03 - Option Beta Evaluation

Verdict

OPTION_BETA_ACCEPTED

Option Beta is accepted only under the following exact interpretation.

Authority model

• U_legacy membership is derived from sealed #20 protected-target roots and exact #11 analyzer closure. No name/pattern/owner scan and no manually maintained legacy or exclusion list is authority.
• Every member has one uniform required end-state: owner is the approved unreachable qt001_cp_owner; object body/definition is unchanged; actual effective privileges equal the exact closed-world sealed #21 desired privilege rows; non-approved privileges are absent.
• relkind/prokind may select only a structural PostgreSQL execution adapter, such as the correct ALTER OWNER syntax. They cannot select policy, membership, privilege outcome, body mutation, or exception behavior.
• A boundary collision is never silently subtracted. If an object in the exact closure cannot receive the uniform end-state, the package fails closed and requires a separate owner decision.

Former-label mapping

Former label	Non-authoritative meaning under Beta
REVOKE_ONLY	Descriptive only: body unchanged; sealed #21 excludes executable or mutating rights.
STUB_FAIL_CLOSED	Removed and prohibited. No body replacement or body-restore path.
FREEZE_NO_CHANGE	Descriptive only: body unchanged; owner isolated; writer/non-reachability guards pass; sealed #21 excludes DML/EXECUTE.
DEPRECATE_READONLY	Descriptive only: any retained read access exists solely as exact sealed #21 SELECT/USAGE rows.
DO_NOT_TOUCH	Boundary description only, never a disposition or automatic exclusion. Collision with an approved protected boundary, including the #26 gateway identity, fails closed.

These labels may appear only in explanatory/package documentation and non-load-bearing logs. They must not appear as manifest authority, rule inputs/outputs, guard decisions, package branches, hash members, or SQL predicates.

Existing authority surfaces

Authority remains in existing #20 roots, #11 closure, #21 closed-world desired privileges, #26 protected gateway identity where relevant, manifest lifecycle/activation contracts, PG ownership/catalog facts, and existing operator authorization. No new surface or hash contract is created.