# P3-GOV-6A — P0/P1 Preventive Controls (control plane)

Implement ONLY the P0/P1 preventive controls defined by P3-GOV-5 and
authorized by the P3-GOV-6A phase letter:

| Priority | Control | Module |
|----------|---------|--------|
| P0 | 1. STATE != AUTHORIZATION (factual cursor is never authorization) | `gov6a_gate.py`, `gov6a_state.py`, `gov6a_authorization.py` |
| P0 | 2. FAIL-CLOSED CONFLICT HANDLING (deterministic gate; STOP with recorded reason) | `gov6a_gate.py` |
| P1 | 3. CHECKPOINT / SOURCE IDENTITY (mismatch -> RESUME_BLOCKED) | `gov6a_identity.py` |
| P1 | 4. EXACT-VALUE PROVENANCE (SOURCE -> EXTRACTION -> VALIDATION -> OUTPUT) | `gov6a_provenance.py` |

Independent oracle: `gov6a_oracle.py` (raw byte / structural JSON comparison,
no shared parsing logic with the implementation).

Regression suite: `gov6a_mutations.py` — 10 mandatory mutations on disposable
fixtures only; required result 10/10 DETECTED.

Runner:

```text
python run_gov6a.py before   # git preconditions + checkpoint SHA before + baseline
python run_gov6a.py suite    # mutation suite TWICE + reproducibility + final
python run_gov6a.py after    # checkpoint SHA after + git scope + files manifest
python run_gov6a.py report   # generate report + handover (docs/) from evidence
```

Constraints (P3-GOV-6A):

- Real checkpoint is READ ONLY (never a mutable test fixture).
- Real Tickstory source is NEVER read for testing (disposable synthetic fixtures only).
- No CHUNK 11, no ML, no Dukascopy, no production MQL5/.mqh changes.
- SAFE_MAX_CHUNK_SIZE = 24 MiB; SAFE_CHUNKS_PER_TURN = 8 under the tested
  benchmark workflow (capability evidence only; not activated here).