10 Design Index Update (SUPERTRACK J)

State transition

Stage 2.6A ORIGINAL: FAILED (Codex STAGE2_6A_FAIL_HARDCODE_STILL_DANGEROUS). Stage 2.6A-FIX: PASS — machine-enforced Plan/Tier/Signoff layer, ready for independent re-audit. Re-audit: a fresh independent Codex re-audit is REQUIRED before Stage 2.6B, any permit, or any apply.

New objects (committed, additive, reversible)

Tables: qt001_tier_rule_registry (11 rules, apply_allowed CHECK false), qt001_signoff_plan_binding (0 rows). Functions: fn_qt001_eval_tier_predicate, fn_qt001_collection_signals, fn_qt001_machine_tier, fn_qt001_machine_blocked_reason. Rewritten: fn_qt001_refresh_plan_snapshot (IN-list removed), fn_qt001_build_plan_registry (CASE + literal removed). Views (23 new): tier_rule_registry, tier_rule_input_signals, tier_rule_evaluation, tier_assignment_machine_enforced, tier_rule_no_go_guard; parity_signal_status, parity_conservation_guard, tier3_block_reason_detail; plan_bound_signoff_status, signoff_scope_guard, signoff_no_go_guard; plan_blocked_reason_detail, blocked_reason_not_literal_guard; hardcode_guard_v2, hardcode_open_risk_inventory; apply_readiness_guard_v4, apply_readiness_dashboard_v4, readiness_v4_no_go_guard; writer_public_bypass_inventory, writer_bypass_must_block_guard; 26a_codex_failure_reverification, 26a_must_not_proceed_guard, 26a_fix_safety_audit.

Authority path (new)

Plan tier = fn_qt001_machine_tier over qt001_tier_rule_registry predicates. Apply authority = readiness v4, which requires machine tier rules + plan-bound SAFE signoff + hardcode_guard_v2 PASS + parity-not-authority + permit/keyset/writer/scale — all currently blocking.

Legacy objects retained but no longer authority

v_qt001_apply_readiness_guard_v3 and v3 dashboard remain (superseded by v4). v_qt001_plan_no_go_guard contains legacy count-pins (=5/=137) and reads snapshot.tier; since snapshot.tier is now machine-derived, its tier-pinned assertions reflect the corrected machine reality (TIER1=0) and are no longer authoritative.

Next macro

BIRTH_STAGE2_6B_QT001_PERMIT_RUN_KEYSET_RESUME — permit/run/keyset/watermark lifecycle bound to plan checksum + exact delta; wire writer to registries + revoke PUBLIC EXECUTE; parity-invariant separation (resolve HC-05/HC-11) + legacy resolver (HC-04) + TG_ARGV scanner (HC-07); duplicate-trigger reconciliation; representative-volume perf gates. Then fresh independent re-audit BEFORE apply.