Decision STAGE2_6A_FIX3_EXACT_CONTROL_CONTRACT_MACHINE_ENFORCED_READY_FOR_CODEX_REAUDIT. Status PARTIAL. Mode EXECUTION. Live mutation YES, additive/reversible/birth-neutral. NO apply, NO permit, NO trigger/gateway-body/old-DOT change. MCP read-back PASS.

Machine-enforcement verified live: rule governance enforced (fn_qt001_rule_governance_ok + fn_qt001_eval_rule_v3 + fn_qt001_machine_tier repointed to v3); fingerprint v3 complete and content-sensitive (composite cb7f062ed3becb1d71ff70917ec5b105, 13/13 negative tests); exact signoff v3 (15/15 negative tests, reviewer allowlist, OTHER rejected); readiness v6 data-driven BLOCKED (SSOT 5/7, APPLY 0/4); hardcode guard v4 structural PASS_WITH_ROUTED_2_6B; structural detector 11/11; no-bypass proof 11/11 blocked; must-not-proceed pass true; scale_not_safe true (capability contract 0/4 satisfied).

Codex FIX2 twelve blockers: B1-B10 fixed; B11 (public/directus DML) and B12 (keyset/resume scale) structurally blocking, routed 2.6B.

Live safety: birth 1,211,019 neutral; tga 129; gateway fn_birth_registry_auto norm-md5 c022f849c2c7d57a720c4cc172789d70 unchanged; gateway integrity all_ok; open execute permits 0; done ledgers 0; dangerous DOT freeze 2/2; apr_approved 2; 20 new FIX3 views.

New live objects: table qt001_capability_contract; functions fn_qt001_rule_checksum, fn_qt001_rule_governance_ok, fn_qt001_eval_rule_v3, fn_qt001_machine_tier_v3, fn_qt001_fp_compose_v3, fn_qt001_plan_fingerprint_v3, fn_qt001_signoff_row_valid_v3, fn_qt001_signoff_satisfies_v3; repointed fn_qt001_machine_tier; views v_qt001_rule_governance_enforcement_guard, v_qt001_rule_governance_negative_tests, v_qt001_public_execute_no_go_guard, v_qt001_directus_dml_no_go_guard, v_qt001_control_plane_authority_lockdown_status, v_qt001_scale_blocking_guard_v3, v_qt001_exact_signoff_v3_guard, v_qt001_exact_signoff_v3_negative_tests, v_qt001_plan_fingerprint_v3, v_qt001_plan_fingerprint_v3_negative_tests, v_qt001_hardcode_diagnostic_inventory_v4, v_qt001_disguised_hardcode_structural_detector, v_qt001_hardcode_guard_v4, v_qt001_apply_readiness_dashboard_v6, v_qt001_apply_readiness_guard_v6, v_qt001_readiness_v6_negative_tests, v_qt001_26a_fix3_codex_blocker_matrix, v_qt001_26a_fix3_must_not_proceed_guard, v_qt001_26a_fix3_no_bypass_proof; patched v_qt001_parity_not_authority_guard and v_qt001_disguised_hardcode_detector to accept v2-or-v3.

SQL: /opt/incomex/docs/mcp-writes/birth-stage2-6a-fix3-2026-06-06/ (00_fp_first, 01_fix3, 02_patch, 90_verify, 99_rollback). Report dir: birth-stage2-6a-fix3-qt001-exact-control-contract-authority-lockdown-2026-06-06/00..13. Checkpoint: checkpoint-birth-stage2-6a-fix3-qt001-exact-control-contract-authority-lockdown-2026-06-06.md. Next: BIRTH_STAGE2_6B_QT001_PERMIT_RUN_KEYSET_RESUME_AND_AUTHORITY_REVOKE; fresh Codex re-audit required before 2.6B.