<!-- DOC_STATUS: ACTIVE_NON_AUTHORITY -->

FIX7 P0 — Owner / GPT Production Decision Packet AFTER Rehearsal (2026-06-12)

This document selects nothing. Default = HOLD_PRODUCTION.

The production rehearsal-only lane is complete. A clone rehearsal proved the rollback pattern byte/row-exact with zero production risk. Production itself is still not authorized and remains separately gated.

What changed (rehearsal-only lane)

• Isolated local clone rehearsal executed: transactional BEGIN..ROLLBACK + committed + snapshot-restore, rollback PROVEN under the hardened validator (after_apply != before, after_rollback == before). Evidence packet tree 7a9364c5b64d95350da4023ad101a902fc77eb994c487f995412fe547bd847f9.
• 10/10 rehearsal bad-input probes fail closed; no production-PASS/seal token leaked.
• CI seal-vs-bytes UNKNOWN classified (not yet designed → design off-production first).
• FIX7-P0-DRYRUN-PROD-ROLLBACK-1 partially discharged (clone leg proven; production leg still OPEN).
• No production mutation, REAL_RUN, QT001/apply, permit/activation/repoint/cutover, CI/deploy trigger, or secrets change.

Options (choose exactly one; default HOLD)

1. HOLD_PRODUCTION (default, recommended) — do nothing further.
2. AUTHORIZE_PRODUCTION_DRYRUN_ONLY — production read-only dry-run (entry==exit), no mutation.
3. AUTHORIZE_PRODUCTION_REALRUN_PRECHECK_ONLY — real-run pre-checks, still no mutation.
4. AUTHORIZE_PRODUCTION_EXECUTION — actual production apply (requires ALL blockers resolved + per-action grants).

Preconditions before ANY production execution (all OPEN)

blocker	status	actor	gate
FIX7-P0-DRYRUN-PROD-ROLLBACK-1	partially discharged (clone leg)	operator (+sep. auth)	prove snapshot/restore on a production-shaped DB dump clone, then production rehearsal
FIX7-P0-PROD-CI-SCOPE-1	classified	owner + operator	design CI seal-vs-bytes gate off-production
FIX7-P0-PROD-BIRTH-SURFACE-1	OPEN	owner + operator	scope production object-birth surface (not invented)
FIX7-P0-PROD-OPT4-1	OPEN	owner	explicit production OPT-4
FIX7-P0-PLAN-REALRUN-1	OPEN	owner	separate REAL_RUN grant
FIX7-P0-PLAN-SEPARATE-AUTH-1	OPEN	owner	distinct grant per QT001-apply/permit/activation/repoint/cutover
FIX7-P0-OPERATOR-INPUT-1	narrowed	operator	production surface map + production-shaped clone/dump + snapshot/restore design

Recommendation

If you are not holding, the single highest-leverage next step is not a production option — it is a separately-authorized lane that proves snapshot/restore on an operator-provided production-shaped DB dump clone (still no production contact), extending the clone leg already proven here. Only after that, and only with production OPT-4 plus a distinct production-rollback grant, should a production rehearsal be considered. Do not jump to option 4 until every blocker above is closed and each irreversible action has its own explicit grant.