01 — Phase A: Pre-proposal safety check (read-only)

All checks executed read-only on the VPS CODE SSOT before any write.

Repo / SSOT state (VPS /opt/incomex)

check	value
branch	feat/s177-sprint1-round-a
HEAD	bbf9c436ce1468cc3cddb231a88216ea8ad8ec88
git status --short count	80 (matches baseline)
git diff --name-only count	17

Apply surface — MUST be clean

git diff -- dot/bin/dot-apr-execute dot/bin/dot-apr-propose dot/bin/dot-dot-register → EMPTY (clean). The dirty tree (S177 WIP + ops backups) does not touch any apply binary. Binaries present: dot-apr-execute (27116 B), dot-apr-propose (10138 B), dot-dot-register (5813 B).

⇒ C1_W7_APR_PACKET_HOLD_PREPROPOSAL_SURFACE_UNSAFE does not fire.

Code / authority validity (governed read-only query_pg, db=directus)

check	result
apr_request_types fix_repair_dot exists / status	yes / active (default_action_code=patch_ops_code)
apr_action_types patch_ops_code exists / status / risk	yes / active / high
patch_ops_code handler_ref	dot-apr-execute:patch_ops (implemented v2.1.0)
authorize_build_step handler_ref (baseline)	unimplemented (unchanged)
apr_action_types total	14
approval_requests total (before)	230
governance_build_authorization grants	0

Duplicate / collision guard

• Existing patch_ops_code APRs: 19 (status: applied 12, approved 1, rejected 6) — none pending.
• APRs whose proposed_action targets /opt/incomex/dot/bin/dot-apr-execute AND mention authorize_build_step: 0 → proposing creates no duplicate / dangling twin.
• dot_tools code for dot-apr-execute = DOT-310 (used as target_entity).

Verdict for Phase A

Surface CLEAN · codes valid+active · no duplicate · payload (Phase B) is W7-only. SAFE to proceed to proposal. No production/current-corpus touch; no C2–C7; no W1–W9; no dry-run.