07 — Activation Matrix (Objective G)

Complete classification of every operation in the Phase-1 coverage surface, grounded in this run's live evidence. Legend: SAFE-NOW (read-only, no gate) · ROLLBACK-OK (rehearse in BEGIN..ROLLBACK) · TESTMODE-COMMIT (tiny inert reversible persist allowed in principle) · RATIFY-GATED (needs L2+L4 + ospa≥1) · FUTURE-DESIGN (substrate absent) · FORBIDDEN.

#	Operation	Classification	Live basis / why
1	Read seams / gap / conflict / effective-owner	SAFE-NOW	pure SELECT; done this run
2	Scanner read-half (summary + drill-down)	SAFE-NOW	doc 03; deterministic, bounded
3	Ownership seed — rollback-only rehearsal	ROLLBACK-OK	doc 02; 0 triggers, entry==exit proven
4	Issue/event payload shaping (SELECT)	SAFE-NOW	doc 05; no write
5	Ownership seed — persistent COMMIT	RATIFY-GATED	governed-state change; ospa=0; this is F-6 COMMIT
6	governance_ruleset row — persistent	RATIFY-GATED	unratified governed config (0 triggers, but gated)
7	governance_candidate_state populate	RATIFY-GATED	candidate population = activation precursor
8	candidate_scan_run ledger row — persistent	RATIFY-GATED	fabricates scan provenance unless real scan ratified/activated
9	gov_worker_cursor row — persistent	RATIFY-GATED	resume-point state for a worker that must not run yet
10	system_issues persistence	FORBIDDEN	9 triggers — not inert; cascade/notify on insert
11	event_outbox emit	FORBIDDEN	1 trigger (dispatch); + governance event types 0-active
12	governance event type activation (active=true)	FORBIDDEN	turns the emit path on; activation
13	Scanner write-half / worker loop	FORBIDDEN	production activation; unbounded run risk
14	Backfill	FORBIDDEN	production activation
15	DOT registration / run	FORBIDDEN	activation; 309 dot_tools untouched
16	Handler activation	FORBIDDEN	activation
17	UI / Nuxt / route mutation	FORBIDDEN	out of envelope
18	Directus / Qdrant mutation	FORBIDDEN	out of envelope (KB doc publish is the only external write, expected)
19	os_proposal_approvals / approval / e-sign write	FORBIDDEN	would forge sovereign authorization
20	Law enactment / version / status change	FORBIDDEN	out of scope
21	Axis coverage (registry/assignment/rule)	FUTURE-DESIGN	axis_* + coverage_rule ABSENT (doc 06)
22	Object-grain birth_registry scan	FUTURE-DESIGN / FORBIDDEN	~6.5 M cells, unbounded, no coverage_rule (doc 06)

Note on the TESTMODE-COMMIT column

The mission permits a tiny inert reversible persistent seed in principle. In practice every Phase-1 candidate seed (rows 5–9) also carries a RATIFY-GATED property (it persists governed ownership/config/provenance), so the test-mode-commit permission is subsumed by the ratification gate and resolves to NO for this surface. There is no Phase-1 item that is simultaneously (tiny + inert + reversible + useful-beyond-rollback + not-governed-state). Hence: nothing committed (doc 04).

The single unblock

Rows 5–9 move from RATIFY-GATED to executable the moment os_proposal_approvals ≥ 1 (backed by L2 quorum + L4 e-sign). Everything in rows 10–20 stays FORBIDDEN regardless — those are activation, not coverage-seeding. Rows 21–22 need new ratified substrate.