08 Writer/Public Bypass Visibility (SUPERTRACK H)

The writer is NOT fixed in this layer (deferred to 2.6B). We made the bypass visible and proved it cannot be exercised. No writer body change, no enablement.

Inventory: v_qt001_writer_public_bypass_inventory

fn_dot_birth_qt001_apply, sp_dot_birth_qt001_apply, fn_birth_register — all proacl NULL = PUBLIC_EXECUTE_DEFAULT. Each row records the fail-closed contract and that revoke PUBLIC EXECUTE is deferred to Stage 2.6B (paired executor/scanner DOTs).

Why it cannot apply today (verified by reading the writer body)

fn_dot_birth_qt001_apply execute path raises before any write unless ALL hold: v_birth_gateway_contract_integrity_dashboard.all_ok; v_birth_stage0_still_enforced_guard all pass; a valid OPEN execute permit (id+collection+status=open+mode=execute+unexpired+max_rows NOT NULL); p_expected_delta equals computed target; p_max_rows within permit. There are 0 open execute permits, so the function raises 'no valid OPEN execute permit'. p_execute defaults false; the dry-run path is pure read.

Guard: v_qt001_writer_bypass_must_block_guard

open_execute_permits=0; apply_allowed_tier_rows=0; plan_bound_safe=false; qt001_origin_births=0; pass=true. Writer risk remains visible and blocked until the next layer revokes PUBLIC EXECUTE and wires the registries.