises run only in agreed maintenance windows.
3. Abort authority rests with the Shift Lead on duty, who may stop the exercise at any point without seeking approval. An aborted drill is recorded as an abort, with the reason — it is not a fail and it is not omitted.
4. Executed by the shift on duty, not by a rehearsed team assembled for the occasion. A drill run by the best available people does not measure what will happen at 03:00.
5. Observed and timed by the Operations Manager or a nominated deputy, against the timings in the procedure.
6. Debriefed within 24 hours, with the record and grade filed the same week.

Every EOP is walked through in September, on approval of the emergency set. Live exercises are then concentrated into the L4 window in November and the L5 window in December — the only period in which plant can be failed deliberately with no customer on it. All 17 are exercised live or at simulation depth before service commences.

• Suppression release is never discharged. LSS-001 is exercised to the point immediately before release, with the actuator isolated — detection, cross-zoning, alarm routing, abort and evacuation are all proven; the gas is not discharged. This is standard practice and the isolation is stated on every record.
• Black-building is run twice. PWR-005 is walked through in September and October, then run live at L5 in December from a genuinely dead facility. It is the single most demanding test in the programme and the one a lender or offtaker should ask to attend.

From ready for service the programme becomes a rolling annual cycle. The commitment is that every one of the 17 procedures is exercised at least once in any 12-month period, spread across quarters so that no single quarter carries a disproportionate operational risk. Live depth is restricted to agreed maintenance windows.

The programme exists to produce a body of evidence. This section states what that evidence is, when each piece first exists, how long it is held, and how the programme itself is held to account.

Reported to the COO on the cadence shown, and to customers and lenders on request. A measure with no owner and no reporting interval is an intention, so each carries both.