<!-- DOC_STATUS: ACTIVE_NON_AUTHORITY -->

FIX7 P0 - Owner / GPT FINAL Real-Data Decision Packet (2026-06-12)

This document selects nothing. Default = HOLD_REAL_DATA.

The final pre-real-data readiness lane is complete with status FIX7_P0_READY_FOR_REAL_DATA_DECISION. Every safely self-resolvable engineering gap is closed; the next step is exclusively a real-data / production-data decision. This packet is the single decision surface.

What is now proven (engineering side - all CLOSED)

• Birth/rollback pattern proven end-to-end on a generated production-shaped surrogate (marker GENERATED_SURROGATE_NOT_REAL_PRODUCTION_DUMP, 7 modeled schema entities incl. the Tier-0 approval gate) under the canonical hardened validator e6547e69..956c47: after_apply != before, after_rollback == before byte-exact. 12/12 bad-input probes fail closed.
• CI seal-vs-bytes gate adoption-ready off-production: canonical checker, sample sealed manifest, NOT-wired workflow stub, 9/9 byte-drift tests (adoption packet tree b22c08d0..f26d63).
• Canonical governance folded through TKT-OBJ-507 (next free 508); rollback of the fold proven byte-exact in staging.
• Full evidence: readiness packet tree b476b547..55cd90.

The options (pick exactly ONE; none is pre-selected)

#	option	what it authorizes	discharges
1	HOLD_REAL_DATA (DEFAULT)	nothing; state stays governed and rerunnable	-
2	AUTHORIZE_OPERATOR_REAL_DATA_CLONE_HANDOFF	operator delivers the production-shaped, secret-free, isolated REAL dump per the handoff spec; a separately-authorized lane re-runs this lane's rehearsal machinery on it (zero production contact)	real-dump leg of FIX7-P0-DRYRUN-PROD-ROLLBACK-1; FIX7-P0-OPERATOR-INPUT-1
3	AUTHORIZE_PRODUCTION_DRYRUN_ONLY	read-only, operator-safe production read to scope the real birth surface; NO mutation	FIX7-P0-PROD-BIRTH-SURFACE-1
4	AUTHORIZE_PRODUCTION_REALRUN_PRECHECK_ONLY	precheck of REAL_RUN preconditions only; NOT REAL_RUN itself	precondition evidence for FIX7-P0-PLAN-REALRUN-1
5	AUTHORIZE_PRODUCTION_EXECUTION	NOT selectable via this packet. Requires options 2+3 outcomes plus production OPT-4 (FIX7-P0-PROD-OPT4-1), a distinct production-rollback grant, the REAL_RUN grant, and per-action QT001/permit/activation/repoint/cutover grants	-

Hard boundaries

• P7 alone does not authorize production; no surrogate/rehearsal/fold grant extends to production.
• The surrogate is NOT real production data and must never be presented as such.
• Production CI wiring (FIX7-P0-PROD-CI-SCOPE-1) is its own owner/operator decision, independent of options 2-4.
• Until an option is recorded by the owner/GPT, the standing state is HOLD_REAL_DATA.