02 - Design-to-Live Mapping

<!-- DOC_STATUS: ACTIVE_AUTHORITY --> <!-- AUTHORITY_BOUNDARY: registry in 00-readme-first.md §Active-authority boundary; this file is load-bearing normative blueprint and IS consumed by implementation authoring -->

CODEX RECHECK-3 PATCH (2026-06-09) — typed set separation. Codex recheck 3 accepted the Option-Beta disposition removal but found the single name U_legacy was used for a mixed denominator that unioned PG objects, principals, and entry-vectors and then asserted both-EXCEPT object equality over that union (a type error: a principal/vector cannot own, have a body, or carry object state). The model is now split into three distinct typed universes and U_legacy means U_legacy_object everywhere unless explicitly stated otherwise: U_legacy_object (PG objects only — the uniform end-state set), U_effective_privilege_principal (roles only — the privilege-evaluation universe), U_entry_vector (trigger/event-trigger/ scheduler/DOT/external — the bypass-coverage universe). The uniform-end-state both-EXCEPT runs ONLY over PG objects; privilege equality runs over the object × principal join; bypass coverage runs over entry-vectors mapped to a target object (never membership). Guards G-U-LEGACY-OBJECT-ONLY, G-PRINCIPAL-SET-SEPARATE, G-ENTRY-VECTOR-SEPARATE (doc 06). See §H.

OPTION-BETA PATCH (2026-06-08) — legacy-disposition model REMOVED; uniform authority-neutralized end-state through approved primitives. Codex (design owner) approved Option Beta for the blocker-C legacy-disposition amendment (codex-fix7-legacy-disposition-design-amendment-2026-06-08/, status FIX7_LEGACY_DISPOSITION_DESIGN_AMENDMENT_APPROVED_OPTION_BETA). T1 has patched this blueprint to that ruling. The five-value disposition enum, the LEGACY_* #20 object_type semantics, the computed/classifier/truth-table/CASE-branch disposition, the external-artifact policy, STUB_FAIL_CLOSED / legacy body mutation / body-restore source, the DO_NOT_TOUCH subtraction from U_legacy, and all policy branching by relkind/prokind/object-name/owner/ pattern/label are removed from load-bearing design.

Under Option Beta there is one uniform required end-state for every member of U_legacy: (1) the object is owner-isolated to the approved NOLOGIN, non-superuser, unreachable qt001_cp_owner; (2) its body/definition is unchanged (no stub, no body mutation, no body restore); (3) its actual effective privileges exactly equal the closed-world sealed privilege_set_manifest #21 desired-privilege rows (both-EXCEPT, role-membership-aware), so no directus/runtime authority remains except where #21 explicitly grants a read-only privilege; (4) unsupported object classes and protected-boundary collisions fail closed and require a separate owner decision — they are never silently subtracted or routed later. relkind/prokind select only PostgreSQL syntax (which ALTER ... OWNER / REVOKE / privilege-verification form to emit), never policy, membership, privilege outcome, or exception behavior.

Authority lives only in existing approved primitives: PG ownership, sealed #20 protected_target roots, exact #11 analyzer closure, the closed-world sealed #21 privilege set, the #26 protected-gateway identity, the #27 writer-repoint bindings, control_epoch, the manifest lifecycle/activation contracts, and evidence_registry (for evidence only). No new authority surface, #20 column, catalog family, readiness gate, or top-level hash contract is added. The recheck-2 in-blueprint fixes (A owner-unreachable, B independent #20-root denominator, D typed operator authorization, E forward-only rollback source, F superuser break-glass, G forward-only history, H author→rehearse→seal order) all remain valid and are unchanged by this patch. Implementation and every live gate remain BLOCKED pending Codex recheck 3.

Each approved FIX7 component is mapped to its live state, classification, required action, and action type. Action types: KEEP / MODIFY / ADD / REPLACE / OWNER_ISOLATE / OPERATOR_GATED / HARD_BLOCK. Design source unless noted: codex-fix7-spec-artifact-correction-... (byte DDL doc 02; catalog doc 04; hash doc 07; thresholds doc 06) and codex-fix7-design-correction-from-t1-rp-refinements-... (runtime-evidence doc 02; consolidated DDL/constraint catalog doc 06; Directus read doc 07) and the CP-06 hash micro-patch package, as amended by the Option-Beta legacy-disposition design amendment.

A. Foundation (roles, schema, domains, catalog root, anchors)

Component	Live	Classification	Action	Type
roles qt001_cp_owner/migrator/reader	absent	MISSING_ADD	create NOLOGIN roles	ADD (op-gated)
schema qt001_cp	absent	MISSING_ADD	create AUTHORIZATION owner	ADD (op-gated)
domains sha256,nonempty_text,positive_bigint,nonnegative_bigint	absent	MISSING_ADD	create	ADD (op-gated)
code_catalog_set/_family/_item (catalog root, doc 04)	absent (legacy has no catalog root)	MISSING_ADD	create + sealed bootstrap + owner-only immutable	ADD (op-gated)
manifest_set, manifest_item_envelope	absent	MISSING_ADD	create (global-unique item_id conservation)	ADD (op-gated)
operator_operand_compatibility	absent	MISSING_ADD	create (RP-03 step 5)	ADD (op-gated)

B. The 27 authority surfaces (exact-set; all MISSING_ADD, all ADD op-gated)

All 27 are absent live and added as qt001_cp child contracts. None maps to a legacy table in-place; legacy equivalents are REPLACE targets (col C).

#	Surface	Legacy object it supersedes	Classification
01	policy_rule_manifest	qt001_tier_rule_registry(_v2) (predicate rows)	MISSING_ADD
02	operator_primitive_manifest	fn_qt001_eval_predicate_v2/eval_rule_* operators	MISSING_ADD
03	metric_manifest	(none; new)	MISSING_ADD
04	unit_manifest	(none; new)	MISSING_ADD
05	storage_class_manifest (owns retention/archive)	qt001_runtime_config (retention/partition part only; its driver batch/runaway config maps to sealed adapter behavior, not retention - XH-1)	MISSING_ADD
06	principal_class_manifest	qt001_authority_identity_registry (class semantics)	MISSING_ADD
07	authority_action_manifest	(implicit in legacy)	MISSING_ADD
08	principal_separation_manifest	(implicit; same-human checks)	MISSING_ADD
09	readiness_gate_manifest (hosts 14 gate DATA rows)	qt001_readiness_guard_registry_v9 + readiness views	MISSING_ADD
10	hash_component_manifest (hosts 7 H01..H07 contracts)	fn_qt001_plan_fingerprint_v*/fp_compose*/rule_checksum	MISSING_ADD
11	dependency_manifest	qt001_authoritative_object_registry + callgraph views	MISSING_ADD
12	bypass_vector_manifest	v_qt001_no_bypass_proof_* views	MISSING_ADD
13	capability_manifest	qt001_capability_contract/_behavior_registry	MISSING_ADD
14	capability_measurement_requirement	qt001_capability_operational_evidence (req side)	MISSING_ADD
15	capability_artifact_requirement	(none; new)	MISSING_ADD
16	signoff_requirement_manifest	fn_qt001_signoff_row_valid_v* (requirement side)	MISSING_ADD
17	tier_manifest	qt001_tier_registry	MISSING_ADD
18	activation_policy_manifest	(none; new)	MISSING_ADD
19	quorum_requirement_manifest	(none; new)	MISSING_ADD
20	authority_scope_manifest (TABLE/CONSTRAINT/INDEX/runtime-evidence + expected-constraint)	qt001_hardcode_inventory (object set)	MISSING_ADD
21	privilege_set_manifest (Directus read contract + the closed-world desired-privilege set)	(none; ACL was ad-hoc)	MISSING_ADD
22	dynamic_sql_target_manifest	(legacy TG_ARGV scan diagnostics)	MISSING_ADD
23	workload_profile_manifest	(none; scale evidence was free-text)	MISSING_ADD
24	analyzer_contract_manifest (binds adapter input set + the #11 closure analyzer)	(none; new)	MISSING_ADD
25	plan_payload_manifest	qt001_plan_registry/_snapshot/_content_binding	MISSING_ADD
26	gateway_manifest	registers/binds the QT001 control-plane writer gateway (identity + source_sha256 + fail_closed + protected_target_set_sha256); records the existing gateway/birth_gateway_release_registry identity for fail-closed reference. It does NOT replace fn_birth_registry_auto - the birth gateway stays a HARD_BLOCK boundary (XHigh-MAP)	MISSING_ADD
27	writer_repoint_manifest	the repeated FIX..FIX6 repoint act, now declarative	MISSING_ADD

Net new authority surfaces vs approved design: 0 (exactly 27; the legacy objects in col C are NOT authority surfaces under FIX7 and are REPLACE targets, not additions).

C. The 11 runtime-evidence tables (non-authority; all MISSING_ADD)

signoff_binding, capability_run, capability_measurement, capability_artifact, gate_fact_result, bypass_vector_fact_result, quorum_vote, denied_attempt_evidence, dashboard_export, level_b_packet_execution, post_activation_verifier_state.

Property	Mapping
live state	absent
authority?	NO - non-authority runtime facts/evidence; enumerated by typed #20 rows
owner	qt001_cp_owner; Directus/PUBLIC no access; append-only after finalization
7 of 11 partitioned	measurement/artifact/gate_fact/bypass_fact/denied/dashboard/level_b RANGE on event time
hash binding	H04->signoff_binding; H05->capability_run/measurement/artifact; H02->signoff+capability+post-activation

These must NEVER be counted among the 27. Guard G-RUNTIME-NONAUTH (doc 06) enforces the count.

D. Sealed DATA components (manifest rows, not new schema)

Component	Hosted in surface	Classification	Type
14 readiness gates	readiness_gate_manifest #09 rows	MISSING_ADD (DATA)	ADD op-gated (seal)
7 hash contracts H01..H07	hash_component_manifest #10 rows	MISSING_ADD (DATA)	ADD op-gated (seal)
H04_SCOPE_V1 (8-key scope)	#10 + signoff_binding cols	MISSING_ADD (DATA)	ADD op-gated
H02/H05 total orders	#10 stable_order_key[] rows	MISSING_ADD (DATA)	ADD op-gated
expected-constraint set	typed #20 CONSTRAINT/INDEX rows + table expected_constraint_set_sha256	MISSING_ADD (DATA)	ADD op-gated
U_legacy protected-target roots	#20 protected_target = true TABLE rows + #26 protected_target_set_sha256	MISSING_ADD (DATA)	ADD op-gated (seal)
U_legacy closure	dependency_manifest #11 reverse edges from #24 analyzer	MISSING_ADD (DATA)	ADD op-gated (seal)
closed-world desired privilege set (U_legacy end-state)	privilege_set_manifest #21 rows	MISSING_ADD (DATA)	ADD op-gated (seal)
catalog-family enforcement	3 exact-set families in catalog root	MISSING_ADD (DATA)	ADD op-gated
item_payload descriptive-only	enforced by #24 + dependency_manifest edges	MISSING_ADD (rule)	ADD op-gated
same-human slot-scope	signoff_binding UNIQUE + #08 separation	MISSING_ADD (rule)	ADD op-gated
retention/partition policy	storage_class_manifest #05 rows	MISSING_ADD (DATA)	ADD op-gated
Directus read contract	privilege_set_manifest #21 rows	MISSING_ADD (DATA)	ADD op-gated (preserves existing Directus SELECT)
control_epoch	column on activation + runtime-evidence	MISSING_ADD	ADD op-gated
Level-B pipeline	level_b_packet_execution + #21	MISSING_ADD	ADD op-gated
evidence/principal/human-identity registries	3 support tables	MISSING_ADD	ADD op-gated
analyzer_run / source-hash	analyzer_run + #24	MISSING_ADD	ADD op-gated

There is no disposition column, no LEGACY_* object_type row, no legacy_disposition catalog family, and no expected_legacy_set_sha256 column anywhere in this set (Option Beta). The U_legacy end-state is carried entirely by the rows above (ownership + #21 + #20/#11/#26/#27 seal).

E. Legacy / live system mapping (uniform end-state; no disposition labels)

Under Option Beta there is no per-object disposition. Every member of the sealed U_legacy set (§H) converges to the single uniform authority-neutralized end-state: owner-isolated to qt001_cp_owner, body unchanged, effective privileges exactly equal to the sealed #21 rows. The table below records only the live inventory and which approved primitive carries each object's neutralization — not a policy branch.

Live component	In U_legacy?	Uniform end-state (Option Beta)	Type
legacy qt001 routines (live: 45 functions + 1 procedure; §H.1)	yes, where #11 reverse-closure from the sealed #20 protected_target roots reaches them	owner-transfer off directus → qt001_cp_owner FIRST (PG owner semantics, live-proven sufficient for effective-EXECUTE=0), then effective privileges reconciled to exact sealed #21 (legacy routines hold no #21 EXECUTE grant → effective EXECUTE = 0 for every non-owner, non-superuser principal); body unchanged (no stub); authoritative callers repointed via #26/#27	OWNER_ISOLATE + #21 (op-gated)
20 legacy qt001_* tables	they are the protected-target roots (#20 protected_target TABLE rows) and any that #11 closure reaches	owner-isolated to qt001_cp_owner; effective privileges = sealed #21 (writes absent; any retained SELECT exists only because a #21 SELECT row grants it); body/definition unchanged; never live-DROPped (forward-only retention, a safety invariant, not a disposition)	OWNER_ISOLATE + #21 (op-gated)
196 legacy qt001 views (by %qt001%; §H.1)	yes, where reached by #11 closure / carrying effective grants	owner-isolated; effective privileges = sealed #21 (read access retained iff a #21 SELECT row grants it); definition unchanged; never DROPped	OWNER_ISOLATE + #21 (op-gated)
legacy apply fn_dot_birth_qt001_apply/sp_dot_birth_qt001_apply	yes (writers of protected state)	the same uniform end-state — owner-isolated, body unchanged, no #21 EXECUTE grant → effective EXECUTE = 0; their fail-closed property comes from being unreachable (owner-isolated + no EXECUTE), NOT from a body stub. QT001 apply remains independently BLOCKED_UNTIL_AUTHORITY	OWNER_ISOLATE + #21 (op-gated)
birth gateway (5 fns + 6 relations)	NO — different layer; not reached by #11 closure from QT001 protected_target roots. If a future closure DID reach it, that is a boundary collision → fail closed, never an automatic exclusion	HARD_BLOCK boundary (doc 08); referenced by #26 only; protected by G-BIRTH-NEUTRAL + policy	HARD_BLOCK
DOT-118 / DOT-119	NO — frozen deploy artifacts; out-of-scope boundary. Collision → fail closed	HARD_BLOCK boundary; keep frozen	HARD_BLOCK
directus ownership of all control objects	the control objects in U_legacy reach the uniform end-state at S15; remaining control objects at S16	transfer to qt001_cp_owner; effective privileges reconciled to #21 (residual directus/PUBLIC authority removed; Directus SELECT re-granted exactly via #21)	OWNER_ISOLATE + #21 (op-gated)
Directus SELECT read set on business base tables	n/a (not legacy QT001 control objects)	preserved identically via #21; Directus retains full authority over its own directus_* app tables and the business base tables it legitimately owns (XH-4)	KEEP (op-gated)

DO_NOT_TOUCH is not a row in this table and not a disposition: the birth gateway and DOTs are out-of-scope hard-block boundaries (doc 08 §A/§B), never subtracted from U_legacy.

F. Hash contracts H01..H07 mapping

Contract	Meaning (approved)	Live equivalent	Classification
H01	top-level composite (recomputes transitively)	fn_qt001_plan_fingerprint_v5 composite	MISSING_ADD (DATA)
H02	capability + post-activation total order	(none, byte-pinned in CP-06 patch)	MISSING_ADD
H03	unchanged contract	n/a	MISSING_ADD
H04	signoff scope (8-key H04_SCOPE_V1) + evidence deref to evidence_registry.artifact_sha256	qt001_signoff_plan_binding (loose)	MISSING_ADD
H05	capability measurements/artifacts total order	qt001_capability_operational_evidence	MISSING_ADD
H06	unchanged	n/a	MISSING_ADD
H07	unchanged	n/a	MISSING_ADD

New top-level hash contracts vs approved design: 0 (exactly 7). There is no expected_legacy_set_sha256 and no disposition-rule hash — the U_legacy set integrity is the existing manifest seal (manifest_set.payload_sha256 + per-row manifest_item_envelope.item_sha256) over the #20 roots + #11 closure, plus the #26 protected_target_set_sha256.

G. Traceability note - operations beyond literal design (now amendment-confirmed)

Two refactor steps are T1 operationalization of the approved design; both are now governed by the Codex-approved Option-Beta amendment, so they are no longer open "confirmation" items but amendment-anchored:

1. S15 uniform legacy neutralization with owner isolation. Because directus (live: a non-superuser, rolsuper=false) owns every legacy routine, REVOKE alone cannot remove the owner's implicit EXECUTE; so within one atomic operator transaction every supported U_legacy member is first ownership-transferred off directus to qt001_cp_owner, THEN its effective privileges are reconciled to the exact sealed #21 rows (both-EXCEPT, role-membership-aware) over the COMPLETE sealed U_legacy set (§H), with no body change for any member (Option Beta; STUB_FAIL_CLOSED is removed). relkind/prokind choose only the PG syntax (ALTER FUNCTION vs ALTER TABLE vs ALTER VIEW OWNER; the REVOKE/privilege-verification form), never a different outcome. The operational membership is the sealed #20 protected_target roots + #11 closure + #27 bindings, both-EXCEPT-equal to the closed denominator §H.4, NOT a name pattern or a prose count. Introduces no new authority surface, readiness gate, hash contract, #20 column, or catalog family.
2. S17/S18 legacy retention of the superseded 20 tables / 46 fns / 196 views. This applies the same uniform end-state (owner-isolated, effective privileges = sealed #21, body unchanged) and retains the objects forward-only (append-only/new-version, never live DROP). It is not a FREEZE_NO_CHANGE/DEPRECATE_READONLY disposition — the only thing that decides whether a superseded object keeps any read access is whether a sealed #21 SELECT row grants it.

Both are consistent with the approved 27/11/14/7 model and the Option-Beta amendment, and change none of the invariants.

H. The set model — object set, principal set, entry-vector set — and the uniform Option-Beta end-state (PG-native authority)

This section replaces the prior "sealed legacy-disposition set" (§H/§I) that recheck 2 ruled unapproved. Under Option Beta there is no disposition layer at all — there is one uniform authority-neutralized end-state for every in-scope PG object. Name patterns and owner filters are diagnostic candidate-discovery only; they never decide membership, the end-state, or any branch.

Three distinct typed universes (Codex recheck-3 fix). The earlier text used the single name U_legacy for a denominator that unioned unlike identity types (objects, principals, entry-vectors) and then asserted object-shape both-EXCEPT over the union — a type error. They are now separated; each is a homogeneous typed set and no set is a member of another (mixed-type membership FAILS CLOSED):

set	identity type	role in the proof	uniform end-state applies?	guard
U_legacy_object	PG object — regclass (table/view/sequence) or regprocedure (function/procedure); relkind/prokind = syntax discriminator only	the in-scope object set; the both-EXCEPT exact-set proof (§H.4.A)	YES — owner isolated, body unchanged where applicable, object effective-privileges == sealed #21	G-U-LEGACY-OBJECT-ONLY
U_effective_privilege_principal	PG role identity — PUBLIC pseudo-role + every relevant rolcanlogin/member role, pg_auth_members-expanded; controlled owner qt001_cp_owner excluded from removable-privilege equality; superusers dispositioned separately	the privilege-evaluation universe; joined to objects (§H.4.B)	NO — a role is not an object; it cannot be owner-isolated or carry a body/#21 object state	G-PRINCIPAL-SET-SEPARATE
U_entry_vector	entry vector — pg_trigger / pg_event_trigger / scheduler entry / frozen DOT / external entrypoint	the bypass-coverage universe; mapped to objects (§H.4.C)	NO — a vector is not an object; it is covered by reachability + independent-block, never owner/body/#21	G-ENTRY-VECTOR-SEPARATE

U_legacy ≡ U_legacy_object for the remainder of this blueprint unless a sentence explicitly names the principal or entry-vector universe. The uniform end-state and its both-EXCEPT exact-set proof apply only to U_legacy_object (§H.3/§H.4.A); the principal universe is used only to evaluate privileges as the join U_legacy_object × U_effective_privilege_principal against sealed #21 (§H.4.B); the entry-vector universe is used only to prove bypass coverage — every vector targets a U_legacy_object member or is independently blocked (§H.4.C).

H.1 Why a name pattern cannot be authority (live proof, read-only, DB directus, 2026-06-08)

The same live catalog yields a different "legacy set" for every pattern an implementer might pick:

query (schema public)	result
routines proname LIKE '%qt001%'	45 functions (prokind f) + 1 procedure (prokind p) = 46 routines
routines matching the prefix list fn_qt001%/sp_qt001%/fn_dot_birth_qt001%/sp_dot_birth_qt001%	45 functions + 1 procedure (no routine sits outside the prefix list - verified 0 extra)
views relname LIKE 'qt001%'	0
views relname LIKE 'v_qt001%'	183
views relname LIKE '%qt001%'	196
tables relname LIKE 'qt001%', relkind r	20
routines with qt001 in name outside schema public	0

All 46 routines: owner directus, proacl = NULL (PUBLIC EXECUTE), prosecdef = false. All 196 views: owner directus. The view count alone swings 0 → 183 → 196 purely by choice of literal. A load-bearing set that changes with the literal is disguised hardcode. The count is evidence, never authority.

H.2 Membership: the closed PG-native U_legacy_object set (PG objects only; no disposition, no subtraction)

U_legacy_object is a single sealed in-scope set of PG object identities — each member addressable as regclass (table/view/sequence) or regprocedure (function/procedure), with pg_class.relkind/pg_proc.prokind as a syntax discriminator only. A principal (role) or an entry vector (trigger/event-trigger/scheduler/DOT/external) is never a member; those belong to U_effective_privilege_principal (§H.4.B) and U_entry_vector (§H.4.C) respectively, and G-U-LEGACY-OBJECT-ONLY fails closed on any non-object member. The set is defined entirely from sealed catalog/manifest facts:

U_legacy_object = closure( dependency_manifest #11 ,
                           roots = authority_scope_manifest #20 rows with protected_target = true,
                                   bound to the candidate manifest and hash-sealed by
                                   gateway_manifest #26 protected_target_set_sha256 )
                  -- PG object identities only (regclass / regprocedure); reverse write-effect closure

• The roots are the sealed #20 protected_target TABLE rows — first-class in the approved design, the gateway's reason to exist — hash-sealed by #26 protected_target_set_sha256 before use. The roots are an independent approved authority, not defined by the closure they seed and not by a name scan.
• The closure is derived by the sealed analyzer (analyzer_contract_manifest #24, analyzer_run evidence) into dependency_manifest #11 reverse edges (root = protected target, dependency = writer routine, analyzer_run_id + evidence_id bound) — pg_depend where native plus #11 edges and dynamic_sql_target_manifest #22 rows for PL/pgSQL body calls and dynamic SQL that pg_depend cannot see. Dynamic/unsupported/unresolved edges the analyzer cannot resolve FAIL CLOSED (the run is UNRESOLVED, blocking seal), never silently dropped.
• No DO_NOT_TOUCH subtraction. Option Beta removes the − DO_NOT_TOUCH term. U_legacy is the exact closure with no manual exclusion and no policy exclusion by object class. The birth gateway and DOTs are not subtracted; they are simply not in the closure (different layer, not writers of QT001 protected targets). If the closure ever reaches a protected-boundary object (the #26 gateway identity, the birth gateway, a frozen DOT, or any object that cannot receive the uniform end-state), that is a boundary collision → the package FAILS CLOSED and requires a separate owner decision — it is never silently excluded.
• Exact-set proof (both-EXCEPT, object-shape only). The sealed U_legacy_object set is both-EXCEPT compared against the object-shape closed denominator (§H.4.A) — the same PG-object identity type on both sides: sealed − denominator = ∅ AND denominator − sealed = ∅, with count(UNKNOWN_REQUIRES_REVIEW) = 0. Principals and entry-vectors are NOT in this comparison (they are evaluated by the separate privilege join §H.4.B and the bypass-coverage relation §H.4.C). Name/owner scans may only widen candidate discovery; they never define or close the set. Guards G-LEGACY-TARGET-CLOSED-DENOMINATOR, G-LEGACY-TARGET-SEALED, and G-U-LEGACY-OBJECT-ONLY (doc 06) enforce this.

U_legacy is manifest-bound (#11/#22/#20/#26 roots; #27 repoint bindings), sealed, integrity-bound by the existing manifest seal, PG-native, and not name-pattern authority. It introduces no LEGACY_* object_type row, no disposition column, no new catalog family, and no new hash — the #20 rows it uses are the already-approved protected_target TABLE rows (§2.7-sanctioned), and the writer set is the #11 closure, not a typed legacy-object family.

H.3 The uniform Option-Beta end-state (one condition for every U_legacy_object member)

Every member of the sealed U_legacy_object set (PG objects only) converges to the same authority-neutralized condition. There is no per-object disposition, no classifier, no truth table, no CASE branch:

1. Owner isolated. ALTER ... OWNER TO qt001_cp_owner for every supported member. qt001_cp_owner is NOLOGIN, non-superuser, holds no grant to any login role, and has no inbound pg_auth_members membership from any rolcanlogin role (G-OWNER-UNREACHABLE) — so the owner-implicit privilege is held by an unreachable principal. relkind/prokind choose only the syntax form.
2. Body unchanged. No object body or definition is mutated, replaced, or stubbed. (pg_get_functiondef / pg_get_viewdef digest unchanged.)
3. Effective privileges = exact sealed #21. Actual effective privileges (computed over the separate principal universe U_effective_privilege_principal — non-superuser, non-owner roles via proacl/relacl/pg_attribute.attacl expanded through pg_auth_members, §H.4.B — joined to each object) are reconciled to exactly the closed-world sealed privilege_set_manifest #21 desired-privilege rows, compared both-EXCEPT (realized − desired = ∅ AND desired − realized = ∅). For legacy routines #21 grants no EXECUTE → effective EXECUTE = 0. For tables/views any retained SELECT/USAGE exists only because an exact #21 row grants it; everything else is absent. Absence is authoritative only because #21 is complete, sealed, and expected-count/hash bound.
4. No directus/runtime authority remains except where #21 explicitly grants a read-only privilege.
5. Superuser disposition. The cluster superuser workflow_admin (rolsuper/rolbypassrls) inherently bypasses object ACL and is excluded from the effective-privilege claim, recorded as an accepted out-of-band property (G-SUPERUSER-BREAKGLASS) — never silently included in a "=0" aggregate.
6. Fail closed on unsupported object class, protected-boundary collision, incomplete #21 coverage, analyzer uncertainty, privilege mismatch, or rollback-evidence failure.

Guard G-U-LEGACY-OPTION-BETA-UNIFORM-ENDSTATE (doc 06; the amendment's G-LEGACY-UNIFORM-NEUTRALIZATION) verifies (1)+(2)+(3) hold for every member; G-LEGACY-NO-DISPOSITION-AUTHORITY verifies that no enum, LEGACY_* row, disposition field/rule/payload, label-driven branch, or STUB/body path exists; G-NOLEGACY-POST verifies the exact post-state and remains fail closed.

H.4 The three typed comparison universes (object both-EXCEPT, privilege join, bypass coverage)

The earlier single denominator rule1 ∪ rule2 ∪ rule3 mixed PG objects (rule1), principals (rule2), and entry-vectors (rule3) and then asserted object both-EXCEPT over the union. That is a type error: a principal/vector cannot own, have a body, or carry object state, so it cannot be both-EXCEPT-equal to a regclass/regprocedure set nor receive the uniform end-state. The single denominator is replaced by three typed relations, each compared in its own identity shape, with no DO_NOT_TOUCH subtraction (Option Beta):

H.4.A — Object denominator (the uniform-end-state both-EXCEPT; PG objects only)

The denominator that U_legacy_object is proven both-EXCEPT-equal to is the reverse write-effect object closure — the same regclass/regprocedure identity shape on both sides:

• from the sealed #20 protected_target TABLE rows (hash-bound by #26 protected_target_set_sha256 before use), the closure is derived by the sealed analyzer (analyzer_contract_manifest #24 / analyzer_run) into dependency_manifest #11 reverse edges + dynamic_sql_target_manifest #22 rows for body-call / dynamic-SQL edges pg_depend cannot see. Unresolved/unsupported edges FAIL CLOSED (UNRESOLVED run blocks seal).
• object_denominator = reverse_write_effect_closure(#11/#22, roots = #20 protected_target) — PG object identities only.
• proof: U_legacy_object − object_denominator = ∅ AND object_denominator − U_legacy_object = ∅, count(UNKNOWN_REQUIRES_REVIEW) = 0, both sides typed as PG object identities. A candidate a name scan missed but the closure reaches MUST be in the sealed set; a name hit the closure does not reach is not in it.
• Boundary collision is a typed object-identity intersection. If the closure reaches a protected-boundary object (the #26 gateway identity, the birth gateway, a frozen DOT, or any object that cannot receive the uniform end-state), the package FAILS CLOSED for a separate owner decision — never auto-excluded, never subtracted, never routed later.
• guards: G-LEGACY-TARGET-CLOSED-DENOMINATOR (object both-EXCEPT, no subtraction) + G-U-LEGACY-OBJECT-ONLY (every member is a PG object identity; no principal/vector member).

H.4.B — Privilege universe (the object × principal join; reconciled to sealed #21)

Effective privilege is not a membership question over U_legacy_object; it is a property of each (object, principal) pair. The principal universe is separate and typed:

• U_effective_privilege_principal = the PUBLIC pseudo-role plus every relevant login/member role derived through pg_auth_members role-membership expansion. The controlled owner qt001_cp_owner is excluded from the removable-privilege equality (it holds owner-implicit privilege as an unreachable NOLOGIN principal — G-OWNER-UNREACHABLE); superusers (live: workflow_admin) are dispositioned separately as inherently ACL-bypassing (G-SUPERUSER-BREAKGLASS).
• the comparison is the join U_legacy_object × U_effective_privilege_principal producing the privilege-tuple set (object_identity, principal_identity, privilege_kind, grant_option / column scope where applicable), reconciled both-EXCEPT to the closed-world sealed privilege_set_manifest #21 over that exact tuple shape: realized − #21 = ∅ AND #21 − realized = ∅. For every legacy routine #21 grants no EXECUTE/DML, so effective EXECUTE = 0 for every non-owner, non-superuser principal; for tables/views any retained SELECT/USAGE exists only because an exact #21 tuple grants it.
• a principal is never a member of U_legacy_object; it appears only on the principal side of this join. G-PRINCIPAL-SET-SEPARATE fails closed if a principal identity is injected into the object set, or if the privilege check is run as object-membership instead of the tuple join.
• guards: G-PRINCIPAL-SET-SEPARATE, G-NOLEGACY-POST, G-U-LEGACY-OPTION-BETA-UNIFORM-ENDSTATE (all over the object × principal tuple shape).

H.4.C — Entry-vector coverage (bypass reachability, not membership)

A trigger / event-trigger / scheduler entry / frozen DOT / external entrypoint is an entry vector, not an object in U_legacy_object. It is evaluated as a coverage relation, never as a set member:

• U_entry_vector = every entry vector over pg_trigger, pg_event_trigger, the scheduler registry, the frozen DOTs, and any external entrypoint that could reach a write of protected state.
• coverage requirement: every vector in U_entry_vector must either (a) target a U_legacy_object member — so neutralizing that object (owner-isolation + #21) neutralizes the vector — or (b) be independently blocked (frozen DOT via G-DOT-FROZEN; disabled/unauthorized scheduler; operator-gated entrypoint). An uncovered vector (one that reaches protected write-state through neither a neutralized object nor an independent block) FAILS CLOSED.
• live read-only evidence 2026-06-08: 0 trigger/event-trigger bypass vector over the qt001 set; DOT-118/119 frozen (G-DOT-FROZEN); no scheduler entry enabled. The relation remains so a future trigger/scheduler/DOT cannot silently add a writer.
• a vector is never a member of U_legacy_object and is never subject to owner/body/#21 object proof. G-ENTRY-VECTOR-SEPARATE enforces both the non-membership and the fail-closed coverage.

Summary. Object membership (H.4.A) is a regclass/regprocedure both-EXCEPT; privilege (H.4.B) is the object × principal tuple reconciliation to sealed #21; bypass (H.4.C) is entry-vector → object reachability with an independent-block fallback. The three are evaluated in their own identity shapes; unknown, unresolved, uncovered vector, mixed-type injection, or protected-boundary collision FAILS CLOSED.

H.5 Establishment order — object membership, then privilege evaluation, then vector coverage (no name authority)

1. S00 discovery (diagnostic): enumerate candidates by name + owner over pg_class/pg_proc. Output is candidate evidence only and is explicitly non-binding.
2. Object membership (objects only): a candidate enters U_legacy_object only via the #11/#22 reverse write-effect object closure from the sealed #20 roots (§H.4.A). Effective-privilege and entry-vector facts are NOT membership criteria — they are evaluated downstream over the already-fixed object set. There is no classification into a disposition; every included object receives the single uniform end-state.
3. Object exact-set proof (§H.4.A): U_legacy_object both-EXCEPT-equal to the object denominator, 0 unknown, protected-boundary collisions fail closed.
4. Privilege evaluation (§H.4.B): build U_effective_privilege_principal, join it to U_legacy_object, and reconcile the privilege tuples both-EXCEPT to sealed #21 (owner excluded from removable-privilege equality; superuser dispositioned).
5. Entry-vector coverage (§H.4.C): build U_entry_vector, prove every vector targets a U_legacy_object member or is independently blocked; an uncovered vector fails closed.
6. Seal (S12, OPERATOR + quorum): only after the object exact-set proof (3) + privilege reconciliation (4) + vector coverage (5) all pass are the #20 roots + #11 closure rows sealed; from that point the sealed object set is the sole operational authority for S15/S16/S17. There is no LEGACY_* row, disposition, or set-hash column to seal.

Former-label mapping (non-authority, descriptive only). The five former labels survive only as non-load-bearing English in explanatory text/logs; they are never manifest authority, rule inputs/outputs, guard decisions, package branches, hash members, or SQL predicates (G-LEGACY-NO-DISPOSITION-AUTHORITY):

Former label	Non-authoritative meaning under Beta
REVOKE_ONLY	descriptive only: body unchanged; sealed #21 excludes executable/mutating rights
STUB_FAIL_CLOSED	removed and prohibited — no body replacement or body-restore path; fail-closed comes from unreachability (owner-isolated + no #21 EXECUTE)
FREEZE_NO_CHANGE	descriptive only: body unchanged; owner isolated; sealed #21 excludes DML/EXECUTE
DEPRECATE_READONLY	descriptive only: any retained read access exists solely as exact sealed #21 SELECT/USAGE rows
DO_NOT_TOUCH	boundary description only, never a disposition or automatic exclusion; collision with a protected boundary (incl. the #26 gateway identity) fails closed

This section adds 0 authority surfaces, 0 readiness gates, 0 top-level hash contracts, 0 new #20 columns, and 0 new catalog families: authority is carried by PG ownership + the sealed #20 roots + #11 closure + the closed-world sealed #21 set + #26/#27 + manifest activation, all already approved. evidence_registry is used for evidence only (e.g. the S14 owner/ACL snapshot), never as authority and never as a body-restore source.