09 - Cross-Layer Boundary Self-Review (recheck-7)

Confirms the recheck-7 patch touched only the construction-document authority layer and left every hard boundary intact.

Invariants (unchanged)

AUTHORITY_SURFACES            = 27   (SSOT canonicalizer is a construction-doc TOOL, not a runtime surface)
RUNTIME_EVIDENCE_TABLES       = 11
NEW_READINESS_GATES           = 0    (the 5 new guards are TEST/VERIFICATION, not gate DATA rows)
NEW_TOP_LEVEL_HASH_CONTRACTS  = 0    (H01..H07 stay 7; canonicalizer_sha256 is a build-time pin, not a runtime hash contract)
PRODUCTION_MUTATION           = 0
MEMBERSHIP                    = f2bda8...fe251 (unchanged; SSOT artifact is NOT a member)

Accepted items NOT reopened

Active extractor (ACTIVE_EXTRACTOR_ACCEPTED); N1–N9 content-hash DAG (SEAL_HASH_GRAPH_DAG_ACCEPTED); invariants/boundary; runtime PG-first/native/driven; membership f2bda8…fe251; typed-set separation (U_legacy_object / U_effective_privilege_principal / U_entry_vector). Edits were additive (the SSOT pin, the revision-anchor demotion, the document_id/marker tightening, the NON_AUTHORITY_EXPLANATION banners) — no accepted item changed.

Hard blocks (all still BLOCKED)

Implementation; Stage 2.6B; qt001_backfill_permit; REAL_RUN; QT001 apply; manifest activation; repoint; owner/ACL cutover. The package split (PKG-A..I) is unchanged except PKG-A preconditions now also require the 5 new guards + the canonicalizer --selftest exit 0, and PKG-I validates "all 63". No package unblocked.

Layer check

layer	touched this pass?
runtime schema / surfaces / gates / hash contracts	no
legacy set model / disposition	no
construction-document authority (canonicalizer SSOT, envelope, anchor, document_id, marker)	yes (the entire recheck-7 scope)
guards (doc 06)	yes (+5 TEST/VERIFICATION guards, rule 12)

Law boundary (prompt-muc-tieu-mo-for-claude-code.md)

No governance_change; no DDL/DML; no production mutation; AUTHOR_MODE_ONLY blueprint revision. The seal is performed by Codex at recheck 8 (not by T1). Verdict: RECHECK7_CROSS_LAYER_SELF_REVIEW_PASS.