01 — SOURCE REGISTER + FULL GAP MAP — 2026-06-22

1. Controlling sources read directly (this session, via AgentData)

• …/reports/codex/codex-review-ready-to-assemble-lego1-patch1-dry-run-auth-readiness-2026-06-22.md (rev1, len 21336) — official Codex HOLD NEED_READY_TO_ASSEMBLE_LEGO1_PATCH2.
• …/reports/macro-ready-to-assemble-lego1-patch2-2026-06-22.md (rev1, len 5037) — Claude PATCH2 self-HOLD READY_TO_ASSEMBLE_LEGO1_PATCH2_HOLD_DOT_DIRECTUS_PATH_INCOMPLETE.
• …/reports/macro-c1-dryrun-execution-2026-06-22.md (rev1, len 3307) — prior dry-run-execution HOLD C1_DRYRUN_HOLD_TEST_SANDBOX_AUTH_OR_RUNTIME_MISSING.
• Accepted base (by reference): RS5B-CLOSEOUT-PATCH2 lego-readiness seal; READY-TO-ASSEMBLE-LEGO1 + PATCH1.

Reconstructed controlling facts: dispatcher refuses REAL_RUN; dot_iu_create_collection writes IU records (not Directus DDL); C1 contracts/harness/preflight absent; auth status domain excludes granted and holds 0 grants; resolver join empty; the binding closure requirement (Codex §5.1) is "actual registered artifacts and read-only definition evidence — authorization may remain absent; the executable contract may not."

2. Live survey method

VPS contabo, PostgreSQL directus (PG 16). All catalog reads via query_pg (read-only role, AST-validated, read-only transaction). Write routes probed with explicit non-mutating reachability probes (denials fire before execution). One docs-channel authoring write performed and disclosed. No governed-DB / runtime mutation. No subagents.

3. FULL GAP MAP — all dry-run prerequisites

Columns: prerequisite · exists now · evidence · needed for dry-run · closable in this macro · closure action · closure evidence · remaining gap.

#	Prerequisite	Exists	Evidence	Needed	Closable here	Closure action attempted	Result	Remaining gap
1	C1 executable contract (DOT_C1_*)	NO	E3 contracts=2, c1=0	YES	NO	register requires DDL + governed write	blocked	YES
2	DOT_C1_SCHEMA_ENSURE	NO	E2/E4 no schema-ensure primitive	YES	NO	needs CREATE FUNCTION (DDL)	blocked	YES
3	DOT_C1_VOCAB_BUILD	NO	E3	YES	NO	needs contract + function	blocked	YES
4	DOT_C1_VOCAB_VERIFY	NO	E3	YES	NO	needs contract + function	blocked	YES
5	C1 Directus collection/schema	NO	E7 directus_create DENIED; E2 absent	YES	NO	collection not in write allowlist; no DDL	blocked	YES
6	C1 table_registry entry	NO	E2 table_registry exists, no C1 row; E7 write denied	YES	NO	cannot write registry (allowlist)	blocked	YES
7	C1 manifest/resolver	NO (design only)	E5 resolver join empty (prior); no governed selection	YES	PARTIAL	can spec + hash a candidate snapshot (paper)	design-only, not registered	YES
8	C1 canonical serialization/hash	PARTIAL	cser-v1 pinned in PATCH2 (digest 2ab1f90b…)	YES	PARTIAL	recomputable over a candidate set	not bound to a registered manifest	YES
9	C1 authorization verifier	NO (spec only)	E5 status domain; PATCH2 spec	YES	NO	needs governed handler (function)	blocked	YES
10	test/sandbox grant path	NO	E5 grants=0, leases=0, ownership=0; no esign authority	YES	NO	cannot create grant (no write, no authority)	blocked	YES
11	C1 preflight view/function	NO	E2 only birth/dotkg/rp preflight views	YES	NO	needs CREATE VIEW/FUNCTION (DDL)	blocked	YES
12	C1 dry-run dispatcher route	NO	E1 dispatcher refuses REAL_RUN; no C1 contract to dispatch	YES	NO	nothing to dispatch	blocked	YES
13	C1 bad-input harness	NO	E4 only IU-BCF harness	YES	NO	needs function + fixtures	blocked	YES
14	C1 evidence writer/readback	NO	E2 no C1 surface	YES	NO	needs C1 tables	blocked	YES
15	C1 rollback/dismantle path	N/A	nothing created to roll back	YES (if state)	N/A	no state created	clean by absence	NO (vacuous)
16	runtime gate flags open	NO	E6 all gates closed	YES (for real-run)	NO	owner-only dot_config flip	not authorized	YES
17	executor health / write channel	NO (for C1)	E7/E8/E10 no governed write/DDL channel	YES	NO	all channels denied/insufficient	blocked	YES
18	clean-state check	YES	E2 baseline = no C1 surface	YES	YES	before/after readback	diff ∅	NO

Closable inside C1 test/sandbox scope this session: 0 of the 14 blocking prerequisites. The root cause is a single irreducible external-capability gap (#1–#6, #9–#14, #16–#17 all reduce to it): no governed write/DDL channel and no isolated sandbox lane.

4. Root-cause chain

No DDL channel (CREATE TABLE/FUNCTION) + governed write allowlist excludes C1 & the contract registry + no isolated sandbox DB/schema ⇒ cannot create the C1 table/functions ⇒ cannot register DOT_C1_* contracts ⇒ no preflight/harness/dispatch route ⇒ dry-run not dispatchable. Every downstream gap inherits from the channel gap. Per macro §5, this is the point at which HOLD is permitted — all known paths surveyed, all safe self-service closures attempted or proven impossible, remaining blocker is external capability.