08 — Controlled Apply Decision (Supertrack H)

Decision: DO NOT COMMIT a real backfill this macro. Leave QT-001 apply ACTION_READY / BACKFILL_READY. All technical gates pass and the apply is proven safe + idempotent, but commit is gated by an independent T2 review and an owner-issued permit.

Per-collection decision (v_birth_qt001_apply_decision)

Collection	gov_role	delta	decision
dot_domain_rules	governed	67	APPLY_READY_PENDING_PERMIT_T2
apr_approvals	governed	42	APPLY_READY_PENDING_PERMIT_T2
normative_relations	governed	18	APPLY_READY_PENDING_PERMIT_T2
apr_action_types	governed	6	APPLY_READY_PENDING_PERMIT_T2
field_type_equivalences	governed	4	APPLY_READY_PENDING_PERMIT_T2
apr_request_types / binding_registry / nrm_doc_type_config / nrm_approval_rules	governed/locked	—	NEEDS_OWNER
34 other eligible	mixed	0	ZERO_DELTA / EMPTY

Why ACTION_READY and not committed

1. Packet section 7 (no self-certify): acceptance requires an independent T2 reviewer to confirm planned vs applied vs source and rerun-delta=0. The apply agent may not also ratify.
2. No OPEN permit: the fail-closed gate requires an owner-issued permit per collection; none exists (deliberately).
3. All 5 targets are GOVERNED (incl. apr_approvals, the authority approvals table) and births are immutable (birth-registry-law) — a higher bar than observed/excluded objects.

Gates that DO pass (apply is genuinely ready)

• identity ELIGIBLE for all 5; policy BIRTH_REQUIRED.
• zero duplicate risk; byte-identical to realtime entity_codes.
• idempotency PROVEN: rehearsal pass-2 rerun_delta=0.
• rollback/compensation: births append-only; rehearsal proved BEGIN..ROLLBACK leaves 0 leaked; per-collection scoping via dot_origin + ledger.
• birth before/after expected = +137 exactly (proven in rehearsal, committed nothing).

Apply result / rerun guards

v_birth_qt001_apply_result (0 done rows — nothing committed). v_birth_qt001_rerun_delta_guard — for any future done ledger row, current dry-run delta MUST be 0; pre-apply it reports the 5 expected deltas.

What unblocks a real apply

Independent T2 sign-off → owner opens a permit per collection (status=open, max_rows ≥ planned) → deploy the reviewed sp_dot_birth_qt001_apply source → run batched with p_execute=true → rerun plan, assert delta=0. Next-macro BIRTH_STAGE2_QT001_APPLY_IF_READY carries this.