11 — Before/After Runtime & KB Readback Evidence — 2026-06-22

LABELS: LOCAL_DISPOSABLE_SANDBOX_DOT_EMULATOR · NOT_GOVERNED_RUNTIME · NOT_PRODUCTION · NOT_DIRECTUS_GOVERNED_WRITE · NOT_A_SUBSTITUTE_FOR_DOT_C1_REGISTRATION

A — Governed runtime: BEFORE == AFTER (zero mutations)

Governed object	Before	After	Δ
governance_canonical_operation_vocab (exists?)	absent (count 0; not in 352-collection list)	absent	0
dot_agent_api_contract rows	DOT_KG_EXPLAIN pair (2)	DOT_KG_EXPLAIN pair (2)	0
governance_build_authorization grants	0 (active 0)	0	0
dot_tools	309	309	0
The only governed-surface calls were read-only SELECTs + one denied directus_create (no row created). 0 governed mutations.

B — Sandbox runtime: BEFORE → AFTER (all changes confined to disposable cluster)

Sandbox object	Start	After build	After dry-run	After apply	After dismantle
c1.governance_canonical_operation_vocab rows	(n/a)	0	0	14	0
c1.c1_build_audit rows	(n/a)	0	0	1	1 (retained)
c1.dot_agent_api_contract (DOT_C1_*)	(n/a)	7	7	7	7
c1.c1_table_registry rows	(n/a)	4	4	4	4

C — Sandbox readback (live)

• Tables (schema c1): apr_action_types_fixture, c1_build_audit, c1_table_registry, dot_agent_api_contract, governance_build_authorization, governance_canonical_operation_vocab.
• Functions: authority_fixture_hash, build_manifest, cser, dot_c1_preflight, dot_c1_schema_ensure, dot_c1_vocab_build, guard_write_once, manifest_hash, resolve, run_case, verify_authorization.
• Artifact hashes: c1_build.sql c4fd4cf5…4110; c1_exercise.sql 405154f7…8163.

D — KB readback (this evidence package)

Package path knowledge/dev/laws-new/reports/c1-dryrun-capability-and-execution/ — pre-write count 0 (verified before writing); files uploaded (index + 01 + 02 + 03 + 04 + 04b + 05 + 06 + 07 + 08 + 09 + 10 + 11 + 12 + 13 + codex-review-packet) + rollup at …/reports/macro-c1-dryrun-capability-and-execution-2026-06-22.md. Each upload returned status:created, revision:1. Additive; no prior package documents overwritten.

E — Disposal note

The sandbox cluster is destroyable at any time: pg_ctl -D /tmp/c1_sandbox_2026_06_22/pgdata stop -m immediate && rm -rf /tmp/c1_sandbox_2026_06_22. Nothing in it is load-bearing for governed runtime.