10 - Recommended Next Roadmap

Immediate Decision

Do not apply Tier1. Keep Tier2/Tier3 blocked. Defer Stage 3.

Next Macro Requirements

1. Governed plan/review/tier registries; remove fixed list/literal sign-off; writer enforces plan/Tier.
2. Permit binds approval, run ID, plan checksum/version, watermark, exact delta, collection, batch policy; enforce lifecycle.
3. Run/batch lifecycle with terminal permit consumption, range records, durable failure outside work transaction.
4. Stable keyset cursor metadata and range-based set operations; resume from last committed key.
5. Fix legacy single-colon semantics; automatic trigger/TG_ARGV-to-metadata scanner.
6. Reconcile duplicate birth triggers.
7. Separate current coverage, conserved history, duplicate identity, and trigger parity invariants.
8. Patch shared fn_birth_register collision behavior.
9. Versioned immutable snapshot with atomic pointer, TTL/checksum.
10. Paired executor/scanner DOTs; revoke PUBLIC EXECUTE.
11. Representative-volume performance gates.

No apply until wrong Tier, stale plan, reused permit, skipped range, duplicate trigger, collision, stale scanner, and false sign-off are structurally impossible.