Seven Canonical SHA-256 Payload Key-Maps

Universal: digest(convert_to(jsonb_build_object('domain',domain,'schema_version',1,'payload',exact_object)::text,'UTF8'),'sha256'). Explicit keys; stated stable arrays; SQL NULL/unknown/implicit row JSON/unordered aggregation/floats/delimiter/MD5 forbidden; optional=JSON null.

H01 plan_content domain incomex.qt001.plan-content.v1 keys: plan_payload,policy_manifest,operator_manifest,tier_manifest,readiness_manifest_hash,capability_manifest,dependency_manifest_hash,hash_component_manifest,bootstrap_manifest,gateway_manifest,trigger_fingerprints,freeze_fingerprints,writer_source_hash. Excludes signoffs/lifecycle times. Arrays ordinal,item_id/object_identity. H02 control_state domain incomex.qt001.control-state.v1 keys: plan_content_hash,control_epoch,active_manifest_set,owner_acl_fingerprint,signoff_binding_hashes,capability_evidence_hashes,dependency_evidence_hashes,activation_state,post_activation_verifier_state. Orders type/version, target/tier/action/reviewer, evidence kind/id. H03 readiness domain incomex.qt001.readiness-manifest.v1 keys: manifest_envelope,gates,policy_rules,fact_adapters,primitives; envelope excludes lifecycle times; arrays ordinal/item_id. H04 signoff domain incomex.qt001.signoff-binding.v1 keys: target_id,plan_content_hash,scope_hash,tier_id,action_id,reviewer_principal_id,binder_principal_id,reviewer_human_identity_id,binder_human_identity_id,reviewer_evidence_hash,binding_evidence_hash,control_epoch,signed_at,bound_at,valid_until. H05 capability domain incomex.qt001.capability-evidence.v1 keys: capability_manifest,measurement_requirements,artifact_requirements,workload_profile,run,measurements,artifacts,environment; orders metric and artifact-kind/evidence. H06 dependency domain incomex.qt001.dependency-manifest.v1 keys: manifest_envelope,roots,edges,source_hashes,analyzer_contract,analyzer_run,dynamic_targets; root/edge/callsite+OID order. H07 activation domain incomex.qt001.activation.v1 keys: manifest_type_code,parent_manifest_id,parent_payload_sha256,candidate_manifest_id,candidate_payload_sha256,added_set_sha256,retired_set_sha256,impact_evidence_sha256,rollback_packet_sha256,requested_control_epoch,quorum_profile_hash,requester_principal_id.

Sensitivity required per key/add/delete/null/reorder/delimiter/mismatch; signoff changes H02/H04 not H01; epoch/ACL changes H02; drift changes H06/H02; gate change H03/H01/H02; activation input changes H07. Rollback recomputes under new epoch.