O8F Report 02 — Source survey & patch plan (G1)

• macro: v0.6-o8f-implement-f2-f3-gap6-deploy-proof
• date_utc: 2026-05-21 · gate: G1 — source survey · result: G1 PASS

1. Code paths inspected

Path	Finding
orchestrator/discover.py	LiveDryRunDiscoverer._shadow_mark_rows emits O4-DRYRUN-SHADOW placeholder body/title. LiveReadOnlyDiscoverer owns a read-only select_rows callable — F2 is localised here.
ledger_v2_canonical_cut.py (LegBRecorder)	v0.5-RATIFIED, frozen to M1: PIN_CANDIDATE_COUNT=60, _require_list(...,60) ×11, body_hash_match_60 literal key, section histogram {principle:15,section:3,article:42} baked in.
ledger_v2_canonical_verify.py (VerifyRecorder)	v0.5-RATIFIED, frozen: 5 PIN_M1_* UUIDs, EXPECTED_SECTION_TYPE class constant, _require_uuid = equality-to-M1.
live_execution.py	ProductionLiveExecutionAdapter already accepts injected governance_writer/verify_writer; defaults refuse. leg_b_record/write_verify deliver the txn-owning seam only.
phases/leg_b_record.py, phases/write_verify.py	Mode.LIVE routes to the adapter; the writer is the F3 deliverable.
compensation	none existed — sql/lifecycle/rollback_runbook.sql is DDL-level only; GAP6 (per-cut data revert) had no module.

2. Patch plan — what is implemented now vs design-only

F2 — implement now (localised to discover.py):
  LiveReadOnlyDiscoverer.source_unit_texts() — read-only SELECT of real
  unit_version title/body; LiveDryRunDiscoverer.from_live wires it into the
  shadow rows; placeholder kept as fallback.

F3 — implement now via a NEW module (the SAFE realisation):
  new orchestrator/governance_writers.py with GenericLegBRecorder /
  GenericVerifyRecorder — every count/histogram/identity per-run.
  DECISION: the v0.5-ratified ledger_v2_canonical_* files are left
  BYTE-IDENTICAL (frozen M1 namespace) — this preserves the M1 writer_digest
  regression trivially AND keeps the change strictly within v0.6 authoring
  scope (no widening of the v0.5 ratification is needed). The macro's
  "generic path" carries no hard N=60; the Constitution constants stay in
  the frozen v0.5 namespace exactly as G3 permits.

GAP6 — implement now (new module, non-mutating):
  new orchestrator/compensation.py — plan_compensation, the append-only
  Compensation-B review_decision builder, the soft-revert SQL-text helper
  (no hard delete default), pre-run snapshot queries, HOLD bundle.

cosmetic — implement now:
  __init__.py milestone comment de-rotted; KNOWN_MILESTONES += O8E/O8F.

design-only / not in O8F scope:
  F1 adapter method-body live execution (needs GAP7 flip), F4 backup key
  (VPS provisioning), GAP7 sovereign ruling, GAP8 target selection.

3. Live-schema check (read-only)

public.unit_version carries title text + body text; information_unit joins via version_anchor_ref. Confirmed the F2 SELECT column set.

g1: PASS — paths mapped; patch plan = F2 + F3(new module) + GAP6 + cosmetic.