F4 Go-Live — 2026-08-24

Lane: Growth Control / F4 continuous calibration (geo-SCM), tenant mycocoons Directive: owner override 2026-08-24 ("approved to override the rules, resolve all issues and go live") + four AskUserQuestion scope locks + one derived-values confirmation. Override interpretation (stated to the owner before use): unlocks process ceremony (self-merged arming PRs, no per-step typed gates); it never invents business values — every value below is measured or owner-typed. Outcome: the F4 lane is ARMED and its FIRST CYCLE returned status=scheduled — a holdout registered through the real Cell 36 client and a reservation proposal in the owner's DCP L2 approval queue. Nothing can spend: approval + the deliberately unregistered actuator are both human keys.

Owner-locked scope

The derivation (measured, diag runs #8–#13 on diag/f4-geo-derive)

• mizoki_unified_data.shopify_unified: 71,898 rows; 7,873 distinct orders (2021-11-30 → 2025-04-06). No geo columns.
• Geography lives on the customer export (mycocoons_customers_raw, 16,425 customers; US 6,134). The numeric-id join measured zero matches; the lowered-email join matched 7,870 / 7,873 orders (99.96%), 3,332 with a US default-address state.
• Both independent sources rank the same top-4 states (orders: CA 565 / FL 298 / NY 283 / TX 226; export Total Orders: CA 903 / NY 483 / FL 465 / TX 397).
• order_economics, canonical_events, ekis_shopify.*, ga4custom_unified, ga_analytics_unified, web_sessions, customer_events_cleaned: all zero rows — no live order stream yet; observations are honestly historical until canonical/EKIS ingestion flows.
• order_value carries refund negatives and inconsistent magnitudes vs the export's own Total Spent, so the KPI is weekly order counts, not revenue.

What landed

Standing safeties (unchanged, live-asserted)

• Reservations are structurally recommend-only: every proposal routes the L2 queue requires_approval: true with actuator f4-geo-reservation — deliberately NOT registered with the action runner (two-key rule).
• autonomy.eligible: false; flipping it requires owner evidence in config and ≥2 clean cycles.
• LTV_BID_WEIGHTING / MMM_PRIOR_WRITEBACK / EDGE_INFERENCE_SERVE flags false — the armed probe fails (exit 25) if any reads true; MEASUREMENT/NET_YIELD writebacks untouched (fail-if-flipped tests).
• Holdout-before-submit invariant exercised for real: the scheduled status is only reachable through Cell 36 registration (post-rotation salt).

Measured capability facts (new this run)

• CI deployer has direct BigQuery read + jobs.create + tables.create (created the view) from the runner; still no Cloud Logging, no secretmanager (secrets.get/versions.add denied).
• Default Cloud Build SA can create secrets/versions; the runtime SA (mizoki-platform) cannot write gs://…_cloudbuild (first-cycle JSON readback unavailable — verdicts ride coded exit statuses).
• Shopify-export columns carry spaces (Default Address City) — backtick-quote or queries fail with misleading Unexpected keyword DEFAULT.

Follow-ups (owner)

1. Your L2 approval queue now holds the first F4 reservation proposal — approve or reject it there. Executing an approved reservation additionally requires a human to wire+register the f4-geo-reservation actuator. Ruling 2026-09-15 (P-1, docs/reports/OWNER_RULINGS_2026-09-15_REGISTER_CLOSEOUT.md): REJECT the stale proposal from growth-scheduler-first-cycle-v762t — it was built from values retired on 2026-08-23 (the file-config F4 values the vault ruling replaced); a fresh proposal from the onboarding-form (vault) values replaces it. The DCP has no reject route of its own (propose, authorize-approved, holdout register, decision reads); a queued L2 proposal is denied in service-approval-routing, by a verified human principal holding the request's route role (operator), never by a service identity. Operator call (not run here — the ruling is recorded, the deny is an owner keystroke): # 1. find the pending request id for the tenant GET {APPROVAL_ROUTING_URL}/api/v1/pending?tenant_id=mycocoons # 2. deny it by request_id, with the ruling as the note POST {APPROVAL_ROUTING_URL}/api/v1/deny {"request_id": "APR-<from step 1>", "note": "owner ruling 2026-09-15 P-1: stale v762t proposal built from values retired 2026-08-23; superseded by a fresh vault-valued proposal"} Both calls carry the caller's identity token and are resolved against the verified principal (WO-05: a service principal is refused 403; a body actor that differs from the principal is refused 400). deny is terminal (status=denied, audited as approval.denied); the fresh proposal is a new growth-scheduler cycle invocation under the current vault values, which lands as a new APR-… request.
2. Observations refresh when live order ingestion (canonical/EKIS) starts flowing; the view definition can then move to the live source in a reviewed commit.
3. Cloud Scheduler cadence for recurring cycles is a later operator wiring (terraform path is protected); until then cycles are deliberate invocations.
4. Six merged remote branches remain undeletable through the session's git proxy (delete-push reports "Everything up-to-date"); one-click cleanup in the GitHub UI when convenient — plus diag/f4-geo-derive (scratch diagnostic vehicle) once this lane's tooling is no longer wanted.