07 - Implementation Package Split

CODEX RECHECK-5 PATCH (2026-06-09) — canonical envelope + Codex detached seal. PKG-A may not begin unless the ACTIVE_AUTHORITY_APPROVAL_ENVELOPE is SEALED, every aggregate digest verifies under the Canonical hash encoding (FIX7-CANON-V1), the manifest binds the complete authority-field roster, and the live envelope_manifest_sha256 equals the Codex detached seal's sealed_envelope_manifest_sha256 (G-CANONICAL-ENCODING-CONTRACT / G-ENVELOPE-MANIFEST-AUTHORITY-COMPLETE / G-CODEX-DETACHED-SEAL-ANCHOR). The blueprint checkpoint is NON_AUTHORITY_INDEX (REPORT_ONLY) — no package consumes it as authority; authoring readiness is decided only by the sealed envelope + the detached seal. Any canonical-hash, manifest-roster, or detached-seal drift → STOP and return to Codex recheck. 27/11/14/7 unchanged.

CODEX RECHECK-7 PATCH (2026-06-09) — Constitution Article 14: executable SSOT + non-self-referential seal. PKG-A may not begin unless, in addition to the recheck-6 gates: (1) the single executable canonicalizer SSOT FIX7-CANON-V1-CANONICALIZER is pinned (canonicalizer_sha256), its --selftest exits 0 and reproduces membership f2bda8…fe251, and the live artifact hash == the sealed value (G-CANONICALIZER-SSOT-ONLY); (2) exactly one load-bearing canonical contract exists — every other description is NON_AUTHORITY_EXPLANATION; a package shipping a different canonicalizer, or a doc/report conflicting with the SSOT, fails closed (G-NO-DUPLICATE-CANONICAL-AUTHORITY); (3) no checkpoint's own post-write revision is load-bearing (revision diagnostic-only; G-NO-SELF-REVISION-ANCHOR); (4) every document_id equals the exact MCP canonical id with all aliases rejected (G-DOCUMENT-ID-CANONICAL-MCP); (5) markers are a consistent closed (kind, literal) pair (G-MARKER-KIND-LITERAL-CONSISTENCY). AUTHORING_REQUIREMENT: implementation-authoring MUST adopt exactly one canonicalizer that is the SSOT artifact (or a re-implementation proven to pass all its test vectors + reproduce f2bda8…fe251) before PKG-A — the implementation runs that artifact, not prose. Seal event → recheck 8. 27/11/14/7 unchanged.

CODEX RECHECK-6 PATCH (2026-06-09) — byte-exact canonicalization + acyclic seal graph. PKG-A may not begin unless, in addition to the recheck-5 gates, the canonical encoding is byte-exact and the seal graph is acyclic: every record field passes the REJECT-not-escape field policy (G-CANONICAL-FIELD-REJECT); active scope/fence/section come only from the deterministic extractor with fail-closed statuses (G-ACTIVE-SCOPE-EXTRACTOR); every digest uses its closed record schema and every envelope key is in the closed key-classification schema (G-RECORD-ENCODING-CLOSED); and the seal hash graph N1..N9 is a DAG with the manifest binding NO checkpoint revision/content hash and the seal never hashing its own checkpoint (G-SEAL-HASH-GRAPH-ACYCLIC). The Codex checkpoint is anchored out-of-band by its platform revision + MCP read-back (not by a content hash that includes the seal). Any byte-rejection, extractor ambiguity, record/key-schema violation, or seal-graph cycle → STOP and return to Codex recheck. The seal event is recheck 7. 27/11/14/7 unchanged.

CODEX RECHECK-4 PATCH (2026-06-09) — packages consume only the envelope-pinned ACTIVE corpus. Implementation-authoring packages (PKG-A..I) and every guard/seal/order input consume only the ACTIVE_AUTHORITY corpus as pinned by the sealed ACTIVE_AUTHORITY_APPROVAL_ENVELOPE (doc 00) — not by mutable markers. PKG-A may not begin unless the envelope is SEALED and every ACTIVE doc's live revision + SHA-256 matches it (G-ACTIVE-AUTHORITY-APPROVAL-ENVELOPE / -HASH-MATCH / -REVISION-MATCH). Any post-approval drift in any active doc/section/marker/fence/registry/guard-set → ACTIVE_AUTHORITY_ENVELOPE_MISMATCH → STOP and return to Codex recheck, never "continue authoring" (G-ACTIVE-AUTHORITY-CHANGE-FAIL-CLOSED, guard-quality rule 9). The envelope is a non-runtime construction-document content-address; 27/11/14/7 unchanged.

CODEX RECHECK-3 PATCH (2026-06-09) — typed set separation + active-authority scope. Every package authors/seals/executes/verifies the PG-object set U_legacy_object (doc 02 §H.4.A); privilege reconciliation is the separate U_legacy_object × U_effective_privilege_principal join to sealed #21 (§H.4.B); entry-vector bypass is the separate U_entry_vector coverage relation (§H.4.C). Packages and all guard/seal/order inputs consume only ACTIVE_AUTHORITY sections (doc 00 registry); consuming a SUPERSEDED_NON_AUTHORITY instruction is a no-go (G-NO-SUPERSEDED-CONSUMPTION). Guards G-U-LEGACY-OBJECT-ONLY, G-PRINCIPAL-SET-SEPARATE, G-ENTRY-VECTOR-SEPARATE, G-ACTIVE-AUTHORITY-SCOPE, G-NO-SUPERSEDED-CONSUMPTION (doc 06).

OPTION-BETA PATCH (2026-06-08). Codex (design owner) approved Option Beta for the legacy-disposition blocker. The sealed legacy-disposition set, the 5-value enum, the computed classifier, and STUB_FAIL_CLOSED/body restore are removed; every package authors/seals/ executes/verifies only the closed U_legacy set (closure(#11, roots=#20 protected_target rows), no subtraction) and the single uniform end-state (owner=qt001_cp_owner, body unchanged, effective privileges == exact sealed #21). Package behavior is generic reconciliation against #11/#20/#21, never a disposition branch. The recheck-2 in-blueprint fixes remain valid:

D operator authorization: the contract is the existing typed PG authority model: the authorized action is an ACTIVE #07 authority_action row; the scope is ACTIVE #20/#21 rows; the quorum/separation/principal are ACTIVE #19/#08 + CP-09 principal_registry/human_identity_registry; the package hash is the sealed manifest_set.payload_sha256 / manifest_activation.candidate_payload_sha256 / activation_sha256 the transition applies; the epoch is control_epoch. The evidence_registry artifact is supporting evidence only, never final authority. G-OPERATOR-AUTH-PG-NATIVE (doc 06).

H author/rehearse/seal order: #11 closure, the U_legacy roots, the closed-world #21, and #26/#27 bindings are authored in PKG-B and rehearsed in the SAME complete set PKG-C seals. PKG-D is read-only re-validation + the Codex re-audit, authoring nothing the rehearsal seal did not cover. G-SEAL-AFTER-AUTHOR-REHEARSE (doc 06).

G forward-only: PKG-F rollback supersedes forward; it never clears activated_at; legacy restore is owner+ACL snapshot replay only (no body change).

Future work is split into dependency-safe packages. Each has scope, rollback, tests, a single runner class, and a no-go condition. Packages are sequenced; a later package may not start until its predecessor passes and (where marked) a fresh Codex re-audit. No package secretly enters Stage 2.6B; the production-mutation packages remain OPERATOR_GATED.

Terminology - operator_authorization vs the blocked permit (Codex BLOCKER 7 / CHECK_J)

The earlier blueprint used "permit" ambiguously for two unrelated things. They are now separated; the word "permit" is reserved for the blocked admission/backfill concept only. (Note: the governing law does not use the word "permit" at all - it expresses package-execution authority via OPERATOR_HANDOFF_MODE / the §3.4 Authority Pack / §4J Operator Surface Rule; operator_authorization below maps to those.)

term	meaning	state under FIX7
`operator_authorization`	permission for an OPERATOR to execute a migration/cutover package (PKG-E..H). PG-native typed authority (recheck-2 BLOCKER D). The decision inputs are ALL typed PG rows: authorized action = ACTIVE #07 `authority_action`; scope = ACTIVE #20 `authority_scope` + #21 `privilege_set`; principal/quorum/separation = CP-09 `principal_registry`/`human_identity_registry` + ACTIVE #19 `quorum_requirement` + #16 `signoff_requirement` + #08 `principal_separation`; package hash = the sealed `manifest_set.payload_sha256` / `manifest_activation.candidate_payload_sha256` / `activation_sha256` the transition applies; epoch = `control_epoch`. A supporting `evidence_registry` artifact (commit/packet/approval) may be referenced for audit but is never final authority (`G-OPERATOR-AUTH-PG-NATIVE`, doc 06). It is NOT the blocked permit; it does NOT open QT001 apply, admission, REAL_RUN, or Stage 2.6B; it creates NO readiness gate.	required per package; granted only by a fresh Codex re-audit + the typed PG authority rows above + operator role grant
`qt001_backfill_permit` (= the birth/admission permit)	permission to run QT001 backfill/apply	BLOCKED (unchanged)
`REAL_RUN_authority`	permission to run real scale/capability execution	BLOCKED (unchanged)
QT001 apply authority	`fn_dot_birth_qt001_apply` / `sp_dot_birth_qt001_apply` apply path	BLOCKED since Codex `NOT_SAFE` (unchanged)

Every PKG-E/F/G precondition says operator_authorization, never "permit". Guard G-NO-QT001-PERMIT-DURING-FIX7 fails any package that opens/consumes a qt001_backfill_permit, REAL_RUN authority, or QT001 apply authority, or that conflates operator_authorization with any of them.

Package types used

author-only (T1 authors artifacts; nothing applied)
local/rehearsal (BEGIN..ROLLBACK on a non-production rehearsal target)
read-only validation (live read-only guards)
operator-gated production (operator applies under explicit authority)
post-cutover verification

Packages

PKG-A - Foundation + 27 surfaces + runtime-evidence DDL (author-only)

package_id: PKG-A; type: author-only.
scope: S01-S08 DDL artifacts (roles/schema/domains/catalog/anchors/27 contracts/registries/11 runtime-evidence/deferred constraints) as reviewable SQL. Not applied.
included steps: S01-S08. excluded: any seal/activate/repoint/cutover/retention.
preconditions: this blueprint passes the current Codex recheck; the ACTIVE_AUTHORITY_APPROVAL_ENVELOPE (doc 00) is SEALED and verified green under the canonical FIX7-CANON-V1 encoding (G-ACTIVE-AUTHORITY-APPROVAL-ENVELOPE / -HASH-MATCH / -REVISION-MATCH / G-CANONICAL-ENCODING-CONTRACT / G-ENVELOPE-MANIFEST-AUTHORITY-COMPLETE / G-CANONICAL-FIELD-REJECT / G-ACTIVE-SCOPE-EXTRACTOR / G-RECORD-ENCODING-CLOSED / G-SEAL-HASH-GRAPH-ACYCLIC / G-CANONICALIZER-SSOT-ONLY / G-NO-DUPLICATE-CANONICAL-AUTHORITY / G-NO-SELF-REVISION-ANCHOR / G-DOCUMENT-ID-CANONICAL-MCP / G-MARKER-KIND-LITERAL-CONSISTENCY), the single canonicalizer SSOT is pinned and --selftest exits 0, AND the Codex detached seal is present and matches (G-CODEX-DETACHED-SEAL-ANCHOR: live envelope_manifest_sha256 == sealed manifest; live detached_seal_sha256 recompute == recorded; live canonicalizer_sha256 == sealed; Codex checkpoint read back by MCP for existence — no checkpoint revision equality is required, recheck-7 blocker A); no ACTIVE_AUTHORITY_ENVELOPE_MISMATCH / ACTIVE_AUTHORITY_DETACHED_SEAL_MISMATCH / SEAL_HASH_GRAPH_CYCLE / SELF_REVISION_ANCHOR_REJECTED / CANONICALIZER_SSOT_MISMATCH / DUPLICATE_CANONICAL_AUTHORITY / DOCUMENT_ID_ALIAS_REJECTED / MARKER_KIND_LITERAL_INCONSISTENT / CANONICAL_FIELD_RESERVED_TOKEN_REJECTED / any extractor ambiguity status; implementation-authoring authorized.
output artifacts: byte-level SQL files + per-contract negative-test specs.
validation: static review vs approved doc 02 byte DDL; T1 stop on any conflict.
rollback: n/a (nothing applied).
who can run: T1 (author). next: PKG-B.
no-go: any DDL diverges from approved design; any UNKNOWN_REQUIRES_REVIEW remains.

PKG-B - Sealed DATA authoring (author-only)

package_id: PKG-B; type: author-only.
scope: S09-S10 + S13 authoring DATA artifacts: catalog rows, 27-manifest item rows, #20 authority-scope rows + expected-constraint set including the sealed protected_target=true TABLE roots, #21 Directus read-contract rows + the closed-world desired-privilege set for every U_legacy member (== enumerated existing SELECT for preserved reads; no EXECUTE/DML row for any legacy object), 14 readiness-gate rows, 7 hash contracts (H04_SCOPE_V1, H02/H05 total orders), #05 retention, #06 thresholds, #23 workload profiles, AND all load-bearing repoint/closure bindings — dependency_manifest #11 reverse-closure (from the sealed #20 protected_target TABLE roots + #26 protected_target_set_sha256), #26 gateway identity pin, #27 writer_repoint old/new source + re-point bindings (recheck-2 BLOCKER H: these are authored BEFORE the rehearsal seal, in the SAME complete set PKG-C rehearses and PKG-E applies — not deferred to a post-seal PKG-D). **There is NO LEGACY_* #20 row, NO disposition, NO STUB body artifact, and NO expected_legacy_set_sha256 (Option Beta) — U_legacy membership is the #11 closure and the end-state is carried by ownership
- the closed-world #21.** Not applied.
preconditions: PKG-A artifacts complete; S00 read-only Directus SELECT grant-set capture available (MX-1 - the read-only capture runs ahead of PKG-B; PKG-D later re-validates it). #21 authoring is blocked until the captured set exists.
output: seed-data files + hash fixtures + exact-set manifests.
validation: G-GATES-14, G-HASH-7, G-HASHDET, G-EXACTSET-20, G-U-LEGACY-OPTION-BETA-UNIFORM-ENDSTATE (the #21 desired set is closed-world over U_legacy), G-LEGACY-NO-DISPOSITION-AUTHORITY run as static fixtures.
rollback: n/a. who: T1. next: PKG-C. no-go: count drift (27/11/14/7); non-deterministic hash; any disposition/LEGACY_*/STUB construct present.

PKG-C - Rehearsal apply + exact-set + seal (local/rehearsal)

package_id: PKG-C; type: local/rehearsal.
scope: apply PKG-A+PKG-B on a rehearsal target inside BEGIN..ROLLBACK; run S11 exact-set both- EXCEPT, CP-06 fixtures, full 27-contract negative suite (incl. the Option-Beta negative tests, doc 06), dropped-deferred-FK -> OBJECT_AUTHORITY_IMMUTABLE; rehearse the COMPLETE set's seal — including #11 closure, the U_legacy roots, the closed-world #21, and #26/#27 bindings authored in PKG-B — so the rehearsed/sealed artifact set is byte-identical to what PKG-E later applies (recheck-2 BLOCKER H; G-SEAL-AFTER-AUTHOR-REHEARSE). Seal hashes are computed from the final authored artifacts.
excluded: production apply; activation; repoint; cutover.
preconditions: PKG-B complete.
output: rehearsal evidence (real rejections, recomputed hashes), reversal-order proof.
validation: every guard in doc 06 marked S11/S08; no literal PASS rows.
rollback: ROLLBACK (rehearsal). who: T1 (rehearsal) + operator approves rehearsal target.
next: PKG-D. no-go: any EXCEPT non-empty; any negative test green-by-literal; reversal fails.

PKG-D - Read-only repoint proof re-validation (read-only validation)

package_id: PKG-D; type: read-only validation.
scope: read-only RE-VALIDATION of the already-sealed complete set against live (no post-seal authoring — recheck-2 BLOCKER H: #11 closure, the U_legacy roots, the closed-world #21, and #26/#27 bindings were authored in PKG-B and sealed in PKG-C). S00 re-baseline + confirm the sealed #26/#27 source_sha256 still match live writer/gateway sources; confirm #11 closure (legacy_reached=0) still holds; run G-NOLEGACY-PRE (structural closure + sealed-set completeness; does NOT require EXECUTE revoked), G-WRITER-GATEWAY-IDENTITY, G-REPOINT-SRC, G-UNKNOWN-ZERO, G-LEGACY-TARGET-SEALED, G-LEGACY-TARGET-CLOSED-DENOMINATOR (sealed U_legacy both-EXCEPT-equal to the closed universe §H.4; no subtraction; collisions fail closed), G-LEGACY-NO-DISPOSITION-AUTHORITY, G-SEAL-AFTER-AUTHOR-REHEARSE read-only against live. These are fully operational under Option Beta (no longer fail-closed pending an amendment).
excluded: any live repoint/seal/activate. PKG-D runs only G-NOLEGACY-PRE, never the post-state guard - so it does not falsely require EXECUTE already revoked while every legacy routine is still PUBLIC-executable (Codex BLOCKER 2 / CHECK_G).
preconditions: PKG-C passes; fresh Codex re-audit of PKG-A..C.
output: repoint manifest rows + #11 reachability proof (legacy_reached=0) + sealed U_legacy set + captured Directus SELECT grant set artifact (MX-1) for PKG-B #21 authoring.
validation: G-NOLEGACY-PRE, G-LEGACY-TARGET-SEALED, G-LEGACY-TARGET-CLOSED-DENOMINATOR (object-shape denominator §H.4.A), G-U-LEGACY-OBJECT-ONLY, G-PRINCIPAL-SET-SEPARATE (object × principal join to #21, §H.4.B), G-ENTRY-VECTOR-SEPARATE (bypass coverage §H.4.C), G-U-LEGACY-OPTION-BETA-UNIFORM-ENDSTATE (the #21 desired set is closed-world), G-LEGACY-NO-DISPOSITION-AUTHORITY, G-ACTIVE-AUTHORITY-SCOPE, G-NO-SUPERSEDED-CONSUMPTION, G-WRITER-GATEWAY-IDENTITY, G-REPOINT-SRC, G-DOT-FROZEN, G-BIRTH-NEUTRAL (baseline).
rollback: n/a (read-only). who: T1 (read-only). next: PKG-E.
no-go: any legacy object reachable; any unknown object; source hash mismatch; any boundary collision; any disposition/LEGACY_* construct present.

PKG-E - Production apply: create + seal + stage (NO activation) (operator-gated production)

package_id: PKG-E; type: operator-gated production.
scope: S01-S12 apply + S14 stage on production, under explicit operator authority and quorum. Creates the qt001_cp control plane and seals the manifest, leaving it STAGED (activated_at NULL; gateway fail-closed; readiness BLOCKED). It does NOT activate - activation is moved into the atomic PKG-F so an ACTIVE new path never coexists with executable legacy (Codex recheck BLOCKER D). It also captures the complete pre-cutover ownership/ACL snapshot (doc 05 invariant 3), hash-bound + read-back-verified, as a mandatory output - this must exist BEFORE PKG-F's S15.1 owner transfer (Codex recheck BLOCKER H). Under Option Beta the snapshot is the SOLE legacy rollback source (no body to capture).
excluded: manifest activation; owner/ACL cutover; legacy retention; live writer repoint cutover; legacy owner transfer; REAL_RUN; QT001 apply.
preconditions: PKG-D passes + fresh Codex re-audit + a valid operator_authorization (see §Terminology - package-execution authority ONLY; it is not a qt001_backfill_permit, opens no admission/QT001-apply/REAL_RUN, and creates no readiness gate).
output: live qt001_cp schema (sealed, STAGED manifest, activated_at NULL); verified hash-bound pre-cutover snapshot.
validation: G-EXACTSET-20, G-AUTH-27, G-RUNTIME-NONAUTH, G-BIRTH-NEUTRAL, G-NO-QT001-PERMIT-DURING-FIX7, G-DOT-NOOVERWRITE (qt001_cp owner-isolated at creation), G-NOMIXED-AUTHORITY (manifest STAGED, legacy sole authoritative path), snapshot present+verified.
rollback: reverse-order drop of empty candidate objects; discard staged manifest + snapshot (no activation occurred, so no live-authority rollback).
who: OPERATOR. next: PKG-F. no-go: any seal check fails; manifest activated; birth row delta; snapshot absent/unverified.

PKG-F - Authoritative live repoint cutover + uniform legacy neutralization (operator-gated production)

package_id: PKG-F; type: operator-gated production.
scope: S15 - in ONE atomic operator transaction, strictly ordered (Codex recheck BLOCKER A/D), applying the single uniform Option-Beta end-state to every U_legacy member: (S15.1) ALTER ... OWNER TO qt001_cp_owner for every supported sealed-set member (relkind/prokind choose only the syntax) - directus is non-superuser and owns the legacy routines, so the owner transfer is what makes its effective EXECUTE removable; (S15.2) reconcile effective privileges to exactly the sealed #21 rows over the COMPLETE sealed set (both-EXCEPT) - for every legacy member #21 grants no EXECUTE/DML, so REVOKE from PUBLIC/directus/every role except qt001_cp_owner; no body is replaced or stubbed for any member (Option Beta); (S15.3) verify G-NOLEGACY-POST + G-U-LEGACY-OPTION-BETA-UNIFORM-ENDSTATE (every member: owner=qt001_cp_owner, definition hash unchanged, effective privileges == exact #21; non-superuser non-owner effective EXECUTE/DML = 0; superuser workflow_admin dispositioned); (S15.4) ACTIVATE the sealed manifest (quorum + epoch) AND repoint the live writer to the #26-pinned gateway; (S15.5) verify G-NOMIXED-AUTHORITY + G-WRITER-GATEWAY-IDENTITY. Activation happens AFTER neutralization, so no ACTIVE new path coexists with executable legacy. Legacy neutralization + activation are bundled here.
excluded: owner/ACL cutover of the remaining legacy relations and residual grants (PKG-G).
preconditions: PKG-E sealed+STAGED + the PKG-E pre-cutover snapshot read-back-verified (captured BEFORE this package's S15.1 owner transfer - Codex recheck BLOCKER H); a fresh independent Codex re-audit of the live repoint + neutralization (the authoritative repoint is a governance_change, which law §4G lists as a stop_without_asking_if hard-stop and excludes from the surgical-drift allowance - it must NOT be a mechanical continuation of PKG-E) + a valid operator_authorization (§Terminology - not a qt001_backfill_permit); rollback artifacts (the captured owner+ACL snapshot) staged; G-NOLEGACY-PRE + G-LEGACY-TARGET-CLOSED-DENOMINATOR green live.
output: live ACTIVE authoritative path on qt001_cp; every U_legacy member at the uniform end-state (owned by qt001_cp_owner, body unchanged, effective privileges == exact #21 → EXECUTE/DML = 0); rollback snapshot staged.
validation: G-NOLEGACY-POST (non-superuser non-owner effective-EXECUTE=0), G-U-LEGACY-OPTION-BETA-UNIFORM-ENDSTATE, G-LEGACY-NO-DISPOSITION-AUTHORITY, G-NOMIXED-AUTHORITY (ACTIVE fact, post-activation), G-WRITER-GATEWAY-IDENTITY, G-LEGACY-TARGET-SEALED, G-LEGACY-TARGET-CLOSED-DENOMINATOR, G-EPOCH-TOCTOU, G-BIRTH-NEUTRAL, G-NO-QT001-PERMIT-DURING-FIX7, gateway fail-closed.
rollback: the atomic forward-only deactivation-first sequence (doc 05 note 5): supersede the new path FORWARD (new manifest_activation of a prior-payload candidate + predecessor superseded_by_manifest_id; never clear/edit activated_at — recheck-2 BLOCKER G) → verify readiness BLOCKED via the derived current-active route → verify gateway cannot route the new path → restore legacy by replaying the PKG-E owner+ACL snapshot (prior owner directus + captured ACL, NO body change), uniquely sourced via manifest_activation.rollback_evidence_id → verify G-NOMIXED-AUTHORITY + G-BIRTH-NEUTRAL.
who: OPERATOR. next: PKG-G. no-go: any legacy effective-executable by non-superuser non-owner OR reachable; directus still owns an executable legacy routine; any member's effective privileges != exact #21; mixed old+new authority; birth delta; gateway not fail-closed; target set not the sealed U_legacy set / denominator not closed; any boundary collision.

PKG-G - Owner/ACL cutover (operator-gated production)

package_id: PKG-G; type: operator-gated production.
scope: S16 - using the PKG-E pre-cutover snapshot (already captured BEFORE PKG-F's S15.1 owner transfer - it is NOT re-captured here, because after S15.1 directus has already lost ownership of the executable routines; Codex recheck BLOCKER H): transfer ownership of the remaining scoped objects - any legacy relation not already moved as a U_legacy member + any qt001_cp control object not already owner-isolated - to qt001_cp_owner (the executable legacy ROUTINES were already moved at PKG-F/S15.1); reconcile residual directus/PUBLIC authority on those control objects only to exact #21; re-grant exact #21 SELECT. The #26 gateway has no owner transition (born qt001_cp_owner). Directus retains full authority over its own directus_* application tables and the business base tables it legitimately owns (XH-4).
excluded: legacy retention; any change to directus_* app tables or business-table ACL; re-capturing the snapshot (it must precede S15.1).
preconditions: PKG-F stable; a fresh independent Codex re-audit of the owner/ACL cutover (the most destructive governance_change - it strips the directus authority that holds readiness BLOCKED; law §4G stop_without_asking_if, never mechanical) + a valid operator_authorization (§Terminology - not a qt001_backfill_permit); G-DIRECTUS-READ preflight green; the PKG-E effective-privilege snapshot present, hash-bound, read-back-verified, restore-rehearsed (MX-3 + Max-E + Codex BLOCKER 5; the snapshot precedes the S15.1 transfer, recheck BLOCKER H).
output: cutover evidence; the verified hash-bound PKG-E prior-ACL snapshot referenced for rollback.
validation: G-OWNER-CUTOVER (effective-privilege over non-superuser non-owner roles, role-membership-aware, column-ACL-inclusive; superuser workflow_admin dispositioned), G-DIRECTUS-READ (SELECT preserved), G-DIRECTUS-APP-INTACT, G-NO-QT001-PERMIT-DURING-FIX7, PUBLIC EXECUTE on control objects gone.
rollback: restore prior ownership + full effective-privilege ACL from the PKG-E snapshot; verify both-direction effective-privilege match.
who: OPERATOR. next: PKG-H. no-go: Directus loses required SELECT OR its directus_*/business-table authority; unverified/unhashed ACL snapshot; column-ACL or role-membership leak; readiness false-unblock.

PKG-H - Legacy retention (operator-gated production)

package_id: PKG-H; type: operator-gated production.
scope: S17-S18 - apply the uniform end-state to the superseded 20 tables/46 fns/196 legacy views (owner-isolated, effective privileges == exact #21, body unchanged) and mark them deprecated/read-only history; never DROP live. This is generic #21 reconciliation, not a FREEZE_NO_CHANGE/ DEPRECATE_READONLY disposition.
preconditions: PKG-G stable; #11 proves no birth/QT-002 dependence on the retained targets.
output: legacy retained at the uniform end-state, marked read-only history, governed by #21.
validation: G-LEGACY-RETAINED, G-U-LEGACY-OPTION-BETA-UNIFORM-ENDSTATE, G-BIRTH-NEUTRAL, QT-002 path intact.
rollback: restore prior grants/owner from the PKG-E snapshot; clear the deprecation marker. who: OPERATOR. next: PKG-I.
no-go: any live-required object depends on a retained target.

PKG-I - Post-cutover verification (post-cutover verification)

package_id: PKG-I; type: post-cutover verification.
scope: S19 - full guard suite; readiness gate facts; bypass-vector facts; scale runs (REAL_RUN is a SEPARATE later gate, not in this package).
preconditions: PKG-H complete.
output: final guard report.
validation: every doc 06 guard green (all 63).
rollback: n/a (read). who: T1 + operator. next: REAL_RUN / QT001 apply remain separately gated.
no-go: any guard red.

Package sequencing and gates

PKG-A -> PKG-B -> PKG-C --[Codex re-audit]--> PKG-D --[Codex re-audit + operator_authorization]-->
PKG-E --[fresh Codex re-audit + operator_authorization]--> PKG-F --[fresh Codex re-audit + operator_authorization]--> PKG-G -> PKG-H -> PKG-I
  ==> (REAL_RUN / QT001 apply / qt001_backfill_permit / Stage 2.6B: separate future gates, all BLOCKED)

PKG-A..D are authorable/rehearsal/read-only and contain no production mutation.
PKG-E..H are OPERATOR_GATED production and require explicit operator_authorization each (NOT a qt001_backfill_permit; see §Terminology).
Activation moved from PKG-E into the atomic PKG-F (Codex recheck BLOCKER D). PKG-E creates+seals+STAGES (manifest activated_at NULL) and captures the pre-cutover snapshot; PKG-F performs the ordered atomic owner-transfer → reconcile-to-#21 → verify → activate → repoint, so an ACTIVE new authoritative path never coexists with an executable legacy path. The snapshot is captured in PKG-E BEFORE PKG-F's S15.1 owner transfer (recheck BLOCKER H).
The two governance-change packages - PKG-F (authoritative repoint + uniform legacy neutralization) and PKG-G (owner/ACL cutover) - additionally require a fresh independent Codex re-audit before they run, not only the one before PKG-E. Law §4G ("Surgical Drift Patch Allowance") lists governance_change as a stop_without_asking_if hard-stop and explicitly states the allowance "does not permit governance change" - so an authoritative repoint / authority-ownership cutover must STOP and be explicitly re-authorized, never carried as a mechanical continuation of PKG-E.
Machine-checkable package-transition authority (Codex MG-01 / CHECK_C; recheck-2 BLOCKER D). A prose statement that a re-audit occurred is not sufficient. Each PKG-E/F/G transition is authorized by typed PG rows, not by unparsed external artifact content: the authorized action is an ACTIVE #07 authority_action row; the scope is ACTIVE #20/#21 rows; the package hash is the sealed manifest_set.payload_sha256/manifest_activation.candidate_payload_sha256/activation_sha256 the transition applies; the principal/quorum/separation/epoch are CP-09 principal_registry + ACTIVE #19/#16/#08 + control_epoch; the operator role grant lets the principal run the package. G-OPERATOR-AUTH-PG-NATIVE proves every input is a typed PG row and that the live package sha256 == the sealed payload hash (both-EXCEPT/read-back). A supporting evidence_registry row may be referenced for audit but supplies no final authority. G-NO-QT001-PERMIT-DURING-FIX7 verifies the authorization grants package execution ONLY and never QT001 apply / admission / REAL_RUN.
No package mixes layers (DDL vs DATA vs repoint vs cutover vs retention are separate).
No package authors, seals, executes, or verifies a disposition; every legacy step is generic reconciliation against #11/#20/#21 to the single uniform end-state (G-LEGACY-NO-DISPOSITION-AUTHORITY).
Set separation + active-authority scope (recheck-3). Every legacy step operates on the typed U_legacy_object set (objects only); privilege checks use the U_legacy_object × U_effective_privilege_principal tuple join to sealed #21; bypass uses the U_entry_vector coverage relation — never object membership (G-U-LEGACY-OBJECT-ONLY / G-PRINCIPAL-SET-SEPARATE / G-ENTRY-VECTOR-SEPARATE). Every package/guard/seal/order input is drawn ONLY from ACTIVE_AUTHORITY sections (doc 00 registry); no package may read or derive authority from a SUPERSEDED_NON_AUTHORITY section (G-NO-SUPERSEDED-CONSUMPTION, G-ACTIVE-AUTHORITY-SCOPE).
Content-addressed authoring authority (recheck-4). The ACTIVE_AUTHORITY corpus a package may consume is fixed by the sealed ACTIVE_AUTHORITY_APPROVAL_ENVELOPE (doc 00; exact KB revision + SHA-256 per active doc/section, sealed at the Codex recheck), NOT by the mutable markers/registry/ fences alone. PKG-A is gated on the envelope being SEALED and every active doc's live revision + content hash matching it (G-ACTIVE-AUTHORITY-APPROVAL-ENVELOPE / -HASH-MATCH / -REVISION-MATCH). Any drift in content/marker/fence/registry/guard-set/membership/active-section vs the sealed envelope → ACTIVE_AUTHORITY_ENVELOPE_MISMATCH, and authoring is BLOCKED until a fresh Codex recheck re-seals the envelope — the correct response is never "continue authoring" (G-ACTIVE-AUTHORITY-CHANGE-FAIL-CLOSED).
Canonical content-addressing + detached seal (recheck-5). Every aggregate digest is byte-exact under the Canonical hash encoding (FIX7-CANON-V1) (doc 00; no prose/unordered hash), the envelope_manifest_sha256 binds the complete authority-field roster, doc 00's self-reference is resolved (Option 1: full_document_sha256 diagnostic, normalized_active_content_sha256 excludes the envelope region), and the SEALED copy of record is an immutable Codex detached seal pinned by checkpoint revision + content SHA-256 + MCP read-back. The blueprint checkpoint is NON_AUTHORITY_INDEX (REPORT_ONLY): not a member, not a self-host, consumed by no package/guard as authority. Canonical-hash / manifest-roster / detached-seal drift → ACTIVE_AUTHORITY_ENVELOPE_MISMATCH / ACTIVE_AUTHORITY_DETACHED_SEAL_MISMATCH, authoring BLOCKED until a fresh Codex recheck (G-CANONICAL-ENCODING-CONTRACT, G-ENVELOPE-MANIFEST-AUTHORITY-COMPLETE, G-CODEX-DETACHED-SEAL-ANCHOR).
Byte-exact, executable, acyclic content-addressing (recheck-6). Beyond "it has a SHA-256", every load-bearing digest now has a REJECT-not-escape field policy (G-CANONICAL-FIELD-REJECT), one deterministic active-scope/fence/section extractor with fail-closed statuses (G-ACTIVE-SCOPE-EXTRACTOR), a closed per-record + envelope-key schema (G-RECORD-ENCODING-CLOSED), and an acyclic seal hash graph — the manifest binds NO Codex-checkpoint revision/content hash and the seal never hashes its own checkpoint; the checkpoint is anchored out-of-band by platform revision + MCP read-back (G-SEAL-HASH-GRAPH-ACYCLIC). A byte-rejection, an extractor ambiguity, a record/key-schema violation, or a SEAL_HASH_GRAPH_CYCLE → STOP and return to Codex recheck. The seal event is recheck 7.
One executable SSOT, no duplicate authority, no self-referential anchor (Constitution Article 14 / NT14 — recheck-7). The single load-bearing canonical contract is the executable canonicalizer SSOT FIX7-CANON-V1-CANONICALIZER (pinned by canonicalizer_sha256, --selftest exits 0, reproduces f2bda8…fe251); every other canonical/extractor/record/marker description (doc 00, reports) is NON_AUTHORITY_EXPLANATION (G-NO-DUPLICATE-CANONICAL-AUTHORITY, G-CANONICALIZER-SSOT-ONLY); the checkpoint own-revision is removed from load-bearing authority (G-NO-SELF-REVISION-ANCHOR); document_id is the exact MCP id with all aliases rejected (G-DOCUMENT-ID-CANONICAL-MCP); markers are a consistent closed (kind, literal) pair (G-MARKER-KIND-LITERAL-CONSISTENCY). Implementation runs the SSOT artifact, not the prose; a package shipping a different canonicalizer, a second load-bearing canonical contract, or a self-revision anchor → STOP and return to Codex recheck. The seal event is recheck 8.
Stage 2.6B is NOT a package here; it remains a separate blocked program (doc 08). The repoint / cutover / retention packages are FIX7-refactor steps, not the 2.6B permit/run/keyset program.