[jamespud]

Durable Decision writers could start on an incomplete generation schema, admit work during cutover, and execute persisted benchmark Cases through the generation-zero compatibility path. Old binaries also retained unfenced write authority while their MySQL credentials remained valid.

This PR completes T6 with an offline cutover:

• Runtime performs read-only T1–T4/S29 schema verification before recovery or scheduling. Fresh initialization and S29 installation are explicit offline commands; incomplete earlier migrations fail closed.
• Admit/Claim lock the versioned writer gate before business locks. Production persistence requires execution owners, and Benchmark uses the existing RunManager admission, Claim and atomic settlement lifecycle.
• The control plane requires the complete per-table DML grants and SELECT-only control-table grant, rejecting missing or extra permissions before gate enablement.
• The management CLI and cutover script block/drain, verify schema, lock/revoke the legacy identity, kill old sessions, validate separate runtime privileges, and enable the exact blocked epoch. Deployment pins the new image and never restarts an old writer on failure.
• Real MySQL tests compile the pinned pre-T1 adapter, reproduce its unsafe writes before exclusion, then prove retained connections and reconnection cannot modify the authoritative write set. Dedicated CI covers both gate lock interleavings, startup failures, migration parity, history and benchmark execution.

Validation on ea9f8060943f277f294c8a7542cd8c7c9c413df9:

• All six GitHub CI checks passed, including Decision writer cutover (MySQL).
• Real MySQL 8.4.11 RED→GREEN: the previous implementation accepted USAGE-only, missing business-table grants and missing control-table SELECT, and incorrectly advanced the gate. All six permission scenarios now pass, covering partial DML, extra control-table UPDATE and the normal minimal-permission control too. Rejection preserves the entire gate row and authoritative records; valid enablement advances exactly one epoch and rejects replay.
• Full T6 MySQL acceptance with race detection passed, including actual old binary exclusion and gate linearization.
• Full backend go test -race -p 1 -count=1 ./... with real MySQL passed: 52 tested packages and 1,436 passing test entries. T1–T5 migration, ABA, reply-loss and retention regressions passed.
• gofmt, git diff --check and go vet ./... passed.
• Four real sandbox tests remain skipped and are not claimed as live sandbox acceptance.

The enforced deployment boundary is separate credentials delivered only to verified binaries. Giving new credentials to an old executable is outside that trust boundary. Inventory/freeze hooks and a production maintenance-window rehearsal are operator responsibilities; no production identities or services were modified here. T5 retention and external-effect semantics are unchanged.

Closes #24. Parent #17 stays open until merged integration acceptance is verified.