Design prod-like oracle i001 fixture correction

[InfoSecHack]

Summary

• Add a docs-only design for correcting oracle-i-001 so it becomes truly inconclusive instead of blocked by complete-confidence boundary evidence.
• Compare three correction options and recommend Option A: split source principals.
• Define likely affected files, expected post-correction result, implementation stop gates, later validation sequence, and exact next slice.

Recommendation

Recommended correction option: Option A, split source principals.

This keeps wildcard resource-scope uncertainty separate from boundary/session uncertainty and avoids cross-contaminating unrelated oracle rows.

Validation

• targeted design-term grep: passed
• account/ARN hygiene scans: clean
• Terraform/raw artifact scan: clean
• ./scripts/check.sh: passed
• ./scripts/test_fast.sh: 1996 passed
• git diff --check: passed