First-hour admitted-series contract

First-hour graduation no longer depends on a literal v1 hash in a table check. research.first_hour_admitted_series_v1 is the owner-controlled registry of series identities that graduation rows may reference. Its initial admissions are the original v1 contract and the sealed wave-1 v2 contract. A foreign key from research.first_hour_graduation_candidates_v1.series_hash rejects every hash that is not in that registry.

Each admission records the full 64-character lowercase hash, a unique version, the adoption time and database principal, a reason, and a canonical recorded_hash over those fields. no role outside the database owner may read or write the registry (deny-by-default, RLS forced; lane readers follow the existing first-hour pattern). No application role can execute research.admit_first_hour_series_v1(text,text,text); the function remains a database-owner operation.

Operator ritual for a new series

1. Independently verify the sealed artifact and copy its complete lowercase SHA-256 hash. Choose a new, unique version such as first-hour-continuation/v3, and write a durable reason that identifies the reviewed contract.
2. In a controlled database-owner session, admit exactly that identity inside one transaction:

   begin;
   select *
   from research.admit_first_hour_series_v1(
     '<64-character-lowercase-sha256>',
     'first-hour-continuation/v3',
     '<reviewed contract and owner decision>'
   );
   commit;

1. Read the row back through the registry and compare the full hash, version, reason, adopter, timestamp, and recorded_hash with the reviewed record. Never grant table write access or function execution to an application role.
2. Only then may a separately authorized graduation insert reference the new hash. Admission does not itself seal a candidate, grant statistical authority, start paper execution, or permit orders.

The existing G3 sealing and statistical-authority functions remain unchanged and v1-bound until the separately reviewed P6 work. Therefore admitting v2 or a later hash establishes referential eligibility only; it does not widen those authority paths.