02 — REUSE-FIRST PROOF (no DOT-approved staging primitive exists)

Goal: before staging anything new, prove there is no existing DOT-approved (1) staging primitive or (2) schema/table create/drop runner usable for an isolated, non-official lane.

Evidence A — filesystem scan of /opt/incomex/dot/bin (290 scripts)

Grep for stag|sandbox|schema|collection|create|drop|c1|vocab|verif|harness|evidence|readback|registr|migrat|ddl|table|provision|ephemeral|teardown|retire. Matches are all official-runtime oriented. Representative:

• dot-schema-apply, dot-schema-ensure, dot-schema-*-ensure (blog, knowledge, tasks, …) → ensure official Directus/PG schema. Target = production runtime.
• dot-collection-create, dot-collection-register, dot-collection-field-sync → create/register official Directus collections (CAT-006 catalog surface). Forbidden here.
• dot-entity-retire, dot-nrm-retire, dot-matrix-retire → retire official entities. Not a sandbox-drop.
• dot-birth-*, dot-schema-birth-registry-ensure → official khai-sinh/birth lifecycle.
• *-verify family → read-only verifiers for official objects.

No dot-staging-*, dot-sandbox-*, dot-c1-staging-*, dot-*-sandbox-create/-drop, dot-ephemeral-*, dot-*-teardown, dot-*-provision exists.

Evidence B — dot_tools registry search (directus DB)

120 rows returned for the same keyword set: every one is a schema-ensure, collection, registry, migration, or verify tool for official runtime. None is a disposable staging sandbox runner. (e.g. DOT-063 dot-schema-apply, DOT-068 dot-schema-ensure, DOT_COLLECTION_CREATE, DOT-077 dot-schema-table-registry-ensure …)

Evidence C — governance tables search (191 matched in public)

All *_registry / *_ledger / birth_* / lifecycle_* tables are official governance substrate (axis_registry, birth_admission_permit, birth_registry, lifecycle_log, qt001_*_registry, table_registry, trigger_registry, …). No staging_registry, sandbox_registry, dot_staging_*, or any disposable staging ledger exists.

Evidence D — DOT spec docs

/opt/incomex/dot/specs → NONE matching staging/sandbox/c1/provision.

Why the existing schema/collection runners are NOT usable (option 2 fails)

The addendum's option 2 ("existing DOT-approved schema/table create/drop runner") requires a runner that can target an isolated, disposable, non-official namespace. Every existing runner writes to official runtime (official PG schema, official Directus collections, official registries). Invoking any of them would:

• modify official dot_tools / CAT-006 / registries → forbidden boundary breach, and/or
• require the high-risk APR quorum / patch_ops_code path → forbidden (no production quorum).

There is no existing unquorumed, staging-scoped, governed PG-write channel.

Conclusion

Options 1 and 2 are exhausted → option 3 applies: stage the smallest missing primitives (dot-staging-sandbox-create, dot-staging-sandbox-drop, dot-c1-staging-vocab-build, dot-c1-staging-verify, dot-c1-staging-bad-input-harness, dot-c1-staging-evidence-readback), each carrying the full 8-facet lifecycle. See docs 03–06.