DOT Manage — LEGO Transition Status Addendum (C1)

Status addendum / LEGO transition note. Additive; mutates no governed runtime registry. Keeps DOT-manage current so future agents do not repeat stale assumptions. Date: 2026-06-22 · Macro: DOT_MANAGE_LEGO_TRANSITION_SURVEY_FOR_C1_DRYRUN. Authoritative package: knowledge/dev/laws-new/reports/dot-manage-lego-transition-for-c1-dryrun/ (index + 01–11 + codex packet) and rollup …/reports/macro-dot-manage-lego-transition-for-c1-dryrun-2026-06-22.md.

Read this before assuming C1 status, the frozen-DOT status, or that a new DOT/path must be built from scratch.

---

1. C1 transition status (do not overclaim)

• C1 = governance_canonical_operation_vocab (14-row canonical operation vocab; carrier C1; PK (operation_code,protocol_version); write-once + versioned supersession).
• DESIGNED: engineering-complete (R_C1 resolver over apr_action_types; cser-v1 manifest hash c9286d3a…ec00; producer/verifier; preflight; bad-input harness; rollback).
• PROVEN AS LOGIC: end-to-end in a disposable LOCAL Postgres sandbox (labeled NOT_GOVERNED_RUNTIME).
• REGISTERED (governed): NONE. RUNNABLE governed dry-run: NO.
• Live (2026-06-22): no C1 collection (not among 352 Directus collections), no C1 table in Postgres, DOT_C1_* in dot_agent_api_contract = 0, C1 in table_registry = 0.

2. Frozen-DOT status — KB classification is NOT live-enforced ⚠

Handbook §13 classifies dot-birth-trigger-setup (CRITICAL/FROZEN), dot-birth-backfill (HIGH/FROZEN), dot-schema-birth-registry-ensure (MEDIUM/MONITORED). But in live dot_tools these rows are status=active, extra_metadata={} — there is no enforced freeze flag. An agent reading only the registry would treat them as ordinary active DOTs. Do NOT reuse them. A governed update to reflect §13 into the registry is recorded as an operator action below.

3. Reuse-first quick reference for the C1 dry-run (full detail in package file 05)

• Reuse as-is: DOT-120 DOT_COLLECTION_REGISTER, DOT_SCHEMA_TABLE_REGISTRY_ENSURE, DOT-015 dot-catalog-sync, retire DOTs, the DOT_KG_EXPLAIN/_VERIFY + v_dotkg_realrun_preflight precedent, fn_process_agent_api_dispatch.
• Extend: DOT-062 dot-rollback for the C1 rollback step (do not clone).
• Template only (not a dry-run prerequisite): DOT_R2_B2_STAGING_SCHEMA_SHELL + 4 guards (authored/admitted, REGISTRATION_HOLD) → fork for the future C1 REAL_RUN sandbox.
• Author new (travels the existing governed Path A): DOT_C1_SCHEMA_ENSURE, DOT_C1_VOCAB_BUILD (incl. R_C1), DOT_C1_VOCAB_VERIFY, DOT_C1_PREFLIGHT, DOT_C1_BAD_INPUT_HARNESS, DOT_C1_EVIDENCE_READBACK.
• Do NOT reuse: generic DOT_SCHEMA_ENSURE (no C1 shape); dot_iu_create_collection (IU staging, not Directus DDL); KG/GOV/TAC *_VERIFY; any frozen birth DOT; any forbidden manual lane.

4. The one blocker (B1) and the next gate

The transition is blocked at a single irreducible operator-only point: there is no governed write/DDL/registration channel (every connected tool is read-only / item-CRUD-only / allowlist-denied / docs-only; directus_create DENIES both the C1 collection and dot_agent_api_contract). The lawful registrar dot-dot-register exists but its admin creds are absent.

Next gate = a separately-authorized governed Gate-B build-prep capability, executed by the human operator/owner on the VPS governed stack, to: (1) create the C1 collection (+ table_registry), (2) register the DOT_C1_* producer/verifier (+ schema/preflight/harness/rollback) via the lawful registrar, (3) mint 1 scoped single-use grant + a C1 ownership row. Then a governed DRY_RUN of DOT_C1_PREFLIGHT + DOT_C1_VOCAB_BUILD becomes dispatchable. Execute-gate flips are for REAL_RUN, not the dry-run.

5. Posture

REGISTRATION_HOLD ACTIVE · REGISTRATION_CAN_PROCEED=NO · P2/named-lane = CLOSED. Engineering PASS ≠ Owner authority PASS. Default HOLD. Authorization ≠ capability. Sandbox-logic-proven ≠ governed-DOT-ready.