Codex Stage 2.6A FIX6 Self-Audit

Status: COMPLETE - STAGE2_6A_FIX6_FAIL_HARDCODE_OR_BYPASS_STILL_DANGEROUS

FIX6 is more honest than FIX5 and correctly blocks the current apply path, but its claimed self-audit, hardcode, signoff-identity, capability-proof, and readiness guarantees contain false-green paths. Critical defects: mutable readiness denominator; Directus owner/DML authority over 262/262 control objects; self-audit and hardcode v7 pass while bypass remains; spoofable signoff identity; self-attested capability evidence; non-canonical MD5 hash; hardcoded/regex proof coverage.

The foundation is not acceptable for 2.6B. No production mutation, permit, apply, backfill, or birth action is authorized.