Checkpoint — Stage 2 Wait-for-Codex Read-Only Watch + Docs Sync

Date: 2026-06-06 Macro: STAGE2_WAIT_FOR_CODEX_READONLY_WATCH_AND_DOCS_SYNC Mode: READ-ONLY + DOCS-ONLY. Live production logic mutation: NONE. Only KB documents were written. Status: PASS — all live safety guards green; Codex independent review found COMPLETE with verdict NOT_SAFE_NEEDS_FIX; docs synced to reflect it.

1. Live safety watch (read-only, verified 2026-06-06 ~07:45 UTC)

Check	View / source	Result
Dangerous DOTs frozen	v_birth_stage0_freeze_no_go_guard	PASS (frozen 2/2)
Stage 0 still enforced	v_birth_stage0_still_enforced_guard	PASS 5/5
Gateway drift guard	v_birth_gateway_ssot_drift_detector	OK (both fns; norm-md5 c022f849)
Gateway no-old-function	v_birth_gateway_no_old_function_guard	PASS
Stage 1 release guard	v_birth_gateway_release_drift_guard	OK 5/5 fns (live sha256 == approved)
Stage 1 no-worse	v_birth_stage1_no_worse_proof	PASS 5/5
Stage 2 no-worse	v_birth_stage2_no_worse_guard	PASS 6/6 (74/58/36; 0 open permits)
H11a contained	v_h11a_no_go_guard	PASS 3/3
Birth explosion / spike	v_birth_spike_alert_guard, v_birth_explosion_current_state	OK (last_1h≈38, last_6h≈107 — provenance trickle only)
trigger_guard_alerts	trigger_guard_alerts count	129 (unchanged)
apr_approvals	apr_approvals count	42 (unchanged)
QT-001 apply gate	v_birth_qt001_apply_no_go_guard	4/4 apply_blocked_now=true
Permits	v_birth_qt001_permit_status	total 0 / open 0 (fail-closed)
Backfill ledger	v_birth_qt001_backfill_ledger_status	planned, dry_run=true, applied_rows=0, planned 137
Global preflight	v_birth_global_preflight_no_go_guard	stage0 PASS / drift OK / birth-ops BLOCKED_UNTIL_STAGE_1_5
OOM / containers	docker_logs postgres, list_docker	safe — pg up 7 weeks healthy, no signal-9/restart; 11/11 containers healthy

Birth count: ~1,210,884–1,210,890 (net-neutral; matches Stage 2 close + KB-upload provenance only). No new explosion.

2. Codex independent review — COMPLETE

Found uploaded in KB: knowledge/dev/reports/architecture/codex-stage2-qt001-backfill-apply-readiness-review-2026-06-06/ (00-readme..09-final-summary). Mode: read-only; no DB/Git/service/permit/apply mutation.

Verdict: NOT_SAFE_NEEDS_FIX — do not open permits, do not apply any target.

• Valid (no rework): 5 targets, exact delta 137, zero current cross-collection collision, metadata 39/39, fn_birth_register current-target compatible.
• Blockers: pseudocode apply source (false-completes ledger with 0 rows); readiness false-pass while procedure/DOTs absent; permit lacks expiry/max_rows; ledger can't prove scoped resumable apply; collision silently skips; no batch compensation/resume; fn_birth_register not generally fail-closed; one stale gate text.
• Next macro: BIRTH_STAGE2_QT001_APPLY_DOT_HARDEN_AND_INDEPENDENT_REAUDIT, then a fresh independent re-audit.

3. Docs sync performed (DOCS-ONLY, KB)

Doc	Change
BIRTH_STAGE2_QT001_METADATA_BACKFILL_REPAIR_PACKET.md (rev 3)	Appended §13 recording the independent-review verdict NOT_SAFE_NEEDS_FIX, the explicit no-apply/no-permit instruction, the 8 blockers, the required hardening macro, and review-package pointer. §12 "ACTION_READY" explicitly marked superseded.
BIRTH_GATEWAY_DESIGN_INDEX.md (rev 6→8)	Status line updated to "QT-001 apply BLOCKED by independent review (NOT_SAFE_NEEDS_FIX)"; Stage 2 macro row updated (apply BLOCKED + independent-review dir pointer); new macro row 2.5 ...APPLY_DOT_HARDEN_AND_INDEPENDENT_REAUDIT (REQUIRED — not started) inserted before Stage 3.
stage2-wait-for-codex-readonly-watch-docs-sync-2026-06-06/00-waiting-note.md (new)	One-page waiting note (current state / what Codex reviewed / what T1 must not do / what next depends on Codex).

Index/packet now correctly point to the Stage 2 checkpoint, the Stage 2 packet, and the Codex review; neither doc any longer implies apply is action-ready.

4. Drift / observations

• No safety drift. All guards green; no gateway/trigger/permit/ledger mutation; net-birth-neutral.
• Docs drift (now fixed): index + packet previously implied QT-001 apply was "ACTION_READY pending T2" while the independent review had already returned NOT_SAFE_NEEDS_FIX. Synced (§3).
• Benign log observation (no action — would require a forbidden fn change): fn_log_issue INSERTs from dot-context-pack-verify (H11a/H11b detectors) error with value too long for character varying(50) on the long entity_code. The INSERT fails entirely → birth-neutral (0 rows created); the 1,153 historical NULL-coalesce rows are stale (last seen 2026-06-05 10:30, ~21h ago). H11a remains detect-only/contained. Logged here for the future hardening macro; not touched under read-only mode.

5. Blocker & next

• Blocker: none technical for this watch macro. QT-001 apply is blocked by the Codex verdict (human/owner + a hardening-and-reaudit macro) — by design.
• T1 must not: apply / open permit / metadata-repair / change any function, trigger, DOT, gateway, or source data; no owner/vote/RP/REALRUN/event/UI deploy.
• Next macro: BIRTH_STAGE2_QT001_APPLY_DOT_HARDEN_AND_INDEPENDENT_REAUDIT (address the 8 Codex blockers; build a real bounded writer; rehearse failure/resume), then request a fresh independent re-audit before any apply.
• Until then: continue READ-ONLY watch; live state already enforces fail-closed.

Waiting note: knowledge/dev/reports/architecture/stage2-wait-for-codex-readonly-watch-docs-sync-2026-06-06/00-waiting-note.md